@cleocode/cleo 2026.4.9 → 2026.4.11

package/dist/dispatch/middleware/rate-limiter.js

@@ -0,0 +1,127 @@
+export const DEFAULT_RATE_LIMITING = {
+    enabled: true,
+    query: { maxRequests: 100, windowMs: 60_000 },
+    mutate: { maxRequests: 30, windowMs: 60_000 },
+    spawn: { maxRequests: 10, windowMs: 60_000 },
+};
+/**
+ * Sliding-window rate limiter for the dispatch pipeline.
+ *
+ * @remarks
+ * Tracks request timestamps per category (query, mutate, spawn) using
+ * in-memory sliding window buckets. The `check` method prunes stale
+ * timestamps, evaluates the current count, and returns whether the
+ * request is allowed along with limit metadata.
+ */
+export class RateLimiter {
+    /** Per-category sliding window buckets. */
+    buckets = new Map();
+    /** Merged configuration with defaults. */
+    config;
+    constructor(config) {
+        this.config = {
+            ...DEFAULT_RATE_LIMITING,
+            ...config,
+            query: { ...DEFAULT_RATE_LIMITING.query, ...config?.query },
+            mutate: { ...DEFAULT_RATE_LIMITING.mutate, ...config?.mutate },
+            spawn: { ...DEFAULT_RATE_LIMITING.spawn, ...config?.spawn },
+        };
+    }
+    check(req) {
+        if (!this.config.enabled) {
+            return {
+                allowed: true,
+                remaining: Infinity,
+                limit: Infinity,
+                resetMs: 0,
+                category: 'disabled',
+            };
+        }
+        const category = this.resolveCategory(req.gateway, req.domain, req.operation);
+        const limitConfig = this.getLimitConfig(category);
+        const now = Date.now();
+        const windowStart = now - limitConfig.windowMs;
+        let bucket = this.buckets.get(category);
+        if (!bucket) {
+            bucket = { timestamps: [] };
+            this.buckets.set(category, bucket);
+        }
+        // Clean up old timestamps
+        bucket.timestamps = bucket.timestamps.filter((t) => t > windowStart);
+        const allowed = bucket.timestamps.length < limitConfig.maxRequests;
+        if (allowed) {
+            bucket.timestamps.push(now);
+        }
+        const oldest = bucket.timestamps[0] || now;
+        const resetMs = Math.max(0, oldest + limitConfig.windowMs - now);
+        return {
+            allowed,
+            remaining: Math.max(0, limitConfig.maxRequests - bucket.timestamps.length),
+            limit: limitConfig.maxRequests,
+            resetMs,
+            category,
+        };
+    }
+    resolveCategory(gateway, domain, operation) {
+        if (domain === 'orchestrate' && operation === 'spawn') {
+            return 'spawn';
+        }
+        return gateway === 'query' ? 'query' : 'mutate';
+    }
+    getLimitConfig(category) {
+        return this.config[category];
+    }
+}
+/**
+ * Creates a rate limiting middleware for the dispatch pipeline.
+ *
+ * @remarks
+ * Attaches rate limit metadata to every response `_meta.rateLimit` field.
+ * When the limit is exceeded, returns an error response with code
+ * `E_RATE_LIMIT_EXCEEDED` and HTTP-style exit code 429.
+ *
+ * @param config - Optional partial config to override defaults
+ * @returns Middleware function that enforces rate limits
+ *
+ * @example
+ * ```typescript
+ * import { createRateLimiter } from './rate-limiter.js';
+ *
+ * const limiter = createRateLimiter({ query: { maxRequests: 50, windowMs: 30_000 } });
+ * ```
+ */
+export function createRateLimiter(config) {
+    const limiter = new RateLimiter(config);
+    return async (req, next) => {
+        const check = limiter.check(req);
+        if (!check.allowed) {
+            return {
+                _meta: {
+                    gateway: req.gateway,
+                    domain: req.domain,
+                    operation: req.operation,
+                    timestamp: new Date().toISOString(),
+                    duration_ms: 0,
+                    source: req.source,
+                    requestId: req.requestId,
+                    rateLimit: check,
+                },
+                success: false,
+                error: {
+                    code: 'E_RATE_LIMIT_EXCEEDED',
+                    exitCode: 429, // Too Many Requests
+                    message: `Rate limit exceeded for category: ${check.category}. Please wait ${Math.ceil(check.resetMs / 1000)} seconds.`,
+                },
+            };
+        }
+        const response = await next();
+        response._meta.rateLimit = {
+            limit: check.limit,
+            remaining: check.remaining,
+            resetMs: check.resetMs,
+            category: check.category,
+        };
+        return response;
+    };
+}
+//# sourceMappingURL=rate-limiter.js.map

package/dist/dispatch/middleware/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../../src/dispatch/middleware/rate-limiter.ts"],"names":[],"mappings":"AAuCA,MAAM,CAAC,MAAM,qBAAqB,GAAuB;IACvD,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC7C,MAAM,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;IAC7C,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;CAC7C,CAAC;AASF;;;;;;;;GAQG;AACH,MAAM,OAAO,WAAW;IACtB,2CAA2C;IACnC,OAAO,GAAqC,IAAI,GAAG,EAAE,CAAC;IAC9D,0CAA0C;IAClC,MAAM,CAAqB;IAEnC,YAAY,MAAoC;QAC9C,IAAI,CAAC,MAAM,GAAG;YACZ,GAAG,qBAAqB;YACxB,GAAG,MAAM;YACT,KAAK,EAAE,EAAE,GAAG,qBAAqB,CAAC,KAAK,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE;YAC3D,MAAM,EAAE,EAAE,GAAG,qBAAqB,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE;YAC9D,KAAK,EAAE,EAAE,GAAG,qBAAqB,CAAC,KAAK,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE;SAC5D,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAoB;QACxB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,QAAQ;gBACnB,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,CAAC;gBACV,QAAQ,EAAE,UAAU;aACrB,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9E,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAElD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC;QAE/C,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;QAED,0BAA0B;QAC1B,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC;QAErE,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC;QACnE,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,WAAW,CAAC,QAAQ,GAAG,GAAG,CAAC,CAAC;QAEjE,OAAO;YACL,OAAO;YACP,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;YAC1E,KAAK,EAAE,WAAW,CAAC,WAAW;YAC9B,OAAO;YACP,QAAQ;SACT,CAAC;IACJ,CAAC;IAEO,eAAe,CACrB,OAAe,EACf,MAAc,EACd,SAAiB;QAEjB,IAAI,MAAM,KAAK,aAAa,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YACtD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClD,CAAC;IAEO,cAAc,CAAC,QAAsC;QAC3D,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAoC;IACpE,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IAExC,OAAO,KAAK,EAAE,GAAoB,EAAE,IAAkB,EAA6B,EAAE;QACnF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEjC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO;gBACL,KAAK,EAAE;oBACL,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,WAAW,EAAE,CAAC;oBACd,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,SAAS,EAAE,KAAK;iBACjB;gBACD,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,uBAAuB;oBAC7B,QAAQ,EAAE,GAAG,EAAE,oBAAoB;oBACnC,OAAO,EAAE,qCAAqC,KAAK,CAAC,QAAQ,iBAAiB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,WAAW;iBACxH;aACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;QAC9B,QAAQ,CAAC,KAAK,CAAC,SAAS,GAAG;YACzB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;QAEF,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC"}

package/dist/dispatch/middleware/sanitizer.d.ts

@@ -0,0 +1,24 @@
+import type { Middleware } from '../types.js';
+/**
+ * Creates a middleware that sanitizes incoming request parameters.
+ * Uses the canonical sanitization logic from security.ts to handle
+ * Task IDs, paths, string lengths, and enum validation.
+ *
+ * @remarks
+ * If sanitization fails (e.g. path traversal detected, invalid task ID format),
+ * the middleware short-circuits the pipeline and returns an error response with
+ * code `E_VALIDATION_FAILED` (exit code 6). Otherwise, the sanitized params
+ * replace the originals on the request object before calling `next()`.
+ *
+ * @param getProjectRoot - Optional function to resolve the current project root for path sanitization
+ * @returns Middleware function that sanitizes request params
+ *
+ * @example
+ * ```typescript
+ * import { createSanitizer } from './sanitizer.js';
+ *
+ * const sanitizer = createSanitizer(() => process.cwd());
+ * ```
+ */
+export declare function createSanitizer(getProjectRoot?: () => string): Middleware;
+//# sourceMappingURL=sanitizer.d.ts.map

package/dist/dispatch/middleware/sanitizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizer.d.ts","sourceRoot":"","sources":["../../../src/dispatch/middleware/sanitizer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAmD,UAAU,EAAE,MAAM,aAAa,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,cAAc,CAAC,EAAE,MAAM,MAAM,GAAG,UAAU,CAgCzE"}

package/dist/dispatch/middleware/sanitizer.js

@@ -0,0 +1,56 @@
+import { sanitizeParams as legacySanitizeParams } from '../lib/security.js';
+/**
+ * Creates a middleware that sanitizes incoming request parameters.
+ * Uses the canonical sanitization logic from security.ts to handle
+ * Task IDs, paths, string lengths, and enum validation.
+ *
+ * @remarks
+ * If sanitization fails (e.g. path traversal detected, invalid task ID format),
+ * the middleware short-circuits the pipeline and returns an error response with
+ * code `E_VALIDATION_FAILED` (exit code 6). Otherwise, the sanitized params
+ * replace the originals on the request object before calling `next()`.
+ *
+ * @param getProjectRoot - Optional function to resolve the current project root for path sanitization
+ * @returns Middleware function that sanitizes request params
+ *
+ * @example
+ * ```typescript
+ * import { createSanitizer } from './sanitizer.js';
+ *
+ * const sanitizer = createSanitizer(() => process.cwd());
+ * ```
+ */
+export function createSanitizer(getProjectRoot) {
+    return async (req, next) => {
+        if (req.params) {
+            try {
+                const root = getProjectRoot ? getProjectRoot() : undefined;
+                req.params = legacySanitizeParams(req.params, root, {
+                    domain: req.domain,
+                    operation: req.operation,
+                });
+            }
+            catch (error) {
+                return {
+                    _meta: {
+                        gateway: req.gateway,
+                        domain: req.domain,
+                        operation: req.operation,
+                        timestamp: new Date().toISOString(),
+                        duration_ms: 0,
+                        source: req.source,
+                        requestId: req.requestId,
+                    },
+                    success: false,
+                    error: {
+                        code: 'E_VALIDATION_FAILED',
+                        exitCode: 6, // VALIDATION_ERROR
+                        message: error instanceof Error ? error.message : String(error),
+                    },
+                };
+            }
+        }
+        return next();
+    };
+}
+//# sourceMappingURL=sanitizer.js.map

package/dist/dispatch/middleware/sanitizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizer.js","sourceRoot":"","sources":["../../../src/dispatch/middleware/sanitizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,IAAI,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAG5E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,eAAe,CAAC,cAA6B;IAC3D,OAAO,KAAK,EAAE,GAAoB,EAAE,IAAkB,EAA6B,EAAE;QACnF,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC3D,GAAG,CAAC,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE;oBAClD,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,SAAS,EAAE,GAAG,CAAC,SAAS;iBACzB,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,KAAK,EAAE;wBACL,OAAO,EAAE,GAAG,CAAC,OAAO;wBACpB,MAAM,EAAE,GAAG,CAAC,MAAM;wBAClB,SAAS,EAAE,GAAG,CAAC,SAAS;wBACxB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBACnC,WAAW,EAAE,CAAC;wBACd,MAAM,EAAE,GAAG,CAAC,MAAM;wBAClB,SAAS,EAAE,GAAG,CAAC,SAAS;qBACzB;oBACD,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE;wBACL,IAAI,EAAE,qBAAqB;wBAC3B,QAAQ,EAAE,CAAC,EAAE,mBAAmB;wBAChC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAChE;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/dispatch/middleware/session-resolver.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Session Resolver Middleware for CQRS Dispatch Layer.
+ *
+ * Runs FIRST in the CLI middleware pipeline.
+ * Populates request.sessionId from the best available source:
+ *
+ *   1. request.sessionId already set (explicit)  -> use it
+ *   2. getBoundSession() has context              -> stamp it
+ *   3. process.env.CLEO_SESSION_ID (legacy/transitional) -> use it
+ *   4. No session found -> leave undefined (OK for many operations)
+ *
+ * All downstream middleware (audit, enforcement) reads request.sessionId
+ * directly instead of doing their own multi-tier fallback.
+ *
+ * @epic T4959
+ */
+import type { Middleware } from '../types.js';
+/**
+ * Creates the session resolver middleware.
+ *
+ * @param cliSessionLookup Optional async function that resolves the active
+ *   session ID from SQLite for CLI commands. If not provided, the resolver
+ *   falls through to env var / null.
+ */
+export declare function createSessionResolver(cliSessionLookup?: () => Promise<string | null>): Middleware;
+//# sourceMappingURL=session-resolver.d.ts.map

package/dist/dispatch/middleware/session-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-resolver.d.ts","sourceRoot":"","sources":["../../../src/dispatch/middleware/session-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAmD,UAAU,EAAE,MAAM,aAAa,CAAC;AAE/F;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,UAAU,CA0CjG"}

package/dist/dispatch/middleware/session-resolver.js

@@ -0,0 +1,65 @@
+/**
+ * Session Resolver Middleware for CQRS Dispatch Layer.
+ *
+ * Runs FIRST in the CLI middleware pipeline.
+ * Populates request.sessionId from the best available source:
+ *
+ *   1. request.sessionId already set (explicit)  -> use it
+ *   2. getBoundSession() has context              -> stamp it
+ *   3. process.env.CLEO_SESSION_ID (legacy/transitional) -> use it
+ *   4. No session found -> leave undefined (OK for many operations)
+ *
+ * All downstream middleware (audit, enforcement) reads request.sessionId
+ * directly instead of doing their own multi-tier fallback.
+ *
+ * @epic T4959
+ */
+import { getBoundSession } from '../context/session-context.js';
+/**
+ * Creates the session resolver middleware.
+ *
+ * @param cliSessionLookup Optional async function that resolves the active
+ *   session ID from SQLite for CLI commands. If not provided, the resolver
+ *   falls through to env var / null.
+ */
+export function createSessionResolver(cliSessionLookup) {
+    return async (req, next) => {
+        // Tier 1: Explicit — already populated by adapter
+        if (req.sessionId) {
+            return next();
+        }
+        // Tier 2: Process-scoped session context
+        const bound = getBoundSession();
+        if (bound) {
+            req.sessionId = bound.sessionId;
+            return next();
+        }
+        // Tier 3: CLI active session lookup (best-effort SQLite query)
+        if (cliSessionLookup && req.source === 'cli') {
+            try {
+                const activeId = await cliSessionLookup();
+                if (activeId) {
+                    req.sessionId = activeId;
+                    return next();
+                }
+            }
+            catch {
+                // Silent failure — many CLI commands don't need a session
+            }
+        }
+        // Tier 4: Legacy env var (transitional — will be removed)
+        const envGradeId = process.env.CLEO_SESSION_GRADE_ID;
+        if (envGradeId && process.env.CLEO_SESSION_GRADE === 'true') {
+            req.sessionId = envGradeId;
+            return next();
+        }
+        const envId = process.env.CLEO_SESSION_ID;
+        if (envId) {
+            req.sessionId = envId;
+            return next();
+        }
+        // Tier 5: No session — leave undefined
+        return next();
+    };
+}
+//# sourceMappingURL=session-resolver.js.map

package/dist/dispatch/middleware/session-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-resolver.js","sourceRoot":"","sources":["../../../src/dispatch/middleware/session-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAGhE;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,gBAA+C;IACnF,OAAO,KAAK,EAAE,GAAoB,EAAE,IAAkB,EAA6B,EAAE;QACnF,kDAAkD;QAClD,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;YAClB,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,yCAAyC;QACzC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;YAChC,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,+DAA+D;QAC/D,IAAI,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,EAAE,CAAC;gBAC1C,IAAI,QAAQ,EAAE,CAAC;oBACb,GAAG,CAAC,SAAS,GAAG,QAAQ,CAAC;oBACzB,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0DAA0D;YAC5D,CAAC;QACH,CAAC;QAED,0DAA0D;QAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACrD,IAAI,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,MAAM,EAAE,CAAC;YAC5D,GAAG,CAAC,SAAS,GAAG,UAAU,CAAC;YAC3B,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAC1C,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC;YACtB,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,uCAAuC;QACvC,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/dispatch/middleware/verification-gates.d.ts

@@ -0,0 +1,22 @@
+import type { Middleware } from '../types.js';
+/**
+ * Creates a middleware that enforces verification gates on task operations.
+ *
+ * @remarks
+ * Maps the dispatch request into a legacy OperationContext and delegates
+ * to the core VerificationGate. When verification fails, returns an error
+ * response with code `E_VALIDATION_FAILED` (exit code 80, LIFECYCLE_GATE_FAILED).
+ * On success, attaches the verification result to the response `_meta.verification`.
+ *
+ * @param strictMode - When true, blocks operations that fail verification gates
+ * @returns Middleware function that enforces verification gates
+ *
+ * @example
+ * ```typescript
+ * import { createVerificationGates } from './verification-gates.js';
+ *
+ * const gates = createVerificationGates(true);
+ * ```
+ */
+export declare function createVerificationGates(strictMode?: boolean): Middleware;
+//# sourceMappingURL=verification-gates.d.ts.map

package/dist/dispatch/middleware/verification-gates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-gates.d.ts","sourceRoot":"","sources":["../../../src/dispatch/middleware/verification-gates.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAmD,UAAU,EAAE,MAAM,aAAa,CAAC;AAE/F;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,GAAE,OAAc,GAAG,UAAU,CAyC9E"}

package/dist/dispatch/middleware/verification-gates.js

@@ -0,0 +1,59 @@
+import { createVerificationGate as legacyCreateGate } from '@cleocode/core/internal';
+/**
+ * Creates a middleware that enforces verification gates on task operations.
+ *
+ * @remarks
+ * Maps the dispatch request into a legacy OperationContext and delegates
+ * to the core VerificationGate. When verification fails, returns an error
+ * response with code `E_VALIDATION_FAILED` (exit code 80, LIFECYCLE_GATE_FAILED).
+ * On success, attaches the verification result to the response `_meta.verification`.
+ *
+ * @param strictMode - When true, blocks operations that fail verification gates
+ * @returns Middleware function that enforces verification gates
+ *
+ * @example
+ * ```typescript
+ * import { createVerificationGates } from './verification-gates.js';
+ *
+ * const gates = createVerificationGates(true);
+ * ```
+ */
+export function createVerificationGates(strictMode = true) {
+    const gate = legacyCreateGate(strictMode);
+    return async (req, next) => {
+        // Map DispatchRequest to legacy OperationContext
+        const context = {
+            domain: req.domain,
+            operation: req.operation,
+            gateway: req.gateway === 'query' ? 'query' : 'mutate',
+            params: req.params,
+            taskId: req.params?.taskId || req.params?.parent,
+        };
+        const result = await gate.verifyOperation(context);
+        if (!result.passed) {
+            return {
+                _meta: {
+                    gateway: req.gateway,
+                    domain: req.domain,
+                    operation: req.operation,
+                    timestamp: new Date().toISOString(),
+                    duration_ms: 0,
+                    source: req.source,
+                    requestId: req.requestId,
+                    verification: result,
+                },
+                success: false,
+                error: {
+                    code: 'E_VALIDATION_FAILED',
+                    exitCode: 80, // LIFECYCLE_GATE_FAILED
+                    message: `Verification gate failed at layer ${result.blockedAt}: ${result.summary}`,
+                    details: { verification: result },
+                },
+            };
+        }
+        const response = await next();
+        response._meta.verification = result;
+        return response;
+    };
+}
+//# sourceMappingURL=verification-gates.js.map

package/dist/dispatch/middleware/verification-gates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-gates.js","sourceRoot":"","sources":["../../../src/dispatch/middleware/verification-gates.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,IAAI,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGrF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,uBAAuB,CAAC,aAAsB,IAAI;IAChE,MAAM,IAAI,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAE1C,OAAO,KAAK,EAAE,GAAoB,EAAE,IAAkB,EAA6B,EAAE;QACnF,iDAAiD;QACjD,MAAM,OAAO,GAAG;YACd,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAE,OAAiB,CAAC,CAAC,CAAE,QAAkB;YAC3E,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,MAAM,EAAG,GAAG,CAAC,MAAM,EAAE,MAAiB,IAAK,GAAG,CAAC,MAAM,EAAE,MAAiB;SACzE,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAEnD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO;gBACL,KAAK,EAAE;oBACL,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,WAAW,EAAE,CAAC;oBACd,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,YAAY,EAAE,MAAM;iBACrB;gBACD,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,qBAAqB;oBAC3B,QAAQ,EAAE,EAAE,EAAE,wBAAwB;oBACtC,OAAO,EAAE,qCAAqC,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,OAAO,EAAE;oBACnF,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE;iBAClC;aACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;QAC9B,QAAQ,CAAC,KAAK,CAAC,YAAY,GAAG,MAAM,CAAC;QACrC,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC"}

package/dist/dispatch/registry.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Unified CQRS Dispatch Layer -- Operation Registry
+ *
+ * Single source of truth for all operations mapped to 10 canonical domains.
+ * Canonical domains only -- no legacy alias support.
+ *
+ * @epic T4820
+ * @task T4814, T5241, T5615
+ */
+import type { CanonicalDomain, Gateway, ParamDef, Tier } from './types.js';
+/** Definition of a single dispatchable operation. */
+export interface OperationDef {
+    /** The CQRS gateway ('query' or 'mutate'). */
+    gateway: Gateway;
+    /** The canonical domain this operation belongs to. */
+    domain: CanonicalDomain;
+    /** The specific operation name (e.g. 'show', 'skill.list'). */
+    operation: string;
+    /** Brief description of what the operation does. */
+    description: string;
+    /** Agent progressive-disclosure tier (0=basic, 1=memory/check, 2=full). */
+    tier: Tier;
+    /** Whether the operation is safe to retry. */
+    idempotent: boolean;
+    /** Whether this operation requires an active session. */
+    sessionRequired: boolean;
+    /** List of parameter keys that MUST be present in the request. */
+    requiredParams: string[];
+    /**
+     * Fully-described parameter list. Replaces `requiredParams` when populated.
+     * Empty array = "no declared params" (not "no params accepted").
+     * Optional during T4897 migration — defaults to [] when absent.
+     * @see T4897 for progressive migration
+     */
+    params?: ParamDef[];
+}
+/**
+ * Resolution output for a dispatch request.
+ */
+export interface Resolution {
+    /** The canonical domain. */
+    domain: CanonicalDomain;
+    /** The operation name. */
+    operation: string;
+    /** The definition of the matched operation. */
+    def: OperationDef;
+}
+/**
+ * The single source of truth for all operations in CLEO.
+ */
+export declare const OPERATIONS: OperationDef[];
+/**
+ * Derive a gateway operation matrix from the registry.
+ *
+ * Returns `Record<string, string[]>` containing:
+ * - All canonical domains with their operations
+ *
+ * This is the SINGLE derivation point — gateways use this instead of
+ * maintaining independent operation lists.
+ */
+export declare function deriveGatewayMatrix(gateway: Gateway): Record<string, string[]>;
+/**
+ * Get all accepted domain names for a gateway (canonical only).
+ */
+export declare function getGatewayDomains(gateway: Gateway): string[];
+/**
+ * Resolves a domain + operation to its registered definition.
+ */
+export declare function resolve(gateway: Gateway, domain: string, operation: string): Resolution | undefined;
+/**
+ * Validates that all required parameters are present in the request.
+ * Returns an array of missing parameter keys.
+ */
+export declare function validateRequiredParams(def: OperationDef, params?: Record<string, unknown>): string[];
+/** Get all operations for a specific canonical domain. */
+export declare function getByDomain(domain: CanonicalDomain): OperationDef[];
+/** Get all operations for a specific gateway. */
+export declare function getByGateway(gateway: Gateway): OperationDef[];
+/** Get all operations available at or below a specific tier. */
+export declare function getByTier(tier: Tier): OperationDef[];
+/** Get a list of canonical domains that actually have operations registered. */
+export declare function getActiveDomains(): CanonicalDomain[];
+/**
+ * Returns summary counts of operations for module validation.
+ */
+export declare function getCounts(): {
+    query: number;
+    mutate: number;
+    total: number;
+};
+//# sourceMappingURL=registry.d.ts.map

package/dist/dispatch/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/dispatch/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAE3E,qDAAqD;AACrD,MAAM,WAAW,YAAY;IAC3B,8CAA8C;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,sDAAsD;IACtD,MAAM,EAAE,eAAe,CAAC;IACxB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,IAAI,EAAE,IAAI,CAAC;IACX,8CAA8C;IAC9C,UAAU,EAAE,OAAO,CAAC;IACpB,yDAAyD;IACzD,eAAe,EAAE,OAAO,CAAC;IACzB,kEAAkE;IAClE,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,4BAA4B;IAC5B,MAAM,EAAE,eAAe,CAAC;IACxB,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,GAAG,EAAE,YAAY,CAAC;CACnB;AAED;;GAEG;AACH,eAAO,MAAM,UAAU,EAAE,YAAY,EAihGpC,CAAC;AAMF;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAU9E;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,CAE5D;AAMD;;GAEG;AACH,wBAAgB,OAAO,CACrB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,UAAU,GAAG,SAAS,CAQxB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,YAAY,EACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,MAAM,EAAE,CAMV;AAED,0DAA0D;AAC1D,wBAAgB,WAAW,CAAC,MAAM,EAAE,eAAe,GAAG,YAAY,EAAE,CAEnE;AAED,iDAAiD;AACjD,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,YAAY,EAAE,CAE7D;AAED,gEAAgE;AAChE,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,YAAY,EAAE,CAEpD;AAED,gFAAgF;AAChF,wBAAgB,gBAAgB,IAAI,eAAe,EAAE,CAGpD;AAED;;GAEG;AACH,wBAAgB,SAAS,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAM5E"}