@cleocode/contracts 2026.6.13 → 2026.6.14

package/dist/dispatch/operations-registry.js

@@ -9,6 +9,8 @@
  * @since SG-ARCH-SOLID Saga T9831 · E-CLI-BOUNDARY T9833 · T10061
  */
 import { DOCS_LIFECYCLE_STATUSES } from '../operations/docs.js';
+import { OUTPUT_CONTRACTS } from '../operations/output-contracts-data.js';
+import { tasksUpdateInputContract } from '../operations/tasks.js';
 // ---------------------------------------------------------------------------
 // Builder helpers
 // ---------------------------------------------------------------------------
@@ -231,6 +233,38 @@ export const OPERATIONS = [
             },
         ],
     },
+    // T11785 (epic T11556 · E1-GATEWAY-CRUD) — the FIRST streaming task op. Served
+    // as `GET /v1/tasks/subscribe` → a `text/event-stream` body of
+    // `GatewayStreamEvent` frames (task/board created/updated/deleted lifecycle
+    // events), scoped to an optional saga/parent root. Studio's interactive Kanban
+    // (T11929) and the Pi-TUI board consume it for live updates. The default
+    // source ships a bounded heartbeat producer (stream-sources.ts); the daemon
+    // injects its real origin-tailing source via `registerStreamSource`.
+    {
+        gateway: 'query',
+        domain: 'tasks',
+        operation: 'subscribe',
+        description: 'tasks.subscribe (query, streaming) — SSE stream of task/board lifecycle events (created/updated/deleted), optionally scoped to a saga/parent root',
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        streaming: true,
+        requiredParams: [],
+        params: [
+            {
+                name: 'root',
+                type: 'string',
+                required: false,
+                description: 'Optional saga/parent task ID to scope the event stream to (omit for the whole board)',
+            },
+            {
+                name: 'ticks',
+                type: 'number',
+                required: false,
+                description: 'Maximum number of event frames to emit before the terminal `done` frame (default: open-ended until client disconnect)',
+            },
+        ],
+    },
     {
         gateway: 'query',
         domain: 'tasks',
@@ -771,6 +805,30 @@ export const OPERATIONS = [
         requiredParams: [],
         params: [],
     },
+    // T11921 — gateway SSE streaming on /v1. The agent/worker/board event stream
+    // the Studio Kanban (T11929) + Pi-TUI (T11936) consume as a realtime
+    // transport. Served as `GET /v1/orchestrate/events` → a `text/event-stream`
+    // body of `GatewayStreamEvent` frames terminated by a `done` frame, NOT as a
+    // unary POST. Secrets never touch the wire — the source resolves server-side.
+    {
+        gateway: 'query',
+        domain: 'orchestrate',
+        operation: 'events',
+        description: 'orchestrate.events (query, streaming) — SSE stream of agent/worker/board lifecycle events',
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        streaming: true,
+        requiredParams: [],
+        params: [
+            {
+                name: 'ticks',
+                type: 'number',
+                required: false,
+                description: 'Maximum number of event frames to emit before the terminal `done` frame (default: open-ended until client disconnect)',
+            },
+        ],
+    },
     // T811 — IVTR multi-agent enforcement
     {
         gateway: 'query',
@@ -1718,6 +1776,70 @@ export const OPERATIONS = [
         requiredParams: [],
         params: [],
     },
+    {
+        gateway: 'query',
+        domain: 'admin',
+        operation: 'config.get',
+        description: 'admin.config.get (query) — resolve a single config value via the ConfigManifest cascade (T11917)',
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ['key'],
+        params: [
+            {
+                name: 'key',
+                type: 'string',
+                required: true,
+                description: 'Dot-notation config key to read (e.g. "release.branchModel")',
+                cli: { positional: true },
+            },
+            {
+                name: 'scope',
+                type: 'string',
+                required: false,
+                description: 'Cascade slice to read from. Defaults to merged.',
+                enum: ['global', 'project', 'merged'],
+            },
+        ],
+    },
+    {
+        gateway: 'query',
+        domain: 'admin',
+        operation: 'config.list',
+        description: 'admin.config.list (query) — resolve the full config cascade and its flattened keys (T11917)',
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [
+            {
+                name: 'scope',
+                type: 'string',
+                required: false,
+                description: 'Cascade slice to project. Defaults to merged.',
+                enum: ['global', 'project', 'merged'],
+            },
+        ],
+    },
+    {
+        gateway: 'query',
+        domain: 'admin',
+        operation: 'config.validate',
+        description: 'admin.config.validate (query) — schema-validate a scoped config file via its manifest entry (T11917)',
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [
+            {
+                name: 'scope',
+                type: 'string',
+                required: false,
+                description: 'Scope to validate (global or project). Defaults to project.',
+                enum: ['global', 'project'],
+            },
+        ],
+    },
     {
         gateway: 'query',
         domain: 'admin',
@@ -2387,10 +2509,18 @@ export const OPERATIONS = [
         ],
     },
     {
+        // T11784 (epic T11556 · E1-GATEWAY-CRUD) — the OperationDef.params used to
+        // declare ONLY `taskId`, so every other mutable field a Studio form binds
+        // to was invisible to dispatch introspection (`cleo update --describe`, the
+        // SDK `describeOperation`) and silently dropped at the dispatch boundary.
+        // The full mutable-field set is now enumerated here, grounded in
+        // {@link TasksUpdateQueryParams} / {@link TASKS_UPDATE_INPUT_SCHEMA}; a
+        // regression test (operations-registry tasks-update parity) asserts the
+        // param names stay in sync with the schema's `properties`.
         gateway: 'mutate',
         domain: 'tasks',
         operation: 'update',
-        description: 'tasks.update (mutate)',
+        description: 'tasks.update (mutate) — partial update; only supplied fields are mutated',
         tier: 0,
         idempotent: false,
         sessionRequired: false,
@@ -2400,10 +2530,183 @@ export const OPERATIONS = [
                 name: 'taskId',
                 type: 'string',
                 required: true,
-                description: 'taskId parameter',
+                description: 'Task ID to update',
                 cli: { positional: true },
             },
+            { name: 'title', type: 'string', required: false, description: 'New title (3–500 chars)' },
+            {
+                name: 'description',
+                type: 'string',
+                required: false,
+                description: 'New description',
+                cli: { flag: 'description', short: '-d' },
+            },
+            {
+                name: 'status',
+                type: 'string',
+                required: false,
+                description: 'New status',
+                enum: ['pending', 'active', 'blocked', 'done', 'cancelled'],
+                cli: { flag: 'status', short: '-s' },
+            },
+            {
+                name: 'priority',
+                type: 'string',
+                required: false,
+                description: 'New priority (orthogonal to severity)',
+                enum: ['low', 'medium', 'high', 'critical'],
+                cli: { flag: 'priority', short: '-p' },
+            },
+            { name: 'notes', type: 'string', required: false, description: 'Append a note entry' },
+            {
+                name: 'labels',
+                type: 'array',
+                required: false,
+                description: 'Replace labels (comma-separated)',
+                cli: { flag: 'labels', short: '-l' },
+            },
+            {
+                name: 'addLabels',
+                type: 'array',
+                required: false,
+                description: 'Add labels incrementally',
+            },
+            {
+                name: 'removeLabels',
+                type: 'array',
+                required: false,
+                description: 'Remove labels incrementally',
+            },
+            {
+                name: 'depends',
+                type: 'array',
+                required: false,
+                description: 'Replace dependency task IDs',
+                cli: { flag: 'depends', short: '-D' },
+            },
+            {
+                name: 'addDepends',
+                type: 'array',
+                required: false,
+                description: 'Add dependency task IDs incrementally',
+            },
+            {
+                name: 'removeDepends',
+                type: 'array',
+                required: false,
+                description: 'Remove dependency task IDs incrementally',
+            },
+            {
+                name: 'acceptance',
+                type: 'array',
+                required: false,
+                description: 'Replace acceptance criteria (pipe-separated)',
+            },
+            {
+                name: 'parent',
+                type: 'string',
+                required: false,
+                description: 'Set parent task ID (null/empty promotes to root)',
+            },
+            {
+                name: 'type',
+                type: 'string',
+                required: false,
+                description: 'New hierarchy type',
+                enum: ['saga', 'epic', 'task', 'subtask'],
+                cli: { flag: 'type', short: '-t' },
+            },
+            {
+                name: 'size',
+                type: 'string',
+                required: false,
+                description: 'New scope-size estimate',
+                enum: ['small', 'medium', 'large'],
+            },
+            {
+                name: 'files',
+                type: 'array',
+                required: false,
+                description: 'Replace associated file paths',
+            },
+            {
+                name: 'addFiles',
+                type: 'array',
+                required: false,
+                description: 'Add file paths incrementally',
+            },
+            {
+                name: 'removeFiles',
+                type: 'array',
+                required: false,
+                description: 'Remove file paths incrementally',
+            },
+            {
+                name: 'pipelineStage',
+                type: 'string',
+                required: false,
+                description: 'Set pipeline stage (forward-only)',
+            },
+            {
+                name: 'kind',
+                type: 'string',
+                required: false,
+                description: 'Task kind / intent axis (orthogonal to type)',
+                enum: ['work', 'research', 'experiment', 'bug', 'spike', 'release'],
+            },
+            {
+                name: 'scope',
+                type: 'string',
+                required: false,
+                description: 'Task scope / granularity axis',
+                enum: ['project', 'feature', 'unit'],
+            },
+            {
+                name: 'severity',
+                type: 'string',
+                required: false,
+                description: 'Severity level (orthogonal to priority)',
+                enum: ['P0', 'P1', 'P2', 'P3'],
+            },
+            {
+                name: 'reason',
+                type: 'string',
+                required: false,
+                description: 'Operator override reason for the AC-immutability guard',
+            },
+            {
+                name: 'dependsWaiver',
+                type: 'string',
+                required: false,
+                description: 'Justification to waive the critical-priority --depends requirement',
+            },
+            {
+                name: 'clearBlockedBy',
+                type: 'boolean',
+                required: false,
+                description: 'Clear the free-text blockedBy reason',
+            },
+            {
+                name: 'relates',
+                type: 'array',
+                required: false,
+                description: 'Replace related-task edges ({taskId, type, reason?})',
+            },
+            {
+                name: 'addRelates',
+                type: 'array',
+                required: false,
+                description: 'Add related-task edges without overwriting existing',
+            },
+            {
+                name: 'removeRelates',
+                type: 'array',
+                required: false,
+                description: 'Remove related-task edges by taskId',
+            },
         ],
+        inputSchema: tasksUpdateInputContract,
+        outputSchema: OUTPUT_CONTRACTS['tasks.update'],
     },
     {
         gateway: 'mutate',
@@ -2547,96 +2850,184 @@ export const OPERATIONS = [
             },
         ],
     },
+    // T11786 (epic T11556 · E1-GATEWAY-CRUD) — bulk task mutate ops the Studio
+    // interactive Kanban (M6) binds to: within-column re-rank, atomic multi-move,
+    // and first-class assignee (distinct from the agent claim lock).
     {
         gateway: 'mutate',
         domain: 'tasks',
-        operation: 'relates.add',
-        description: 'tasks.relates.add (mutate)',
+        operation: 'reorder-rank',
+        description: 'tasks.reorder-rank (mutate) — within-column positional re-rank from an explicit top-to-bottom task-ID order (Kanban drag-reorder)',
         tier: 1,
         idempotent: false,
         sessionRequired: false,
-        requiredParams: ['taskId', 'type'],
+        requiredParams: ['orderedIds'],
         params: [
             {
-                name: 'taskId',
-                type: 'string',
-                required: true,
-                description: 'taskId parameter',
-                cli: { positional: true },
-            },
-            {
-                name: 'type',
-                type: 'string',
+                name: 'orderedIds',
+                type: 'array',
                 required: true,
-                description: 'type parameter',
+                description: 'Ordered task IDs describing the desired top-to-bottom column order; each task position is set to its 1-based index',
             },
         ],
+        outputSchema: OUTPUT_CONTRACTS['tasks.reorder-rank'],
     },
     {
-        // T11575 — the handler (dispatch/domains/tasks.ts 'relates.add-batch') and
-        // CLI command (cli/commands/relates.ts add-batch) shipped, but no
-        // OperationDef existed here, so `resolve()` returned undefined and the
-        // dispatcher rejected the call with E_INVALID_OPERATION before it ever
-        // reached the handler. Registering the op (gateway:'mutate') closes the gap.
         gateway: 'mutate',
         domain: 'tasks',
-        operation: 'relates.add-batch',
-        description: 'tasks.relates.add-batch (mutate) — bulk-add advisory relation edges from a JSON payload ({relations:[...]} or {edges:[...]}); use dryRun to preview without writing.',
+        operation: 'bulk-move',
+        description: 'tasks.bulk-move (mutate) — atomically move N tasks to a new status and/or pipeline stage in a single transaction (Kanban multi-card column move)',
         tier: 1,
         idempotent: false,
         sessionRequired: false,
-        // Neither `relations` nor `edges` is individually required — the handler
-        // accepts either shape and validates emptiness in core — so no param is
-        // declared required at the dispatch boundary.
-        requiredParams: [],
+        requiredParams: ['taskIds'],
         params: [
             {
-                name: 'relations',
-                type: 'array',
-                required: false,
-                description: 'Array of relation edges ({from|taskId, to|relatedId, type, reason})',
-            },
-            {
-                name: 'edges',
+                name: 'taskIds',
                 type: 'array',
-                required: false,
-                description: 'Alias for `relations` — array of relation edges',
+                required: true,
+                description: 'Task IDs to move (all-or-nothing; any failure rolls back every move)',
             },
             {
-                name: 'dryRun',
-                type: 'boolean',
+                name: 'status',
+                type: 'string',
                 required: false,
-                description: 'Validate and report what would be created without writing',
+                description: 'Target lifecycle status applied to every task',
+                enum: [
+                    'pending',
+                    'active',
+                    'blocked',
+                    'done',
+                    'cancelled',
+                    'archived',
+                    'proposed',
+                ],
             },
             {
-                name: 'reasonWaiver',
+                name: 'pipelineStage',
                 type: 'string',
                 required: false,
-                description: 'Explicit audit waiver text for edges without per-edge reasons',
+                description: 'Target pipeline stage applied to every task (forward-only)',
             },
         ],
+        outputSchema: OUTPUT_CONTRACTS['tasks.bulk-move'],
     },
     {
         gateway: 'mutate',
         domain: 'tasks',
-        operation: 'relates.remove',
-        description: 'tasks.relates.remove (mutate) — delete a relation between two tasks. Pass `type` to scope deletion to a single relation kind; omit to remove any type.',
+        operation: 'assignee',
+        description: 'tasks.assignee (mutate) — set/clear a first-class human assignee (DISTINCT from the agent claim/unclaim lock; pass assignee:null to clear)',
         tier: 1,
         idempotent: true,
         sessionRequired: false,
-        requiredParams: ['taskId', 'relatedId'],
+        requiredParams: ['taskId'],
         params: [
             {
                 name: 'taskId',
                 type: 'string',
                 required: true,
-                description: 'Source task ID',
+                description: 'Task ID whose assignee is being set or cleared',
                 cli: { positional: true },
             },
             {
-                name: 'relatedId',
+                name: 'assignee',
                 type: 'string',
-                required: true,
+                required: false,
+                description: 'Assignee to set; omit / empty / null clears the assignee',
+            },
+        ],
+        outputSchema: OUTPUT_CONTRACTS['tasks.assignee'],
+    },
+    {
+        gateway: 'mutate',
+        domain: 'tasks',
+        operation: 'relates.add',
+        description: 'tasks.relates.add (mutate)',
+        tier: 1,
+        idempotent: false,
+        sessionRequired: false,
+        requiredParams: ['taskId', 'type'],
+        params: [
+            {
+                name: 'taskId',
+                type: 'string',
+                required: true,
+                description: 'taskId parameter',
+                cli: { positional: true },
+            },
+            {
+                name: 'type',
+                type: 'string',
+                required: true,
+                description: 'type parameter',
+            },
+        ],
+    },
+    {
+        // T11575 — the handler (dispatch/domains/tasks.ts 'relates.add-batch') and
+        // CLI command (cli/commands/relates.ts add-batch) shipped, but no
+        // OperationDef existed here, so `resolve()` returned undefined and the
+        // dispatcher rejected the call with E_INVALID_OPERATION before it ever
+        // reached the handler. Registering the op (gateway:'mutate') closes the gap.
+        gateway: 'mutate',
+        domain: 'tasks',
+        operation: 'relates.add-batch',
+        description: 'tasks.relates.add-batch (mutate) — bulk-add advisory relation edges from a JSON payload ({relations:[...]} or {edges:[...]}); use dryRun to preview without writing.',
+        tier: 1,
+        idempotent: false,
+        sessionRequired: false,
+        // Neither `relations` nor `edges` is individually required — the handler
+        // accepts either shape and validates emptiness in core — so no param is
+        // declared required at the dispatch boundary.
+        requiredParams: [],
+        params: [
+            {
+                name: 'relations',
+                type: 'array',
+                required: false,
+                description: 'Array of relation edges ({from|taskId, to|relatedId, type, reason})',
+            },
+            {
+                name: 'edges',
+                type: 'array',
+                required: false,
+                description: 'Alias for `relations` — array of relation edges',
+            },
+            {
+                name: 'dryRun',
+                type: 'boolean',
+                required: false,
+                description: 'Validate and report what would be created without writing',
+            },
+            {
+                name: 'reasonWaiver',
+                type: 'string',
+                required: false,
+                description: 'Explicit audit waiver text for edges without per-edge reasons',
+            },
+        ],
+    },
+    {
+        gateway: 'mutate',
+        domain: 'tasks',
+        operation: 'relates.remove',
+        description: 'tasks.relates.remove (mutate) — delete a relation between two tasks. Pass `type` to scope deletion to a single relation kind; omit to remove any type.',
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ['taskId', 'relatedId'],
+        params: [
+            {
+                name: 'taskId',
+                type: 'string',
+                required: true,
+                description: 'Source task ID',
+                cli: { positional: true },
+            },
+            {
+                name: 'relatedId',
+                type: 'string',
+                required: true,
                 description: 'Target task ID to remove the relation to',
                 cli: { positional: true },
             },
@@ -4334,6 +4725,31 @@ export const OPERATIONS = [
             },
         ],
     },
+    {
+        gateway: 'mutate',
+        domain: 'admin',
+        operation: 'config.unset',
+        description: 'admin.config.unset (mutate) — remove a key from a scoped config file (idempotent) (T11917)',
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ['key'],
+        params: [
+            {
+                name: 'key',
+                type: 'string',
+                required: true,
+                description: 'Dot-notation config key to remove',
+                cli: { positional: true },
+            },
+            {
+                name: 'global',
+                type: 'boolean',
+                required: false,
+                description: 'Remove from the global file instead of the project file',
+            },
+        ],
+    },
     {
         gateway: 'query',
         domain: 'admin',
@@ -8521,5 +8937,573 @@ export const OPERATIONS = [
             },
         ],
     },
+    // ── service domain: universal service-vault OAuth flow (T11939 · epic T11765) ──
+    // Four verbs driving the declarative SERVICE_PROVIDERS registry: auth-url (query
+    // — build a PKCE authorization URL), exchange (mutate — persist encrypted tokens
+    // from an auth code), refresh (mutate — renew an access token honoring the
+    // per-provider RefreshConfig), self-heal (mutate — resolve + transparently
+    // refresh a past-expiry connection). The flow lives in CORE (store/service-oauth.ts).
+    {
+        gateway: 'query',
+        domain: 'service',
+        operation: 'auth-url',
+        description: 'service.auth-url (query) — build a PKCE OAuth authorization URL for a service provider; returns the URL + the code verifier + state to round-trip into service.exchange.',
+        tier: 2,
+        idempotent: false,
+        sessionRequired: false,
+        requiredParams: ['provider'],
+        params: [
+            {
+                name: 'provider',
+                type: 'string',
+                required: true,
+                description: 'Service provider key (e.g. github, google, notion) — must be in SERVICE_PROVIDERS.',
+            },
+            {
+                name: 'state',
+                type: 'string',
+                required: false,
+                description: 'Opaque CSRF state to embed; a random value is generated when omitted.',
+            },
+            {
+                name: 'scope',
+                type: 'string',
+                required: false,
+                description: 'Scope override (e.g. a BYOC custom scope). Defaults to the provider scope.',
+            },
+            {
+                name: 'redirectUri',
+                type: 'string',
+                required: false,
+                description: 'Redirect URI override. Defaults to the provider loopback redirect.',
+            },
+        ],
+    },
+    {
+        gateway: 'mutate',
+        domain: 'service',
+        operation: 'exchange',
+        description: 'service.exchange (mutate) — exchange an OAuth authorization code (+ PKCE verifier) for tokens and PERSIST them encryptGlobal-encrypted into service_connections. Returns the non-secret connection identity.',
+        tier: 2,
+        idempotent: false,
+        sessionRequired: false,
+        requiredParams: ['provider', 'code', 'codeVerifier', 'redirectUri'],
+        params: [
+            { name: 'provider', type: 'string', required: true, description: 'Service provider key.' },
+            {
+                name: 'code',
+                type: 'string',
+                required: true,
+                description: 'Authorization code from the redirect callback.',
+            },
+            {
+                name: 'codeVerifier',
+                type: 'string',
+                required: true,
+                description: 'PKCE code verifier from service.auth-url (round-tripped).',
+            },
+            {
+                name: 'redirectUri',
+                type: 'string',
+                required: true,
+                description: 'Redirect URI used in service.auth-url (must match).',
+            },
+            {
+                name: 'label',
+                type: 'string',
+                required: false,
+                description: 'Connection label, unique within the provider. Defaults to "default".',
+            },
+        ],
+    },
+    {
+        gateway: 'mutate',
+        domain: 'service',
+        operation: 'refresh',
+        description: 'service.refresh (mutate) — refresh a service connection access token honoring the per-provider RefreshConfig (Form/Json × Body/BasicAuth, plus github-app / service-account-jwt / client-credentials variants); re-encrypts + persists the new blob.',
+        tier: 2,
+        idempotent: false,
+        sessionRequired: false,
+        requiredParams: ['agentId', 'provider', 'label'],
+        params: [
+            {
+                name: 'agentId',
+                type: 'string',
+                required: true,
+                description: 'Agent requesting the refresh (trust-gated).',
+            },
+            { name: 'provider', type: 'string', required: true, description: 'Service provider key.' },
+            { name: 'label', type: 'string', required: true, description: 'Connection label.' },
+            {
+                name: 'approved',
+                type: 'boolean',
+                required: false,
+                description: 'Out-of-band manual-approval flag forwarded to the trust gate.',
+            },
+        ],
+    },
+    {
+        gateway: 'mutate',
+        domain: 'service',
+        operation: 'self-heal',
+        description: 'service.self-heal (mutate) — resolve a service connection and, when its expires_at is past, transparently refresh + re-encrypt + persist; returns a fresh sealed-credential reference (agents never see a stale token).',
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ['agentId', 'provider', 'label'],
+        params: [
+            {
+                name: 'agentId',
+                type: 'string',
+                required: true,
+                description: 'Agent requesting the connection (trust-gated).',
+            },
+            { name: 'provider', type: 'string', required: true, description: 'Service provider key.' },
+            { name: 'label', type: 'string', required: true, description: 'Connection label.' },
+            {
+                name: 'approved',
+                type: 'boolean',
+                required: false,
+                description: 'Out-of-band manual-approval flag forwarded to the trust gate.',
+            },
+        ],
+    },
+    // ── service domain: user-facing service-vault CLI verbs (T11941 · M2-W4) ──
+    // Four verbs making the universal vault USABLE from the CLI: connect (mutate —
+    // store a credential via token-direct or paste-code OAuth exchange), list
+    // (query — redacted connection views, NEVER the token), revoke (mutate — hard
+    // delete + cascade agent grants), status (query — connection health: expired?
+    // needsRefresh?). Thin handlers delegate to CORE accessor + service-oauth.
+    {
+        gateway: 'mutate',
+        domain: 'service',
+        operation: 'connect',
+        description: 'service.connect (mutate) — connect a service credential: store an already-obtained token (--token) OR exchange an OAuth authorization code (--paste-code + --code-verifier + --redirect-uri). Persists the token blob encryptGlobal-encrypted; returns the NON-SECRET connection identity (never the token).',
+        tier: 2,
+        idempotent: false,
+        sessionRequired: false,
+        requiredParams: ['provider'],
+        params: [
+            {
+                name: 'provider',
+                type: 'string',
+                required: true,
+                description: 'Service provider key (e.g. github, google, notion).',
+            },
+            {
+                name: 'label',
+                type: 'string',
+                required: false,
+                description: "Connection label, unique within the provider. Defaults to 'default'.",
+            },
+            {
+                name: 'token',
+                type: 'string',
+                required: false,
+                description: 'Direct access token to store (token-direct mode). SECRET — never echoed.',
+            },
+            {
+                name: 'refreshToken',
+                type: 'string',
+                required: false,
+                description: 'Optional refresh token paired with --token. SECRET.',
+            },
+            {
+                name: 'expiresAt',
+                type: 'string',
+                required: false,
+                description: 'ISO-8601 access-token expiry (token-direct mode).',
+            },
+            {
+                name: 'code',
+                type: 'string',
+                required: false,
+                description: 'OAuth authorization code from the redirect callback (paste-code mode).',
+            },
+            {
+                name: 'codeVerifier',
+                type: 'string',
+                required: false,
+                description: 'PKCE code verifier from service.auth-url, round-tripped (paste-code mode).',
+            },
+            {
+                name: 'redirectUri',
+                type: 'string',
+                required: false,
+                description: 'Redirect URI used in service.auth-url; must match (paste-code mode).',
+            },
+        ],
+    },
+    {
+        gateway: 'query',
+        domain: 'service',
+        operation: 'list',
+        description: 'service.list (query) — list service connections as NON-SECRET views (provider/label/status/scopes/expiresAt/hasCredentials). The decrypted token is NEVER surfaced.',
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [
+            {
+                name: 'provider',
+                type: 'string',
+                required: false,
+                description: 'Optional provider filter; lists all providers when omitted.',
+            },
+        ],
+    },
+    {
+        gateway: 'mutate',
+        domain: 'service',
+        operation: 'revoke',
+        description: 'service.revoke (mutate) — DELETE a service connection and CASCADE its agent_service_grants. Returns the {count, deleted, grantsRemoved} envelope (count=0 when no such connection).',
+        tier: 2,
+        idempotent: false,
+        sessionRequired: false,
+        requiredParams: ['provider', 'label'],
+        params: [
+            { name: 'provider', type: 'string', required: true, description: 'Service provider key.' },
+            {
+                name: 'label',
+                type: 'string',
+                required: true,
+                description: 'Connection label to revoke.',
+            },
+        ],
+    },
+    {
+        gateway: 'query',
+        domain: 'service',
+        operation: 'status',
+        description: 'service.status (query) — report connection health: each connection adds `expired` + `needsRefresh` booleans computed from expires_at. NON-SECRET; never surfaces a token.',
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [
+            {
+                name: 'provider',
+                type: 'string',
+                required: false,
+                description: 'Optional provider filter; reports all connections when omitted.',
+            },
+        ],
+    },
+    // ── 5-entity provider experience (T11700 · epic T11666 · North-Star §2) ──
+    // The addressable Provider / Alias / Account / Model / Profile surface. Each op
+    // dispatches to the CORE entity-ops layer (llm/entity-ops.ts), which is a thin
+    // composition over the ALREADY-MERGED accessors: the credential pool
+    // (account.* — secret-bearing, redacted to tokenPreview), the declarative
+    // `providers` table (#1039), the `models_catalog` table (#1037), and the
+    // resolver-consumed `llm.profiles[name]` config (profile.*). The secret-bearing
+    // ops carry NO `mcpExposed` flag → they are MCP-default-denied (AC5/AC7); read
+    // ops are also unary CLI/RPC/HTTP (no `mcpExposed`), keeping the MCP surface
+    // curated. INPUT + OUTPUT contracts live in contracts/operations/entities.ts.
+    // account.* — the credential pool (the rename/successor of the secret-bearing
+    // `llm` pool ops). `account.add` is SECRET-BEARING (cli-only; MCP-denied).
+    {
+        gateway: 'mutate',
+        domain: 'account',
+        operation: 'add',
+        description: 'account.add (mutate) — store a pooled provider credential. SECRET-BEARING (cli-only): accepts an API key / OAuth token and persists it encrypted; returns the NON-SECRET redacted view (tokenPreview last-4 ONLY — never the raw secret).',
+        tier: 2,
+        idempotent: false,
+        sessionRequired: false,
+        requiredParams: ['provider', 'token'],
+        params: [
+            {
+                name: 'provider',
+                type: 'string',
+                required: true,
+                description: 'LLM provider transport key (e.g. anthropic, openai).',
+                cli: { positional: true },
+            },
+            {
+                name: 'token',
+                type: 'string',
+                required: true,
+                description: 'API key or OAuth bearer token to persist. SECRET — never echoed.',
+            },
+            {
+                name: 'label',
+                type: 'string',
+                required: false,
+                description: "Account label, unique within the provider (default: 'default').",
+            },
+            {
+                name: 'baseUrl',
+                type: 'string',
+                required: false,
+                description: 'Optional override for the provider base URL.',
+            },
+            {
+                name: 'authType',
+                type: 'string',
+                required: false,
+                description: "Explicit auth-type override ('api_key' | 'oauth' | 'aws_sdk').",
+            },
+            {
+                name: 'priority',
+                type: 'number',
+                required: false,
+                description: 'Optional priority override (lower wins).',
+            },
+        ],
+    },
+    {
+        gateway: 'query',
+        domain: 'account',
+        operation: 'list',
+        description: 'account.list (query) — list pooled accounts as NON-SECRET redacted views (provider/label/authType/tokenPreview). The decrypted secret is NEVER surfaced.',
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [
+            {
+                name: 'provider',
+                type: 'string',
+                required: false,
+                description: 'Optional provider filter; lists all providers when omitted.',
+            },
+        ],
+    },
+    {
+        gateway: 'mutate',
+        domain: 'account',
+        operation: 'remove',
+        description: 'account.remove (mutate) — delete a (provider, label) account from the pool. Returns the {count, deleted} envelope (count=0 when absent — idempotent).',
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ['provider', 'label'],
+        params: [
+            {
+                name: 'provider',
+                type: 'string',
+                required: true,
+                description: 'LLM provider transport key.',
+                cli: { positional: true },
+            },
+            {
+                name: 'label',
+                type: 'string',
+                required: true,
+                description: 'Account label to remove.',
+            },
+        ],
+    },
+    // provider.* — the declarative `providers` table (#1039) + alias resolution.
+    {
+        gateway: 'query',
+        domain: 'provider',
+        operation: 'list',
+        description: 'provider.list (query) — list every declarative provider as a NON-SECRET view (id/displayName/aliases/authMethods/modelsDevId) from the providers table.',
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [],
+    },
+    {
+        gateway: 'query',
+        domain: 'provider',
+        operation: 'show',
+        description: 'provider.show (query) — resolve ONE provider by id OR case-insensitive alias against the declarative alias index; returns the provider view + the id/alias matched.',
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ['provider'],
+        params: [
+            {
+                name: 'provider',
+                type: 'string',
+                required: true,
+                description: 'Provider id OR a case-insensitive alias.',
+                cli: { positional: true },
+            },
+        ],
+    },
+    {
+        gateway: 'mutate',
+        domain: 'provider',
+        operation: 'connect',
+        description: 'provider.connect (mutate) — connect a provider by storing a token as one of its accounts (token-direct). SECRET-BEARING (cli-only): resolves the provider (id/alias) then delegates to the secret-bearing account write; returns the NON-SECRET account identity (never the raw token). OAuth flows route through `cleo service`.',
+        tier: 2,
+        idempotent: false,
+        sessionRequired: false,
+        requiredParams: ['provider'],
+        params: [
+            {
+                name: 'provider',
+                type: 'string',
+                required: true,
+                description: 'Provider id or alias to connect.',
+                cli: { positional: true },
+            },
+            {
+                name: 'token',
+                type: 'string',
+                required: false,
+                description: 'Direct API key / bearer token to store (token-direct mode). SECRET.',
+            },
+            {
+                name: 'label',
+                type: 'string',
+                required: false,
+                description: "Account label to create (default: 'default').",
+            },
+            {
+                name: 'authType',
+                type: 'string',
+                required: false,
+                description: "Explicit auth-type override ('api_key' | 'oauth' | 'aws_sdk').",
+            },
+        ],
+    },
+    // model.* — the models.dev catalog (`models_catalog` table, #1037). QUERY-ONLY.
+    {
+        gateway: 'query',
+        domain: 'model',
+        operation: 'query',
+        description: 'model.query (query) — read the models.dev catalog (models_catalog table) newest-first by release date; optionally filtered by provider (models.dev id) and capped by --limit. Returns NON-SECRET catalog views.',
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [
+            {
+                name: 'provider',
+                type: 'string',
+                required: false,
+                description: 'Optional provider filter (models.dev id); queries all providers when omitted.',
+            },
+            {
+                name: 'limit',
+                type: 'number',
+                required: false,
+                description: 'Optional cap on the number of rows returned (newest-first).',
+            },
+        ],
+    },
+    {
+        gateway: 'query',
+        domain: 'model',
+        operation: 'show',
+        description: 'model.show (query) — resolve ONE catalog model by id; returns {found, model} (found=false when the id is absent — not an error).',
+        tier: 1,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ['model'],
+        params: [
+            {
+                name: 'model',
+                type: 'string',
+                required: true,
+                description: 'Model id (catalog key) to resolve.',
+                cli: { positional: true },
+            },
+        ],
+    },
+    // profile.* — the named binding account+model[+params+role], persisted into
+    // `llm.profiles[name]` (the resolver-consumed config SSoT).
+    {
+        gateway: 'mutate',
+        domain: 'profile',
+        operation: 'create',
+        description: 'profile.create (mutate) — bind an account + model into a named, addressable profile. Validates the binding (the pinned account must exist; the model must be in the catalog) then persists into llm.profiles[name]. Returns {count, created, profile}.',
+        tier: 2,
+        idempotent: false,
+        sessionRequired: false,
+        requiredParams: ['name', 'provider', 'model'],
+        params: [
+            {
+                name: 'name',
+                type: 'string',
+                required: true,
+                description: 'Profile name (the addressable handle).',
+                cli: { positional: true },
+            },
+            {
+                name: 'provider',
+                type: 'string',
+                required: true,
+                description: 'Provider transport the bound account belongs to.',
+            },
+            {
+                name: 'model',
+                type: 'string',
+                required: true,
+                description: 'Model id to bind (validated against the catalog).',
+            },
+            {
+                name: 'label',
+                type: 'string',
+                required: false,
+                description: 'Account label to pin (the credential binding). Validated to exist.',
+            },
+            {
+                name: 'role',
+                type: 'string',
+                required: false,
+                description: 'Optional role this profile occupies (extraction | consolidation | …).',
+            },
+        ],
+    },
+    {
+        gateway: 'query',
+        domain: 'profile',
+        operation: 'list',
+        description: 'profile.list (query) — list every named profile from llm.profiles (name + provider + model + optional credentialLabel).',
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: [],
+        params: [],
+    },
+    {
+        gateway: 'mutate',
+        domain: 'profile',
+        operation: 'pin',
+        description: 'profile.pin (mutate) — pin a role to a named profile (llm.roles[role].profile). The role must be a valid background role and the profile must already exist.',
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ['name', 'role'],
+        params: [
+            {
+                name: 'name',
+                type: 'string',
+                required: true,
+                description: 'Profile name to pin (must exist).',
+                cli: { positional: true },
+            },
+            {
+                name: 'role',
+                type: 'string',
+                required: true,
+                description: 'Role to pin to this profile (extraction | consolidation | derivation | …).',
+            },
+        ],
+    },
+    {
+        gateway: 'mutate',
+        domain: 'profile',
+        operation: 'use',
+        description: 'profile.use (mutate) — set a named profile as the global default binding (llm.defaultProfile). The profile must already exist.',
+        tier: 2,
+        idempotent: true,
+        sessionRequired: false,
+        requiredParams: ['name'],
+        params: [
+            {
+                name: 'name',
+                type: 'string',
+                required: true,
+                description: 'Profile name to mark as default (must exist).',
+                cli: { positional: true },
+            },
+        ],
+    },
 ];
 //# sourceMappingURL=operations-registry.js.map