@geraldmaron/construct 1.0.0 → 1.0.1

package/lib/provider-capabilities.js

@@ -0,0 +1,142 @@
+/**
+ * lib/provider-capabilities.js — Model-agnostic provider capability interface.
+ *
+ * Follows the embeddings-engine.js pattern:
+ *   - This file is the model-agnostic router.
+ *   - Provider-specific logic lives in provider-capabilities-*.js adapters.
+ *   - All adapters return the same capability shape.
+ *
+ * Standard capability interface (all adapters implement this shape):
+ *   - cacheControl: boolean
+ *   - cacheMechanism: 'annotation' | 'automatic' | 'resource' | 'none'
+ *   - cacheTTL: { '5m': number, '1h': number } | null (tokens, not ms)
+ *   - structuredOutput: boolean
+ *   - maxContextWindow: number (tokens)
+ *   - tokenRatio: number (chars per token for this provider)
+ *   - annotationFormat: 'anthropic' | 'google' | 'openai' | 'none'
+ *   - annotationHeaders: object | null
+ */
+import { readFileSync, existsSync, writeFileSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+
+const CAPABILITY_CACHE_PATH = join(homedir(), '.cx', 'provider-capabilities.json');
+const CAPABILITY_CACHE_TTL_MS = 24 * 60 * 60 * 1000; // 24h
+
+const ADAPTERS = {
+  anthropic: () => import('./provider-capabilities-anthropic.js'),
+  'anthropic-direct': () => import('./provider-capabilities-anthropic.js'),
+  google: () => import('./provider-capabilities-google.js'),
+  openai: () => import('./provider-capabilities-openai.js'),
+  deepseek: () => import('./provider-capabilities-deepseek.js'),
+  generic: () => import('./provider-capabilities-generic.js'),
+};
+
+function resolveAdapterKey(modelId) {
+  const id = String(modelId || '').toLowerCase();
+  if (/^anthropic\//.test(id) || /^openrouter\/anthropic\//.test(id)) return 'anthropic';
+  if (/^google\//.test(id) || /^openrouter\/google\//.test(id)) return 'google';
+  if (/^openai\//.test(id) || /^openrouter\/openai\//.test(id) || /^github-copilot\//.test(id)) return 'openai';
+  if (/^deepseek\//.test(id) || /^openrouter\/deepseek\//.test(id)) return 'deepseek';
+  return 'generic';
+}
+
+function readCapabilityCache() {
+  try {
+    if (!existsSync(CAPABILITY_CACHE_PATH)) return {};
+    const cached = JSON.parse(readFileSync(CAPABILITY_CACHE_PATH, 'utf8'));
+    if (cached?.fetchedAt && Date.now() - cached.fetchedAt < CAPABILITY_CACHE_TTL_MS) {
+      return cached.capabilities || {};
+    }
+  } catch { /* stale or corrupt */ }
+  return {};
+}
+
+function writeCapabilityCache(capabilities) {
+  try {
+    mkdirSync(join(homedir(), '.cx'), { recursive: true });
+    writeFileSync(CAPABILITY_CACHE_PATH, JSON.stringify({
+      fetchedAt: Date.now(),
+      capabilities,
+    }, null, 2));
+  } catch { /* best effort */ }
+}
+
+let _cache = null;
+function getCache() {
+  if (_cache === null) _cache = readCapabilityCache();
+  return _cache;
+}
+
+/**
+ * Resolve provider capabilities for a given model ID.
+ * Returns the standard capability interface.
+ *
+ * @param {string} modelId - The model identifier (e.g., "anthropic/claude-opus-4-6")
+ * @returns {object} Capability object with the standard shape
+ */
+export async function resolveProviderCapabilities(modelId) {
+  const adapterKey = resolveAdapterKey(modelId);
+  const loader = ADAPTERS[adapterKey] || ADAPTERS.generic;
+
+  try {
+    const { capabilities } = await loader();
+    return capabilities(modelId);
+  } catch {
+    // Fallback to generic
+    const { capabilities } = await ADAPTERS.generic();
+    return capabilities(modelId);
+  }
+}
+
+/**
+ * Synchronous version — uses cache if available, otherwise returns generic.
+ * Use this in hot paths where async is not possible.
+ *
+ * @param {string} modelId
+ * @returns {object} Capability object
+ */
+export function resolveProviderCapabilitiesSync(modelId) {
+  const adapterKey = resolveAdapterKey(modelId);
+  const cache = getCache();
+
+  // Check cache first (keyed by adapter type, not full model ID)
+  if (cache[adapterKey]) return cache[adapterKey];
+
+  // Return generic synchronously (can't load adapter in sync context)
+  return {
+    cacheControl: false,
+    cacheMechanism: 'none',
+    cacheTTL: null,
+    structuredOutput: false,
+    maxContextWindow: 200000,
+    tokenRatio: 4,
+    annotationFormat: 'none',
+    annotationHeaders: null,
+  };
+}
+
+/**
+ * Probe provider for live capabilities (async).
+ * Results are cached for 24h.
+ *
+ * @param {string} modelId
+ * @param {object} opts - { probe: boolean }
+ * @returns {Promise<object>}
+ */
+export async function probeProviderCapabilities(modelId, { probe = false } = {}) {
+  const caps = await resolveProviderCapabilities(modelId);
+
+  if (probe) {
+    // TODO: implement live probing (API call) in Phase A follow-up
+    // For now, just return the static capabilities
+  }
+
+  // Cache by adapter key
+  const adapterKey = resolveAdapterKey(modelId);
+  const cache = getCache();
+  cache[adapterKey] = caps;
+  writeCapabilityCache(cache);
+
+  return caps;
+}

package/lib/providers/atlassian-confluence/index.mjs

@@ -0,0 +1,103 @@
+/**
+ * lib/providers/atlassian-confluence/index.mjs — Confluence data-source provider.
+ *
+ * Capabilities: read, search.
+ *
+ * Auth: shares JIRA_* env vars with the Jira provider (Atlassian Cloud uses
+ * the same email + API token across products) plus optional
+ * `CONFLUENCE_BASE_URL` if it differs from `JIRA_BASE_URL`.
+ *
+ * Config (per call):
+ *   - pageId:  numeric id of the page to read
+ *   - cql:     CQL query string (e.g. 'space = ENG AND text ~ "auth"')
+ *   - limit:   integer (default 25)
+ */
+
+const DEFAULT_LIMIT = 25;
+const HARD_LIMIT = 100;
+
+function authConfig(env) {
+  const baseUrl = (env.CONFLUENCE_BASE_URL || env.JIRA_BASE_URL || '').replace(/\/$/, '');
+  const email = env.CONFLUENCE_EMAIL || env.JIRA_EMAIL || '';
+  const token = env.CONFLUENCE_API_TOKEN || env.JIRA_API_TOKEN || '';
+  return { baseUrl, email, token, ok: Boolean(baseUrl && email && token) };
+}
+
+function authHeader({ email, token }) {
+  if (!email || !token) return {};
+  const basic = Buffer.from(`${email}:${token}`).toString('base64');
+  return { Authorization: `Basic ${basic}` };
+}
+
+async function confluenceFetch(path, env, init = {}) {
+  const auth = authConfig(env);
+  if (!auth.ok) throw new Error('confluence: base URL + email + token required');
+  const res = await fetch(`${auth.baseUrl}${path}`, {
+    ...init,
+    headers: {
+      'Accept': 'application/json',
+      ...authHeader(auth),
+      ...(init.headers || {}),
+    },
+  });
+  if (!res.ok) {
+    const body = await res.text().catch(() => '');
+    throw new Error(`Confluence ${res.status} ${res.statusText}: ${body.slice(0, 200)}`);
+  }
+  return res.json();
+}
+
+export function create({ env = process.env } = {}) {
+  return {
+    meta: {
+      id: 'atlassian-confluence',
+      displayName: 'Atlassian Confluence',
+      capabilities: ['read', 'search'],
+      description: 'Pages, spaces, CQL search.',
+    },
+
+    configSchema: {
+      $schema: 'https://json-schema.org/draft/2020-12/schema',
+      type: 'object',
+      properties: {
+        pageId: { type: 'string', pattern: '^[0-9]+$' },
+        cql: { type: 'string' },
+        limit: { type: 'integer', minimum: 1, maximum: HARD_LIMIT, default: DEFAULT_LIMIT },
+      },
+    },
+
+    async health() {
+      const auth = authConfig(env);
+      if (!auth.ok) {
+        return { ok: false, detail: 'CONFLUENCE_BASE_URL/JIRA_BASE_URL + email + token not set' };
+      }
+      try {
+        await confluenceFetch('/wiki/rest/api/space?limit=1', env);
+        return { ok: true, detail: `connected to ${auth.baseUrl}` };
+      } catch (err) {
+        return { ok: false, detail: err.message };
+      }
+    },
+
+    async read(config) {
+      if (!config?.pageId) throw new Error('confluence.read: config.pageId required');
+      return confluenceFetch(
+        `/wiki/rest/api/content/${encodeURIComponent(config.pageId)}?expand=body.storage,version`,
+        env
+      );
+    },
+
+    async search(config) {
+      const cql = config?.cql;
+      if (!cql) throw new Error('confluence.search: config.cql required');
+      const limit = Math.min(config?.limit || DEFAULT_LIMIT, HARD_LIMIT);
+      const data = await confluenceFetch(
+        `/wiki/rest/api/content/search?cql=${encodeURIComponent(cql)}&limit=${limit}`,
+        env
+      );
+      return Array.isArray(data?.results) ? data.results : [];
+    },
+  };
+}
+
+export default create;

package/lib/providers/atlassian-jira/index.mjs

@@ -0,0 +1,100 @@
+/**
+ * lib/providers/atlassian-jira/index.mjs — Jira data-source provider.
+ *
+ * Capabilities: read, search.
+ *
+ * Auth: `JIRA_BASE_URL`, `JIRA_EMAIL`, `JIRA_API_TOKEN` from env.
+ *
+ * Config (per call):
+ *   - issueKey: 'PROJ-123' for read
+ *   - jql:      JQL string for search (e.g. 'project = RLBLT AND assignee = currentUser()')
+ *   - maxResults: integer (default 50, max 100)
+ */
+
+const DEFAULT_MAX = 50;
+const HARD_MAX = 100;
+
+function authConfig(env) {
+  const baseUrl = env.JIRA_BASE_URL?.replace(/\/$/, '') || '';
+  const email = env.JIRA_EMAIL || '';
+  const token = env.JIRA_API_TOKEN || '';
+  return { baseUrl, email, token, ok: Boolean(baseUrl && email && token) };
+}
+
+function authHeader({ email, token }) {
+  if (!email || !token) return {};
+  const basic = Buffer.from(`${email}:${token}`).toString('base64');
+  return { Authorization: `Basic ${basic}` };
+}
+
+async function jiraFetch(path, env, init = {}) {
+  const auth = authConfig(env);
+  if (!auth.ok) throw new Error('jira: JIRA_BASE_URL, JIRA_EMAIL, and JIRA_API_TOKEN must be set');
+  const url = `${auth.baseUrl}${path}`;
+  const res = await fetch(url, {
+    ...init,
+    headers: {
+      'Accept': 'application/json',
+      'Content-Type': 'application/json',
+      ...authHeader(auth),
+      ...(init.headers || {}),
+    },
+  });
+  if (!res.ok) {
+    const body = await res.text().catch(() => '');
+    throw new Error(`Jira ${res.status} ${res.statusText}: ${body.slice(0, 200)}`);
+  }
+  return res.json();
+}
+
+export function create({ env = process.env } = {}) {
+  return {
+    meta: {
+      id: 'atlassian-jira',
+      displayName: 'Atlassian Jira',
+      capabilities: ['read', 'search'],
+      description: 'Issues, sprints, JQL search.',
+    },
+
+    configSchema: {
+      $schema: 'https://json-schema.org/draft/2020-12/schema',
+      type: 'object',
+      properties: {
+        issueKey: { type: 'string', pattern: '^[A-Z][A-Z0-9_]+-[0-9]+$' },
+        jql: { type: 'string' },
+        maxResults: { type: 'integer', minimum: 1, maximum: HARD_MAX, default: DEFAULT_MAX },
+      },
+    },
+
+    async health() {
+      const auth = authConfig(env);
+      if (!auth.ok) {
+        return { ok: false, detail: 'JIRA_BASE_URL / JIRA_EMAIL / JIRA_API_TOKEN not set' };
+      }
+      try {
+        await jiraFetch('/rest/api/3/myself', env);
+        return { ok: true, detail: `connected to ${auth.baseUrl}` };
+      } catch (err) {
+        return { ok: false, detail: err.message };
+      }
+    },
+
+    async read(config) {
+      if (!config?.issueKey) throw new Error('jira.read: config.issueKey required');
+      return jiraFetch(`/rest/api/3/issue/${encodeURIComponent(config.issueKey)}`, env);
+    },
+
+    async search(config) {
+      const jql = config?.jql;
+      if (!jql) throw new Error('jira.search: config.jql required');
+      const max = Math.min(config?.maxResults || DEFAULT_MAX, HARD_MAX);
+      const data = await jiraFetch('/rest/api/3/search', env, {
+        method: 'POST',
+        body: JSON.stringify({ jql, maxResults: max, fields: ['summary', 'status', 'assignee', 'priority', 'updated'] }),
+      });
+      return Array.isArray(data?.issues) ? data.issues : [];
+    },
+  };
+}
+
+export default create;

package/lib/providers/auth-manager.mjs

@@ -0,0 +1,126 @@
+// lib/providers/auth-manager.mjs
+// OAuth refresh and token lifecycle management
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { homedir } from 'node:os';
+
+const AUTH_DIR = path.join(homedir(), '.construct', 'auth');
+
+try {
+  fs.mkdirSync(AUTH_DIR, { recursive: true, mode: 0o700 });
+} catch { /* ignore */ }
+
+const PROVIDER_CONFIGS = {
+  github: {
+    name: 'GitHub',
+    tokenExpiry: null,
+    refreshable: false,
+    envVar: 'GITHUB_TOKEN',
+  },
+  salesforce: {
+    name: 'Salesforce',
+    tokenExpiry: 7200,
+    refreshable: true,
+    refreshBuffer: 300,
+    envVar: 'SALESFORCE_ACCESS_TOKEN',
+    refreshEnvVar: 'SALESFORCE_REFRESH_TOKEN',
+  },
+};
+
+export function loadAuthState(provider) {
+  try {
+    const file = path.join(AUTH_DIR, `${provider}.json`);
+    if (fs.existsSync(file)) {
+      return JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+  } catch { /* ignore */ }
+  return null;
+}
+
+export function saveAuthState(provider, state) {
+  try {
+    const file = path.join(AUTH_DIR, `${provider}.json`);
+    fs.writeFileSync(file, JSON.stringify(state, null, 2), { mode: 0o600 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function getTokenStatus(provider) {
+  const config = PROVIDER_CONFIGS[provider];
+  if (!config) return { valid: false, error: 'Unknown provider' };
+  
+  const state = loadAuthState(provider);
+  if (!state) {
+    // Fall back to env var
+    const envToken = process.env[config.envVar];
+    if (!envToken) {
+      return { valid: false, error: 'No token configured' };
+    }
+    return { valid: true, source: 'env', expiresAt: null };
+  }
+  
+  if (!state.expiresAt) {
+    return { valid: true, source: 'auth-store' };
+  }
+  
+  const expiresAt = new Date(state.expiresAt);
+  const now = new Date();
+  const bufferMs = (config.refreshBuffer || 0) * 1000;
+  
+  if (expiresAt - now < bufferMs) {
+    return {
+      valid: false,
+      error: 'Token expired or expiring soon',
+      needsRefresh: config.refreshable,
+    };
+  }
+  
+  return {
+    valid: true,
+    source: 'auth-store',
+    expiresAt: state.expiresAt,
+    expiresIn: Math.floor((expiresAt - now) / 1000),
+  };
+}
+
+export async function withValidToken(provider, fn) {
+  const status = getTokenStatus(provider);
+  
+  if (!status.valid) {
+    if (status.needsRefresh) {
+      const refreshed = await refreshToken(provider);
+      if (!refreshed.success) {
+        throw new Error(`Token refresh failed: ${refreshed.error}`);
+      }
+    } else {
+      throw new Error(`Invalid token: ${status.error}`);
+    }
+  }
+  
+  const state = loadAuthState(provider);
+  const token = state?.token || process.env[PROVIDER_CONFIGS[provider].envVar];
+  
+  return await fn(token);
+}
+
+async function refreshToken(provider) {
+  const config = PROVIDER_CONFIGS[provider];
+  if (!config?.refreshable) {
+    return { success: false, error: 'Provider does not support refresh' };
+  }
+  
+  const state = loadAuthState(provider);
+  if (!state?.refreshToken) {
+    return { success: false, error: 'No refresh token available' };
+  }
+  
+  // Provider-specific refresh logic would go here
+  // For now, just indicate refresh is needed
+  return {
+    success: false,
+    error: 'Token refresh required - reauthenticate manually',
+  };
+}

package/lib/providers/circuit-breaker.mjs

@@ -0,0 +1,124 @@
+/**
+ * lib/providers/circuit-breaker.mjs — per-provider circuit breaker.
+ *
+ * Wraps any async function with three-state breaker semantics:
+ *
+ *   CLOSED  — calls run normally. Consecutive failures are counted.
+ *   OPEN    — calls fail-fast with a `CircuitOpenError`. After
+ *             `cooldownMs`, the breaker transitions to HALF_OPEN.
+ *   HALF_OPEN — the next call is a probe. Success → CLOSED, failure → OPEN.
+ *
+ * Wraps provider HTTP calls so when a remote system goes down, Construct
+ * stops drilling it (and stops blocking user-facing operations on the failure
+ * mode) until the cooldown elapses. State is per-key, so one provider going
+ * down doesn't trip another's breaker.
+ *
+ * The breaker classifies errors via `isFailure(err)`. By default any
+ * non-null error counts as a failure. Callers can pass a predicate to
+ * exclude expected errors (e.g. 4xx auth errors that don't indicate the
+ * remote system is unhealthy).
+ *
+ * Inspection: `getBreaker(key).state`, `.openedAt`, `.failureCount` are
+ * read-only views, useful for `construct doctor` to surface "GitHub
+ * provider circuit OPEN since 12:34:56".
+ */
+
+const STATES = Object.freeze({ CLOSED: 'closed', OPEN: 'open', HALF_OPEN: 'half_open' });
+
+const REGISTRY = new Map();
+
+class CircuitOpenError extends Error {
+  constructor(key, openedAt) {
+    super(`circuit breaker '${key}' is open (since ${new Date(openedAt).toISOString()})`);
+    this.name = 'CircuitOpenError';
+    this.key = key;
+    this.openedAt = openedAt;
+  }
+}
+
+class Breaker {
+  constructor(key, options = {}) {
+    this.key = key;
+    this.failureThreshold = options.failureThreshold ?? 5;
+    this.cooldownMs = options.cooldownMs ?? 30_000;
+    this.isFailure = options.isFailure || ((err) => err != null);
+    this.state = STATES.CLOSED;
+    this.failureCount = 0;
+    this.openedAt = null;
+  }
+
+  reset() {
+    this.state = STATES.CLOSED;
+    this.failureCount = 0;
+    this.openedAt = null;
+  }
+
+  _maybeHalfOpen() {
+    if (this.state !== STATES.OPEN) return;
+    if (Date.now() - this.openedAt >= this.cooldownMs) {
+      this.state = STATES.HALF_OPEN;
+    }
+  }
+
+  _recordSuccess() {
+    if (this.state === STATES.HALF_OPEN) {
+      this.reset();
+      return;
+    }
+    if (this.state === STATES.CLOSED) {
+      this.failureCount = 0;
+    }
+  }
+
+  _recordFailure() {
+    if (this.state === STATES.HALF_OPEN) {
+      this.state = STATES.OPEN;
+      this.openedAt = Date.now();
+      return;
+    }
+    this.failureCount += 1;
+    if (this.failureCount >= this.failureThreshold) {
+      this.state = STATES.OPEN;
+      this.openedAt = Date.now();
+    }
+  }
+
+  async run(fn, ...args) {
+    this._maybeHalfOpen();
+    if (this.state === STATES.OPEN) {
+      throw new CircuitOpenError(this.key, this.openedAt);
+    }
+    try {
+      const result = await fn(...args);
+      this._recordSuccess();
+      return result;
+    } catch (err) {
+      if (this.isFailure(err)) this._recordFailure();
+      throw err;
+    }
+  }
+}
+
+export function getBreaker(key, options) {
+  if (!REGISTRY.has(key)) REGISTRY.set(key, new Breaker(key, options));
+  return REGISTRY.get(key);
+}
+
+export function describeBreakers() {
+  return [...REGISTRY.values()].map((b) => ({
+    key: b.key,
+    state: b.state,
+    failureCount: b.failureCount,
+    openedAt: b.openedAt,
+  }));
+}
+
+export function resetBreaker(key) {
+  REGISTRY.get(key)?.reset();
+}
+
+export function clearBreakerRegistry() {
+  REGISTRY.clear();
+}
+
+export { STATES, CircuitOpenError };

package/lib/providers/contract.mjs

@@ -0,0 +1,93 @@
+/**
+ * lib/providers/contract.mjs — data-source provider contract.
+ *
+ * A provider integrates Construct with an external system that holds work
+ * artefacts: GitHub repos, Jira projects, Confluence spaces, Slack channels,
+ * Salesforce orgs, etc. Providers are stateless adapters — durable state
+ * (cached search results, last-seen markers, observations distilled from
+ * fetched items) lives in core stores, not in the provider.
+ *
+ * A provider module exports a factory:
+ *
+ *   export function create(options) {
+ *     return {
+ *       meta: { id, displayName, capabilities: [...], description },
+ *       configSchema: { ... } // JSON-Schema draft 2020-12
+ *       health: async (config) => ({ ok, detail }),
+ *       read?:    async (config, query) => items[],
+ *       search?:  async (config, query) => items[],
+ *       watch?:   async (config, callback) => unsubscribe,
+ *       write?:   async (config, payload) => result,
+ *       webhook?: async (config, request) => ack,
+ *     };
+ *   }
+ *
+ * Capabilities are an unordered set drawn from the canonical list in
+ * `CAPABILITIES`. A provider declares only what it implements; callers
+ * consult `meta.capabilities` and skip optional methods that aren't
+ * declared.
+ *
+ * `assertProviderContract(provider)` runs at registry load time and refuses
+ * to accept providers that miss required fields or declare capabilities
+ * they don't implement. The check is deliberately loose — providers can
+ * extend the shape with extra methods — but it gates the load-bearing
+ * fields so a typo in a plugin can't take down the registry.
+ */
+
+export const CAPABILITIES = Object.freeze([
+  'read',
+  'search',
+  'watch',
+  'write',
+  'webhook',
+]);
+
+const REQUIRED_META = ['id', 'displayName', 'capabilities'];
+const REQUIRED_METHODS = ['health'];
+const CAPABILITY_TO_METHOD = {
+  read: 'read',
+  search: 'search',
+  watch: 'watch',
+  write: 'write',
+  webhook: 'webhook',
+};
+
+export function assertProviderContract(provider) {
+  if (!provider || typeof provider !== 'object') {
+    throw new Error('provider: must be a non-null object returned from create()');
+  }
+  if (!provider.meta || typeof provider.meta !== 'object') {
+    throw new Error('provider: missing required `meta` object');
+  }
+  for (const field of REQUIRED_META) {
+    if (provider.meta[field] === undefined || provider.meta[field] === null || provider.meta[field] === '') {
+      throw new Error(`provider: meta.${field} is required`);
+    }
+  }
+  if (!Array.isArray(provider.meta.capabilities) || provider.meta.capabilities.length === 0) {
+    throw new Error(`provider (${provider.meta.id}): meta.capabilities must be a non-empty array`);
+  }
+  for (const cap of provider.meta.capabilities) {
+    if (!CAPABILITIES.includes(cap)) {
+      throw new Error(`provider (${provider.meta.id}): unknown capability '${cap}'. Allowed: ${CAPABILITIES.join(', ')}`);
+    }
+    const method = CAPABILITY_TO_METHOD[cap];
+    if (typeof provider[method] !== 'function') {
+      throw new Error(`provider (${provider.meta.id}): capability '${cap}' declared but method '${method}' is missing`);
+    }
+  }
+  for (const fn of REQUIRED_METHODS) {
+    if (typeof provider[fn] !== 'function') {
+      throw new Error(`provider (${provider.meta.id}): missing required method '${fn}'`);
+    }
+  }
+}
+
+export function checkProviderContract(provider) {
+  try {
+    assertProviderContract(provider);
+    return { ok: true, errors: [] };
+  } catch (err) {
+    return { ok: false, errors: [err.message] };
+  }
+}