@aiwg/cli 2026.10.5 → 2026.10.6

package/dist/src/extensions/manifest.js

@@ -13,6 +13,7 @@
  * @architecture .aiwg/architecture/design-manifest-schema.md
  */
 import { z } from 'zod';
+import { integer, dateTime, url } from '../schema/zod-validation.mjs';
 import { PlatformCompatibilitySchema, DeploymentConfigSchema, MemoryFootprintSchema, DeprecationSchema, } from './validation.js';
 // ============================================
 // Limits (from #1042 threat model + #1044 design)
@@ -58,7 +59,7 @@ const ArtifactListsSchema = z.object({
     behaviors: z.array(z.string()).max(50).optional(),
     gatePacks: z.array(z.string().min(1).max(128)).max(50).optional(),
 });
-const EntryPathsSchema = z.object({
+const EntryPathsSchema = z.strictObject({
     agents: safeRelativePath.optional(),
     skills: safeRelativePath.optional(),
     rules: safeRelativePath.optional(),
@@ -68,37 +69,37 @@ const EntryPathsSchema = z.object({
     commands: safeRelativePath.optional(),
     behaviors: safeRelativePath.optional(),
     gatePacks: safeRelativePath.optional(),
-}).strict();
-export const AddonConfigSchema = z.object({
+});
+export const AddonConfigSchema = z.strictObject({
     entry: EntryPathsSchema.optional(),
     ...ArtifactListsSchema.shape,
     core: z.boolean().optional(),
     autoInstall: z.boolean().optional(),
-}).strict();
-export const FrameworkConfigSchema = z.object({
+});
+export const FrameworkConfigSchema = z.strictObject({
     path: safeRelativePath.optional(),
     files: z.array(safeRelativePath).max(100).optional(),
     ignore: z.array(safeRelativePath).max(100).optional(),
     gatePacks: z.array(z.string().min(1).max(128)).max(50).optional(),
-    entry: z.object({
+    entry: z.strictObject({
         gatePacks: safeRelativePath.optional(),
-    }).strict().optional(),
-    contextContributions: z.object({
+    }).optional(),
+    contextContributions: z.strictObject({
         hookFragment: safeRelativePath.optional(),
         sectionsDir: safeRelativePath.optional(),
         sectionsManifest: safeRelativePath.optional(),
-        priority: z.number().int().min(0).max(100).optional(),
+        priority: integer().min(0).max(100).optional(),
         description: z.string().max(512).optional(),
-    }).strict().optional(),
-}).strict();
-export const ExtensionConfigSchema = z.object({
+    }).optional(),
+});
+export const ExtensionConfigSchema = z.strictObject({
     entry: EntryPathsSchema.optional(),
     ...ArtifactListsSchema.shape,
-}).strict();
-export const PluginConfigSchema = z.object({
+});
+export const PluginConfigSchema = z.strictObject({
     payloadType: z.enum(['addon', 'framework', 'extension']),
     payloadPath: safeRelativePath,
-}).strict();
+});
 const ProviderCapabilityFeatureSchema = z.enum([
     'cron',
     'agent_teams',
@@ -116,11 +117,11 @@ const ProviderCapabilityEmulationSchema = z.enum([
     'aiwg-daemon',
     'external-trigger',
 ]).nullable();
-const ProviderCapabilityOverridesSchema = z.object({
-    nativeFeatures: z.record(ProviderCapabilityFeatureSchema, z.boolean()).optional(),
-    emulation: z.record(ProviderCapabilityFeatureSchema, ProviderCapabilityEmulationSchema).optional(),
-}).strict();
-export const ProviderConfigSchema = z.object({
+const ProviderCapabilityOverridesSchema = z.strictObject({
+    nativeFeatures: z.partialRecord(ProviderCapabilityFeatureSchema, z.boolean()).optional(),
+    emulation: z.partialRecord(ProviderCapabilityFeatureSchema, ProviderCapabilityEmulationSchema).optional(),
+});
+export const ProviderConfigSchema = z.strictObject({
     extends: z.enum([
         'claude',
         'codex',
@@ -142,7 +143,7 @@ export const ProviderConfigSchema = z.object({
     displayName: z.string().min(1).max(128).optional(),
     aliases: z.array(z.string().min(1).max(64)).max(20).optional(),
     capabilities: ProviderCapabilityOverridesSchema.optional(),
-}).strict();
+});
 /**
  * Review attestation for one gate metric provider (#2831).
  *
@@ -152,11 +153,11 @@ export const ProviderConfigSchema = z.object({
  * registration refuses absent attestations and digest mismatches. Null or
  * unknown digests never verify: they fail closed.
  */
-export const GateProviderReviewSchema = z.object({
+export const GateProviderReviewSchema = z.strictObject({
     reviewer: z.string().min(1).max(128),
-    reviewedAt: z.string().datetime(),
+    reviewedAt: dateTime(),
     codeDigest: z.string().regex(/^sha256:[0-9a-f]{64}$/, 'must be a sha256 digest'),
-}).strict();
+});
 /**
  * One addon/extension gate metric provider declared by a bundle manifest
  * (#2831). The module is loaded ONLY through the gates registry from this
@@ -165,16 +166,16 @@ export const GateProviderReviewSchema = z.object({
  * providers remain the default; this field is optional and disabled unless
  * the caller explicitly enables bundle providers.
  */
-export const GateProviderEntrySchema = z.object({
+export const GateProviderEntrySchema = z.strictObject({
     id: z.string().min(1).max(128).regex(/^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/, 'must be a namespaced provider id <scope>/<name> (alphanumeric plus . _ -)'),
     version: z.string().regex(/^\d+\.\d+\.\d+/, 'CalVer or SemVer (X.Y.Z[...])'),
     module: safeModuleFile,
     description: z.string().min(1).max(512),
     review: GateProviderReviewSchema.optional(),
     reviewFile: safeJsonFile.optional(),
-}).strict().refine((entry) => (entry.review !== undefined) !== (entry.reviewFile !== undefined), { message: 'exactly one of review or reviewFile is required' });
-export const GateProvidersSchema = z.array(GateProviderEntrySchema).max(20).refine((entries) => new Set(entries.map((entry) => entry.id)).size === entries.length, { message: 'gate provider ids must be unique within a bundle' }).refine((entries) => new Set(entries.map((entry) => entry.module)).size === entries.length, { message: 'gate provider modules must be unique within a bundle' });
-export const CliCommandsSchema = z.object({
+}).refine((entry) => (entry.review !== undefined) !== (entry.reviewFile !== undefined), { error: 'exactly one of review or reviewFile is required' });
+export const GateProvidersSchema = z.array(GateProviderEntrySchema).max(20).refine((entries) => new Set(entries.map((entry) => entry.id)).size === entries.length, { error: 'gate provider ids must be unique within a bundle' }).refine((entries) => new Set(entries.map((entry) => entry.module)).size === entries.length, { error: 'gate provider modules must be unique within a bundle' });
+export const CliCommandsSchema = z.strictObject({
     namespace: z.string()
         .min(1)
         .max(64)
@@ -184,7 +185,7 @@ export const CliCommandsSchema = z.object({
     subcommands: z.record(z.string()
         .min(1)
         .max(64)
-        .regex(bundleNamePattern, 'kebab-case alphanumeric, no leading/trailing hyphen'), z.object({
+        .regex(bundleNamePattern, 'kebab-case alphanumeric, no leading/trailing hyphen'), z.strictObject({
         file: safeModuleFile,
         description: z.string().min(1).max(512),
         hook_event: z.enum([
@@ -195,14 +196,14 @@ export const CliCommandsSchema = z.object({
             'PostToolUse',
             'FeatureComplete',
         ]).optional(),
-    }).strict()).refine((commands) => Object.keys(commands).length > 0, {
-        message: 'at least one CLI subcommand is required',
+    })).refine((commands) => Object.keys(commands).length > 0, {
+        error: 'at least one CLI subcommand is required',
     }),
-}).strict();
+});
 // ============================================
 // Top-level BundleManifestSchema
 // ============================================
-export const BundleManifestSchema = z.object({
+export const BundleManifestSchema = z.strictObject({
     // Required core fields
     id: z.string()
         .min(1)
@@ -219,7 +220,7 @@ export const BundleManifestSchema = z.object({
     // Optional standard metadata
     author: z.string().max(128).optional(),
     license: z.string().max(64).optional(),
-    repository: z.string().url().max(512).optional(),
+    repository: url().max(512).optional(),
     // Type-discriminated nested config (exactly one matches `type`)
     addonConfig: AddonConfigSchema.optional(),
     frameworkConfig: FrameworkConfigSchema.optional(),
@@ -242,7 +243,6 @@ export const BundleManifestSchema = z.object({
     // providers remain the default when this field is absent.
     gateProviders: GateProvidersSchema.optional(),
 })
-    .strict()
     .refine((m) => {
     // Discriminator alignment: type must match the present *Config block(s)
     const present = {
@@ -258,18 +258,45 @@ export const BundleManifestSchema = z.object({
         return presentCount === 0 || (presentCount === 1 && present.extension);
     }
     return presentCount === 1 && present[m.type];
-}, { message: 'type must match its corresponding *Config block (addon→addonConfig, framework→frameworkConfig, plugin→pluginConfig, provider→providerConfig; extension may omit extensionConfig)' });
+}, { error: 'type must match its corresponding *Config block (addon→addonConfig, framework→frameworkConfig, plugin→pluginConfig, provider→providerConfig; extension may omit extensionConfig)' });
 /**
  * Convert a Zod error into the structured ManifestValidationError shape used
  * by discovery and `aiwg validate-metadata`.
  */
-export function zodErrorToValidationErrors(err, manifestPath) {
-    return err.errors.map((issue) => ({
-        path: manifestPath,
-        field: issue.path.join('.') || '(root)',
-        expected: issue.message,
-        actual: 'received' in issue ? String(issue.received) : 'invalid',
-        severity: 'error',
-    }));
+export function zodErrorToValidationErrors(err, manifestPath, input) {
+    const hasInput = arguments.length >= 3;
+    const issues = err.issues.flatMap(issue => {
+        // Partial enum maps report unknown keys at the map in v4; discovery's
+        // existing field contract identifies each rejected capability key.
+        if (issue.code === 'unrecognized_keys'
+            && issue.path.length === 3 && issue.path[0] === 'providerConfig'
+            && issue.path[1] === 'capabilities'
+            && ['nativeFeatures', 'emulation'].includes(String(issue.path[2]))) {
+            return issue.keys.map(key => ({ ...issue, path: [...issue.path, key] }));
+        }
+        return [issue];
+    });
+    return issues.map((issue) => {
+        let actual = 'invalid';
+        if (issue.code === 'invalid_type' && hasInput) {
+            let value = input;
+            for (const segment of issue.path) {
+                value = value !== null && typeof value === 'object' && Object.hasOwn(value, segment)
+                    ? value[segment] : undefined;
+            }
+            // Emit only the former type classification, never rejected values.
+            actual = value === null ? 'null' : Array.isArray(value) ? 'array'
+                : typeof value === 'number' && Number.isNaN(value) ? 'nan'
+                    : issue.expected === 'int' && typeof value === 'number' ? 'float'
+                        : typeof value;
+        }
+        return {
+            path: manifestPath,
+            field: issue.path.join('.') || '(root)',
+            expected: issue.message,
+            actual,
+            severity: 'error',
+        };
+    });
 }
 //# sourceMappingURL=manifest.js.map

package/dist/src/extensions/project-local-discovery.js

@@ -228,7 +228,7 @@ export async function loadAndValidateManifest(manifestPath, expectedType, projec
     }
     const result = BundleManifestSchema.safeParse(parsed);
     if (!result.success) {
-        return { errors: zodErrorToValidationErrors(result.error, manifestPath) };
+        return { errors: zodErrorToValidationErrors(result.error, manifestPath, parsed) };
     }
     const manifest = result.data;
     // Cross-check: manifest declared type must match the directory it lives in.

package/dist/src/extensions/project-quickref.js

@@ -10,6 +10,7 @@ import { access, mkdir, readFile, readdir, rm, writeFile } from 'fs/promises';
 import { basename, dirname, isAbsolute, join, resolve } from 'path';
 import { homedir } from 'os';
 import { z } from 'zod';
+import { integer } from '../schema/zod-validation.mjs';
 import { getProviderDefinition, normalizeProviderDefinitionId, } from '../providers/provider-definitions.js';
 import { resolveHermesHome } from '../providers/hermes-home.js';
 import { OPERATIONAL_SHOW_TYPES } from '../artifacts/types.js';
@@ -18,45 +19,45 @@ import { appendAiwgSourceTrackBlock } from './project-local-gitignore.js';
 import { discoverProjectLocalBundles } from './project-local-discovery.js';
 import { enumerateBundleArtifacts } from './shadow-resolver.js';
 const OWNERSHIP_MARKER = '.aiwg-project-quickref.json';
-const ShowHintSchema = z.object({
+const ShowHintSchema = z.strictObject({
     type: z.enum(OPERATIONAL_SHOW_TYPES),
     name: z.string().min(1).max(128),
-}).strict();
-const QuickrefEntrySchema = z.object({
+});
+const QuickrefEntrySchema = z.strictObject({
     title: z.string().min(1).max(128),
     summary: z.string().min(1).max(512),
     discover: z.array(z.string().min(1).max(256)).max(10).default([]),
     show: z.array(ShowHintSchema).max(20).default([]),
-}).strict().refine(entry => entry.discover.length > 0 || entry.show.length > 0, { message: 'each entry must provide at least one discover or show hint' });
-export const ProjectQuickrefSchema = z.object({
+}).refine(entry => entry.discover.length > 0 || entry.show.length > 0, { error: 'each entry must provide at least one discover or show hint' });
+export const ProjectQuickrefSchema = z.strictObject({
     version: z.literal('1'),
-    project: z.object({
+    project: z.strictObject({
         id: z.string().regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/, 'must be kebab-case'),
         name: z.string().min(1).max(128),
         description: z.string().min(1).max(512),
-    }).strict(),
+    }),
     precedence: z.string().min(1).max(1024),
     entries: z.array(QuickrefEntrySchema).min(1).max(50),
-}).strict();
-const QuickrefOverrideSchema = z.object({
+});
+const QuickrefOverrideSchema = z.strictObject({
     title: z.string().min(1).max(128).optional(),
     summary: z.string().min(1).max(512).optional(),
     discover: z.array(z.string().min(1).max(256)).max(10).optional(),
     show: z.array(ShowHintSchema).max(20).optional(),
     hidden: z.boolean().optional(),
-    order: z.number().int().optional(),
-}).strict();
-export const ProjectQuickrefConfigSchema = z.object({
+    order: integer().optional(),
+});
+export const ProjectQuickrefConfigSchema = z.strictObject({
     version: z.literal('1'),
     project: ProjectQuickrefSchema.shape.project.optional(),
     precedence: z.string().min(1).max(1024).optional(),
     entries: z.array(QuickrefEntrySchema).max(50).default([]),
-    discovery: z.object({
+    discovery: z.strictObject({
         enabled: z.boolean().default(true),
         excludeBundles: z.array(z.string().min(1)).max(200).default([]),
-        overrides: z.record(z.string(), QuickrefOverrideSchema).default({}),
-    }).strict().default({ enabled: true, excludeBundles: [], overrides: {} }),
-}).strict();
+        overrides: z.record(z.string(), QuickrefOverrideSchema).prefault({}),
+    }).prefault({ enabled: true, excludeBundles: [], overrides: {} }),
+});
 function sha256(content) {
     return createHash('sha256').update(content).digest('hex');
 }
@@ -281,7 +282,7 @@ export function renderProjectQuickref(definition) {
             lines.push(`- Discover: \`aiwg discover ${JSON.stringify(phrase)}\``);
         }
         for (const hint of entry.show) {
-            lines.push(`- Fetch: \`aiwg show ${hint.type} ${hint.name}\``);
+            lines.push(`- Fetch: \`aiwg show ${hint.type} ${hint.name} --body\``);
         }
         lines.push('');
     }

package/dist/src/extensions/validation.js

@@ -10,6 +10,7 @@
  * @version 1.0.0
  */
 import { z } from 'zod';
+import { integer, dateTime, url, number } from '../schema/zod-validation.mjs';
 // ============================================
 // Core Enums & Primitives
 // ============================================
@@ -77,13 +78,13 @@ export const PlatformCompatibilitySchema = z.object({
     codex: PlatformSupportSchema.optional(),
     opencode: PlatformSupportSchema.optional(),
     generic: PlatformSupportSchema.optional(),
-}).refine((data) => Object.values(data).some((val) => val !== undefined), { message: 'At least one platform must be specified' });
+}).refine((data) => Object.values(data).some((val) => val !== undefined), { error: 'At least one platform must be specified' });
 /**
  * Deployment configuration
  */
 export const DeploymentConfigSchema = z.object({
     pathTemplate: z.string().min(1, 'Path template is required'),
-    pathOverrides: z.record(z.string()).optional(),
+    pathOverrides: z.record(z.string(), z.string()).optional(),
     additionalFiles: z.array(z.string()).optional(),
     autoInstall: z.boolean().optional().default(false),
     core: z.boolean().optional().default(false),
@@ -106,7 +107,7 @@ export const MemoryFootprintSchema = z.object({
  * Deprecation information
  */
 export const DeprecationSchema = z.object({
-    date: z.string().datetime({ message: 'Date must be ISO 8601 format' }),
+    date: dateTime({ error: 'Date must be ISO 8601 format' }),
     successor: z.string().optional(),
     reason: z.string().min(1, 'Deprecation reason is required'),
 });
@@ -114,7 +115,7 @@ export const DeprecationSchema = z.object({
  * Installation state
  */
 export const InstallationSchema = z.object({
-    installedAt: z.string().datetime({ message: 'Install timestamp must be ISO 8601 format' }),
+    installedAt: dateTime({ error: 'Install timestamp must be ISO 8601 format' }),
     installedFrom: z.enum(['builtin', 'registry', 'local', 'git']),
     installedPath: z.string().min(1),
     enabled: z.boolean(),
@@ -142,7 +143,7 @@ export const AgentMetadataSchema = z.object({
     }),
     tools: z.array(z.string()).min(1, 'At least one tool is required'),
     template: z.string().optional(),
-    maxTools: z.number().int().positive().optional(),
+    maxTools: integer().positive().optional(),
     canDelegate: z.boolean().optional(),
     readOnly: z.boolean().optional(),
     workflow: z.array(z.string()).optional(),
@@ -157,8 +158,8 @@ export const CommandArgumentSchema = z.object({
     description: z.string().min(1),
     required: z.boolean(),
     type: z.enum(['string', 'number', 'boolean']),
-    default: z.union([z.string(), z.number(), z.boolean()]).optional(),
-    position: z.number().int().nonnegative().optional(),
+    default: z.union([z.string(), number(), z.boolean()]).optional(),
+    position: integer().nonnegative().optional(),
 });
 /**
  * Command option definition
@@ -167,7 +168,7 @@ export const CommandOptionSchema = z.object({
     name: z.string().min(1),
     description: z.string().min(1),
     type: z.enum(['string', 'boolean', 'number', 'array']),
-    default: z.union([z.string(), z.boolean(), z.number()]).optional(),
+    default: z.union([z.string(), z.boolean(), number()]).optional(),
     short: z.string().length(1).optional(),
     long: z.string().min(2).optional(),
 });
@@ -229,11 +230,13 @@ export const SkillReferenceSchema = z.object({
  * natural-language invocation. Do NOT relax this rule — a blank description
  * is what caused the 107-file regression we are guarding against.
  */
-export const SkillFrontmatterSchema = z.object({
+export const SkillFrontmatterSchema = z.looseObject({
     name: z.string().min(1, 'Skill name is required'),
     description: z
         .string({
-        required_error: 'Description is required (Codex rejects SKILL.md without it)',
+        error: issue => issue.input === undefined
+            ? 'Description is required (Codex rejects SKILL.md without it)'
+            : undefined,
     })
         .min(1, 'Description is required and must be non-empty'),
     version: z.string().regex(/^\d+\.\d+\.\d+/, 'Version must be semver or CalVer format (e.g., 1.0.0)').optional(),
@@ -247,7 +250,7 @@ export const SkillFrontmatterSchema = z.object({
     triggers: z
         .array(z
         .string()
-        .refine((s) => s.trim().length > 0, { message: 'trigger phrases must be non-empty' }))
+        .refine((s) => s.trim().length > 0, { error: 'trigger phrases must be non-empty' }))
         .min(1, 'triggers is declared but empty — add at least one phrase or remove the field (empty-triggers anti-pattern, #1623)')
         .optional(),
     aliases: z.array(z.string()).optional(),
@@ -263,8 +266,8 @@ export const SkillFrontmatterSchema = z.object({
     context: z.enum(['fork', 'inherit']).optional(),
     author: z.string().optional(),
     license: z.string().optional(),
-    metadata: z.record(z.unknown()).optional(),
-}).passthrough();
+    metadata: z.record(z.string(), z.unknown()).optional(),
+});
 /**
  * Validate SKILL.md frontmatter.
  *
@@ -313,10 +316,10 @@ export const SkillMetadataSchema = z.object({
 export const HookMetadataSchema = z.object({
     type: z.literal('hook'),
     event: HookEventSchema,
-    priority: z.number().int().optional().default(100),
+    priority: integer().optional().default(100),
     canModify: z.boolean().optional().default(false),
     canBlock: z.boolean().optional().default(false),
-    configSchema: z.record(z.unknown()).optional(),
+    configSchema: z.record(z.string(), z.unknown()).optional(),
 });
 /**
  * Tool-specific metadata
@@ -326,11 +329,11 @@ export const ToolMetadataSchema = z.object({
     category: z.enum(['core', 'languages', 'utilities', 'custom']),
     executable: z.string().min(1, 'Executable path is required'),
     verificationStatus: z.enum(['verified', 'unverified']).optional(),
-    lastVerified: z.string().datetime().optional(),
+    lastVerified: dateTime().optional(),
     manPage: z.string().optional(),
     aliases: z.array(z.string()).optional(),
     relatedTools: z.array(z.string()).optional(),
-    platformNotes: z.record(z.string()).optional(),
+    platformNotes: z.record(z.string(), z.string()).optional(),
     installHint: z.string().optional(),
 });
 /**
@@ -348,7 +351,7 @@ export const MCPServerMetadataSchema = z.object({
     type: z.literal('mcp-server'),
     mcpVersion: z.string().min(1, 'MCP version is required'),
     transport: z.enum(['stdio', 'http']),
-    port: z.number().int().positive().optional(),
+    port: integer().positive().optional(),
     capabilities: z.object({
         tools: z.boolean(),
         resources: z.boolean(),
@@ -358,9 +361,9 @@ export const MCPServerMetadataSchema = z.object({
     }),
     sourceType: z.enum(['cli', 'api', 'catalog', 'nl', 'extension']),
     sourceCommand: z.string().optional(),
-    sourceBaseUrl: z.string().url().optional(),
+    sourceBaseUrl: url().optional(),
     workingDirectory: z.string().optional(),
-    environment: z.record(z.string()).optional(),
+    environment: z.record(z.string(), z.string()).optional(),
     tools: z.array(MCPToolSummarySchema).optional(),
     resources: z.array(z.string()).optional(),
     prompts: z.array(z.string()).optional(),
@@ -379,8 +382,8 @@ export const FrameworkMetadataSchema = z.object({
         templates: z.array(z.string()).optional(),
         prompts: z.array(z.string()).optional(),
     }),
-    configSchema: z.record(z.unknown()).optional(),
-    defaultConfig: z.record(z.unknown()).optional(),
+    configSchema: z.record(z.string(), z.unknown()).optional(),
+    defaultConfig: z.record(z.string(), z.unknown()).optional(),
 });
 /**
  * Addon-specific metadata
@@ -476,15 +479,15 @@ export const ExtensionSchema = z.object({
     requires: z.array(z.string()).optional(),
     recommends: z.array(z.string()).optional(),
     conflicts: z.array(z.string()).optional(),
-    systemDependencies: z.record(z.string()).optional(),
+    systemDependencies: z.record(z.string(), z.string()).optional(),
     // Metadata & Documentation
     author: z.string().optional(),
     license: z.string().optional(),
-    repository: z.string().url().optional(),
-    homepage: z.string().url().optional(),
-    bugs: z.string().url().optional(),
-    documentation: z.record(z.string()).optional(),
-    researchCompliance: z.record(z.array(z.string())).optional(),
+    repository: url().optional(),
+    homepage: url().optional(),
+    bugs: url().optional(),
+    documentation: z.record(z.string(), z.string()).optional(),
+    researchCompliance: z.record(z.string(), z.array(z.string())).optional(),
     memory: MemoryFootprintSchema.optional(),
     // Type-Specific Data
     metadata: ExtensionMetadataSchema,
@@ -495,7 +498,7 @@ export const ExtensionSchema = z.object({
     // Validation & Quality
     checksum: z.string().optional(),
     signature: SignatureSchema.optional(),
-}).refine((data) => data.type === data.metadata.type, { message: 'Extension type must match metadata type' });
+}).refine((data) => data.type === data.metadata.type, { error: 'Extension type must match metadata type' });
 /**
  * Validate an extension manifest
  *

package/dist/src/housekeeper/daemon-config.js

@@ -0,0 +1,148 @@
+/**
+ * Daemon config access for `aiwg housekeeper` (epic #3353 slice B5).
+ *
+ * Mirrors the file precedence of `tools/daemon/config.mjs` (YAML, then YML,
+ * then JSON) without importing `tools/` — `src/` must never import `tools/`
+ * (tools import compiled src via `importImpl`). Only the `schedule.jobs`
+ * and `watch.paths` sections plus `daemon.profile` are read or written;
+ * every other key is preserved byte-for-byte through a YAML round-trip.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import YAML from 'yaml';
+import { parseMemoryAuditOptions } from '../memory/cli.js';
+export const HOUSEKEEPER_PROFILE = 'housekeeper';
+/**
+ * Deterministic maintenance kinds. Mirrors `MAINTENANCE_KINDS` in
+ * `tools/daemon/scheduled-task-runner.mjs` — that module owns execution;
+ * this list only validates `job register` input on the CLI side.
+ */
+export const MAINTENANCE_KINDS = Object.freeze([
+    'index.verify',
+    'index.reconcile',
+    'cache.retention',
+    'update.check',
+    'update.install',
+    'index.freshness',
+    'index.refresh',
+    'cache.prune',
+    'memory.audit',
+    'memory.recommend',
+    'memory.apply',
+]);
+/** Same argument contract for registration, daemon configuration and dispatch. */
+export function validateMemoryJobArgs(kind, args = {}) {
+    if (!kind.startsWith('memory.'))
+        return;
+    if (!['memory.audit', 'memory.recommend', 'memory.apply'].includes(kind))
+        throw new Error(`Unsupported memory kind: ${kind}`);
+    if (!args || typeof args !== 'object' || Array.isArray(args))
+        throw new Error('Memory job args must be an object');
+    const values = args;
+    const allowed = kind === 'memory.apply' ? ['plan', 'confirmedDigest', 'windows']
+        : ['scope', 'provider', ...(kind === 'memory.recommend' ? ['evidence', 'usage'] : [])];
+    for (const [key, value] of Object.entries(values)) {
+        if (!allowed.includes(key))
+            throw new Error(`Unsupported ${kind} argument: ${key}`);
+        if (key !== 'windows' && (typeof value !== 'string' || !value.trim()))
+            throw new Error(`${key} must be a non-empty string`);
+    }
+    if (kind === 'memory.apply') {
+        if (!values.plan || !values.confirmedDigest)
+            throw new Error('memory.apply requires args.plan and args.confirmedDigest for the named reviewed plan');
+    }
+    else {
+        parseMemoryAuditOptions(['scope', 'provider'].flatMap(key => values[key] === undefined ? [] : [`--${key}`, String(values[key])]));
+    }
+}
+/** Resolve the daemon config file with the same precedence as Config.load. */
+export function resolveDaemonConfigPath(cwd) {
+    const candidates = [
+        path.join(cwd, '.aiwg', 'daemon.yaml'),
+        path.join(cwd, '.aiwg', 'daemon.yml'),
+        path.join(cwd, '.aiwg', 'daemon.json'),
+    ];
+    for (const candidate of candidates) {
+        if (fs.existsSync(candidate))
+            return { path: candidate, existed: true };
+    }
+    return { path: candidates[0], existed: false };
+}
+function parseConfigFile(file) {
+    const raw = fs.readFileSync(file, 'utf8');
+    if (file.endsWith('.json')) {
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            throw new Error(`Daemon config ${file} must contain a JSON object`);
+        }
+        return parsed;
+    }
+    const parsed = YAML.parse(raw);
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error(`Daemon config ${file} must contain a mapping`);
+    }
+    return parsed;
+}
+export function loadDaemonConfig(cwd) {
+    const { path: file, existed } = resolveDaemonConfigPath(cwd);
+    if (!existed)
+        return { path: file, existed, config: {} };
+    return { path: file, existed, config: parseConfigFile(file) };
+}
+export function saveDaemonConfig(file, config) {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const body = file.endsWith('.json')
+        ? `${JSON.stringify(config, null, 2)}\n`
+        : YAML.stringify(config);
+    const tmp = `${file}.tmp.${process.pid}`;
+    fs.writeFileSync(tmp, body);
+    fs.renameSync(tmp, file);
+}
+export function getDaemonProfile(config) {
+    const daemon = config['daemon'];
+    if (!daemon || typeof daemon !== 'object' || Array.isArray(daemon))
+        return undefined;
+    const profile = daemon['profile'];
+    return typeof profile === 'string' ? profile : undefined;
+}
+export function setDaemonProfile(config, profile) {
+    const daemon = (config['daemon'] ??= {});
+    daemon['profile'] = profile;
+}
+export function getScheduleJobs(config) {
+    const schedule = config['schedule'];
+    if (!schedule || typeof schedule !== 'object' || Array.isArray(schedule))
+        return [];
+    const jobs = schedule['jobs'];
+    return Array.isArray(jobs) ? jobs : [];
+}
+export function setScheduleJobs(config, jobs) {
+    const schedule = (config['schedule'] ??= {});
+    schedule['jobs'] = jobs;
+}
+export function scheduleEnabled(config) {
+    const schedule = config['schedule'];
+    if (!schedule || typeof schedule !== 'object' || Array.isArray(schedule))
+        return false;
+    return schedule['enabled'] !== false;
+}
+export function getWatchPaths(config) {
+    const watch = config['watch'];
+    if (!watch || typeof watch !== 'object' || Array.isArray(watch))
+        return [];
+    const paths = watch['paths'];
+    return Array.isArray(paths) ? paths : [];
+}
+export function setWatchPaths(config, entries) {
+    const watch = (config['watch'] ??= {});
+    watch['paths'] = entries;
+}
+/** Minimal housekeeper seed written when no daemon config exists yet. */
+export function seedHousekeeperConfig() {
+    return {
+        daemon: { profile: HOUSEKEEPER_PROFILE, heartbeat_interval_seconds: 30 },
+        watch: { enabled: false, paths: [] },
+        schedule: { enabled: true, jobs: [] },
+    };
+}
+//# sourceMappingURL=daemon-config.js.map