@cleocode/contracts 2026.6.13 → 2026.6.14

package/src/dispatch/identity.ts

@@ -104,6 +104,26 @@ export const CANONICAL_DOMAINS = [
   // regression emits ONE leased `selfimprove_dhq` row + ONE DRAFT PR. Default
   // OFF (requires --execute); the engine lives in CORE (P5 self-improvement spec).
   'selfimprove',
+  // T11939 (epic T11765 · M2): 'cleo service auth-url|exchange|refresh|self-heal'
+  // — the universal service-vault OAuth flow. auth-url builds a PKCE auth URL;
+  // exchange persists encrypted tokens; refresh/self-heal renew them honoring the
+  // per-provider RefreshConfig. The flow lives in CORE (store/service-oauth.ts),
+  // driven by the declarative SERVICE_PROVIDERS registry (contracts).
+  'service',
+  // T11700 (epic T11666 · M3 · North-Star §2): the 5-entity provider experience —
+  // the addressable Provider / Alias / Account / Model / Profile surface.
+  //   'account'  — 'cleo account add|list|remove' (the credential pool; add is
+  //                secret-bearing/cli-only, MCP-default-denied).
+  //   'provider' — 'cleo provider list|show|connect' (the declarative providers
+  //                table #1039 + alias resolution; connect is secret-bearing).
+  //   'model'    — 'cleo model query|show' (the models_catalog table #1037; QUERY-ONLY).
+  //   'profile'  — 'cleo profile create|list|pin|use' (the named account+model
+  //                binding persisted into llm.profiles[name], the resolver SSoT).
+  // Each dispatches to the CORE entity-ops layer (llm/entity-ops.ts).
+  'account',
+  'provider',
+  'model',
+  'profile',
 ] as const;
 
 /**

package/src/dispatch/operation-def.ts

@@ -95,6 +95,27 @@ export interface OperationDef {
    */
   mcpExposed?: boolean;
 
+  /**
+   * Whether this operation is a **streaming** operation served over the gateway
+   * HTTP/SSE transport as `GET /v1/<domain>/<operation>` (T11921).
+   *
+   * **Default-deny**: absent / `false` means the operation is unary only — it is
+   * dispatched via the POST path and returns a single LAFS envelope. When
+   * `streaming: true`, the `/v1` HTTP listener routes a `GET` to the same
+   * `(domain, operation)` pair through {@link createSseStream}, emitting a
+   * sequence of `GatewayStreamEvent` frames (`data` … terminated by `done` or
+   * `error`) over a `text/event-stream` body. This is the realtime transport the
+   * Studio Kanban (T11929) and Pi-TUI (T11936) consume.
+   *
+   * A streaming op is still a normal registry entry (it has a `gateway`, a
+   * `domain`, an `operation`, a `tier`), so it co-exists with the unary POST
+   * routes and is discoverable by every existing registry helper — only the wire
+   * framing (a long-lived SSE body vs a single JSON response) differs.
+   *
+   * @task T11921 — gateway SSE streaming on `/v1`
+   */
+  streaming?: boolean;
+
   /**
    * Schema-first INPUT contract for this operation (DHQ-033 / T11692).
    *