@apexops/cli 0.10.0-next.5 → 0.11.0-next.1

package/dist/host-profile.js

@@ -0,0 +1,269 @@
+import { readFile, stat } from "node:fs/promises";
+import { homedir, release } from "node:os";
+import { join } from "node:path";
+import { meetsMinimumVersion } from "./version.js";
+const MAX_COPILOT_CONFIG_BYTES = 1024 * 1024;
+const RELEASE_VERSION = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/u;
+export function currentHostEnvironment() {
+    return { platform: process.platform, release: release(), env: process.env, homedir: homedir() };
+}
+export function detectHostKind(host) {
+    if (host.platform === "win32")
+        return "windows";
+    if (host.platform === "darwin")
+        return "macos";
+    if (host.platform !== "linux")
+        return "unsupported";
+    // WSL2 kernels report `-microsoft-standard[-WSL2]`; WSL1 reports `-Microsoft` without `standard`.
+    if (/microsoft-standard|wsl2/iu.test(host.release))
+        return "wsl2";
+    if (/microsoft/iu.test(host.release))
+        return "wsl1";
+    return "linux";
+}
+/** Hosts whose supported client is Copilot CLI; VS Code there is not an APEX client. */
+export function isCopilotCliHost(kind) {
+    return kind === "wsl2" || kind === "linux" || kind === "wsl1";
+}
+/** Extracts the first stable release version from tool output such as `GitHub Copilot CLI 1.0.93.`. */
+export function firstReleaseVersion(output) {
+    for (const match of output.matchAll(/(?<![\d.])(\d+\.\d+\.\d+)(?![\d-])/gu))
+        if (RELEASE_VERSION.test(match[1]))
+            return match[1];
+    return undefined;
+}
+export function copilotHome(host) {
+    const configured = host.env.COPILOT_HOME?.trim();
+    if (configured !== undefined && configured.length > 0)
+        return configured;
+    return join(host.homedir, ".copilot");
+}
+function hostCheck(kind) {
+    const sandbox = "client local sandboxing is assumed on and not checked";
+    switch (kind) {
+        case "windows":
+            return {
+                id: "host",
+                ok: true,
+                value: `windows: VS Code Copilot harness or GitHub Copilot app; Copilot CLI manages the plugin store only; ${sandbox}`,
+            };
+        case "wsl2":
+            return { id: "host", ok: true, value: `wsl2: GitHub Copilot CLI; ${sandbox}` };
+        case "linux":
+            return { id: "host", ok: true, value: `linux: GitHub Copilot CLI; ${sandbox}` };
+        case "macos":
+            return {
+                id: "host",
+                ok: true,
+                severity: "warning",
+                value: "macos: VS Code or the GitHub Copilot app, best effort and not qualified",
+                remedy: "Use Windows 11 for VS Code or the GitHub Copilot app, or Linux or WSL2 for Copilot CLI",
+            };
+        case "wsl1":
+            return {
+                id: "host",
+                ok: false,
+                value: "wsl1: unsupported; the Copilot CLI sandbox needs WSL2",
+                remedy: "Use a WSL2 distribution: run wsl --set-version DISTRIBUTION 2 in PowerShell after a backup",
+            };
+        case "unsupported":
+            return {
+                id: "host",
+                ok: false,
+                value: "unsupported platform",
+                remedy: "Use Windows 11 for VS Code or the GitHub Copilot app, or Linux or WSL2 for Copilot CLI",
+            };
+    }
+}
+async function gitCheck(kind, inputs) {
+    const found = await inputs.executableExists("git");
+    return {
+        id: "git",
+        ok: found,
+        value: found ? "found on PATH" : "not found on PATH",
+        remedy: kind === "windows"
+            ? "Install Git with winget install Git.Git, then open a new terminal"
+            : kind === "macos"
+                ? "Install Git and add it to PATH"
+                : "Install Git with sudo apt install git",
+    };
+}
+async function vscodeCheck(kind, inputs) {
+    // On WSL2 `code` is usually the Windows VS Code shim, and running it can start a VS Code Server install. Copilot CLI
+    // hosts never use VS Code, so doctor does not run it there.
+    if (isCopilotCliHost(kind))
+        return {
+            id: "vscode",
+            ok: true,
+            value: (await inputs.executableExists("code"))
+                ? "skipped: the Copilot CLI host does not use VS Code"
+                : "not needed: the Copilot CLI host does not use VS Code",
+        };
+    const minimum = inputs.minimums.vscode;
+    if (minimum === undefined)
+        return {
+            id: "vscode",
+            ok: false,
+            value: "bundled VS Code minimum unavailable",
+            remedy: "Reinstall the apex CLI package",
+        };
+    if (!(await inputs.executableExists("code")))
+        return { id: "vscode", ok: true, value: `not found; ${minimum} or newer needed only for the VS Code harness` };
+    const version = await inputs.toolVersion("code", ["--version"]);
+    return {
+        id: "vscode",
+        ok: version !== undefined && meetsMinimumVersion(version, minimum),
+        value: version ?? "version unavailable from code --version",
+        remedy: `Update VS Code to ${minimum} or newer to use the Copilot harness`,
+    };
+}
+async function copilotCliCheck(kind, inputs) {
+    const minimum = inputs.minimums.copilotCli;
+    if (minimum === undefined)
+        return {
+            id: "copilot-cli",
+            ok: false,
+            value: "bundled Copilot CLI minimum unavailable",
+            remedy: "Reinstall the apex CLI package",
+        };
+    const sessionClient = isCopilotCliHost(kind);
+    const install = kind === "windows"
+        ? `Install Copilot CLI ${minimum} or newer with winget install GitHub.Copilot`
+        : `Install Copilot CLI ${minimum} or newer with npm install -g @github/copilot, then run copilot login`;
+    const advisory = (value, remedy) => sessionClient
+        ? { id: "copilot-cli", ok: false, value, remedy }
+        : { id: "copilot-cli", ok: true, severity: "warning", value: `${value}; needed to install the plugin`, remedy };
+    if (!(await inputs.executableExists("copilot")))
+        return advisory("not found on PATH", install);
+    const version = await inputs.toolVersion("copilot", ["--no-auto-update", "--version"]);
+    if (version === undefined)
+        return advisory("version unavailable from copilot --version", install);
+    if (!meetsMinimumVersion(version, minimum))
+        return advisory(version, `Update Copilot CLI to ${minimum} or newer with copilot update`);
+    return {
+        id: "copilot-cli",
+        ok: true,
+        value: sessionClient ? version : `${version}; manages the plugin store only, run APEX in VS Code or the app`,
+    };
+}
+async function readInstalledPlugins(path) {
+    try {
+        const info = await stat(path);
+        if (!info.isFile() || info.size > MAX_COPILOT_CONFIG_BYTES)
+            return "invalid";
+        // Copilot CLI writes config.json with leading `//` comment lines.
+        const config = JSON.parse((await readFile(path, "utf8")).replace(/^\s*\/\/.*$/gmu, ""));
+        if (config === null || typeof config !== "object" || Array.isArray(config))
+            return "invalid";
+        if (config.installedPlugins === undefined)
+            return [];
+        if (!Array.isArray(config.installedPlugins))
+            return "invalid";
+        return config.installedPlugins.filter((entry) => entry !== null && typeof entry === "object");
+    }
+    catch (error) {
+        return error.code === "ENOENT" ? "missing" : "invalid";
+    }
+}
+async function copilotPluginCheck(kind, inputs) {
+    const { name, marketplace } = inputs.plugin;
+    const qualified = `${name}@${marketplace}`;
+    const home = copilotHome(inputs.host);
+    const configPath = join(home, "config.json");
+    const reinstall = kind === "windows"
+        ? `Close every VS Code window, then run copilot plugin uninstall ${qualified} and copilot plugin install ${qualified}`
+        : `Run copilot plugin uninstall ${qualified}, then copilot plugin install ${qualified}`;
+    const installed = await readInstalledPlugins(configPath);
+    if (installed === "invalid")
+        return {
+            id: "copilot-plugin",
+            ok: false,
+            value: `unreadable Copilot CLI configuration ${configPath}`,
+            remedy: "Run copilot plugin list to check the Copilot CLI configuration, then run doctor again",
+        };
+    const entries = installed === "missing" ? [] : installed.filter((entry) => entry.name === name);
+    if (entries.length === 0) {
+        // Copilot CLI installs the plugin that the workspace settings enable on the first trusted session; VS Code and
+        // the app only read the store, so on those hosts the plugin must already be there.
+        const missing = `not installed in the Copilot CLI plugin store ${home}`;
+        return isCopilotCliHost(kind)
+            ? {
+                id: "copilot-plugin",
+                ok: true,
+                severity: "warning",
+                value: missing,
+                remedy: `Run copilot plugin install ${qualified}, or start copilot in the initialized workspace and trust it`,
+            }
+            : {
+                id: "copilot-plugin",
+                ok: false,
+                value: missing,
+                remedy: `${kind === "windows" ? "Close every VS Code window, then run" : "Run"} copilot plugin marketplace add jonathan-vella/apex-plugins and copilot plugin install ${qualified}`,
+            };
+    }
+    if (entries.length > 1)
+        return {
+            id: "copilot-plugin",
+            ok: false,
+            value: `${entries.length} ${name} plugins installed in ${home}`,
+            remedy: `Uninstall the extra copies so that only ${qualified} remains (copilot plugin list shows them)`,
+        };
+    const entry = entries[0];
+    const version = typeof entry.version === "string" ? entry.version : "unknown";
+    const source = typeof entry.marketplace === "string" && entry.marketplace.length > 0 ? entry.marketplace : "direct";
+    const label = `${name}@${source} ${version}`;
+    // Workspace settings enable only the declared marketplace; a direct install (no marketplace) is a local candidate.
+    if (source !== "direct" && source !== marketplace)
+        return {
+            id: "copilot-plugin",
+            ok: false,
+            value: `${label} from another marketplace`,
+            remedy: `Uninstall ${name}@${source}, then run copilot plugin install ${qualified}`,
+        };
+    if (entry.enabled !== true)
+        return { id: "copilot-plugin", ok: false, value: `${label} disabled`, remedy: reinstall };
+    if (version !== inputs.apexVersion)
+        return {
+            id: "copilot-plugin",
+            ok: false,
+            value: `${label}; this apex CLI is ${inputs.apexVersion}`,
+            remedy: `Keep the plugin and CLI at one version: run copilot plugin update ${qualified}, or install @apexops/cli@${version}`,
+        };
+    return {
+        id: "copilot-plugin",
+        ok: true,
+        value: kind === "windows"
+            ? `${label} enabled in ${home}; VS Code must list one apex entry under @agentPlugins`
+            : `${label} enabled in ${home}`,
+    };
+}
+async function sandboxToolsCheck(inputs) {
+    const missing = [];
+    for (const executable of ["bwrap", "slirp4netns"])
+        if (!(await inputs.executableExists(executable)))
+            missing.push(executable);
+    return missing.length === 0
+        ? { id: "linux-sandbox-tools", ok: true, value: "bwrap and slirp4netns found; sandbox setting not checked" }
+        : {
+            id: "linux-sandbox-tools",
+            ok: true,
+            severity: "warning",
+            value: `missing ${missing.join(", ")}; the Copilot CLI sandbox needs them`,
+            remedy: "Install them with sudo apt install bubblewrap slirp4netns; copilot help sandbox lists the rest",
+        };
+}
+/** Read-only host checks for the supported client on this host. Each failing or advisory check carries a remedy. */
+export async function hostDoctorChecks(inputs) {
+    const kind = detectHostKind(inputs.host);
+    const checks = [
+        hostCheck(kind),
+        await gitCheck(kind, inputs),
+        await vscodeCheck(kind, inputs),
+        await copilotCliCheck(kind, inputs),
+        await copilotPluginCheck(kind, inputs),
+    ];
+    if (kind === "linux" || kind === "wsl2")
+        checks.push(await sandboxToolsCheck(inputs));
+    return checks;
+}
+//# sourceMappingURL=host-profile.js.map

package/dist/mcp-output-schemas.d.ts

@@ -0,0 +1,43 @@
+import { z } from "zod";
+/** Maximum checks listed in a doctor MCP summary; the doctorChecks tool pages the complete list. */
+export declare const MCP_DOCTOR_CHECK_LIMIT = 32;
+export declare const MCP_OUTPUT_SCHEMAS: {
+    status: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    releaseWriter: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    capabilityList: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    capabilityStatus: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    nextTask: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    taskContext: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    readTaskInput: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    recordInput: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    governanceImport: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    governanceSelect: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    projectCreate: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    projectList: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    projectUse: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    projectDelete: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    gateDecide: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    reviewDecide: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    stageArtifact: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    stageFile: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    generateIac: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    validateTask: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    completeTask: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    requirementsComplete: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    architectureComplete: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    reviewComplete: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    planComplete: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    preview: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    inventory: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    reconcile: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    diagnose: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    improvementObserve: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    improvementObservations: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    improvementProposals: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    render: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    promote: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    doctor: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    doctorChecks: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+    submitEvidence: z.ZodObject<z.core.$ZodLooseShape, z.core.$strip>;
+};
+//# sourceMappingURL=mcp-output-schemas.d.ts.map

package/dist/mcp-output-schemas.js

@@ -0,0 +1,279 @@
+import { ApprovalEvidenceV1Schema, EvidenceManifestV1Schema, ImprovementObservationV1Schema, ImprovementProposalV1Schema, InputRequestV1Schema, InputValueV1Schema, IsoDateTimeSchema, NonEmptyStringSchema, NativeValidationReceiptV1Schema, ResourceInventoryV1Schema, ReviewRequestV1Schema, RunConfigV1Schema, Sha256Schema, TaskEnvelopeV1Schema, registerContractFormats, } from "@apexops/contracts";
+import { Type } from "@sinclair/typebox";
+import { Value } from "@sinclair/typebox/value";
+import { z } from "zod";
+import { SUPPORTED_ARTIFACT_KINDS } from "./service.js";
+registerContractFormats();
+const object = (properties) => Type.Object(properties, { additionalProperties: false });
+const strings = Type.Array(Type.String());
+const count = Type.Integer({ minimum: 0 });
+const artifactKind = Type.Union(SUPPORTED_ARTIFACT_KINDS.map((kind) => Type.Literal(kind)));
+const artifactHashes = object(Object.fromEntries(SUPPORTED_ARTIFACT_KINDS.map((kind) => [kind, Type.Optional(Sha256Schema)])));
+function contract(schema, options = {}) {
+    const successBranches = schema.anyOf ?? [schema];
+    schema = Type.Union([
+        ...(options.pageable
+            ? successBranches.map((branch) => object({ ...branch.properties, nextCursor: Type.Optional(Type.String()) }))
+            : successBranches),
+        object({
+            error: object({
+                code: Type.Union([
+                    "APEX_USAGE",
+                    "APEX_NOT_FOUND",
+                    "APEX_CONFLICT",
+                    "APEX_WRITER_CONFLICT",
+                    "APEX_WORKSPACE_UNSUPPORTED",
+                    "APEX_RUNTIME_MISMATCH",
+                    "APEX_VALIDATION",
+                    "APEX_STALE",
+                    "APEX_AUTHORIZATION",
+                    "APEX_CURSOR_INVALID",
+                    "APEX_RESULT_TOO_LARGE",
+                    "APEX_REVIEW_PENDING",
+                    "APEX_INTERNAL",
+                ].map((code) => Type.Literal(code))),
+                message: Type.String(),
+                remediation: Type.String(),
+            }),
+        }),
+    ]);
+    const branches = schema.anyOf;
+    const envelope = branches === undefined
+        ? schema
+        : object(Object.fromEntries([
+            ...new Set([
+                ...branches.flatMap((branch) => Object.keys(branch.properties)),
+                ...(options.pageable ? ["nextCursor"] : []),
+            ]),
+        ].map((key) => [
+            key,
+            Type.Optional(key === "nextCursor"
+                ? Type.String()
+                : Type.Union(branches.flatMap((branch) => branch.properties[key] ?? []))),
+        ])));
+    const json = (value) => JSON.parse(JSON.stringify(value, (key, entry) => (key === "$id" ? undefined : entry)));
+    const converted = z.fromJSONSchema(json(envelope));
+    if (!(converted instanceof z.ZodObject))
+        throw new Error("MCP result contract must be an object");
+    return converted
+        .superRefine((value, context) => {
+        if (!Value.Check(schema, value))
+            context.addIssue({ code: "custom", message: "Invalid domain contract" });
+    })
+        .meta({ ...json(envelope), ...json(schema) });
+}
+const selection = object({ projectId: NonEmptyStringSchema, runId: NonEmptyStringSchema });
+const capability = object({
+    id: Type.String(),
+    state: Type.Union(["installed", "unavailable", "blocked", "invalid", "not-installed"].map((value) => Type.Literal(value))),
+    version: Type.Optional(Type.String()),
+    installedVersion: Type.Optional(Type.String()),
+    requiredWorkflows: strings,
+    reason: Type.Optional(Type.String()),
+    action: Type.String(),
+});
+const status = object({
+    run: RunConfigV1Schema,
+    head: Type.Union([Sha256Schema, Type.Null()]),
+    events: count,
+    task: Type.Union([NonEmptyStringSchema, Type.Null()]),
+    blockers: strings,
+});
+/** Maximum checks listed in a doctor MCP summary; the doctorChecks tool pages the complete list. */
+export const MCP_DOCTOR_CHECK_LIMIT = 32;
+const doctorCheck = object({
+    id: Type.String(),
+    ok: Type.Boolean(),
+    value: Type.String(),
+    remedy: Type.Optional(Type.String()),
+    severity: Type.Optional(Type.Literal("warning")),
+});
+const doctor = object({
+    healthy: Type.Boolean(),
+    nextAction: Type.String(),
+    remedies: strings,
+    counts: object({ total: count, passed: count, failed: count }),
+    checks: Type.Array(doctorCheck, { maxItems: MCP_DOCTOR_CHECK_LIMIT }),
+    omitted: object({ passed: count, failed: count }),
+    truncated: Type.Boolean(),
+});
+const review = object({
+    gate: Type.Integer({ minimum: 1, maximum: 4 }),
+    reviewHash: Sha256Schema,
+    findings: Type.Array(object({
+        id: NonEmptyStringSchema,
+        severity: Type.Union(["critical", "high", "medium", "low", "info"].map((value) => Type.Literal(value))),
+        title: NonEmptyStringSchema,
+        detail: NonEmptyStringSchema,
+        actions: Type.Array(Type.Union(["revise", "accept-risk", "acknowledge", "dismiss"].map((value) => Type.Literal(value)))),
+    })),
+});
+const reviewMetadata = object({
+    subjectKind: artifactKind,
+    subjectHash: Sha256Schema,
+    criteria: strings,
+    dispositions: Type.Array(object({
+        findingId: NonEmptyStringSchema,
+        reviewHash: Sha256Schema,
+        subjectHash: Sha256Schema,
+        disposition: Type.Union(["fixed", "accepted-risk", "acknowledged", "dismissed"].map((value) => Type.Literal(value))),
+        actor: Type.String(),
+        rationale: Type.String(),
+        evidenceRefs: Type.Array(Sha256Schema),
+        expiresAt: Type.Optional(IsoDateTimeSchema),
+        dependencyHash: Sha256Schema,
+    })),
+    evidenceRefs: Type.Array(Sha256Schema),
+});
+const stagedArtifact = object({
+    taskId: NonEmptyStringSchema,
+    kind: artifactKind,
+    path: NonEmptyStringSchema,
+    bytes: count,
+    hash: Sha256Schema,
+});
+const stagedFile = object({
+    taskId: NonEmptyStringSchema,
+    path: NonEmptyStringSchema,
+    bytes: count,
+    hash: Sha256Schema,
+    idempotent: Type.Boolean(),
+});
+const completion = object({ outputHashes: artifactHashes, summary: Type.String() });
+const evidenceProperties = {
+    kind: Type.String(),
+    bytes: count,
+    retention: Type.Union(["immutable", "project", "optional"].map((value) => Type.Literal(value))),
+    redacted: Type.Boolean(),
+    reasons: strings,
+};
+export const MCP_OUTPUT_SCHEMAS = {
+    status: contract(Type.Union([
+        status,
+        object({
+            status: Type.Literal("needs_project"),
+            workspaceReady: Type.Literal(true),
+            projects: Type.Array(Type.String(), { maxItems: 0 }),
+            nextAction: NonEmptyStringSchema,
+        }),
+        object({
+            status: Type.Literal("runtime_mismatch"),
+            reason: Type.Union(["RUNTIME_WORKSPACE_OLDER", "RUNTIME_WORKSPACE_NEWER", "RUNTIME_LOCK_INVALID"].map((value) => Type.Literal(value))),
+            runtimeVersion: NonEmptyStringSchema,
+            workspaceRuntimeVersion: Type.Union([NonEmptyStringSchema, Type.Null()]),
+            nextAction: NonEmptyStringSchema,
+        }),
+    ])),
+    releaseWriter: contract(object({
+        released: Type.Boolean(),
+        projectId: NonEmptyStringSchema,
+        runId: NonEmptyStringSchema,
+    })),
+    capabilityList: contract(object({ packs: Type.Array(capability) })),
+    capabilityStatus: contract(capability),
+    nextTask: contract(Type.Union([
+        object({ status: Type.Literal("needs_input"), request: InputRequestV1Schema }),
+        object({ status: Type.Literal("needs_review"), review }),
+        object({ status: Type.Literal("task"), task: TaskEnvelopeV1Schema }),
+    ])),
+    taskContext: contract(object({
+        task: TaskEnvelopeV1Schema,
+        inputs: Type.Array(Type.Unknown()),
+        inputReferences: Type.Array(object({ hash: Sha256Schema, bytes: count, inlined: Type.Boolean() })),
+        artifactHashes: Type.Record(Type.String(), Sha256Schema),
+        recordedInput: Type.Union([Type.Record(Type.String(), InputValueV1Schema), Type.Null()]),
+        decisions: Type.Record(Type.String(), InputValueV1Schema),
+        governanceFindings: Type.Optional(Type.Union([
+            object({ count, untypedCount: count, resourceTypeCount: count, read: NonEmptyStringSchema }),
+            Type.Array(object({
+                policyAssignmentId: NonEmptyStringSchema,
+                policyDefinitionId: NonEmptyStringSchema,
+                policyDefinitionReferenceId: Type.Optional(NonEmptyStringSchema),
+                effect: Type.Union([Type.Literal("deny"), Type.Literal("modify"), Type.Literal("deployIfNotExists")]),
+                displayName: Type.String(),
+                resourceTypes: strings,
+                requiredValue: Type.Optional(Type.Unknown()),
+            })),
+        ])),
+        outputTemplates: object(Object.fromEntries(SUPPORTED_ARTIFACT_KINDS.map((kind) => [kind, Type.Optional(Type.Unknown())]))),
+        reviewMetadata: Type.Optional(reviewMetadata),
+        reviewMetadataReference: Type.Optional(object({ selector: Type.Literal("review-metadata"), bytes: count, inlined: Type.Boolean() })),
+        reviewRequest: Type.Optional(ReviewRequestV1Schema),
+        outputRoot: NonEmptyStringSchema,
+        status: Type.Union([Type.Literal("completed"), Type.Literal("active")]),
+        blockers: strings,
+    }), { pageable: true }),
+    readTaskInput: contract(object({
+        subjectHash: Sha256Schema,
+        content: Type.String(),
+        offset: count,
+        nextOffset: Type.Optional(count),
+    }), { pageable: true }),
+    recordInput: contract(object({ recorded: Type.Literal(true), requestId: NonEmptyStringSchema })),
+    governanceImport: contract(object({ outputHash: Sha256Schema, summary: Type.String() })),
+    governanceSelect: contract(Type.Union([
+        object({ status: Type.Literal("needs_input"), request: InputRequestV1Schema }),
+        object({
+            status: Type.Literal("selected"),
+            choice: Type.Union([Type.Literal("reuse"), Type.Literal("refresh")]),
+            candidateHash: Sha256Schema,
+            observedAt: IsoDateTimeSchema,
+            refreshRequired: Type.Boolean(),
+        }),
+    ])),
+    projectCreate: contract(selection),
+    projectList: contract(object({ projects: Type.Array(object({ projectId: NonEmptyStringSchema, displayName: Type.String() })) }), { pageable: true }),
+    projectUse: contract(selection),
+    projectDelete: contract(object({ deleted: NonEmptyStringSchema, selected: Type.Optional(selection) })),
+    gateDecide: contract(ApprovalEvidenceV1Schema),
+    reviewDecide: contract(object({ status: Type.Union([Type.Literal("revision_requested"), Type.Literal("resolved")]) })),
+    stageArtifact: contract(Type.Union([stagedArtifact, object({ artifacts: Type.Array(stagedArtifact) })])),
+    stageFile: contract(stagedFile),
+    generateIac: contract(object({ files: Type.Array(stagedFile), outputHashes: artifactHashes, treeHash: Sha256Schema })),
+    validateTask: contract(Type.Union([
+        object({
+            valid: Type.Literal(true),
+            taskId: NonEmptyStringSchema,
+            staged: Type.Optional(Type.Union([stagedArtifact, Type.Array(stagedArtifact)])),
+        }),
+        object({
+            valid: Type.Boolean(),
+            taskId: NonEmptyStringSchema,
+            execution: object({
+                mode: Type.Literal("native"),
+                executedValidatorIds: strings,
+                blockedValidatorIds: strings,
+                storageSecurity: NativeValidationReceiptV1Schema.properties.storageSecurity,
+                storageDiagnostics: NativeValidationReceiptV1Schema.properties.storageDiagnostics,
+                securityBaseline: NativeValidationReceiptV1Schema.properties.securityBaseline,
+            }),
+            outputs: Type.Array(object({ kind: Type.Literal("validation-evidence"), value: EvidenceManifestV1Schema }), {
+                minItems: 1,
+                maxItems: 1,
+            }),
+        }),
+    ])),
+    completeTask: contract(completion),
+    requirementsComplete: contract(completion),
+    architectureComplete: contract(completion),
+    reviewComplete: contract(completion),
+    planComplete: contract(completion),
+    preview: contract(object({ markdown: Type.String() }), { pageable: true }),
+    inventory: contract(ResourceInventoryV1Schema, { pageable: true }),
+    reconcile: contract(ResourceInventoryV1Schema),
+    diagnose: contract(object({ status, doctor })),
+    improvementObserve: contract(object({ observation: ImprovementObservationV1Schema, deduplicated: Type.Boolean() })),
+    improvementObservations: contract(object({ observations: Type.Array(ImprovementObservationV1Schema) }), {
+        pageable: true,
+    }),
+    improvementProposals: contract(object({ proposals: Type.Array(ImprovementProposalV1Schema) }), { pageable: true }),
+    render: contract(object({ markdown: Type.String() }), { pageable: true }),
+    promote: contract(RunConfigV1Schema),
+    doctor: contract(doctor),
+    doctorChecks: contract(object({ checks: Type.Array(doctorCheck) }), { pageable: true }),
+    submitEvidence: contract(Type.Union([
+        object({ ...evidenceProperties, status: Type.Literal("accepted"), hash: Sha256Schema }),
+        object({ ...evidenceProperties, status: Type.Literal("quarantined"), quarantinePath: NonEmptyStringSchema }),
+    ])),
+};
+//# sourceMappingURL=mcp-output-schemas.js.map