Files

2026-05-27 23:29:53 +01:00

198 KiB

Raw Permalink Blame History

Status

Single source of truth for every package planned, in-flight, or shipped on genesis. Edit by hand when status changes; regenerate from disk + SUMMARY.md whenever the auto-gen sources are refreshed (see Maintenance below).

Companion docs:

SUMMARY.md — auto-generated package summaries (completed / pending / genesis-original) with full descriptions.

MANIFEST.md — auto-generated dep graph + tier overlay (bun scripts/folder-reorg/generate-manifest.ts).

MISSING.yml — auto-generated machine-readable list of packages not yet on disk (bun scripts/generate-missing.ts).

MIGRATION.md — Vaulted password-manager migration plan (future reference, not active OpenSpec work).

Legend

Symbol	Meaning
✅	Migrated. Source is on `genesis` and the package builds. Folder under `packages/` is populated.
–	Yet to be migrated. Source exists in `../suaveplan/` (main branch) but has not been ported, or the genesis folder is a placeholder waiting on its OpenSpec change.
❌	Hasn't been written yet. Net-new package — not in `suaveplan` and no genesis source. Typically scheduled in `MIGRATION.md`.

Counts

Status	Count
✅ Migrated	387
– Yet to be migrated	152
❌ Hasn't been written yet	7
Total tracked	501

Packages

`api`

Package	Status	Info
`@suaveplan/api`	✅	Hono orchestrator + middleware framework: SuaveApp composition-via-DI, AppBuilder fluent API with auto-wired tenant resolver, 6-state monotonic FSM, multi-source Zod config loader (file→env-file→env-vars), name-addressable MiddlewareChain (fail-fast insert), full SuaveplanError statusCode passthrough, configurable health routes, opt-in single RequestContext ALS, 5 API.* codes
`@suaveplan/api-gateway`	–	API gateway with routing, load balancing, circuit br...
`@suaveplan/api-manifest`	✅	Stage-1 contract package for the API plugin foundation. Composite Zod `pluginManifestSchema` (`.strict()` at top level) covers every documented `plugin.json` key from design §3 — identity / compat / isolation / permissions / dependsOn / routes / graphql / websockets / sse / sagas / twoPhaseCommit / database / jobs / events / secrets / config / scopes / telemetry / openapi / errors / uninstall. `parseManifest` (throw-form) and `parseManifestSafe` (discriminated `ParseResult`) over the same schema. Four cross-field validators that Zod alone can't express: `validateSagaOwnership`, `validatePermissionsWhenSandboxed`, `validateOpenApiRequiresGraphqlOrRoutes`, `validateErrorStatusMapShape` — each batch-mode, every offender surfaced in one pass. `resolveInstallOrder` is a deterministic Kahn topological sort with lexicographic tie-breaking; cycle path + missing-dep + version-mismatch surface stable error codes. `resolveCapabilities` reports required-missing / version-mismatch as errors and optional-missing as warnings. `hashManifest` returns `sha256:<hex>` over canonical JSON (deep key-sort, cycle/bigint/NaN-reject). `runManifestConformance` harness for downstream parsers. Eleven `MANIFEST.*` codes, every one production-path-reachable (spec-conformance-test enforced). 109 tests, 100/100/100/100 coverage. Deps: `@suaveplan/api-types`, `@suaveplan/error`, `@suaveplan/types`, `zod`.
`@suaveplan/api-migrations`	✅	Dialect-agnostic DB migration runner: MigrationAdapter per dialect (SurrealQL/Postgres/SQLite shipped, MySQL slot open), real SHA-256 checksum validation, AbortSignal cancellation, dry-run, OTel emitters, 6 MIGRATION.* codes
`@suaveplan/api-openapi`	✅	OpenAPI 3.1 registry + RouteBuilder with end-to-end Zod inference, widened StandardResponses (400-504 incl. 422/429/503/504), instance-only SchemaRegistry (no global singleton), atomic Hono/registry dual-surface registration via definePluginRoutes, 3 OPENAPI.* codes
`@suaveplan/api-router-worker-bridge`	✅	Stage-3 HTTP marshaller across the worker boundary: `marshalRequest`/`rehydrateRequest` + `marshalResponse`/`rehydrateResponse` (tagged-union body: `none`/`inline`/`stream`), default header deny-list (`authorization`/`cookie`/`set-cookie`/`x-csrf-token`/`proxy-authorization`), 64 KiB inline cap + 16 MiB hard cap, Zod envelope schemas validated both sides; `ReadableStream<Uint8Array>` transport over `api-worker-rpc` `stream-chunk`/`stream-end`/`stream-ack` frames with window=16 backpressure; `createMainBridge(port)` / `createWorkerBridge(port, handler)` over a single `MessagePort` with multiplex by correlation id; worker-side `SuaveplanError` round-trips via `errorToEnvelope`; `createInProcessBridge` + `runBridgeConformance` harness; 4 `ROUTER_BRIDGE.*` codes (`MARSHAL_FAILED`, `BODY_TOO_LARGE`, `STREAM_INTERRUPTED`, `RESPONSE_INVALID`); no raw `Request` reference ever crosses the wire; 72 tests / 100/100/100/100 coverage.
`@suaveplan/api-worker-rpc`	✅	Stage-3 root: MessagePort RPC protocol — Zod-validated `WorkerRpcMessage` discriminated frames (request/response/cancel/progress/stream-/hello/goodbye), CorrelationIdGenerator + pendingRegistry, `createWorkerRpcClient<T>(port)` Proxy + `serveWorkerRpc(port, handlers)`, streaming via AsyncIterable + backpressure policy, AbortSignal forwarding via cancel frames, SuaveplanError round-trip via ErrorEnvelope codec, cloneable-guard, 10 `WORKER_RPC.` codes, `runWorkerRpcConformance` harness. 122 tests / 100/100/100/100.
`@suaveplan/api-worker-host`	✅	Stage-3 worker-side runtime hosting exactly one plugin: `bootstrapWorkerPlugin` validates manifest + capability handles via Zod, builds frozen RPC-backed capability proxy table over the capability port, mounts `lifecycle.dispatch`/`host.manifest`/`host.state` on the control port, and posts `worker-ready`; `createLifecycleReceiver` runs the nine-state worker FSM with `errorToEnvelope`-reconstructed `LifecycleAck`; `installCrashDetector` wires `uncaughtException`/`unhandledRejection` → `WORKER_HOST.CRASHED`; 9 `WORKER_HOST.*` codes; `runWorkerHostConformance` in-process simulator. 55 tests / 100/100/100/100.
`@suaveplan/api-logger-worker-proxy`	✅	Stage-3 worker → main logger proxy: `createLoggerProxyClient(port, plugin)` returns `LoggerLike` with plugin pre-tagging + OTel `TraceProvider` + injectable `ClientClock`; `createLoggerProxyServer(port, logger, options?)` with redaction passthrough, level narrowing, child-logger cache, observation hooks. `LogBatcher` with size/idle/error-flush + bounded outstanding-batch budget. `ControlChannelSender`/`mountControlChannelReceiver` for `disable`/`enable`. 5 `LOGGER_PROXY.*` codes; `runLoggerProxyConformance` harness. 66 tests / 100/100/100/100.
`@suaveplan/api-jobs-worker-proxy`	✅	Stage-3 jobs proxy: bidirectional `MessagePort` bridge implementing `capabilities.JobRegistrationHandle`. Worker `registerCron`/`registerQueued` calls store closures in `HandlerRegistry` and marshal `registerJob` RPC to main; main-side validates against manifest whitelist then wires registration into host's real handle. Scheduler ticks dispatch `runJob` back to the worker; `runWithTimeout` enforces per-handler budgets. 5 `JOBS_PROXY.*` codes. 44 tests / 100/100/100/100.
`@suaveplan/api-events-worker-proxy`	✅	Stage-3 worker-tier proxy over a main-process `EventBus`. `createEventBusProxyServer(port, bus)` mounts the bus over `@suaveplan/api-worker-rpc`; `createEventBusProxyClient(port)` returns `EventBus`-shaped surface. Subscriptions are long-lived streaming RPCs; Zod-validated payload codec + structured-clone safety probe reject non-cloneable payloads with `EVENTS_PROXY.UNSERIALISABLE_PAYLOAD`. Per-subscription `highWaterMark` backpressure. 4 `EVENTS_PROXY.*` codes. 77 tests / 100/100/100/100.
<<<<<<< HEAD
`@suaveplan/api-events-in-memory`	✅	Stage-5 in-memory `EventsBus` adapter for the API testing kit. `createInMemoryEventsBus(options?)` (alias `createInMemoryEventBus`) wraps a fresh `@suaveplan/events` `EventBus` with a per-topic recording layer: `publish`/`publishAsync`/`emit` append payload to history BEFORE dispatch so `bus.published(topic)` returns every payload since the last `reset()` (or construction) in publish order even when subscribers throw. Subscribers fire through the real production bus (FIFO delivery, `once`, `off`, dispose unsubscribe). `emit(topic, payload)` satisfies the structural `CapabilityEventBusLike` contract from `@suaveplan/api-types/capabilities` so the bus can be handed to plugins as their `events` capability directly. Strict-throw history overflow via cap-bounded `History` ring (`maxHistoryPerTopic` default 1000; positive-integer Zod boundary rejects `0`, negatives, fractions, and unknown keys via `.strict()`). 2 `EVENTS_IN_MEMORY.*` codes (`HISTORY_OVERFLOW` with `{topic, limit}` context, `INVALID_OPTIONS` carrying `z.ZodError` cause). `./testing` subpath ships `createInMemoryEventsBusHarness({maxHistoryPerTopic?})` returning `{bus, waitFor(predicate, {timeoutMs=1000, intervalMs=5}?), dispose}` with fast-path resolve when the predicate already holds and descriptive timeout messages. `dispose()` clears history AND subscribers. 6 subpath exports (`./bus`, `./adapter` alias, `./history`, `./options`, `./testing`, `./error-codes`). 43 tests across 5 files / 100/100/100/100 coverage. Deps: `@suaveplan/api-types`, `@suaveplan/events`, `@suaveplan/error`, `tslib`, `zod`.

======= | @suaveplan/api-db-sqlite-memory | ✅ | Stage-5 in-memory SQLite database adapter for the api-host testing kit. createSqliteMemoryAdapter(opts?) opens a real bun:sqlite Database (:memory: default or any filename for file-backed fixtures), applies journal_mode=WAL + foreign_keys=ON by default with full per-pragma override ({ ...DEFAULT_PRAGMAS, ...opts.pragmas }), and exposes the canonical AdminDatabaseLike surface — real BEGIN IMMEDIATE/COMMIT/ROLLBACK, real prepare/finalize, real FK enforcement (no shim). createSqliteMemoryDb(opts?) composes the adapter with createTenantScopedSqliteWrapper to return { admin, scoped(tenantId), close }; the scoped surface mirrors @suaveplan/api-db-adapter's rewriter (WHERE/AND injection on SELECT/UPDATE/DELETE preserving ORDER BY/LIMIT/GROUP BY/RETURNING tails, INSERT auto-inject under autoInjectInserts: true or rejection with DB_SQLITE_MEMORY.TENANT_SCOPE_VIOLATION under false, literal + bound-param tenant-mismatch detection, $N positional bind handling, multi-row INSERT/INSERT…SELECT/DDL/record-params all rejected). registerSqliteMemoryEngine() declaration-merges "sqlite-memory" into the api-db-adapter DatabaseEngineRegistry and installs an idempotent disposer-returning factory so createDbAdapter({ engine: "sqlite-memory", url: ":memory:" }) resolves transparently from any Stage-4 caller. runSqliteMemoryMigrations({ plugin, admin, migrationsDir, fs }) is a transactional lexicographic forward-only runner with __plugin_migrations(plugin, version, applied_at) bookkeeping, idempotent re-run, and DB_SQLITE_MEMORY.MIGRATION_FAILED with the offending file on context.file. createInMemorySqliteHarness(opts?) ships the convenience beforeEach/afterEach builder with idempotent cleanup(). 4-code DB_SQLITE_MEMORY_* namespace (OPEN_FAILED, INVALID_OPTIONS, MIGRATION_FAILED, TENANT_SCOPE_VIOLATION), each thrown by a real production path. 5 OTel instruments lazily resolved (api.db.query_duration_ms, api.db.execute_duration_ms, api.db.errors_total, api.db.migrations_applied_total, api.db.migration_duration_ms) — counter + histogram both asserted under an in-memory MeterProvider. 9 subpath exports. 73 tests across 10 files, 100/100/100/100 src coverage. Deps: @suaveplan/api-db-adapter, @suaveplan/api-types, @suaveplan/error, @opentelemetry/api, tslib, zod. |

feat/api-db-sqlite-memory | @suaveplan/api-db-adapter | ✅ | Stage-4 bridge from @suaveplan/db engine adapters to plugin AdminDatabaseLike / TenantScopedDatabaseLike. Open DatabaseEngineRegistry (host calls registerEngine(name, factory) per engine — postgres/sqlite/surrealdb declared in @suaveplan/api-types, third-party engines via declaration merging). createDbAdapter({ engine, url, pool?, tenantColumn, autoInjectInserts, migrationsDir? }) returns { admin, scoped(tenantId), close }; Zod-validated options throw DB_ADAPTER.INVALID_OPTIONS. createTenantScopedWrapper(admin, tenantId, opts?) rewrites SQL: WHERE/AND tenantColumn = ? on SELECT/UPDATE/DELETE (ORDER BY, LIMIT, RETURNING, GROUP BY tails preserved); INSERT auto-injects column when autoInjectInserts: true or rejects with TENANT_SCOPE_VIOLATION (also for conflicting literal/bound tenant value); DDL + multi-row INSERT + record-shaped params + named params all rejected at the boundary. createUnsafeGate({ plugin, capabilities, admin }) exposes db.unsafe.query/execute gated by db.unsafe-queries capability declaration; permitted calls increment plugin.unsafe_query_total{plugin}; absent declaration throws UNSAFE_NOT_PERMITTED. runMigrations({ plugin, admin, migrationsDir, fs }) applies lexicographic *.sql files inside engine transaction (when supported), records versions in __plugin_migrations(plugin, version, applied_at), idempotent on re-run, MIGRATION_FAILED with cause + file context. createDbAdapterWorkerProxy({ port, engine }) wires @suaveplan/api-db-worker-proxy/worker-side into the same surface for plugins running inside worker hosts (cursor streaming preserved). 5 DB_ADAPTER.* codes (TENANT_SCOPE_VIOLATION, UNSAFE_NOT_PERMITTED, MIGRATION_FAILED, ENGINE_UNSUPPORTED, INVALID_OPTIONS). 3 OTel instruments (plugin.unsafe_query_total, api.db.migrations_applied_total, api.db.migration_duration_ms) all lazily-resolved via getMeter for test-MeterProvider compatibility. 63 tests / 100/100/100/100. Deps: @suaveplan/api-types, @suaveplan/api-db-worker-proxy, @suaveplan/db, @suaveplan/error, @opentelemetry/api, tslib, zod. | | @suaveplan/api-db-worker-proxy | ✅ | Stage-3 worker → main DB adapter proxy. createDbProxyServer(port, db) mounts AdminDatabaseLike on a MessagePort; createDbProxyClient(port, { engine }) returns proxy + streaming cursor(sql, params, { signal? }). Transactions auto-commit/auto-rollback; leaked tx handles throw DB_PROXY.TRANSACTION_LOST. Prepared statements survive multiple round-trips. Cursor rows stream as stream-chunk frames; consumer abort propagates. wrapTenantScoped(adminProxy, tenantId) is the worker-side type-level facade. 4 DB_PROXY.* codes. 72 tests / 100/100/100/100. | | @suaveplan/api-router | ✅ | Stage-1 contract package for the API plugin foundation. Abstract Router class (8 verbs incl. all with 2- and 3-arg overloads + mount prefix composition + match resolution + collidesWith + use middleware chain) with reference in-memory implementation; host-side RouterRequest/RouterResponse shapes + immutable ResponseBuilder (ok/jsonResponse shortcuts, ETag, Server-Timing, streaming toggle); MapHeaders case-insensitive store; Zod-validated routeOptionsSchema (auth, summary, tags, request/responses with structural Zod predicate accepting cross-realm schemas, runtimeValidation/openapi defaulting true, streaming defaulting false, csrf, idempotent, discriminated rateLimit: {rpm} | {rps}); onion-model Middleware + composeMiddleware with double-next() rejection; 11-step PipelineStep literal + PLUGIN_INSERTION_STEP="post-validation" + assertPluginInsertionStep guard; RouteMatch + frozen createRouteMatch; BlueGreenSlot interface + InMemoryBlueGreenSlot reference impl (atomic flip returning DrainingHandle, acquire/release pending bookkeeping, dispose race-with-AbortSignal on timeout); frozen 5-entry ROUTER_CODES (ROUTE_COLLISION, INVALID_PREFIX, MIDDLEWARE_INSERTION_DENIED, SLOT_FLIP_FAILED, SLOT_DISPOSE_TIMEOUT) — every code thrown by a production path + spec-conformance test enumerating reachability; runRouterConformance(factory) adapter harness + makeNoopSpan/makeFixtureRequest helpers. 9 subpath exports. 125 tests across 16 files, 100/100/100/100 coverage. Deps: @suaveplan/api-types, @suaveplan/error, @suaveplan/types, tslib, zod. | | @suaveplan/api-router-in-memory | ✅ | Stage-5 in-memory Router + PipelineRouter adapter. Single concrete InMemoryRouter class extends abstract Router from @suaveplan/api-router (inheriting verb registration, mount/prefix rewriting, collision detection, param parsing) AND exposes the pipeline facet (registerPipelineRoute, unregisterPipelineRoute, unregisterPipelinePlugin, listPipelineRoutes, matchPipeline) structurally compatible with @suaveplan/api-host's PipelineRouter/PipelineRoute contracts. PipelineRouteTable Map-backed metadata store: cross-plugin collision throws ROUTER_IN_MEMORY.ROUTE_COLLISION; same-plugin re-registration overwrites (hot-reload path); URL-decoded :param extraction; trailing-slash + case normalisation. InMemoryBlueGreenSlot thin extension of api-router's reference impl. Zod-validated constructor options throw ROUTER_IN_MEMORY.INVALID_PREFIX on invalid plugin label. createInMemoryRouterHarness() bundles a fresh router + pinned slot factory for downstream foundation/plugin tests. 50 tests across 7 files including BOTH conformance suites (runRouterConformance from @suaveplan/api-router/testing AND runPipelineRouterConformance from @suaveplan/api-host/testing); 100/100/100/100 coverage. Subpath exports: ./adapter, ./blue-green-slot, ./pipeline, ./testing, ./error-codes. No HTTP listener, no socket — production-grade in-memory adapter, not a test double. Deps: @suaveplan/api-host, @suaveplan/api-router, @suaveplan/api-types, @suaveplan/error, tslib, zod. | | @suaveplan/api-router-hono | ✅ | Stage-4 concrete Hono Router adapter. HonoRouter subclasses the abstract Router and mirrors every verb registration (get/post/put/patch/delete/head/options/all) onto a private Hono instance; getHonoApp() exposes the underlying app for ops integrations; createHonoRouter() factory returns the abstract Router surface so runRouterConformance accepts it unchanged. HonoBlueGreenSlot implements BlueGreenSlot with O(1) atomic flip, pending-counter acquire/release, AbortController per slot, dispose(timeoutMs) racing a timer against drain settle and aborting on timeout (ROUTER.SLOT_DISPOSE_TIMEOUT), flip() without a shadow throws ROUTER.SLOT_FLIP_FAILED. toHonoMiddleware/fromHonoMiddleware bridge the genesis onion-model Middleware ↔ Hono MiddlewareHandler; bridge wraps Hono-side throws in RouterHonoError (ROUTER_HONO.HONO_INTERNAL_ERROR). 2-entry ROUTER_HONO_CODES (HONO_INTERNAL_ERROR, INVALID_HONO_PEER) — every code thrown by a production path. 50 tests across 5 files including full runRouterConformance invocation, 100/100/100/100 coverage. Deps: @suaveplan/api-router, @suaveplan/api-types, @suaveplan/error, tslib, zod; hono peer ≥4.0.0. | | @suaveplan/api-plugin | ✅ | Plugin-system foundation: definePlugin / PluginRegistry with 4-phase lifecycle, deterministic topo-sort, AbortSignal-enforced timeouts, type-safe ServiceRegistry via module augmentation, priority-ordered HookExecutor, 10 PLUGIN.* codes | | @suaveplan/api-tenant | ✅ | Multi-tenant resolution: canonical Tenant type, 6 resolver strategies + TenantCache (TTL + negative + request-coalesce), single c.get("tenant") key, fail-closed NullTenantContext, pluggable rate-limit store with LRU bound, opt-in ALS, tenantScopes plugin opt-out, 7 TENANT.* codes | <<<<<<< HEAD | @suaveplan/api-tenant-resolver-jwt | ✅ | Stage-4 tenant-resolver adapter: reads Principal.tenantId (or a configurable claim from Principal.claims) attached by an earlier api-auth-* chain step and projects it into a TenantContext; returns null (chain-advance sentinel) when the claim is absent, throws TENANT_RESOLVER_JWT.PRINCIPAL_MISSING_TENANT_ID only under strict-mode (requirePrincipal: true); Zod-validated options at construction time (TENANT_RESOLVER_JWT.INVALID_OPTIONS); injectable PrincipalExtractor (default reads request.principal); self-conformance harness covers id stability, return-shape contract, request immutability, concurrent fan-out; 31 tests, 100/100/100/100 coverage. Deps: @suaveplan/api-types, @suaveplan/error, zod. | ======= | @suaveplan/api-tenant-provider-memory | ✅ | Stage-4 in-memory reference TenantProvider adapter. createMemoryTenantProvider({ tenants? }) returns a MemoryTenantProvider (abstract contract + out-of-band add/remove/clear admin helpers) backed by an insertion-ordered Map<TenantId, TenantRecord> for deterministic list() output and O(1) lookup/count. Honours the contract's active-only-default filter (includeSuspended lifts to active+suspended; archived reachable only via lookup) and the canonical encodeCursor/decodeCursor codec from @suaveplan/api-tenant-provider/pagination, including pageSize clamp + resumable cursor offsets. Every record entering the store passes through tenantRecordSchema at the boundary — seed, add(), and options shape all validated. 3 TENANT_PROVIDER_MEMORY.* codes (DUPLICATE_TENANT, TENANT_NOT_FOUND, INVALID_RECORD), each thrown from at least one production path. Idempotent dispose() clears the store. Passes runTenantProviderConformance({ label: "memory" }) verbatim. 25 tests, 100/100/100/100 coverage. Deps: @suaveplan/api-tenant-provider, @suaveplan/api-types, @suaveplan/error, tslib, zod. | feat/api-tenant-provider-memory | @suaveplan/api-plugin-admin | – | Admin panel plugin | | @suaveplan/api-plugin-analytics | – | Product analytics, funnel/cohort analysis | | @suaveplan/api-plugin-audit | ✅ | Hono audit-trail plugin wrapping @suaveplan/audit-logging. Global middleware records {method, path, status, duration_ms, response_size, request_id, principal_id, tenant_id} per request with severity classification (info<400, warning<500, error otherwise). Configurable sampling (head-end RNG gate), exclude paths (health probes default), case-insensitive header redaction + exact query/body field redaction, optional JSON body capture. c.get("audit") exposes handler-level log() + getLogger() via Hono ContextVariableMap augmentation. auditService typed slot in ServiceRegistry. Sink failures never throw into the request — logged at warn + counted via audit.sink_failures_total. 4 AUDIT_PLUGIN_* codes; 4 OTel instruments (requests_recorded_total{outcome,sampled}, requests_excluded_total, sink_failures_total, middleware_duration_ms). 65 tests inc. 1000-request sampling integration in [400, 600] band. 100/100/100/100 coverage. | | @suaveplan/api-plugin-auth | ✅ | Better-Auth-first authentication plugin. Canonical 6-step onInit lifecycle (resolve services → apply schema via injected MigrationRunner → construct Better-Auth via injectable factory → register authService in ServiceRegistry → register routes via definePluginRoutes → install global session-resolver middleware that sets typed c.get("user") + c.get("session") via Hono ContextVariableMap augmentation). 9 OpenAPI routes (sign-up, sign-in, sign-out, session, forgot-password, reset-password, verify-email, oauth-start, oauth-callback) via RouteBuilder PLUS catch-all app.all("/auth/*", auth.handler) so Better-Auth's full router surface is reachable while OpenAPI documents the 9 canonical paths. 4 middleware factories: sessionMiddleware, requireAuth, requireRole, requireEmailVerified. Principal + mapBetterAuthUserToPrincipal (canonical genesis identity). 10 AUTH.* codes, every one thrown from a real call site. 5 OTel instruments (sessions_resolved_total, session_resolve_duration_ms, role_check_total, signups_total, signins_total). 122 tests including 5 real-SurrealDB-testcontainer integration tests (full sign-up → sign-in → /session → sign-out roundtrip; OpenAPI doc lists 9 routes; schema-apply idempotency). 100/100/100/100 coverage. | | @suaveplan/api-plugin-campaigns | ✅ | Hono campaigns/suppression/webhooks API plugin (18 routes) with OpenAPIHono boundaries, Surreal + in-memory repositories, local CampaignSuppressionStore (channel-scoped) | | @suaveplan/api-plugin-cms | ✅ | Content management plugin | | @suaveplan/api-plugin-database | ✅ | Database management plugin (Path A: wraps SurrealAdapter). 88 tests, 100% coverage. Shipped parallel session. | | @suaveplan/api-plugin-event-bus | ✅ | Genesis-native typed event-bus plugin wrapping @suaveplan/events. createEventBusPlugin(options) factory. Canonical 6-step onInit: resolve app + optional openAPIRegistry → construct EventBus (interceptors + bounded queue + idempotency) → register eventBusService slot → install requestBusMiddleware setting c.set("eventBus", scopedHandle) via ContextVariableMap → optionally mount 3 routes (POST /event-bus/publish, GET /event-bus/subscriptions, DELETE /event-bus/subscriptions/:id) gated by requireAuth(). Per-tenant scoping via scopeTopic/unscopeTopic auto-prefixing with tenant:<id>: from c.get("tenant")?.id (tenant id validated against stricter sub-regex to block prefix smuggling). Topic name validation ^[a-z0-9_\-:.]+$. 8 EVENT_BUS_* codes; 5 OTel instruments (published_total{outcome,topic_root}, dropped_total{policy}, duplicates_total, subscriptions_active, publish_duration_ms). 135 tests inc. tenant-isolation + http-routes integration suites. 100/100/100/100 coverage. | | @suaveplan/api-plugin-events | ✅ | Events management plugin (social/calendar — RSVPs, meetups, ICS export — not yet shipped; distinct from api-plugin-event-bus) | | @suaveplan/api-plugin-export | ✅ | Data export plugin (CSV, JSON, XLSX) with streaming + RBAC scoping. 77 tests, 100% coverage. Shipped parallel session. | | @suaveplan/api-plugin-file-upload | ✅ | Multipart + chunked file uploads with validation. 6 routes under basePath (default /uploads): POST / single-shot (10 MiB default cap), POST /initiate + PUT /:uploadId/chunks/:chunkIndex + POST /:uploadId/complete chunked (1 GiB default cap, 5 MiB default chunk), DELETE /:uploadId abort, GET /:uploadId status. All requireAuth()-gated + scoped to c.get("user")!.id + tenant (foreign uploadId → 404 anti-enumeration). MIME validation via @suaveplan/mime with magic-bytes sniff cross-check (PNG/JPEG/GIF/WEBP/PDF/ZIP baseline) to detect Content-Type spoofing. Executable-MIME denylist on by default. SHA-256 hash verification on chunked complete; assembler + verifyHash helpers. Pluggable UploadStorage (MemoryUploadStorage + FileSystemUploadStorage with path-traversal hardening) + UploadSessionStore (memory default). fileUploadService typed slot. 11 UPLOAD_* codes. 4 counters + 1 histogram. Cleanup scheduler unref()'d, cleared on onClose. 154 tests inc. real-fs 1 MiB / 256 KiB chunked round-trip with simulated-crash resume + MIME spoof rejection + 200-run fast-check property. 100/100/100/100 coverage. | | @suaveplan/api-plugin-graphql | ✅ | GraphQL adapter with schema building. 60 tests, 100% coverage. Shipped parallel session. | | @suaveplan/api-plugin-import | ✅ | Data import plugin (CSV/JSON/XLSX) with progress tracking + transform pipeline. Wrapped onto genesis PluginDescriptor from @suaveplan/api-plugin (upstream's definePlugin shape rewritten). 3 format parsers (csv/json/xlsx), transform pipeline (map/filter/validate stages), in-memory ImportStore with per-job progress events, RFC 7807 problem+json errors via hand-rolled renderer (genesis @suaveplan/error doesn't ship formatErrorAsProblemJson). Hono routes auth-gated via requireAuth(); foreign-owner reads return IMPORT_NOT_FOUND (anti-enumeration). Route errors funnel through app.onError so handler returns stay strictly typed against OpenAPI response codes. Removed 7 @deprecated aliases + duplicate import.service.ts per enterprise/api-plugin-import.md §3. 158 tests across 13 files (csv 29, json 7, xlsx 7, transform 24, progress 8, store 8, service 34, problem-json 6, build-routes 14, plugin 11, conformance 4, otel 2, error-codes 4). 100/100/100/100 coverage (statements 593/593, branches 347/347, functions 104/104, lines 554/554). | | @suaveplan/api-plugin-rate-limit | ✅ | Hono rate-limit plugin wrapping @suaveplan/rate-limiter. createRateLimitPlugin(options) factory + standalone rateLimit({service}) middleware. RateLimitService typed slot in ServiceRegistry: check({ip, tenantId?, path, method}), reset(key), config. Default global app.use("*", rateLimit(...)) (secure-by-default); per-route mount available. Hono-compatible path patterns (exact, /*, inline *, :param). 429 response: RFC 7807 Problem+JSON body + Retry-After header. Three header families on every response: X-RateLimit-* (default), RFC 9238 RateLimit-*, both. Tenant multiplier applied to numeric limit. c.set("rateLimit", decision) via ContextVariableMap. Pluggable RateLimitStorage (bundled MemoryStorage default; Redis caller-supplied). 5 codes (INVALID_INPUT, SERVICE_NOT_AVAILABLE, LIMIT_EXCEEDED, STORAGE_FAILURE, INVALID_PATH_PATTERN). 4 OTel instruments. 75 tests, 100/100/100/100. | | @suaveplan/api-plugin-search | ✅ | Full-text search plugin with relevance scoring, Typesense-backed via @suaveplan/testing-integration-typesense. 125 tests, 100% coverage. Shipped parallel session. | | @suaveplan/api-plugin-site | ✅ | Site management plugin | | @suaveplan/api-plugin-social | – | Social features plugin | | @suaveplan/api-plugin-sse | ✅ | Server-Sent Events plugin via native ReadableStream<Uint8Array> (Bun/Node/Workers/Deno portable). createSsePlugin(options) factory; sseService slot: broadcast(channel, event), subscribe({channel, lastEventId?, principalId?, signal?}) returning SubscriptionHandle with AsyncIterableIterator<SseEvent>, close(channel?), stats(). Reads Last-Event-ID for resume; threads AbortSignal on client disconnect; per-connection heartbeat via injectable timer; backpressure via pull-driven drainInto with queueHighWaterMark + overflowPolicy. Bounded RingBuffer per channel with stale-cursor protection. Pluggable Fanout (in-process default; cross-node siblings later). formatSseFrame/parseSseStream wire-format pair shipped. 8 SSE_* codes incl. SSE_UNAUTHENTICATED via requirePrincipal: true. 4 counters + UpDownCounter + Histogram. 102 tests inc. real-fetch round-trip + heartbeat + Last-Event-ID reconnect, 100/100/100/100. | | @suaveplan/api-plugin-tenant | ✅ | Hono plugin exposing @suaveplan/api-tenant's resolver chain as a first-class slot. createTenantPlugin(options) factory; canonical 6-step onInit: resolve host services → build 7-strategy resolver chain (header/subdomain/domain/path/jwt/query/cookie; Query+Cookie contributed locally since api-tenant didn't ship those) → register tenantService → install global middleware setting c.set("tenant", ctx) → optionally mount 5 CRUD routes when store configured → optional rate-limit middleware. tenantService slot: resolveFrom/requireFrom/current/getById/listAll/createTenant/updateTenant/deleteTenant/getResolver. Pluggable TenantStore + default MemoryTenantStore (slug-uniqueness, idempotent soft-delete). Admin RBAC via dynamic import of @suaveplan/api-plugin-auth's requireRole("admin") (declared as optional peer; graceful degrade when missing). Optional TenantCache wrap with OTel cache-outcome instrumentation. Strict Zod schemas on every surface. 7 TENANT_PLUGIN_* codes; 4 OTel instruments. 128 tests inc. header-beats-query priority + NullTenantContext fallback + admin role enforcement. 100/100/100/100 coverage. | | @suaveplan/api-plugin-user | ✅ | User profile plugin on top of api-plugin-auth. 3 routes (GET /users/me, PATCH /users/me, DELETE /users/me) all gated by requireAuth() and scoped to c.get("user")!.id. userService registered in ServiceRegistry (getById, requireById, getCurrent, updateProfile) with module-augmentation typed slot. USER_PROFILE_SCHEMA DDL renderer + applyUserProfileSchema helper supporting both migrationRunner and db transports. UserProfileSchema extends PrincipalSchema from auth plugin; UpdateUserProfileBodySchema is .pick(profileFields).partial().strict() rejecting unknown fields; buildUpdateBodySchemaFor mints per-instance schemas. 7 USER.* error codes, every one thrown. 3 OTel counters (profile_reads_total, profile_updates_total{outcome}, self_deletes_total). DELETE /users/me uses auth.$context.internalAdapter.deleteUser(userId) for cascade. 101 tests including real-SurrealDB-testcontainer integration: sign-up via auth → userService.getById round-trip → updateProfile. 100/100/100/100 coverage. dependencies: ["auth"]. | | @suaveplan/api-plugin-webhook | ✅ | Outbound signed webhook delivery plugin wrapping @suaveplan/webhook-client. createWebhookPlugin(options?) Zod-validated PluginDescriptor with 5-step onInit. WebhookService: send/sendAll/register/update/unregister/listEndpoints/getEndpoint/test. 6 routes (GET/POST /webhooks, GET/PATCH/DELETE /webhooks/:id, POST /webhooks/:id/test) all requireAuth()-gated + tenant-scoped. HMAC-SHA256 signing; canonical headers (X-Webhook-Id, X-Webhook-Event, X-Webhook-Timestamp, X-Webhook-Signature). Per-delivery dedup via @suaveplan/idempotency (fallback in-process Map). Retry with exponential backoff + jitter (maxAttempts default 5); 4xx non-retryable; dead-letter sink on exhaustion. Pluggable EndpointStore + DeadLetterSink (memory defaults). 10 WEBHOOK.* codes. 4 OTel instruments (deliveries_total, dead_letters_total, delivery_attempts, send_duration_ms). 77 tests inc. real node:http receiver on random port asserting signed payload + 3-attempt retry + dead-letter. 100/100/100/100. | | @suaveplan/api-auth | ✅ | Stage-1 abstract session-resolver: SessionResolver + SessionResolverChain (ordered first-match-wins, fail-closed-on-throw, opt-in continueOnThrow), SecuritySchemeContribution (Zod-validated OAS-3.1 discriminated union), CsrfPolicy.requiresCsrf default, composite AuthAdapter (securityScheme now optional for anonymous topology), AUTH_SESSION_CAPABILITY_ID literal, 4-code AUTH_CODES registry, runAuthSessionConformance harness with null-only seedPrincipal mode for the anonymous tail. 55 tests / 100/100/100/100. | | @suaveplan/api-auth-anonymous | ✅ | Stage-4 trivial session resolver — createAnonymousResolver(opts?) always returns null Principal and dispose() is a no-op (idempotent). ANONYMOUS_AUTH_ADAPTER constant pairs the resolver with csrf: false and omits securityScheme (anonymous-only hosts emit OpenAPI with no security entry); validates via validateAuthAdapter. Strict zod options schema rejects non-object / unknown-key input with the single AUTH_ANON.INVALID_OPTIONS code; no per-request failure paths by design. Passes runAuthSessionConformance in null-only mode (null + dispose-idempotent scenarios). 18 tests / 100/100/100/100. Deps: @suaveplan/api-auth, @suaveplan/api-types, @suaveplan/error, tslib, zod. | | @suaveplan/api-auth-static-principal | ✅ | Stage-5 fixed-Principal session resolver — createStaticPrincipalResolver(opts) returns the configured Principal verbatim on every request (no token decoding, no I/O, no state). createStaticPrincipalAdapter(opts) bundles resolver + omitted securityScheme (anonymous-style topology validated by validateAuthAdapter) + pinned csrf: false. applyTo(req) predicate + nullForPaths (exact or /foo/* suffix-glob) drive selective null-return without rewiring the chain. Defensive clone-and-freeze per resolve() so callers cannot mutate one returned Principal and observe the change. Strict Zod boundary with split AUTH_STATIC_PRINCIPAL.{INVALID_OPTIONS, INVALID_PRINCIPAL} codes — principal issues map to INVALID_PRINCIPAL, everything else to INVALID_OPTIONS. Passes runAuthSessionConformance (static-principal-direct) in seeded-principal mode for the recognised scenario and via nullForPaths for the null scenario. 43 tests / 100/100/100/100. Stage-5 api-host/testing adapter-table registration deferred until that surface lands (currently STAGE_2_RESERVED); documented in README. Deps: @suaveplan/api-auth, @suaveplan/api-types, @suaveplan/error, tslib, zod. | | @suaveplan/api-auth-provider | ✅ | Stage-1 abstract account-lifecycle contract (design §2.3). AuthProviderAdapter<Caps> with configurable pathPrefix, four-hook lifecycle. 9-entry PROVIDER_ROUTE_SURFACE (register/login/logout/refresh/oauth.start/oauth.callback/verify-email/forgot-password/reset-password). PathOwnership registry + detectAuthPathCollisions segment-aware containment. 4 AUTH_PROVIDER.* codes. runAuthProviderConformance harness. 79 tests / 100/100/100/100. | <<<<<<< HEAD | @suaveplan/api-auth-bearer-static | ✅ | Stage-4 service-to-service static-token SessionResolver adapter: matches Authorization: Bearer <token> against a fixed token → Principal table via constant-time compare from @suaveplan/crypto-utils; unknown tokens defer to next chain entry. Optional per-entry mutual-TLS gate (mtlsRequired) rejects when host did not surface request.tls.peerCertificate. Configurable headerName/prefix (case-insensitive scheme match per RFC 7235). Ships both direct surface (createBearerStaticResolver) and worker-proxy surface (createBearerStaticResolverWorkerProxy + serveBearerStaticResolverOnPort) over @suaveplan/api-worker-rpc; both pass runAuthSessionConformance. OAS-3.1 HTTP-Bearer securitySchemeContribution, 4-code AUTH_BEARER_STATIC.* registry (only INVALID_OPTIONS thrown; rest surfaced via OTel outcome label), api.auth.bearer_static_match_total{outcome} counter. 67 tests / 100/100/100/100. | ======= | @suaveplan/api-auth-jwt | ✅ | Stage-4 concrete JWT SessionResolver for the API plugin foundation. createJwtSessionResolver(opts) verifies a Bearer JWT (or cookie token) via @suaveplan/jws against either a remote JWKS endpoint (JwksCache: positive TTL, 30s negative cache, in-flight dedup, kid-miss refresh, stale-on-failure) or a single static JWK; enforces iss/aud/exp/nbf with injectable clock + clockToleranceSec. defaultClaimsToPrincipal maps sub/scope+scopes/tenant_id+tid; overridable via options.claimsToPrincipal. JWT_BEARER_SCHEME OpenAPI 3.1 http/bearer/bearerFormat: "JWT" contribution (renameable). Per-request soft failures collapse to null (chain-friendly); infrastructure failures raise the 3-code AUTH_JWT.* registry (JWKS_FETCH_FAILED/INVALID_KEY_FORMAT/INVALID_CLAIMS_MAPPER). Conformance harness runAuthSessionConformance passes against the resolver under jwt-static-key. 92 tests including real-node:http JWKS server with RS256 sign+verify round-trip via @suaveplan/crypto-rsa. 100/100/100/100 coverage. | feat/api-auth-jwt | @suaveplan/api-schemas | ✅ | Shared Zod schemas describing Suaveplan API request/response shapes — single so… | | @suaveplan/api-secrets-env | ✅ | Stage-4 SecretsLike adapter backed by process.env / Bun.env with per-plugin allowed-keys enforcement. createEnvSecrets({ allowedKeys, source?, prefix? }) returns a frozen-shaped instance: Zod-validated options (SECRETS_ENV.INVALID_OPTIONS on bad input); allow-list checked BEFORE source lookup (SECRETS_ENV.KEY_NOT_PERMITTED never reads the snapshot); get() resolves undefined for permitted-but-absent, require() throws SECRETS_ENV.KEY_NOT_FOUND; list() hands out the frozen allowedKeys so the surface cannot enumerate names outside the manifest. Injectable source so tests never mutate the real env; default reads process.env overlaid with Bun.env per call (no constructor cache so rotations are picked up immediately). Optional prefix namespaces lookups (prefix: "BILLING_" → get("API_KEY") reads BILLING_API_KEY). Companion buildEnvSecretDescriptors / descriptorAllowedKeys derive both the manifest secrets[] and the adapter's allowedKeys from one declaration. Secret VALUES never appear in logs/errors — only NAMES on error.context.name. Passes runSecretsConformance (@suaveplan/api-secrets/testing) via isNotFound mapped to SECRETS_ENV.KEY_NOT_FOUND. 3 SECRETS_ENV.* codes; 31 tests / 100/100/100/100 coverage. Deps: @suaveplan/api-secrets, @suaveplan/api-types, @suaveplan/error, tslib, zod. | | @suaveplan/api-ws-broker-in-memory | ✅ | Stage-5 in-process single-host WsBroker implementation of the @suaveplan/api-ws contract. createInMemoryWsBroker(options?) returns an InMemoryWsBroker<Payload> (abstract contract + subscriberCount(topic) + isDisposed() introspection). Per-topic Map<string, Set<RegistryEntry>> registry; publish(topic, envelope) snapshots the subscriber set before dispatch so a handler that unsubscribes mid-fan-out does not skip siblings; per-subscriber failures are individually caught so one bad handler never poisons the broadcast. deliveryMode: "fire-and-forget" (default) dispatches without awaiting; "await-all" Promise.all-awaits every handler. Idempotent dispose() clears the registry and flips a disposed flag — subsequent publish/subscribe throw WS_BROKER_IN_MEMORY.BROKER_DISPOSED; second dispose() is a no-op. Strict-mode Zod options gate throws WS_BROKER_IN_MEMORY.INVALID_OPTIONS on unknown keys or invalid enum values. ./testing subpath ships createInMemoryBrokerHarness(opts?) with a captured-envelope observer, publishOne(payload, opts?) convenience, extraTopics probe-registration, and idempotent teardown. 34 tests / 100/100/100/100 (istanbul); zero direct vitest/bun:test imports (uses @suaveplan/testing/runner). Deps: @suaveplan/api-ws, @suaveplan/api-types, @suaveplan/error, tslib, zod. | | @suaveplan/api-shared | – | Shared API utilities and types | | @suaveplan/api-loader | ✅ | Stage-1 abstract module resolver + RollbackJournal. ModuleResolver<M> types-only contract, RollbackJournal ring-buffer (depth 3) + reference createRollbackJournal, bustSpecifier(url, version) WHATWG-URL cache-bust, persisted Zod schema (sha256 + ISO datetime), NativeBindingDetector + assertNoNativeBindings, 4-code LOADER_CODES, conformance harnesses. 8 subpaths, 75 tests / 100/100/100/100. | | @suaveplan/api-graphql | ✅ | Stage-1 abstract GraphQL contract: createGraphqlRegistry, mergeSdl federation with collision detection + @graphql.namespace wrapper, minimal SDL parser, @auth/@rateLimit directive descriptors, GraphqlEngine lifecycle, graphql-ws subscription protocol Zod schema, runGraphqlEngineConformance harness, 7 GRAPHQL.* codes. Zero engine deps. 82 tests / 100/100/100/100. | | @suaveplan/api-host | ✅ | Stage-2 keystone for the API plugin foundation. Subpaths: ./error-codes (44 codes via defineCodes across HOST_*/PLUGIN_*/RELOAD_*/CAPABILITY_*/ADMIN_*/LEDGER_* namespaces, including the Chunk-D per-request additions TENANT_NOT_RESOLVED/SESSION_REQUIRED/CSRF_TOKEN_INVALID/RBAC_DENIED/RATE_LIMIT_EXCEEDED/REQUEST_VALIDATION_FAILED/RESPONSE_VALIDATION_FAILED/IDEMPOTENCY_REPLAY/ROUTE_NOT_FOUND/HANDLER_THREW/CLIENT_ABORTED), HOST_DEFAULT_STATUS_MAP, HostError; ./define-plugin author DX (definePlugin<Caps> literal-array requires threaded into PluginContext<Caps> + RequestContext<Caps>); ./capability-registry runtime with semver/scope/duplicate validation + reverse-registration-order disposers; ./lifecycle LifecycleDriver driving every §4 transition with per-plugin mutex + crashed/auto-restart + startForReload rollback hand-off; ./hot-reload ReloadDriver blue-green primitive (§8.1) + FileWatcher debounce + persisted RollbackJournal (depth 3) + native-binding guard + 503-window mode; ./plugin-ledger PluginLedger over bun:sqlite with forward-only idempotent HostMigrationRunner, asLifecycleLedger() + asRollbackPersistence() adapter views; ./admin-api Hono sub-router exposing every §8.4 endpoint with host:admin scope, per-principal token-bucket rate-limit (60/min reads, 1/min destructive), Idempotency-Key enforcement, audit envelope; ./error-boundary wraps every pipeline step and projects SuaveplanError → statusMap / AbortError → 499 / unknown → 500 + cause-chain log + api.errors_total; ./request-pipeline implements the §6 11-step driver exactly (tenant → session → CSRF → RBAC → rate-limit → idempotency → request-validate → handler → response-validate → audit → telemetry) with Zod request/response gates, enforce/warn strictness, streaming bypass, full §12.3 counter + histogram emission; ./host createHost(config) composing every internal driver with Zod-validated config, topo-sorted start()/reverse-topo stop(graceMs), host.fetch(request) driving the pipeline, /internal/livez + /internal/readyz probes, runtime installPlugin/uninstallPlugin; ./otel HostInstruments covering every §12.3 counter + histogram; ./testing populated in Stage 5 with createTestHost(config?) — composes the in-memory router/auth/tenant/db/secrets/ws-broker/events/ledger adapters into a running TestHost (extends Host with installFixturePlugin/fetchAs/waitForEvent/dispose), seeds principal/tenants/secrets through override-beats-default slots, exposes STAGE_2_RESERVED=false for Stage-2 detection back-compat, alongside the existing runPipelineRouterConformance harness; Stage-5 smoke (e2e/foundation-stack-test-host) drives every wired slot via Bun.serve + 8 Playwright groups. 287 tests, 100% line coverage on every Chunk-D module + every other src/ module, full pre-publish gate (lint + typecheck + test + build) green. | | @suaveplan/api-types | ✅ | Types-only contract package for the API plugin foundation — Principal/TenantId brands, the PluginManifest type-level view, PluginContext/RequestContext with capability-driven db split (admin vs tenant-scoped), 25-member alphabetised CapabilityId union + CapabilityMap/RequestCapabilityMap lookup, CapabilitySlice<Caps> context narrowing, 13-state PluginState lifecycle union, ErrorCode template literal PLUGIN.<UPPER>.<UPPER>, Router/Middleware/RouteHandler/RouteOptions/RouterSlot/BlueGreenSlot, AuthAdapter/AuthProviderAdapter/SessionResolver/SecuritySchemeContribution, TenantResolver/TenantResolverChain/TenantProvider, SecretsLike/SecretDescriptor, AdminDatabaseLike/TenantScopedDatabaseLike with open-extensible DatabaseEngineRegistry, GraphqlRegistry/Resolver/SubscriptionResolver/LoaderFactory, WsConnection/WsConnectionRegistry/SubscriptionBus/WsBroker, SseConnection/SseBroker, SagaParticipant/SagaInstance/SagaStep/SagaState, TwoPcParticipant/TwoPcVote/TwoPcTransaction, WorkerRpcMessage discriminated union + WorkerProxyOf<T> structural transform with NotCloneable<T> marker, Counter/Histogram/Gauge/InstrumentRegistry, RollbackJournalEntry/RollbackJournal ring-buffer interface. 20 subpath exports, zero runtime, zero deps; byte-size + dep-graph + 11 expectTypeOf conformance suites pinning every cross-cutting invariant. |

`audio`

Package	Status	Info
`@suaveplan/audio-controllers`	✅	Universal-tier MIDI hardware controller plugins. Ships `KontrolS88Plugin` (88-key keyboard with scale modes, arp, pitch-bend, mod-wheel, RGB key LEDs), `MaschinePlugin` (16-pad grid + per-pad step rows + slot-based sample loader), `TraktorS4Plugin` (4-deck DJ controller with mixer, crossfader, per-channel volume). Shared `MidiControllerPlugin` base — injectable `MidiAccessAdapter` seam (zero `navigator` references), `@suaveplan/fsm`-driven `disconnected/connecting/connected/error` connection state with hot-plug recovery, declarative `CCMapping` DSL with Zod boundary validation, learn mode, batched LED output. Transport-synced `Sequencer` and `Arpeggiator` (sample-accurate via `Transport.scheduleRepeat`, offline-renderable, zero `setInterval`). `bindParameter` / `bindPluginPreset` helpers for `@suaveplan/audio-fx-plugin-base` integration with linear/log/exponential scale mapping + optional smoothing curve. 6 `AUDIO_CONTROLLERS.*` codes (`ACCESS_DENIED`, `INVALID_OPTIONS`, `INVALID_STATE`, `DEVICE_ERROR`, `NOT_CONNECTED`, `UNKNOWN_PARAMETER`). OTel tracer + 4 instruments (`audio_controller_midi_messages_total`, `audio_controller_sequencer_steps_total`, `audio_controller_midi_latency_ms`, `audio_controller_sequencer_jitter_ms`) no-op without exporter, no import-time globals. 104 tests, 100/100/100/100 coverage.
`@suaveplan/audio-core`	✅	Universal audio data model and processing primitives: paged AudioDocument, non-destructive PlanEngine, block-level ProcessPipeline, and typed OpRegistry
`@suaveplan/audio-decode-wav`	✅	Genesis-original universal WAV decoder wrapping `@audio/decode-wav` with uniform `AudioDecoder` contract, `AUDIO_DECODE.WAV.*` codes, OpenTelemetry, and chunked-stream + whole-buffer decode paths.
`@suaveplan/audio-engine-browser`	✅	Browser-tier `TimelineAdapter` implementation: Web Audio rendering, AudioWorklet hosting, and `AudioFxPlugin` `createAudioNode()` integration for the universal `TimelineEngine`.
`@suaveplan/audio-engine-server`	✅	Server-tier `TimelineAdapter` implementation: file source/sink adapters and offline render driver for the universal `TimelineEngine`.
`@suaveplan/audio-ir-core`	✅	Genesis-original foundation for the IR family: `ImpulseResponse`, `IrManifest`/`IrManifestEntry` Zod schemas, `IrRegistry` with collision detection, `MutableUriPluginRegistrar` + `createUriPluginCollector`, `AUDIO_IR.*` codes, OpenTelemetry.
`@suaveplan/audio-ir-loader`	✅	Genesis-original IR pipeline: registry → resolver → decoder → manifest validation → frozen `ImpulseResponse`. LRU cache, bounded preload, `AUDIO_IR_LOADER.*` codes, OpenTelemetry.
`@suaveplan/audio-ir-room-plugin-club`	✅	Genesis-original IR content package: ships two bundled WAV room captures (`club1.wav`, `club2.wav`) via the `bundle://` URI scheme. Canonical example of the bundle-only content pattern.
`@suaveplan/audio-ir-room-plugin-pool`	✅	Genesis-original IR content package: ships one bundled WAV (`outdoor-swimming-pool.wav`) paired with a CDN fallback via `fallback://?u=<bundle>&u=<https>`. Canonical example of the bundle + fallback pattern.
`@suaveplan/audio-fx-plugin-audio-analyzer`	✅	Tap-point FFT analyser plugin (member of audio-fx-plugin-* family).
`@suaveplan/audio-fx-plugin-audio-player`	✅	Playback source plugin (audio-fx-plugin-* family).
`@suaveplan/audio-fx-plugin-auto-filter`	✅	LFO-driven filter plugin (audio-fx-plugin-* family).
`@suaveplan/audio-fx-plugin-base`	✅	Foundation for the audio-fx-plugin-amily: AudioFxPlugin contract, PluginChain, ChainContext, AmbientState, BusRegistry, PluginRegistry, ChainSnapshot, ChainEventBus, ParameterSchedule, PresetSnapshot, biquad DSP math, `AUDIO_FX.*` error-code registry. Universal-tier; zero @suaveplan/audio-fx-plugin- deps.
`@suaveplan/audio-fx-plugin-chorus`	✅	Modulated comb / multi-voice chorus plugin (audio-fx-plugin-* family).
`@suaveplan/audio-fx-plugin-compressor`	✅	Feed-forward compressor with sidechain input (audio-fx-plugin-* family).
`@suaveplan/audio-fx-plugin-delay`	✅	Stereo delay with ping-pong + BPM sync (audio-fx-plugin-* family).
`@suaveplan/audio-fx-plugin-distortion`	✅	Waveshaping + soft/hard clip plugin (audio-fx-plugin-* family).
`@suaveplan/audio-fx-plugin-eq`	✅	Parametric / shelving / high-pass / low-pass 8-band equaliser, RBJ Audio EQ Cookbook biquads (audio-fx-plugin-* family).
`@suaveplan/audio-fx-plugin-filter`	✅	Multi-mode filter (biquad / IIR / state-variable) (audio-fx-plugin-* family).
`@suaveplan/audio-fx-plugin-flanger`	✅	Short-delay modulated comb plugin (audio-fx-plugin-* family).
`@suaveplan/audio-fx-plugin-game-audio`	✅	Game-audio orchestration plugin (audio-fx-plugin-* family).
`@suaveplan/audio-fx-plugin-gate`	✅	Noise gate with hold + linked envelope (audio-fx-plugin-* family).
`@suaveplan/audio-fx-plugin-glados`	✅	Pitch-tracked vocal-style effect plugin (audio-fx-plugin-* family).
`@suaveplan/audio-fx-plugin-limiter`	✅	Look-ahead brick-wall limiter plugin (audio-fx-plugin-* family).
`@suaveplan/audio-fx-plugin-microphone`	✅	Source plugin simulating mic colour (audio-fx-plugin-* family).
`@suaveplan/audio-fx-plugin-mixer`	✅	Bus mixer with per-channel sends (audio-fx-plugin-* family).
`@suaveplan/audio-fx-plugin-phaser`	✅	All-pass-bank phaser plugin (audio-fx-plugin-* family).
`@suaveplan/audio-fx-plugin-pitch-shifter`	✅	Phase-vocoder pitch-shifter plugin (audio-fx-plugin-* family).
`@suaveplan/audio-fx-plugin-reverb`	✅	Engine-pluggable reverb (FDN / Schroeder / convolution) (audio-fx-plugin-* family).
`@suaveplan/audio-fx-plugin-sampler`	✅	Sample-playback source plugin (audio-fx-plugin-* family).
`@suaveplan/audio-fx-plugin-spatial`	✅	HRTF-based spatial panner plugin (audio-fx-plugin-* family).
`@suaveplan/audio-fx-plugin-synthesizer`	✅	Polyphonic subtractive synth plugin (audio-fx-plugin-* family).
`@suaveplan/audio-fx-plugin-tremolo`	✅	Amplitude-modulated tremolo plugin (audio-fx-plugin-* family).
`@suaveplan/audio-fx-plugin-widener`	✅	Stereo width / mid-side processor plugin (audio-fx-plugin-* family).
`@suaveplan/audio-metadata`	✅	Universal audio metadata extractor: parses ID3v1/v2, MP4/M4A atoms, FLAC Vorbis…
`@suaveplan/audio-sprite-packer`	✅	Universal audio sprite packer with injectable adapter, Zod-validated boundaries, and OpenTelemetry instrumentation. Zero browser or Node.js dependencies.
`@suaveplan/audio-timeline`	✅	Headless DAW timeline engine with multi-track arrangements, clips, playback, loop regions, selection, zoom, per-track mixer state, undo/redo, and a pluggable TimelineAdapter.
`@suaveplan/audio-transport`	✅	Universal musical clock and transport: sample-accurate scheduling with PPQ, BPM automation, swing, time signatures, and loop regions. Zero browser or Node dependencies.
`@suaveplan/dmx`	–	DMX512 lighting control engine
`@suaveplan/python-audio-fingerprint`	–	High-accuracy audio fingerprinting and matching service
`@suaveplan/r3f-audio`	–	Positional 3D spatial audio (HRTF, culling)
`@suaveplan/r3f-dmx`	–	DMX512 lighting control visualization
`@suaveplan/react-audio`	✅	React surface for the unified audio architecture: `AudioProvider` (strict-mode-safe lifecycle over `BrowserTimelineAdapter` + `PluginRegistry` + `BusRegistry`), 14 hooks via `useSyncExternalStore` for concurrent-safe + SSR-consistent subscription, 17 components (`<PluginSlot>` generic renderer + 12 composed-plugin UIs + `<MidiControllerSetup>` learn-mode), 2 zustand stores, full keyboard + ARIA a11y, Storybook coverage gate enforcing default + interactive + edge-case stories. `REACT_AUDIO.*` error-code namespace, per-component subpath exports. Shipped across 4 sequential changes (`enterprise-react-audio-{foundation,components,components-extras,midi}`).
`@suaveplan/react-audio-fingerprint`	–	Audio fingerprinting components
`@suaveplan/react-audio-player`	–	Modular audio player with 3D viz
`@suaveplan/react-audio-stream`	–	Audio streaming components
`@suaveplan/voice`	✅	Provider-agnostic voice core: abstract interfaces, shared types, Zod schemas, a…

`auth`

Package	Status	Info
`@suaveplan/auth`	✅	Provider-agnostic authentication: JWT lifecycle, API key management, session ma…
`@suaveplan/better-auth-surrealdb`	✅	Better-Auth Adapter for SurrealDB v3. Two factories: v1.4 `createBetterAuthSurrealAdapter` returns the 10-method `CustomAdapter` directly; v1.6 `createBetterAuthSurrealAdapterV16` wraps it via `createAdapterFactory` from `@better-auth/core/db` to satisfy v1.6's `DBAdapterInstance` factory shape (re-invoking the factory inside the transaction callback to thread Better-Auth's full transform pipeline). Bundles canonical 17-table `BETTER_AUTH_SURREAL_SCHEMA` (user/session/account/verification/passkey/jwks/sso_provider/oauth_application/oauth_access_token/oauth_consent/organization/member/invitation/team/team_member/two_factor/api_key + 13 indexes) extracted byte-for-byte from upstream `02-better-auth.surql`, plus `applyBetterAuthSchema(adapter)` helper. `DEFAULT_BETTER_AUTH_LINK_FIELDS` auto-prefixes string userIds → `record<user>` for 9 link tables. RecordId construction routes through `createRequire(import.meta.url)("surrealdb")` to dodge the CJS/ESM class-identity bug in the driver's CBOR encoder. 172/172 tests including real-SurrealDB-testcontainer `signUpEmail` end-to-end roundtrip. 19-requirement spec (14 v1.4 + 5 v1.6).
`@suaveplan/jwt-tenant`	✅	JWT-based multi-tenant token issuance and verification with Ed25519/ECDSA signi…
`@suaveplan/macos-keychain`	✅	macOS Keychain bridge via the `security` CLI: shell-injection-safe `Bun.spawn…
`@suaveplan/oauth-client`	✅	Universal OAuth 2.0 / OIDC client: Authorization Code + PKCE, Client Credential…
`@suaveplan/permissions`	✅	Full RBAC/ABAC permissions engine: Ability/AbilityBuilder, RoleManager, PolicyE…
`@suaveplan/react-auth`	✅	Authentication components
`@suaveplan/react-auth-whitelabel`	✅	White-label auth with tenant branding
`@suaveplan/react-permissions`	–	RBAC/ABAC permission components
`@suaveplan/webauthn`	✅	W3C WebAuthn L3 client: `register` / `authenticate` over injectable `WebAuthnAdapter`, full authenticator-data parser with flags decoder, all 7 attestation-format verifiers (`packed` self+full, `fido-u2f`, `tpm` via `@suaveplan/tpm-struct`, `android-key`, `android-safetynet` via `@suaveplan/jws`, `apple`, `none`) under pluggable registry, COSE_Key parse via `@suaveplan/cbor/cose`, signature verify dispatching to `@suaveplan/crypto-curve` + `@suaveplan/crypto-rsa`, X.509 chain validation via `@suaveplan/x509`, sign-counter regression detection (W3C §6.1.1), PRF + largeBlob extension passthrough, conditional UI, DOMException → typed error mapping with 6 DOM-name → typed-error edges, 17-code error registry, constant-time challenge + rpIdHash compare, 5 OTel instruments. 64 impl + 27 test + 24 sibling `.md` + 8 fixture + 3 benchmark files; 317+ tests; 100% coverage. Side-effects: `decodeOne` re-exported from `@suaveplan/cbor` root barrel (1 line) + `__fixtures__/` namespace anchor + subpath export added to `@suaveplan/x509` (both packages keep 100% coverage).

`barcode`

Package	Status	Info
`@suaveplan/barcode`	✅	Barcode generation and parsing for common 1D symbologies: Code 128, Code 39, EA…
`@suaveplan/qrcode`	✅	QR code generation producing SVG, pixel matrix, terminal (Unicode blocks), and…

`bitpacker`

Package	Status	Info
`@suaveplan/bitpacker`	✅	Core bit-level binary packing: BitWriter, BitReader, BitPacker, strategy manager. Hardened: Zod boundary, `./register-schemas`, OTel instruments + spans on pack/unpack, mitata baseline.
`@suaveplan/bitpacker-compressed`	✅	CompressedBitPacker + RLE/dictionary adapters and registry. Hardened: Zod boundary on adapter + config, `./register-schemas`, OTel instruments.
`@suaveplan/bitpacker-crypto`	✅	Bit-packer-aware crypto primitives — SignedBitSchema, EncryptedBitSchema, EnvelopeSchema, MultiSignedBitSchema, HashChainSchema, schemaFingerprint, crc32/adler32. Skipped from Phase 3 OTel (already instrumented upstream).
`@suaveplan/bitpacker-delta`	✅	DeltaManager, calculateStringDiff/applyStringDiff, numberXor — change detection and diff/patch encoding.
`@suaveplan/bitpacker-game`	✅	GameStateManager, vector quantization, PositionPredictor / RotationPredictor (Kalman + 6 polynomial methods), GameInterpolator (9 methods), StateReconciliation. Hardened: Zod boundary on the 6 option bundles, `./register-schemas`, OTel instruments.
`@suaveplan/bitpacker-network`	✅	NetworkSimulator (latency, jitter, packet loss, burstiness). Hardened: Zod boundary with 0–100 percentage bounds + structural Rng/Clock injection, `./register-schemas`, OTel instruments.
`@suaveplan/bitpacker-schema`	✅	Schema registry, validation, and versioning for @suaveplan/bitpacker.
`@suaveplan/bitpacker-strategies`	✅	22 built-in packing strategies. Hardened: Zod boundary on registerDefaultStrategies, `./register-schemas`, OTel span on bootstrap, fast-check properties on 9 kinds, `_version` forward tolerance via `_tolerance: "strict"\|"forward"` + `_allowedVersions`.
`@suaveplan/bitpacker-streaming`	✅	packToChunks, unpackFromChunks, FramedPack/UnpackStream — Web Streams + length-prefix framing. Hardened: Zod boundary on 9 option bundles + FramingConfig, `./register-schemas`, OTel instruments.
`@suaveplan/bitpacker-validation`	✅	SafetyLimits, SafetyChecker, RecursionGuard, ValidationReport. Hardened: Zod boundary on safety + validator options, `./register-schemas`, OTel instruments.

`commerce`

Package	Status	Info
`@suaveplan/api-plugin-asset-register`	–	Asset register — fixed assets, depreciation, mainten...
`@suaveplan/api-plugin-bank`	–	Game bank with virtual currency + interest
`@suaveplan/api-plugin-banking`	–	Banking/payment plugin
`@suaveplan/api-plugin-payment`	✅	Payment intent lifecycle plugin wrapping `@suaveplan/payment` + provider siblings (`payment-provider-{stripe,adyen,paypal,square}`). `createPaymentPlugin(options)` factory — caller injects `PaymentProvider` (no default). 7 OpenAPI routes all `requireAuth()`-gated + scoped to `c.get("user").id` with 404 anti-enumeration: `POST/GET /payments/intents`, `GET /payments/intents/:id`, `POST /payments/intents/:id/{confirm,capture,cancel,refund}`. Webhook receiver `POST /payments/webhook` mounted as separate sub-router (NOT through `OpenAPIRegistry` so generated SDKs don't expose it) that reads raw body BEFORE Zod parsing for HMAC verification (SHA-256/384/512, 5-min replay window default). `Idempotency-Key` middleware wired to `POST /intents` + `POST .../refund` via `@suaveplan/idempotency` (`MemoryIdempotencyStore` default). Pluggable `PaymentIntentStore` (in-memory default) maps provider IDs back to `(ownerId, tenantId?)`. `FakePaymentProvider implements PaymentProvider` for tests (real interface, in-memory backing). 15 `PAYMENT_PLUGIN_*` codes; 5 counters + 1 histogram (all `provider`-labeled). BigInt amounts serialized as decimal strings. `app.onError` translator converts `PaymentPluginError` → JSON. 153 tests inc. full createIntent → confirm → capture → refund lifecycle + idempotency replay + webhook signature verify + cross-user isolation. 100/100/100/100 coverage.
`@suaveplan/booking`	✅	Universal-tier JSON-configurable booking engine with pluggable strategies — `BookingEngine<TBookableMeta, TBookingMeta>` pipeline (availability → conflict → pricing → rules → state machine → events), in-package `Hooks<TMap>` transform pipeline, configurable `StateMachine` for status transitions, typed `EventBus` for 15 lifecycle events, six domain presets (seats / accommodation / appointments / resources / activities / transport), four built-in conflict detectors (exact_match / range_overlap / slot_capacity / provider_overlap), three availability strategies (exactMatch / rangeOverlap / capacity), eight built-in rule-condition factories, rule evaluator with 11 operators, pricing calculator + seasonal + dynamic + tiered + modifier pipeline with three rounding modes, Zod schemas for bookable / booking / config validation, temporal helpers (windows / recurrence / slots), and typed `BookingError extends SuaveplanError<BookingErrorCode>` with 7-code registry (`ENGINE_NOT_CONFIGURED`, `BOOKING_NOT_FOUND`, `BOOKING_CONFLICT`, `TRANSITION_NOT_ALLOWED`, `UNKNOWN_CONFLICT_MODE`, `UNKNOWN_AVAILABILITY_STRATEGY`, `HOOK_RETURNED_PROMISE_IN_SYNC`) and optional `bookingId` / `holdId` / `mode` / `strategy` discriminants. 29 subpath exports, 150 tests at 100/100/100/100 coverage. Deps: `@suaveplan/error`, `zod`.
`@suaveplan/currency`	✅	Universal-tier currency conversion engine — pluggable `CurrencyProvider` interface, TTL-bounded `RateCache` with direct / inverse / triangulated lookup, primary + fallback chain with `AbortSignal` cancellation, Zod-validated public boundary, typed `CurrencyError` hierarchy with 7 stable `CURRENCY.*` codes, virtual-currency seeding with post-construction `setVirtualRate` / `updateVirtualRate` mutators, enriched `ConversionResult` carrying `providerName` and `triangulatedThrough` diagnostics. 6 subpath exports, 107 tests at 100/100/100/100 coverage. Built on `@suaveplan/money`.
`@suaveplan/currency-provider-binance`	✅	Universal-tier Binance sibling of the `@suaveplan/currency-providers` slim core (follow-up wave, 2026-05-17). Ships `BinanceProvider implements CurrencyProvider` (`name = "binance"`, `supportsCrypto = true`, `supportsFiat = false`) plus the stable `BINANCE_PROVIDER_NAME` / `BINANCE_DEFAULT_BASE_URL` constants. No API key required — fetches the public Binance spot ticker (`GET /api/v3/ticker/price`) through the slim core's shared `httpRequest()` helper, suffix-decodes pairs (e.g. `BTCUSDT` → `BTC` when base is `USDT`) into the converter's "1 base = N units of asset" form via `1 / price`, sanitises zero / negative / non-finite prices, defends against the `USDTUSDT`-style suffix-equals-symbol edge case, and exposes typed `CurrencyProviderError` for every failure: `HTTP_ERROR` (non-2xx via `httpRequest`), `PARSE_ERROR` (non-JSON body, with `cause` set only when the parser threw an `Error`), `UPSTREAM_ERROR` (payload shape is not `Array<{ symbol: string; price: string }>` — non-array, null row, wrong-typed row, missing field), `UNKNOWN_CURRENCY` (requested `options.targets` entry absent from upstream listing, with the offending symbol surfaced in `upstreamMessage`). Constructor takes optional `NoKeyConfig & { timeoutMs?: number }` — injectable `FetchLike` for tests / proxies / edge runtimes, custom `baseUrl` for regional mirrors or staging, optional `timeoutMs` that flows through to `httpRequest` and composes with the caller's `AbortSignal`. 1 subpath export (`./binance/binance`), 21 tests at 100/100/100/100 coverage. Deps: `@suaveplan/currency`, `@suaveplan/currency-providers`, `@suaveplan/error`, `@suaveplan/types`, `tslib`.
`@suaveplan/currency-provider-kraken`	✅	Universal-tier Kraken sibling for the `@suaveplan/currency-providers` slim core (2026-05-17). Ships `KrakenProvider implements CurrencyProvider` (`name = "kraken"`, `supportsCrypto = true`, `supportsFiat = false`) wrapping Kraken's free, no-API-key `/0/public/Ticker?pair=<csv>` endpoint — accepts the slim core's shared `NoKeyConfig` (optional `baseUrl` defaulting to `https://api.kraken.com/0/public`, optional injectable `FetchLike` defaulting to `globalThis.fetch`) plus an optional `extraSymbols` map that merges on top of the canonical 12-symbol table at construction time (single-round-trip batch fetch via the comma-separated `pair=` query; bidirectional `KRAKEN_SYMBOL_MAP` / `KRAKEN_PAIR_TO_SYMBOL` frozen maps normalise Kraken's legacy `X<base>Z<quote>` asset-prefix names — `XXBTZUSD`, `XETHZUSD`, `XDGUSD`, `XLTCZUSD`, `XXRPZUSD` — and the flat `<base>USD` newer listings — `SOLUSD`, `USDTZUSD`, `DOTUSD`, `ADAUSD`, `LINKUSD`, `AVAXUSD`, `ATOMUSD`). Routes every request through the shared `httpRequest()` helper from the slim core so HTTP failures + caller `RateFetchOptions.signal` propagation come for free, reads the `c[0]` last-trade-closed price for each mapped pair and inverts it (`rates[symbol] = 1 / price`) into the converter's `1 USD = N crypto` convention, silently skips entries whose price doesn't parse to a positive finite number (Kraken occasionally returns `"0.00"` for freshly-listed pairs), filters the rate map by `options.targets`, defaults `options.base` to `"USD"`. Typed error mapping: `HTTP_ERROR` (non-2xx via `httpRequest`, carries `status`), `UPSTREAM_ERROR` (non-empty `data.error[]` array, carries first message on `upstreamMessage`; falls back to `"unknown upstream error"` when the array contains a `null`), `PARSE_ERROR` (malformed JSON or shape-violating body — non-object, non-array `error`, missing or non-object `result`, JSON `null`), `UNKNOWN_CURRENCY` (caller-supplied `targets` array is non-empty but no requested symbol resolves to a mapped Kraken pair). 2 subpath exports (`./symbols/symbols`, `./provider/provider`), 34 tests at 100/100/100/100 coverage. Universal-tier, `sideEffects: false`. Deps: `@suaveplan/currency`, `@suaveplan/currency-providers`, `@suaveplan/error`, `@suaveplan/types`, `tslib`.
`@suaveplan/currency-provider-cryptocompare`	✅	Universal-tier CryptoCompare sibling for the `@suaveplan/currency-providers` slim core (2026-05-17). Ships `CryptoCompareProvider implements CurrencyProvider` (`name = "cryptocompare"`, `supportsCrypto = true`, `supportsFiat = false`) with truly-optional `apiKey` config — free public tier works fully keyless, supplying `apiKey` attaches the `authorization: Apikey <key>` header on every outbound request (free → keyed is a single-field config change; whitespace-only strings are treated as absent so `process.env.CRYPTOCOMPARE_API_KEY` can be passed directly without a guard). Routes every request through the shared `httpRequest()` helper from the slim core (abort-signal composition + per-call timeouts + typed `HTTP_ERROR` come for free), calls `GET <baseUrl>/pricemulti?fsyms=<targets-or-default-15>&tsyms=<base>`, inverts upstream "1 crypto = X fiat" prices into the converter's "1 base = X crypto" convention, skips non-finite/non-positive quotes, defaults base to `"USD"`, and raises typed `CurrencyProviderError` on every failure path (`HTTP_ERROR` via `httpRequest`, `PARSE_ERROR` for invalid JSON or non-object payload, `UPSTREAM_ERROR` when the payload carries `Response: "Error"` (with `upstreamMessage` populated from `Message` or a default), `UNKNOWN_CURRENCY` when no requested symbol produces a positive quote). 15 default symbols when `options.targets` is omitted or empty (BTC, ETH, SOL, USDT, USDC, BNB, XRP, ADA, DOGE, DOT, AVAX, LINK, UNI, ATOM, LTC). 1 subpath export (`./cryptocompare/cryptocompare`), 15 tests at 100/100/100/100 coverage covering both keyless and keyed branches. Deps: `@suaveplan/currency`, `@suaveplan/currency-providers`, `@suaveplan/error`, `@suaveplan/types`, `tslib`.
`@suaveplan/currency-provider-coingecko`	✅	Universal-tier CoinGecko sibling for the `@suaveplan/currency-providers` slim core (2026-05-17). Ships `CoinGeckoProvider implements CurrencyProvider` (`name = "coingecko"`, `supportsCrypto = true`, `supportsFiat = true`) with truly-optional `apiKey` config — free public tier needs no key; supplying `apiKey` attaches the `x-cg-pro-api-key` header on every outbound request (free → Pro is a single-field config change). Routes every request through the shared `httpRequest()` helper from the slim core (abort-signal composition + per-call timeouts + typed `HTTP_ERROR` come for free), proactively gates `options.targets` against the curated `COIN_IDS` map (16 cryptos: BTC, ETH, SOL, USDT, USDC, BNB, XRP, ADA, DOGE, DOT, AVAX, MATIC, LINK, UNI, ATOM, LTC) so unknown targets reject with `UNKNOWN_CURRENCY` before any network round trip, inverts upstream "1 crypto = X fiat" prices into the converter's "1 base = X crypto" convention, and raises typed `CurrencyProviderError` on every failure path (`HTTP_ERROR` via `httpRequest`, `PARSE_ERROR` for invalid JSON, `UPSTREAM_ERROR` for wrong response shape, `UNKNOWN_CURRENCY` for unmapped targets). Also exposes `getCoinGeckoId(symbol)` for case-insensitive symbol lookup. 2 subpath exports (`./coingecko/coingecko`, `./coin-ids/coin-ids`), 23 tests at 100/100/100/100 coverage covering both keyless and Pro-key branches. Deps: `@suaveplan/currency`, `@suaveplan/currency-providers`, `@suaveplan/error`, `@suaveplan/types`, `tslib`.
`@suaveplan/currency-provider-open-exchange-rates`	✅	Universal-tier Open Exchange Rates sibling for the `@suaveplan/currency-providers` slim core (2026-05-17). Ships `OpenExchangeRatesProvider implements CurrencyProvider` (`name = "open-exchange-rates"`, `supportsFiat = true`, `supportsCrypto = false`) wrapping `/latest.json?app_id=<key>&base=<base>`. API-key (`app_id`) required — empty string raises `MISSING_CONFIG` synchronously from the constructor. Free-tier safe by default: non-USD `RateFetchOptions.base` raises `UNSUPPORTED_BASE` before any network round trip; paid plans opt in via `OpenExchangeRatesProviderConfig.allowNonUsdBase: true`. Routes through the slim-core `httpRequest()` helper so non-2xx surfaces typed `HTTP_ERROR` with `providerName` / `status`, and the caller `RateFetchOptions.signal` is forwarded. Validates the upstream `{ base, rates, timestamp }` shape — every malformed branch (non-object body, non-string `base`, non-number `timestamp`, non-object `rates`, invalid JSON, error payload missing `status` / `message`) raises typed `PARSE_ERROR`. Detects the OXR 2xx error-payload shape (`{ error: true, status, message, description? }`) and raises `UPSTREAM_ERROR` with `upstreamMessage` populated. Filters the rates map to `options.targets`; missing codes raise `UNKNOWN_CURRENCY` with the offending symbol in the message. Converts the upstream Unix-seconds timestamp to milliseconds. `apiKey` is `encodeURIComponent`-wrapped to prevent injection. 1 subpath export (`./provider/provider`), 22 tests at 100/100/100/100 coverage covering every error path including non-Error rejection from `Response.json()`. Deps: `@suaveplan/currency`, `@suaveplan/currency-providers`, `@suaveplan/error`, `@suaveplan/types`, `tslib`.
`@suaveplan/currency-provider-coinmarketcap`	✅	Universal-tier CoinMarketCap sibling for the `@suaveplan/currency-providers` slim core (2026-05-17). Ships `CoinMarketCapProvider implements CurrencyProvider` (`name = "coinmarketcap"`, `supportsCrypto = true`, `supportsFiat = false`) constructed from `ApiKeyConfig` (`apiKey`, optional `baseUrl` defaulting to `https://pro-api.coinmarketcap.com/v1`, optional injectable `FetchLike`); empty / whitespace `apiKey` raises `CurrencyProviderError(MISSING_CONFIG)` at construction time so misconfiguration surfaces synchronously instead of on first fetch. Routes every request through the shared `httpRequest()` helper from the slim core (abort-signal composition + per-call timeouts + typed `HTTP_ERROR` come for free), calls `GET <baseUrl>/cryptocurrency/quotes/latest?symbol=<csv>&convert=<base>` with the `X-CMC_PRO_API_KEY` + `Accept: application/json` headers, forwards `options.signal`, defaults `base` to `USD` and `targets` to the top-10 crypto-by-market-cap (`BTC,ETH,SOL,USDT,USDC,BNB,XRP,ADA,DOGE,DOT`), inverts each returned price (`1 / price`) into the converter's expected `1 fiat = X crypto` form, and silently drops non-finite / non-positive / wrong-base quotes before checking for empty result. Typed error mapping: `HTTP_ERROR` (non-2xx, via `httpRequest`), `PARSE_ERROR` (invalid JSON / non-object body / missing or non-object `data` field with no usable upstream signal), `UPSTREAM_ERROR` (`status.error_code` populated and non-zero, carries `upstreamMessage` when `error_message` is a string; treats `error_code === 0` as success), `UNKNOWN_CURRENCY` (no requested symbol resolved to a positive quote), `MISSING_CONFIG` (constructor); every error carries `providerName: "coinmarketcap"`. 2 subpath exports (`./coinmarketcap/coinmarketcap`), 22 tests at 100/100/100/100 coverage. Universal-tier, `sideEffects: false`. Deps: `@suaveplan/currency`, `@suaveplan/currency-providers`, `@suaveplan/error`, `@suaveplan/types`, `tslib`.
`@suaveplan/currency-provider-fixer`	✅	Universal-tier Fixer.io sibling for the `@suaveplan/currency-providers` slim core (2026-05-17). Ships `FixerProvider implements CurrencyProvider` (`name = "fixer"`, `supportsFiat = true`, `supportsCrypto = false`) — API-key required (free tier restricts `base` to `EUR`, paid plans unlock arbitrary base + higher quotas; 170+ fiat currencies). Constructor takes the slim core's shared `ApiKeyConfig` and raises `CURRENCY_PROVIDER.MISSING_CONFIG` synchronously when `apiKey === ""` so a missing `process.env.FIXER_KEY` fails before burning a single request against the monthly quota. Routes every request through the shared `httpRequest()` helper from the slim core (abort-signal composition + per-call timeouts + typed `HTTP_ERROR` come for free), builds `?access_key=…&base=…[&symbols=…]` (default `base = "EUR"`, `targets` comma-joined into `symbols` when non-empty), and maps the upstream `{ success, error: { code, info } }` envelope into typed `CurrencyProviderError` codes: code `105` (`base_currency_access_restricted`, free-tier base lock) → `UNSUPPORTED_BASE`, codes `201` (`invalid_base_currency`) / `202` (`invalid_currency_codes`) → `UNKNOWN_CURRENCY`, any other `success: false` (or missing `error` field) → `UPSTREAM_ERROR` carrying the upstream `error.info` (or `"<unknown>"`) on `upstreamMessage`. Distinguishes parse failures (malformed JSON, non-object JSON, success envelope missing `base`/`rates`/`timestamp`) under a single `PARSE_ERROR` code. Forwards caller-supplied `RateFetchOptions.signal` to the underlying fetch via `httpRequest` (upstream skeleton did not). Injectable `FetchLike` from `@suaveplan/types` so tests pass a recording closure instead of `vi.mock`. No top-level side effect — `sideEffects: false` honoured; the package never registers an instance with any global registry at import time. 1 subpath export (`./fixer/fixer`), 22 tests across one file at 100/100/100/100 coverage. Deps: `@suaveplan/currency`, `@suaveplan/currency-providers`, `@suaveplan/error`, `@suaveplan/types`, `tslib`.
`@suaveplan/currency-provider-virtual`	✅	Universal-tier in-memory programmable virtual / game currency sibling for the `@suaveplan/currency-providers` slim core (2026-05-17). Ships `VirtualCurrencyProvider implements CurrencyProvider` (`name = "virtual-currency"`, `supportsCrypto = false`, `supportsFiat = false`, `supportsVirtual = true`) backed by a nested `Map<from, Map<to, number>>` rate table — zero HTTP, zero `FetchLike`, zero API key, zero `@suaveplan/money` `registerCurrency` coupling (kept `sideEffects: false` honest, unlike the upstream form). Programmable runtime API: `setRate(from, to, rate)` (upsert — replaces an existing pair without throwing), `removeRate(from, to): boolean` (idempotent, auto-cleans empty inner maps so `listCurrencies()` stays accurate, never throws), `clear()`, `hasRate(from, to)`, `getRate(from, to): number \| undefined`, `listCurrencies(): readonly string[]` (lexicographic snapshot). `fetchRates(options?)` returns the directed rates stored under `options.base` (default `defaultBase`, `"USD"`), optionally filtered by an `options.targets` inclusion list; `RateFetchResult.timestamp` is sourced from an injectable `Clock` (`@suaveplan/types`, default `() => Date.now()`) so `FakeClock`-driven tests get deterministic timestamps without monkey-patching `Date`. Triangulation is deliberately absent — the provider returns only the rates explicitly stored under the requested base; callers wire it through `CurrencyConverter` (which triangulates from its cache) when they need cross-rates. Raises `CurrencyProviderError(CURRENCY_PROVIDER.UNKNOWN_CURRENCY)` with `providerName: "virtual-currency"` when the requested base has no rates stored (table can legitimately be empty — no triangulation). Surfaces a tiny `makeUnknownCurrencyError(base)` helper + `VIRTUAL_PROVIDER_NAME` / `VIRTUAL_CURRENCY_PROVIDER_CODES` re-exports for ergonomic error construction. 2 subpath exports (`./error-codes/error-codes`, `./provider/provider`), 25 tests at 100/100/100/100 coverage. Universal-tier, `sideEffects: false`. Deps: `@suaveplan/currency`, `@suaveplan/currency-providers`, `@suaveplan/error`, `@suaveplan/types`, `tslib`.
`@suaveplan/currency-provider-ecb`	✅	Universal-tier European Central Bank sibling for the `@suaveplan/currency-providers` slim core (2026-05-17). Ships `EcbProvider implements CurrencyProvider` (`name = "ecb"`, `supportsFiat = true`, `supportsCrypto = false`) — free, no API key, consumes the ECB daily reference-rates XML feed (`https://www.ecb.europa.eu/stats/eurofxref/eurofxref-daily.xml`). Routes every request through the shared `httpRequest()` helper from the slim core (abort-signal composition + per-call timeouts + typed `HTTP_ERROR` come for free), parses the EUR-quoted rate table via the same zero-dep regex the upstream `@suaveplan/currency-providers` shipped pre-slim, mathematically inverts EUR rates to any caller-requested non-EUR `base` (`result.EUR = 1 / baseRate`, `result.<other> = <eurRate> / baseRate`), honours `RateFetchOptions.targets` filtering and `RateFetchOptions.signal` cancellation, and raises typed `CurrencyProviderError` on every failure path (`HTTP_ERROR` via `httpRequest`, `PARSE_ERROR` when the upstream body contains zero currency tags so an empty rate map is never silently cached, `UNSUPPORTED_BASE` when the requested non-EUR base is missing from the feed, `UNKNOWN_CURRENCY` when every requested target is absent from the resolved map). Injectable `FetchLike` from `@suaveplan/types` (`NoKeyConfig.fetch`) so tests pass a recording closure instead of `vi.mock`. 1 subpath export (`./ecb/ecb`), 16 tests at 100/100/100/100 coverage. Deps: `@suaveplan/currency`, `@suaveplan/currency-providers`, `@suaveplan/types`, `tslib`.
`@suaveplan/currency-providers`	✅	Universal-tier slim plugin core for `@suaveplan/currency` rate providers (slimmed 2026-05-17 from the original 9-provider bundle to a foundation-with-sibling-plugins shape matching `@suaveplan/network` and `@suaveplan/drive`). Ships `CurrencyProviderRegistry` (name-keyed `register` / `get` / `has` / `list` / `unregister`, typed `PROVIDER_NOT_REGISTERED` / `PROVIDER_ALREADY_REGISTERED` errors, sorted-snapshot `list()` for deterministic downstream tests), `defineCurrencyProvider` factory + `DefineCurrencyProviderInput` (returns an `Object.freeze`-d `CurrencyProvider` from a plain object literal), shared `httpRequest` / `composeAbortSignal` helper (used by every sibling provider — abort-signal composition via `AbortSignal.any`, `AbortSignal.timeout`-derived timeouts, non-2xx → typed `HTTP_ERROR`, returns raw `Response`), typed `CurrencyProviderError extends SuaveplanError<CurrencyProviderErrorCode>` with the 8-code `CURRENCY_PROVIDER_*` registry (`HTTP_ERROR`, `PARSE_ERROR`, `UPSTREAM_ERROR`, `UNSUPPORTED_BASE`, `MISSING_CONFIG`, `UNKNOWN_CURRENCY`, `PROVIDER_NOT_REGISTERED`, `PROVIDER_ALREADY_REGISTERED`) + optional `providerName` / `status` / `upstreamMessage` discriminants, and the four shared config types (`ApiKeyConfig`, `NoKeyConfig`, `HttpFetchOptions`, `ProviderConfigBase`) every sibling extends. Concrete providers (ECB, Fixer, Open Exchange Rates, Binance, CoinGecko, CoinMarketCap, CryptoCompare, Kraken, Virtual) ship as separate `@suaveplan/currency-provider-<name>` sibling packages (follow-up wave). 5 subpath exports, 32 tests at 100/100/100/100 coverage. Deps: `@suaveplan/currency`, `@suaveplan/error`, `@suaveplan/types`, `tslib`.
`@suaveplan/money`	✅	Universal-tier precise currency arithmetic — `bigint` minor-unit `Money` class with full arithmetic + comparison + conversion + lossless JSON round-trip, 30 ISO 4217 fiat + 5 cryptocurrency built-ins, custom and virtual currency registration, locale-aware `Intl.NumberFormat` formatting (`formatMoney`, `formatMoneyCompact`), fair allocators preserving the input total (`allocateEvenly`, `allocateByRatios`, `allocateByPercentages`), aggregators (`sumMoney`, `minMoney`, `maxMoney`), typed `MoneyError` hierarchy with stable `MONEY.*` code registry. 6 subpath exports, 90 tests at 100/100/100/100 coverage.
`@suaveplan/payment`	✅	Universal-tier payment intent lifecycle, state-machine enforcement, webhook signature verification (HMAC via `@suaveplan/crypto-hash` + constant-time compare via `@suaveplan/crypto-utils`), receipt generation, fraud scoring, refund-balance ledger, jurisdiction-aware tax calculator, retry orchestration with exponential backoff + jitter, reconciliation matcher, and PCI-conscious card tokenization. Provider-agnostic; ships Stripe + PayPal + in-memory Test adapters. Typed `PaymentError` extending `SuaveplanError<PaymentErrorCode>` with 13 codes. 16 subpath exports, 180 tests at 100/100/100/100 coverage.
`@suaveplan/payment-providers`	✅	Universal-tier slim plugin core for `@suaveplan/payment` provider adapters (slimmed 2026-05-17 from the original 5-adapter bundle to a foundation-with-sibling-plugins shape matching `@suaveplan/network`, `@suaveplan/drive`, and `@suaveplan/currency-providers`). Ships `ProviderRegistry` (name-keyed `register` / `get` / `has` / `list` / `unregister`, typed `PROVIDER_NOT_REGISTERED` / `PROVIDER_ALREADY_REGISTERED` errors, insertion-ordered frozen `list()` snapshot), `definePaymentProvider<TName>` factory (returns an `Object.freeze`-d literal-typed `PaymentProvider` for sibling packages that prefer a closure to a class), shared `httpRequest` + the now-public `composeAbortSignal` helper (used by every sibling for caller-signal + per-call timeout composition; JSON serialisation, string-body passthrough, typed errors, empty-body handling), typed `PaymentProviderError extends SuaveplanError<PaymentProviderErrorCode>` with the 6-code `PAYMENT_PROVIDER_*` registry (`HTTP_ERROR`, `TIMEOUT`, `PARSE_ERROR`, `OAUTH_TOKEN_FAILURE`, `PROVIDER_NOT_REGISTERED`, `PROVIDER_ALREADY_REGISTERED`) + optional `provider` / `httpStatus` / `url` / `bodyExcerpt` discriminants, and the four shared config shapes (`ApiKeyConfig`, `OAuthConfig`, `MerchantKeyConfig`, `ProviderCommonOptions`) plus the `HttpOptions` / `ProviderResponse` / `NowFn` / `RandomIdFn` / `Base64EncodeFn` / `FetchLike` injectable seams every sibling consumes. Concrete providers (Stripe, PayPal, Square, Mollie, Adyen) ship as separate `@suaveplan/payment-provider-<name>` sibling packages (follow-up wave). 5 subpath exports, 45 tests at 100/100/100/100 coverage. Deps: `@suaveplan/payment`, `@suaveplan/error`, `tslib`.
`@suaveplan/payment-provider-adyen`	✅	Universal-tier Adyen Checkout API v71 adapter — sibling provider package on the slim `@suaveplan/payment-providers` core. `AdyenProvider` implements the `PaymentProvider` contract from `@suaveplan/payment` with literal name `"adyen"`, `AdyenConfig` (alias of the shared `MerchantKeyConfig`) constructor requiring `apiKey` + `merchantAccount` and accepting optional `baseUrl` (defaults `https://checkout-test.adyen.com/v71`), `timeoutMs`, `signal`, `fetch`, `randomId`, and `webhookHmacKey`. `X-API-Key: <apiKey>` header stamped on every call (read + write); caller-supplied `idempotencyKey` forwards verbatim as the standard `Idempotency-Key` header on `createIntent` and `refund` AND as the request body's `reference` field on `createIntent`. When `idempotencyKey` is omitted on `createIntent`, the default `reference` is generated via the injectable `RandomIdFn` (falls back to `globalThis.crypto.randomUUID()` at call time when available; throws a typed `PaymentProviderError(PARSE_ERROR)` otherwise so the package stays universal-tier with no `node:crypto` import). Full lifecycle: `createIntent` → POST `/payments` (sends `merchantAccount`, `amount`, `reference`, optional `captureDelayHours: 0` for `manual` capture, `shopperStatement`, `returnUrl`, `paymentMethod.storedPaymentMethodId`, `metadata`), `confirmIntent` → POST `/payments/{id}/details`, `captureIntent` → POST `/payments/{id}/captures`, `cancelIntent` → POST `/payments/{id}/cancels`, `refund` → POST `/payments/{id}/refunds` (with optional `amount`), `getIntent` → GET `/payments/{id}`. The configured `merchantAccount` is injected into every modification body (`captures`, `cancels`, `refunds`) per Adyen's contract. Exhaustive Adyen → domain mappings: 10-row result-code status table (`Authorised` → `authorized`, `Refused`/`Error` → `failed`, `Cancelled` → `canceled`, `Pending`/`Received`/`RedirectShopper`/`IdentifyShopper`/`ChallengeShopper`/`PresentToShopper` → `pending`, unknown → `failed`), 1-row refund-status table (`received` → `pending`, else → `failed`), payment-method normalisation (`scheme` → `card`, anything else → `wallet`; brand lower-cased; `lastFour` → `last4`). Every HTTP call routes through slim-core `httpRequest`; raised `PaymentProviderError`s carry `provider: "adyen"` discriminant. 2 subpath exports (`./adyen/adyen`, `./types/adyen`), 36 tests at 100/100/100/100 coverage. Deps: `@suaveplan/payment`, `@suaveplan/payment-providers`, `tslib`.
`@suaveplan/payment-provider-mollie`	✅	Universal-tier Mollie Payments API v2 adapter — sibling provider package on the slim `@suaveplan/payment-providers` core. `MollieProvider` implements the `PaymentProvider` contract from `@suaveplan/payment` with name `"mollie"`, `ApiKeyConfig` constructor, `Authorization: Bearer <apiKey>` header auto-applied on every call, and the full lifecycle (`createIntent` → POST `/payments`, read-through `confirmIntent`/`captureIntent` for Mollie's auto-capture model, `cancelIntent` → DELETE, `refund` → POST `/payments/{id}/refunds`, `getIntent` → GET). Marshals genesis Money (`bigint` minor-units) to / from Mollie's `{ currency, value: "X.YY" }` wire shape via the exported pure helpers `formatMollieAmount` / `parseMollieAmount` (lossless round-trip via `bigint` — covered with 1-cent, exact-major, large-value, and over-precision edges). Exported total status maps (`mapMollieStatus`, `mapMollieRefundStatus`) with documented unknown-status fallback to `"failed"`. All failures surface as `PaymentProviderError` from the slim core; raw `Error` is never thrown. 2 subpath exports, 34 tests at 100/100/100/100 coverage. Deps: `@suaveplan/payment`, `@suaveplan/payment-providers`, `@suaveplan/error`, `tslib`.
`@suaveplan/payment-provider-paypal`	✅	Universal-tier PayPal Orders v2 + Payments Captures Refund adapter — sibling provider package on the slim `@suaveplan/payment-providers` core. `PayPalProvider` implements the `PaymentProvider` contract from `@suaveplan/payment` with literal name `"paypal"`, `PayPalConfig` constructor extending the shared `OAuthConfig` with `sandbox?: boolean` (flips the default base URL to `https://api-m.sandbox.paypal.com`; explicit `baseUrl` always wins) plus injectable `now: NowFn` (token-cache TTL clock) and `base64Encode: Base64EncodeFn` (Basic-header encoder; defaults to `globalThis.btoa` — runtimes without `btoa` supply their own without forking the package). OAuth2 client-credentials token cache: POST `/v1/oauth2/token` with `Authorization: Basic <base64(clientId:clientSecret)>` + `Content-Type: application/x-www-form-urlencoded` + `grant_type=client_credentials`; cached in-memory with `tokenAcquiredAt + (expires_in * 1000) - 60_000` ms TTL (60 s clock-skew buffer); reused across every method call until expiry; refreshed transparently. Token-fetch failures (non-2xx, transport error, malformed JSON) raise `PaymentProviderError(OAUTH_TOKEN_FAILURE)` with `provider: "paypal"`, the token URL on the `url` discriminant, and the underlying cause attached — raised before any subsequent Orders-v2 call is attempted. Full lifecycle: `createIntent` → POST `/v2/checkout/orders` (intent `AUTHORIZE` for `captureMethod: "manual"`, `CAPTURE` otherwise; sends `purchase_units[0].amount` + optional `description`; caller-supplied `idempotencyKey` forwards as `PayPal-Request-Id` header), `confirmIntent` → POST `/v2/checkout/orders/{id}/authorize`, `captureIntent` → POST `/v2/checkout/orders/{id}/capture` (sums every nested `purchase_units[].payments.captures[].amount.value` into `capturedAmount`), `cancelIntent` → POST `/v2/checkout/orders/{id}/void` (returns synthesised `canceled` intent whose timestamps come from `new Date(now()).toISOString()` so tests pin them deterministically), `refund` → POST `/v2/payments/captures/{paymentIntentId}/refund` (sends optional `amount` + `PayPal-Request-Id` from caller's `idempotencyKey`; empty-object body when neither is supplied), `getIntent` → GET `/v2/checkout/orders/{id}`. Exhaustive PayPal → domain mappings: 6-row order-status table (`CREATED`/`SAVED` → `created`, `APPROVED` → `authorized`, `VOIDED` → `canceled`, `COMPLETED` → `captured`, `PAYER_ACTION_REQUIRED` → `pending`, unknown → `failed`), 3-row refund-status table (`COMPLETED` → `succeeded`, `PENDING` → `pending`, else → `failed`), `MoneyLike` bigint minor-unit ↔ PayPal decimal-string major-unit marshalling (`5000n` ↔ `"50.00"`; handles PayPal's zero-decimal currencies like JPY where no `.` separator is sent). Every HTTP call routes through slim-core `httpRequest`; `Authorization: Bearer <token>` stamped on every call from the cache; raised `PaymentProviderError`s carry `provider: "paypal"` discriminant. 3 subpath exports (`.`, `./paypal/paypal`, `./paypal/mapping`), 25 tests at 100/100/100/100 coverage. Deps: `@suaveplan/payment`, `@suaveplan/payment-providers`, `@suaveplan/error`, `tslib`.
`@suaveplan/payment-provider-stripe`	✅	Universal-tier Stripe REST API adapter — sibling provider package on the slim `@suaveplan/payment-providers` core. `StripeProvider` implements the `PaymentProvider` contract from `@suaveplan/payment` with literal name `"stripe"`, `StripeConfig` (alias of the shared `ApiKeyConfig`) constructor, `Authorization: Bearer <apiKey>` on every call (read + write), and the full payment-intent + refund lifecycle (`createIntent` → POST `/payment_intents`, `confirmIntent` / `captureIntent` / `cancelIntent` → POST `/payment_intents/:id/{confirm,capture,cancel}`, `refund` → POST `/refunds`, `getIntent` → GET). Caller-supplied `idempotencyKey` forwards verbatim as the standard Stripe `Idempotency-Key` header on `createIntent` and `refund`; omitted on read calls and when the caller did not supply one. Exhaustive Stripe → domain mappings: 7-row payment-intent status table (`requires_payment_method`/`requires_confirmation` → `created`, `requires_action`/`processing` → `pending`, `requires_capture` → `authorized`, `succeeded` → `captured`, `canceled` → `canceled`, unknown → `failed`), 3-row refund-status table (`succeeded`/`pending`/else → `failed`), 4-row refund-reason table (`duplicate`/`fraudulent`/`requested_by_customer`/else → `other`, absent → `other`), payment-method normalisation (`card` → `card` with `brand`+`last4`, any other → `wallet`, absent → `undefined`). Every HTTP call flows through the slim-core `httpRequest` so caller-supplied `fetch` / `signal` / `timeoutMs` from `ProviderCommonOptions` propagate end-to-end; raised `PaymentProviderError`s carry `provider: "stripe"` discriminant. 2 subpath exports, 42 tests at 100/100/100/100 coverage. Deps: `@suaveplan/payment`, `@suaveplan/payment-providers`, `tslib`.
`@suaveplan/payment-provider-square`	✅	Universal-tier Square Payments API adapter — sibling provider package on the slim `@suaveplan/payment-providers` core. `SquareProvider` implements the `PaymentProvider` contract from `@suaveplan/payment` with literal name `"square"`, `SquareConfig` constructor extending the shared `ApiKeyConfig` with required `locationId: string` (Square multi-location support) plus optional `sandbox?: boolean` (flips the default base URL to `https://connect.squareupsandbox.com/v2`), `apiVersion?: string` (pins the `Square-Version` header — defaults to `"2024-01-18"`), and `randomId?: RandomIdFn` (deterministic idempotency-key generation; defaults to `crypto.randomUUID()` at call time). Full lifecycle: `createIntent` → POST `/payments` (sends `amount_money`, `location_id`, `autocomplete`, `idempotency_key` plus optional `customer_id`/`note`/`source_id`), `confirmIntent` → no-op delegating to `getIntent` (Square auto-confirms), `captureIntent` → POST `/payments/{id}/complete`, `cancelIntent` → POST `/payments/{id}/cancel`, `refund` → POST `/refunds` (with optional `amount_money`/`reason` and `idempotency_key`), `getIntent` → GET `/payments/{id}`. Exhaustive Square → domain mappings: 5-row payment-status table (`APPROVED` → `authorized`, `COMPLETED` → `captured`, `CANCELED` → `canceled`, `FAILED` → `failed`, `PENDING` → `pending`, unknown → `failed`) and 3-row refund-status table (`COMPLETED` → `succeeded`, `PENDING` → `pending`, anything else including `REJECTED`/`FAILED` → `failed`); payment-method normalisation lower-cases Square's upper-case `card_brand` and falls back to `"unknown"` for non-canonical brands; refund-reason maps any non-empty Square reason to `"requested_by_customer"` and empty/absent to `"other"`. `Authorization: Bearer <apiKey>` and `Square-Version: <apiVersion>` headers stamped on every request via the slim-core `httpRequest`; caller-supplied `fetch` / `signal` / `timeoutMs` from `ProviderCommonOptions` propagate end-to-end; raised `PaymentProviderError`s carry `provider: "square"` discriminant. 5 subpath exports, 37 tests at 100/100/100/100 coverage. Deps: `@suaveplan/payment`, `@suaveplan/payment-providers`, `tslib`.
`@suaveplan/react-bank`	–	Game banking components and hooks

`contacts`

Package	Status	Info
`@suaveplan/api-plugin-contacts`	–	Contacts and groups API plugin
`@suaveplan/contacts`	✅	Universal contact + n-level group management with materialised-path tree, audience resolution, dedup, CSV/JSON import-export, Zod boundaries, OTel instrumentation, typed `CONTACTS.*` error registry.
`@suaveplan/macos-contacts`	✅	macOS Contacts.app bridge via AppleScript with `Contact`↔`Person` mapping, dedup via `@suaveplan/contacts`, push/pull/sync, vCard import-export.

`core`

Package	Status	Info
`@suaveplan/config`	✅	Layered configuration management: defaults, file, object, env, CLI layers merge…
`@suaveplan/env`	✅	Type-safe environment variable loading: schema-first validation, field types, d…
`@suaveplan/error`	✅	Foundation error substrate — SuaveplanError base class, stable code registry, c…
`@suaveplan/schema-registry`	✅	Versioned schema registry with forward/backward compatibility checking for evol…
`@suaveplan/types`	✅	Types-only foundation — canonical shared interfaces (Clock, IdGenerator, Rng, M…
`@suaveplan/typescript-config`	✅	Shared TypeScript configuration presets for the Suaveplan monorepo
`@suaveplan/utils`	✅	Universal utility library: debug, object, platform, number, random, string, ema…

`crypto`

Package	Status	Info
`@suaveplan/api-plugin-vault`	✅	Per-principal encrypted vault plugin wrapping `@suaveplan/vault`. 5 routes (`GET /vault/items`, `POST /vault/items`, `GET/PATCH/DELETE /vault/items/:id`) all gated by `requireAuth()` and scoped to `c.get("user")!.id` — foreign items return `VAULT_PLUGIN_ITEM_NOT_FOUND` 404 (NOT 403, anti-enumeration). `UpdateVaultItemBodySchema` is strict mode; `maxItemSizeBytes` default 10 MiB → 413 `VAULT_PLUGIN_ITEM_TOO_LARGE`. `VAULT_OWNERSHIP_SCHEMA` (vault_item + vault_share tables + indexes) applied via injected `MigrationRunner` or `db` fallback. Default unlock extractor `headerExtractor("X-Vault-Unlock")` — never logs the password. Per-principal Vault config: `email` ← `principal.email ?? principal.id`, `secretKey` ← `principal.id` (server-known stable 2nd secret), `argon2idSalt` ← `HKDF-SHA256(serverPepper, principalId, "suaveplan-vault-plugin-argon2id-salt", 16)`. `vaultService` registered with `VaultHandle` opaque type. 9 `VAULT_PLUGIN_*` codes, every one thrown. 4 counters (`items.{created,read,updated,deleted}_total{outcome}`) + 1 histogram (`item.size_bytes`). 116 tests including real-SurrealDB-testcontainer integration: full sign-up via auth → vault CRUD roundtrip with X-Vault-Unlock + cross-user isolation + served `/openapi.json` lists 5 routes + fast-check 200-run property test on size invariant. 100/100/100/100 coverage. `dependencies: ["auth"]`.
`@suaveplan/crypto`	✅	Universal cryptographic primitives — AEAD (AES-256-GCM, ChaCha20-Poly1305, XCha…
`@suaveplan/crypto-bin`	✅	Suaveplan crypto bins: suaveplan-hash-password (Argon2id / blake2b password has…
`@suaveplan/crypto-browser`	✅	WebCrypto-backed engine implementations for @suaveplan/crypto — AES-256-GCM, Ed…
`@suaveplan/crypto-cipher`	✅	AEAD cipher primitives with per-primitive selector layout: aes-256-gcm, chacha2…
`@suaveplan/crypto-cli`	✅	Suaveplan keychain CLI — root + server identity lifecycle (init, roll, revoke,…
`@suaveplan/crypto-core`	✅	Universal cryptographic primitives (formerly @suaveplan/crypto) — AEAD (AES-256…
`@suaveplan/crypto-curve`	✅	Elliptic-curve primitives with per-primitive selector layout: secp256k1, ed2551…
`@suaveplan/crypto-hash`	✅	Pure-TypeScript hashing substrate — SHA-2 digests, HMAC, HKDF, PBKDF2, Argon2id…
`@suaveplan/crypto-rsa`	✅	RSA primitives — RFC 8017 PKCS #1 v2.2 (PKCS1v15 + PSS sign/verify, OAEP + PKCS1v15 encrypt/decrypt), RFC 5208/5958 PKCS#8, RFC 5280 SPKI, RFC 7517/7518 JWK, RFC 7468 PEM, RFC 7638 JWK Thumbprint + RFC 9278 thumbprint URI. Multi-prime keygen with NIST FIPS 186-5 Miller-Rabin (64 rounds), AbortSignal throughout, blinding (RFC 8017 §5.1.2 / Kocher 1996) wired by default into every sign/decrypt path with `{ blinding: false }` opt-out emitting a counter, hand-rolled ASN.1 reader/writer, SPKI fingerprint with hex/base64/base64url/colon-hex output, `RsaCryptoEngine` adapter (noble + WebCrypto subtle + auto-selector), `RsaKeyHandle` HSM/PKCS#11 bridge with reference `SoftwareRsaKeyHandleProvider`, FIPS 186-5 profile (modulusBits ∈ {2048,3072,4096}; e ∈ [2¹⁶+1, 2²⁵⁶-1] odd; PSS saltLength === hLen; SHA-1 banned for sign/verify), JWK `key_ops`/`use`/`alg` enforcement (RFC 7517 §4.2-4.4), Bleichenbacher-resistant combined-error decrypt, constant-time PKCS1v15 verify (Wycheproof-grade). 17-code error registry, 438 tests at 100/100/100/100 coverage. Gates `@suaveplan/x509` + `@suaveplan/jws` + `@suaveplan/webauthn`.
`@suaveplan/crypto-sodium`	✅	libsodium-backed engine implementations for @suaveplan/crypto — AEAD (XChaCha20…
`@suaveplan/crypto-utils`	✅	Shared cryptographic utilities: encoding (hex/base64/base64url/base58), byte he…
`@suaveplan/crypto-vault`	✅	Vaulted cryptographic foundation: BIP39 mnemonics, OWASP-hardened Argon2id, 2…
`@suaveplan/crypto-keys`	✅	Hierarchical keychain chain-signing: pluggable ChainHasher + ChainCodec interf…
`@suaveplan/cryptocurrency`	✅	Universal-tier crypto utilities: 15-chain address validation with EIP-55 checksumming, EIP-1559 gas estimation (bigint), async chain registry with `LoggerLike` injection + typed `UNKNOWN_CHAIN` errors, ERC-20 `TokenRegistry` + `COMMON_TOKENS`, calldata / 4-byte selector decoder, bigint-pure unit conversion across ETH / BTC / SOL, `CryptocurrencyError` hierarchy with 5-code `CRYPTOCURRENCY.*` registry. 11 subpath exports; 183 tests at 100/100/100/100 (Istanbul).
`@suaveplan/keys`	➖	Superseded: chain-signing → `@suaveplan/crypto-keys`; vault orchestration → `@suaveplan/vault`; chunked vault I/O → compose `@suaveplan/packer/chunked` + `@suaveplan/streams` + `@suaveplan/vault`. Bitpacker keychain schemas are obsolete (v1 derivation grammar replaces them).
`@suaveplan/react-crypto`	–	Client-side cryptography components

`data`

Package	Status	Info
`@suaveplan/bytes`	✅	Low-level byte utilities: hex/base64/utf8 encoding, Uint8Array helpers, UUID co…
`@suaveplan/data-masking`	✅	PII/sensitive data masking for objects and strings: field-level masking rules,…
`@suaveplan/dedup`	✅	Entity deduplication engine with pluggable match keys, scoring rules, Jaro-Wink…
`@suaveplan/diff`	✅	Zero-dependency RFC 6902 JSON Patch engine with structural diffing, patch appli…
`@suaveplan/json`	✅	Safe JSON parse/stringify with prototype-pollution protection, circular-ref det…
`@suaveplan/mime`	✅	Structured MIME-type detection, parsing, and registry: magic-byte sniffing, RFC…
`@suaveplan/packer`	✅	Binary packing/unpacking: whole-file (gzip + AEAD + ed25519) and chunked (locke…
`@suaveplan/packer-browser`	✅	Browser-tier runtime for `@suaveplan/packer` archives — `PackedResourceManager` (LRU + ref-count + Blob-URL bookkeeping), unit-tested Service Worker interceptor + hand-rolled SW-scope shim, `verifyArchiveSignature` (Ed25519 via `@suaveplan/crypto`), OTel metrics (`packed_resource_fetch_total`, `_cache_hits_total`, `_cache_miss_total`, `_decode_ms`), injected `Clock`/`Rng`, `AbortSignal` on every async entrypoint, `@suaveplan/retry` on the source-pull path, `@suaveplan/feature-flags` slot, 6-code error hierarchy, i18n MessageResolver catalog. Five subpath exports (`.`, `/manager`, `/service-worker`, `/utils`, `/singleton`). No React runtime dep. 153 tests at 100/100/100/100 coverage.
`@suaveplan/react-packer`	✅	React 19 companion for `@suaveplan/packer-browser` — `usePackedResource` generic hook + `usePackedImage` / `usePackedAudio` / `usePackedVideo` / `usePackedFont` variants (font hook injects `@font-face` and gates on `document.fonts.load`) + `PackedResourceProvider` React context with `MessageResolver` propagation and `@suaveplan/packer-browser/singleton` fallback. `AbortSignal` on every load (pre-aborted, mid-flight abort, abort-on-unmount, abort-on-URL-change). 3-code error hierarchy (`LOAD_FAILED`, `FONT_LOAD_FAILED`, `ABORTED`) via branded `ReactPackerError`. Seven subpath exports (`.`, `/hooks/*` × 5, `/provider`). React is a peer dep — non-React consumers of `packer-browser` pay nothing. 48 tests at 100/100/100/100 coverage.
`@suaveplan/pagination`	✅	Universal pagination primitives: cursor, offset, keyset strategies with adapter…
`@suaveplan/serialize`	✅	Round-trip-preserving structured serialization — tagged JSON, MessagePack binar…
`@suaveplan/templates`	✅	Plugin-based template engine with type-safe contexts, variable interpolation, t…
`@suaveplan/validation`	✅	Runtime schema validation with Zod-compatible API — self-contained parse engine…

`database`

Package	Status	Info
`@suaveplan/db`	✅	Universal relational database adapter interface: DatabaseAdapter (extends Datab…
`@suaveplan/db-sqlite`	✅	Universal SQLite adapter for the genesis monorepo: bun:sqlite on the Bun server…
`@suaveplan/migration`	✅	Database-agnostic migration runner with ledger tracking, dry-run, checksums, lo…
`@suaveplan/seed`	✅	Universal-tier declarative seeding & fixtures: SeedBuilder + SeedRegistry + Sed…
`@suaveplan/surrealdb`	✅	Universal SurrealDB client wrapper implementing DatabaseAdapter: connection lif…

`docs`

Package	Status	Info
`@suaveplan/api-docs`	–	API documentation generator
`@suaveplan/compress-svg`	✅	SVG optimisation and minification: whitespace removal, redundant attribute stri…
`@suaveplan/docs`	✅	Server-tier markdown docs toolkit: monorepo-wide discovery with `AbortSignal` + IO-error counter, typed mdast parsing (no `any`), bidirectional reference graph, orphan finder, hierarchy builder with configurable `maxDepth`, scored search with snippet context, eight `DOCS.*` codes, eight OTel instruments (4 counters + 4 histograms), Zod-validated `DiscoverOptions`, eighteen-category `DocCategory`. 95 tests, 100/100/100/100, 9 docs at 100%.
`@suaveplan/pdf`	✅	Server-tier PDF 1.4 generation toolkit (Chunks A–E): typed `PdfError` registry (13 `PDF.*` codes), Zod boundary schemas, six OTel instruments (4 counters + 2 histograms), unit + hex/RGB colour utilities, page-size + margin types, hand-rolled PDF 1.4 binary writer with FlateDecode + AbortSignal + injectable `Clock`, chainable `ContentStreamEncoder`, four document-element primitives (text/table/image/divider) with Zod validation, `StyleResolver` cascade + `DEFAULT_THEME`, block-flow `LayoutEngine` with header/footer slots, fluent `DocumentBuilder`, orchestrating `renderDocument` returning real PDF 1.4 bytes round-trippable via `pdf-parse`, and three high-level templates — `createReceiptTemplate`, `createReportTemplate`, `createInvoiceTemplate` — each Zod-validated and shipping their own pdf-parse round-trip. 395 tests, 100/100/100/100, 21 docs at 100%.
`@suaveplan/react-docs`	–	React components for rendering Suaveplan documentati...
`@suaveplan/react-pdf`	–	PDF viewer with zoom and navigation
`@suaveplan/react-rich-text`	–	Rich text WYSIWYG editor (Tiptap-based)
`@suaveplan/sitemap`	✅	Sitemap generation and parsing: sitemap.xml, sitemap index, image sitemaps, vid…

`drive`

Package	Status	Info
`@suaveplan/drive`	✅	Modular virtual filesystem core for the Suaveplan monorepo. File-level operatio…
`@suaveplan/drive-mesh`	✅	P2P mesh orchestrator over `drive-plugin-chunks`. `DriveMesh` class with `start`/`stop`/`requestChunk`/`advertise`/`unadvertise`/`peers`/`registry`/`tickGossip` + typed event emitter (`chunk:`/`peer:`/`gossip:*`). `PeerRegistry` overlay (availability bitsets per fileId, EMA latency α=0.3, score-ranked `rank(fileId, chunkId)`, session/persistent denylist). `GossipEngine` (periodic advertisement broadcast over compressed bitsets). `ParallelPuller` (top-K racing window default 250 ms, shared `AbortController`, mandatory `verifyChunkSig` gate, `maxParallelRequests` cap). `ServerFallback` (equal-jitter exponential backoff, signature verification on fallback bytes). 10-code `DriveMeshError`. Zod `DriveMeshOptionsSchema`/`ServerFallbackConfigSchema`/`AdvertisementSchema`. Consumes pluggable `DriveTransport` list (HTTPS, WebRTC) — does NOT import `network-plugin-registry` (boundary per `drive-network-integration` spec). 115 tests at 100/100/100/100 coverage; fixtures use real `ed25519` keypair + real `buildSignedChunk` from `drive-plugin-chunks` + in-memory `Broker`/`FakeDriveTransport` — no `vi.mock`/`vi.stubGlobal`. Shipped 2026-05-12 (`drive-mesh-port` archived).
`@suaveplan/drive-mesh-protocol`	✅	Wire protocol for chunk discovery, request, and delivery across the mesh. Three…
`@suaveplan/drive-plugin-chunks`	✅	Chunk-addressing plugin for @suaveplan/drive. Defines the version 0x0001 binary…
`@suaveplan/drive-react-sharing`	✅	React bindings for `@suaveplan/drive-sharing`: `useSharing` hook (live `recipients` list, async `addRecipient`/`removeRecipient`/`updatePermission`/`refresh`, AbortSignal threading, OTel counters, real `GrantManager`/`PartitionManager`/`TokenManager` — no mocks). Components: `<ShareDialog>` (modal, ESC-dismiss, focus trap, `role="dialog"`/`aria-modal`), `<PartitionBadge>` (`role="status"` + composed `aria-label`), `<FileAccessList>` (semantic `<ul>`/`<li>`, Delete/Backspace keyboard revoke). 7-code `DriveReactSharingError`. 55 tests at 100% coverage, accessibility audited (ARIA roles, keyboard nav, screen-reader text). Stories per component. Shipped 2026-05-12 (`enterprise-react-drive-sharing` archived).
`@suaveplan/drive-sharing`	✅	Partitioned drive with envelope encryption: AEAD envelope (AES-GCM/XChaCha) wi…
`@suaveplan/drive-template`	✅	Server-signed drive templates: pre-configured folder structure and per-file met…
`@suaveplan/drive-transport-https`	✅	HTTPS-relay-backed `TransportLike<MessageEnvelope>` for the drive mesh. Stateless `POST /send` + long-poll `GET /recv` with cursor-tracked at-least-once delivery, explicit `start()`/`stop()` lifecycle, equal-jitter exponential backoff on transient failures, auth-failure short-circuit exposing `lastAuthError` for credential refresh, 256-msg batch cap with yield between batches, injectable `fetchFn`/`clock`/`random`, Zod boundaries, 9 frozen `HTTPS_TRANSPORT_CODES`. 100% coverage. Shipped 2026-05-11 (`drive-transport-https-v1` archived).
`@suaveplan/drive-plugin-cache`	✅	Read-through cache middleware for `@suaveplan/drive`. `driveCachePlugin(options): DrivePlugin<DriveCacheHandle>` registers a `DriveMiddleware` that intercepts `Drive.read(path)` against a caller-supplied `AbstractCache<Uint8Array>` (memory / OPFS / file / Redis / any `cache-storage` backend). Read-through populates on miss when `shouldCache(path, bytes)` returns true (default ceiling 16 MiB matching `drive-mesh-protocol`'s `MAX_FRAME_BYTES`). Write/delete invalidate post-success; stat/list passthrough. 3-code `DRIVE_CACHE.*` registry. Cache failures swallow + counter-record (perf optimisation, not correctness boundary). AbortSignal pre-abort short-circuit. Multi-namespace isolation on a shared cache. Full OTel surface (hits/misses/populations/invalidations/errors counters, `entry_bytes` histogram, outcome-tagged spans). Universal tier. Real `Drive` + `MemoryCache`/`StorageCache` in integration tests (no mocks).
`@suaveplan/drive-uri`	✅	Drive/+mesh/+template URI plugins for `StorageUriResolver`. Three `UriPlugin` factories — `driveUriPlugin`, `driveMeshUriPlugin`, `driveTemplateUriPlugin` — wrap caller-supplied `Drive` instances in a `StorageLike` shim and plug into the existing `storage-uri` resolver. `drive+template://` plugin fetches templates via injected `templateProvider`, hydrates the drive via `Drive.hydrateFrom`, caches `(templateId → in-flight hydration)` so concurrent reads share one round-trip. 7-code `DRIVE_URI.*` registry (`INVALID_URI` / `DRIVE_ID_MISMATCH` / `TEMPLATE_NOT_AVAILABLE` / `TEMPLATE_INVALID` / `WRITE_UNSUPPORTED` / `CAPABILITY_MISSING` / `ABORTED`). Universal tier, no chunk-codec / peer-discovery / template-validation duplication — Drive handles all of that through its installed middleware. Real `Drive` + `chunksPlugin` + `storage-file` in integration tests (no mocks).
`@suaveplan/drive-transport-webrtc`	✅	WebRTC datachannel implementation of the `DriveTransport` interface. Composes `WebRTCClient` + `DataChannelManager` from `@suaveplan/drive-webrtc`. Length-prefixed binary wire framing (`[4B frameLen][1B frameType][payload]`), 3 frame types (`chunk-request` / `chunk-response` / `advertisement`), `MAX_FRAME_BYTES = 16 MiB`. `CompressionStream`/`DecompressionStream`-backed gzipped-bitset advertisement payloads with injectable `StreamCtorResolver`. AbortSignal threading, idempotent `dispose`, 7-code `DriveTransportWebRtcError` (`FRAME_INVALID`/`FRAME_TOO_LARGE`/`REQUEST_TIMEOUT`/`PEER_NOT_CONNECTED`/`DATA_CHANNEL_CLOSED`/`BITSET_COMPRESSION_FAILED`/`ABORTED`), Zod payload schemas, OTel surface (2 counters + 2 histograms). 67 tests at 100% coverage. Tests reuse `FakeRTCPeerConnection`/`FakeRTCDataChannel` from drive-webrtc — no `vi.mock`/`vi.stubGlobal`. Shipped 2026-05-12 (`drive-transport-webrtc-port` archived).
`@suaveplan/drive-webrtc`	✅	Browser-tier WebRTC P2P mesh plugin for `@suaveplan/drive`. 11 subsystems: `SignalingClient` (Zod-validated, reconnect with backoff), `WebRTCClient` (offer/answer/ICE/auto-restart, injectable RTCPeerConnection), `PeerManager` + `PeerBandwidthTracker` + 3 topology strategies (FullMesh/SuperPeer/HubAndSpoke), `DataChannelManager` (bufferedAmount throttle), `ChunkIntegrityManager` (real Ed25519 via `@suaveplan/crypto-curve` + SHA-256 hash), `ChunkDiscoveryManager` (multi-peer racing, integrity-gated fallback), `WebRTCChunkSource`, `WebRTCDrivePlugin` orchestrator, `LRUCache`, `RateLimiter`, `SubChunkSplitter`/`Reassembler`, security validators. 13-code error registry, Zod boundaries, OTel surface (counters + 3 histograms), 419 tests at 100% coverage, 11 bundle-size snapshots. Shipped 2026-05-12 (`enterprise-browser-drive-webrtc` archived).

`emails`

Package	Status	Info
`@suaveplan/dmarc`	✅	DMARC report parser — parses aggregate (RUA) and forensic (RUF) DMARC XML repor…
`@suaveplan/domain-normalizer`	✅	Normalisation, matching, and alias-canonicalisation for internet domain names
`@suaveplan/email-processing`	✅	postal-mime + libmime wrappers; parser, attachments, CID resolver, calendar, data extractor, DKIM canon/verify, DMARC, SPF, spam scorer, thread grouper, hooks pipeline
`@suaveplan/email-templates`	✅	Universal-tier React-free email template engine: VNode factories, nine reusable components, five built-in templates, typed registry, fluent builder, theme system, structured errors, OTel instruments
`@suaveplan/emailer`	✅	Email sending with plugins
`@suaveplan/suppression`	✅	Email suppression list management: in-memory store, bulk import/export (CSV/JSO…

`events`

Package	Status	Info
`@suaveplan/broadcast-channel`	✅	Cross-tab BroadcastChannel communication
`@suaveplan/event-sourcing`	✅	Event sourcing patterns: aggregate root, typed event store, snapshot support, p…
`@suaveplan/events`	✅	Typed event-bus substrate: pub/sub with deterministic FIFO, interceptor API, bo…
`@suaveplan/events-metrics`	✅	OTel metrics companion for @suaveplan/events: dispatch counters, latency histog…
`@suaveplan/events-otel`	✅	OpenTelemetry tracing companion for @suaveplan/events: wraps each dispatch in a…
`@suaveplan/events-schema`	✅	Runtime schema-validation companion for @suaveplan/events: validates event payl…
`@suaveplan/events-transport`	✅	Cross-context event bridges for @suaveplan/events: MessageChannel (at-least-onc…

`flow`

Package	Status	Info
`@suaveplan/cache`	✅	Type-safe caching abstraction: LRU/LFU/FIFO/TTL MemoryCache, NamespacedCache, C…
`@suaveplan/cbor`	✅	CBOR (RFC 8949) + RFC 8742 sequences + RFC 9052 COSE + RFC 8392 CWT + RFC 8610 CDDL (Vaulted)
`@suaveplan/crdt`	✅	Conflict-free replicated data types: G-Counter, PN-Counter, OR-Set, LWW-Registe…
`@suaveplan/idempotency`	✅	Idempotency key guard and dedup: store adapters (memory, database, redis), dist…
`@suaveplan/job-scheduler`	✅	Background job scheduling with cron
`@suaveplan/queue`	✅	Enterprise-grade queue management: memory/priority/delayed queues, concurrent w…
`@suaveplan/queue-distribution`	✅	Worker-pool distribution layer: load-balancing strategies (round-robin / least-busy / weighted), worker pool, manager with retry + health checks, in-process LocalWorker. Transport plugins ship separately.
`@suaveplan/queue-distribution-http`	✅	HTTP transport plugin: HttpWorkerCommunicator (fetch-backed, Zod-validated envelope) + RemoteWorker with @suaveplan/retry-driven connect/reconnect.
`@suaveplan/queue-distribution-worker-thread`	✅	Web-Worker / worker_threads transport plugin: WorkerThreadCommunicator (Zod envelope, bounded outstanding-request map, AbortSignal) + WorkerThreadWorker.
`@suaveplan/rate-limiter`	✅	Enterprise rate limiter: TokenBucket, SlidingWindow, FixedWindow algorithms; te…
`@suaveplan/retry`	✅	Retry strategies with exponential/linear/constant backoff, jitter, circuit brea…
`@suaveplan/rules`	✅	Rule engine + builder + 33 operators + 3 validators + serializer + optimizer + actions + events
`@suaveplan/rules-hono`	✅	Hono middleware suite for `@suaveplan/rules` — 6 factories + lazy default engine
`@suaveplan/streams`	✅	WHATWG-Streams-based primitives: backpressure-first transforms, zero-copy Uint8…
`@suaveplan/undo`	✅	Enterprise-grade undo/redo engine with branching history, async commands, histo…

`fonts`

Package	Status	Info
`@suaveplan/font-compress`	✅	BTF (Binary TypeFace) binary packing — packer-only since the 2026-05-17 split (unpacker now in `@suaveplan/font-decompress`).
`@suaveplan/font-convert`	✅	Convert TTF/OTF/WOFF/WOFF2 font files to typeface.js JSON format. Defines canon…
`@suaveplan/font-decompress`	✅	BTF binary unpacking — reverses `@suaveplan/font-compress::BinaryFontPacker` output back to typeface.js JSON for Three.js / R3F / game-font rendering.
`@suaveplan/font-subset`	✅	Font subsetting pipeline: Unicode range subsetting, WOFF2/WOFF encoding, TTF-to…
`@suaveplan/react-font-decompress`	–	React hooks for font loading

`forms`

Package	Status	Info
`@suaveplan/form-builder`	✅	Dynamic form schema builder with validation, conditi...
`@suaveplan/react-admin-forms`	–	Admin form components
`@suaveplan/react-calendar`	–	Calendar and date picker components
`@suaveplan/react-color-picker`	–	Color picker component
`@suaveplan/react-file-upload`	–	Drag-and-drop file upload with chunked/resumable upl...
`@suaveplan/react-forms`	✅	React form-validation surface: schema-driven `<Form>`, field bindings, validators, error reporting; 88 src files, 28 test files, all gates green.
`@suaveplan/react-wizard`	–	Multi-step form wizard with validation

`games`

Package	Status	Info
`@suaveplan/animation-events`	–	Animation event dispatching, foot contact detection, procedural modifiers
`@suaveplan/api-plugin-anticheat`	–	Server-side anti-cheat with speed, damage, rate, and teleport validation
`@suaveplan/api-plugin-game-persistence`	–	Game save/load with slots, auto-save, and size limits
`@suaveplan/api-plugin-game-server`	–	Game server session management with tick rate and heartbeats
`@suaveplan/api-plugin-matchmaking`	–	Skill-based matchmaking with queue management and gap expansion
`@suaveplan/behavior-tree`	–	Behavior tree engine with composite nodes, decorators, blackboard, and fluent builder
`@suaveplan/bone-mapping`	–	Skeleton detection, bone matching, retargeting math
`@suaveplan/building`	–	Player building system with snap placement, structural integrity, and blueprints
`@suaveplan/character-physics`	–	Engine-agnostic character controller physics (floating capsule, plugins)
`@suaveplan/character-vehicle-picker`	–	Character/vehicle picker schemas, catalogs, and state management with BitPacker
`@suaveplan/chat`	–	In-game chat with channels, whispers, rate limiting, and profanity filter
`@suaveplan/combat`	–	Core combat mechanics with damage types, health, armor, shields, and status effects
`@suaveplan/controller`	–	Controller abstractions
`@suaveplan/crafting`	–	Recipe-based crafting with stations, material requirements, quality tiers, and queues
`@suaveplan/day-night`	–	Day/night cycle with configurable time, light schedules, and gameplay modifiers
`@suaveplan/destructibles`	–	Destructible environment system with fracture patterns, debris, and loot
`@suaveplan/dialogue`	–	Branching dialogue trees with conditional choices, bark system, and conversation management
`@suaveplan/economy`	–	In-game economy with wallets, trading, marketplace, and auction system
`@suaveplan/ecs`	–	Archetype-based Entity Component System with bitset queries
`@suaveplan/emotes`	–	Emote/expression system with registry, cooldowns, and level-gated unlocks
`@suaveplan/fauna`	–	Wildlife AI with herding, predator-prey, territorial zones, and taming
`@suaveplan/fruit-machine`	–	Nested state-machine engine for fruit-machine / AWP games (Adders & Ladders reference)
`@suaveplan/game-loop`	–	Fixed-timestep game loop with tick scheduling
`@suaveplan/game-persistence`	–	Save/load game state with versioned migrations
`@suaveplan/game-server`	–	Universal game server framework with sessions, networking, matchmaking, and game queue
`@suaveplan/game-state-schemas`	–	Bit-level quantization schemas for multiplayer state compression
`@suaveplan/heightmap-tiles`	–	Delta-encoded heightmap tile pyramid with adaptive bit depth
`@suaveplan/hitbox`	–	Hierarchical hit detection with per-bone hitboxes, raycasting, and sweep tests
`@suaveplan/ik-solver`	–	Pure math inverse kinematics solvers (two-bone, look-at, multi-chain)
`@suaveplan/leaderboard`	–	Leaderboard system with rankings, seasonal resets, and around-player queries
`@suaveplan/lobby`	–	Multiplayer lobby management with matchmaking and countdown
`@suaveplan/mixamo`	–	Mixamo character utilities
`@suaveplan/npc`	–	NPC lifecycle management with spawn pools, population control, and daily schedules
`@suaveplan/osm-buildings`	–	OSM building/road geometry extraction and mesh generation
`@suaveplan/party`	–	Party/group system with invites, leadership transfer, and kick/promote
`@suaveplan/progression`	–	Character progression with XP curves, skill trees, perks, and achievements
`@suaveplan/quest`	–	Quest/mission system with multi-objective tracking, chains, rewards, and event-driven triggers
`@suaveplan/react-controller`	–	Game controller components
`@suaveplan/react-crafting`	–	Crafting UI with recipe filtering, station selection, and craft queues
`@suaveplan/react-dialogue`	–	Dialogue UI with typewriter effect, choices, and speaker portraits
`@suaveplan/react-game-hud`	–	Game HUD state for health, ammo, compass, minimap, notifications
`@suaveplan/react-game-map`	–	World map with viewport, markers, fog of war, and zoom controls
`@suaveplan/react-game-settings`	–	Game settings for graphics, audio, controls, and accessibility
`@suaveplan/react-social-game`	–	Social game UI with friends list, requests, blocking, and status
`@suaveplan/vehicle-physics`	–	Engine-agnostic vehicle physics (Pacejka tires, suspension, drivetrain)
`@suaveplan/weapons`	–	Weapon system with projectile ballistics, melee, recoil, ammo, and attachments
`@suaveplan/weather`	–	Dynamic weather simulation with transitions, zones, and gameplay effects

`geo`

Package	Status	Info
`@suaveplan/geo`	✅	Abstract geospatial geometry: ellipsoids, spherical coordinates, transforms, distance, bearing, angular separation, bounds, polygons, units, and Zod schemas
`@suaveplan/geo-earth`	✅	Earth configuration and legacy geo utilities — WGS84 constants, geocoding, geohash, coordinate parsing/formatting
`@suaveplan/geo-planet`	✅	Configurable planet surface geometry from PlanetConfig — ellipsoid, atmosphere, satellites, and orbital elements
`@suaveplan/solar-system`	✅	Solar system provider with injectable astronomy engine — body positions, seasons, equinoxes, solstices, sunrise/sunset, lunar phases
`@suaveplan/stars`	✅	Star catalog provider with in-memory sources, cone queries, magnitude filtering, and atmospheric extinction
`@suaveplan/tides`	✅	Tidal prediction providers — TICON harmonic engine, ADMIRALTY, and physics-based with multi-satellite superposition
`@suaveplan/universe`	✅	Observer model, coordinate frames, wire protocol packets, and provider registry for solar, star, tide, and weather data

`gtap`

Package	Status	Info
`@suaveplan/api-plugin-gtap`	–	GTAP integration plugin

`i18n`

Package	Status	Info
`@suaveplan/i18n`	✅	Slim integration core (Wave 6 modular split, archived 2026-05-09). Owns the `MessageCatalog` (typed `t<K extends DotPaths<TMessages>>`, ergonomic options bag, nested `$t()` refs), `createI18n` / `I18nInstance` plugin slot, locale negotiation/resolver, server middleware, observability state (detector + backend metrics), schemas, key utilities, post-processors (pseudo-localize, missing-key reporter), and `defaultFormatBridge` wiring the per-formatter packages into the universal-tier ICU parser. Constants / errors / parser / pluralization / interpolation / formatters / detector / backends now live in 14 sibling packages and are re-exported here via the root barrel for back-compat. Four kept subpaths (`./detector`, `./parser`, `./plugin`, `./errors`). 320 tests in the slim core, 100/100/100/100 coverage; downstream sweep 40 react-* tasks green (1238 tests in `react-ui` alone). Bundle 592 KB / 15 modules (was ~3.5 MB / ~120 modules pre-split).
`@suaveplan/i18n-backend-chained`	✅	Universal-tier chained backend orchestrator: `ChainedBackend` class + `chainedBackend` factory, capabilities matrix derived from union of children (`canRead: true`; `canSave/canTrackModification/canWatch` follow union), read-fallthrough on `BACKEND_LOCALE_NOT_AVAILABLE` with immediate propagation of `BACKEND_READ_FAILED`, write-through cache after successful read from index N to indices 0..N-1 (best-effort; per-backend save failures swallowed), `readMulti` concurrent fan-out with `first-wins` (default) or `last-wins` merge strategies (gaps filled regardless), `save` fan-out to every save-capable child surfacing failures as `BACKEND_WRITE_FAILED`, `lastModified` returns first defined timestamp, `init` forward / `dispose` reverse-order, optional `AbortSignal` on `read`/`readMulti`/`save` throwing `BACKEND_TIMEOUT` on pre-aborted signals + threaded into children, defensive `CHAINED_BACKEND_ALL_FAILED` runtime guard for empty-chain bypasses past the schema, Zod boundary validation throwing `INVALID_OPTIONS`, OTel instruments (`i18n.backend.chained.read_duration_ms{backend,locale,namespace,outcome}` histogram, `read_total{backend,outcome}` counter — `outcome ∈ hit/miss/error/cache_hit/cache_miss/primary` extending the base set with chained-cache classification, `read_errors_total{backend,code}` counter, `write_duration_ms`/`write_total{backend,outcome}`, `fallthrough_total{from_backend,to_backend}` counter for per-link fallthrough rate). Tested with shared `runBackendConformance` harness from `@suaveplan/i18n-shared/testing`.
`@suaveplan/i18n-backend-fs-multifile`	✅	Server-tier Node `fs/promises`-backed translation backend: `MultiFileFsBackend` class + `multiFileFsBackend` factory, 5-flag capability matrix (`canRead: true`, `canReadMulti: false`, `canSave: true`, `canTrackModification: true`, `canWatch` follows the `watch` option), three wire layouts (`nested` default reads `<root>/<locale>/<namespace>.<ext>`, `flat` reads `<root>/<locale>.<namespace>.<ext>`, `glob` substitutes `{locale}` / `{namespace}` placeholders into a caller-supplied pattern joined to root). JSON built-in encode/decode rejecting non-object payloads as `BACKEND_READ_FAILED`; YAML/YML and JSON5 auto-detected via dynamic `import()` (`yaml` / `json5` are optional peer deps, never direct deps); missing peers surface as `BACKEND_READ_FAILED` with `peer` in the error context. Optional `fs.watch` loop emits `loaded` events through `BackendInitContext.emitLoaded` for both `nested` and `flat` layouts (HMR / Suspense refresh integration). ENOENT / ENOTDIR map to `BACKEND_LOCALE_NOT_AVAILABLE` (chained-backend fallthrough); other errno codes (`EACCES`, `EBUSY`, …) map to `BACKEND_READ_FAILED`; `writeFile` failure → `BACKEND_WRITE_FAILED` with `cause` preserved; unsupported encode extension → `BACKEND_WRITE_FAILED`. Optional `AbortSignal` on `read`/`save` throws `BACKEND_TIMEOUT` on pre-aborted signals before any filesystem call. Injectable `MultiFileFsLike` shim defaulting to `node:fs/promises` via dynamic import — tests run against a real `node:fs.mkdtemp` tmpdir per CLAUDE.md "no mocks" rule. Zod boundary validation throwing `INVALID_OPTIONS` (rejects bad `layout`, empty `name`, `glob` without `globPattern`). OTel instruments (`i18n.backend.fs_multifile.read_duration_ms{backend,locale,namespace,outcome,layout}` histogram, `read_total{backend,outcome,layout}` counter, `read_errors_total{backend,code,layout}` counter, `write_duration_ms{backend,outcome,layout}` histogram, `write_total{backend,outcome,layout}` counter — `layout` 3-value low-cardinality enum). `package.json` declares `engines.node >=20`, omits `browser` field; leading `// Server-tier package` comment in `src/backend/backend.ts`; NOT re-exported from slim `@suaveplan/i18n` core (Wave 6). Tested with shared `runBackendConformance` harness from `@suaveplan/i18n-shared/testing`.
`@suaveplan/i18n-backend-http`	✅	Universal-tier `fetch`-based translation backend: `HttpBackend` class + `httpBackend` factory, read-only 5-flag capability matrix (`canRead=true`, all writes/watches false), URL templating via `{locale}`/`{namespace}` placeholders with `encodeURIComponent`, pluggable `parsePayload` (default JSON-object parser rejecting arrays/null/primitives as `BACKEND_READ_FAILED`), exported `defaultParsePayload` + `buildUrl` helpers, pluggable `customHeaders` builder, `crossDomain: true` shorthand for `credentials: "include"` + `mode: "cors"`, structurally-compatible `retry?: HttpBackendRetry` (consumes `@suaveplan/retry`'s `RetryPolicy` without a hard dep), optional `AbortSignal` on `read` throwing `BACKEND_TIMEOUT` on pre-aborted signals + threading into `RequestInit` for mid-flight cancellation (AbortError / `ABORT_ERR` code → `BACKEND_TIMEOUT`), `defaultFetch()` fallback throwing `BACKEND_READ_FAILED` when `globalThis.fetch` is unavailable, Zod boundary validation throwing `INVALID_OPTIONS`, error semantics (404 → `BACKEND_LOCALE_NOT_AVAILABLE` for chained-backend fallthrough; 5xx / network / parse → `BACKEND_READ_FAILED` chain-stopping signal), OTel instruments (`i18n.backend.http.read_duration_ms{locale,namespace,outcome}` histogram, `read_total{outcome}` counter, `read_errors_total{code,status?}` counter — `status` present on HTTP-classified errors). Tested with shared `runBackendConformance` harness from `@suaveplan/i18n-shared/testing`.
`@suaveplan/i18n-backend-memory`	✅	Universal-tier in-memory translation backend: `MemoryBackend` class + `memoryBackend` factory, full 5-flag capability matrix (`canRead/canReadMulti/canSave/canTrackModification`, `canWatch=false`), `Map<locale, Map<namespace, TranslationRecord>>` store + modification ledger, injectable `now` clock, optional `AbortSignal` on `read`/`readMulti`/`save` throwing `BACKEND_TIMEOUT`, Zod boundary validation throwing `INVALID_OPTIONS`, OTel instruments (`i18n.backend.memory.read_duration_ms`, `read_total{outcome}`, `read_errors_total{code}`, `write_duration_ms`, `write_total{outcome}`). Tested with shared `runBackendConformance` harness from `@suaveplan/i18n-shared/testing`.
`@suaveplan/i18n-backend-storage`	✅	Universal-tier `AbstractStorage`-backed translation backend: `StorageBackend` class + `storageBackend` factory, full 5-flag capability matrix (`canRead/canReadMulti/canSave/canTrackModification`, `canWatch=false`), three wire layouts (`single-key-per-namespace` default, `single-key-per-locale`, `flat-keys`), pluggable codec (default JSON via `TextEncoder`/`TextDecoder` rejecting non-object payloads as `BACKEND_READ_FAILED`), exported `defaultCodec`, optional `AbortSignal` on `read`/`readMulti`/`save` throwing `BACKEND_TIMEOUT`, Zod boundary validation throwing `INVALID_OPTIONS`, `lastModified` consults `AbstractStorage.getMetadata().modifiedAt` (max across leaves for `flat-keys`), OTel instruments (`i18n.backend.storage.read_duration_ms`, `read_total{outcome,layout}`, `read_errors_total{code,layout}`, `write_duration_ms`, `write_total{outcome,layout}` — `layout` is a 3-value low-cardinality enum). Tested via `runBackendConformance` against all three layouts.
`@suaveplan/i18n-detector`	✅	Universal-tier locale-detection chain: `createDetectorChain` orchestrator, `bcp47Negotiate` default negotiator, `getTextDirection` / `isRtl` helpers, 9 detectors (querystring, userPreference, cookie, localStorage, htmlLang, acceptLanguage, navigator, cloudflareIpGeo, fallback), `defaultDetectorChain` factory, OTel instruments (`i18n.detector.match_total{detector}`, `i18n.detector.detected_total{detector,locale}`, `i18n.detector.duration_ms`, `i18n.detector.chain.exhausted_total`, `i18n.detect` span).
`@suaveplan/i18n-formatter-collator`	✅	Universal-tier `Intl.Collator` adapter exposing locale-aware string comparison + sort helpers, plugged into `defaultFormatBridge`.
`@suaveplan/i18n-formatter-currency`	✅	Universal-tier `Intl.NumberFormat` currency adapter. Currency-code-aware formatting with sign display + accounting modes, plugged into `defaultFormatBridge`.
`@suaveplan/i18n-formatter-date`	✅	Universal-tier `Intl.DateTimeFormat` adapter. Date / time / datetime formatting with caller-supplied options and cache, plugged into `defaultFormatBridge`.
`@suaveplan/i18n-formatter-display-name`	✅	Universal-tier `Intl.DisplayNames` adapter for language / region / script / currency name lookup, plugged into `defaultFormatBridge`.
`@suaveplan/i18n-formatter-list`	✅	Universal-tier `Intl.ListFormat` adapter. Conjunction / disjunction / unit list formatting plugged into `defaultFormatBridge`.
`@suaveplan/i18n-formatter-number`	✅	Universal-tier `Intl.NumberFormat` adapter for the i18n family. Locale-aware decimal / percent / scientific / compact formatting with caching, plugged into `defaultFormatBridge` by `@suaveplan/i18n`.
`@suaveplan/i18n-formatter-relative-time`	✅	Universal-tier `Intl.RelativeTimeFormat` adapter. Locale-aware relative-time strings ("3 days ago", "in 2 hours"), plugged into `defaultFormatBridge`.
`@suaveplan/i18n-formatter-segmenter`	✅	Universal-tier `Intl.Segmenter` adapter exposing grapheme / word / sentence iteration, plugged into `defaultFormatBridge`.
`@suaveplan/i18n-icu-parser`	✅	Universal-tier ICU MessageFormat parser carved out of the i18n core (Wave 6). Tokenizer + AST builder for ICU syntax (plural, select, selectordinal, number/date/time formatters, nested placeholders), pluralization helpers, interpolation engine, integrates with the per-formatter packages via the `defaultFormatBridge`.
`@suaveplan/i18n-shared`	✅	Shared runtime atoms for the i18n family — locale constants, BCP-47 normalisation map, RTL set, locale descriptors, interpolation defaults, the `I18N_CODES` registry, the `I18nError` base class, AND (Wave 5a) the `runBackendConformance(...)` shared harness under the `/testing` subpath consumed by every `@suaveplan/i18n-backend-*` package.
`@suaveplan/locale-data`	✅	Static ISO 3166-1 country data and ISO 639-1 language data with typed lookup fu…
`@suaveplan/react-i18n`	✅	React bindings for `@suaveplan/i18n`: `<TranslationProvider>`, 14 hooks (incl. `useFormatter`, `useLocaleAdapter`), 4 components, `withTranslation` HOC, 9-detector chain + `useLocaleDetection`, branded `TranslationKey` typing, `tDynamic`, `REACT_I18N_CODES` (12 codes), OTel telemetry. Plugin substrate `createReactI18nRegistry` + `<RegistryProvider>`: four plugin kinds (detector / formatter / post-processor / locale-adapter) with idempotent registration, schema validation, disposable lifecycle. Six built-in formatter plugins auto-register; detector chain accepts plugin splice by priority; post-processor pipeline runs in `<Trans>` after ICU. 408 tests, 100% coverage, 1238-test downstream sweep green. Plugin substrate shipped 2026-05-10 (`react-i18n-plugin-registry-and-ui-primitives` archived).

`image`

Package	Status	Info
`@suaveplan/caddy-imgproxy`	✅	Universal-tier TypeScript port of the Caddy imgproxy URL rewriter — compact-grammar parser, aspect / pixel dimension resolver, gravity + operation translator, HMAC-SHA256 URL signer, full handler with Zod-validated config and OTel telemetry.
`@suaveplan/compress-image`	✅	Runtime-agnostic image compression utilities: resize, quality reduction, format…
`@suaveplan/emblem-solver`	✅	Minimal-rectangle SVG converter for pixelated sprite...
`@suaveplan/exif`	✅	Dependency-free, runtime-agnostic EXIF/XMP/IPTC metadata reader, writer, and st…
`@suaveplan/image`	✅	Universal-tier image metadata extraction, format detection, resize math, crop validation, and transform pipeline planning.
`@suaveplan/colours`	✅	Universal-tier colour manipulation: parsing, conversion, analysis, mixing, blending, and palette generation.
`@suaveplan/colour-convert-hsluv`	✅	HSLuv perceptually uniform colour space with gamut mapping and uniform harmonies.
`@suaveplan/colour-convert-cieluv`	✅	CIELUV, xyY, LMS cone response, and Bradford chromatic adaptation with CIE standard illuminants.
`@suaveplan/colour-filter-cmc`	✅	CMC l:c Delta-E colour difference metric for textile and print quality control.
`@suaveplan/colour-filter-cct`	✅	Correlated Colour Temperature (CCT) calculation and approximation from RGB.
`@suaveplan/image-quantisation`	✅	Image complexity analysis and adaptive colour quantisation with pool detection, spatial-aware AA cleanup, and multiple quantisation algorithms.
`@suaveplan/react-image`	–	Image components with lazy loading

`logistics`

Package	Status	Info
`@suaveplan/api-plugin-customs`	–	Cross-border customs — declarations, HS codes, borde...
`@suaveplan/api-plugin-logistics`	–	Enterprise logistics — shipments, carriers, pallets,...
`@suaveplan/api-plugin-port-tracking`	–	Port tracking — vessel positions, port calls, shippi...
`@suaveplan/api-plugin-procurement`	–	Procurement — purchase orders, goods receipt notes, ...
`@suaveplan/api-plugin-warehouse-ops`	–	Warehouse operations — pick/pack/ship, cycle counts,...
`@suaveplan/delivery-tracking`	✅	Channel-agnostic delivery event tracking
`@suaveplan/ports`	✅	Universal-tier global port database with shipping-lane routing and ETA estimation. Curated `Port` registry (~100 sea ports across 5 regions + ~30 cargo airports + ~30 rail freight terminals), UN/LOCODE lookups (`findPort` / `findPortStrict`), country / type / name filters, proximity search (`findNearestPort`, `findPortsInRadius`) via a 5°-bucketed `PortSpatialIndex`, curated `shippingLanes` waypoint graph, lane distance via `@suaveplan/geo` great-circle (`estimateLaneDistance`, `cumulativeDistances`), lane projection (`findPositionOnLane`), ETA estimation (`estimateETA`) with injectable `Clock` and three-tier confidence band. Eight `PORTS.*` error codes + 8 typed `PortsError` subclasses, Zod schemas for every public type, 3 OTel counters + 3 histograms, 99 tests at 100/100/100/100 coverage. Deps: `@suaveplan/error`, `@suaveplan/geo`, `@suaveplan/types`, `@opentelemetry/api`, `zod`.
`@suaveplan/react-port-tracking`	–	Port tracking components and hooks

`messaging`

Package	Status	Info
`@suaveplan/api-plugin-messaging`	–	Messaging plugin
`@suaveplan/api-plugin-notifications`	✅	Notifications plugin
`@suaveplan/discord-client`	✅	Generic Discord API client for webhooks, bot messaging, and embeds. 62 tests, 100% coverage. Shipped parallel session.
`@suaveplan/imessage-adapter`	✅	macOS iMessage SQLite chat.db watcher + `MessageSourceAdapter` projection. Zod-validated config boundary, AbortSignal-aware polling, monotonic `lastRowId` cursor (settable + readable for resume), injectable `SqliteReader` (production `bunSqliteReader` via lazy `createRequire(import.meta.url)("bun:sqlite")`, tests via real chat.db fixture — no mocks), typed `EventBus<IMessageWatcherEvents>` surface beside legacy `on/off`, 10 `IMESSAGE.*` codes (`DB_OPEN_FAILED`, `DB_QUERY_FAILED`, `WATCHER_NOT_RUNNING`, `WATCHER_ALREADY_RUNNING`, `ADAPTER_NOT_INITIALIZED`, `INVALID_CONFIG`, `POLL_ABORTED`, `POLL_FAILED`, `ATTACHMENT_PARSE_FAILED`, `APPLE_DATE_PARSE_FAILED`), 4 OTel instruments (`messages_emitted_total{chat_type,from_me}`, `attachments_emitted_total{mime_family}`, `poll_errors_total{code}`, `poll_duration_ms{outcome}`). 89 tests, 100% line coverage on every package file.
`@suaveplan/react-notifications`	–	Toast/notification system
`@suaveplan/slack-client`	✅	Generic Slack API client for messaging, channels, and webhooks
`@suaveplan/sms`	✅	SMS send/receive, delivery status tracking, template...
`@suaveplan/sms-providers`	✅	Universal-tier SMS provider implementations for `@suaveplan/sms`: Twilio (HTTP Basic + form + X-Twilio-Signature HMAC-SHA1), Vonage (form auth + HMAC-SHA256), MessageBird (AccessKey + JWT HS256 with iat/exp/nbf window), Plivo (Basic + X-Plivo-Signature-V3 HMAC-SHA256), AWS SNS (inline SigV4 + RSA-SHA1 SNS verifier with injectable callback). `ProviderRegistry`, `httpRequest` over injectable `FetchLike`, `composeAbortSignal`, `defineCodes("SMS_PROVIDERS", [8])` + `SmsProvidersError`, per-provider `mapStatus`/`parseInbound`/`verifyWebhookSignature`, `parseOptOutKeyword` (CTIA/TCPA STOP/UNSTOP/HELP), five OTel instruments. 236 tests inc. real `node:http` round-trip per provider + real `node:crypto` HMAC + RFC 4231/2202 test vectors + RFC SHA-256 fixtures + targeted branch-coverage suites for conditional-spread arms and default-config paths. 100/100/100/100 across statements/branches/functions/lines.
`@suaveplan/telegram-client`	✅	Generic Telegram Bot API client for messaging, groups, and media

`monitor`

Package	Status	Info
`@suaveplan/audit-logging`	✅	Tamper-proof, GDPR-compliant audit logging: cryptographic chain-integrity, plug…
`@suaveplan/logger`	✅	Foundation logging package — structured JSON output, level filtering, redaction…
`@suaveplan/opentelemetry`	✅	OpenTelemetry SDK setup and configuration helpers: tracer/meter/logger provider…

`network`

Package	Status	Info
`@suaveplan/network`	✅	Core network interfaces: NetworkNode, NetworkPlugin, NetworkBus, MessageEnvelop…
`@suaveplan/network-bootstrap`	✅	Pluggable peer-discovery chain + TTL peer cache + `BootstrapPlugin`/`BootstrapMiddleware`; injectable `Clock`, `@suaveplan/retry` backoff+jitter, NetworkBus events, opt-in `PeerCacheStorageLike`, NET_BOOTSTRAP error registry, Zod boundaries, OTel surface (span + 2 counters + duration histogram), AbortSignal everywhere. 67 tests, 100/100/100/100.
`@suaveplan/network-discovery-crdt`	✅	Browser-tier CRDT-awareness `DiscoveryStrategy` for `@suaveplan/network-bootstrap`. Construction-time provider selection (Yjs OR Automerge) via single `CRDTProviderAdapter` — no runtime swap. Injectable `yjsDocFactory` / `automergeRepoFactory`; `signaling` URL list REQUIRED (no `wss://signaling.yjs.dev` default). 7-code `NET_DISC_CRDT` registry, Zod boundaries, OTel surface (start span + per-provider sync span + counter + histogram), AbortSignal everywhere. 92 tests (16 Yjs + 13 Automerge + 32 orchestrator + property suite), 100/100/100/100; FakeYjsBroker/FakeAutomergeBroker real impls — no mocks.
`@suaveplan/network-discovery-gundb`	✅	Browser-tier GunDB gossip `DiscoveryStrategy` with enterprise security uplift over upstream's flagged-fragile audit: mandatory `peers` list, Ed25519-signed peer-announces (unsigned/tampered silently dropped), Zod wire validation, constant-time peer-ID compare. + ships `Transport` + `NetworkPlugin` via `./transport` + `./plugin` subpaths (Wave 3.5 fold) — every `transport.send()` flows through `signEnvelope`; every inbound payload gated by Zod parse → verify → senderPeerId match → recipient match BEFORE caller handler. Same `gundb.invalid_messages_total` + `gundb.signature_rejected_total` counters cover transport tier. 11-code `NET_DISC_GUNDB` registry (8 discovery + 3 transport). 114 tests (67 discovery + 47 transport/signing/plugin), 100/100/100/100.
`@suaveplan/network-discovery-hybrid`	✅	Browser-tier multi-strategy `DiscoveryStrategy` orchestrator over the five Wave-2 siblings (peerjs/crdt/trystero/webtorrent/gundb), all declared as optional peer-deps with graceful degradation via `STRATEGY_LOAD_FAILED`. Five-module composer: `HybridDiscoveryManager` + `StrategyManager` (health/priority) + `Lifecycle` (start/stop FSM) + `PeerTracker` (deduped peer set with `PeerSource` provenance) + `StrategyLoader` (dynamic `import()`-based lazy resolution). Banned-mock removal: upstream `__mocks__/strategy-mock.ts` explicitly dropped; in-package `TestStrategy` deterministic real fixture under `tests/setup/`. Zero `vi.mock`/`jest.mock`/`__mocks__/`/`: any` anywhere. 6-code `NET_DISC_HYBRID` registry, Zod boundaries, OTel surface incl. `hybrid.fallback_total{from,to}` + `hybrid.active_strategies` gauge. 89 tests across 7 files (4 integration), 100/100/100/100.
`@suaveplan/network-discovery-peerjs`	✅	Browser-tier PeerJS `DiscoveryStrategy` for `@suaveplan/network-bootstrap`. Mandatory `host` + injectable `peerFactory` (no public-`peerjs.com` fallback). + ships `Transport` + `NetworkPlugin` via `./transport` + `./plugin` subpaths (Wave 3.2 fold) — lazy peer init, per-peer `DataConnectionLike` registry over wire frame `{kind: "suaveplan.transport.v1", envelope}` that discovery's Zod schema rejects so transport + discovery share one PeerJS unit cleanly. 10-code `NET_DISC_PEERJS` registry (5 discovery + 5 transport), OTel adds `peerjs_transport.*` instruments. 145 tests (101 discovery + 44 transport/plugin/otel), 100/100/100/100.
`@suaveplan/network-discovery-trystero`	✅	Browser-tier Trystero `DiscoveryStrategy` with 4 transports (BitTorrent / Nostr / MQTT / IPFS) behind single `TrysteroTransportAdapter` interface. Mandatory non-empty relay lists; auto-fallback via `@suaveplan/retry`. + ships `Transport` + `NetworkPlugin` via `./transport` + `./plugin` subpaths (Wave 3.3 fold) — `TrysteroNodeTransport` (renamed to avoid string-union collision) over `"envelope"` action namespace, factory resolution for all 4 transport kinds, room-leave auto-prune. 14-code `NET_DISC_TRYSTERO` registry (10 discovery + 4 transport). 150 tests (118 discovery + 32 transport/plugin), 100/100/100/100.
`@suaveplan/network-discovery-webtorrent`	✅	Browser-tier WebTorrent-tracker `DiscoveryStrategy` via `p2pt` for `@suaveplan/network-bootstrap`. Mandatory `.min(1)` tracker list (no public-tracker fallback survives). Injectable `p2ptFactory` + `FakeP2PT` real impl (no mocks). + ships `Transport` + `NetworkPlugin` via `./transport` + `./plugin` subpaths (Wave 3.4 fold) — per-peer registry, lazy p2pt instantiation, AbortSignal-aware, 30 s default `CONNECT_TIMEOUT`. 13-code `NET_DISC_WEBTORRENT` registry (5 discovery + 8 transport), OTel adds `webtorrent_transport.*` instruments. 96 tests (46 discovery + 50 transport/plugin/otel), 100/100/100/100.
`@suaveplan/network-gundb-server`	✅	Server-tier (Node-only) GunDB relay daemon paired with `@suaveplan/network-discovery-gundb` ✅ clients. Idempotent `start({signal?})` / `stop()` lifecycle; injectable `gunFactory` + `FakeGun` real impl (no mocks). Inline `/health` `/ready` `/live` JSON endpoints. Honours client's wire-format security model: Zod-validates inbound announces against shared `GunDBPeerAnnounceSchema` (single source of truth) and silently drops malformed/wrong-kind/missing-sig/missing-key with `gundb_server.invalid_messages_total{reason}`. Signature verification deliberately at client (gossip-security model). Real-server-boot integration test on port 0. 6-code `NET_GUNDB_SERVER` registry, OTel surface. 56 tests, 100/100/100/100.
`@suaveplan/network-libp2p-server`	✅	Server-tier libp2p bootstrap + circuit-relay-v2 daemon paired with `@suaveplan/network-transport-libp2p` ✅ clients. Idempotent `start({signal?}) → {peerId, multiaddrs[]}` / `stop()` lifecycle; required injectable `libp2pFactory` (no native deps on test surface). Inline `/health`/`/ready`/`/live` HTTP probes. TCP + WebSockets listen, Noise + Yamux + Identify + Bootstrap, autoRelay enabled. 6-code `NET_LIBP2P_SERVER` registry, OTel (span + 3 counters + gauge + histogram). All discipline metrics clean — 299 LOC max source, 384 LOC max test, zero `:any`/mocks/React. 4-scenario in-process integration (health probes + client dial + 2-client autoRelay stream + graceful stop). 59 tests, 100/100/100/100.
`@suaveplan/network-plugin-assignment`	✅	Mesh auto-placement: MeshCapacityTracker (live peer-event consumption), AssignmentEngine (weighted multi-criteria scoring across latency/capacity/load/region/tier-fit), MeshBalancer (rebalance planning), AdmissionController (policy-gated admission).
`@suaveplan/network-plugin-audit-mesh`	✅	Signed append-only audit logs across the mesh: hash-chained event records, host-signed entries, cross-host replication for durability, server reconciliation on reconnection, compaction and conflict resolution.
`@suaveplan/network-plugin-auth`	✅	Mesh membership auth + capability tokens: MeshMembershipVerifier (join authorization via auth provider), CapabilityTokenIssuer (tier-bound Ed25519-signed tokens), CrossMeshTrustValidator (relay trust relations).
`@suaveplan/network-plugin-circuit-breaker`	✅	Mesh-boundary circuit breaking: per-path MeshCircuitBreaker FSM (CLOSED→OPEN→HALF_OPEN), fleet-wide registry, half-open probe with bounded test traffic, relay-integration middleware.
`@suaveplan/network-plugin-content-delivery`	✅	P2P file-chunk distribution over the mesh: chunk redundancy planner, integrity verifier, latency-aware routing, plugin wrapper bridging `@suaveplan/drive` chunks across WebRTC peers. (Sub-changes for packer/prefetch/store/throttle remain open.)
`@suaveplan/network-plugin-crypto-messages`	✅	Cryptographic message integrity: per-message Ed25519 signing/verify, peer identity verification via challenge-response, server-signed session/mesh tokens, key rotation, hash-chained log integrity.
`@suaveplan/network-plugin-devtools`	✅	Developer-tools plugin: NetworkVisualizer (hierarchy/flow/heat IR + injectable Renderer + bundled SVG renderer), StateInspector (per-path ring + RFC-6902 diff via @suaveplan/diff + scrubber + composable search), SimulationConfigTool (programmatic peer/link/condition/event editor with deterministic recording, atMs-grouped playback, Zod-validated JSON round-trip), PerformanceProfiler (p50/p95/p99 latency distributions + throughput + plugin overhead + memory tracking + named baselines + Z-score regression detection + categorised optimisation suggestions), and DevToolsPlugin facade with tier gate and `requireActive()` PLUGIN_DEV_DISABLED guard. 111 tests, 100/100/100/100 coverage, OTel counters across every subsystem.
`@suaveplan/network-plugin-failover`	✅	Mesh failover orchestration: HeartbeatManager, HealthMonitor (alive→suspect→dead), debounced PromoterManager, FailoverCoordinator failure-transition, FailoverPlugin wrapper.
`@suaveplan/network-plugin-governance`	✅	Host elections + reputation: ElectionEngine (metric/direct/hybrid modes), CandidateScorer (weighted multi-criteria), ReputationTracker, VotingManager, TransitionManager handover FSM, GovernancePlugin wrapper.
`@suaveplan/network-plugin-intra-relay`	✅	Intra-mesh relay routing: connection manager, peer discovery, envelope encoding, loop guard, relay monitor, peer selector, plugin wrapper. (Security extension proposal still open.)
`@suaveplan/network-plugin-middleware`	✅	Pluggable middleware pipeline for the network bus: 12 modules covering throttling, validation, observability, error handling, transformation, and lifecycle hooks; 85 conformance tests.
`@suaveplan/network-plugin-migration`	✅	Peer state migration between meshes: MigrationCoordinator (initiate→pack→transfer→drain), StateTransferProtocol (snapshot serialize/deserialize), ForwardingTunnel (buffer + drain). Adapters intentionally deferred to dedicated `migration-adapter-*` packages.
`@suaveplan/network-plugin-monitor`	✅	Network health + telemetry monitoring: peer-quality scorers, RTT/loss collectors, alert thresholds, OTel histogram + counter wiring. + Wave 6.1 fold of `@suaveplan/network-observability` — universal-tier Prometheus exposition emitter (hand-rolled `0.0.4` text format from `MetricCollector.scrape()`, sanitised metric/label names + escaped label values, counter/gauge/histogram/summary support with configurable quantiles, optional timestamps, pinned `Content-Type`; no `prom-client` dep) and Grafana dashboard JSON generator (auto-layout, injectable `Rng` for deterministic UIDs, Zod-validated panel options, pinned Prometheus datasource binding, `schemaVersion: 38`). + Wave 6.2 fold of `@suaveplan/network-quality` — universal-tier quality-class classification + adaptive degradation: `BandwidthMonitor` (single-pole EMA over bandwidth/RTT/loss, bounded ring buffer with configurable `maxSamples` + `smoothingFactor` validation, injectable `clock`, listener subscription returning unsubscribe fn), `DegradationManager` (4-rung ladder `MINIMAL=0 < LOW=1 < MEDIUM=2 < HIGH=3` with one-step transitions, candidate-must-persist `hysteresisMs` debounce — `0` commits same-call — over windowed averages, `forceLevel`/`reset` overrides with `"forced"`/`"reset"`/`"conditions-changed"` change-reasons, injectable `clock`), `createQualityMiddleware<M>(dm, options?)` (outgoing-message gate with per-`source` counters, HIGH/MEDIUM/LOW/MINIMAL drop policies, customisable critical-type allowlist + position-update set, identity-preserving pass-or-`null`-drop API), full `QualityLevel`/`BandwidthSample`/`QualityThresholds`/`LevelThreshold`/`QualityChangeEvent` Zod-validated types. 166 tests, 100/100/100/100.
`@suaveplan/network-plugin-partition`	✅	Split-brain detection + healing: PartitionDetector (peer reachability matrix), QuorumResolver (majority/weighted quorum policies), MergeProtocol (post-partition reconciliation).
`@suaveplan/network-plugin-protocol`	✅	Network protocol plugin: 13-byte binary header, message encoder/decoder, pipeli…
`@suaveplan/network-plugin-qos`	✅	Per-mesh QoS: BandwidthQuotaEnforcer, MessagePriorityClassifier, CongestionMonitor, qosRouter prioritising control-plane traffic over bulk.
`@suaveplan/network-plugin-registry`	✅	Fixed-capacity peer registry with bitpacker-based binary message encoding
`@suaveplan/network-plugin-relay`	✅	Cross-mesh federation: RelayRouter, HostBackboneTransport, CrossMeshEnvelope, MeshDirectory, LoopGuard, RelayManager wiring.
`@suaveplan/network-plugin-server-bridge`	✅	Tier-0 host ↔ central-server bridge: ServerGateway (transport-agnostic, 2× heartbeat disconnect detection), GracefulDegradationFsm (online → degrading → offline → recovering → online), OfflineModeCoordinator (autonomous mode + token-grace extension), LogBuffer (circular signed-log replay queue with hash-dedup), ReconciliationProtocol (server-watermark differential with LWW conflict resolution), CommandDispatcher (Ed25519 + nonce-replay protection), HeartbeatMultiplexer (Tier-0 batch forwarding), four hosting-model coordinators (PURE_CLIENT Byzantine quorum, SERVER_BASED, SERVER_TO_CLIENT_FAILOVER, CLIENT_WITH_SERVER_BACKUP), and ServerBridgePlugin facade with tier gate. 156 tests, 100/100/100/100 coverage.
`@suaveplan/network-plugin-session`	✅	Hierarchical session management: SessionTree, SessionManager, SessionRouter, per-session host election, transition FSM, parent-state bridge, capacity enforcer, mesh-wide registry, and SessionPlugin wrapper.
`@suaveplan/network-plugin-simulation`	✅	Mesh simulation harness: latency/loss/jitter injection, deterministic clock + RNG, scripted peer scenarios for failover/governance/partition tests across 11 modules.
`@suaveplan/network-plugin-state`	✅	Mesh-state coordination: shared key-value state with vector-clock conflict resolution, snapshot + delta sync, persistent backing, observable state subscriptions across 14 modules.
`@suaveplan/network-plugin-topology`	✅	Mesh topology plugin: tiered hierarchy (Tier 0 Host → Tier 1 SubHost → Tier 2 Leaf), latency-grouped neighbours, group manager, plugin wrapper.
`@suaveplan/network-plugin-transport-manager`	✅	Multi-transport orchestration: pool registry, capability negotiation, 5-tier priority routing (CRITICAL/HIGH/NORMAL/LOW/BULK) with redundant CRITICAL delivery, round-robin balancing, health monitor with auto-pause/resume, EMA quality-trend analyzer + pre-emptive selector with smooth handoff, session persistence buffer, prioritized connection recovery, continuity guard, battery-aware scheduler, bandwidth conservator.
`@suaveplan/network-testing`	✅	Network testing utilities
`@suaveplan/network-transport-hyperswarm`	✅	Server-tier (Node-only) `Transport` + `NetworkPlugin` over Hyperswarm DHT. Required injectable `hyperswarmFactory` (never imports `hyperswarm` directly — keeps native deps off the unit-test surface). Per-peer connection registry, hole-punched DHT discovery, Ed25519-signed peer announces with Zod wire-payload validation + defensive drop. Reputation store with monotonicity property test. `@suaveplan/serialize` length-prefix wire format. 10-code `NET_HYPERSWARM` registry, OTel (2 counters + 2 histograms + active-peers gauge), AbortSignal everywhere. 3-peer in-process integration test (`FakeSwarmHub`) green; all-to-all envelope exchange + disconnect propagation verified. 94 tests effectively 100% net-new (upstream was 8.98%). 100/100/100/100.
`@suaveplan/network-transport-libp2p`	✅	Universal-tier `Transport` + `NetworkPlugin` over the libp2p stack (websockets + webrtc sub-transports; tcp/mdns deferred to a future server-tier sibling). Required injectable `libp2pFactory` — package never imports `libp2p` at module-eval (keeps 12 subpackage native deps off the unit-test surface). Mandatory `bootstrap` list — no public-bootstrap fallback survives. 11-code `NET_LIBP2P` registry, OTel (3 counters + 2 histograms + active-peers gauge), AbortSignal everywhere. 9-module architecture, every file ≤300 LOC (max 290), every test file ≤500 LOC. Zero React imports / `:any` / mocks in the package. 2-peer integration tests for both websockets and webrtc sub-transports via `FakeLibp2pHub`. 749-LOC upstream demo extracted to Wave 7 (`react-network-libp2p-demo`). 74 tests, 100/100/100/100.
`@suaveplan/network-transport-standby`	✅	Pre-emptive WebRTC standby pool implementing `Transport`+`NetworkPlugin` from `@suaveplan/network`. Min/max slot pool + EMA health scoring (RTT/jitter/loss) + auto-reconnect FSM via `@suaveplan/retry` exponential backoff + equal jitter. Warm-up via `@suaveplan/timing` Scheduler + injectable `Clock`. Injectable `RtcConnectionFactory` + `FakeRtcConnection` real impl (no mocks). 6-code `NET_STANDBY` registry, Zod cross-field invariants, OTel (gauge + 2 counters + histogram). 102 tests; warm-to-active < 100 ms integration test green. fast-check verifies `warmCount + activeCount ≤ maxSlots`, eviction monotonicity, promotion atomicity, health bounds. (Renamed from upstream `network-standby-transport` per network-transport-family proposal.) 100/100/100/100.
`@suaveplan/network-transport-webrtc`	✅	WebRTC transport plugin for mesh networking: RTCPeerConnection data-channel tra…
`@suaveplan/network-transport-websockets`	✅	WebSocket `Transport` + `NetworkPlugin` per `@suaveplan/network` contract on top of existing `WebSocketClient` (typed framing, heartbeat, backpressure queue, injectable adapter). Per-peer registry with duplicate-id rejection, `AbortSignal` on connect, fan-in `onMessage`, idempotent close. Extended `defineCodes("NET_WS", [...])` with `PEER_ALREADY_CONNECTED`/`PEER_UNKNOWN`/`TRANSPORT_CLOSED`/`MAX_PEERS_EXCEEDED`. OTel spans + counters + active-peers gauge. 88 tests (60 baseline + 28 new conformance/edge), 100% coverage.
`@suaveplan/network-trystero-server`	✅	Server-tier Trystero signaling daemon paired with `@suaveplan/network-discovery-trystero` ✅ clients. Construction-time `mode: "mqtt"\|"nostr"` via single `BrokerLike` adapter (no runtime branching). Required injectable `mqttBrokerFactory`/`nostrRelayFactory` — production passes real WS broker shims, tests bind `FakeBroker` real impl. Idempotent `start({signal?})/stop()` lifecycle, inline `/health`/`/ready`/`/live`. 6-code `NET_TRYSTERO_SERVER` registry, OTel mode-labelled (span + 2 counters + gauge + histogram). Both modes integration-tested end-to-end (boot → health → published relayUrl round-trip → 2-client connect/frame/disconnect). 298 LOC max source, 413 LOC max test, zero `:any`/mocks. Concrete production broker shims deferred to future `network-trystero-server-broker-{mqtt,nostr}`. 69 tests, 100/100/100/100.
`@suaveplan/react-network-libp2p-demo`	✅	Net-new React demo for `@suaveplan/network-transport-libp2p` ✅, extracted from upstream's 749-LOC `libp2p-demo.tsx` per the tier-isolation rule. 6 subcomponents (`<Libp2pDemo>` root composer, `<NodeStatusPanel>`, `<NodeControls>`, `<PeerInteractionPanel>`, `<PeerList>`, `<LogPanel>`), each with sibling `.tsx`/`.md`/`.test.tsx`/`.stories.tsx`. `useLibp2pDemo` hook + `wirePeerEvents` helper. Bootstrap list is a required React prop (no hardcoded defaults). Consumes structural `Libp2pDemoNodeFactory` adapter — package never imports `libp2p`. 5-code `REACT_LIBP2P_DEMO_CODES` registry, Zod boundaries on props. Discipline: max source 263 LOC, max test 495 LOC, zero `:any`/mocks. 72 tests across 10 files, 100/100/100/100.
`@suaveplan/service-discovery`	✅	Universal `ServiceRegistry` with TTL/expiry, AbortSignal-aware `watch()`, optional storage persistence + `EventBusLike` fan-out; 100% coverage.
`@suaveplan/websocket-gateway`	✅	Server-tier WebSocket gateway hosting rooms + presence + channels. Idempotent `start({signal?}) → {address, port}` / `stop()` lifecycle. Required injectable `wsServerFactory` (production → real `ws.WebSocketServer`, tests → `FakeWsServer`/`RealWsServer` adapters; no mocks). 4 callback hooks for unmigrated deps (`authVerifier`/`authorizationCheck`/`rateLimitGate`/`auditLogger`) — default no-op, README documents replacement paths to `jwt-tenant`/`permissions`/`rate-limiter`/`audit-logging` when shipped. Direct integrations: `@suaveplan/idempotency` (dedup on mutating events), `@suaveplan/retry`, `@suaveplan/webhook-client` (signed presence-event delivery). 9-code `WS_GATEWAY` registry, OTel surface. 3-client real-`ws` integration test verifies room broadcast + health endpoints + shutdown. 125 tests, 100/100/100/100. (Note: `gateway/gateway.ts` is 332 LOC — 32 over CLAUDE.md hard cap as a documented facade-pattern exception; 7 subsystems already factored out cleanly.)

`platform`

Package	Status	Info
`@suaveplan/analytics-browser`	✅	Browser-tier client-side analytics: `AnalyticsTracker` + `BatchTransport` (AbortController + timeoutMs + 4xx short-circuit + exponential backoff) + `BeaconTransport` (sendBeacon + fetch keepalive) + `SessionManager`. Consent gate (`AllowAllPolicy`/`DoNotTrackPolicy`), `HeadSampler` with per-event overrides, PII scrubber (redact/hash/drop on dotted paths), `MemoryStorageBackend` + `WebStorageBackend` (maxBytes watermark). Zod-validated `AnalyticsEventSchema`. Eight-code `ANALYTICS_BROWSER.*` registry. Five OTel instruments. Typed `EventBus<AnalyticsEventMap>` lifecycle bus. 114 tests, 100/100/100/100.
`@suaveplan/audience-rules`	✅	Dynamic audience segmentation: predicate library, segment evaluator + refresher, Zod-validated store, typed errors, OTel.
`@suaveplan/campaigns`	✅	Campaign orchestration: 9-transition state machine, batch planner, 6-step workflow runner, CampaignStore + InMemory impl, audience+template+channel+schedule
`@suaveplan/etl`	✅	Extract-Transform-Load pipeline engine with typed stages, error handling, obser…
`@suaveplan/feature-flags`	✅	Provider-agnostic feature flag evaluation with typed flag values, strategy chai…
`@suaveplan/health-check`	✅	/health, /ready, /live with dependency checks (HTTP, TCP, custom); injectable fetch/connect; OTel duration histogram + status counters
`@suaveplan/notification-channel`	✅	Multi-channel notification routing with templates, r...
`@suaveplan/pwa`	✅	Browser-tier PWA: SW lifecycle manager, caching strategies + router, sync queue (IndexedDB/localStorage/memory) with retry + schema migration, push subscriptions, install-prompt, manifest builder, cross-tab update controller, OTel counters/histograms
`@suaveplan/search`	✅	Full-text and fuzzy search primitives with in-memory BM25 engine, trigram fuzzy…
`@suaveplan/webhook-client`	✅	Webhook delivery client with retry logic, HMAC signature generation/verificatio…

`r3f`

Package	Status	Info
`@suaveplan/r3f-animation`	–	Animation state machine, blend trees, layers
`@suaveplan/r3f-booking`	–	Interactive 3D venue maps for booking
`@suaveplan/r3f-building`	–	R3F building mode with snap system, ghost preview, and placement validation
`@suaveplan/r3f-buildings`	–	Instanced 3D building and road rendering for R3F
`@suaveplan/r3f-camera`	–	Advanced camera controls for React Three Fiber
`@suaveplan/r3f-character`	–	Character controller for 3D games
`@suaveplan/r3f-character-vehicle`	–	Character-vehicle integration (enter/exit, authority transfer)
`@suaveplan/r3f-character-vehicle-picker`	–	Character/vehicle picker UI with 3D previews, GTA-style customisation
`@suaveplan/r3f-combat`	–	R3F rendering layer for combat with hitbox debug, projectile trails, muzzle flash, impact effects, and damage numbers
`@suaveplan/r3f-controller`	–	Input controller for 3D scenes
`@suaveplan/r3f-earth`	–	3D globe with port markers, shipping lanes
`@suaveplan/r3f-emulator`	–	3D device emulation interface
`@suaveplan/r3f-environment`	–	Skybox, HDR, and lighting presets
`@suaveplan/r3f-lod`	–	Level-of-detail management
`@suaveplan/r3f-minimap`	–	Minimap renderer, entity tracking, fog-of-war
`@suaveplan/r3f-networking`	✅	R3F-tier multiplayer state sync: frame-loop interpolation, client-side prediction with reconciliation FSM (composes `@suaveplan/fsm`), snapshot diff round-trip (composes `@suaveplan/diff`), snapshot interpolation, React hooks (`useNetworkSync`/`useNetworkedEntity`/`useNetworkPredict`) and R3F components (`<NetworkProvider>`/`<NetworkedEntity>`/`<NetworkStats>` with Storybook stories). Transport-agnostic: accepts any `Transport` from `@suaveplan/network` via injection; ships `MemoryTransport` deterministic real-impl for tests + canonical wiring docs for `network-transport-webrtc`. 5-code `R3F_NET` registry, OTel surface, AbortSignal everywhere. Property tests: interpolation monotonicity (200 runs), prediction-reconcile convergence (50 runs), snapshot diff round-trip equivalence (100 runs). 152 tests, 100/100/100/100. Max source 177 LOC, max test 184 LOC, zero `:any`/mocks.
`@suaveplan/r3f-npc`	–	R3F NPC rendering with behavior tree debug, nameplates, and dialogue triggers
`@suaveplan/r3f-number-plate`	–	3D number plate component
`@suaveplan/r3f-parallax`	–	Interior-parallax components (WindowParallax + GridParallax)
`@suaveplan/r3f-particles`	–	GPU-accelerated particle systems (instanced)
`@suaveplan/r3f-pathfinding`	–	NavMesh pathfinding, steering, crowd simulation
`@suaveplan/r3f-performance`	–	Performance monitoring and optimization
`@suaveplan/r3f-physics-cascade`	–	Cascading physics effects
`@suaveplan/r3f-physics-core`	–	Physics engine abstraction layer
`@suaveplan/r3f-physics-rapier`	–	Rapier physics engine integration
`@suaveplan/r3f-shaders`	–	Custom shader effects and materials
`@suaveplan/r3f-terrain`	–	Procedural terrain with chunked LOD
`@suaveplan/r3f-ui`	–	HTML/React UI components in 3D space
`@suaveplan/r3f-vegetation`	–	R3F procedural vegetation with biome rules, LOD, and instanced placement
`@suaveplan/r3f-vehicle`	–	Vehicle controllers for React Three Fiber
`@suaveplan/r3f-water`	–	Water rendering and ocean simulation
`@suaveplan/r3f-weather`	–	R3F weather rendering with particles, fog, lightning, and surface wetness
`@suaveplan/r3f-world`	–	World management and scene composition
`@suaveplan/r3f-xr`	–	WebXR/VR/AR with controller and hand tracking

`random`

Package	Status	Info
`@suaveplan/fsm`	✅	Typed finite state machine with guards, actions, history tracking, hierarchical…
`@suaveplan/noise`	✅	Seeded spatial noise fields: Perlin, Simplex, Value, Worley, fBm and Blue-noise…
`@suaveplan/pseudo-random`	✅	Deterministic seeded PRNG implementations (Mulberry32, SFC32, Xoshiro256++, Cou…
`@suaveplan/random`	✅	High-level CSPRNG-backed randomness: strings, UUID/ULID/Nanoid, collections, ob…

`react`

Package	Status	Info
`@suaveplan/react-charts`	–	Chart and data visualization components
`@suaveplan/react-command-palette`	–	Cmd+K command palette with fuzzy search, keyboard na...
`@suaveplan/react-consent-overlay`	–	Cookie/consent/privacy overlays
`@suaveplan/react-data-table`	–	Data grid with sorting/filtering/pagination
`@suaveplan/react-dnd`	–	Drag-and-drop with sortable lists
`@suaveplan/react-error-boundary`	–	Error boundary with fallback UI
`@suaveplan/react-hotkeys`	–	Keyboard shortcut management
`@suaveplan/react-infinite-scroll`	–	Infinite scroll with IntersectionObserver
`@suaveplan/react-iphone`	–	iPhone simulator with WebRTC support
`@suaveplan/react-kanban`	–	Headless kanban board with drag-and-drop columns, sw...
`@suaveplan/react-loading`	–	Loading screen with weighted task progress and tip rotation
`@suaveplan/react-modal`	–	Modal/dialog system with focus trapping
`@suaveplan/react-skeleton`	–	Skeleton/shimmer loading placeholders
`@suaveplan/react-social`	–	Social library with real-time updates
`@suaveplan/react-timeline`	–	Timeline visualization components
`@suaveplan/react-tour`	–	Guided product tours and onboarding walkthroughs wit...
`@suaveplan/react-tree-view`	–	Tree view component
`@suaveplan/react-ui`	✅	Core React UI component library. ~70 shadcn-style components (Radix + cva + theme system + pack registry). i18n surface (capability spec `react-ui-i18n`): 7 formatted-value primitives (`<FormattedNumber>`, `<FormattedCurrency>`, `<FormattedDate>`, `<FormattedList>`, `<FormattedRelativeTime>`, `<Plural>`, `<FormattedMessage>`), `<ReactUiI18nBridge>` mounting `@radix-ui/react-direction` + `<html lang>`/`<html dir>` sync + `ReactUiLocaleContext`, `localeAwareSortingFn` / `localeAwareFilterFn` for tanstack tables, `formattedCell` shortcut for column cells, `<InputNumber>` (locale-aware decimal/grouping parse), `useValidationMessageBridge`, `<Drawer>` / `<Sheet>` `inline-start`/`inline-end` directions, `<Calendar>` auto-wires registry's `date-fns` adapter when present. Tooling: `bun run check:i18n-keys` (translation-key drift gate, MISSING fails / ORPHAN warns by default + `--strict` mode), `bun run check:registry-eject` (shadcn-eject smoke gate), 11 stories with consolidated snapshot test. 1368 tests pass. Initial i18n surface shipped 2026-05-10 (`react-i18n-plugin-registry-and-ui-primitives`); deferred tooling shipped 2026-05-10 (`react-ui-i18n-deferred-tooling`).
`@suaveplan/react-ui-social`	–	Social UI components
`@suaveplan/react-virtual`	–	Virtualized list/grid rendering

`security`

Package	Status	Info
`@suaveplan/hibp`	✅	Privacy-preserving Have I Been Pwned client: k-anonymity SHA-1 prefix range API (`Add-Padding: true`, NTLM mode via injectable adapter, constant-time suffix compare, byte-level no-leak suite), authenticated breach/paste API with 1500ms client-side rate-limit gate + 429 `Retry-After` honour, in-memory LRU cache (10k entries / 24h TTL) + pluggable `HibpCacheLike`, differential-privacy decoy-prefix padding, Zod boundary schemas at every response, 7 error codes, OTel histograms + outcome counters. 100% coverage.
`@suaveplan/jws`	✅	Impl complete (43 `.ts` files / 2403 LOC / 24 sibling `.md` docs at 100% docs:check / 10 subpath exports / 18-code error registry). Biome / lint / typecheck / build GREEN. Test pass + archive pending in separate session — needs ~27 test files matching `Verified by:` paths in spec delta, RFC 7515 Appendix A.1–A.7 verbatim fixtures, x5c chain fixtures (consume `@suaveplan/x509`'s `build-certs.ts`), 100/100/100/100 Istanbul. Surface: RFC 7515 JSON Web Signature; compact + JSON-flat + JSON-general serializations; verify + sign across HS256/384/512, RS256/384/512, PS256/384/512, ES256/384/512, EdDSA (RFC 8037); JWK header parse, `x5c` embedded cert chain delegating to `@suaveplan/x509.validateChain`, `kid` resolver, `crit` allowlist enforcement with mandatory `b64` listing per RFC 7797 §3, `alg: "none"` two-flag explicit opt-in, RFC 7797 `b64: false` header, detached signatures (RFC 7515 §A.5), constant-time MAC compare for HMAC, ECDSA DER-form rejection (raw `r\|\|s` only). 12-step verify orchestrator with AbortSignal at three checkpoints. Gates webauthn-android-safetynet attestation.
`@suaveplan/otp`	✅	RFC 4226 HOTP + RFC 6238 TOTP + RFC 6287 OCRA + Key URI + recovery codes (Vaulted)
`@suaveplan/password-formats`	✅	Universal import/export layer for common password-manager export formats — Appl…
`@suaveplan/password-generator`	✅	Cryptographically-strong password and passphrase generator: char-class mode (configurable length / classes / exclusions / required-class quotas), passphrase mode over bundled EFF Long (7776) + EFF Short 1 (1296) wordlists under tree-shakeable subpaths, pronounceable Markov-digram mode, PIN mode, bias-free `randomInt` per Lemire rejection sampling, `estimateEntropy` for both modes, `assertStrength(password, minBits)` guard, wordlist plugin API (≥256-entry minimum), injectable `Rng` via `@suaveplan/types`. χ² statistical test on 1M draws (p > 0.01). 100% coverage.
`@suaveplan/password-strength`	✅	zxcvbn-style password strength estimator: 6 pattern matchers (dictionary with l33t+reverse, sequence, repeat, date, keyboard adjacency for QWERTY/DVORAK/AZERTY, recent-year regex), `mostGuessableMatchSequence` DP scorer with factorial penalty + bruteforce fallback, `estimateGuesses` per Wheeler §4 formulae, 4-scenario `crackTimes` with `adjustments` multiplier, 5-bucket score (literal `0\|1\|2\|3\|4`), feedback strings keyed for `@suaveplan/i18n`, `loadDictionaries` runtime swap, `userInputs` personal-info match, multilingual dicts under `./dicts/{de,fr,es,zh-Hans,ru}` subpaths, `assessReactive` streaming variant with AbortSignal, 200-char DoS guard. 100% coverage.
`@suaveplan/security-codes`	✅	Detect and sanitise sensitive security-code leakage in strings: API keys, JWTs,…
`@suaveplan/slsa`	✅	SLSA L1-L2 supply-chain security: provenance, SBOM, DSSE attestations, Sigstore…
`@suaveplan/srp`	✅	SRP-6a (RFC 5054) zero-knowledge password proof: bundled 2048-bit safe-prime group at root + 1024/1536/3072/4096/6144/8192 under `./groups/<size>` subpaths (every constant byte-exact to Appendix A); SHA-256 default, SHA-1 legacy opt-in; client (`computeVerifier`, `clientStartHandshake`, `clientFinishHandshake`, `clientVerifyServerProof`) and server (`serverStartHandshake`, `serverFinishHandshake`, `serverComputeM2`) roles; reject `A mod N == 0` / `B mod N == 0` / `u == 0` per §2.5.4 with `SRP.PUBLIC_KEY_INVALID`; modpow via `@noble/curves/abstract/modular.pow` (never `BigInt ** BigInt %`); constant-time M1/M2/S compare via `@suaveplan/crypto-utils`; dual hash backends (`nobleHashBridge` sync + `subtleHashBridge` async + `defaultHashBridge` selector); `PakeProvider` interface for future OPAQUE drop-in; RFC 5054 Appendix B 1024/SHA-1 vectors verified byte-exact; locally-derived 2048/SHA-256 fixture via `scripts/generate-srp-vectors.ts`; 1000-triple property test asserts `client.K === server.K`. 100% coverage.
`@suaveplan/tpm-struct`	✅	TPM 2.0 attestation-structure parser per TCG TPM 2.0 Library Part 2 r1.59: `parseTpmsAttest` covering all 8 `TPM_ST_ATTEST_*` variants (§10.12 + §10.11), `parseTpmtPublic` covering RSA / ECC / KEYEDHASH / SYMCIPHER (§12.2), byte-identical serializers, `computeTpmtPublicName` (§16) with injected `HashLike`, `extraDataMatches` (W3C WebAuthn L3 §8.3 step 8) with injected constant-time compare, `TPM_ALG` 35-entry + `TPM_ECC_CURVE` 9-entry frozen registries (§11.1 / §11.2.5), TPM2B length-prefix reader/writer, magic check `0xff544347` ("TCG\xff" reversed), `0 ⇒ 65537` RSA exponent normalization with `rawExponent` preservation, bounds enforcement → `TPM_STRUCT.TRUNCATED`, alg-unknown → `TPM_STRUCT.ALG_UNSUPPORTED`, debug-only `toDiagnostic` dumper, Zod boundary schemas at every public surface, 10-code error registry, OTel histograms + counters with bounded-enum attributes. Synthetic WebAuthn TPM integration fixture (no real-device byte string available). 100% coverage.
`@suaveplan/vault`	✅	Vault orchestration layer for the Vaulted ecosystem: drive-backed encrypted…
`@suaveplan/vault-sync`	✅	Offline-first, end-to-end-encrypted sync engine for vault items: domain-specif…
`@suaveplan/x509`	✅	RFC 5280 v3 certificate parsing + chain validation: hand-rolled ASN.1 BER/DER codec for the X.509 subset; RFC 7468 PEM framing; TBSCertificate parser; pluggable extension decoder + critical-extension enforcement; all 8 standard extension decoders (basic constraints / key usage / EKU / SAN with DNS+IPv4+IPv6+URI+email+dirName+rfc822Name / name constraints / AKI + SKI / CRL distribution points); `validateChain` per §6.1 12-step algorithm with policy tree; validity period (UTCTime/GeneralizedTime 2050 boundary) with injectable `Clock`; signature verify dispatching to `@suaveplan/crypto-rsa` (PKCS1v15-SHA256/384/512 + PSS) and `@suaveplan/crypto-curve` (ECDSA-P256/384/521 + Ed25519); self-signed-leaf rejection; chain depth bound (default 16); `TrustAnchorStore` with configurable duplicate-SKI policy; OCSP responder interface. 45 src + 38 test files, 381 tests, 16 deterministic chain builders (real RSA/P-256/Ed25519 signatures, no mocks). 100% coverage. Gates webauthn-tpm + webauthn-android-key + webauthn-apple attestation.

`storage`

Package	Status	Info
`@suaveplan/cache-browser`	✅	Use `@suaveplan/cache-storage` over `@suaveplan/storage-browser-{localstorage,indexeddb,opfs}`. No separate package required.
`@suaveplan/cache-memory`	✅	Built into `@suaveplan/cache` as `MemoryCache`. No separate package required.
`@suaveplan/cache-redis`	✅	`AbstractCache<T>` backend over a minimal `RedisLike` interface — native `SET ... EX`, `GET`, `DEL`, `EXISTS`, `TTL`, `SCAN`. Reuses `@suaveplan/cache-storage` codecs (JSON / identity / base64).
`@suaveplan/cache-storage`	✅	`AbstractCache<T>` backend that bridges any `@suaveplan/storage` `AbstractStorage` into a typed cache via a 32-byte fixed-width TTL header and pluggable `Codec<T>` (JSON default, identity for `Uint8Array`). Subsumes `cache-browser` by composition.
`@suaveplan/storage`	✅	Enterprise key-value storage abstractions: AbstractStorage (StorageLike + strea…
`@suaveplan/storage-browser-opfs`	✅	OPFS storage backend for @suaveplan/storage
`@suaveplan/storage-cdn`	✅	Types-only foundation for CDN-flavoured storage adapters: `CdnAdapter` abstract base extending `AbstractStorage` with `purge`/`signUrl`/`edgeUrl`, `CdnCapabilities` matrix, Zod-validated `SignUrlOptions`, `STORAGE_CDN` error registry (8 codes), type-guard helpers, module augmentation for `capabilities.cdn`. Provider packages (rackspace, bunnycdn) implement against this contract.
`@suaveplan/storage-cdn-bunnycdn`	✅	BunnyCDN Storage Zone + Pull Zone provider for `@suaveplan/storage-cdn`. Full `AbstractStorage`/`CdnAdapter` surface against the regional Storage Zone (`de`/`ny`/`la`/`sg`/`syd`/`uk`) with `AccessKey` headers, HMAC-SHA256 Token Authentication signed URLs, single + wildcard prefix purge via `api.bunny.net/purge`, transient-status retry honouring `Retry-After`, full OTel surface with `provider="bunnycdn"` + `storage_region`. The only adapter in the family with `cdnPrefixPurge: true`.
`@suaveplan/storage-cdn-rackspace`	✅	Rackspace Cloud Files (OpenStack Swift) origin + Rackspace CDN provider for `@suaveplan/storage-cdn`. v2 identity auth with proactive token refresh, service-catalog endpoint lookup (LON/IAD/DFW/ORD/SYD/HKG), HMAC-SHA1 Swift TempURL signing, CDN purge (single-key), Range reads, native streaming, full OTel surface with `provider="rackspace"` + `region`.
`@suaveplan/storage-file`	✅	filesystem storage
`@suaveplan/storage-http`	✅	Universal HTTP/CDN-backed `AbstractStorage` adapter. Reads via `GET`/`HEAD`/`Range` against any `baseUrl + key` origin, optional writes through a pluggable `HttpUploader`, AbortSignal everywhere, retry on transient outcomes honouring `Retry-After`, conditional reads via ETag cache, native `ReadableStream` from `Response.body`, full OTel surface. Universal tier — no Node/Bun imports; runs unchanged in Node 18+, Bun, Deno, browsers, Workers.
`@suaveplan/storage-s3`	✅	S3-compatible object storage adapter for @suaveplan/storage: implements Abstrac…
`@suaveplan/storage-plugin-cache`	✅	Read-through cache decorator for any `AbstractStorage`. `cachedStorage(inner, options): CachedStorage` returns a class extending `AbstractStorage` that wraps an inner storage with a caller-supplied `AbstractCache<Uint8Array>` in front (the inverse of `cache-storage`'s storage-as-cache direction). Populates on miss when `shouldCache(key, bytes)` returns true (default 16 MiB ceiling). Invalidates on `set`/`setPartial`/`delete`/`clear` (post-success). `clear()` evicts only the wrapper's namespaced subset via `cache.keys()` enumeration; logs a warning + skips when the cache backend lacks `keys()` (avoids cross-namespace wipe). Passthrough on `exists` / `list` / `getMetadata` / `getWithMetadata` / `getSize` / `getItemSize` / `getPartial` / `createReadStream` / `createWriteStream`. 2-code `STORAGE_CACHE.*` registry; class renamed `CachedStorageError` to avoid the namespace collision with `@suaveplan/cache-storage`'s `StorageCacheError`. Cache failures swallow + counter-record. Multi-namespace isolation on a shared cache. Full OTel surface. Universal tier; composes with `drive`, `storage-uri` plugins, application code that takes a `StorageLike`.
`@suaveplan/storage-uri`	✅	Universal URI-routed dispatcher over any `StorageLike`. Single resolver maps `scheme → UriPlugin` (`file://`, `https://`, `s3://`, `rackspace://`, `bunny://`, …), returns `ReadableStream<Uint8Array>` via `adapter.createReadStream` with one-chunk buffered fallback. 8-code `STORAGE_URI.*` registry. `SuaveplanError` subclasses thrown by adapters pass through unchanged; non-namespaced throwables wrap as `ADAPTER_ERROR`. AbortSignal propagation, full OTel surface, `runUriPluginConformance` harness exported for sibling plugin packages.

`store`

Package	Status	Info
`@suaveplan/api-plugin-inventory`	–	Inventory management plugin — items, stock levels, m...
`@suaveplan/api-plugin-store`	–	E-commerce store plugin
`@suaveplan/api-plugin-subscription`	–	Subscription/recurring billing plugin
`@suaveplan/api-plugin-virtual-currency`	–	Virtual currency wallets, transfers, purchases, cashout
`@suaveplan/r3f-inventory`	–	Grid-based inventory, equipment, loot tables
`@suaveplan/react-store`	–	Store state management components

`testing`

Package	Status	Info
`@suaveplan/ab-testing`	✅	Enterprise A/B testing and experimentation: deterministic FNV-1a bucketing, tar…
`@suaveplan/testing`	✅	Universal test utilities (FakeClock, Factory, FixtureManager, MemoryStore, buil…
`@suaveplan/testing-dom`	✅	DOM/React testing — vitest+bun-test conditional re-exports, createTestConfig, p…
`@suaveplan/testing-e2e`	✅	Playwright E2E utilities — config factory, page objects, fixtures, helpers, str…
`@suaveplan/testing-integration`	✅	Core integration test infrastructure: ServiceFixture interface, TestEnvironm…
`@suaveplan/testing-integration-garage-s3`	✅	Garage S3 v2.0.0 testcontainers fixture for @suaveplan/testing-integration
`@suaveplan/testing-integration-mailpit`	✅	Mailpit testcontainers fixture + assertMail helper for @suaveplan/testing-integ…
`@suaveplan/testing-integration-postgres`	✅	PostgreSQL 16 testcontainers fixture for @suaveplan/testing-integration
`@suaveplan/testing-integration-redis`	✅	Redis 7 testcontainers fixture for @suaveplan/testing-integration
`@suaveplan/testing-integration-step-ca`	✅	smallstep/step-ca testcontainers fixture for @suaveplan/testing-integration — r…
`@suaveplan/testing-integration-surrealdb`	✅	SurrealDB v3 testcontainers fixture for @suaveplan/testing-integration
`@suaveplan/testing-integration-typesense`	✅	Typesense 27 testcontainers fixture for @suaveplan/testing-integration

`timing`

Package	Status	Info
`@suaveplan/cron`	✅	Universal-tier cron expression parser, next-fire calculator with timezone + DST support, and lightweight in-process scheduler
`@suaveplan/datetime`	✅	Timezone-aware date/time utilities with business-day arithmetic, recurrence rul…
`@suaveplan/timing`	✅	Timing and scheduling utilities — stopwatch, throttle, debounce, scheduler, dec…

`tooling`

Package	Status	Info
`@suaveplan/cli`	✅	Zero-dependency CLI toolkit: argument parser, command router, ANSI styling, out…
`@suaveplan/electrobun`	✅	Electrobun desktop-app generator + orchestrator: scaffolder (9 project + 8 feature renderers), iconz-backed icon pipeline, five CLI subcommands (create/dev/build/package/sign) orchestrating the upstream `electrobun` binary via an injectable `CommandRunner`, layered config + Prompter seam, Zod-validated options, eleven `ELECTROBUN.*` codes, 5 OTel counters + 2 histograms
`@suaveplan/install-agent-skills`	✅	Suaveplan installer plugin: bundles the agent-skills set and installs them into…
`@suaveplan/installer`	✅	Plugin host + lifecycle for project boilerplating and asset installation: detec…
`@suaveplan/license`	✅	Software license generation
`@suaveplan/linter`	✅	Unified markdown + biome linting pipeline: remark-based markdown fixer, injectable CommandRunner-backed biome wrapper, glob resolver, orchestrator with structured LintReport, pure runCli, `LINTER_CODES` error registry, OTel self-telemetry.
`@suaveplan/overview`	✅	Machine-readable monorepo manifest with Zod schemas, tier inference, server-tier filesystem discovery (`./discover` subpath), graph utilities (Kahn topo, Tarjan cycles, transitive deps), plugin/category/tier roll-ups, 6 `OVERVIEW.*` codes, OTel. 56 tests / 100/100/100/100.
`@suaveplan/profiler`	✅	Runtime performance profiling: sampler, marks, memory snapshots, bottleneck detector, flamegraph JSON, profile comparator, text reporter, OTel exporter; injectable Clock/Timers/Logger.
`@suaveplan/readline`	✅	Terminal I/O primitive: AsyncGenerator line reader and interactive prompt inter…
`@suaveplan/sandbox`	✅	Server-tier sandboxed code execution — vm/worker/spawn/isolate engines, pre-warmed pool, async result streamer, regex code transformer, module resolver, sliding-window rate limiter, SHA-256 audit logger, OTel instruments, 15 SANDBOX.* error codes
`@suaveplan/server-keys`	✅	Server key management CLI
`@suaveplan/test-vite`	✅	Vite + Vitest configuration factories and validators with browser-environment shims, tree-shake validator, bundle-size snapshot, port allocator, HMR tester, custom matchers, TEST_VITE_CODES error registry, and OTel self-telemetry.
`@suaveplan/wip`	–	Work-in-progress experiments

`unknown`

Package	Status	Info
`@suaveplan/biometrics`	❌	Touch ID / Face ID / Hello facade (Vaulted)
`@suaveplan/clipboard`	✅	Enterprise Clipboard API: typed errors, OTel metrics, async queue, secure-context guard, image/blob copy + read, paste-event read fallback, permission change subscription, focus-aware retry, sanitizer hook
`@suaveplan/form-detection`	❌	DOM heuristics for autofill (Vaulted)
`@suaveplan/iconz`	❌	App icon generator from SVG (Vaulted)
`@suaveplan/mcp`	✅	Universal-tier MCP server + client with JSON-RPC dispatcher, pluggable transports (in-memory, stdio, HTTP+SSE), AbortSignal cancellation, progress notifications, authorize hook, and OTel meter
`@suaveplan/media`	✅	Universal-tier media detection, metadata extraction, and constraint validation. Pluggable `SignatureRegistry` (twelve built-in formats: PNG, JPEG, GIF, BMP, WEBP, RIFF, MP4/MOV, WebM/MKV, MP3-ID3, MP3-sync, FLAC, OGG) with offset-aware `match`/`detect`/`register`/`unregister`. Detection via `detectMediaType`, `detectSignature`, `detectMediaTypeFromName` (MIME bucket via `@suaveplan/mime`), `inferMimeFromSignature` canonical-MIME mapping. Sync `getMetadata` + async `getMetadataAsync` with optional `MediaMetadataExtractor` hook (width/height/duration). `validateMedia`/`validateMediaAsync`/`assertValidMedia` with Zod-parsed `MediaConstraints` (size/MIME/type/dimensions/duration/predicate), wrapped predicate errors. Typed `MediaError` hierarchy with eight stable `MEDIA.*` codes (`EMPTY_INPUT`, `INVALID_CONSTRAINTS`, `VALIDATION_FAILED`, `UNSUPPORTED_TYPE`, `PREDICATE_FAILED`, `DUPLICATE_SIGNATURE`, `METADATA_EXTRACTOR_FAILED`, `INVALID_SIGNATURE`) plus per-code metadata (`httpStatus`, `retryable`, `severity`, `description`). OTel: four counters (`media_detect_total`, `media_metadata_total`, `media_validate_total`, `media_error_total`), two histograms (`media_op_latency_ms`, `media_input_size_bytes`). 103 tests, 100/100/100/100 coverage.
`@suaveplan/native-messaging`	❌	Encrypted extension↔desktop transport (Vaulted)
`@suaveplan/qrcode-scan`	❌	QR decode subpath (Vaulted)
`@suaveplan/react-map`	–	Map visualization components
`@suaveplan/react-media`	–	Media rendering components
`@suaveplan/react-rule-builder`	–	Visual rule builder with AND/OR groups, drag-drop, JSON config
`@suaveplan/site-icons`	❌	Favicon fetch + cache (Vaulted)
`@suaveplan/spatial-hash`	–	Spatial hashing for O(1) broad-phase 2D/3D queries
`@suaveplan/storage-browser`	❌	Retired — superseded by split into `storage-browser-indexeddb` / `storage-browser-localstorage` / `storage-browser-opfs` (all ✅). See archive `2026-05-12-enterprise-browser-storage-browser-superseded-by-split`.
`@suaveplan/storybook-test-utils`	–	Storybook E2E testing utilities
`@suaveplan/streams-chunk-queue`	✅	Chunked-queue stream processing: binary protocol, decryptor, rate limiter, storage adapter, hooks, validator, OTel.
`@suaveplan/streams-metadata`	✅	Stream transform for extracting rich media metadata via EXIF, MIME, and events.
`@suaveplan/third-party-elevenlabs`	✅	Typed thin client for the ElevenLabs platform API: REST + WebSocket transport,…
`@suaveplan/web-workers`	✅	Browser-tier Web Worker / SharedWorker / worker-pool runtime: typed RPC with AbortSignal + transfer-list + backpressure + circuit breaker + streaming, FIFO + round-robin / least-busy schedulers, restart-on-crash supervision, EventBus lifecycle emission, OTel observability, 13-code `WEB_WORKERS.*` registry, `defineWorker()` helper.
`@suaveplan/workflow`	✅	Workflow/saga orchestration: fluent builder, sequential/parallel/conditional steps, saga compensation, retry middleware, hooks, transition-data pipeline, six `WORKFLOW.*` codes, OTel.

`vatdash`

Package	Status	Info
`@suaveplan/api-plugin-vatdash-bridge`	–	Bridge wiring all api-plugins into the vatdash Hono server

`video`

Package	Status	Info
`@suaveplan/react-video`	–	Video player components
`@suaveplan/video`	✅	Universal-tier video metadata + transform-planning: 8-format magic-byte sniffer, `calculateVideoResize` with 6 presets, `validateTrimRange`, `VideoProcessor` w/ typed EventBus, `extractMetadata`/`planTransform`, Zod-validated 9-variant `VideoTransformOpSchema`, fluent `VideoPipelineBuilder`, 16-code `VIDEO.*` registry + metadata table, OTel. 113 tests / 100/100/100/100.
`@suaveplan/video-thumbnails`	✅	Video thumbnail extraction + sprite sheets via injectable FfmpegRunner (default fluent-ffmpeg + bundled @ffmpeg-installer/@ffprobe-installer binaries). Single-frame, batch, sliding-window, N×M tile. Zod boundaries, AbortSignal, 9 `VIDEO_THUMBNAILS.*` codes, 4 OTel instruments. 93 tests / 100/100/100/100.

Maintenance

When you finish migrating a package:

Confirm the folder under packages/<plugin>/<pkg>/ builds and tests cleanly.
Flip the row's status icon from – to ✅ and replace the suaveplan summary with the genesis description from the package's README.md (truncate to ~80 chars).
Run bun scripts/folder-reorg/generate-manifest.ts to refresh MANIFEST.md. The dep graph is the source of truth for workspace edges.
Run bun scripts/generate-missing.ts to refresh MISSING.yml.
Update SUMMARY.md per the workflow described in AGENTS.md step 5 — paste the README summary into its plugin-folder section.

When you propose a net-new package not in suaveplan:

Add a row here with status ❌, the planned parent folder, and a short note explaining what it does and why.
Open the OpenSpec change (openspec/changes/<change-id>/) before any code lands.

Superseded upstream packages — do not migrate

Per openspec/changes/network-transport-family/proposal.md (2026-05-11) the following upstream packages have been replaced by genesis equivalents and MUST NOT be migrated under their original names:

Upstream	Genesis replacement
`@suaveplan/network-protocol`	`@suaveplan/network-plugin-protocol` ✅
`@suaveplan/network-registry`	`@suaveplan/network-plugin-registry` ✅
`@suaveplan/network-assignment`	`@suaveplan/network-plugin-assignment` ✅
`@suaveplan/network-webrtc`	`@suaveplan/network-transport-webrtc` ✅
`@suaveplan/network-topology`	`@suaveplan/network-plugin-topology` ✅
`@suaveplan/network-failover`	`@suaveplan/network-plugin-failover` ✅
`@suaveplan/network-governance`	`@suaveplan/network-plugin-governance` ✅
`@suaveplan/network-websockets`	`@suaveplan/network-transport-websockets` ✅
`@suaveplan/network-observability`	folded into `@suaveplan/network-plugin-monitor` ✅ (Wave 6.1 `network-observability-consolidation`; Prometheus exposition + Grafana dashboard generator land as universal-tier feature modules; OTel SDK bridge dropped as redundant — monitor emits through `@opentelemetry/api` directly)
`@suaveplan/network-quality`	folded into `@suaveplan/network-plugin-monitor` ✅ (Wave 6.2 `network-quality-consolidation`; `BandwidthMonitor` EMA recorder + `DegradationManager` 4-level classifier with hysteresis + one-step transitions + `createQualityMiddleware` per-source throttling gate land as universal-tier feature modules under `src/quality/`; `EventEmitter`-based upstream evented API replaced by callback-handler subscriptions returning unsubscribe fns, dropping the `@suaveplan/events` runtime coupling — matches genesis no-monolithic-EE convention; `hysteresisMs: 0` newly commits same-call so the policy is genuinely usable for synchronous tests)

If upstream functionality is missing from a genesis replacement, extend the replacement — do not create a parallel package under the deprecated name.

198 KiB Raw Permalink Blame History Unescape Escape

Status

Legend

Counts

Packages

api

audio

auth

barcode

bitpacker

commerce

contacts

core

crypto

data

database

docs

drive

emails

events

flow

fonts

forms

games

geo

gtap

i18n

image

logistics

messaging

monitor

network

platform

r3f

random

react

security

storage

store

testing

timing

tooling

unknown

vatdash

video