@dcdr/contracts 2.5.2 → 2.6.0

package/README.md

@@ -38,6 +38,7 @@ On top of that, every failure can be reviewed, corrected, and turned into traini
 - **Public TypeScript contracts** (interfaces/enums) for DCDR Registries and runtime API payloads.
 - **`DcdrRuntimeClient`**: a strongly-typed TypeScript HTTP client for calling a DCDR Runtime instance.
 - **Tracked-call rating metadata**: a shared, versioned multimodal multiplier matrix that backend/UI can render and audit consistently with runtime behavior.
+- **Governance contracts**: shared provider/model limit shapes (`provider-limits.contract`) for tenant-level enablement, call-window, and budget-window policy configuration.
 
 ## Who should use it
 

package/dist/index.d.ts

@@ -9,6 +9,8 @@ export * from "./prompts.contract";
 export * from "./session.contract";
 export * from "./logs.contract";
 export * from "./provider.contract";
+export * from "./provider-limits.contract";
+export * from "./provider.catalog.contract";
 export * from "./credentials.contract";
 export * from "./http.contract";
 export * from "./entitlements.contract";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,mCAAmC,CAAC;AAClD,cAAc,2BAA2B,CAAC;AAM1C,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,2BAA2B,EAC3B,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,sBAAsB,CAAC;AACrC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,mCAAmC,CAAC;AAClD,cAAc,2BAA2B,CAAC;AAM1C,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,2BAA2B,EAC3B,0BAA0B,EAC1B,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC"}

package/dist/index.js

@@ -26,6 +26,8 @@ __exportStar(require("./prompts.contract"), exports);
 __exportStar(require("./session.contract"), exports);
 __exportStar(require("./logs.contract"), exports);
 __exportStar(require("./provider.contract"), exports);
+__exportStar(require("./provider-limits.contract"), exports);
+__exportStar(require("./provider.catalog.contract"), exports);
 __exportStar(require("./credentials.contract"), exports);
 __exportStar(require("./http.contract"), exports);
 __exportStar(require("./entitlements.contract"), exports);

package/dist/provider-limits.contract.d.ts

@@ -0,0 +1,39 @@
+import { IntentProvider } from "./provider.contract";
+import { DcdrServiceTokenLimitType } from "./service-tokens.contract";
+/**
+ * Tenant-level provider/model limiting gate used by DCDR governance.
+ *
+ * Notes
+ * - Missing/undefined values preserve permissive behavior by default.
+ * - This contract carries configuration only; live metering/enforcement is a
+ *   runtime/backend responsibility.
+ */
+export interface DcdrProviderLimitGate {
+    /** Missing/true = allowed. `false` = fully blocked. */
+    enabled?: boolean;
+    /** Max execution calls allowed within `maxCallsPeriod`. `null` = unlimited. */
+    maxCalls?: number | null;
+    /** Window type for `maxCalls`. Only meaningful when `maxCalls` is set. */
+    maxCallsPeriod?: DcdrServiceTokenLimitType;
+    /** Max spend allowed within `maxBudgetPeriod`. `null` = unlimited. */
+    maxBudget?: number | null;
+    /** Window type for `maxBudget`. Only meaningful when `maxBudget` is set. */
+    maxBudgetPeriod?: DcdrServiceTokenLimitType;
+}
+/**
+ * Per-provider gate plus optional per-model overrides.
+ *
+ * Notes
+ * - Model ids remain free strings rather than a closed enum because the public
+ *   provider catalog is large and versioned independently of tenant config.
+ */
+export interface DcdrProviderLimitEntry extends DcdrProviderLimitGate {
+    models?: Record<string, DcdrProviderLimitGate>;
+}
+/**
+ * Tenant-scoped provider limits configuration.
+ */
+export interface DcdrProviderLimitsConfig {
+    providers?: Partial<Record<IntentProvider, DcdrProviderLimitEntry>>;
+}
+//# sourceMappingURL=provider-limits.contract.d.ts.map

package/dist/provider-limits.contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-limits.contract.d.ts","sourceRoot":"","sources":["../src/provider-limits.contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEtE;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,uDAAuD;IACvD,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAEzB,0EAA0E;IAC1E,cAAc,CAAC,EAAE,yBAAyB,CAAC;IAE3C,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B,4EAA4E;IAC5E,eAAe,CAAC,EAAE,yBAAyB,CAAC;CAC7C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAuB,SAAQ,qBAAqB;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;CAChD;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,sBAAsB,CAAC,CAAC,CAAC;CACrE"}

package/dist/provider-limits.contract.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/provider.contract.d.ts

@@ -125,5 +125,4 @@ export type ProviderExecuteResult = {
         totalTokens?: number;
     };
 };
-export * from "./provider.catalog.contract";
 //# sourceMappingURL=provider.contract.d.ts.map

package/dist/provider.contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.contract.d.ts","sourceRoot":"","sources":["../src/provider.contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D;;;;;;;;;;GAUG;AACH,oBAAY,cAAc;IACxB;;;;;;OAMG;IACH,IAAI,SAAS;IAEb,0DAA0D;IAC1D,OAAO,YAAY;IAEnB,2BAA2B;IAC3B,MAAM,WAAW;IAEjB,sBAAsB;IACtB,IAAI,SAAS;IAEb,8BAA8B;IAC9B,SAAS,cAAc;IAEvB,4BAA4B;IAC5B,OAAO,YAAY;IAEnB,wCAAwC;IACxC,MAAM,WAAW;IAEjB;;;;;;OAMG;IACH,MAAM,WAAW;IAEjB;;;OAGG;IACH,MAAM,WAAW;IAEjB;;;;;;;;OAQG;IACH,kBAAkB,uBAAuB;IAEzC;;OAEG;IACH,GAAG,QAAQ;IAEX;;OAEG;IACH,IAAI,SAAS;IAEb;;;OAGG;IACH,SAAS,cAAc;IAEvB;;;OAGG;IACH,KAAK,UAAU;CAChB;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,sBAAsB,CAAC;IACvC,WAAW,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAGxC,MAAM,EAAE,cAAc,CAAC;IACvB,gBAAgB,EAAE,OAAO,EAAE,CAAC;IAC5B,UAAU,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAGlC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE9B;;OAEG;IACH,aAAa,CAAC,EAAE,gBAAgB,CAAC;IAEjC;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,KAAK,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IAE9B,8DAA8D;IAC9D,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAE3B,0DAA0D;IAC1D,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAEvB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,OAAO,CAAC;IAEhB,MAAM,EAAE,OAAO,CAAC;IAEhB,KAAK,CAAC,EAAE;QACN,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH,CAAC;AAEF,cAAc,6BAA6B,CAAC"}
+{"version":3,"file":"provider.contract.d.ts","sourceRoot":"","sources":["../src/provider.contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAE7D;;;;;;;;;;GAUG;AACH,oBAAY,cAAc;IACxB;;;;;;OAMG;IACH,IAAI,SAAS;IAEb,0DAA0D;IAC1D,OAAO,YAAY;IAEnB,2BAA2B;IAC3B,MAAM,WAAW;IAEjB,sBAAsB;IACtB,IAAI,SAAS;IAEb,8BAA8B;IAC9B,SAAS,cAAc;IAEvB,4BAA4B;IAC5B,OAAO,YAAY;IAEnB,wCAAwC;IACxC,MAAM,WAAW;IAEjB;;;;;;OAMG;IACH,MAAM,WAAW;IAEjB;;;OAGG;IACH,MAAM,WAAW;IAEjB;;;;;;;;OAQG;IACH,kBAAkB,uBAAuB;IAEzC;;OAEG;IACH,GAAG,QAAQ;IAEX;;OAEG;IACH,IAAI,SAAS;IAEb;;;OAGG;IACH,SAAS,cAAc;IAEvB;;;OAGG;IACH,KAAK,UAAU;CAChB;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,sBAAsB,CAAC;IACvC,WAAW,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAGxC,MAAM,EAAE,cAAc,CAAC;IACvB,gBAAgB,EAAE,OAAO,EAAE,CAAC;IAC5B,UAAU,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAGlC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE9B;;OAEG;IACH,aAAa,CAAC,EAAE,gBAAgB,CAAC;IAEjC;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,KAAK,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IAE9B,8DAA8D;IAC9D,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAE3B,0DAA0D;IAC1D,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAEvB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,OAAO,CAAC;IAEhB,MAAM,EAAE,OAAO,CAAC;IAEhB,KAAK,CAAC,EAAE;QACN,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH,CAAC"}

package/dist/provider.contract.js

@@ -1,18 +1,4 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.IntentProvider = void 0;
 /**
@@ -90,4 +76,3 @@ var IntentProvider;
      */
     IntentProvider["RULES"] = "RULES";
 })(IntentProvider || (exports.IntentProvider = IntentProvider = {}));
-__exportStar(require("./provider.catalog.contract"), exports);

package/dist/service-tokens.contract.d.ts

@@ -6,13 +6,38 @@
  * - Tokens are referenced by sha256(utf8(tokenString)) in hex.
  * - Backend should keep this snapshot stable & ordered for reproducible ETags.
  */
+import { IntentProvider } from "./provider.contract";
 export type DcdrServiceTokenStatus = "ACTIVE" | "REVOKED";
+/**
+ * Stable well-known scopes that can be attached to DCDR service tokens.
+ *
+ * Notes
+ * - `scopes` remains an open `string[]` surface for backward compatibility.
+ * - This enum only publishes shared canonical values that runtime/backend/UI
+ *   may want to reference consistently.
+ */
+export declare enum DcdrServiceTokenScope {
+    GATEWAY = "gateway"
+}
 export declare enum DcdrServiceTokenLimitType {
     FIXED = "FIXED",
     LIMITED_BY_HOUR = "LIMITED_BY_HOUR",
     LIMITED_BY_DAY = "LIMITED_BY_DAY",
     LIMITED_BY_MONTH = "LIMITED_BY_MONTH"
 }
+/**
+ * Gateway binding for one provider.
+ *
+ * Notes
+ * - `credentialRef` uses the same reference concept already used elsewhere in
+ *   DCDR contracts.
+ * - Runtime/backend should treat `provider` as unique within one token's
+ *   `gatewayBindings` array.
+ */
+export interface DcdrServiceTokenGatewayProviderBinding {
+    provider: IntentProvider;
+    credentialRef: string;
+}
 export interface DcdrServiceTokenLimit {
     /**
      * Maximum number of execution endpoint calls allowed for this limit window.
@@ -39,6 +64,16 @@ export type DcdrServiceTokenSnapshotItem = {
     exp?: number;
     /** Optional runtime-enforced execution limits for this token. */
     limits?: DcdrServiceTokenLimit[];
+    /**
+     * Optional OpenAI-compatible gateway bindings.
+     *
+     * Intended use
+     * - A token with `gateway` scope can be constrained to exactly one backend-
+     *   managed credential reference per provider.
+     * - Runtime should resolve the selected credential by reference via backend
+     *   before making the upstream provider call.
+     */
+    gatewayBindings?: DcdrServiceTokenGatewayProviderBinding[];
     /** Optional note for operators. */
     note?: string;
 };

package/dist/service-tokens.contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-tokens.contract.d.ts","sourceRoot":"","sources":["../src/service-tokens.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,sBAAsB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE1D,oBAAY,yBAAyB;IACnC,KAAK,UAAU;IACf,eAAe,oBAAoB;IACnC,cAAc,mBAAmB;IACjC,gBAAgB,qBAAqB;CACtC;AAED,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,IAAI,EAAE,yBAAyB,CAAC;IAEhC;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,MAAM,4BAA4B,GAAG;IACzC,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;IAEX,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IAEf,MAAM,EAAE,sBAAsB,CAAC;IAE/B,kGAAkG;IAClG,MAAM,EAAE,MAAM,EAAE,CAAC;IAEjB,yGAAyG;IACzG,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,iEAAiE;IACjE,MAAM,CAAC,EAAE,qBAAqB,EAAE,CAAC;IAEjC,mCAAmC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,4BAA4B,EAAE,CAAC;IACvC,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC"}
+{"version":3,"file":"service-tokens.contract.d.ts","sourceRoot":"","sources":["../src/service-tokens.contract.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,MAAM,sBAAsB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE1D;;;;;;;GAOG;AACH,oBAAY,qBAAqB;IAC/B,OAAO,YAAY;CACpB;AAED,oBAAY,yBAAyB;IACnC,KAAK,UAAU;IACf,eAAe,oBAAoB;IACnC,cAAc,mBAAmB;IACjC,gBAAgB,qBAAqB;CACtC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,sCAAsC;IACrD,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,IAAI,EAAE,yBAAyB,CAAC;IAEhC;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,MAAM,4BAA4B,GAAG;IACzC,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;IAEX,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;IAEf,MAAM,EAAE,sBAAsB,CAAC;IAE/B,kGAAkG;IAClG,MAAM,EAAE,MAAM,EAAE,CAAC;IAEjB,yGAAyG;IACzG,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,iEAAiE;IACjE,MAAM,CAAC,EAAE,qBAAqB,EAAE,CAAC;IAEjC;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,sCAAsC,EAAE,CAAC;IAE3D,mCAAmC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,iCAAiC,GAAG;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,4BAA4B,EAAE,CAAC;IACvC,8CAA8C;IAC9C,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC"}

package/dist/service-tokens.contract.js

@@ -1,14 +1,18 @@
 "use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DcdrServiceTokenLimitType = exports.DcdrServiceTokenScope = void 0;
 /**
- * Snapshot of allowed (and revoked) customer service tokens.
+ * Stable well-known scopes that can be attached to DCDR service tokens.
  *
- * IMPORTANT:
- * - Never include tokens in clear.
- * - Tokens are referenced by sha256(utf8(tokenString)) in hex.
- * - Backend should keep this snapshot stable & ordered for reproducible ETags.
+ * Notes
+ * - `scopes` remains an open `string[]` surface for backward compatibility.
+ * - This enum only publishes shared canonical values that runtime/backend/UI
+ *   may want to reference consistently.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DcdrServiceTokenLimitType = void 0;
+var DcdrServiceTokenScope;
+(function (DcdrServiceTokenScope) {
+    DcdrServiceTokenScope["GATEWAY"] = "gateway";
+})(DcdrServiceTokenScope || (exports.DcdrServiceTokenScope = DcdrServiceTokenScope = {}));
 var DcdrServiceTokenLimitType;
 (function (DcdrServiceTokenLimitType) {
     DcdrServiceTokenLimitType["FIXED"] = "FIXED";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dcdr/contracts",
-  "version": "2.5.2",
+  "version": "2.6.0",
   "homepage": "https://dcdr.ai",
   "description": "TypeScript contracts and runtime client for DCDR intent-based AI execution",
   "private": false,
@@ -31,11 +31,13 @@
   ],
   "scripts": {
     "prepare": "npm run build",
-    "check": "tsc --noEmit",
+    "prepublishOnly": "npm run check && npm test",
+    "check": "tsc --noEmit && npm run check:no-barrel-cycles",
+    "check:no-barrel-cycles": "node tools/check-no-barrel-cycles.js",
     "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
     "build": "npm run clean && tsc -p tsconfig.json",
-    "test": "npm run build && jest",
-    "test:ci": "npm run build && jest --runInBand"
+    "test": "npm run build && npm run check:no-barrel-cycles && jest",
+    "test:ci": "npm run build && npm run check:no-barrel-cycles && jest --runInBand"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",
@@ -72,6 +74,8 @@
     "./policies.contract": { "types": "./dist/policies.contract.d.ts", "default": "./dist/policies.contract.js" },
     "./prompts.contract": { "types": "./dist/prompts.contract.d.ts", "default": "./dist/prompts.contract.js" },
     "./provider.contract": { "types": "./dist/provider.contract.d.ts", "default": "./dist/provider.contract.js" },
+    "./provider-limits.contract": { "types": "./dist/provider-limits.contract.d.ts", "default": "./dist/provider-limits.contract.js" },
+    "./provider.catalog.contract": { "types": "./dist/provider.catalog.contract.d.ts", "default": "./dist/provider.catalog.contract.js" },
     "./service-tokens.contract": { "types": "./dist/service-tokens.contract.d.ts", "default": "./dist/service-tokens.contract.js" },
     "./session.contract": { "types": "./dist/session.contract.d.ts", "default": "./dist/session.contract.js" }
   },
@@ -100,6 +104,8 @@
       "policies.contract": ["dist/policies.contract.d.ts"],
       "prompts.contract": ["dist/prompts.contract.d.ts"],
       "provider.contract": ["dist/provider.contract.d.ts"],
+      "provider-limits.contract": ["dist/provider-limits.contract.d.ts"],
+      "provider.catalog.contract": ["dist/provider.catalog.contract.d.ts"],
       "service-tokens.contract": ["dist/service-tokens.contract.d.ts"],
       "session.contract": ["dist/session.contract.d.ts"]
     }