@aiwg/cli 2026.8.28 → 2026.9.1

package/dist/src/cli/handlers/steward.js

@@ -29,6 +29,9 @@ import { buildWrapperRouteEnvelope } from '../../models/wrapper-route.js';
 import { loadProviderModelCatalog, } from '../../models/provider-policy.js';
 import { CapabilityResolutionError, resolveRoutableCapability, } from '../../artifacts/capability-resolver.js';
 const BASELINE_PROVIDER = 'claude-code';
+function isModelPolicyProvider(provider) {
+    return Object.hasOwn(loadProviderModelCatalog().providers, provider);
+}
 // ── Feature name normalization ────────────────────────────────────────────────
 /**
  * Accept both hyphenated (agent-teams) and underscored (agent_teams) feature
@@ -192,7 +195,7 @@ async function handleSteward(args, ctx) {
     aiwg steward permissions migrate --apply      Back up and atomically normalize config
 
   Providers:
-    claude-code, codex, copilot, cursor, factory, opencode, warp, windsurf, hermes, openclaw
+    claude-code, codex, copilot, cursor, factory, opencode, pi, warp, windsurf, hermes, openclaw
 
   Features:
     cron, agent_teams, tasks, mcp, behaviors, mission_control, daemon
@@ -455,6 +458,13 @@ async function handleSteward(args, ctx) {
                     hint: 'Pass --provider with a supported provider id.',
                     exitCode: EXIT_CODES.USAGE,
                 });
+            if (!isModelPolicyProvider(provider))
+                throw new AiwgError({
+                    code: 'ERR_USAGE_UNSUPPORTED_PROVIDER',
+                    message: `Model wrapper routing is not implemented for provider: ${provider}`,
+                    hint: 'Use `aiwg steward capabilities --provider pi` for current Pi capability routing; model routing is tracked separately.',
+                    exitCode: EXIT_CODES.USAGE,
+                });
             const capabilityType = flagValue('--capability-type');
             const capability = flagValue('--capability');
             const assignment = flagValue('--assignment');

package/dist/src/cli/handlers/use.js

@@ -1022,12 +1022,13 @@ async function countBundleDeployedArtifacts(bundlePath, target, provider) {
 }
 const SKILL_SUPPORT_REFERENCE = /(?:^|[\s`('"\[])((?:templates|references|scripts|assets)\/[A-Za-z0-9._@/+\-]+)(?=$|[\s`)'"\],:;])/gm;
 /**
- * Project skill-relative support files may live beside the skill or at the
- * bundle root (plugin payloads commonly share report templates). Materialize
+ * Skill-relative support files may live beside the skill or at the bundle root
+ * (plugin payloads commonly share report templates). Materialize
  * only paths explicitly named by SKILL.md, and fail closed on missing or
  * unsafe sources so a deployed instruction can never point at absent assets.
  */
-async function reconcileProjectLocalSkillAssets(bundlePath, target, provider) {
+async function reconcileDeployedSkillAssets(bundlePath, target, provider, options = {}) {
+    const strictReferences = options.strictReferences ?? true;
     const skillsRoot = path.join(bundlePath, 'skills');
     let skillDirs;
     try {
@@ -1054,7 +1055,13 @@ async function reconcileProjectLocalSkillAssets(bundlePath, target, provider) {
         catch {
             continue;
         }
-        const references = [...new Set([...content.matchAll(SKILL_SUPPORT_REFERENCE)].map(match => match[1]))];
+        const frontmatter = content.match(/^---\r?\n([\s\S]*?)\r?\n---/)?.[1] ?? '';
+        const declaredEntrypoint = frontmatter
+            .match(/^[ \t]+entrypoint:\s*["']?([^"'\s]+)["']?\s*$/m)?.[1];
+        const declaredEntrypoints = new Set(declaredEntrypoint ? [declaredEntrypoint] : []);
+        const references = [...new Set([
+                ...content.matchAll(SKILL_SUPPORT_REFERENCE),
+            ].map(match => match[1]).concat([...declaredEntrypoints]))];
         for (const relative of references) {
             const normalized = path.posix.normalize(relative);
             if (normalized !== relative || normalized.startsWith('../') || path.isAbsolute(normalized)) {
@@ -1072,8 +1079,12 @@ async function reconcileProjectLocalSkillAssets(bundlePath, target, provider) {
                 }
                 catch { /* try bundle-root fallback */ }
             }
-            if (!source)
-                throw new Error(`missing skill support asset '${relative}' referenced by ${sourceSkillMd}`);
+            if (!source) {
+                if (strictReferences || declaredEntrypoints.has(relative)) {
+                    throw new Error(`missing skill support asset '${relative}' referenced by ${sourceSkillMd}`);
+                }
+                continue;
+            }
             let deployedSkillRoot;
             for (const root of deployRoots) {
                 // The deployer may select the bulk or kernel tier; use the tier that
@@ -1162,7 +1173,7 @@ async function deployOneProjectLocalBundle(opts) {
         exitCode = result.exitCode;
         if (exitCode === 0 && !dryRun) {
             try {
-                await reconcileProjectLocalSkillAssets(bundle.artifactPath, target, provider);
+                await reconcileDeployedSkillAssets(bundle.artifactPath, target, provider);
             }
             catch (error) {
                 ui.warn(`Project-local skill asset deployment failed for '${bundle.id}': ${error.message}`);
@@ -2733,6 +2744,17 @@ export class UseHandler {
                             || `Failed to deploy required addon '${dependency}'`,
                     };
                 }
+                if (!dryRunAddon) {
+                    try {
+                        await reconcileDeployedSkillAssets(dependencySource, target, provider, { strictReferences: false });
+                    }
+                    catch (error) {
+                        return {
+                            exitCode: 1,
+                            message: `Required addon '${dependency}' skill asset deployment failed: ${error instanceof Error ? error.message : String(error)}`,
+                        };
+                    }
+                }
                 try {
                     await registerSourceCliCommands({
                         source: dependencySource,
@@ -2764,6 +2786,17 @@ export class UseHandler {
             if (addonResult.exitCode !== 0) {
                 return addonResult;
             }
+            if (!dryRunAddon) {
+                try {
+                    await reconcileDeployedSkillAssets(addonSource, target, provider, { strictReferences: false });
+                }
+                catch (error) {
+                    return {
+                        exitCode: 1,
+                        message: `${kind} '${framework}' skill asset deployment failed: ${error instanceof Error ? error.message : String(error)}`,
+                    };
+                }
+            }
             // Register only artifacts actually written by a confirmed deployment.
             if (!dryRunAddon) {
                 try {
@@ -2889,7 +2922,7 @@ export class UseHandler {
             catch {
                 // Profile selection is optional — don't fail deployment
             }
-            if (framework === 'aiwg-utils' && !remainingArgs.includes('--dry-run')) {
+            if (framework === 'aiwg-utils' && provider !== 'pi' && !remainingArgs.includes('--dry-run')) {
                 const wrapperValidation = await validateDeployedModelWrappers({
                     provider: normalizeProviderDefinitionId(provider) ?? provider,
                     target,
@@ -2992,6 +3025,7 @@ export class UseHandler {
             ? withProviderOverride(deployFilteredArgs, provider)
             : deployFilteredArgs;
         const bulkKernelOnly = framework === 'all'
+            && provider !== 'pi'
             && !remainingArgs.includes('--copy-all')
             && !remainingArgs.includes('--copy-standard-skills');
         if (bulkKernelOnly)
@@ -3197,7 +3231,10 @@ export class UseHandler {
         }
         await ensureProviderGeneratedDirsIgnored(target, provider, { dryRun, verbose });
         const paths = getProviderPaths(provider);
-        if (!dryRun && !skipUtils && !bulkKernelOnly) {
+        // Pi model selection/headless routing is delivered by #2151. Until that
+        // adapter exists, do not require model-wrapper artifacts that Pi cannot
+        // load; resource deployment remains independently valid.
+        if (!dryRun && !skipUtils && !bulkKernelOnly && provider !== 'pi') {
             const wrapperValidation = await validateDeployedModelWrappers({
                 provider,
                 target,

package/dist/src/cli/hooks/builtin/activity-log-hook.js

@@ -74,6 +74,12 @@ export const activityLogPostCommandHook = {
         commands: Object.keys(COMMAND_OPERATION_MAP),
     },
     async execute(ctx) {
+        // A dry-run is a strict no-write contract. The command handler may preview
+        // mutations, but the post-command hook must not create activity.log as a
+        // side effect of that preview.
+        if (ctx.args.includes('--dry-run')) {
+            return { action: 'continue' };
+        }
         // Skip on env-var opt-out
         if (isActivityLogSkipped()) {
             return { action: 'continue' };

package/dist/src/cli/router.js

@@ -316,7 +316,7 @@ async function logCommandInvocation(input) {
  * @returns Handler context
  */
 async function buildContext(args, rawArgs, options) {
-    const frameworkRoot = await getFrameworkRoot();
+    const frameworkRoot = await getFrameworkRoot({ createIfMissing: !args.includes('--dry-run') });
     const ctx = {
         args,
         rawArgs,

package/dist/src/cli/scope-resolver.js

@@ -13,6 +13,16 @@ import { homedir } from 'node:os';
 import * as path from 'node:path';
 import { resolveHermesHome, resolveHermesHomePath } from '../providers/hermes-home.js';
 export const hermesHome = resolveHermesHome;
+function piAgentDir() {
+    const configured = process.env.PI_CODING_AGENT_DIR;
+    if (!configured)
+        return path.join(homedir(), '.pi', 'agent');
+    if (configured === '~')
+        return homedir();
+    if (configured.startsWith('~/'))
+        return path.join(homedir(), configured.slice(2));
+    return configured;
+}
 /**
  * User-scope deploy paths per provider per ADR-4 §2. Each path is absolute
  * (rooted in os.homedir()) so the orchestrator's existing path-join logic
@@ -47,6 +57,18 @@ export const USER_SCOPE_PATHS = {
         rules: '',
         behaviors: '',
     },
+    pi: {
+        // Pi's global resource root is configurable. Unlike project deployment,
+        // user-scope resources belong under the effective agent directory. Keep
+        // skills on this single native path instead of also copying them to
+        // ~/.agents/skills, which would create duplicate Pi discovery entries.
+        // PI_CODING_AGENT_DIR is configuration only and is not runtime evidence.
+        agents: '',
+        skills: path.join(piAgentDir(), 'skills'),
+        commands: path.join(piAgentDir(), 'prompts'),
+        rules: '',
+        behaviors: path.join(piAgentDir(), 'extensions'),
+    },
     copilot: {
         // #1160 — Non-applicable for filesystem user-scope discovery.
         //

package/dist/src/dataset/adapter-sdk.d.ts

@@ -0,0 +1,41 @@
+import type { AdapterCheckpoint, AdapterConfigurationResult, AdapterDiagnostic, AdapterDiagnosticCode, AdapterLimits, AdapterManifest, AdapterOperation, AdapterQualificationCell, AdapterQualificationReport, AdapterRequest, AdapterSchemaDeclaration, CredentialLocator, DatasetSourceAdapter } from './adapter-types.js';
+export declare const DEFAULT_ADAPTER_LIMITS: AdapterLimits;
+export declare function sha256Digest(value: string | Uint8Array): {
+    algorithm: 'sha256';
+    value: string;
+};
+export declare function canonicalJson(value: unknown): string;
+export declare function diagnostic(operation: AdapterOperation, code: AdapterDiagnosticCode, message: string, options?: {
+    path?: string;
+    retryable?: boolean;
+    severity?: AdapterDiagnostic['severity'];
+}): AdapterDiagnostic;
+export declare class AdapterFailure extends Error {
+    readonly diagnostic: AdapterDiagnostic;
+    constructor(diagnostic: AdapterDiagnostic);
+}
+export declare function assertActive(signal: AbortSignal | undefined, operation: AdapterOperation): void;
+export declare function effectiveLimits(manifest: AdapterManifest, requested: AdapterLimits): AdapterLimits;
+export declare function isCredentialLocator(value: unknown): value is CredentialLocator;
+export declare function containsRawSecret(value: unknown, key?: string): boolean;
+export declare function redactAdapterValue(value: unknown, key?: string): unknown;
+export declare function schemaDeclaration(id: string, schema: Record<string, unknown>): AdapterSchemaDeclaration;
+export declare function configureObject<T extends Record<string, unknown>>(operation: AdapterOperation, value: unknown, validate: (candidate: Record<string, unknown>) => candidate is T): AdapterConfigurationResult<T>;
+export declare function validateCheckpoint(checkpoint: AdapterCheckpoint | undefined, manifest: AdapterManifest, sourceIdentity: string): AdapterDiagnostic[];
+export declare class AdapterRegistry {
+    #private;
+    private readonly trust;
+    constructor(trust: {
+        allowIds: Set<string>;
+        allowUntrusted?: boolean;
+    });
+    register(adapter: DatasetSourceAdapter): void;
+    require(id: string, version: string): DatasetSourceAdapter;
+}
+export declare function qualifyAdapter(adapter: DatasetSourceAdapter, options: {
+    fixtureRevision: string;
+    qualifiedAt: string;
+    cells: AdapterQualificationCell[];
+}): Promise<AdapterQualificationReport>;
+export declare function request<T extends Record<string, unknown>>(requestId: string, config: T, policy: AdapterRequest<T>['policy'], limits?: Partial<AdapterLimits>): AdapterRequest<T>;
+//# sourceMappingURL=adapter-sdk.d.ts.map

package/dist/src/dataset/adapter-sdk.js

@@ -0,0 +1,147 @@
+import { createHash } from 'node:crypto';
+import { DATASET_ADAPTER_CONTRACT_VERSION } from './adapter-types.js';
+export const DEFAULT_ADAPTER_LIMITS = Object.freeze({
+    maxRecords: 10_000,
+    maxBytes: 16 * 1024 * 1024,
+    maxRecordBytes: 1024 * 1024,
+    timeoutMs: 30_000,
+    maxRedirects: 3,
+    maxDepth: 16,
+});
+export function sha256Digest(value) {
+    return { algorithm: 'sha256', value: createHash('sha256').update(value).digest('hex') };
+}
+export function canonicalJson(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(',')}]`;
+    return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => `${JSON.stringify(key)}:${canonicalJson(item)}`).join(',')}}`;
+}
+export function diagnostic(operation, code, message, options = {}) {
+    return { code, message, operation, retryable: options.retryable ?? false, severity: options.severity ?? 'error', ...(options.path ? { path: options.path } : {}) };
+}
+export class AdapterFailure extends Error {
+    diagnostic;
+    constructor(diagnostic) {
+        super(diagnostic.message);
+        this.diagnostic = diagnostic;
+        this.name = 'AdapterFailure';
+    }
+}
+export function assertActive(signal, operation) {
+    if (signal?.aborted)
+        throw new AdapterFailure(diagnostic(operation, 'ADAPTER_CANCELLED', 'The adapter operation was cancelled.'));
+}
+export function effectiveLimits(manifest, requested) {
+    const positive = (value, ceiling) => Math.max(1, Math.min(Number.isFinite(value) ? Math.trunc(value) : 1, ceiling));
+    return {
+        maxRecords: positive(requested.maxRecords, manifest.limits.maxRecords),
+        maxBytes: positive(requested.maxBytes, manifest.limits.maxBytes),
+        maxRecordBytes: positive(requested.maxRecordBytes, manifest.limits.maxRecordBytes),
+        timeoutMs: positive(requested.timeoutMs, manifest.limits.timeoutMs),
+        maxRedirects: Math.max(0, Math.min(Math.trunc(requested.maxRedirects), manifest.limits.maxRedirects)),
+        maxDepth: positive(requested.maxDepth, manifest.limits.maxDepth),
+    };
+}
+export function isCredentialLocator(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const candidate = value;
+    return ['opaque', 'environment', 'keychain', 'vault'].includes(String(candidate.kind))
+        && typeof candidate.locator === 'string' && candidate.locator.length > 0 && candidate.locator.length <= 512;
+}
+const SECRET_KEY = /(?:secret|password|passwd|token|api[-_]?key|credential)/iu;
+export function containsRawSecret(value, key = '') {
+    if (SECRET_KEY.test(key))
+        return !isCredentialLocator(value);
+    if (Array.isArray(value))
+        return value.some(item => containsRawSecret(item));
+    if (value && typeof value === 'object')
+        return Object.entries(value).some(([childKey, child]) => containsRawSecret(child, childKey));
+    return false;
+}
+export function redactAdapterValue(value, key = '') {
+    if (SECRET_KEY.test(key))
+        return '[credential-locator-redacted]';
+    if (Array.isArray(value))
+        return value.map(item => redactAdapterValue(item));
+    if (value && typeof value === 'object')
+        return Object.fromEntries(Object.entries(value).map(([childKey, child]) => [childKey, redactAdapterValue(child, childKey)]));
+    return value;
+}
+export function schemaDeclaration(id, schema) {
+    const version = '1.0.0';
+    return { id, version, digest: sha256Digest(canonicalJson(schema)), dialect: 'https://json-schema.org/draft/2020-12/schema', schema };
+}
+export function configureObject(operation, value, validate) {
+    if (!value || typeof value !== 'object' || Array.isArray(value) || containsRawSecret(value)) {
+        return { ok: false, diagnostics: [diagnostic(operation, containsRawSecret(value) ? 'ADAPTER_SECRET_REJECTED' : 'ADAPTER_INVALID_CONFIGURATION', containsRawSecret(value) ? 'Secret-like fields must contain an opaque credential locator, never credential material.' : 'Configuration must be an object accepted by the adapter schema.')] };
+    }
+    const candidate = structuredClone(value);
+    if (!validate(candidate))
+        return { ok: false, diagnostics: [diagnostic(operation, 'ADAPTER_INVALID_CONFIGURATION', 'Configuration does not satisfy the adapter contract.')] };
+    return { ok: true, config: candidate, configDigest: sha256Digest(canonicalJson(redactAdapterValue(candidate))), diagnostics: [] };
+}
+export function validateCheckpoint(checkpoint, manifest, sourceIdentity) {
+    if (!checkpoint)
+        return [];
+    const valid = checkpoint.contractVersion === DATASET_ADAPTER_CONTRACT_VERSION
+        && checkpoint.kind === 'AdapterCheckpoint'
+        && checkpoint.adapter.id === manifest.id
+        && checkpoint.adapter.version === manifest.version
+        && checkpoint.sourceIdentity === sourceIdentity
+        && /^-?\d+$/u.test(checkpoint.cursor)
+        && checkpoint.schema.id === manifest.schemas.checkpoint.id
+        && checkpoint.schema.version === manifest.schemas.checkpoint.version
+        && checkpoint.schema.digest?.value === manifest.schemas.checkpoint.digest.value;
+    return valid ? [] : [diagnostic('read', 'ADAPTER_CHECKPOINT_INCOMPATIBLE', 'Checkpoint identity, adapter version, or schema binding is incompatible; no records were read.')];
+}
+export class AdapterRegistry {
+    trust;
+    #adapters = new Map();
+    constructor(trust) {
+        this.trust = trust;
+    }
+    register(adapter) {
+        const manifest = adapter.describe();
+        if (!this.trust.allowIds.has(manifest.id))
+            throw new Error(`ADAPTER_NOT_ALLOWLISTED: ${manifest.id}`);
+        if (manifest.trust.state === 'untrusted' && !this.trust.allowUntrusted)
+            throw new Error(`ADAPTER_TRUST_REQUIRED: ${manifest.id}`);
+        if (manifest.permissions.credentials !== 'none' && manifest.permissions.credentials !== 'locator-only')
+            throw new Error(`ADAPTER_PERMISSION_INVALID: ${manifest.id}`);
+        this.#adapters.set(`${manifest.id}@${manifest.version}`, adapter);
+    }
+    require(id, version) {
+        const adapter = this.#adapters.get(`${id}@${version}`);
+        if (!adapter)
+            throw new Error(`ADAPTER_NOT_REGISTERED: ${id}@${version}`);
+        return adapter;
+    }
+}
+export async function qualifyAdapter(adapter, options) {
+    const manifest = adapter.describe();
+    const required = new Set(['configuration-schema', 'preview-purity', 'deterministic-read', 'stable-errors', 'cancellation', 'checkpoints', 'version-upgrade', 'secret-leakage']);
+    const passed = new Set(options.cells.filter(cell => cell.passed).map(cell => cell.name));
+    const qualified = [...required].every(name => passed.has(name));
+    const realSource = options.cells.some(cell => cell.source === 'real-source' && cell.passed);
+    return {
+        contractVersion: DATASET_ADAPTER_CONTRACT_VERSION,
+        kind: 'AdapterQualificationReport',
+        adapter: { id: manifest.id, version: manifest.version, packageDigest: manifest.packageDigest },
+        schemas: {
+            config: binding(manifest.schemas.config), record: binding(manifest.schemas.discoveredRecord), checkpoint: binding(manifest.schemas.checkpoint),
+        },
+        fixtureRevision: options.fixtureRevision,
+        cells: structuredClone(options.cells), qualifiedAt: options.qualifiedAt,
+        qualified, stableEligible: qualified && realSource,
+    };
+}
+function binding(schema) {
+    return { id: schema.id, version: schema.version, digest: schema.digest };
+}
+export function request(requestId, config, policy, limits = {}) {
+    return { contractVersion: DATASET_ADAPTER_CONTRACT_VERSION, requestId, config, policy, limits: { ...DEFAULT_ADAPTER_LIMITS, ...limits } };
+}
+//# sourceMappingURL=adapter-sdk.js.map

package/dist/src/dataset/adapter-types.d.ts

@@ -0,0 +1,179 @@
+import type { Digest, PrivacyClassification, SchemaBinding } from './types.js';
+export declare const DATASET_ADAPTER_CONTRACT_VERSION: "aiwg.dataset.adapter/v1";
+export type DatasetAdapterContractVersion = typeof DATASET_ADAPTER_CONTRACT_VERSION;
+export type AdapterOperation = 'describe' | 'configure' | 'check' | 'discover' | 'preview' | 'read';
+export type AdapterDiagnosticCode = 'ADAPTER_INVALID_CONFIGURATION' | 'ADAPTER_AUTHORIZATION_UNAVAILABLE' | 'ADAPTER_OFFLINE_PROHIBITED' | 'ADAPTER_SOURCE_UNAVAILABLE' | 'ADAPTER_RESOURCE_LIMIT' | 'ADAPTER_SCHEMA_DRIFT' | 'ADAPTER_CHECKPOINT_INCOMPATIBLE' | 'ADAPTER_CANCELLED' | 'ADAPTER_PATH_ESCAPE' | 'ADAPTER_UNSAFE_SYMLINK' | 'ADAPTER_SPECIAL_FILE' | 'ADAPTER_NETWORK_PROHIBITED' | 'ADAPTER_REDIRECT_PROHIBITED' | 'ADAPTER_SECRET_REJECTED' | 'ADAPTER_INTERNAL_ERROR';
+export interface AdapterDiagnostic {
+    code: AdapterDiagnosticCode;
+    severity: 'info' | 'warning' | 'error';
+    message: string;
+    operation: AdapterOperation;
+    path?: string;
+    retryable: boolean;
+}
+export interface AdapterSchemaDeclaration extends SchemaBinding {
+    digest: Digest;
+    dialect: 'https://json-schema.org/draft/2020-12/schema';
+    schema: Record<string, unknown>;
+}
+export interface AdapterManifest {
+    contractVersion: DatasetAdapterContractVersion;
+    kind: 'AdapterManifest';
+    id: string;
+    version: string;
+    packageDigest: Digest;
+    datasetContractRange: string;
+    sourceKinds: string[];
+    schemas: {
+        config: AdapterSchemaDeclaration;
+        discoveredRecord: AdapterSchemaDeclaration;
+        checkpoint: AdapterSchemaDeclaration;
+    };
+    capabilities: Array<'discovery' | 'preview' | 'streaming-read' | 'checkpoint' | 'tombstone'>;
+    limits: AdapterLimits;
+    maturity: 'experimental' | 'qualified' | 'stable';
+    publisher: {
+        id: string;
+        url?: string;
+    };
+    trust: {
+        state: 'builtin' | 'verified' | 'untrusted';
+        signature?: string;
+    };
+    permissions: {
+        locality: 'local' | 'remote';
+        network: 'none' | 'https-allowlisted';
+        credentials: 'none' | 'locator-only';
+    };
+    incremental: {
+        ordering: string;
+        sameCursorTieHandling: string;
+        lateArrivals: string;
+        tombstones: string;
+        checkpointCompatibility: string;
+    };
+}
+export interface CredentialLocator {
+    kind: 'opaque' | 'environment' | 'keychain' | 'vault';
+    locator: string;
+}
+export interface AdapterLimits {
+    maxRecords: number;
+    maxBytes: number;
+    maxRecordBytes: number;
+    timeoutMs: number;
+    maxRedirects: number;
+    maxDepth: number;
+}
+export interface AdapterPolicy {
+    offline: boolean;
+    allowedRoot?: string;
+    allowedHosts?: string[];
+    allowPrivateNetwork?: boolean;
+}
+export interface AdapterRequest<TConfig extends Record<string, unknown> = Record<string, unknown>> {
+    contractVersion: DatasetAdapterContractVersion;
+    requestId: string;
+    config: TConfig;
+    policy: AdapterPolicy;
+    limits: AdapterLimits;
+    signal?: AbortSignal;
+}
+export interface AdapterCheckpoint {
+    contractVersion: DatasetAdapterContractVersion;
+    kind: 'AdapterCheckpoint';
+    adapter: {
+        id: string;
+        version: string;
+    };
+    sourceIdentity: string;
+    cursor: string;
+    tieBreaker?: string;
+    schema: SchemaBinding;
+    createdAt: string;
+}
+export interface AdapterConfigurationResult<TConfig extends Record<string, unknown> = Record<string, unknown>> {
+    ok: boolean;
+    config?: TConfig;
+    configDigest?: Digest;
+    diagnostics: AdapterDiagnostic[];
+}
+export interface AdapterDiscovery {
+    sourceIdentity: string;
+    proposedSchema: Record<string, unknown>;
+    schemaBasis: 'declared' | 'observed' | 'inferred';
+    estimates: {
+        records?: number;
+        bytes?: number;
+    };
+    privacySignals: PrivacyClassification[];
+    licenseSignals: string[];
+    cursorSupport: boolean;
+    checkpointSupport: boolean;
+    identityStability: 'stable' | 'source-unstable';
+    identityLimitation?: string;
+    limitations: string[];
+}
+export interface AdapterResult<T> {
+    ok: boolean;
+    value?: T;
+    diagnostics: AdapterDiagnostic[];
+}
+export interface AdapterRecord {
+    logicalId: string;
+    ordinal: number;
+    value: unknown;
+    sourceLocator: string;
+    contentDigest: Digest;
+    tombstone?: boolean;
+}
+export type AdapterReadEvent = {
+    kind: 'record';
+    record: AdapterRecord;
+} | {
+    kind: 'checkpoint';
+    checkpoint: AdapterCheckpoint;
+} | {
+    kind: 'diagnostic';
+    diagnostic: AdapterDiagnostic;
+};
+export interface DatasetSourceAdapter<TConfig extends Record<string, unknown> = Record<string, unknown>> {
+    describe(): AdapterManifest;
+    configure(config: unknown): Promise<AdapterConfigurationResult<TConfig>>;
+    check(request: AdapterRequest<TConfig>): Promise<AdapterResult<{
+        sourceIdentity: string;
+    }>>;
+    discover(request: AdapterRequest<TConfig>): Promise<AdapterResult<AdapterDiscovery>>;
+    preview(request: AdapterRequest<TConfig> & {
+        count: number;
+    }): Promise<AdapterResult<AdapterRecord[]>>;
+    read(request: AdapterRequest<TConfig> & {
+        checkpoint?: AdapterCheckpoint;
+    }): AsyncIterable<AdapterReadEvent>;
+}
+export interface AdapterQualificationCell {
+    name: string;
+    source: 'fixture' | 'real-source';
+    passed: boolean;
+    evidence: string[];
+}
+export interface AdapterQualificationReport {
+    contractVersion: DatasetAdapterContractVersion;
+    kind: 'AdapterQualificationReport';
+    adapter: {
+        id: string;
+        version: string;
+        packageDigest: Digest;
+    };
+    schemas: {
+        config: SchemaBinding;
+        record: SchemaBinding;
+        checkpoint: SchemaBinding;
+    };
+    fixtureRevision: string;
+    cells: AdapterQualificationCell[];
+    qualifiedAt: string;
+    qualified: boolean;
+    stableEligible: boolean;
+}
+//# sourceMappingURL=adapter-types.d.ts.map

package/dist/src/dataset/adapter-types.js

@@ -0,0 +1,2 @@
+export const DATASET_ADAPTER_CONTRACT_VERSION = 'aiwg.dataset.adapter/v1';
+//# sourceMappingURL=adapter-types.js.map