@cleocode/cleo 2026.3.37 → 2026.3.39

package/dist/dispatch/middleware/rate-limiter.js

@@ -1,101 +0,0 @@
-export const DEFAULT_RATE_LIMITING = {
-    enabled: true,
-    query: { maxRequests: 100, windowMs: 60_000 },
-    mutate: { maxRequests: 30, windowMs: 60_000 },
-    spawn: { maxRequests: 10, windowMs: 60_000 },
-};
-export class RateLimiter {
-    buckets = new Map();
-    config;
-    constructor(config) {
-        this.config = {
-            ...DEFAULT_RATE_LIMITING,
-            ...config,
-            query: { ...DEFAULT_RATE_LIMITING.query, ...config?.query },
-            mutate: { ...DEFAULT_RATE_LIMITING.mutate, ...config?.mutate },
-            spawn: { ...DEFAULT_RATE_LIMITING.spawn, ...config?.spawn },
-        };
-    }
-    check(req) {
-        if (!this.config.enabled) {
-            return {
-                allowed: true,
-                remaining: Infinity,
-                limit: Infinity,
-                resetMs: 0,
-                category: 'disabled',
-            };
-        }
-        const category = this.resolveCategory(req.gateway, req.domain, req.operation);
-        const limitConfig = this.getLimitConfig(category);
-        const now = Date.now();
-        const windowStart = now - limitConfig.windowMs;
-        let bucket = this.buckets.get(category);
-        if (!bucket) {
-            bucket = { timestamps: [] };
-            this.buckets.set(category, bucket);
-        }
-        // Clean up old timestamps
-        bucket.timestamps = bucket.timestamps.filter((t) => t > windowStart);
-        const allowed = bucket.timestamps.length < limitConfig.maxRequests;
-        if (allowed) {
-            bucket.timestamps.push(now);
-        }
-        const oldest = bucket.timestamps[0] || now;
-        const resetMs = Math.max(0, oldest + limitConfig.windowMs - now);
-        return {
-            allowed,
-            remaining: Math.max(0, limitConfig.maxRequests - bucket.timestamps.length),
-            limit: limitConfig.maxRequests,
-            resetMs,
-            category,
-        };
-    }
-    resolveCategory(gateway, domain, operation) {
-        if (domain === 'orchestrate' && operation === 'spawn') {
-            return 'spawn';
-        }
-        return gateway === 'query' ? 'query' : 'mutate';
-    }
-    getLimitConfig(category) {
-        return this.config[category];
-    }
-}
-/**
- * Creates a rate limiting middleware.
- */
-export function createRateLimiter(config) {
-    const limiter = new RateLimiter(config);
-    return async (req, next) => {
-        const check = limiter.check(req);
-        if (!check.allowed) {
-            return {
-                _meta: {
-                    gateway: req.gateway,
-                    domain: req.domain,
-                    operation: req.operation,
-                    timestamp: new Date().toISOString(),
-                    duration_ms: 0,
-                    source: req.source,
-                    requestId: req.requestId,
-                    rateLimit: check,
-                },
-                success: false,
-                error: {
-                    code: 'E_RATE_LIMIT_EXCEEDED',
-                    exitCode: 429, // Too Many Requests
-                    message: `Rate limit exceeded for category: ${check.category}. Please wait ${Math.ceil(check.resetMs / 1000)} seconds.`,
-                },
-            };
-        }
-        const response = await next();
-        response._meta.rateLimit = {
-            limit: check.limit,
-            remaining: check.remaining,
-            resetMs: check.resetMs,
-            category: check.category,
-        };
-        return response;
-    };
-}
-//# sourceMappingURL=rate-limiter.js.map

package/dist/dispatch/middleware/rate-limiter.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../../src/dispatch/middleware/rate-limiter.ts"],"names":[],"mappings":"AAuBA,MAAM,CAAC,MAAM,qBAAqB,GAAuB;IACvD,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC7C,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC7C,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;CAC7C,CAAC;AASF,MAAM,OAAO,WAAW;IACd,OAAO,GAAqC,IAAI,GAAG,EAAE,CAAC;IACtD,MAAM,CAAqB;IAEnC,YAAY,MAAoC;QAC9C,IAAI,CAAC,MAAM,GAAG;YACZ,GAAG,qBAAqB;YACxB,GAAG,MAAM;YACT,KAAK,EAAE,EAAE,GAAG,qBAAqB,CAAC,KAAK,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE;YAC3D,MAAM,EAAE,EAAE,GAAG,qBAAqB,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE;YAC9D,KAAK,EAAE,EAAE,GAAG,qBAAqB,CAAC,KAAK,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE;SAC5D,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAoB;QACxB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,QAAQ;gBACnB,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,CAAC;gBACV,QAAQ,EAAE,UAAU;aACrB,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9E,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAElD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC;QAE/C,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;QAED,0BAA0B;QAC1B,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC;QAErE,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC;QACnE,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC;QAEjE,OAAO;YACL,OAAO;YACP,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;YAC1E,KAAK,EAAE,WAAW,CAAC,WAAW;YAC9B,OAAO;YACP,QAAQ;SACT,CAAC;IACJ,CAAC;IAEO,eAAe,CACrB,OAAe,EACf,MAAc,EACd,SAAiB;QAEjB,IAAI,MAAM,KAAK,aAAa,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YACtD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClD,CAAC;IAEO,cAAc,CAAC,QAAsC;QAC3D,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAoC;IACpE,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IAExC,OAAO,KAAK,EAAE,GAAoB,EAAE,IAAkB,EAA6B,EAAE;QACnF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEjC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO;gBACL,KAAK,EAAE;oBACL,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,WAAW,EAAE,CAAC;oBACd,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,SAAS,EAAE,KAAK;iBACjB;gBACD,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,uBAAuB;oBAC7B,QAAQ,EAAE,GAAG,EAAE,oBAAoB;oBACnC,OAAO,EAAE,qCAAqC,KAAK,CAAC,QAAQ,iBAAiB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,WAAW;iBACxH;aACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;QAC9B,QAAQ,CAAC,KAAK,CAAC,SAAS,GAAG;YACzB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;QAEF,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC"}

package/dist/dispatch/middleware/sanitizer.d.ts

@@ -1,10 +0,0 @@
-import type { Middleware } from '../types.js';
-/**
- * Creates a middleware that sanitizes incoming request parameters.
- * Uses the canonical sanitization logic from security.ts to handle
- * Task IDs, paths, string lengths, and enum validation.
- *
- * @param getProjectRoot - Optional function to resolve the current project root for path sanitization
- */
-export declare function createSanitizer(getProjectRoot?: () => string): Middleware;
-//# sourceMappingURL=sanitizer.d.ts.map

package/dist/dispatch/middleware/sanitizer.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sanitizer.d.ts","sourceRoot":"","sources":["../../../src/dispatch/middleware/sanitizer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAmD,UAAU,EAAE,MAAM,aAAa,CAAC;AAE/F;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,cAAc,CAAC,EAAE,MAAM,MAAM,GAAG,UAAU,CAgCzE"}

package/dist/dispatch/middleware/sanitizer.js

@@ -1,42 +0,0 @@
-import { sanitizeParams as legacySanitizeParams } from '../lib/security.js';
-/**
- * Creates a middleware that sanitizes incoming request parameters.
- * Uses the canonical sanitization logic from security.ts to handle
- * Task IDs, paths, string lengths, and enum validation.
- *
- * @param getProjectRoot - Optional function to resolve the current project root for path sanitization
- */
-export function createSanitizer(getProjectRoot) {
-    return async (req, next) => {
-        if (req.params) {
-            try {
-                const root = getProjectRoot ? getProjectRoot() : undefined;
-                req.params = legacySanitizeParams(req.params, root, {
-                    domain: req.domain,
-                    operation: req.operation,
-                });
-            }
-            catch (error) {
-                return {
-                    _meta: {
-                        gateway: req.gateway,
-                        domain: req.domain,
-                        operation: req.operation,
-                        timestamp: new Date().toISOString(),
-                        duration_ms: 0,
-                        source: req.source,
-                        requestId: req.requestId,
-                    },
-                    success: false,
-                    error: {
-                        code: 'E_VALIDATION_FAILED',
-                        exitCode: 6, // VALIDATION_ERROR
-                        message: error instanceof Error ? error.message : String(error),
-                    },
-                };
-            }
-        }
-        return next();
-    };
-}
-//# sourceMappingURL=sanitizer.js.map

package/dist/dispatch/middleware/sanitizer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sanitizer.js","sourceRoot":"","sources":["../../../src/dispatch/middleware/sanitizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,IAAI,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAG5E;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,cAA6B;IAC3D,OAAO,KAAK,EAAE,GAAoB,EAAE,IAAkB,EAA6B,EAAE;QACnF,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC3D,GAAG,CAAC,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE;oBAClD,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,SAAS,EAAE,GAAG,CAAC,SAAS;iBACzB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,KAAK,EAAE;wBACL,OAAO,EAAE,GAAG,CAAC,OAAO;wBACpB,MAAM,EAAE,GAAG,CAAC,MAAM;wBAClB,SAAS,EAAE,GAAG,CAAC,SAAS;wBACxB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACnC,WAAW,EAAE,CAAC;wBACd,MAAM,EAAE,GAAG,CAAC,MAAM;wBAClB,SAAS,EAAE,GAAG,CAAC,SAAS;qBACzB;oBACD,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,qBAAqB;wBAC3B,QAAQ,EAAE,CAAC,EAAE,mBAAmB;wBAChC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAChE;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/dispatch/middleware/session-resolver.d.ts

@@ -1,26 +0,0 @@
-/**
- * Session Resolver Middleware for CQRS Dispatch Layer.
- *
- * Runs FIRST in both MCP and CLI middleware pipelines.
- * Populates request.sessionId from the best available source:
- *
- *   1. request.sessionId already set (explicit)  -> use it
- *   2. getBoundSession() has context (MCP path)   -> stamp it
- *   3. process.env.CLEO_SESSION_ID (legacy/transitional) -> use it
- *   4. No session found -> leave undefined (OK for many operations)
- *
- * All downstream middleware (audit, enforcement) reads request.sessionId
- * directly instead of doing their own multi-tier fallback.
- *
- * @epic T4959
- */
-import type { Middleware } from '../types.js';
-/**
- * Creates the session resolver middleware.
- *
- * @param cliSessionLookup Optional async function that resolves the active
- *   session ID from SQLite for CLI commands. If not provided, the resolver
- *   falls through to env var / null.
- */
-export declare function createSessionResolver(cliSessionLookup?: () => Promise<string | null>): Middleware;
-//# sourceMappingURL=session-resolver.d.ts.map

package/dist/dispatch/middleware/session-resolver.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-resolver.d.ts","sourceRoot":"","sources":["../../../src/dispatch/middleware/session-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAmD,UAAU,EAAE,MAAM,aAAa,CAAC;AAE/F;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,UAAU,CA0CjG"}

package/dist/dispatch/middleware/session-resolver.js

@@ -1,65 +0,0 @@
-/**
- * Session Resolver Middleware for CQRS Dispatch Layer.
- *
- * Runs FIRST in both MCP and CLI middleware pipelines.
- * Populates request.sessionId from the best available source:
- *
- *   1. request.sessionId already set (explicit)  -> use it
- *   2. getBoundSession() has context (MCP path)   -> stamp it
- *   3. process.env.CLEO_SESSION_ID (legacy/transitional) -> use it
- *   4. No session found -> leave undefined (OK for many operations)
- *
- * All downstream middleware (audit, enforcement) reads request.sessionId
- * directly instead of doing their own multi-tier fallback.
- *
- * @epic T4959
- */
-import { getBoundSession } from '../context/session-context.js';
-/**
- * Creates the session resolver middleware.
- *
- * @param cliSessionLookup Optional async function that resolves the active
- *   session ID from SQLite for CLI commands. If not provided, the resolver
- *   falls through to env var / null.
- */
-export function createSessionResolver(cliSessionLookup) {
-    return async (req, next) => {
-        // Tier 1: Explicit — already populated by adapter
-        if (req.sessionId) {
-            return next();
-        }
-        // Tier 2: Process-scoped session context (MCP path)
-        const bound = getBoundSession();
-        if (bound) {
-            req.sessionId = bound.sessionId;
-            return next();
-        }
-        // Tier 3: CLI active session lookup (best-effort SQLite query)
-        if (cliSessionLookup && req.source === 'cli') {
-            try {
-                const activeId = await cliSessionLookup();
-                if (activeId) {
-                    req.sessionId = activeId;
-                    return next();
-                }
-            }
-            catch {
-                // Silent failure — many CLI commands don't need a session
-            }
-        }
-        // Tier 4: Legacy env var (transitional — will be removed)
-        const envGradeId = process.env.CLEO_SESSION_GRADE_ID;
-        if (envGradeId && process.env.CLEO_SESSION_GRADE === 'true') {
-            req.sessionId = envGradeId;
-            return next();
-        }
-        const envId = process.env.CLEO_SESSION_ID;
-        if (envId) {
-            req.sessionId = envId;
-            return next();
-        }
-        // Tier 5: No session — leave undefined
-        return next();
-    };
-}
-//# sourceMappingURL=session-resolver.js.map

package/dist/dispatch/middleware/session-resolver.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"session-resolver.js","sourceRoot":"","sources":["../../../src/dispatch/middleware/session-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAGhE;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,gBAA+C;IACnF,OAAO,KAAK,EAAE,GAAoB,EAAE,IAAkB,EAA6B,EAAE;QACnF,kDAAkD;QAClD,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAClB,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,oDAAoD;QACpD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;YAChC,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,+DAA+D;QAC/D,IAAI,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,EAAE,CAAC;gBAC1C,IAAI,QAAQ,EAAE,CAAC;oBACb,GAAG,CAAC,SAAS,GAAG,QAAQ,CAAC;oBACzB,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0DAA0D;YAC5D,CAAC;QACH,CAAC;QAED,0DAA0D;QAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACrD,IAAI,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,MAAM,EAAE,CAAC;YAC5D,GAAG,CAAC,SAAS,GAAG,UAAU,CAAC;YAC3B,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAC1C,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC;YACtB,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,uCAAuC;QACvC,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/dispatch/middleware/verification-gates.d.ts

@@ -1,3 +0,0 @@
-import type { Middleware } from '../types.js';
-export declare function createVerificationGates(strictMode?: boolean): Middleware;
-//# sourceMappingURL=verification-gates.d.ts.map

package/dist/dispatch/middleware/verification-gates.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"verification-gates.d.ts","sourceRoot":"","sources":["../../../src/dispatch/middleware/verification-gates.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAmD,UAAU,EAAE,MAAM,aAAa,CAAC;AAE/F,wBAAgB,uBAAuB,CAAC,UAAU,GAAE,OAAc,GAAG,UAAU,CAyC9E"}

package/dist/dispatch/middleware/verification-gates.js

@@ -1,40 +0,0 @@
-import { createVerificationGate as legacyCreateGate } from '@cleocode/core/internal';
-export function createVerificationGates(strictMode = true) {
-    const gate = legacyCreateGate(strictMode);
-    return async (req, next) => {
-        // Map DispatchRequest to legacy OperationContext
-        const context = {
-            domain: req.domain,
-            operation: req.operation,
-            gateway: req.gateway === 'query' ? 'query' : 'mutate',
-            params: req.params,
-            taskId: req.params?.taskId || req.params?.parent,
-        };
-        const result = await gate.verifyOperation(context);
-        if (!result.passed) {
-            return {
-                _meta: {
-                    gateway: req.gateway,
-                    domain: req.domain,
-                    operation: req.operation,
-                    timestamp: new Date().toISOString(),
-                    duration_ms: 0,
-                    source: req.source,
-                    requestId: req.requestId,
-                    verification: result,
-                },
-                success: false,
-                error: {
-                    code: 'E_VALIDATION_FAILED',
-                    exitCode: 80, // LIFECYCLE_GATE_FAILED
-                    message: `Verification gate failed at layer ${result.blockedAt}: ${result.summary}`,
-                    details: { verification: result },
-                },
-            };
-        }
-        const response = await next();
-        response._meta.verification = result;
-        return response;
-    };
-}
-//# sourceMappingURL=verification-gates.js.map

package/dist/dispatch/middleware/verification-gates.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"verification-gates.js","sourceRoot":"","sources":["../../../src/dispatch/middleware/verification-gates.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,IAAI,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGrF,MAAM,UAAU,uBAAuB,CAAC,aAAsB,IAAI;IAChE,MAAM,IAAI,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAE1C,OAAO,KAAK,EAAE,GAAoB,EAAE,IAAkB,EAA6B,EAAE;QACnF,iDAAiD;QACjD,MAAM,OAAO,GAAG;YACd,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAE,OAAiB,CAAC,CAAC,CAAE,QAAkB;YAC3E,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,MAAM,EAAG,GAAG,CAAC,MAAM,EAAE,MAAiB,IAAK,GAAG,CAAC,MAAM,EAAE,MAAiB;SACzE,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAEnD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO;gBACL,KAAK,EAAE;oBACL,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,WAAW,EAAE,CAAC;oBACd,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,YAAY,EAAE,MAAM;iBACrB;gBACD,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,qBAAqB;oBAC3B,QAAQ,EAAE,EAAE,EAAE,wBAAwB;oBACtC,OAAO,EAAE,qCAAqC,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,OAAO,EAAE;oBACnF,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE;iBAClC;aACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;QAC9B,QAAQ,CAAC,KAAK,CAAC,YAAY,GAAG,MAAM,CAAC;QACrC,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC"}

package/dist/dispatch/registry.d.ts

@@ -1,91 +0,0 @@
-/**
- * Unified CQRS Dispatch Layer -- Operation Registry
- *
- * Single source of truth for all operations mapped to 10 canonical domains.
- * Canonical domains only -- no legacy alias support.
- *
- * @epic T4820
- * @task T4814, T5241, T5615
- */
-import type { CanonicalDomain, Gateway, ParamDef, Tier } from './types.js';
-/** Definition of a single dispatchable operation. */
-export interface OperationDef {
-    /** The CQRS gateway ('query' or 'mutate'). */
-    gateway: Gateway;
-    /** The canonical domain this operation belongs to. */
-    domain: CanonicalDomain;
-    /** The specific operation name (e.g. 'show', 'skill.list'). */
-    operation: string;
-    /** Brief description of what the operation does. */
-    description: string;
-    /** Agent progressive-disclosure tier (0=basic, 1=memory/check, 2=full). */
-    tier: Tier;
-    /** Whether the operation is safe to retry. */
-    idempotent: boolean;
-    /** Whether this operation requires an active session. */
-    sessionRequired: boolean;
-    /** List of parameter keys that MUST be present in the request. */
-    requiredParams: string[];
-    /**
-     * Fully-described parameter list. Replaces `requiredParams` when populated.
-     * Empty array = "no declared params" (not "no params accepted").
-     * Optional during T4897 migration — defaults to [] when absent.
-     * @see T4897 for progressive migration
-     */
-    params?: ParamDef[];
-}
-/**
- * Resolution output for a dispatch request.
- */
-export interface Resolution {
-    /** The canonical domain. */
-    domain: CanonicalDomain;
-    /** The operation name. */
-    operation: string;
-    /** The definition of the matched operation. */
-    def: OperationDef;
-}
-/**
- * The single source of truth for all operations in CLEO.
- */
-export declare const OPERATIONS: OperationDef[];
-/**
- * Derive a gateway operation matrix from the registry.
- *
- * Returns `Record<string, string[]>` containing:
- * - All canonical domains with their operations
- *
- * This is the SINGLE derivation point — gateways use this instead of
- * maintaining independent operation lists.
- */
-export declare function deriveGatewayMatrix(gateway: Gateway): Record<string, string[]>;
-/**
- * Get all accepted domain names for a gateway (canonical only).
- */
-export declare function getGatewayDomains(gateway: Gateway): string[];
-/**
- * Resolves a domain + operation to its registered definition.
- */
-export declare function resolve(gateway: Gateway, domain: string, operation: string): Resolution | undefined;
-/**
- * Validates that all required parameters are present in the request.
- * Returns an array of missing parameter keys.
- */
-export declare function validateRequiredParams(def: OperationDef, params?: Record<string, unknown>): string[];
-/** Get all operations for a specific canonical domain. */
-export declare function getByDomain(domain: CanonicalDomain): OperationDef[];
-/** Get all operations for a specific gateway. */
-export declare function getByGateway(gateway: Gateway): OperationDef[];
-/** Get all operations available at or below a specific tier. */
-export declare function getByTier(tier: Tier): OperationDef[];
-/** Get a list of canonical domains that actually have operations registered. */
-export declare function getActiveDomains(): CanonicalDomain[];
-/**
- * Returns summary counts of operations for module validation.
- */
-export declare function getCounts(): {
-    query: number;
-    mutate: number;
-    total: number;
-};
-//# sourceMappingURL=registry.d.ts.map

package/dist/dispatch/registry.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/dispatch/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAE3E,qDAAqD;AACrD,MAAM,WAAW,YAAY;IAC3B,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,sDAAsD;IACtD,MAAM,EAAE,eAAe,CAAC;IACxB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,IAAI,EAAE,IAAI,CAAC;IACX,8CAA8C;IAC9C,UAAU,EAAE,OAAO,CAAC;IACpB,yDAAyD;IACzD,eAAe,EAAE,OAAO,CAAC;IACzB,kEAAkE;IAClE,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,4BAA4B;IAC5B,MAAM,EAAE,eAAe,CAAC;IACxB,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,GAAG,EAAE,YAAY,CAAC;CACnB;AAED;;GAEG;AACH,eAAO,MAAM,UAAU,EAAE,YAAY,EAilFpC,CAAC;AAMF;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAU9E;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,CAE5D;AAMD;;GAEG;AACH,wBAAgB,OAAO,CACrB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,UAAU,GAAG,SAAS,CAQxB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,YAAY,EACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,MAAM,EAAE,CAMV;AAED,0DAA0D;AAC1D,wBAAgB,WAAW,CAAC,MAAM,EAAE,eAAe,GAAG,YAAY,EAAE,CAEnE;AAED,iDAAiD;AACjD,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,EAAE,CAE7D;AAED,gEAAgE;AAChE,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,YAAY,EAAE,CAEpD;AAED,gFAAgF;AAChF,wBAAgB,gBAAgB,IAAI,eAAe,EAAE,CAGpD;AAED;;GAEG;AACH,wBAAgB,SAAS,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAM5E"}