@cleocode/cleo 2026.4.10 → 2026.4.12

package/dist/dispatch/lib/exit-codes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exit-codes.js","sourceRoot":"","sources":["../../../src/dispatch/lib/exit-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,gEAAgE;AAChE,IAAI,aAAa,GAA+B,IAAI,CAAC;AAErD;;;;;GAKG;AACH,SAAS,aAAa;IACpB,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,aAAa,GAAG,GAAG,CAAC;IACpB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,0BAA0B,CAAC,WAA+B;IACxE,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAChD,OAAO,aAAa,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AAC1C,CAAC"}

package/dist/dispatch/lib/gateway-meta.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Gateway metadata factory for domain handlers.
+ *
+ * Creates LAFS-conformant GatewayMeta objects with all required fields,
+ * replacing the inline _meta construction previously duplicated across
+ * every domain handler.
+ *
+ * Uses the canonical GatewayMeta type from src/types/lafs.ts (which
+ * extends LAFSMeta from @cleocode/lafs) to ensure LAFS v1.2.3
+ * conformance.
+ *
+ * @epic T4663
+ * @task T4700
+ */
+import type { GatewayMeta } from '@cleocode/contracts';
+/**
+ * GatewayMeta with an index signature for DomainResponse.meta
+ * compatibility.  All domain handlers receive this from
+ * createGatewayMeta().
+ *
+ * @task T4655
+ */
+export type GatewayMetaRecord = GatewayMeta & Record<string, unknown>;
+/**
+ * Create a fully typed GatewayMeta for domain responses.
+ *
+ * @param gateway - Gateway name (e.g., 'query', 'mutate')
+ * @param domain - Domain name (e.g., 'tasks', 'session')
+ * @param operation - Operation name (e.g., 'show', 'list')
+ * @param startTime - Timestamp from Date.now() at start of request
+ * @returns GatewayMeta with all LAFS and CLEO-specific fields
+ *
+ * @task T4700
+ * @epic T4663
+ */
+export declare function createGatewayMeta(gateway: string, domain: string, operation: string, startTime: number): GatewayMetaRecord;
+//# sourceMappingURL=gateway-meta.d.ts.map

package/dist/dispatch/lib/gateway-meta.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-meta.d.ts","sourceRoot":"","sources":["../../../src/dispatch/lib/gateway-meta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGvD;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEtE;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,iBAAiB,CAoBnB"}

package/dist/dispatch/lib/gateway-meta.js

@@ -0,0 +1,50 @@
+/**
+ * Gateway metadata factory for domain handlers.
+ *
+ * Creates LAFS-conformant GatewayMeta objects with all required fields,
+ * replacing the inline _meta construction previously duplicated across
+ * every domain handler.
+ *
+ * Uses the canonical GatewayMeta type from src/types/lafs.ts (which
+ * extends LAFSMeta from @cleocode/lafs) to ensure LAFS v1.2.3
+ * conformance.
+ *
+ * @epic T4663
+ * @task T4700
+ */
+import { randomUUID } from 'node:crypto';
+import { getCurrentSessionId } from '@cleocode/core/internal';
+/**
+ * Create a fully typed GatewayMeta for domain responses.
+ *
+ * @param gateway - Gateway name (e.g., 'query', 'mutate')
+ * @param domain - Domain name (e.g., 'tasks', 'session')
+ * @param operation - Operation name (e.g., 'show', 'list')
+ * @param startTime - Timestamp from Date.now() at start of request
+ * @returns GatewayMeta with all LAFS and CLEO-specific fields
+ *
+ * @task T4700
+ * @epic T4663
+ */
+export function createGatewayMeta(gateway, domain, operation, startTime) {
+    const sessionId = getCurrentSessionId();
+    return {
+        // LAFS canonical fields
+        specVersion: '1.2.3',
+        schemaVersion: '2026.2.1',
+        timestamp: new Date().toISOString(),
+        operation,
+        requestId: randomUUID(),
+        transport: 'sdk',
+        strict: true,
+        mvi: 'minimal',
+        contextVersion: 1,
+        ...(sessionId && { sessionId }),
+        // CLEO gateway extensions
+        gateway,
+        domain,
+        duration_ms: Date.now() - startTime,
+        'x-cleo-transport': 'stdio',
+    };
+}
+//# sourceMappingURL=gateway-meta.js.map

package/dist/dispatch/lib/gateway-meta.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-meta.js","sourceRoot":"","sources":["../../../src/dispatch/lib/gateway-meta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAW9D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,MAAc,EACd,SAAiB,EACjB,SAAiB;IAEjB,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,OAAO;QACL,wBAAwB;QACxB,WAAW,EAAE,OAAO;QACpB,aAAa,EAAE,UAAU;QACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS;QACT,SAAS,EAAE,UAAU,EAAE;QACvB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,IAAI;QACZ,GAAG,EAAE,SAAS;QACd,cAAc,EAAE,CAAC;QACjB,GAAG,CAAC,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;QAC/B,0BAA0B;QAC1B,OAAO;QACP,MAAM;QACN,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QACnC,kBAAkB,EAAE,OAAO;KAC5B,CAAC;AACJ,CAAC"}

package/dist/dispatch/lib/job-manager-accessor.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Singleton accessor for BackgroundJobManager.
+ *
+ * @task T4820
+ */
+import type { BackgroundJobManager } from './background-jobs.js';
+export declare function setJobManager(manager: BackgroundJobManager): void;
+export declare function getJobManager(): BackgroundJobManager | null;
+//# sourceMappingURL=job-manager-accessor.d.ts.map

package/dist/dispatch/lib/job-manager-accessor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"job-manager-accessor.d.ts","sourceRoot":"","sources":["../../../src/dispatch/lib/job-manager-accessor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAIjE,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI,CAEjE;AAED,wBAAgB,aAAa,IAAI,oBAAoB,GAAG,IAAI,CAE3D"}

package/dist/dispatch/lib/job-manager-accessor.js

@@ -0,0 +1,13 @@
+/**
+ * Singleton accessor for BackgroundJobManager.
+ *
+ * @task T4820
+ */
+let _instance = null;
+export function setJobManager(manager) {
+    _instance = manager;
+}
+export function getJobManager() {
+    return _instance;
+}
+//# sourceMappingURL=job-manager-accessor.js.map

package/dist/dispatch/lib/job-manager-accessor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"job-manager-accessor.js","sourceRoot":"","sources":["../../../src/dispatch/lib/job-manager-accessor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,IAAI,SAAS,GAAgC,IAAI,CAAC;AAElD,MAAM,UAAU,aAAa,CAAC,OAA6B;IACzD,SAAS,GAAG,OAAO,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/dispatch/lib/meta.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Dispatch-local metadata factory.
+ *
+ * Generates LAFS-conformant metadata for dispatch layer responses.
+ * Generates LAFS-conformant metadata for dispatch responses.
+ *
+ * @task T4772
+ */
+import type { DispatchResponse, Source } from '../types.js';
+/**
+ * Create metadata for a dispatch response.
+ *
+ * @param gateway   - Gateway name (e.g., 'query', 'mutate')
+ * @param domain    - Domain name (e.g., 'tasks', 'session')
+ * @param operation - Operation name (e.g., 'show', 'list')
+ * @param startTime - Timestamp from Date.now() at start of request
+ * @param source    - Where the request originated
+ * @param requestId - Optional pre-generated request ID
+ * @param sessionId - Optional session ID to include in metadata
+ * @returns Metadata conforming to DispatchResponse['meta']
+ *
+ * @task T4772
+ * @task T4959
+ */
+export declare function createDispatchMeta(gateway: string, domain: string, operation: string, startTime: number, source?: Source, requestId?: string, sessionId?: string | null): DispatchResponse['meta'];
+//# sourceMappingURL=meta.d.ts.map

package/dist/dispatch/lib/meta.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"meta.d.ts","sourceRoot":"","sources":["../../../src/dispatch/lib/meta.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE5D;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,MAAc,EACtB,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GACxB,gBAAgB,CAAC,MAAM,CAAC,CAW1B"}

package/dist/dispatch/lib/meta.js

@@ -0,0 +1,37 @@
+/**
+ * Dispatch-local metadata factory.
+ *
+ * Generates LAFS-conformant metadata for dispatch layer responses.
+ * Generates LAFS-conformant metadata for dispatch responses.
+ *
+ * @task T4772
+ */
+import { randomUUID } from 'node:crypto';
+/**
+ * Create metadata for a dispatch response.
+ *
+ * @param gateway   - Gateway name (e.g., 'query', 'mutate')
+ * @param domain    - Domain name (e.g., 'tasks', 'session')
+ * @param operation - Operation name (e.g., 'show', 'list')
+ * @param startTime - Timestamp from Date.now() at start of request
+ * @param source    - Where the request originated
+ * @param requestId - Optional pre-generated request ID
+ * @param sessionId - Optional session ID to include in metadata
+ * @returns Metadata conforming to DispatchResponse['meta']
+ *
+ * @task T4772
+ * @task T4959
+ */
+export function createDispatchMeta(gateway, domain, operation, startTime, source = 'cli', requestId, sessionId) {
+    return {
+        gateway: gateway,
+        domain,
+        operation,
+        timestamp: new Date().toISOString(),
+        duration_ms: Date.now() - startTime,
+        source,
+        requestId: requestId ?? randomUUID(),
+        ...(sessionId != null && { sessionId }),
+    };
+}
+//# sourceMappingURL=meta.js.map

package/dist/dispatch/lib/meta.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"meta.js","sourceRoot":"","sources":["../../../src/dispatch/lib/meta.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,MAAc,EACd,SAAiB,EACjB,SAAiB,EACjB,SAAiB,KAAK,EACtB,SAAkB,EAClB,SAAyB;IAEzB,OAAO;QACL,OAAO,EAAE,OAA8C;QACvD,MAAM;QACN,SAAS;QACT,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QACnC,MAAM;QACN,SAAS,EAAE,SAAS,IAAI,UAAU,EAAE;QACpC,GAAG,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC"}

package/dist/dispatch/lib/param-utils.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Param derivation utilities (Backward-Compat Re-export)
+ *
+ * Thin wrapper that re-exports from the canonical location at
+ * src/core/validation/param-utils.ts.
+ *
+ * @task T5706
+ */
+export type { CommanderArgSplit, JSONSchemaObject, JsonSchemaProperty, JsonSchemaType, } from '@cleocode/core/internal';
+export { buildCommanderArgs, buildCommanderOptionString, buildDispatchInputSchema, buildMcpInputSchema, camelToKebab, validateRequiredParamsDef, } from '@cleocode/core/internal';
+//# sourceMappingURL=param-utils.d.ts.map

package/dist/dispatch/lib/param-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"param-utils.d.ts","sourceRoot":"","sources":["../../../src/dispatch/lib/param-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,GACf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,wBAAwB,EACxB,mBAAmB,EACnB,YAAY,EACZ,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC"}

package/dist/dispatch/lib/param-utils.js

@@ -0,0 +1,10 @@
+/**
+ * Param derivation utilities (Backward-Compat Re-export)
+ *
+ * Thin wrapper that re-exports from the canonical location at
+ * src/core/validation/param-utils.ts.
+ *
+ * @task T5706
+ */
+export { buildCommanderArgs, buildCommanderOptionString, buildDispatchInputSchema, buildMcpInputSchema, camelToKebab, validateRequiredParamsDef, } from '@cleocode/core/internal';
+//# sourceMappingURL=param-utils.js.map

package/dist/dispatch/lib/param-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"param-utils.js","sourceRoot":"","sources":["../../../src/dispatch/lib/param-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,wBAAwB,EACxB,mBAAmB,EACnB,YAAY,EACZ,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC"}

package/dist/dispatch/lib/projections.d.ts

@@ -0,0 +1,56 @@
+/**
+ * MVI (Minimum Viable Information) projection configurations.
+ * Maps disclosure tiers to operation access and field filtering rules.
+ *
+ * @epic T4820
+ * @task T5096
+ */
+/**
+ * Disclosure tier level for MVI (Minimum Viable Information) filtering.
+ *
+ * @remarks
+ * Controls how much data is exposed in dispatch responses:
+ * - `minimal`: Only tasks, session, and admin domains; shallow depth
+ * - `standard`: Adds memory, check, pipeline, tools, sticky; medium depth
+ * - `orchestrator`: Full access including orchestrate and nexus; deep nesting
+ */
+export type MviTier = 'minimal' | 'standard' | 'orchestrator';
+/**
+ * Configuration for a single MVI projection tier.
+ *
+ * @remarks
+ * Defines which domains are accessible, which fields to strip, and how
+ * deep nested objects may be traversed in responses at a given tier.
+ */
+export interface ProjectionConfig {
+    /** Operations allowed at this tier */
+    allowedDomains: string[];
+    /** Fields to exclude from responses */
+    excludeFields?: string[];
+    /** Maximum depth for nested objects */
+    maxDepth?: number;
+}
+export declare const PROJECTIONS: Record<MviTier, ProjectionConfig>;
+/**
+ * Resolve tier from request params, defaulting to 'standard'.
+ *
+ * @remarks
+ * Priority: explicit `_mviTier` param wins, then epic scope auto-maps
+ * to orchestrator, otherwise standard is returned.
+ *
+ * @param params - Request params that may contain a `_mviTier` field
+ * @param sessionScope - Current session scope for auto-tier detection
+ * @returns The resolved MVI tier
+ *
+ * @example
+ * ```typescript
+ * import { resolveTier } from './projections.js';
+ *
+ * const tier = resolveTier(req.params, currentSession?.scope);
+ * ```
+ */
+export declare function resolveTier(params?: Record<string, unknown>, sessionScope?: {
+    type: string;
+    epicId?: string;
+} | null): MviTier;
+//# sourceMappingURL=projections.d.ts.map

package/dist/dispatch/lib/projections.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projections.d.ts","sourceRoot":"","sources":["../../../src/dispatch/lib/projections.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;GAQG;AACH,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,cAAc,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,uCAAuC;IACvC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,gBAAgB,CA0BzD,CAAC;AAKF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,WAAW,CACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,YAAY,CAAC,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GACtD,OAAO,CAOT"}

package/dist/dispatch/lib/projections.js

@@ -0,0 +1,65 @@
+/**
+ * MVI (Minimum Viable Information) projection configurations.
+ * Maps disclosure tiers to operation access and field filtering rules.
+ *
+ * @epic T4820
+ * @task T5096
+ */
+export const PROJECTIONS = {
+    minimal: {
+        allowedDomains: ['tasks', 'session', 'admin'],
+        excludeFields: ['notes', 'history', 'metadata._internal', 'auditLog'],
+        maxDepth: 2,
+    },
+    standard: {
+        allowedDomains: ['tasks', 'session', 'admin', 'memory', 'check', 'pipeline', 'tools', 'sticky'],
+        excludeFields: ['metadata._internal', 'auditLog'],
+        maxDepth: 4,
+    },
+    orchestrator: {
+        allowedDomains: [
+            'tasks',
+            'session',
+            'admin',
+            'memory',
+            'check',
+            'pipeline',
+            'orchestrate',
+            'tools',
+            'nexus',
+            'sticky',
+        ],
+        maxDepth: 8,
+    },
+};
+/** Valid MVI tier values for runtime checking. */
+const VALID_TIERS = new Set(['minimal', 'standard', 'orchestrator']);
+/**
+ * Resolve tier from request params, defaulting to 'standard'.
+ *
+ * @remarks
+ * Priority: explicit `_mviTier` param wins, then epic scope auto-maps
+ * to orchestrator, otherwise standard is returned.
+ *
+ * @param params - Request params that may contain a `_mviTier` field
+ * @param sessionScope - Current session scope for auto-tier detection
+ * @returns The resolved MVI tier
+ *
+ * @example
+ * ```typescript
+ * import { resolveTier } from './projections.js';
+ *
+ * const tier = resolveTier(req.params, currentSession?.scope);
+ * ```
+ */
+export function resolveTier(params, sessionScope) {
+    // Explicit param always wins
+    const mvi = params?._mviTier;
+    if (typeof mvi === 'string' && VALID_TIERS.has(mvi))
+        return mvi;
+    // Auto-map epic scope to orchestrator tier
+    if (sessionScope?.type === 'epic')
+        return 'orchestrator';
+    return 'standard';
+}
+//# sourceMappingURL=projections.js.map

package/dist/dispatch/lib/projections.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projections.js","sourceRoot":"","sources":["../../../src/dispatch/lib/projections.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA6BH,MAAM,CAAC,MAAM,WAAW,GAAsC;IAC5D,OAAO,EAAE;QACP,cAAc,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;QAC7C,aAAa,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,UAAU,CAAC;QACrE,QAAQ,EAAE,CAAC;KACZ;IACD,QAAQ,EAAE;QACR,cAAc,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC;QAC/F,aAAa,EAAE,CAAC,oBAAoB,EAAE,UAAU,CAAC;QACjD,QAAQ,EAAE,CAAC;KACZ;IACD,YAAY,EAAE;QACZ,cAAc,EAAE;YACd,OAAO;YACP,SAAS;YACT,OAAO;YACP,QAAQ;YACR,OAAO;YACP,UAAU;YACV,aAAa;YACb,OAAO;YACP,OAAO;YACP,QAAQ;SACT;QACD,QAAQ,EAAE,CAAC;KACZ;CACF,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,CAAC,SAAS,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;AAE7E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,WAAW,CACzB,MAAgC,EAChC,YAAuD;IAEvD,6BAA6B;IAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,QAAQ,CAAC;IAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,GAAc,CAAC;IAC3E,2CAA2C;IAC3C,IAAI,YAAY,EAAE,IAAI,KAAK,MAAM;QAAE,OAAO,cAAc,CAAC;IACzD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/dispatch/lib/proto-envelope.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Shared bridge stub type for LAFS SDK protocol-shape envelopes.
+ *
+ * The LAFS SDK's internal `LAFSEnvelope` uses the proto-shape `{_meta, result}`.
+ * The canonical CLEO CLI envelope uses `{meta, data}`. Several dispatch-layer
+ * modules (budget enforcement, field filtering) need to map between the two.
+ *
+ * This stub captures the SDK's expected shape so both `budget.ts` and
+ * `field-filter.ts` share a single, consistent definition rather than
+ * duplicating it inline.
+ *
+ * @task T338
+ * @epic T335
+ * @internal
+ */
+/**
+ * Minimal stub of the LAFS SDK's `LAFSEnvelope` proto-shape.
+ *
+ * Used to bridge `DispatchResponse` (canonical CLI envelope with `meta` + `data`)
+ * into the SDK's expected `{_meta, result}` shape for budget checking and
+ * field filtering. After the SDK call, results are mapped back to the canonical
+ * shape.
+ *
+ * @internal
+ */
+export interface _ProtoEnvelopeStub {
+    /** LAFS JSON Schema URL. */
+    $schema: string;
+    /**
+     * Protocol-level metadata block (SDK proto-shape).
+     *
+     * This mirrors the required fields of `LAFSMeta` so the SDK's validators
+     * accept the stub without a full `LAFSMeta` import.
+     */
+    _meta: {
+        specVersion: string;
+        schemaVersion: string;
+        timestamp: string;
+        operation: string;
+        requestId: string;
+        transport: string;
+        strict: boolean;
+        mvi: string;
+        contextVersion: number;
+        [key: string]: unknown;
+    };
+    /** Whether the operation succeeded. */
+    success: boolean;
+    /** Operation result payload (SDK proto-shape uses `result`, not `data`). */
+    result: Record<string, unknown> | Record<string, unknown>[] | null;
+    /** Optional error payload. */
+    error?: Record<string, unknown>;
+    /** Extensible: additional SDK fields pass through the index signature. */
+    [key: string]: unknown;
+}
+//# sourceMappingURL=proto-envelope.d.ts.map

package/dist/dispatch/lib/proto-envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proto-envelope.d.ts","sourceRoot":"","sources":["../../../src/dispatch/lib/proto-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;GASG;AACH,MAAM,WAAW,kBAAkB;IACjC,4BAA4B;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,KAAK,EAAE;QACL,WAAW,EAAE,MAAM,CAAC;QACpB,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,OAAO,CAAC;QAChB,GAAG,EAAE,MAAM,CAAC;QACZ,cAAc,EAAE,MAAM,CAAC;QACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,uCAAuC;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC;IACnE,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,0EAA0E;IAC1E,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB"}

package/dist/dispatch/lib/proto-envelope.js

@@ -0,0 +1,17 @@
+/**
+ * Shared bridge stub type for LAFS SDK protocol-shape envelopes.
+ *
+ * The LAFS SDK's internal `LAFSEnvelope` uses the proto-shape `{_meta, result}`.
+ * The canonical CLEO CLI envelope uses `{meta, data}`. Several dispatch-layer
+ * modules (budget enforcement, field filtering) need to map between the two.
+ *
+ * This stub captures the SDK's expected shape so both `budget.ts` and
+ * `field-filter.ts` share a single, consistent definition rather than
+ * duplicating it inline.
+ *
+ * @task T338
+ * @epic T335
+ * @internal
+ */
+export {};
+//# sourceMappingURL=proto-envelope.js.map

package/dist/dispatch/lib/proto-envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proto-envelope.js","sourceRoot":"","sources":["../../../src/dispatch/lib/proto-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}

package/dist/dispatch/lib/schema-utils.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Schema utilities for the CQRS dispatch layer.
+ *
+ * Provides getOperationSchema() — a convenience function that looks up an
+ * OperationDef from the OPERATIONS registry and returns a JSON Schema object
+ * suitable for tool introspection.
+ *
+ *  T4894
+ *  T4901
+ */
+import type { Gateway } from '../types.js';
+import type { JSONSchemaObject } from './param-utils.js';
+/**
+ * Look up an operation in the OPERATIONS registry and return a JSON Schema
+ * object suitable for use as `input_schema.properties.params` or as a
+ * stand-alone per-operation schema.
+ *
+ * @param domain    Canonical domain name (e.g. 'tasks', 'session')
+ * @param operation Operation name (e.g. 'show', 'add')
+ * @param gateway   Gateway ('query' or 'mutate')
+ * @returns JSONSchemaObject derived from ParamDef[], or permissive fallback
+ *
+ * @example
+ * // tasks.show → { type: 'object', properties: { taskId: {...} }, required: ['taskId'] }
+ * getOperationSchema('tasks', 'show', 'query');
+ *
+ * // tasks.current → { type: 'object', properties: {}, required: [] }
+ * getOperationSchema('tasks', 'current', 'query');
+ */
+export declare function getOperationSchema(domain: string, operation: string, gateway: Gateway): JSONSchemaObject;
+/**
+ * Return schemas for ALL operations of a given gateway.
+ *
+ * Useful for documentation generation and tool introspection endpoints.
+ *
+ * @returns Record keyed by "<domain>.<operation>" → JSONSchemaObject
+ */
+export declare function getAllOperationSchemas(gateway: Gateway): Record<string, JSONSchemaObject>;
+//# sourceMappingURL=schema-utils.d.ts.map

package/dist/dispatch/lib/schema-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-utils.d.ts","sourceRoot":"","sources":["../../../src/dispatch/lib/schema-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAsC,MAAM,kBAAkB,CAAC;AAyC7F;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,GACf,gBAAgB,CAUlB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAUzF"}

package/dist/dispatch/lib/schema-utils.js

@@ -0,0 +1,88 @@
+/**
+ * Schema utilities for the CQRS dispatch layer.
+ *
+ * Provides getOperationSchema() — a convenience function that looks up an
+ * OperationDef from the OPERATIONS registry and returns a JSON Schema object
+ * suitable for tool introspection.
+ *
+ *  T4894
+ *  T4901
+ */
+import { OPERATIONS } from '../registry.js';
+/**
+ * Build an input schema directly from cleo's OperationDef.
+ *
+ * Derives a JSON Schema object from the ParamDef array, filtering
+ * hidden params and applying enum constraints.
+ */
+function buildInputSchema(def) {
+    const properties = {};
+    const required = [];
+    for (const param of def.params ?? []) {
+        if (param.hidden)
+            continue;
+        const prop = {
+            type: param.type,
+            description: param.description,
+        };
+        if (param.enum)
+            prop.enum = [...param.enum];
+        properties[param.name] = prop;
+        if (param.required)
+            required.push(param.name);
+    }
+    return { type: 'object', properties, required };
+}
+/**
+ * Permissive fallback schema returned when an operation has no declared params.
+ *
+ * An empty params array means "no declared params" (not "no params accepted"),
+ * so we return an open object schema.
+ */
+const PERMISSIVE_SCHEMA = {
+    type: 'object',
+    properties: {},
+    required: [],
+};
+/**
+ * Look up an operation in the OPERATIONS registry and return a JSON Schema
+ * object suitable for use as `input_schema.properties.params` or as a
+ * stand-alone per-operation schema.
+ *
+ * @param domain    Canonical domain name (e.g. 'tasks', 'session')
+ * @param operation Operation name (e.g. 'show', 'add')
+ * @param gateway   Gateway ('query' or 'mutate')
+ * @returns JSONSchemaObject derived from ParamDef[], or permissive fallback
+ *
+ * @example
+ * // tasks.show → { type: 'object', properties: { taskId: {...} }, required: ['taskId'] }
+ * getOperationSchema('tasks', 'show', 'query');
+ *
+ * // tasks.current → { type: 'object', properties: {}, required: [] }
+ * getOperationSchema('tasks', 'current', 'query');
+ */
+export function getOperationSchema(domain, operation, gateway) {
+    const def = OPERATIONS.find((o) => o.domain === domain && o.operation === operation && o.gateway === gateway);
+    if (!def || (def.params ?? []).length === 0) {
+        return PERMISSIVE_SCHEMA;
+    }
+    return buildInputSchema(def);
+}
+/**
+ * Return schemas for ALL operations of a given gateway.
+ *
+ * Useful for documentation generation and tool introspection endpoints.
+ *
+ * @returns Record keyed by "<domain>.<operation>" → JSONSchemaObject
+ */
+export function getAllOperationSchemas(gateway) {
+    const result = {};
+    for (const def of OPERATIONS) {
+        if (def.gateway !== gateway)
+            continue;
+        const key = `${def.domain}.${def.operation}`;
+        result[key] = (def.params ?? []).length === 0 ? PERMISSIVE_SCHEMA : buildInputSchema(def);
+    }
+    return result;
+}
+//# sourceMappingURL=schema-utils.js.map

package/dist/dispatch/lib/schema-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-utils.js","sourceRoot":"","sources":["../../../src/dispatch/lib/schema-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAqB,MAAM,gBAAgB,CAAC;AAI/D;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAiB;IACzC,MAAM,UAAU,GAAuC,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM;YAAE,SAAS;QAE3B,MAAM,IAAI,GAAuB;YAC/B,IAAI,EAAE,KAAK,CAAC,IAAsB;YAClC,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC;QAEF,IAAI,KAAK,CAAC,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAE5C,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAC9B,IAAI,KAAK,CAAC,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,iBAAiB,GAAqB;IAC1C,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE;IACd,QAAQ,EAAE,EAAE;CACb,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,SAAiB,EACjB,OAAgB;IAEhB,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CACzB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CACjF,CAAC;IAEF,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,MAAM,MAAM,GAAqC,EAAE,CAAC;IAEpD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO;YAAE,SAAS;QACtC,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC5F,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/dispatch/lib/security.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Security Hardening and Input Sanitization (Backward-Compat Re-export)
+ *
+ * Thin wrapper that re-exports from the canonical location at
+ * src/core/security/input-sanitization.ts.
+ *
+ * @task T5706
+ */
+export type { RateLimitConfig, RateLimitResult } from '@cleocode/core/internal';
+export { ALL_VALID_STATUSES, DEFAULT_RATE_LIMITS, ensureArray, RateLimiter, SecurityError, sanitizeContent, sanitizeParams, sanitizePath, sanitizeTaskId, VALID_DOMAINS, VALID_GATEWAYS, VALID_LIFECYCLE_STAGE_STATUSES, VALID_MANIFEST_STATUSES, VALID_PRIORITIES, validateEnum, } from '@cleocode/core/internal';
+//# sourceMappingURL=security.d.ts.map

package/dist/dispatch/lib/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/dispatch/lib/security.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAChF,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,YAAY,EACZ,cAAc,EACd,aAAa,EACb,cAAc,EACd,8BAA8B,EAC9B,uBAAuB,EACvB,gBAAgB,EAChB,YAAY,GACb,MAAM,yBAAyB,CAAC"}

package/dist/dispatch/lib/security.js

@@ -0,0 +1,10 @@
+/**
+ * Security Hardening and Input Sanitization (Backward-Compat Re-export)
+ *
+ * Thin wrapper that re-exports from the canonical location at
+ * src/core/security/input-sanitization.ts.
+ *
+ * @task T5706
+ */
+export { ALL_VALID_STATUSES, DEFAULT_RATE_LIMITS, ensureArray, RateLimiter, SecurityError, sanitizeContent, sanitizeParams, sanitizePath, sanitizeTaskId, VALID_DOMAINS, VALID_GATEWAYS, VALID_LIFECYCLE_STAGE_STATUSES, VALID_MANIFEST_STATUSES, VALID_PRIORITIES, validateEnum, } from '@cleocode/core/internal';
+//# sourceMappingURL=security.js.map

package/dist/dispatch/lib/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/dispatch/lib/security.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,YAAY,EACZ,cAAc,EACd,aAAa,EACb,cAAc,EACd,8BAA8B,EAC9B,uBAAuB,EACvB,gBAAgB,EAChB,YAAY,GACb,MAAM,yBAAyB,CAAC"}

package/dist/dispatch/middleware/audit.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Audit Trail Middleware for CQRS Dispatch Layer.
+ *
+ * Dual-writes every audited operation to:
+ *   1. Pino structured log (subsystem: 'audit') -> .cleo/logs/cleo.log
+ *   2. SQLite audit_log table -> .cleo/tasks.db
+ *
+ * Legacy JSON file logging (.cleo/audit-log.json + rotated audit-log-*.json)
+ * has been removed per ADR-019.
+ *
+ * @task T2920
+ * @task T2929
+ * @task T4844
+ */
+import type { Middleware } from '../types.js';
+export type { AuditEntry } from '@cleocode/core/internal';
+/**
+ * Creates an audit middleware that logs all mutate operations
+ * (and query operations during grade sessions) to Pino + SQLite.
+ */
+export declare function createAudit(): Middleware;
+export { queryAudit } from '@cleocode/core/internal';
+//# sourceMappingURL=audit.d.ts.map