@cleocode/contracts 2026.6.12 → 2026.6.14

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (216) hide show
  1. package/dist/__tests__/operation-def.test.js +5 -1
  2. package/dist/__tests__/operation-def.test.js.map +1 -1
  3. package/dist/__tests__/provider-def.test.d.ts +12 -0
  4. package/dist/__tests__/provider-def.test.d.ts.map +1 -0
  5. package/dist/__tests__/provider-def.test.js +84 -0
  6. package/dist/__tests__/provider-def.test.js.map +1 -0
  7. package/dist/__tests__/sealed-credential.test.d.ts +19 -0
  8. package/dist/__tests__/sealed-credential.test.d.ts.map +1 -0
  9. package/dist/__tests__/sealed-credential.test.js +74 -0
  10. package/dist/__tests__/sealed-credential.test.js.map +1 -0
  11. package/dist/__tests__/service-provider.test.d.ts +17 -0
  12. package/dist/__tests__/service-provider.test.d.ts.map +1 -0
  13. package/dist/__tests__/service-provider.test.js +108 -0
  14. package/dist/__tests__/service-provider.test.js.map +1 -0
  15. package/dist/__tests__/skill-executor-contract.test.js +3 -0
  16. package/dist/__tests__/skill-executor-contract.test.js.map +1 -1
  17. package/dist/acceptance-gate.d.ts +2 -3
  18. package/dist/acceptance-gate.d.ts.map +1 -1
  19. package/dist/boundary.d.ts +52 -0
  20. package/dist/boundary.d.ts.map +1 -1
  21. package/dist/boundary.js +24 -19
  22. package/dist/boundary.js.map +1 -1
  23. package/dist/conduit.d.ts +171 -0
  24. package/dist/conduit.d.ts.map +1 -1
  25. package/dist/config/index.d.ts +23 -0
  26. package/dist/config/index.d.ts.map +1 -0
  27. package/dist/config/index.js +22 -0
  28. package/dist/config/index.js.map +1 -0
  29. package/dist/config.d.ts +104 -1
  30. package/dist/config.d.ts.map +1 -1
  31. package/dist/data-accessor.d.ts +21 -1
  32. package/dist/data-accessor.d.ts.map +1 -1
  33. package/dist/data-accessor.js.map +1 -1
  34. package/dist/dispatch/__tests__/tasks-gateway-crud-ops.test.d.ts +21 -0
  35. package/dist/dispatch/__tests__/tasks-gateway-crud-ops.test.d.ts.map +1 -0
  36. package/dist/dispatch/__tests__/tasks-gateway-crud-ops.test.js +84 -0
  37. package/dist/dispatch/__tests__/tasks-gateway-crud-ops.test.js.map +1 -0
  38. package/dist/dispatch/identity.d.ts +1 -1
  39. package/dist/dispatch/identity.d.ts.map +1 -1
  40. package/dist/dispatch/identity.js +25 -0
  41. package/dist/dispatch/identity.js.map +1 -1
  42. package/dist/dispatch/operation-def.d.ts +20 -0
  43. package/dist/dispatch/operation-def.d.ts.map +1 -1
  44. package/dist/dispatch/operations-registry.d.ts.map +1 -1
  45. package/dist/dispatch/operations-registry.js +1044 -182
  46. package/dist/dispatch/operations-registry.js.map +1 -1
  47. package/dist/docs/read.d.ts +2 -2
  48. package/dist/index.d.ts +25 -11
  49. package/dist/index.d.ts.map +1 -1
  50. package/dist/index.js +17 -1
  51. package/dist/index.js.map +1 -1
  52. package/dist/lease-ipc/__tests__/freeze.test.d.ts +15 -0
  53. package/dist/lease-ipc/__tests__/freeze.test.d.ts.map +1 -0
  54. package/dist/lease-ipc/__tests__/freeze.test.js +313 -0
  55. package/dist/lease-ipc/__tests__/freeze.test.js.map +1 -0
  56. package/dist/lease-ipc/index.d.ts +17 -0
  57. package/dist/lease-ipc/index.d.ts.map +1 -0
  58. package/dist/lease-ipc/index.js +16 -0
  59. package/dist/lease-ipc/index.js.map +1 -0
  60. package/dist/lease-ipc/messages.d.ts +918 -0
  61. package/dist/lease-ipc/messages.d.ts.map +1 -0
  62. package/dist/lease-ipc/messages.js +476 -0
  63. package/dist/lease-ipc/messages.js.map +1 -0
  64. package/dist/lease-ipc/version.d.ts +41 -0
  65. package/dist/lease-ipc/version.d.ts.map +1 -0
  66. package/dist/lease-ipc/version.js +43 -0
  67. package/dist/lease-ipc/version.js.map +1 -0
  68. package/dist/llm/catalog-schema.d.ts +242 -0
  69. package/dist/llm/catalog-schema.d.ts.map +1 -0
  70. package/dist/llm/catalog-schema.js +153 -0
  71. package/dist/llm/catalog-schema.js.map +1 -0
  72. package/dist/llm/catalog-schema.json +139 -0
  73. package/dist/llm/index.d.ts +15 -0
  74. package/dist/llm/index.d.ts.map +1 -0
  75. package/dist/llm/index.js +14 -0
  76. package/dist/llm/index.js.map +1 -0
  77. package/dist/llm/interfaces.d.ts +23 -0
  78. package/dist/llm/interfaces.d.ts.map +1 -1
  79. package/dist/llm/oauth.d.ts +16 -2
  80. package/dist/llm/oauth.d.ts.map +1 -1
  81. package/dist/llm/onboarding.d.ts +126 -0
  82. package/dist/llm/onboarding.d.ts.map +1 -0
  83. package/dist/llm/onboarding.js +34 -0
  84. package/dist/llm/onboarding.js.map +1 -0
  85. package/dist/llm/provider-def.d.ts +254 -0
  86. package/dist/llm/provider-def.d.ts.map +1 -0
  87. package/dist/llm/provider-def.js +93 -0
  88. package/dist/llm/provider-def.js.map +1 -0
  89. package/dist/llm/sealed-credential.d.ts +164 -0
  90. package/dist/llm/sealed-credential.d.ts.map +1 -0
  91. package/dist/llm/sealed-credential.js +43 -0
  92. package/dist/llm/sealed-credential.js.map +1 -0
  93. package/dist/llm/system-of-use.d.ts +383 -0
  94. package/dist/llm/system-of-use.d.ts.map +1 -0
  95. package/dist/llm/system-of-use.js +238 -0
  96. package/dist/llm/system-of-use.js.map +1 -0
  97. package/dist/llm/system-resolver.d.ts +87 -11
  98. package/dist/llm/system-resolver.d.ts.map +1 -1
  99. package/dist/llm/system-resolver.js +14 -7
  100. package/dist/llm/system-resolver.js.map +1 -1
  101. package/dist/operations/__tests__/ensures-schema-registry.test.d.ts +17 -0
  102. package/dist/operations/__tests__/ensures-schema-registry.test.d.ts.map +1 -0
  103. package/dist/operations/__tests__/ensures-schema-registry.test.js +113 -0
  104. package/dist/operations/__tests__/ensures-schema-registry.test.js.map +1 -0
  105. package/dist/operations/admin.d.ts +124 -1
  106. package/dist/operations/admin.d.ts.map +1 -1
  107. package/dist/operations/ensures-schema-registry.d.ts +172 -0
  108. package/dist/operations/ensures-schema-registry.d.ts.map +1 -0
  109. package/dist/operations/ensures-schema-registry.js +226 -0
  110. package/dist/operations/ensures-schema-registry.js.map +1 -0
  111. package/dist/operations/entities.d.ts +110 -0
  112. package/dist/operations/entities.d.ts.map +1 -0
  113. package/dist/operations/entities.js +695 -0
  114. package/dist/operations/entities.js.map +1 -0
  115. package/dist/operations/llm.d.ts +116 -9
  116. package/dist/operations/llm.d.ts.map +1 -1
  117. package/dist/operations/output-contracts-data.d.ts.map +1 -1
  118. package/dist/operations/output-contracts-data.js +230 -0
  119. package/dist/operations/output-contracts-data.js.map +1 -1
  120. package/dist/operations/service.d.ts +68 -0
  121. package/dist/operations/service.d.ts.map +1 -0
  122. package/dist/operations/service.js +336 -0
  123. package/dist/operations/service.js.map +1 -0
  124. package/dist/operations/tasks.d.ts +109 -0
  125. package/dist/operations/tasks.d.ts.map +1 -1
  126. package/dist/operations/tasks.js.map +1 -1
  127. package/dist/operations/validate.d.ts +1 -12
  128. package/dist/operations/validate.d.ts.map +1 -1
  129. package/dist/operations/validate.js +1 -1
  130. package/dist/playbook.d.ts +116 -0
  131. package/dist/playbook.d.ts.map +1 -1
  132. package/dist/release/plan.d.ts +5 -5
  133. package/dist/session.d.ts +11 -0
  134. package/dist/session.d.ts.map +1 -1
  135. package/dist/session.js.map +1 -1
  136. package/dist/templates/manifest.d.ts +1 -1
  137. package/dist/tools/agent-tools.d.ts +231 -0
  138. package/dist/tools/agent-tools.d.ts.map +1 -0
  139. package/dist/tools/agent-tools.js +25 -0
  140. package/dist/tools/agent-tools.js.map +1 -0
  141. package/dist/tools/atomic.d.ts +19 -0
  142. package/dist/tools/atomic.d.ts.map +1 -1
  143. package/dist/tools/atomic.js +17 -0
  144. package/dist/tools/atomic.js.map +1 -1
  145. package/dist/tools/index.d.ts +2 -0
  146. package/dist/tools/index.d.ts.map +1 -1
  147. package/dist/tools/skill-executor.d.ts +7 -0
  148. package/dist/tools/skill-executor.d.ts.map +1 -1
  149. package/dist/tools/web-tools.d.ts +217 -0
  150. package/dist/tools/web-tools.d.ts.map +1 -0
  151. package/dist/tools/web-tools.js +31 -0
  152. package/dist/tools/web-tools.js.map +1 -0
  153. package/dist/vault/service-provider.d.ts +343 -0
  154. package/dist/vault/service-provider.d.ts.map +1 -0
  155. package/dist/vault/service-provider.js +857 -0
  156. package/dist/vault/service-provider.js.map +1 -0
  157. package/dist/workgraph.d.ts +12 -12
  158. package/package.json +14 -2
  159. package/src/__tests__/__snapshots__/operations-registry.test.ts.snap +1 -1
  160. package/src/__tests__/operation-def.test.ts +7 -1
  161. package/src/__tests__/provider-def.test.ts +93 -0
  162. package/src/__tests__/sealed-credential.test.ts +100 -0
  163. package/src/__tests__/service-provider.test.ts +129 -0
  164. package/src/__tests__/skill-executor-contract.test.ts +3 -0
  165. package/src/acceptance-gate.ts +2 -3
  166. package/src/boundary.ts +70 -20
  167. package/src/conduit.ts +200 -0
  168. package/src/config/index.ts +35 -0
  169. package/src/config.ts +106 -1
  170. package/src/data-accessor.ts +22 -1
  171. package/src/dispatch/__tests__/tasks-gateway-crud-ops.test.ts +99 -0
  172. package/src/dispatch/identity.ts +25 -0
  173. package/src/dispatch/operation-def.ts +21 -0
  174. package/src/dispatch/operations-registry.ts +1083 -176
  175. package/src/index.ts +240 -25
  176. package/src/lease-ipc/__tests__/freeze.test.ts +342 -0
  177. package/src/lease-ipc/index.ts +75 -0
  178. package/src/lease-ipc/messages.ts +588 -0
  179. package/src/lease-ipc/version.ts +46 -0
  180. package/src/llm/catalog-schema.json +139 -0
  181. package/src/llm/catalog-schema.ts +184 -0
  182. package/src/llm/index.ts +29 -0
  183. package/src/llm/interfaces.ts +23 -0
  184. package/src/llm/oauth.ts +16 -2
  185. package/src/llm/onboarding.ts +131 -0
  186. package/src/llm/provider-def.ts +291 -0
  187. package/src/llm/sealed-credential.ts +166 -0
  188. package/src/llm/system-of-use.ts +503 -0
  189. package/src/llm/system-resolver.ts +91 -11
  190. package/src/operations/__tests__/ensures-schema-registry.test.ts +169 -0
  191. package/src/operations/admin.ts +144 -0
  192. package/src/operations/ensures-schema-registry.ts +260 -0
  193. package/src/operations/entities.ts +758 -0
  194. package/src/operations/llm.ts +120 -8
  195. package/src/operations/output-contracts-data.ts +264 -0
  196. package/src/operations/service.ts +360 -0
  197. package/src/operations/tasks.ts +119 -0
  198. package/src/operations/validate.ts +1 -14
  199. package/src/playbook.ts +117 -0
  200. package/src/session.ts +11 -0
  201. package/src/tools/agent-tools.ts +270 -0
  202. package/src/tools/atomic.ts +21 -0
  203. package/src/tools/index.ts +46 -0
  204. package/src/tools/skill-executor.ts +7 -0
  205. package/src/tools/web-tools.ts +247 -0
  206. package/src/vault/service-provider.ts +1137 -0
  207. package/dist/tessera.d.ts +0 -32
  208. package/dist/tessera.d.ts.map +0 -1
  209. package/dist/tessera.js +0 -11
  210. package/dist/tessera.js.map +0 -1
  211. package/dist/warp-chain.d.ts +0 -129
  212. package/dist/warp-chain.d.ts.map +0 -1
  213. package/dist/warp-chain.js +0 -13
  214. package/dist/warp-chain.js.map +0 -1
  215. package/src/tessera.ts +0 -35
  216. package/src/warp-chain.ts +0 -185
@@ -0,0 +1,226 @@
1
+ /**
2
+ * Ensures-schema Zod registry — the cantbook `ensures.schema` name → Zod
3
+ * validator SSoT (T11762 ST-1 · Lane A).
4
+ *
5
+ * ## Why this exists
6
+ *
7
+ * The playbook runtime (`packages/playbooks/src/runtime.ts`) validates a node's
8
+ * post-merge `context` against a named shape declared as `ensures.schema:` in a
9
+ * `.cantbook`. Historically the runtime HARDCODED two bespoke validators
10
+ * (`validateDecompositionTaskTree` / `validateIvtrEvidenceOutput`) in an
11
+ * `if (schema === 'task_tree') … else if (=== 'evidence')` block, and silently
12
+ * SKIPPED any other schema name. T11762 replaces that hardcode with a
13
+ * registry-driven lookup so:
14
+ *
15
+ * - `ensures.schema` names resolve to a registered Zod validator (AC1).
16
+ * - the runtime no longer hardcodes `'task_tree'` / `'evidence'` (AC2).
17
+ * - an unknown schema name FAILS CLOSED instead of silently passing.
18
+ *
19
+ * This module holds ONLY the Gate-10 (`lint-no-runtime-in-contracts`)-ALLOWED
20
+ * kinds: the Zod schema **const values**, the {@link EnsuresSchemaSpec} **type**,
21
+ * and the registry **data** (a `ReadonlyMap` value). The bodied accessors
22
+ * (`getEnsuresSchema` / `listEnsuresSchemaNames` / `defineEnsuresSchema`) live in
23
+ * `@cleocode/core` (`packages/core/src/dispatch/contracts/ensures-schema.ts`,
24
+ * ST-1b) because a `Map.get` helper is a net-new runtime function that the
25
+ * contracts-purity gate forbids in this leaf package.
26
+ *
27
+ * ## Message parity (behavior preservation)
28
+ *
29
+ * The Zod schemas are crafted so that — for every input the deleted bespoke
30
+ * validators rejected — the FIRST Zod issue message equals the SUFFIX of the
31
+ * original human-readable violation string (the part after the
32
+ * `ensures.schema[<name>] on <nodeId>: ` prefix). ST-2's runtime wrapper
33
+ * re-applies that prefix, so the end-to-end violation strings are unchanged. The
34
+ * ST-1 parity test asserts on these issue messages directly.
35
+ *
36
+ * ## Genkit-forward naming
37
+ *
38
+ * The registry surface is deliberately Genkit-shaped so a future Genkit
39
+ * `ai.defineSchema(name, zodSchema)` bridge (T11768) is a thin adapter over this
40
+ * SSoT, never a competing source.
41
+ *
42
+ * @packageDocumentation
43
+ * @module @cleocode/contracts/operations/ensures-schema-registry
44
+ *
45
+ * @epic T11762 — E-OUTPUT-SCHEMA-ENFORCEMENT
46
+ * @task T11900 — ST-1: ensures-schema Zod registry DATA + schemas
47
+ * @see validateDecompositionTaskTree — the ported bespoke task_tree validator
48
+ * @see validateIvtrEvidenceOutput — the ported bespoke evidence validator
49
+ */
50
+ import { z } from 'zod';
51
+ // ─── task_tree — ports validateDecompositionTaskTree (runtime.ts:794-855) ──────
52
+ /**
53
+ * Zod schema for a single `task_tree` entry.
54
+ *
55
+ * Parity rules ported from `validateDecompositionTaskTree`:
56
+ * - `title` must be a non-empty string (after trim).
57
+ * - `acceptance` must be a non-empty array containing at least one non-empty
58
+ * (after-trim) string.
59
+ * - `id` / `parentId` / `depends` are optional and not hard-validated (the
60
+ * bespoke validator was intentionally lenient on these).
61
+ *
62
+ * @remarks
63
+ * The `title` check is split so the message echoes the bespoke
64
+ * `entry[i].title must be a non-empty string` regardless of whether the field is
65
+ * absent, the wrong type, or whitespace-only.
66
+ */
67
+ export const taskTreeEntrySchema = z.object({
68
+ title: z
69
+ .string({ message: 'title must be a non-empty string' })
70
+ .refine((s) => s.trim().length > 0, { message: 'title must be a non-empty string' }),
71
+ acceptance: z
72
+ .array(z.unknown(), { message: 'must have a non-empty acceptance array' })
73
+ .min(1, { message: 'must have a non-empty acceptance array' })
74
+ .refine((arr) => arr.some((s) => typeof s === 'string' && s.trim().length > 0), {
75
+ message: 'acceptance array contains no non-empty strings',
76
+ }),
77
+ id: z.string().optional(),
78
+ parentId: z.string().optional(),
79
+ depends: z.array(z.string()).optional(),
80
+ });
81
+ /**
82
+ * Zod schema for the `task_tree` context value emitted by a RCASD decomposition
83
+ * node — a non-empty array of {@link taskTreeEntrySchema} entries.
84
+ *
85
+ * Parity: an empty array is rejected with `task_tree is an empty array …`; a
86
+ * non-array is rejected by Zod's base array type error.
87
+ *
88
+ * @public
89
+ */
90
+ export const taskTreeSchema = z
91
+ .array(taskTreeEntrySchema, { message: 'task_tree must be a non-empty array' })
92
+ .min(1, { message: 'task_tree is an empty array — decomposition produced no tasks' });
93
+ // ─── evidence — ports validateIvtrEvidenceOutput (runtime.ts:873-902) ──────────
94
+ /**
95
+ * Zod schema for the `evidence` context value emitted by an IVTR validation
96
+ * node.
97
+ *
98
+ * Parity rules ported from `validateIvtrEvidenceOutput`. Valid evidence is one
99
+ * of:
100
+ * - a non-empty (after-trim) string,
101
+ * - a non-empty array,
102
+ * - an object with at least one key.
103
+ *
104
+ * `null` / `undefined`, the empty string, the empty array, the empty object, and
105
+ * any other primitive (number, boolean) are rejected — matching the bespoke
106
+ * validator exactly.
107
+ *
108
+ * @remarks
109
+ * A `z.union` of the three valid shapes would reject the SAME set of inputs, but
110
+ * collapses every rejection to a generic `"Invalid input"` union error. To
111
+ * preserve the bespoke validator's branch-specific messages (`evidence must be
112
+ * present …`, `evidence string must not be empty`, `evidence array must not be
113
+ * empty`, `evidence object must have at least one key (got {})`, `evidence must
114
+ * be a string, array, or object (got <type>)`), this schema replicates the
115
+ * original branch order in a single `superRefine`. The `superRefine` callback is
116
+ * an inline argument — NOT an exported bodied function/arrow — so it does not
117
+ * trip the Gate-10 contracts-purity lint.
118
+ *
119
+ * @public
120
+ */
121
+ export const evidenceSchema = z.unknown().superRefine((value, ctx) => {
122
+ if (value === null || value === undefined) {
123
+ ctx.addIssue({
124
+ code: 'custom',
125
+ message: 'evidence must be present (non-null, non-undefined)',
126
+ });
127
+ return;
128
+ }
129
+ if (typeof value === 'string') {
130
+ if (value.trim().length === 0) {
131
+ ctx.addIssue({ code: 'custom', message: 'evidence string must not be empty' });
132
+ }
133
+ return;
134
+ }
135
+ if (Array.isArray(value)) {
136
+ if (value.length === 0) {
137
+ ctx.addIssue({ code: 'custom', message: 'evidence array must not be empty' });
138
+ }
139
+ return;
140
+ }
141
+ if (typeof value === 'object') {
142
+ if (Object.keys(value).length === 0) {
143
+ ctx.addIssue({
144
+ code: 'custom',
145
+ message: 'evidence object must have at least one key (got {})',
146
+ });
147
+ }
148
+ return;
149
+ }
150
+ // Numbers, booleans, symbols, bigints, functions — not valid evidence shapes.
151
+ ctx.addIssue({
152
+ code: 'custom',
153
+ message: `evidence must be a string, array, or object (got ${typeof value})`,
154
+ });
155
+ });
156
+ // ─── passthrough — legacy starter `ensures.schema` names (R1 fail-closed) ──────
157
+ /**
158
+ * Passthrough validator that accepts ANY value (including `undefined`).
159
+ *
160
+ * Used to register the legacy `ensures.schema` names already declared in the
161
+ * shipped starter `.cantbook` files ({@link LEGACY_PASSTHROUGH_SCHEMA_NAMES}).
162
+ *
163
+ * @remarks
164
+ * Before T11762, the runtime hardcoded ONLY `task_tree` / `evidence` and
165
+ * SILENTLY SKIPPED every other `ensures.schema` name. ST-2 flips that to
166
+ * fail-closed: an UNREGISTERED name is now a contract violation. To avoid
167
+ * regressing the in-repo starter playbooks (`release` / `rcasd` / `ivtr`),
168
+ * which declare a dozen descriptive schema names that were never actually
169
+ * shape-checked, each such name is registered here with this passthrough
170
+ * schema — preserving their historical "always pass" behavior EXACTLY while
171
+ * still failing-closed for genuinely-unknown names (Risk R1). Tightening any of
172
+ * these into a real shape is a follow-up; the name is the SSoT anchor.
173
+ *
174
+ * @public
175
+ */
176
+ export const passthroughSchema = z.unknown();
177
+ /**
178
+ * The legacy `ensures.schema` names declared in the shipped starter
179
+ * `.cantbook` files that were SILENTLY SKIPPED pre-T11762. Registered with
180
+ * {@link passthroughSchema} so the fail-closed flip (ST-2) does not regress
181
+ * them. Kept as exported DATA so the parity test can assert the exact set.
182
+ *
183
+ * @public
184
+ */
185
+ export const LEGACY_PASSTHROUGH_SCHEMA_NAMES = [
186
+ // release.cantbook
187
+ 'version_bump_report',
188
+ 'changelog_entry',
189
+ 'publish_report',
190
+ // rcasd.cantbook
191
+ 'research_summary',
192
+ 'consensus_decision',
193
+ 'architecture_plan',
194
+ 'specification_document',
195
+ // ivtr.cantbook
196
+ 'implementation_diff',
197
+ 'validation_report',
198
+ 'audit_report',
199
+ 'test_report',
200
+ 'release_confirmation',
201
+ ];
202
+ /**
203
+ * The ensures-schema registry DATA — a `ReadonlyMap` from `ensures.schema` name
204
+ * to its {@link EnsuresSchemaSpec}.
205
+ *
206
+ * This is a VALUE (data), not a bodied function, so it is Gate-10-safe in the
207
+ * `@cleocode/contracts` leaf package. The bodied accessor layer in
208
+ * `@cleocode/core` (ST-1b) reads this map.
209
+ *
210
+ * Two strict entries (`task_tree`, `evidence`) port the deleted bespoke
211
+ * validators; the remaining entries are the legacy starter names
212
+ * ({@link LEGACY_PASSTHROUGH_SCHEMA_NAMES}) registered with
213
+ * {@link passthroughSchema} so the ST-2 fail-closed flip does not regress the
214
+ * shipped playbooks (Risk R1).
215
+ *
216
+ * @public
217
+ */
218
+ export const ENSURES_SCHEMA_REGISTRY = new Map([
219
+ ['task_tree', { name: 'task_tree', contextKey: 'task_tree', schema: taskTreeSchema }],
220
+ ['evidence', { name: 'evidence', contextKey: 'evidence', schema: evidenceSchema }],
221
+ ...LEGACY_PASSTHROUGH_SCHEMA_NAMES.map((name) => [
222
+ name,
223
+ { name, contextKey: name, schema: passthroughSchema },
224
+ ]),
225
+ ]);
226
+ //# sourceMappingURL=ensures-schema-registry.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"ensures-schema-registry.js","sourceRoot":"","sources":["../../src/operations/ensures-schema-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAAgB,CAAC,EAAE,MAAM,KAAK,CAAC;AAwBtC,kFAAkF;AAElF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAY,CAAC,CAAC,MAAM,CAAC;IACnD,KAAK,EAAE,CAAC;SACL,MAAM,CAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC;SACvD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC;IACtF,UAAU,EAAE,CAAC;SACV,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;SACzE,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC;SAC7D,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE;QAC9E,OAAO,EAAE,gDAAgD;KAC1D,CAAC;IACJ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAY,CAAC;KACrC,KAAK,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;KAC9E,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,+DAA+D,EAAE,CAAC,CAAC;AAExF,kFAAkF;AAElF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,cAAc,GAAY,CAAC,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5E,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,oDAAoD;SAC9D,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,qDAAqD;aAC/D,CAAC,CAAC;QACL,CAAC;QACD,OAAO;IACT,CAAC;IACD,8EAA8E;IAC9E,GAAG,CAAC,QAAQ,CAAC;QACX,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,oDAAoD,OAAO,KAAK,GAAG;KAC7E,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,kFAAkF;AAElF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAY,CAAC,CAAC,OAAO,EAAE,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAsB;IAChE,mBAAmB;IACnB,qBAAqB;IACrB,iBAAiB;IACjB,gBAAgB;IAChB,iBAAiB;IACjB,kBAAkB;IAClB,oBAAoB;IACpB,mBAAmB;IACnB,wBAAwB;IACxB,gBAAgB;IAChB,qBAAqB;IACrB,mBAAmB;IACnB,cAAc;IACd,aAAa;IACb,sBAAsB;CACvB,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAA2C,IAAI,GAAG,CAGpF;IACA,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACrF,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAClF,GAAG,+BAA+B,CAAC,GAAG,CAAC,CAAC,IAAI,EAA+B,EAAE,CAAC;QAC5E,IAAI;QACJ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE;KACtD,CAAC;CACH,CAAC,CAAC"}
@@ -0,0 +1,110 @@
1
+ /**
2
+ * 5-entity provider-experience operation contracts — INPUT + OUTPUT schemas (T11700).
3
+ *
4
+ * The schema-first I/O contracts for the addressable provider-experience surface
5
+ * the North-Star design needs (§2 — Provider / Alias / Account / Model / Profile).
6
+ * They live HERE in the `contracts` leaf package — alongside `tasks.ts`,
7
+ * `service.ts`, and the OUTPUT-contracts registry — so every consumer (CLI
8
+ * `--describe`, the SDK `describeOperation`, REST clients) resolves the I/O shape
9
+ * against ONE source of truth.
10
+ *
11
+ * ## The five entities (North-Star §2)
12
+ *
13
+ * - **Provider** — a declarative LLM provider definition (`anthropic`, `openai`, …)
14
+ * with its aliases, auth methods, and endpoint variants (`providers` table, #1039).
15
+ * - **Alias** — a case-insensitive name resolving to a provider (carried inside the
16
+ * provider rows; surfaced via `provider.show`).
17
+ * - **Account** — ONE pooled credential for a provider (the rename/successor of the
18
+ * secret-bearing `llm` credential pool). `account.add` is SECRET-BEARING.
19
+ * - **Model** — a row in the models.dev catalog (`models_catalog` table, #1037).
20
+ * - **Profile** — the named, addressable binding of `account + model (+ params + role)`,
21
+ * persisted in config under `llm.profiles[name]` (the resolver-consumed SSoT).
22
+ *
23
+ * ## Secrets never surfaced
24
+ *
25
+ * `account.add` accepts a SECRET token but its OUTPUT view is the same NON-SECRET
26
+ * redacted shape `account.list` returns — `tokenPreview` (last-4) ONLY, NEVER the
27
+ * raw key. There is no `--field` pointer that resolves to a secret, by design. The
28
+ * secret-bearing ops are kept OFF the MCP surface (default-deny `mcpExposed`).
29
+ *
30
+ * @packageDocumentation
31
+ * @module @cleocode/contracts/operations/entities
32
+ *
33
+ * @epic T11666
34
+ * @task T11700 — provider/account/model/profile OperationDefs
35
+ */
36
+ import type { JsonSchema, OperationInputContract } from './input-contract.js';
37
+ import type { OperationOutputContract } from './output-contract.js';
38
+ /** Accepted input shape for `account.add`. `token` is SECRET — never echoed. */
39
+ export declare const ACCOUNT_ADD_INPUT_SCHEMA: JsonSchema;
40
+ /** Schema-first INPUT contract for `account.add`. */
41
+ export declare const accountAddInputContract: OperationInputContract<Record<string, unknown>>;
42
+ /** OUTPUT contract for `account.add` — the NON-SECRET redacted view. */
43
+ export declare const accountAddOutputContract: OperationOutputContract;
44
+ /** Accepted input shape for `account.list`. */
45
+ export declare const ACCOUNT_LIST_INPUT_SCHEMA: JsonSchema;
46
+ /** Schema-first INPUT contract for `account.list`. */
47
+ export declare const accountListInputContract: OperationInputContract<Record<string, unknown>>;
48
+ /** OUTPUT contract for `account.list` — redacted account views. */
49
+ export declare const accountListOutputContract: OperationOutputContract;
50
+ /** Accepted input shape for `account.remove`. */
51
+ export declare const ACCOUNT_REMOVE_INPUT_SCHEMA: JsonSchema;
52
+ /** Schema-first INPUT contract for `account.remove`. */
53
+ export declare const accountRemoveInputContract: OperationInputContract<Record<string, unknown>>;
54
+ /** OUTPUT contract for `account.remove` — the mutate envelope. */
55
+ export declare const accountRemoveOutputContract: OperationOutputContract;
56
+ /** Accepted input shape for `provider.list`. */
57
+ export declare const PROVIDER_LIST_INPUT_SCHEMA: JsonSchema;
58
+ /** Schema-first INPUT contract for `provider.list`. */
59
+ export declare const providerListInputContract: OperationInputContract<Record<string, unknown>>;
60
+ /** OUTPUT contract for `provider.list` — declarative provider views. */
61
+ export declare const providerListOutputContract: OperationOutputContract;
62
+ /** Accepted input shape for `provider.show`. */
63
+ export declare const PROVIDER_SHOW_INPUT_SCHEMA: JsonSchema;
64
+ /** Schema-first INPUT contract for `provider.show`. */
65
+ export declare const providerShowInputContract: OperationInputContract<Record<string, unknown>>;
66
+ /** OUTPUT contract for `provider.show` — the resolved provider + the alias matched. */
67
+ export declare const providerShowOutputContract: OperationOutputContract;
68
+ /** Accepted input shape for `provider.connect`. */
69
+ export declare const PROVIDER_CONNECT_INPUT_SCHEMA: JsonSchema;
70
+ /** Schema-first INPUT contract for `provider.connect`. */
71
+ export declare const providerConnectInputContract: OperationInputContract<Record<string, unknown>>;
72
+ /** OUTPUT contract for `provider.connect` — the NON-SECRET account identity. */
73
+ export declare const providerConnectOutputContract: OperationOutputContract;
74
+ /** Accepted input shape for `model.query`. */
75
+ export declare const MODEL_QUERY_INPUT_SCHEMA: JsonSchema;
76
+ /** Schema-first INPUT contract for `model.query`. */
77
+ export declare const modelQueryInputContract: OperationInputContract<Record<string, unknown>>;
78
+ /** OUTPUT contract for `model.query` — catalog model views. */
79
+ export declare const modelQueryOutputContract: OperationOutputContract;
80
+ /** Accepted input shape for `model.show`. */
81
+ export declare const MODEL_SHOW_INPUT_SCHEMA: JsonSchema;
82
+ /** Schema-first INPUT contract for `model.show`. */
83
+ export declare const modelShowInputContract: OperationInputContract<Record<string, unknown>>;
84
+ /** OUTPUT contract for `model.show` — one catalog model. */
85
+ export declare const modelShowOutputContract: OperationOutputContract;
86
+ /** Accepted input shape for `profile.create`. */
87
+ export declare const PROFILE_CREATE_INPUT_SCHEMA: JsonSchema;
88
+ /** Schema-first INPUT contract for `profile.create`. */
89
+ export declare const profileCreateInputContract: OperationInputContract<Record<string, unknown>>;
90
+ /** OUTPUT contract for `profile.create` — the persisted binding. */
91
+ export declare const profileCreateOutputContract: OperationOutputContract;
92
+ /** Accepted input shape for `profile.list`. */
93
+ export declare const PROFILE_LIST_INPUT_SCHEMA: JsonSchema;
94
+ /** Schema-first INPUT contract for `profile.list`. */
95
+ export declare const profileListInputContract: OperationInputContract<Record<string, unknown>>;
96
+ /** OUTPUT contract for `profile.list` — named binding views. */
97
+ export declare const profileListOutputContract: OperationOutputContract;
98
+ /** Accepted input shape for `profile.pin`. */
99
+ export declare const PROFILE_PIN_INPUT_SCHEMA: JsonSchema;
100
+ /** Schema-first INPUT contract for `profile.pin`. */
101
+ export declare const profilePinInputContract: OperationInputContract<Record<string, unknown>>;
102
+ /** OUTPUT contract for `profile.pin` — the role→profile binding. */
103
+ export declare const profilePinOutputContract: OperationOutputContract;
104
+ /** Accepted input shape for `profile.use`. */
105
+ export declare const PROFILE_USE_INPUT_SCHEMA: JsonSchema;
106
+ /** Schema-first INPUT contract for `profile.use`. */
107
+ export declare const profileUseInputContract: OperationInputContract<Record<string, unknown>>;
108
+ /** OUTPUT contract for `profile.use` — the default-profile binding. */
109
+ export declare const profileUseOutputContract: OperationOutputContract;
110
+ //# sourceMappingURL=entities.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"entities.d.ts","sourceRoot":"","sources":["../../src/operations/entities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAoCpE,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,EAAE,UA2BtC,CAAC;AAEF,qDAAqD;AACrD,eAAO,MAAM,uBAAuB,EAAE,sBAAsB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAenF,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,wBAAwB,EAAE,uBAoBtC,CAAC;AAMF,+CAA+C;AAC/C,eAAO,MAAM,yBAAyB,EAAE,UAUvC,CAAC;AAEF,sDAAsD;AACtD,eAAO,MAAM,wBAAwB,EAAE,sBAAsB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWpF,CAAC;AAEF,mEAAmE;AACnE,eAAO,MAAM,yBAAyB,EAAE,uBAsBvC,CAAC;AAMF,iDAAiD;AACjD,eAAO,MAAM,2BAA2B,EAAE,UAQzC,CAAC;AAEF,wDAAwD;AACxD,eAAO,MAAM,0BAA0B,EAAE,sBAAsB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUtF,CAAC;AAEF,kEAAkE;AAClE,eAAO,MAAM,2BAA2B,EAAE,uBAkBzC,CAAC;AAyBF,gDAAgD;AAChD,eAAO,MAAM,0BAA0B,EAAE,UAKxC,CAAC;AAEF,uDAAuD;AACvD,eAAO,MAAM,yBAAyB,EAAE,sBAAsB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAIrF,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,0BAA0B,EAAE,uBAiBxC,CAAC;AAMF,gDAAgD;AAChD,eAAO,MAAM,0BAA0B,EAAE,UAWxC,CAAC;AAEF,uDAAuD;AACvD,eAAO,MAAM,yBAAyB,EAAE,sBAAsB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAOrF,CAAC;AAEF,uFAAuF;AACvF,eAAO,MAAM,0BAA0B,EAAE,uBAcxC,CAAC;AAMF,mDAAmD;AACnD,eAAO,MAAM,6BAA6B,EAAE,UAoB3C,CAAC;AAEF,0DAA0D;AAC1D,eAAO,MAAM,4BAA4B,EAAE,sBAAsB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUxF,CAAC;AAEF,gFAAgF;AAChF,eAAO,MAAM,6BAA6B,EAAE,uBAmB3C,CAAC;AAuBF,8CAA8C;AAC9C,eAAO,MAAM,wBAAwB,EAAE,UActC,CAAC;AAEF,qDAAqD;AACrD,eAAO,MAAM,uBAAuB,EAAE,sBAAsB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWnF,CAAC;AAEF,+DAA+D;AAC/D,eAAO,MAAM,wBAAwB,EAAE,uBActC,CAAC;AAMF,6CAA6C;AAC7C,eAAO,MAAM,uBAAuB,EAAE,UAOrC,CAAC;AAEF,oDAAoD;AACpD,eAAO,MAAM,sBAAsB,EAAE,sBAAsB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUlF,CAAC;AAEF,4DAA4D;AAC5D,eAAO,MAAM,uBAAuB,EAAE,uBAarC,CAAC;AAMF,iDAAiD;AACjD,eAAO,MAAM,2BAA2B,EAAE,UAyBzC,CAAC;AAEF,wDAAwD;AACxD,eAAO,MAAM,0BAA0B,EAAE,sBAAsB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAetF,CAAC;AAEF,oEAAoE;AACpE,eAAO,MAAM,2BAA2B,EAAE,uBA+BzC,CAAC;AAMF,+CAA+C;AAC/C,eAAO,MAAM,yBAAyB,EAAE,UAKvC,CAAC;AAEF,sDAAsD;AACtD,eAAO,MAAM,wBAAwB,EAAE,sBAAsB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAIpF,CAAC;AAEF,gEAAgE;AAChE,eAAO,MAAM,yBAAyB,EAAE,uBA+BvC,CAAC;AAMF,8CAA8C;AAC9C,eAAO,MAAM,wBAAwB,EAAE,UAYtC,CAAC;AAEF,qDAAqD;AACrD,eAAO,MAAM,uBAAuB,EAAE,sBAAsB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUnF,CAAC;AAEF,oEAAoE;AACpE,eAAO,MAAM,wBAAwB,EAAE,uBAetC,CAAC;AAMF,8CAA8C;AAC9C,eAAO,MAAM,wBAAwB,EAAE,UAWtC,CAAC;AAEF,qDAAqD;AACrD,eAAO,MAAM,uBAAuB,EAAE,sBAAsB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMnF,CAAC;AAEF,uEAAuE;AACvE,eAAO,MAAM,wBAAwB,EAAE,uBAgBtC,CAAC"}