@cat-factory/app 0.36.0 → 0.37.0

package/app/composables/api/github.ts

@@ -1,98 +1,115 @@
+import {
+  commentGitHubIssueContract,
+  commitGitHubFilesContract,
+  connectGitHubContract,
+  createGitHubBranchContract,
+  createGitHubRepoContract,
+  disconnectGitHubContract,
+  getGitHubConnectionContract,
+  getGitHubInstallUrlContract,
+  listGitHubAvailableReposContract,
+  listGitHubBranchesContract,
+  listGitHubInstallationsContract,
+  listGitHubIssuesContract,
+  listGitHubPullsContract,
+  listGitHubReposContract,
+  listGitHubRepoTreeContract,
+  mergeGitHubPullRequestContract,
+  openGitHubPullRequestContract,
+  resyncGitHubContract,
+  setGitHubLinkedReposContract,
+} from '@cat-factory/contracts'
 import type {
   CommitFilesInput,
   CreateBranchInput,
-  CreatedRepo,
-  CreateRepoRequest,
-  GitHubAvailableRepo,
-  GitHubBranch,
-  GitHubConnection,
-  GitHubInstallationOption,
-  GitHubIssue,
-  GitHubPullRequest,
-  GitHubRepo,
   MergePullRequestInput,
   OpenPullRequestInput,
-  RepoTreeEntry,
   ResyncRequest,
 } from '~/types/domain'
+import type { SendParams } from './client'
 import type { ApiContext } from './context'
 
+// The create-repo body is typed from the contract's INPUT shape so the
+// valibot-defaulted `private`/`description` stay optional for callers (the exported
+// `CreateRepoRequest` is the post-default OUTPUT shape).
+type CreateRepoBody = NonNullable<SendParams<typeof createGitHubRepoContract>['body']>
+
 /**
  * GitHub integration: connection management, the D1-served projection reads
  * (fast, rate-limit-free) and the repo writes (branches/commits/PRs/merges).
  */
-export function githubApi({ http, ws }: ApiContext) {
+export function githubApi({ send, ws }: ApiContext) {
   return {
     // ---- github integration ----------------------------------------------
     // Connection management, projection reads (served from D1 — fast and
     // rate-limit-free) and repo writes. A 503 from `getGitHubConnection` means
     // the integration is off (the store hides its UI on any error there).
     getGitHubInstallUrl: (workspaceId: string) =>
-      http<{ url: string }>(`${ws(workspaceId)}/github/install-url`),
+      send(getGitHubInstallUrlContract, { pathPrefix: ws(workspaceId) }),
 
     getGitHubConnection: (workspaceId: string) =>
-      http<{ connection: GitHubConnection | null }>(`${ws(workspaceId)}/github/connection`),
+      send(getGitHubConnectionContract, { pathPrefix: ws(workspaceId) }),
 
     listGitHubInstallations: (workspaceId: string) =>
-      http<{ installations: GitHubInstallationOption[] }>(
-        `${ws(workspaceId)}/github/installations`,
-      ),
+      send(listGitHubInstallationsContract, { pathPrefix: ws(workspaceId) }),
 
     connectGitHub: (workspaceId: string, installationId: number) =>
-      http<GitHubConnection>(`${ws(workspaceId)}/github/connect`, {
-        method: 'POST',
-        body: { installationId },
-      }),
+      send(connectGitHubContract, { pathPrefix: ws(workspaceId), body: { installationId } }),
 
     disconnectGitHub: (workspaceId: string) =>
-      http(`${ws(workspaceId)}/github/connection`, { method: 'DELETE' }),
+      send(disconnectGitHubContract, { pathPrefix: ws(workspaceId) }),
 
     resyncGitHub: (workspaceId: string, body: ResyncRequest = {}) =>
-      http<{ status: string }>(`${ws(workspaceId)}/github/resync`, { method: 'POST', body }),
+      send(resyncGitHubContract, { pathPrefix: ws(workspaceId), body }),
 
-    listGitHubRepos: (workspaceId: string) => http<GitHubRepo[]>(`${ws(workspaceId)}/github/repos`),
+    listGitHubRepos: (workspaceId: string) =>
+      send(listGitHubReposContract, { pathPrefix: ws(workspaceId) }),
 
     // Programmatic repo creation (privileged App tier). Only called when the
     // connection reports `canCreateRepos`; otherwise the UI opens GitHub directly.
-    createGitHubRepo: (workspaceId: string, body: CreateRepoRequest) =>
-      http<CreatedRepo>(`${ws(workspaceId)}/github/repos`, { method: 'POST', body }),
+    createGitHubRepo: (workspaceId: string, body: CreateRepoBody) =>
+      send(createGitHubRepoContract, { pathPrefix: ws(workspaceId), body }),
 
     // Repos the connected installation can access, annotated with whether this
     // workspace links each (drives the per-workspace repo picker).
     listGitHubAvailableRepos: (workspaceId: string) =>
-      http<GitHubAvailableRepo[]>(`${ws(workspaceId)}/github/available-repos`),
+      send(listGitHubAvailableReposContract, { pathPrefix: ws(workspaceId) }),
 
     // Set the exact set of repos this workspace links.
     setGitHubLinkedRepos: (workspaceId: string, repoGithubIds: number[]) =>
-      http<GitHubRepo[]>(`${ws(workspaceId)}/github/repos`, {
-        method: 'PUT',
-        body: { repoGithubIds },
-      }),
+      send(setGitHubLinkedReposContract, { pathPrefix: ws(workspaceId), body: { repoGithubIds } }),
 
     // Browse one level of a (monorepo) repo's tree to pin a service to a subdirectory.
     listGitHubRepoTree: (workspaceId: string, repoGithubId: number, path = '') =>
-      http<RepoTreeEntry[]>(`${ws(workspaceId)}/github/repos/${repoGithubId}/tree`, {
-        query: { path },
+      send(listGitHubRepoTreeContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { repoGithubId: String(repoGithubId) },
+        queryParams: { path },
       }),
 
     listGitHubBranches: (workspaceId: string, repoGithubId: number) =>
-      http<GitHubBranch[]>(`${ws(workspaceId)}/github/repos/${repoGithubId}/branches`),
+      send(listGitHubBranchesContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { repoGithubId: String(repoGithubId) },
+      }),
 
     listGitHubPullRequests: (workspaceId: string) =>
-      http<GitHubPullRequest[]>(`${ws(workspaceId)}/github/pulls`),
+      send(listGitHubPullsContract, { pathPrefix: ws(workspaceId) }),
 
     listGitHubIssues: (workspaceId: string) =>
-      http<GitHubIssue[]>(`${ws(workspaceId)}/github/issues`),
+      send(listGitHubIssuesContract, { pathPrefix: ws(workspaceId) }),
 
     createGitHubBranch: (workspaceId: string, repoGithubId: number, body: CreateBranchInput) =>
-      http<GitHubBranch>(`${ws(workspaceId)}/github/repos/${repoGithubId}/branches`, {
-        method: 'POST',
+      send(createGitHubBranchContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { repoGithubId: String(repoGithubId) },
         body,
       }),
 
     commitGitHubFiles: (workspaceId: string, repoGithubId: number, body: CommitFilesInput) =>
-      http<{ sha: string }>(`${ws(workspaceId)}/github/repos/${repoGithubId}/commits`, {
-        method: 'POST',
+      send(commitGitHubFilesContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { repoGithubId: String(repoGithubId) },
         body,
       }),
 
@@ -101,8 +118,9 @@ export function githubApi({ http, ws }: ApiContext) {
       repoGithubId: number,
       body: OpenPullRequestInput,
     ) =>
-      http<GitHubPullRequest>(`${ws(workspaceId)}/github/repos/${repoGithubId}/pulls`, {
-        method: 'POST',
+      send(openGitHubPullRequestContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { repoGithubId: String(repoGithubId) },
         body,
       }),
 
@@ -112,8 +130,9 @@ export function githubApi({ http, ws }: ApiContext) {
       number: number,
       body: MergePullRequestInput = {},
     ) =>
-      http(`${ws(workspaceId)}/github/repos/${repoGithubId}/pulls/${number}/merge`, {
-        method: 'PUT',
+      send(mergeGitHubPullRequestContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { repoGithubId: String(repoGithubId), number: String(number) },
         body,
       }),
 
@@ -123,8 +142,9 @@ export function githubApi({ http, ws }: ApiContext) {
       number: number,
       bodyText: string,
     ) =>
-      http(`${ws(workspaceId)}/github/repos/${repoGithubId}/issues/${number}/comments`, {
-        method: 'POST',
+      send(commentGitHubIssueContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { repoGithubId: String(repoGithubId), number: String(number) },
         body: { body: bodyText },
       }),
   }

package/app/composables/api/humanReview.ts

@@ -1,4 +1,4 @@
-import type { ExecutionInstance } from '~/types/domain'
+import { requestHumanReviewFixContract } from '@cat-factory/contracts'
 import type { ApiContext } from './context'
 
 /**
@@ -7,12 +7,13 @@ import type { ApiContext } from './context'
  * immediately. Returns the updated execution instance (the gate state rides on its step + the
  * execution stream).
  */
-export function humanReviewApi({ http, ws }: ApiContext) {
+export function humanReviewApi({ send, ws }: ApiContext) {
   return {
     requestHumanReviewFix: (workspaceId: string, blockId: string, instructions: string) =>
-      http<ExecutionInstance>(
-        `${ws(workspaceId)}/blocks/${encodeURIComponent(blockId)}/human-review/request-fix`,
-        { method: 'POST', body: { instructions } },
-      ),
+      send(requestHumanReviewFixContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { blockId },
+        body: { instructions },
+      }),
   }
 }

package/app/composables/api/humanTest.ts

@@ -1,4 +1,10 @@
-import type { ExecutionInstance } from '~/types/domain'
+import {
+  confirmHumanTestContract,
+  destroyHumanTestEnvContract,
+  pullMainHumanTestContract,
+  recreateHumanTestEnvContract,
+  requestHumanTestFixContract,
+} from '@cat-factory/contracts'
 import type { ApiContext } from './context'
 
 /**
@@ -6,32 +12,30 @@ import type { ApiContext } from './context'
  * step and returns the updated execution instance (the gate state rides on its current step,
  * and also arrives live via the execution stream).
  */
-export function humanTestApi({ http, ws }: ApiContext) {
-  const base = (workspaceId: string, blockId: string) =>
-    `${ws(workspaceId)}/blocks/${encodeURIComponent(blockId)}/human-test`
-
+export function humanTestApi({ send, ws }: ApiContext) {
   return {
     // Confirm the change works: tear the env down and advance the pipeline.
     confirmHumanTest: (workspaceId: string, blockId: string) =>
-      http<ExecutionInstance>(`${base(workspaceId, blockId)}/confirm`, { method: 'POST' }),
+      send(confirmHumanTestContract, { pathPrefix: ws(workspaceId), pathParams: { blockId } }),
 
     // Submit findings and request a fix (dispatches the Tester's fixer, then rebuilds the env).
     requestHumanTestFix: (workspaceId: string, blockId: string, findings: string) =>
-      http<ExecutionInstance>(`${base(workspaceId, blockId)}/request-fix`, {
-        method: 'POST',
+      send(requestHumanTestFixContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { blockId },
         body: { findings },
       }),
 
     // Pull latest main into the PR branch + redeploy (conflict → conflict-resolver).
     pullMainHumanTest: (workspaceId: string, blockId: string) =>
-      http<ExecutionInstance>(`${base(workspaceId, blockId)}/pull-main`, { method: 'POST' }),
+      send(pullMainHumanTestContract, { pathPrefix: ws(workspaceId), pathParams: { blockId } }),
 
     // Rebuild the ephemeral environment on demand.
     recreateHumanTestEnv: (workspaceId: string, blockId: string) =>
-      http<ExecutionInstance>(`${base(workspaceId, blockId)}/recreate-env`, { method: 'POST' }),
+      send(recreateHumanTestEnvContract, { pathPrefix: ws(workspaceId), pathParams: { blockId } }),
 
     // Destroy the ephemeral environment on demand (the run stays parked).
     destroyHumanTestEnv: (workspaceId: string, blockId: string) =>
-      http<ExecutionInstance>(`${base(workspaceId, blockId)}/destroy-env`, { method: 'POST' }),
+      send(destroyHumanTestEnvContract, { pathPrefix: ws(workspaceId), pathParams: { blockId } }),
   }
 }

package/app/composables/api/kaizen.ts

@@ -1,16 +1,18 @@
-import type { KaizenGrading, KaizenOverview } from '~/types/domain'
+import { getKaizenOverviewContract, getKaizenRunGradingsContract } from '@cat-factory/contracts'
 import type { ApiContext } from './context'
 
 /** Kaizen (post-run grading) read endpoints: the screen overview + a run's gradings. */
-export function kaizenApi({ http, ws }: ApiContext) {
+export function kaizenApi({ send, ws }: ApiContext) {
   return {
     // The Kaizen screen: recent grading history + the verified-combo library.
-    getKaizenOverview: (workspaceId: string) => http<KaizenOverview>(`${ws(workspaceId)}/kaizen`),
+    getKaizenOverview: (workspaceId: string) =>
+      send(getKaizenOverviewContract, { pathPrefix: ws(workspaceId) }),
 
     // The gradings recorded for one run (the run-window status surface).
     getKaizenForExecution: (workspaceId: string, executionId: string) =>
-      http<{ gradings: KaizenGrading[] }>(
-        `${ws(workspaceId)}/executions/${encodeURIComponent(executionId)}/kaizen`,
-      ),
+      send(getKaizenRunGradingsContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { executionId },
+      }),
   }
 }

package/app/composables/api/localSettings.ts

@@ -1,4 +1,5 @@
-import type { LocalSettings, UpdateLocalSettingsInput } from '~/types/localSettings'
+import { getLocalSettingsContract, updateLocalSettingsContract } from '@cat-factory/contracts'
+import type { UpdateLocalSettingsInput } from '~/types/localSettings'
 import type { ApiContext } from './context'
 
 /**
@@ -7,11 +8,11 @@ import type { ApiContext } from './context'
  * Worker / stock Node facades (the store hides the panel then). No secrets, so the read view
  * is the plain config and the write replaces it wholesale.
  */
-export function localSettingsApi({ http }: ApiContext) {
+export function localSettingsApi({ send }: ApiContext) {
   return {
-    getLocalSettings: () => http<LocalSettings>('/local-settings'),
+    getLocalSettings: () => send(getLocalSettingsContract, {}),
 
     updateLocalSettings: (body: UpdateLocalSettingsInput) =>
-      http<LocalSettings>('/local-settings', { method: 'PUT', body }),
+      send(updateLocalSettingsContract, { body }),
   }
 }

package/app/composables/api/models.ts

@@ -1,25 +1,42 @@
+import {
+  addAccountApiKeyContract,
+  addUserApiKeyContract,
+  addVendorCredentialContract,
+  addWorkspaceApiKeyContract,
+  getOpenRouterCatalogContract,
+  getServiceFragmentDefaultsContract,
+  listAccountApiKeysContract,
+  listLocalModelEndpointsContract,
+  listModelsContract,
+  listPersonalSubscriptionsContract,
+  listUserApiKeysContract,
+  listVendorCredentialsContract,
+  listWorkspaceApiKeysContract,
+  listWorkspaceModelsContract,
+  refreshOpenRouterCatalogContract,
+  removeAccountApiKeyContract,
+  removeLocalModelEndpointContract,
+  removePersonalSubscriptionContract,
+  removeUserApiKeyContract,
+  removeVendorCredentialContract,
+  removeWorkspaceApiKeyContract,
+  setServiceFragmentDefaultsContract,
+  storePersonalSubscriptionContract,
+  testLocalModelEndpointContract,
+  upsertLocalModelEndpointContract,
+  upsertOpenRouterCatalogContract,
+} from '@cat-factory/contracts'
 import type {
   AddApiKeyInput,
-  ApiKey,
-  ModelOption,
-  PersonalSubscriptionStatus,
-  ServiceFragmentDefaults,
   StorePersonalSubscriptionInput,
   SubscriptionVendor,
-  VendorCredential,
 } from '~/types/domain'
 import type {
-  LocalModelEndpoint,
-  LocalModelEndpointTestResult,
   LocalRunner,
   TestLocalModelEndpointInput,
   UpsertLocalModelEndpointInput,
 } from '~/types/localModels'
-import type {
-  OpenRouterCatalog,
-  OpenRouterRefreshResult,
-  UpsertOpenRouterCatalogInput,
-} from '~/types/openrouter'
+import type { UpsertOpenRouterCatalogInput } from '~/types/openrouter'
 import type { ApiContext } from './context'
 
 /**
@@ -27,104 +44,94 @@ import type { ApiContext } from './context'
  * API keys, vendor subscription tokens, per-user personal subscriptions + local
  * runners) + the per-workspace routing/selection defaults.
  */
-export function modelsApi({ http, ws }: ApiContext) {
+export function modelsApi({ send, ws }: ApiContext) {
   return {
     // ---- model picker catalog (effective per-deployment flavours) ---------
-    getModels: () => http<ModelOption[]>('/models'),
+    getModels: () => send(listModelsContract, {}),
     // Per-workspace catalog: selectability reflects the workspace's (+ account's +
     // caller's) configured API keys and subscription tokens (`available` flag).
-    getWorkspaceModels: (workspaceId: string) => http<ModelOption[]>(`${ws(workspaceId)}/models`),
+    getWorkspaceModels: (workspaceId: string) =>
+      send(listWorkspaceModelsContract, { pathParams: { workspaceId } }),
 
     // ---- direct-provider API keys (the DB-backed pool) --------------------
     // Onboarded via UI, stored encrypted, pooled + rotated. Scoped to a workspace,
     // its owning account, or the signed-in user. Keys are write-only (never returned).
     listWorkspaceApiKeys: (workspaceId: string) =>
-      http<{ keys: ApiKey[] }>(`${ws(workspaceId)}/api-keys`),
+      send(listWorkspaceApiKeysContract, { pathPrefix: ws(workspaceId) }),
     addWorkspaceApiKey: (workspaceId: string, body: AddApiKeyInput) =>
-      http<ApiKey>(`${ws(workspaceId)}/api-keys`, { method: 'POST', body }),
+      send(addWorkspaceApiKeyContract, { pathPrefix: ws(workspaceId), body }),
     removeWorkspaceApiKey: (workspaceId: string, id: string) =>
-      http(`${ws(workspaceId)}/api-keys/${encodeURIComponent(id)}`, { method: 'DELETE' }),
-    listMyApiKeys: () => http<{ keys: ApiKey[] }>('/me/api-keys'),
-    addMyApiKey: (body: AddApiKeyInput) => http<ApiKey>('/me/api-keys', { method: 'POST', body }),
-    removeMyApiKey: (id: string) =>
-      http(`/me/api-keys/${encodeURIComponent(id)}`, { method: 'DELETE' }),
+      send(removeWorkspaceApiKeyContract, { pathPrefix: ws(workspaceId), pathParams: { id } }),
+    listMyApiKeys: () => send(listUserApiKeysContract, {}),
+    addMyApiKey: (body: AddApiKeyInput) => send(addUserApiKeyContract, { body }),
+    removeMyApiKey: (id: string) => send(removeUserApiKeyContract, { pathParams: { id } }),
     // Account-scoped keys (shared by every workspace in the account); admin-only.
     listAccountApiKeys: (accountId: string) =>
-      http<{ keys: ApiKey[] }>(`/accounts/${encodeURIComponent(accountId)}/api-keys`),
+      send(listAccountApiKeysContract, { pathParams: { accountId } }),
     addAccountApiKey: (accountId: string, body: AddApiKeyInput) =>
-      http<ApiKey>(`/accounts/${encodeURIComponent(accountId)}/api-keys`, { method: 'POST', body }),
+      send(addAccountApiKeyContract, { pathParams: { accountId }, body }),
     removeAccountApiKey: (accountId: string, id: string) =>
-      http(`/accounts/${encodeURIComponent(accountId)}/api-keys/${encodeURIComponent(id)}`, {
-        method: 'DELETE',
-      }),
+      send(removeAccountApiKeyContract, { pathParams: { accountId, id } }),
 
     // ---- LLM vendor subscription credentials (the token pool) -------------
     listVendorCredentials: (workspaceId: string) =>
-      http<{ credentials: VendorCredential[] }>(`${ws(workspaceId)}/vendor-credentials`),
+      send(listVendorCredentialsContract, { pathPrefix: ws(workspaceId) }),
     addVendorCredential: (
       workspaceId: string,
       body: { vendor: SubscriptionVendor; label: string; token: string },
-    ) => http<VendorCredential>(`${ws(workspaceId)}/vendor-credentials`, { method: 'POST', body }),
+    ) => send(addVendorCredentialContract, { pathPrefix: ws(workspaceId), body }),
     removeVendorCredential: (workspaceId: string, id: string) =>
-      http(`${ws(workspaceId)}/vendor-credentials/${encodeURIComponent(id)}`, { method: 'DELETE' }),
+      send(removeVendorCredentialContract, { pathPrefix: ws(workspaceId), pathParams: { id } }),
 
     // ---- personal (individual-usage) subscriptions (per-user, e.g. Claude) ----
     // Stored per signed-in user, double-encrypted under their personal password.
     // Metadata only is returned (never the token). User-scoped (no workspace).
-    listPersonalSubscriptions: () =>
-      http<{ subscriptions: PersonalSubscriptionStatus[] }>('/personal-subscriptions'),
+    listPersonalSubscriptions: () => send(listPersonalSubscriptionsContract, {}),
 
     storePersonalSubscription: (body: StorePersonalSubscriptionInput) =>
-      http<PersonalSubscriptionStatus>('/personal-subscriptions', { method: 'POST', body }),
+      send(storePersonalSubscriptionContract, { body }),
 
     removePersonalSubscription: (vendor: SubscriptionVendor) =>
-      http(`/personal-subscriptions/${encodeURIComponent(vendor)}`, { method: 'DELETE' }),
+      send(removePersonalSubscriptionContract, { pathParams: { vendor } }),
 
     // ---- local model runners (per-user, e.g. Ollama / LM Studio) ----------
     // A developer's own-machine LLM endpoints, stored per signed-in user (the API
     // key is write-only, never returned). User-scoped (no workspace). The enabled
     // models then surface automatically in the per-workspace `/models` catalog.
-    listLocalModelEndpoints: () =>
-      http<{ endpoints: LocalModelEndpoint[] }>('/local-model-endpoints'),
+    listLocalModelEndpoints: () => send(listLocalModelEndpointsContract, {}),
 
     upsertLocalModelEndpoint: (provider: LocalRunner, body: UpsertLocalModelEndpointInput) =>
-      http<LocalModelEndpoint>(`/local-model-endpoints/${encodeURIComponent(provider)}`, {
-        method: 'PUT',
-        body,
-      }),
+      send(upsertLocalModelEndpointContract, { pathParams: { provider }, body }),
 
     deleteLocalModelEndpoint: (provider: LocalRunner) =>
-      http(`/local-model-endpoints/${encodeURIComponent(provider)}`, { method: 'DELETE' }),
+      send(removeLocalModelEndpointContract, { pathParams: { provider } }),
 
     // Probe a runner endpoint for reachability + the models it currently serves
     // (no persistence — drives the "Test connection" model multi-select).
     testLocalModelEndpoint: (body: TestLocalModelEndpointInput) =>
-      http<LocalModelEndpointTestResult>('/local-model-endpoints/test', {
-        method: 'POST',
-        body,
-      }),
+      send(testLocalModelEndpointContract, { body }),
 
     // ---- OpenRouter dynamic catalog (per-workspace gateway models) --------
     // Browse OpenRouter's live catalog (`refresh`, leasing the workspace's pooled
     // OpenRouter key server-side) and enable a subset; enabled models then surface
     // in the per-workspace `/models` catalog with their context + price.
     getOpenRouterCatalog: (workspaceId: string) =>
-      http<OpenRouterCatalog>(`${ws(workspaceId)}/openrouter/catalog`),
+      send(getOpenRouterCatalogContract, { pathParams: { workspaceId } }),
 
     setOpenRouterCatalog: (workspaceId: string, body: UpsertOpenRouterCatalogInput) =>
-      http<OpenRouterCatalog>(`${ws(workspaceId)}/openrouter/catalog`, { method: 'PUT', body }),
+      send(upsertOpenRouterCatalogContract, { pathParams: { workspaceId }, body }),
 
     refreshOpenRouterCatalog: (workspaceId: string) =>
-      http<OpenRouterRefreshResult>(`${ws(workspaceId)}/openrouter/refresh`, { method: 'POST' }),
+      send(refreshOpenRouterCatalogContract, { pathParams: { workspaceId } }),
 
     // The workspace's default service-fragment selection (the fragment ids new
     // services inherit). `setServiceFragmentDefaults` replaces the whole list.
     getServiceFragmentDefaults: (workspaceId: string) =>
-      http<ServiceFragmentDefaults>(`${ws(workspaceId)}/service-fragment-defaults`),
+      send(getServiceFragmentDefaultsContract, { pathPrefix: ws(workspaceId) }),
 
     setServiceFragmentDefaults: (workspaceId: string, fragmentIds: string[]) =>
-      http<ServiceFragmentDefaults>(`${ws(workspaceId)}/service-fragment-defaults`, {
-        method: 'PUT',
+      send(setServiceFragmentDefaultsContract, {
+        pathPrefix: ws(workspaceId),
         body: { fragmentIds },
       }),
   }

package/app/composables/api/notifications.ts

@@ -1,23 +1,29 @@
-import type { Notification } from '~/types/notifications'
+import {
+  actNotificationContract,
+  dismissNotificationContract,
+  listNotificationsContract,
+} from '@cat-factory/contracts'
 import type { ApiContext } from './context'
 
 /** The human-actionable notification inbox (act / dismiss). */
-export function notificationsApi({ http, ws }: ApiContext) {
+export function notificationsApi({ send, ws }: ApiContext) {
   return {
     // ---- notifications (human-actionable board items) ---------------------
     listNotifications: (workspaceId: string) =>
-      http<Notification[]>(`${ws(workspaceId)}/notifications`),
+      send(listNotificationsContract, { pathPrefix: ws(workspaceId) }),
 
     // Act on a notification (merge the PR / confirm / retry), then resolve it.
     actNotification: (workspaceId: string, id: string) =>
-      http<Notification>(`${ws(workspaceId)}/notifications/${encodeURIComponent(id)}/act`, {
-        method: 'POST',
+      send(actNotificationContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { notificationId: id },
       }),
 
     // Dismiss a notification without acting.
     dismissNotification: (workspaceId: string, id: string) =>
-      http<Notification>(`${ws(workspaceId)}/notifications/${encodeURIComponent(id)}/dismiss`, {
-        method: 'POST',
+      send(dismissNotificationContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { notificationId: id },
       }),
   }
 }

package/app/composables/api/presets.ts

@@ -1,52 +1,58 @@
-import type {
-  CreateMergePresetInput,
-  MergeThresholdPreset,
-  UpdateMergePresetInput,
-} from '~/types/merge'
-import type {
-  CreateModelPresetInput,
-  ModelPreset,
-  UpdateModelPresetInput,
-} from '~/types/model-presets'
+import {
+  createMergePresetContract,
+  createModelPresetContract,
+  deleteMergePresetContract,
+  deleteModelPresetContract,
+  listMergePresetsContract,
+  listModelPresetsContract,
+  updateMergePresetContract,
+  updateModelPresetContract,
+} from '@cat-factory/contracts'
+import type { UpdateMergePresetInput } from '~/types/merge'
+import type { CreateModelPresetInput, UpdateModelPresetInput } from '~/types/model-presets'
+import type { SendParams } from './client'
 import type { ApiContext } from './context'
 
+// The merge-preset create body is typed from the contract's INPUT shape so the
+// valibot-defaulted fields (release/grace windows, isDefault) stay optional for callers
+// (the exported `CreateMergePresetInput` is the post-default OUTPUT shape).
+type CreateMergePresetBody = NonNullable<SendParams<typeof createMergePresetContract>['body']>
+
 /** The per-workspace preset libraries: merge-threshold policy + model->agent mapping. */
-export function presetsApi({ http, ws }: ApiContext) {
+export function presetsApi({ send, ws }: ApiContext) {
   return {
     // ---- merge threshold presets (per-task auto-merge policy library) -----
     listMergePresets: (workspaceId: string) =>
-      http<MergeThresholdPreset[]>(`${ws(workspaceId)}/merge-presets`),
+      send(listMergePresetsContract, { pathPrefix: ws(workspaceId) }),
 
-    createMergePreset: (workspaceId: string, body: CreateMergePresetInput) =>
-      http<MergeThresholdPreset>(`${ws(workspaceId)}/merge-presets`, { method: 'POST', body }),
+    createMergePreset: (workspaceId: string, body: CreateMergePresetBody) =>
+      send(createMergePresetContract, { pathPrefix: ws(workspaceId), body }),
 
     updateMergePreset: (workspaceId: string, presetId: string, body: UpdateMergePresetInput) =>
-      http<MergeThresholdPreset>(
-        `${ws(workspaceId)}/merge-presets/${encodeURIComponent(presetId)}`,
-        { method: 'PATCH', body },
-      ),
+      send(updateMergePresetContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { presetId },
+        body,
+      }),
 
     deleteMergePreset: (workspaceId: string, presetId: string) =>
-      http(`${ws(workspaceId)}/merge-presets/${encodeURIComponent(presetId)}`, {
-        method: 'DELETE',
-      }),
+      send(deleteMergePresetContract, { pathPrefix: ws(workspaceId), pathParams: { presetId } }),
 
     // ---- model presets (per-task model->agent mapping library) ------------
     listModelPresets: (workspaceId: string) =>
-      http<ModelPreset[]>(`${ws(workspaceId)}/model-presets`),
+      send(listModelPresetsContract, { pathPrefix: ws(workspaceId) }),
 
     createModelPreset: (workspaceId: string, body: CreateModelPresetInput) =>
-      http<ModelPreset>(`${ws(workspaceId)}/model-presets`, { method: 'POST', body }),
+      send(createModelPresetContract, { pathPrefix: ws(workspaceId), body }),
 
     updateModelPreset: (workspaceId: string, presetId: string, body: UpdateModelPresetInput) =>
-      http<ModelPreset>(`${ws(workspaceId)}/model-presets/${encodeURIComponent(presetId)}`, {
-        method: 'PATCH',
+      send(updateModelPresetContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { presetId },
         body,
       }),
 
     deleteModelPreset: (workspaceId: string, presetId: string) =>
-      http(`${ws(workspaceId)}/model-presets/${encodeURIComponent(presetId)}`, {
-        method: 'DELETE',
-      }),
+      send(deleteModelPresetContract, { pathPrefix: ws(workspaceId), pathParams: { presetId } }),
   }
 }