@lssm/lib.growth-runtime

Pure, provider-neutral GrowthOS lifecycle logic for referral and affiliate programs.

It selects one prioritized, non-stackable attribution winner, enforces consent and identity/organization loop boundaries, projects fixed or BillingOS commission-based rewards, applies approval, maturity, and compensating ledger transitions, builds homogeneous payout batches, validates payout readiness, and signs short-lived acquisition context. Persistence and provider SDK calls belong to integrations.

Marketing and editorial runtime

The optional ./marketing subpath adds MarketingExecutor, EditorialService, EditorialPublicationService, source-aware measurement reconciliation and review-only experiment assessment. Supply current authorization, durable CAS storage, provider, clock and ID ports. No provider effects are available by default. Concurrent workers share durable reservations and publication intents; ambiguous outcomes require reconciliation rather than blind redispatch.

Editorial edits invalidate previous approvals and scheduling. Reviews bind to the exact content digest. Published content requires a separate withdrawal workflow; archiving cannot silently remove a live publication.

Commands

• bun run test
• bun run typecheck
• bun run lint:check
• bun run build

MarketingConversionService reserves conversion identity before dispatch, rechecks current consent and retains uncertain outcomes for read-only reconciliation. Corrections require the accepted predecessor; retractions are terminal. Host authority governs data egress and may independently authorize a retraction after consent revocation.

MarketingObservationService authorizes refresh/read scopes, rejects substituted provider requests and persists observations. marketingObservedStateDigest excludes timestamps and evidence references while retaining scoped resource states for execution planning.

marketing/planning-approval supplies MarketingPlanningApprovalService. Inject current pricing/brand authorization, human-review verification and durable storage. The service issues the existing OperationApprovalReceipt format, bound to exact parsed input and maximum cost. Configure its verifyEvidence callback on createOperationApprovalPort with a durable nonce store; omitting evidence verification is not a supported setup. Issuance returns the persisted receipt, so concurrent calls and replay agree.

marketing/measurement-report sums explicitly requested reporting buckets after source reconciliation. It preserves campaign/creative/creator, currency, timezone and attribution dimensions; missing, partial, stale or future observations keep totals unavailable. Overlapping periods and duplicate authoritative buckets are rejected. These numeric analytics totals do not replace exact-money settlement calculations.

Published builds keep workspace package imports external so dependencies resolve through their owning package manifests rather than being silently inlined across package boundaries.

EditorialService.recovery authorizes scope and each record, validates claim/digest/status/age, and returns a bounded oldest-first batch. It never dispatches publication.

verifyEditorialDeployment checks exact release SHA, ready state, receipt digest, locale coverage and expected canonical URL before returning verified evidence. Hosts must obtain observations from an authorized deployment origin and bind the compiler expectation to the persisted publication claim. This pure verifier does not publish or fetch.

GitEditorialPublisher persists an immutable compiled artifact before its sole Git write attempt. Existing claims reconcile through read-only transport recovery; committed artifacts still require exact deployment proof. The host must implement current authority and native compiler validation.

Git compiler/artifact/authority rejections before dispatch can now return a durable failed-publication receipt when the store supports preparation failures. Existing stores without the capability retain conservative unknown behavior. A failure never supersedes an existing Git attempt, and raw error text is not recorded.

Qualified publishers may implement resumePreparation. The publication service preserves the claim ID, rechecks review/content/current publish authority and claims the expected revision before invoking it. Git resumes reconcile existing attempts and honor preparation-failure fences.

Editorial discovery validates page bounds, UTF-8 ID ordering, scope and all filter bindings before returning summary-schema projections. Scope and every row, including lookahead, require read authorization; denied rows fail the request.

compareEditorialIds exposes the same UTF-8 ordering used by SQL-backed listing so clients can reject non-advancing pages.

readEditorialHistory requires current scope/record authorization and separate authorization for every historical revision. It verifies identity, scope, content digest and ordering before returning historical content.

Editorial history requires contiguous revisions and detects incomplete pages before the observed current revision. Corrupt audit trails fail explicitly.