@cleocode/contracts 2026.6.12 → 2026.6.14

package/src/index.ts

@@ -140,12 +140,14 @@ export type {
 export type {
   BoundaryEntry,
   CanonicalHome,
+  ChannelBoundaryEntry,
+  ChannelTrustPosture,
   PerfBudget,
   SafetyBudget,
   ThroughputThreshold,
   WorkloadIntent,
 } from './boundary.js';
-export { BOUNDARY_REGISTRY } from './boundary.js';
+export { BOUNDARY_REGISTRY, CHANNEL_BOUNDARY_REGISTRY } from './boundary.js';
 // === Brain/Memory Types ===
 export type {
   BackupRecoverBrainResult,
@@ -213,6 +215,11 @@ export type {
 } from './code-symbol.js';
 // === Conduit Protocol (agent-to-agent communication) ===
 export type {
+  ChannelAdapter,
+  ChannelConfig,
+  ChannelHealth,
+  ChannelHealthStatus,
+  ChannelSession,
   Conduit,
   ConduitConfig,
   ConduitMessage,
@@ -223,6 +230,8 @@ export type {
   ConduitTopicPublishOptions,
   ConduitTopicSubscribeOptions,
   ConduitUnsubscribe,
+  InboundMsg,
+  OutboundReply,
 } from './conduit.js';
 // === Config Manifest (T9876 / Saga T9855) ===
 export type {
@@ -264,6 +273,7 @@ export type {
   LlmConfig,
   LlmDefaultConfig,
   LlmProfileConfig,
+  LlmProfileTier,
   LlmProfileTuning,
   LlmProviderEntry,
   LlmProviderTransport,
@@ -282,6 +292,7 @@ export type {
   SharingMode,
   SignalDockConfig,
   SignalDockMode,
+  SystemBinding,
 } from './config.js';
 export type { AdapterContextMonitorProvider } from './context-monitor.js';
 // === Claude Code credential parsing (T9307 — pure helper, no core imports) ===
@@ -739,6 +750,87 @@ export {
   isLafsError,
   isLafsSuccess,
 } from './lafs.js';
+// === Lease-IPC v1.1 (PARALLEL DbWriterLease contract — T11627 · SG-RUNTIME-UNIFICATION) ===
+export type {
+  ChildKilledUnresponsiveResponse,
+  LeaseAcquireRequest,
+  LeaseDeniedResponse,
+  LeaseErrorResponse,
+  LeaseGrantedResponse,
+  LeaseIpcEnvelope,
+  LeaseIpcRequest,
+  LeaseIpcRequestEnvelope,
+  LeaseIpcResponse,
+  LeaseIpcResponseEnvelope,
+  LeaseLane,
+  LeaseQueuedResponse,
+  LeaseReleaseRequest,
+  LeaseRenewRequest,
+  LeaseRevokedResponse,
+  LeaseScope,
+  QueueAdmitDisposition,
+  QueueAdmitRequest,
+  QueueAdmitResultResponse,
+  QueuePriorityClass,
+  RateCheckRequest,
+  RateResultResponse,
+  ToolGrantedResponse,
+  ToolGrantRequest,
+} from './lease-ipc/index.js';
+export {
+  ChildKilledUnresponsiveResponseSchema,
+  isFrozenLeaseIpcVersion,
+  LEASE_IPC_MESSAGE_KINDS,
+  LEASE_IPC_PROTOCOL_VERSION,
+  LEASE_IPC_REQUEST_KINDS,
+  LEASE_IPC_RESPONSE_KINDS,
+  LeaseAcquireRequestSchema,
+  LeaseDeniedResponseSchema,
+  LeaseErrorResponseSchema,
+  LeaseGrantedResponseSchema,
+  LeaseIpcEnvelopeSchema,
+  LeaseIpcRequestEnvelopeSchema,
+  LeaseIpcRequestSchema,
+  LeaseIpcResponseEnvelopeSchema,
+  LeaseIpcResponseSchema,
+  LeaseLaneSchema,
+  LeaseQueuedResponseSchema,
+  LeaseReleaseRequestSchema,
+  LeaseRenewRequestSchema,
+  LeaseRevokedResponseSchema,
+  LeaseScopeSchema,
+  QueueAdmitDispositionSchema,
+  QueueAdmitRequestSchema,
+  QueueAdmitResultResponseSchema,
+  QueuePriorityClassSchema,
+  RateCheckRequestSchema,
+  RateResultResponseSchema,
+  ToolGrantedResponseSchema,
+  ToolGrantRequestSchema,
+} from './lease-ipc/index.js';
+export type {
+  CatalogAuthType,
+  CatalogModelEntry,
+  CatalogModelStatus,
+  CatalogProvider,
+  CuratedCatalog,
+  ModelsCatalogRowInsert,
+  ModelsCatalogRowSelect,
+} from './llm/catalog-schema.js';
+// === E8 Curated Models Catalog (T11731 · offline-first catalog SSoT) ===
+export {
+  CATALOG_AUTH_TYPES,
+  CATALOG_MODEL_STATUSES,
+  catalogCostSchema,
+  catalogLimitSchema,
+  catalogModalitiesSchema,
+  catalogModelEntrySchema,
+  catalogModelProviderSchema,
+  catalogProviderSchema,
+  curatedCatalogSchema,
+  modelsCatalogRowInsertSchema,
+  modelsCatalogRowSelectSchema,
+} from './llm/catalog-schema.js';
 // === LLM Error Taxonomy (T9270 — Hermes FailoverReason port) ===
 export type { ClassifiedError, FailoverReason } from './llm/failover-reason.js';
 // === Phase 4 Unified Architecture (T9281 / ADR-072) — Session + Executor interfaces ===
@@ -774,6 +866,14 @@ export type {
 } from './llm/normalized-response.js';
 // === OAuth types — SSoT shared between core and cleo (T9302) ===
 export type { OAuthMode, OAuthTokens, PkceFlowConfig, ProviderOAuthConfig } from './llm/oauth.js';
+// === Onboarding login engine result envelope (T11724 · M3) ===
+export type {
+  OnboardingAuthMode,
+  OnboardingResult,
+  OnboardingStepName,
+  OnboardingStepResult,
+  OnboardingStepStatus,
+} from './llm/onboarding.js';
 // === Phase 4/5 Plugin LLM facade types (T9305 / T9313) ===
 export type { PluginLlmComplete, PluginLlmContext } from './llm/plugin-llm.js';
 export {
@@ -782,6 +882,23 @@ export {
   PluginModelGateError,
   PluginRateLimitedError,
 } from './llm/plugin-llm.js';
+export type {
+  AiSdkEndpoint,
+  AnthropicMessagesEndpoint,
+  OAuthFlowDef,
+  OpenAICompletionsEndpoint,
+  OpenAIResponsesEndpoint,
+  ProviderDef,
+  ProviderEndpoint,
+  ProviderTransport,
+  RequestQuirk,
+  RequestQuirkKind,
+} from './llm/provider-def.js';
+// === M3 Provider SSoT (T11702 · epic T11667) — declarative ProviderDef ===
+export {
+  PROVIDER_TRANSPORTS,
+  REQUEST_QUIRK_KINDS,
+} from './llm/provider-def.js';
 // === Phase 4 Unified Architecture (T9281 / ADR-072) — Provider identity ===
 export type { ApiMode, BuiltinProviderId, ProviderId } from './llm/provider-id.js';
 // === Provider Profile + Plugin Contracts (T9262 — Phase 3 T-LLM-CRED) ===
@@ -794,10 +911,42 @@ export type {
 export type { ResolvedCredential } from './llm/resolved-credential.js';
 // === E9 SSoT resolution descriptor (T11745 / T11761) ===
 export type { ModelCaps, ResolvedLLMDescriptor } from './llm/resolved-descriptor.js';
+// === E10 Sealed credential handle (T11752 / T11746) — on-demand decrypt at the wire ===
+export type { DecryptedToken, SealedCredential } from './llm/sealed-credential.js';
+// === E9 System-of-Use taxonomy + registry (T11747 · hermes _AUX_TASKS analog) ===
+export type {
+  AuxSystem,
+  AuxSystemId,
+  CantbookNodeSystem,
+  OpenSystemKind,
+  OrchestrationSystem,
+  RegisteredSystemOfUse,
+  RoleSystem,
+  SkillSystem,
+  SpawnUnitSystem,
+  SystemOfUse,
+  SystemOfUseDefaults,
+  SystemOfUseKind,
+  SystemOfUsePickerEntry,
+  ToolSystem,
+  WhoamiRoleId,
+} from './llm/system-of-use.js';
+export {
+  AUX_SYSTEM_IDS,
+  BUILTIN_SYSTEMS_OF_USE,
+  isBuiltinSystemOfUse,
+  isOpenSystemKind,
+  isSystemOfUse,
+  OPEN_SYSTEM_KEY_PREFIXES,
+  ORCHESTRATION_TIER_IDS,
+  ROLE_SYSTEM_IDS,
+  WHOAMI_ROLE_IDS,
+} from './llm/system-of-use.js';
 // === E9 System-of-Use chokepoint contract (T11749) ===
 export type {
   ResolveLLMForSystemOptions,
-  SystemOfUse,
+  SystemOfUseLabel,
+  SystemResolverInput,
 } from './llm/system-resolver.js';
 export { SYSTEM_ROLE_MAP } from './llm/system-resolver.js';
 // === Logger contract (T9766 — centralized from @cleocode/core) ===
@@ -961,10 +1110,19 @@ export type {
   AdminBackupListParams,
   AdminBackupMutateParams,
   AdminCleanupParams,
+  AdminConfigGetParams,
+  AdminConfigGetResult,
+  AdminConfigListParams,
+  AdminConfigListResult,
   AdminConfigPresetsParams,
+  AdminConfigScope,
   AdminConfigSetParams,
   AdminConfigSetPresetParams,
   AdminConfigShowParams,
+  AdminConfigUnsetParams,
+  AdminConfigUnsetResult,
+  AdminConfigValidateParams,
+  AdminConfigValidateResult,
   AdminContextInjectParams,
   AdminContextParams,
   AdminContextPullParams,
@@ -1045,6 +1203,49 @@ export {
   type DocsLifecycleStatus,
   type DocsUpdateParams,
 } from './operations/docs.js';
+// === Ensures-schema Zod registry (T11762 ST-1 / T11900 — cantbook ensures.schema SSoT) ===
+// Named Zod validators for cantbook `ensures.schema` shapes (task_tree, evidence)
+// + the registry DATA. Bodied accessors live in @cleocode/core (ST-1b) to keep
+// contracts Gate-10-pure. The runtime resolves a schema name → validator here
+// instead of hardcoding `if (schema === 'task_tree') … else if (=== 'evidence')`.
+export type { EnsuresSchemaSpec } from './operations/ensures-schema-registry.js';
+export {
+  ENSURES_SCHEMA_REGISTRY,
+  evidenceSchema,
+  LEGACY_PASSTHROUGH_SCHEMA_NAMES,
+  passthroughSchema,
+  taskTreeEntrySchema,
+  taskTreeSchema,
+} from './operations/ensures-schema-registry.js';
+// 5-entity provider-experience op contracts (T11700 · epic T11666) — INPUT
+// contracts consumed by core's INPUT_CONTRACTS registry; OUTPUT contracts already
+// register into OUTPUT_CONTRACTS above.
+export {
+  accountAddInputContract,
+  accountAddOutputContract,
+  accountListInputContract,
+  accountListOutputContract,
+  accountRemoveInputContract,
+  accountRemoveOutputContract,
+  modelQueryInputContract,
+  modelQueryOutputContract,
+  modelShowInputContract,
+  modelShowOutputContract,
+  profileCreateInputContract,
+  profileCreateOutputContract,
+  profileListInputContract,
+  profileListOutputContract,
+  profilePinInputContract,
+  profilePinOutputContract,
+  profileUseInputContract,
+  profileUseOutputContract,
+  providerConnectInputContract,
+  providerConnectOutputContract,
+  providerListInputContract,
+  providerListOutputContract,
+  providerShowInputContract,
+  providerShowOutputContract,
+} from './operations/entities.js';
 // === Operations Types (API wire format, namespaced to avoid collision with domain types) ===
 export * as ops from './operations/index.js';
 // === Operation Input Contracts (T9914 / Saga T9855 / E7) ===
@@ -1091,6 +1292,7 @@ export type {
 // === LLM Credential + Role-Resolver Wire Types (T-LLM-CRED Phase 1/2 — T9255) ===
 export type {
   AuthTypeWire,
+  CredentialMetadataWire,
   CredentialResultWire,
   CredentialSourceWire,
   CredentialsStoreStrategyWire,
@@ -1110,6 +1312,8 @@ export type {
   LlmRemoveResult,
   LlmStatusResult,
   LlmStoredCredentialView,
+  LlmSystemsOfUseParams,
+  LlmSystemsOfUseResult,
   LlmTestParams,
   LlmTestResult,
   LlmUseParams,
@@ -1372,6 +1576,19 @@ export type {
   ProposeRunResult,
   SentientOps,
 } from './operations/sentient.js';
+// Service-vault CLI op contracts (T11941 · epic T11765 · M2-W4) — INPUT contracts
+// consumed by core's INPUT_CONTRACTS registry; OUTPUT contracts already register
+// into OUTPUT_CONTRACTS above.
+export {
+  serviceConnectInputContract,
+  serviceConnectOutputContract,
+  serviceListInputContract,
+  serviceListOutputContract,
+  serviceRevokeInputContract,
+  serviceRevokeOutputContract,
+  serviceStatusInputContract,
+  serviceStatusOutputContract,
+} from './operations/service.js';
 // Session operation param/result types — re-exported at top level for typed-dispatch consumers
 // (T975 Wave D · ADR-051 migration)
 export type {
@@ -1550,8 +1767,6 @@ export type {
   ValidateCanonDocsResult,
   ValidateCanonParams,
   ValidateCanonResult,
-  ValidateChainParams,
-  ValidateChainResult,
   ValidateCoherenceParams,
   ValidateCoherenceResult,
   ValidateComplianceRecordParams,
@@ -1658,6 +1873,7 @@ export type {
   PlaybookDefinition,
   PlaybookDeterministicNode,
   PlaybookEdge,
+  PlaybookEdgeCondition,
   PlaybookEnsures,
   PlaybookErrorHandler,
   PlaybookInput,
@@ -2220,12 +2436,6 @@ export {
   TEMPLATE_UPDATE_STRATEGIES,
   TemplateManifestEntrySchema,
 } from './templates/manifest.js';
-// === Tessera Types ===
-export type {
-  TesseraInstantiationInput,
-  TesseraTemplate,
-  TesseraVariable,
-} from './tessera.js';
 export type { FetchBrainEntriesInput, FetchBrainEntriesOutput } from './tools/brain-fetch.js';
 export type { ObserveBrainInput, ObserveBrainOutput } from './tools/brain-observe.js';
 // === SDK Tool Contracts (T10068 / T10070 / T9835) ===
@@ -2291,21 +2501,26 @@ export {
   validatorRejectionSchema,
   validatorVerdictSchema,
 } from './validator/index.js';
-// === WarpChain Types ===
-export type {
-  ChainShape,
-  ChainValidation,
-  GateCheck,
-  GateContract,
-  GateName,
-  GateResult,
-  ProtocolType,
-  WarpChain,
-  WarpChainExecution,
-  WarpChainInstance,
-  WarpLink,
-  WarpStage,
-} from './warp-chain.js';
+// === Universal Service Vault — declarative service-provider registry (T11937 seed + T11938 breadth, epic T11765) ===
+export type {
+  CredentialHeaderRule,
+  HostAuthStrategy,
+  InjectionRule,
+  InjectionValueSource,
+  MetadataHeaderRule,
+  RefreshBodyFormat,
+  RefreshClientAuth,
+  RefreshConfig,
+  RefreshKind,
+  ServiceAuthKind,
+  ServiceHostRule,
+  ServiceProviderDef,
+} from './vault/service-provider.js';
+export {
+  REFRESH_KINDS,
+  SERVICE_AUTH_KINDS,
+  SERVICE_PROVIDERS,
+} from './vault/service-provider.js';
 export type {
   TasksFrontierParamsInput,
   TasksRollupParamsInput,