@aiwg/cli 2026.9.18 → 2026.9.20

package/dist/src/decision/receipts.js

@@ -0,0 +1,291 @@
+import { createHash, createHmac, randomUUID, timingSafeEqual } from 'node:crypto';
+import { link, mkdir, open, readFile, readdir, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { canonicalJson } from '../security/artifact-trust.js';
+export function decisionInvocationFingerprint(input) {
+    return `sha256:${createHash('sha256').update(canonicalJson({
+        invocationId: input.invocationId, input: input.value, definitions: input.definitions,
+        ruleset: input.ruleset, binding: input.binding,
+        policy: input.policy ?? null, calibration: input.calibration ?? null,
+    })).digest('hex')}`;
+}
+const terminal = new Set(['completed', 'failed', 'execution-uncertain']);
+const allowed = {
+    acquired: ['dispatched', 'observation-received', 'composed', 'failed', 'execution-uncertain'],
+    dispatched: ['remote-handle-known', 'observation-received', 'execution-uncertain'],
+    'remote-handle-known': ['observation-received', 'execution-uncertain'],
+    'observation-received': ['observation-received', 'dispatched', 'composed', 'failed', 'execution-uncertain'],
+    composed: ['completed', 'failed', 'execution-uncertain'],
+    completed: [], failed: [], 'execution-uncertain': [],
+};
+export class DecisionReceiptIntegrityError extends Error {
+}
+export class DecisionReceiptAccessError extends Error {
+}
+/** A transport may throw this only before it has attempted remote dispatch. */
+export class DecisionPreDispatchError extends Error {
+}
+export function validateReceipt(receipt, invocationId, projectId) {
+    if (!receipt || receipt.schema !== 'decision-receipt/v2' || receipt.invocationId !== invocationId || receipt.projectId !== projectId
+        || !Number.isSafeInteger(receipt.revision) || receipt.revision < 1
+        || !Number.isSafeInteger(receipt.acquiredAtEpochMs) || receipt.acquiredAtEpochMs < 0
+        || !Number.isSafeInteger(receipt.updatedAtEpochMs) || receipt.updatedAtEpochMs < receipt.acquiredAtEpochMs
+        || (receipt.state === 'completed' ? !Number.isSafeInteger(receipt.completedAtEpochMs)
+            || receipt.completedAtEpochMs < receipt.acquiredAtEpochMs
+            : receipt.completedAtEpochMs !== undefined)
+        || !/^sha256:[a-f0-9]{64}$/.test(receipt.fingerprint)
+        || !Object.hasOwn(allowed, receipt.state) || !Array.isArray(receipt.remoteHandles)
+        || receipt.remoteHandles.some(handle => typeof handle !== 'string' || !handle.length)
+        || !receipt.evaluations || typeof receipt.evaluations !== 'object' || Array.isArray(receipt.evaluations)
+        || Object.entries(receipt.evaluations).some(([alias, result]) => result.spec.alias !== alias || result.spec.invocationId !== invocationId)
+        || (receipt.pending !== null && (!receipt.pending || typeof receipt.pending.alias !== 'string'
+            || !Number.isSafeInteger(receipt.pending.targetIndex) || receipt.pending.targetIndex < 0
+            || !Number.isSafeInteger(receipt.pending.ordinal) || receipt.pending.ordinal < 1
+            || !Array.isArray(receipt.pending.attempts)))
+        || (receipt.state === 'completed' && (!receipt.result || receipt.result.spec.invocationId !== invocationId
+            || receipt.result.spec.status === 'error' && receipt.result.spec.reason === 'execution-uncertain'))
+        || (receipt.state !== 'completed' && receipt.result !== undefined)) {
+        throw new DecisionReceiptIntegrityError('Invalid decision receipt');
+    }
+}
+export function nextReceipt(previous, state, extra = {}) {
+    if (!allowed[previous.state].includes(state))
+        throw new DecisionReceiptIntegrityError('Illegal receipt transition');
+    const updatedAtEpochMs = Math.max(previous.updatedAtEpochMs, extra.updatedAtEpochMs ?? Date.now());
+    const next = { ...structuredClone(previous), ...structuredClone(extra), state, revision: previous.revision + 1,
+        updatedAtEpochMs, ...(state === 'completed' ? { completedAtEpochMs: extra.completedAtEpochMs ?? updatedAtEpochMs } : {}) };
+    if (next.remoteHandles.length < previous.remoteHandles.length || previous.remoteHandles.some((handle, index) => next.remoteHandles[index] !== handle)) {
+        throw new DecisionReceiptIntegrityError('Remote handle lineage changed');
+    }
+    if (Object.entries(previous.evaluations).some(([alias, result]) => canonicalJson(next.evaluations[alias]) !== canonicalJson(result))) {
+        throw new DecisionReceiptIntegrityError('Completed evaluation lineage changed');
+    }
+    validateReceipt(next, previous.invocationId, previous.projectId);
+    return next;
+}
+function initial(invocationId, projectId, fingerprint) {
+    const acquiredAtEpochMs = Date.now();
+    const receipt = { schema: 'decision-receipt/v2', revision: 1, acquiredAtEpochMs, updatedAtEpochMs: acquiredAtEpochMs,
+        projectId, invocationId, fingerprint, state: 'acquired', remoteHandles: [], evaluations: {}, pending: null };
+    validateReceipt(receipt, invocationId, projectId);
+    return receipt;
+}
+function assertTransition(previous, next) {
+    const expected = nextReceipt(previous, next.state, {
+        ...(next.result !== undefined ? { result: next.result } : {}), remoteHandles: next.remoteHandles,
+        evaluations: next.evaluations, pending: next.pending, updatedAtEpochMs: next.updatedAtEpochMs,
+        ...(next.completedAtEpochMs !== undefined ? { completedAtEpochMs: next.completedAtEpochMs } : {}),
+    });
+    if (canonicalJson(expected) !== canonicalJson(next))
+        throw new DecisionReceiptIntegrityError('Receipt mutation outside legal transition');
+}
+export class MemoryDecisionReceiptStore {
+    authorize;
+    receipts = new Map();
+    constructor(authorize = () => true) {
+        this.authorize = authorize;
+    }
+    async check(projectId) {
+        if (!await this.authorize(projectId))
+            throw new DecisionReceiptAccessError('Decision receipt access denied');
+    }
+    async read(invocationId, projectId = 'default') {
+        await this.check(projectId);
+        const receipt = this.receipts.get(invocationId);
+        if (!receipt)
+            return null;
+        validateReceipt(receipt, invocationId, projectId);
+        return structuredClone(receipt);
+    }
+    async acquire(invocationId, projectId, fingerprint) {
+        await this.check(projectId);
+        const existing = this.receipts.get(invocationId);
+        if (existing) {
+            validateReceipt(existing, invocationId, projectId);
+            return { owner: false, receipt: structuredClone(existing) };
+        }
+        const receipt = initial(invocationId, projectId, fingerprint);
+        this.receipts.set(invocationId, receipt);
+        return { owner: true, receipt: structuredClone(receipt) };
+    }
+    async compareAndSwap(invocationId, projectId, expectedRevision, next) {
+        await this.check(projectId);
+        const current = this.receipts.get(invocationId);
+        if (!current)
+            throw new DecisionReceiptIntegrityError('Missing decision receipt');
+        validateReceipt(current, invocationId, projectId);
+        if (current.revision !== expectedRevision)
+            return false;
+        assertTransition(current, next);
+        this.receipts.set(invocationId, structuredClone(next));
+        return true;
+    }
+    async waitForTerminal(invocationId, projectId, fingerprint, signal) {
+        for (;;) {
+            const receipt = await this.read(invocationId, projectId);
+            if (!receipt || receipt.fingerprint !== fingerprint)
+                throw new DecisionReceiptIntegrityError('Receipt fingerprint mismatch');
+            if (terminal.has(receipt.state))
+                return receipt;
+            if (signal?.aborted)
+                throw signal.reason ?? new Error('Aborted');
+            await sleep(20, signal);
+        }
+    }
+}
+export class FileDecisionReceiptStore {
+    directory;
+    options;
+    constructor(directory, options) {
+        this.directory = directory;
+        this.options = options;
+        if (options.integrityKey.length < 32)
+            throw new Error('Decision receipt integrity key must be at least 32 bytes');
+    }
+    async check(projectId) {
+        if (this.options.authorize && !await this.options.authorize(projectId))
+            throw new DecisionReceiptAccessError('Decision receipt access denied');
+    }
+    prefixFor(invocationId) {
+        return createHash('sha256').update(invocationId).digest('hex');
+    }
+    pathFor(invocationId, revision) {
+        return join(this.directory, `${this.prefixFor(invocationId)}.r${revision}.json`);
+    }
+    mac(receipt) {
+        return createHmac('sha256', this.options.integrityKey).update(canonicalJson(receipt)).digest('hex');
+    }
+    async read(invocationId, projectId = 'default') {
+        await this.check(projectId);
+        let names;
+        try {
+            names = await readdir(this.directory);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return null;
+            throw error;
+        }
+        const prefix = `${this.prefixFor(invocationId)}.r`;
+        const revisions = names.filter(name => name.startsWith(prefix) && name.endsWith('.json'))
+            .map(name => Number(name.slice(prefix.length, -'.json'.length)));
+        if (!revisions.length)
+            return null;
+        // A previous writer may have died after link() but before directory sync().
+        // Synchronize any observed publication before treating it as ownership evidence.
+        const dir = await open(this.directory, 'r');
+        try {
+            await dir.sync();
+        }
+        finally {
+            await dir.close();
+        }
+        if (revisions.some(revision => !Number.isSafeInteger(revision) || revision < 1))
+            throw new DecisionReceiptIntegrityError('Corrupt decision receipt revision index');
+        revisions.sort((a, b) => a - b);
+        let previous = null;
+        for (let index = 0; index < revisions.length; index += 1) {
+            const revision = revisions[index];
+            if (revision !== index + 1)
+                throw new DecisionReceiptIntegrityError('Decision receipt revision gap');
+            let document;
+            try {
+                document = JSON.parse(await readFile(this.pathFor(invocationId, revision), 'utf8'));
+            }
+            catch {
+                throw new DecisionReceiptIntegrityError('Corrupt decision receipt');
+            }
+            if (!document || typeof document.mac !== 'string' || !/^[a-f0-9]{64}$/.test(document.mac))
+                throw new DecisionReceiptIntegrityError('Corrupt decision receipt envelope');
+            if (!timingSafeEqual(Buffer.from(document.mac, 'hex'), Buffer.from(this.mac(document.receipt), 'hex'))) {
+                throw new DecisionReceiptIntegrityError('Decision receipt integrity check failed');
+            }
+            validateReceipt(document.receipt, invocationId, projectId);
+            if (document.receipt.revision !== revision || (revision === 1 && document.receipt.state !== 'acquired')) {
+                throw new DecisionReceiptIntegrityError('Decision receipt revision mismatch');
+            }
+            if (previous)
+                assertTransition(previous, document.receipt);
+            previous = document.receipt;
+        }
+        return structuredClone(previous);
+    }
+    async acquire(invocationId, projectId, fingerprint) {
+        await this.check(projectId);
+        const existing = await this.read(invocationId, projectId);
+        if (existing)
+            return { owner: false, receipt: existing };
+        const receipt = initial(invocationId, projectId, fingerprint);
+        if (await this.persist(invocationId, receipt))
+            return { owner: true, receipt };
+        const winner = await this.read(invocationId, projectId);
+        if (!winner)
+            throw new DecisionReceiptIntegrityError('Missing winning receipt');
+        return { owner: false, receipt: winner };
+    }
+    async compareAndSwap(invocationId, projectId, expectedRevision, next) {
+        await this.check(projectId);
+        const current = await this.read(invocationId, projectId);
+        if (!current)
+            throw new DecisionReceiptIntegrityError('Missing decision receipt');
+        if (current.revision !== expectedRevision)
+            return false;
+        assertTransition(current, next);
+        return this.persist(invocationId, next);
+    }
+    async waitForTerminal(invocationId, projectId, fingerprint, signal) {
+        for (;;) {
+            const receipt = await this.read(invocationId, projectId);
+            if (!receipt || receipt.fingerprint !== fingerprint)
+                throw new DecisionReceiptIntegrityError('Receipt fingerprint mismatch');
+            if (terminal.has(receipt.state))
+                return receipt;
+            if (signal?.aborted)
+                throw signal.reason ?? new Error('Aborted');
+            await sleep(30, signal);
+        }
+    }
+    async persist(invocationId, receipt) {
+        await mkdir(this.directory, { recursive: true, mode: 0o700 });
+        const destination = this.pathFor(invocationId, receipt.revision);
+        const temporary = `${destination}.${randomUUID()}.tmp`;
+        try {
+            const file = await open(temporary, 'wx', 0o600);
+            try {
+                await file.writeFile(`${JSON.stringify({ receipt, mac: this.mac(receipt) })}\n`);
+                await file.sync();
+            }
+            finally {
+                await file.close();
+            }
+            await this.options.onPublish?.('before-link', receipt);
+            try {
+                await link(temporary, destination);
+            }
+            catch (error) {
+                if (error.code === 'EEXIST')
+                    return false;
+                throw error;
+            }
+            await this.options.onPublish?.('after-link', receipt);
+            const dir = await open(this.directory, 'r');
+            try {
+                await dir.sync();
+            }
+            finally {
+                await dir.close();
+            }
+            return true;
+        }
+        finally {
+            await rm(temporary, { force: true });
+        }
+    }
+}
+async function sleep(ms, signal) {
+    await new Promise((resolve, reject) => {
+        const timer = setTimeout(resolve, ms);
+        signal?.addEventListener('abort', () => { clearTimeout(timer); reject(signal.reason ?? new Error('Aborted')); }, { once: true });
+    });
+}
+//# sourceMappingURL=receipts.js.map

package/dist/src/decision/types.js

@@ -0,0 +1,3 @@
+export const DECISION_API_VERSION = 'decision.aiwg.io/v1alpha1';
+export const DECISION_API_VERSION_STRUCTURED = 'decision.aiwg.io/v1alpha2';
+//# sourceMappingURL=types.js.map

package/dist/src/decision/validate.js

@@ -0,0 +1,303 @@
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import Ajv2020 from 'ajv/dist/2020.js';
+import { canonicalJson } from '../security/artifact-trust.js';
+import { admitEntry, EntryAdmissionError } from './entry.js';
+import { DECISION_API_VERSION, DECISION_API_VERSION_STRUCTURED } from './types.js';
+const schemaFiles = {
+    DecisionBinding: 'DecisionBinding.schema.json',
+    DecisionDefinition: 'DecisionDefinition.schema.json',
+    DecisionResult: 'DecisionResult.schema.json',
+    DecisionRuleset: 'DecisionRuleset.schema.json',
+    RulesetResult: 'RulesetResult.schema.json',
+};
+const structuredSchemaFiles = {
+    DecisionDefinition: 'DecisionDefinition.v1alpha2.schema.json',
+    DecisionRuleset: 'DecisionRuleset.v1alpha2.schema.json',
+    DecisionBinding: 'DecisionBinding.v1alpha2.schema.json',
+    DecisionResult: 'DecisionResult.v1alpha2.schema.json',
+    RulesetResult: 'RulesetResult.v1alpha2.schema.json',
+};
+export class DecisionValidationError extends Error {
+    errors;
+    constructor(message, errors = []) {
+        super(message);
+        this.errors = errors;
+        this.name = 'DecisionValidationError';
+    }
+}
+let validators = null;
+function schemaRoot() {
+    const here = dirname(fileURLToPath(import.meta.url));
+    const candidates = [resolve(here, '../../schemas/decision'), resolve(here, '../../../schemas/decision')];
+    const found = candidates.find(candidate => existsSync(resolve(candidate, schemaFiles.DecisionDefinition)));
+    if (!found)
+        throw new DecisionValidationError('Decision schema directory is unavailable');
+    return found;
+}
+function getValidators() {
+    if (validators)
+        return validators;
+    const ajv = new Ajv2020({ strict: false, allErrors: true, validateFormats: false });
+    validators = new Map();
+    for (const [kind, filename] of Object.entries(schemaFiles)) {
+        const schema = JSON.parse(readFileSync(resolve(schemaRoot(), filename), 'utf8'));
+        validators.set(`decision.aiwg.io/v1alpha1:${kind}`, ajv.compile(schema));
+    }
+    for (const [kind, filename] of Object.entries(structuredSchemaFiles)) {
+        const schema = JSON.parse(readFileSync(resolve(schemaRoot(), filename), 'utf8'));
+        validators.set(`decision.aiwg.io/v1alpha2:${kind}`, ajv.compile(schema));
+    }
+    return validators;
+}
+export function artifactDigest(value) {
+    const started = performance.now();
+    admitEntry(value);
+    const canonical = canonicalJson(value);
+    if (performance.now() - started > 1000) {
+        throw new EntryAdmissionError('time-budget', { bytes: Buffer.byteLength(canonical), entries: 0 });
+    }
+    return `sha256:${createHash('sha256').update(canonical).digest('hex')}`;
+}
+export function artifactPin(value) {
+    return { id: value.metadata.id, version: value.metadata.version, digest: artifactDigest(value) };
+}
+export function assertArtifactPin(value, pin, label) {
+    if (value.metadata.id !== pin.id || value.metadata.version !== pin.version) {
+        throw new DecisionValidationError(`${label} identity/version does not match its pin`);
+    }
+    if (artifactDigest(value) !== pin.digest)
+        throw new DecisionValidationError(`${label} digest does not match its pin`);
+}
+export function validateDecisionDocument(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new DecisionValidationError('Decision document must be an object');
+    }
+    try {
+        admitEntry(value);
+    }
+    catch (error) {
+        if (error instanceof EntryAdmissionError)
+            throw new DecisionValidationError(error.message);
+        throw error;
+    }
+    const kind = value.kind;
+    const version = value.apiVersion;
+    const key = `${version}:${kind}`;
+    if (!kind || !getValidators().has(key))
+        throw new DecisionValidationError(`Unsupported decision kind/version '${key}'`);
+    const validate = getValidators().get(key);
+    if (!validate(value)) {
+        throw new DecisionValidationError(`${kind} schema validation failed: ${ajvMessage(validate.errors)}`, validate.errors ?? []);
+    }
+}
+export const DECISION_CHANGED_SEMANTICS = [
+    'structured-entry', 'batch-receipt', 'acceptance-uncertainty', 'calibration-pin', 'trust-projection',
+];
+/** Writer gate shared by D02 and future D07-D10 emitters. */
+export function assertDecisionWriterVersion(value, semantic) {
+    validateDecisionDocument(value);
+    if (value.apiVersion !== DECISION_API_VERSION_STRUCTURED) {
+        throw new DecisionValidationError(`${semantic} requires ${DECISION_API_VERSION_STRUCTURED}`);
+    }
+}
+/** A rollback reader may inspect v1alpha2, but cannot execute or rewrite it. */
+export function readDecisionDocumentForRollback(value, mode) {
+    validateDecisionDocument(value);
+    if (mode === 'execute' && value.apiVersion !== DECISION_API_VERSION) {
+        throw new DecisionValidationError('Rollback executor cannot execute v1alpha2 artifacts');
+    }
+    const document = structuredClone(value);
+    if (mode === 'read-only')
+        deepFreeze(document);
+    return { document, writable: mode === 'execute' };
+}
+function deepFreeze(value) {
+    if (!value || typeof value !== 'object' || Object.isFrozen(value))
+        return;
+    for (const child of Object.values(value))
+        deepFreeze(child);
+    Object.freeze(value);
+}
+export function validateAgainstSchema(schema, value, label) {
+    assertLocalSchema(schema, label);
+    const ajv = new Ajv2020({ strict: false, allErrors: true, validateFormats: false });
+    let validate;
+    try {
+        validate = ajv.compile(schema);
+    }
+    catch (error) {
+        throw new DecisionValidationError(`${label} is not a supported local draft 2020-12 schema: ${errorMessage(error)}`);
+    }
+    if (!validate(value))
+        throw new DecisionValidationError(`${label} rejected value: ${ajvMessage(validate.errors)}`, validate.errors ?? []);
+}
+export function validateDefinition(definition) {
+    validateDecisionDocument(definition);
+    assertLocalSchema(definition.spec.inputSchema, `${definition.metadata.id}.inputSchema`);
+    if (definition.spec.answer.kind === 'choice') {
+        assertUnique(definition.spec.answer.options.map(option => option.id), 'choice option IDs');
+    }
+    if (definition.spec.answer.kind === 'ordinal-score') {
+        const keys = definition.spec.answer.levels.map(level => canonicalJson(level));
+        assertUnique(keys, 'ordinal levels');
+    }
+}
+export function validateRuleset(ruleset) {
+    validateDecisionDocument(ruleset);
+    assertLocalSchema(ruleset.spec.inputSchema, `${ruleset.metadata.id}.inputSchema`);
+    assertLocalSchema(ruleset.spec.outputSchema, `${ruleset.metadata.id}.outputSchema`);
+    const aliases = ruleset.spec.evaluations.map(item => item.alias);
+    assertUnique(aliases, 'evaluation aliases');
+    assertUnique(ruleset.spec.rules.map(rule => rule.id), 'rule IDs');
+    for (const rule of ruleset.spec.rules)
+        assertPredicateAliases(rule.when, new Set(aliases));
+    if (ruleset.spec.composition === 'collect') {
+        const output = ruleset.spec.outputSchema;
+        if (output.type !== 'array' || !output.items || Array.isArray(output.items) || output.prefixItems !== undefined) {
+            throw new DecisionValidationError('collect outputSchema must be an array schema with one object-valued items schema');
+        }
+        const itemSchema = output.items;
+        if (itemSchema.type !== 'object')
+            throw new DecisionValidationError('collect outputSchema.items must describe objects');
+        for (const rule of ruleset.spec.rules)
+            validateAgainstSchema(itemSchema, rule.outcome, `rule ${rule.id} outcome`);
+    }
+    else {
+        for (const rule of ruleset.spec.rules)
+            validateAgainstSchema(ruleset.spec.outputSchema, rule.outcome, `rule ${rule.id} outcome`);
+    }
+    validateAgainstSchema(ruleset.spec.outputSchema, ruleset.spec.defaultOutcome, 'defaultOutcome');
+    validateAgainstSchema(ruleset.spec.outputSchema, ruleset.spec.failureOutcome, 'failureOutcome');
+}
+export function validateBinding(binding, ruleset) {
+    validateDecisionDocument(binding);
+    assertArtifactPin(ruleset, binding.spec.ruleset, 'ruleset');
+    const declared = [...ruleset.spec.evaluations.map(item => item.alias)].sort();
+    const bound = Object.keys(binding.spec.evaluations).sort();
+    if (canonicalJson(declared) !== canonicalJson(bound)) {
+        throw new DecisionValidationError('binding must map every ruleset evaluation alias exactly once');
+    }
+    for (const [alias, evaluation] of Object.entries(binding.spec.evaluations)) {
+        for (const target of evaluation.targets) {
+            if (target.retry.maxDelayMs < target.retry.initialDelayMs) {
+                throw new DecisionValidationError(`${alias} retry maxDelayMs must be >= initialDelayMs`);
+            }
+        }
+    }
+}
+export function resolveJsonPointer(root, pointer) {
+    if (pointer === '')
+        return { found: true, value: root };
+    if (!pointer.startsWith('/'))
+        return { found: false };
+    let current = root;
+    for (const encoded of pointer.slice(1).split('/')) {
+        const token = encoded.replace(/~1/g, '/').replace(/~0/g, '~');
+        if (Array.isArray(current)) {
+            if (!/^(0|[1-9]\d*)$/.test(token))
+                return { found: false };
+            const index = Number(token);
+            if (index >= current.length)
+                return { found: false };
+            current = current[index];
+        }
+        else if (current && typeof current === 'object' && Object.prototype.hasOwnProperty.call(current, token)) {
+            current = current[token];
+        }
+        else {
+            return { found: false };
+        }
+    }
+    return { found: true, value: current };
+}
+export function validateDecisionValue(definition, value) {
+    const answer = definition.spec.answer;
+    if (answer.kind === 'choice') {
+        if (typeof value !== 'string' || !answer.options.some(option => option.id === value)) {
+            throw new DecisionValidationError(`choice value must be one of: ${answer.options.map(option => option.id).join(', ')}`);
+        }
+        return;
+    }
+    if (typeof value !== 'number' || !Number.isFinite(value))
+        throw new DecisionValidationError(`${answer.kind} value must be finite`);
+    if (answer.kind === 'truth-probability' && (value < 0 || value > 1)) {
+        throw new DecisionValidationError('truth-probability must be within [0,1]');
+    }
+    if (answer.kind === 'ordinal-score' && (value < 0 || value > answer.levels.length - 1)) {
+        throw new DecisionValidationError(`ordinal-score must be within [0,${answer.levels.length - 1}]`);
+    }
+}
+export function validateDistribution(definition, distribution) {
+    const expected = definition.spec.answer.kind === 'choice'
+        ? definition.spec.answer.options.map(option => option.id)
+        : definition.spec.answer.kind === 'ordinal-score'
+            ? definition.spec.answer.levels.map((_, index) => String(index))
+            : ['false', 'true'];
+    if (canonicalJson(Object.keys(distribution).sort()) !== canonicalJson([...expected].sort())) {
+        throw new DecisionValidationError('distribution support must exactly match the declared answer domain');
+    }
+    const values = Object.values(distribution);
+    if (values.some(value => !Number.isFinite(value) || value < 0 || value > 1)) {
+        throw new DecisionValidationError('distribution values must be finite probabilities');
+    }
+    if (Math.abs(values.reduce((sum, value) => sum + value, 0) - 1) > 1e-6) {
+        throw new DecisionValidationError('distribution probabilities must sum to one');
+    }
+}
+function assertLocalSchema(schema, label) {
+    const visit = (value, stack, depth) => {
+        if (depth > 64)
+            throw new DecisionValidationError(`${label} exceeds maximum schema depth`);
+        if (!value || typeof value !== 'object')
+            return;
+        if (stack.has(value))
+            throw new DecisionValidationError(`${label} contains a cycle`);
+        stack.add(value);
+        if (!Array.isArray(value)) {
+            const ref = value.$ref;
+            if (typeof ref === 'string' && !ref.startsWith('#/')) {
+                throw new DecisionValidationError(`${label} contains a non-local $ref`);
+            }
+        }
+        for (const child of Array.isArray(value) ? value : Object.values(value))
+            visit(child, stack, depth + 1);
+        stack.delete(value);
+    };
+    visit(schema, new Set(), 0);
+    try {
+        new Ajv2020({ strictSchema: true, strictTypes: false, strictTuples: false,
+            strictRequired: false, validateFormats: false }).compile(schema);
+    }
+    catch (error) {
+        throw new DecisionValidationError(`${label} uses an unsupported schema construct: ${errorMessage(error)}`);
+    }
+}
+function assertPredicateAliases(predicate, aliases) {
+    if ('all' in predicate)
+        return predicate.all.forEach(item => assertPredicateAliases(item, aliases));
+    if ('any' in predicate)
+        return predicate.any.forEach(item => assertPredicateAliases(item, aliases));
+    if ('not' in predicate)
+        return assertPredicateAliases(predicate.not, aliases);
+    if (predicate.left.source === 'decision' && (!predicate.left.alias || !aliases.has(predicate.left.alias))) {
+        throw new DecisionValidationError(`predicate references undeclared decision alias '${predicate.left.alias ?? ''}'`);
+    }
+}
+function assertUnique(values, label) {
+    if (new Set(values).size !== values.length)
+        throw new DecisionValidationError(`${label} must be unique`);
+}
+function ajvMessage(errors) {
+    return (errors ?? []).map(error => `${error.instancePath || '/'} ${error.message ?? 'invalid'}`).join('; ');
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+export function asJsonValue(value) {
+    canonicalJson(value);
+    return value;
+}
+//# sourceMappingURL=validate.js.map

package/dist/src/extensions/commands/definitions.js

@@ -1101,6 +1101,24 @@ export const writerProfileCommand = {
         allowedTools: ['Read', 'Write', 'Bash'],
     },
 };
+export const botHandoffCommand = {
+    id: 'bot-handoff', type: 'command', name: 'Bot Handoff',
+    description: 'Generate operator-reviewed routine, teammate, connector and memory drafts; no native installation',
+    version: '1.0.0', capabilities: ['cli', 'providers', 'handoff'],
+    keywords: ['provider', 'handoff', 'routines', 'teammates', 'connectors', 'memory'],
+    category: 'utility', platforms: { generic: 'full' },
+    deployment: { pathTemplate: '.{platform}/commands/{id}.md', core: true },
+    metadata: { type: 'command', template: 'utility', argumentHint: '--input <proposal.json> [--provider <id>] [--dry-run]', allowedTools: ['Read'] },
+};
+export const buildVerifyCommand = {
+    id: 'build-verify', type: 'command', name: 'Build Verification',
+    description: 'Verify AIWG deployment and supported native discovery before any provider runs a build or CI task',
+    version: '1.0.0', capabilities: ['cli', 'providers', 'verification'],
+    keywords: ['provider', 'inspect', 'ci', 'verification'],
+    category: 'utility', platforms: { generic: 'full' },
+    deployment: { pathTemplate: '.{platform}/commands/{id}.md', core: true },
+    metadata: { type: 'command', template: 'utility', argumentHint: '[--provider <id>]', allowedTools: ['Read', 'Bash'] },
+};
 export const outputModeCommand = {
     id: 'output-mode',
     type: 'command',
@@ -3824,6 +3842,8 @@ export const commandDefinitions = [
     sessionsCommand,
     outputModeCommand,
     writerProfileCommand,
+    botHandoffCommand,
+    buildVerifyCommand,
     writingCommand,
     schemaCommand,
     datasetCommand,