@cleocode/core 2026.6.12 → 2026.6.14

package/dist/store/schema/cleo-global/accounts.d.ts

@@ -0,0 +1,357 @@
+/**
+ * Global-scope `cleo.db` — **LLM credential pool** (`accounts`, 1 table).
+ *
+ * EP-PROVIDER-VAULT (epic T10410 · task T11709 · saga SG-VAULT-CORE T10409). This
+ * table is the queryable, `cleo health`-visible home for the **pooled LLM provider
+ * credentials** that today live as a plaintext JSON blob with no schema, no index,
+ * and no health surface. Each row is one credential ("account") for one provider —
+ * an API key or OAuth token pair — plus the rotation / cooldown / health metadata
+ * the pool runner uses to pick the next live account and to retire dead ones.
+ *
+ * ## NOT `agent_registry_accounts` (do not confuse the two)
+ *
+ * The consolidated global `cleo.db` ALSO carries `agent_registry_accounts` — the
+ * better-auth OAuth-account table from the agent-identity tier (the cloud-sync
+ * `accounts` source, renamed under T11622). That table is a SaaS account record;
+ * THIS table (`accounts`, bare) is the local machine-wide LLM-credential pool. The
+ * two never overlap: the physical names differ (`accounts` vs
+ * `agent_registry_accounts`) and the JS exports differ (`accounts` here vs
+ * `agentRegistryAccounts`). The bare name `accounts` is the credential pool.
+ *
+ * ## Encrypted at rest (global KDF — T11710)
+ *
+ * `secretEnc` / `refreshEnc` are ciphertext, NEVER plaintext. They are produced by
+ * `encryptGlobal()` (packages/core/src/crypto/credentials.ts, T11710) — the
+ * project-INDEPENDENT KDF `HMAC-SHA256(machine-key || globalSalt, id)` reusing the
+ * machine-local `getGlobalSalt()` (store/global-salt.ts). The ciphertext keeps the
+ * versioned `0x01 + 12B IV + 16B authTag` framing. Global (not project-bound)
+ * encryption is required because an LLM credential must decrypt consistently for
+ * the same machine regardless of which project's cwd the pool is read from.
+ *
+ * ## Active-account pointer (`isActive`)
+ *
+ * `isActive` is the per-provider "currently-selected" pointer: AT MOST ONE row per
+ * `provider` may carry `isActive = 1`. drizzle-orm cannot model a partial-`WHERE`
+ * unique index, so the one-active-per-provider invariant is enforced by a raw-SQL
+ * **partial unique index** `ux_accounts_active_provider ON accounts (provider)
+ * WHERE is_active = 1` emitted in the forward migration (the established repo
+ * pattern — cf. `_writer_leases.active`, T11627). This module declares only the
+ * full-column table plus the non-partial `(provider, label)` unique index, which
+ * drizzle CAN emit.
+ *
+ * @task T11709
+ * @epic T10410
+ * @saga T10409
+ * @see ../../../crypto/credentials.ts — `encryptGlobal` / `decryptGlobal` (T11710)
+ * @see ../../global-salt.ts — `getGlobalSalt` (the reused machine-local salt)
+ * @see ./agent-registry.ts — `agentRegistryAccounts` (the UNRELATED OAuth-account table)
+ * @see ../../../../migrations/drizzle-cleo-global — the forward migration (raw partial index)
+ */
+/**
+ * Legal `accounts.status` values — the health lifecycle of a pooled credential.
+ *
+ * - `ok` — usable; the pool may select it.
+ * - `exhausted` — rate-limited / quota-hit; usable again after `cooldownResetAt`.
+ * - `dead` — permanently unusable (revoked key, hard auth failure); never selected.
+ *
+ * @task T11709
+ */
+export declare const ACCOUNT_STATUSES: readonly ["ok", "exhausted", "dead"];
+/** TypeScript union derived from {@link ACCOUNT_STATUSES}. */
+export type AccountStatus = (typeof ACCOUNT_STATUSES)[number];
+/**
+ * `accounts` — the machine-wide pooled-LLM-credential table.
+ *
+ * One row per credential ("account") for one provider. Carries the encrypted
+ * secret/refresh material plus the rotation, cooldown, and health metadata the
+ * pool runner consults to choose the next live account (highest `priority` among
+ * `status = 'ok'`) and to retire dead ones. The `(provider, label)` pair is unique;
+ * `isActive` is the per-provider active pointer (one active row per provider,
+ * enforced by the raw-SQL partial unique index in the migration).
+ *
+ * @task T11709
+ */
+export declare const accounts: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "accounts";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "accounts";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        provider: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "accounts";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        label: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "accounts";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        authType: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "accounts";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        secretEnc: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "accounts";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        refreshEnc: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "accounts";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        expiresAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "accounts";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        priority: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "accounts";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        source: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "accounts";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        status: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "accounts";
+            dataType: "string enum";
+            data: "ok" | "exhausted" | "dead";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["ok", "exhausted", "dead"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        lastErrorCode: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "accounts";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        cooldownResetAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "accounts";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        requestCount: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "accounts";
+            dataType: "number int53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        metadata: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "accounts";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        isActive: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "accounts";
+            dataType: "boolean";
+            data: boolean;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        createdAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "accounts";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+        updatedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "accounts";
+            dataType: "string";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}>;
+    };
+    dialect: "sqlite";
+}>;
+/** Row type for `accounts` SELECT queries. */
+export type AccountRow = typeof accounts.$inferSelect;
+/** Row type for `accounts` INSERT/UPSERT operations. */
+export type NewAccountRow = typeof accounts.$inferInsert;
+//# sourceMappingURL=accounts.d.ts.map

package/dist/store/schema/cleo-global/accounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accounts.d.ts","sourceRoot":"","sources":["../../../../src/store/schema/cleo-global/accounts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAKH;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,sCAAuC,CAAC;AAErE,8DAA8D;AAC9D,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiEpB,CAAC;AAEF,8CAA8C;AAC9C,MAAM,MAAM,UAAU,GAAG,OAAO,QAAQ,CAAC,YAAY,CAAC;AACtD,wDAAwD;AACxD,MAAM,MAAM,aAAa,GAAG,OAAO,QAAQ,CAAC,YAAY,CAAC"}

package/dist/store/schema/cleo-global/accounts.js

@@ -0,0 +1,136 @@
+/**
+ * Global-scope `cleo.db` — **LLM credential pool** (`accounts`, 1 table).
+ *
+ * EP-PROVIDER-VAULT (epic T10410 · task T11709 · saga SG-VAULT-CORE T10409). This
+ * table is the queryable, `cleo health`-visible home for the **pooled LLM provider
+ * credentials** that today live as a plaintext JSON blob with no schema, no index,
+ * and no health surface. Each row is one credential ("account") for one provider —
+ * an API key or OAuth token pair — plus the rotation / cooldown / health metadata
+ * the pool runner uses to pick the next live account and to retire dead ones.
+ *
+ * ## NOT `agent_registry_accounts` (do not confuse the two)
+ *
+ * The consolidated global `cleo.db` ALSO carries `agent_registry_accounts` — the
+ * better-auth OAuth-account table from the agent-identity tier (the cloud-sync
+ * `accounts` source, renamed under T11622). That table is a SaaS account record;
+ * THIS table (`accounts`, bare) is the local machine-wide LLM-credential pool. The
+ * two never overlap: the physical names differ (`accounts` vs
+ * `agent_registry_accounts`) and the JS exports differ (`accounts` here vs
+ * `agentRegistryAccounts`). The bare name `accounts` is the credential pool.
+ *
+ * ## Encrypted at rest (global KDF — T11710)
+ *
+ * `secretEnc` / `refreshEnc` are ciphertext, NEVER plaintext. They are produced by
+ * `encryptGlobal()` (packages/core/src/crypto/credentials.ts, T11710) — the
+ * project-INDEPENDENT KDF `HMAC-SHA256(machine-key || globalSalt, id)` reusing the
+ * machine-local `getGlobalSalt()` (store/global-salt.ts). The ciphertext keeps the
+ * versioned `0x01 + 12B IV + 16B authTag` framing. Global (not project-bound)
+ * encryption is required because an LLM credential must decrypt consistently for
+ * the same machine regardless of which project's cwd the pool is read from.
+ *
+ * ## Active-account pointer (`isActive`)
+ *
+ * `isActive` is the per-provider "currently-selected" pointer: AT MOST ONE row per
+ * `provider` may carry `isActive = 1`. drizzle-orm cannot model a partial-`WHERE`
+ * unique index, so the one-active-per-provider invariant is enforced by a raw-SQL
+ * **partial unique index** `ux_accounts_active_provider ON accounts (provider)
+ * WHERE is_active = 1` emitted in the forward migration (the established repo
+ * pattern — cf. `_writer_leases.active`, T11627). This module declares only the
+ * full-column table plus the non-partial `(provider, label)` unique index, which
+ * drizzle CAN emit.
+ *
+ * @task T11709
+ * @epic T10410
+ * @saga T10409
+ * @see ../../../crypto/credentials.ts — `encryptGlobal` / `decryptGlobal` (T11710)
+ * @see ../../global-salt.ts — `getGlobalSalt` (the reused machine-local salt)
+ * @see ./agent-registry.ts — `agentRegistryAccounts` (the UNRELATED OAuth-account table)
+ * @see ../../../../migrations/drizzle-cleo-global — the forward migration (raw partial index)
+ */
+import { sql } from 'drizzle-orm';
+import { index, integer, sqliteTable, text, unique } from 'drizzle-orm/sqlite-core';
+/**
+ * Legal `accounts.status` values — the health lifecycle of a pooled credential.
+ *
+ * - `ok` — usable; the pool may select it.
+ * - `exhausted` — rate-limited / quota-hit; usable again after `cooldownResetAt`.
+ * - `dead` — permanently unusable (revoked key, hard auth failure); never selected.
+ *
+ * @task T11709
+ */
+export const ACCOUNT_STATUSES = ['ok', 'exhausted', 'dead'];
+/**
+ * `accounts` — the machine-wide pooled-LLM-credential table.
+ *
+ * One row per credential ("account") for one provider. Carries the encrypted
+ * secret/refresh material plus the rotation, cooldown, and health metadata the
+ * pool runner consults to choose the next live account (highest `priority` among
+ * `status = 'ok'`) and to retire dead ones. The `(provider, label)` pair is unique;
+ * `isActive` is the per-provider active pointer (one active row per provider,
+ * enforced by the raw-SQL partial unique index in the migration).
+ *
+ * @task T11709
+ */
+export const accounts = sqliteTable('accounts', {
+    /** Surrogate primary key (autoincrement via INTEGER PRIMARY KEY rowid alias). */
+    id: integer('id').primaryKey(),
+    /** Provider key (e.g. `anthropic` | `openai` | `google`). Selection is per-provider. */
+    provider: text('provider').notNull(),
+    /**
+     * Human-readable credential label, unique WITHIN a provider (e.g. `work-key`,
+     * `personal-oauth`). The `(provider, label)` pair is the natural unique key.
+     */
+    label: text('label').notNull(),
+    /** Credential kind — `api-key` | `oauth` (drives which `*_enc` columns are populated). */
+    authType: text('auth_type').notNull(),
+    /**
+     * Encrypted primary secret (API key or OAuth access token), `encryptGlobal()`
+     * ciphertext (`0x01 + 12B IV + 16B authTag` framing, T11710). NEVER plaintext.
+     */
+    secretEnc: text('secret_enc'),
+    /**
+     * Encrypted OAuth refresh token, `encryptGlobal()` ciphertext. NULL for an
+     * `api-key` credential (no refresh material).
+     */
+    refreshEnc: text('refresh_enc'),
+    /** ISO-8601 UTC expiry of the secret; NULL for a non-expiring API key. */
+    expiresAt: text('expires_at'),
+    /** Selection priority — HIGHER is preferred. The pool picks the highest live priority. */
+    priority: integer('priority').notNull().default(0),
+    /** Provenance — where this credential came from (e.g. `env` | `oauth-flow` | `import`). */
+    source: text('source'),
+    /**
+     * Health lifecycle — `ok` | `exhausted` | `dead` ({@link ACCOUNT_STATUSES}).
+     * Only `ok` rows are eligible for selection.
+     */
+    status: text('status', { enum: ACCOUNT_STATUSES }).notNull().default('ok'),
+    /** Last transport/provider error code observed (e.g. `429` | `invalid_api_key`); NULL when healthy. */
+    lastErrorCode: text('last_error_code'),
+    /**
+     * ISO-8601 UTC instant an `exhausted` credential becomes eligible again; NULL
+     * when not cooling down. The pool skips an `exhausted` row until `now >= this`.
+     */
+    cooldownResetAt: text('cooldown_reset_at'),
+    /** Monotonic count of requests served by this credential (rotation telemetry). */
+    requestCount: integer('request_count').notNull().default(0),
+    /** Free-form JSON blob for forward-compatible per-credential metadata (serialized TEXT). */
+    metadata: text('metadata').notNull().default('{}'),
+    /**
+     * Per-provider active-pointer. AT MOST ONE row per `provider` carries `true`,
+     * enforced by the raw-SQL partial unique index `ux_accounts_active_provider`
+     * (drizzle cannot model a partial-`WHERE` unique). Defaults to `false`.
+     */
+    isActive: integer('is_active', { mode: 'boolean' }).notNull().default(false),
+    /** ISO-8601 UTC row-creation instant. Defaults to write time. */
+    createdAt: text('created_at').notNull().default(sql `(datetime('now'))`),
+    /** ISO-8601 UTC last-update instant. Defaults to write time; bumped on mutation. */
+    updatedAt: text('updated_at').notNull().default(sql `(datetime('now'))`),
+}, (table) => [
+    // The natural unique key: a label is unique within a provider. drizzle CAN
+    // emit this (non-partial) unique; the per-provider active pointer is the
+    // SEPARATE partial unique index emitted as raw SQL in the migration.
+    unique('ux_accounts_provider_label').on(table.provider, table.label),
+    // Selection index — the pool scans live rows per provider ordered by priority.
+    index('idx_accounts_provider_status_priority').on(table.provider, table.status, table.priority),
+]);
+//# sourceMappingURL=accounts.js.map

package/dist/store/schema/cleo-global/accounts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accounts.js","sourceRoot":"","sources":["../../../../src/store/schema/cleo-global/accounts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEpF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,MAAM,CAAU,CAAC;AAKrE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,WAAW,CACjC,UAAU,EACV;IACE,iFAAiF;IACjF,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC9B,wFAAwF;IACxF,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACpC;;;OAGG;IACH,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,0FAA0F;IAC1F,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACrC;;;OAGG;IACH,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B;;;OAGG;IACH,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAC/B,0EAA0E;IAC1E,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,0FAA0F;IAC1F,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,2FAA2F;IAC3F,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC;IACtB;;;OAGG;IACH,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1E,uGAAuG;IACvG,aAAa,EAAE,IAAI,CAAC,iBAAiB,CAAC;IACtC;;;OAGG;IACH,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC;IAC1C,kFAAkF;IAClF,YAAY,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,4FAA4F;IAC5F,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClD;;;;OAIG;IACH,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5E,iEAAiE;IACjE,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,mBAAmB,CAAC;IACvE,oFAAoF;IACpF,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA,mBAAmB,CAAC;CACxE,EACD,CAAC,KAAK,EAAE,EAAE,CAAC;IACT,2EAA2E;IAC3E,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,CAAC,4BAA4B,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC;IACpE,+EAA+E;IAC/E,KAAK,CAAC,uCAAuC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC;CAChG,CACF,CAAC"}

package/dist/store/schema/cleo-global/index.d.ts

@@ -92,8 +92,13 @@
  * @see drizzle/cleo-global.config.ts (per-scope domain membership)
  */
 export * from '../cleo-shared/index.js';
+export * from './accounts.js';
 export * from './agent-registry.js';
+export * from './models-catalog.js';
 export * from './nexus.js';
+export * from './providers.js';
+export * from './services.js';
+export * from './session-manifest.js';
 export * from './skills.js';
 export * from './telemetry.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/store/schema/cleo-global/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/store/schema/cleo-global/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4FG;AAEH,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/store/schema/cleo-global/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4FG;AAEH,cAAc,yBAAyB,CAAC;AACxC,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AAEpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,YAAY,CAAC;AAE3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC"}

package/dist/store/schema/cleo-global/index.js

@@ -92,8 +92,15 @@
  * @see drizzle/cleo-global.config.ts (per-scope domain membership)
  */
 export * from '../cleo-shared/index.js';
+export * from './accounts.js';
 export * from './agent-registry.js';
+// E8-CATALOG-CURATION (T11733) — the models.dev catalog SSoT (`models_catalog`).
+export * from './models-catalog.js';
 export * from './nexus.js';
+// M3 Provider SSoT (T11703 · epic T11667) — the declarative provider table (`providers`).
+export * from './providers.js';
+export * from './services.js';
+export * from './session-manifest.js';
 export * from './skills.js';
 export * from './telemetry.js';
 //# sourceMappingURL=index.js.map

package/dist/store/schema/cleo-global/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/store/schema/cleo-global/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4FG;AAEH,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/store/schema/cleo-global/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4FG;AAEH,cAAc,yBAAyB,CAAC;AACxC,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,iFAAiF;AACjF,cAAc,qBAAqB,CAAC;AACpC,cAAc,YAAY,CAAC;AAC3B,0FAA0F;AAC1F,cAAc,gBAAgB,CAAC;AAC/B,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,aAAa,CAAC;AAC5B,cAAc,gBAAgB,CAAC"}