@m6d/cortex-cli 1.2.0 → 1.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@m6d/cortex-cli",
-    "version": "1.2.0",
+    "version": "1.4.0",
     "description": "Scaffold and operate Cortex servers",
     "license": "MIT",
     "type": "module",
@@ -16,7 +16,7 @@
     ],
     "scripts": {
         "check": "tsc --noEmit",
-        "prepack": "cp -R ../../internal/contracts src/contracts && rm src/contracts/package.json src/contracts/tsconfig.json",
+        "prepack": "rm -rf src/contracts && cp -R ../../internal/contracts/src src/contracts",
         "postpack": "rm -rf src/contracts",
         "test": "bun test"
     },

package/src/contracts/client-tools/index.ts

@@ -0,0 +1,56 @@
+/**
+ * The embed ↔ widget handshake for client tools.
+ *
+ * A page embedded by the chat widget (a hosted checkout, signing page, …)
+ * reports its outcome with:
+ *
+ *     window.parent.postMessage(
+ *         { type: "cortex:client-tool", status: "completed", reference: "session_123" },
+ *         "*",
+ *     );
+ *
+ * The widget accepts the message only when the event's origin matches the
+ * tool's configured `embedOrigin`. The payload is the page's claim, relayed to
+ * the agent as-is: cortex does not verify it, and anything that must actually
+ * be true lives in the integrating backend's own records.
+ *
+ * Like the wire seam, this file is compiled into the client SDKs and must stay
+ * free of runtime dependencies. It is also the spec any future SDK (Flutter)
+ * reimplements against.
+ */
+
+export const CLIENT_TOOL_MESSAGE_TYPE = "cortex:client-tool";
+
+export const CLIENT_TOOL_STATUSES = ["completed", "cancelled", "failed"] as const;
+
+export type ClientToolStatus = (typeof CLIENT_TOOL_STATUSES)[number];
+
+export type ClientToolHandshake = {
+    type: typeof CLIENT_TOOL_MESSAGE_TYPE;
+    status: ClientToolStatus;
+    /** Opaque id for the integrating backend's own bookkeeping (session id, envelope id, …). */
+    reference?: string;
+    /** Optional payload passed through to the agent as part of the tool result. */
+    result?: unknown;
+};
+
+/**
+ * Parse a `message` event into a handshake, or null when the origin doesn't
+ * match the tool's `embedOrigin` or the payload isn't a well-formed handshake.
+ * Call from the widget's `message` listener with `event.data` / `event.origin`.
+ */
+export function parseClientToolHandshake(data: unknown, origin: string, embedOrigin: string) {
+    if (origin !== embedOrigin) return null;
+    if (typeof data !== "object" || data === null) return null;
+    const message = data as Record<string, unknown>;
+    if (message["type"] !== CLIENT_TOOL_MESSAGE_TYPE) return null;
+    const status = CLIENT_TOOL_STATUSES.find((known) => known === message["status"]);
+    if (!status) return null;
+    const reference = message["reference"];
+    return {
+        type: CLIENT_TOOL_MESSAGE_TYPE,
+        status,
+        ...(typeof reference === "string" ? { reference } : {}),
+        ...(message["result"] !== undefined ? { result: message["result"] } : {}),
+    } satisfies ClientToolHandshake;
+}

package/src/contracts/graph/index.ts

@@ -0,0 +1,30 @@
+/**
+ * The graph contract — the knowledge-graph vocabulary, authoring types and
+ * clients that `@m6d/cortex-cli` writes with and `@m6d/cortex-server` reads
+ * with. `@m6d/cortex-server` re-exports all of it, so a project authoring
+ * domains still has exactly one import path.
+ */
+
+export type { GraphSchema } from "./schema";
+export { GRAPH_SCHEMA, GRAPH_SCHEMA_VERSION } from "./schema";
+
+export type {
+    EndpointScalarType,
+    EndpointProperty,
+    ResponseKind,
+    AutoGenerated,
+    ConceptDef,
+    EndpointDef,
+    EndpointInput,
+    ServiceDef,
+    RuleDef,
+    DomainDef,
+} from "./types";
+
+export { defineConcept, defineRule, defineService, defineDomain, defineEndpoint } from "./helpers";
+
+export type { Neo4jConfig, Neo4jClient } from "./clients/neo4j";
+export { createNeo4jClient } from "./clients/neo4j";
+
+export type { EmbedFn, EmbeddingProviderConfig } from "./clients/embed";
+export { createEmbedder } from "./clients/embed";

package/src/contracts/{runtime.ts → runtime/index.ts}

@@ -90,16 +90,15 @@ export const knowledgeChunkSchema = z.object({
 });
 
 /**
- * Runtime contract §5.4: present on signatures of `interactive` tools — flows
+ * Runtime contract §5.4: present on signatures of `embedded` tools — flows
  * the end user completes in an embedded surface inside the chat widget. The
  * tool's endpoint fields act as the *initiate* call (returns the embed URL);
- * `hasVerify` marks a second, server-trusted call that settles the result.
+ * the result the page reports back is relayed as-is — verifying it is the
+ * integrating backend's job.
  */
-export const toolInteractionSchema = z.object({
+export const toolEmbedSchema = z.object({
     surface: z.enum(["inline", "modal"]),
     embedOrigin: z.url(),
-    hasVerify: z.boolean(),
-    resultDelivery: z.enum(["agent", "endpoint", "both"]),
 });
 
 export const toolSignatureSchema = z.object({
@@ -111,8 +110,8 @@ export const toolSignatureSchema = z.object({
     signature: z.string(),
     score: z.number().nullable(),
     pinned: z.boolean(),
-    interaction: toolInteractionSchema.optional(),
-    /** Interactive tools only: the published input JSON Schema, verbatim.
+    embed: toolEmbedSchema.optional(),
+    /** Client tools only: the published input JSON Schema, verbatim.
      * Client-executed declarations need a real schema — the rendered
      * `signature` text alone is not enough for function calling. */
     inputSchema: z.record(z.string(), z.unknown()).optional(),
@@ -133,7 +132,6 @@ export const runtimeAgentConfigSchema = z.object({
     agentId: agentSlugSchema,
     systemPrompt: z.string(),
     promptVariables: z.array(z.enum(PROMPT_VARIABLES)),
-    catalogBlurb: z.string(),
     defaultLocale: localeSchema,
     metaTools: z.object({
         searchKnowledge: z.boolean(),
@@ -212,9 +210,6 @@ export const searchKnowledgeResponseSchema = z.object({
 
 export const executeRequestSchema = z.object({
     input: z.record(z.string(), z.unknown()).default({}),
-    // Interactive tools only: absent | "initiate" targets the tool's endpoint
-    // fields, "verify" targets its verify endpoint config.
-    phase: z.enum(["initiate", "verify"]).optional(),
     context: z
         .object({
             threadId: z.string().max(128).optional(),
@@ -257,7 +252,7 @@ export const runtimeErrorSchema = z.object({
     }),
 });
 
-export type ToolInteraction = z.infer<typeof toolInteractionSchema>;
+export type ToolEmbed = z.infer<typeof toolEmbedSchema>;
 export type RuntimeAgentConfig = z.infer<typeof runtimeAgentConfigSchema>;
 export type ResolveRequest = z.input<typeof resolveRequestSchema>;
 export type ResolveResponse = z.infer<typeof resolveResponseSchema>;

package/src/contracts/{wire.ts → wire/index.ts}

@@ -71,16 +71,14 @@ export type TokenUsage = {
 };
 
 /**
- * How to launch one interactive tool: stamped by the server, per tool name, on
+ * How to launch one client tool: stamped by the server, per tool name, on
  * the metadata of an assistant message that may carry its pending call. Kept in
  * the message so the binding survives server restarts while a run is parked.
  */
-export type InteractiveToolBinding = {
+export type ClientToolBinding = {
     toolId: string;
     surface: "inline" | "modal";
     embedOrigin: string;
-    hasVerify: boolean;
-    resultDelivery: "agent" | "endpoint" | "both";
 };
 
 export type MessageMetadata = {
@@ -89,10 +87,7 @@ export type MessageMetadata = {
     isAborted?: boolean;
     tokenUsage?: TokenUsage;
     attachments?: AttachmentSummary[];
-    interactiveTools?: Record<string, InteractiveToolBinding>;
-    /** Per tool call: the trusted reference its initiate call returned. A
-     * verified completion must match it — the browser's word is never enough. */
-    interactiveReferences?: Record<string, string>;
+    clientTools?: Record<string, ClientToolBinding>;
 };
 
 /**
@@ -111,15 +106,32 @@ export type CortexMessage<TPart = unknown> = {
 };
 
 /**
- * Response of `POST /chat/:chatId/tools/:toolCallId/initiate`. `interactive:
- * false` means the pending call is not an interactive CC tool — the widget
+ * Key under the AG-UI request's `forwardedProps` carrying the answers to
+ * parked client tool calls on a continuation request. The server owns the
+ * transcript (a continuation sends `messages: []`), so the answered assistant
+ * message itself never crosses the wire — the SDK's park-boundary snapshot
+ * does not preserve its id, and round-tripping it duplicated the stored
+ * message.
+ */
+export const CLIENT_TOOL_ANSWERS_KEY = "clientToolAnswers";
+
+/** One answered client tool call, applied to the stored transcript server-side. */
+export type ClientToolAnswer = {
+    toolCallId: string;
+    output: unknown;
+    state: "complete" | "error";
+};
+
+/**
+ * Response of `POST /chat/:chatId/tools/:toolCallId/initiate`. `embed:
+ * false` means the pending call is not a CC client tool — the widget
  * falls back to its default rendering for the call. The payload is for the
  * widget only; it never reaches the LLM.
  */
-export type InteractiveInitiateResult =
-    | { interactive: false }
+export type ClientToolInitiateResult =
+    | { embed: false }
     | {
-          interactive: true;
+          embed: true;
           embedUrl: string;
           surface: "inline" | "modal";
           embedOrigin: string;

package/tsconfig.json

@@ -22,7 +22,7 @@
             // vendors it into src/contracts, where the first candidate finds it in
             // the published tarball. Inside the repo that copy doesn't exist and
             // resolution falls through to the workspace source.
-            "@cortex/contracts/*": ["./src/contracts/*", "../../internal/contracts/*"],
+            "@cortex/contracts/*": ["./src/contracts/*", "../../internal/contracts/src/*"],
             // Internal-only, and the reason this file ships in package.json `files`:
             // the CLI runs as raw TypeScript from inside node_modules, so Bun has to
             // read this config to resolve `@/`.

package/src/contracts/README.md

@@ -1,23 +0,0 @@
-# @cortex/contracts
-
-The shapes both sides of a cortex boundary must agree on. Private on purpose —
-it never publishes; each publishable package carries its own copy:
-
-- `@m6d/cortex-server` and `@m6d/cortex-cli` publish raw source, so their
-  `prepack` vendors a copy of this directory into the tarball (`contracts/` and
-  `src/contracts/` respectively), resolved there by their shipped tsconfig paths.
-- `@m6d/cortex-angular` and `@m6d/cortex-react` compile the parts they import
-  into their build artifacts.
-
-Three boundaries, one subpath each:
-
-| import                      | boundary                                                      |
-| --------------------------- | ------------------------------------------------------------- |
-| `@cortex/contracts/wire`    | chat client ↔ server (HTTP/WebSocket types)                   |
-| `@cortex/contracts/runtime` | cortex-cc console ↔ server runtime API (zod schemas)          |
-| `@cortex/contracts/graph`   | graph authoring (cli) ↔ server (vocabulary, helpers, clients) |
-
-Everything is consumed as TypeScript source — no build, no dist. Nothing here
-has a runtime dependency beyond zod (for `/runtime`), and nothing here may grow
-one: these files are compiled into an Angular library, a React library, a CLI
-and a Bun server alike.

package/src/contracts/graph.ts

@@ -1,36 +0,0 @@
-/**
- * The graph contract — the knowledge-graph vocabulary, authoring types and
- * clients that `@m6d/cortex-cli` writes with and `@m6d/cortex-server` reads
- * with. `@m6d/cortex-server` re-exports all of it, so a project authoring
- * domains still has exactly one import path.
- */
-
-export type { GraphSchema } from "./graph/schema";
-export { GRAPH_SCHEMA, GRAPH_SCHEMA_VERSION } from "./graph/schema";
-
-export type {
-    EndpointScalarType,
-    EndpointProperty,
-    ResponseKind,
-    AutoGenerated,
-    ConceptDef,
-    EndpointDef,
-    EndpointInput,
-    ServiceDef,
-    RuleDef,
-    DomainDef,
-} from "./graph/types";
-
-export {
-    defineConcept,
-    defineRule,
-    defineService,
-    defineDomain,
-    defineEndpoint,
-} from "./graph/helpers";
-
-export type { Neo4jConfig, Neo4jClient } from "./graph/neo4j";
-export { createNeo4jClient } from "./graph/neo4j";
-
-export type { EmbedFn, EmbeddingProviderConfig } from "./graph/embed";
-export { createEmbedder } from "./graph/embed";

package/src/contracts/interactive.ts

@@ -1,53 +0,0 @@
-/**
- * The embed ↔ widget handshake for interactive tools.
- *
- * A page embedded by the chat widget (a hosted checkout, signing page, …)
- * reports its outcome with:
- *
- *     window.parent.postMessage(
- *         { type: "cortex:interactive", status: "completed", reference: "session_123" },
- *         "*",
- *     );
- *
- * The widget accepts the message only when the event's origin matches the
- * tool's configured `embedOrigin`, and treats the payload as untrusted — for
- * tools with a verify endpoint the server re-checks the reference before the
- * agent sees a result.
- *
- * Like `wire.ts`, this file is compiled into the client SDKs and must stay
- * free of runtime dependencies. It is also the spec any future SDK (Flutter)
- * reimplements against.
- */
-
-export const INTERACTIVE_MESSAGE_TYPE = "cortex:interactive";
-
-export const INTERACTIVE_STATUSES = ["completed", "cancelled", "failed"] as const;
-
-export type InteractiveStatus = (typeof INTERACTIVE_STATUSES)[number];
-
-export type InteractiveHandshake = {
-    type: typeof INTERACTIVE_MESSAGE_TYPE;
-    status: InteractiveStatus;
-    /** Opaque id the tool's verify endpoint resolves (session id, envelope id, …). */
-    reference?: string;
-};
-
-/**
- * Parse a `message` event into a handshake, or null when the origin doesn't
- * match the tool's `embedOrigin` or the payload isn't a well-formed handshake.
- * Call from the widget's `message` listener with `event.data` / `event.origin`.
- */
-export function parseInteractiveHandshake(data: unknown, origin: string, embedOrigin: string) {
-    if (origin !== embedOrigin) return null;
-    if (typeof data !== "object" || data === null) return null;
-    const message = data as Record<string, unknown>;
-    if (message["type"] !== INTERACTIVE_MESSAGE_TYPE) return null;
-    const status = INTERACTIVE_STATUSES.find((known) => known === message["status"]);
-    if (!status) return null;
-    const reference = message["reference"];
-    return {
-        type: INTERACTIVE_MESSAGE_TYPE,
-        status,
-        ...(typeof reference === "string" ? { reference } : {}),
-    } satisfies InteractiveHandshake;
-}