@native-knowledge/cli 0.1.0-rc.1 → 0.1.0-rc.3

package/dist/internal/serving-contracts/tenant-runtime.js

@@ -0,0 +1,37 @@
+/** Provider20只增加明确授权的运行元数据；不扩展旧版本工具或授予正文读取。 */
+import { z } from 'zod';
+import { materialTenantIdSchema, isoDateTimeSchema, stableUriSchema, sha256Schema, projectKeySchema, tenantResourceRefSchema, tenantBudgetPolicySchema, tenantStorageKey, parseTenantResourceRef, parseTenantCollectionBatchRef, tenantBudgetReasonSchema } from '../contracts/index.js';
+import { tenantProjectWorkspaceToolSchemas, tenantProjectWorkspaceDataSchemas, tenantProjectScopesForInput, tenantProjectAuthorization, tenantProjectErrorSchema, tenantProjectProviderSchema } from './tenant-project.js';
+const count = z.number().int().nonnegative().safe(), cursor = z.string().min(1).max(4096), state = z.enum(['MATCH', 'MISSING', 'UNAVAILABLE', 'INTEGRITY_MISMATCH', 'NOT_REGISTERED']);
+export const tenantRuntimeKindSchema = z.enum(['REQUESTS', 'RESOURCES', 'PROJECTIONS', 'PROJECTS']);
+export const tenantRuntimeInputSchema = z.object({ kind: tenantRuntimeKindSchema.default('REQUESTS'), after: cursor.optional(), limit: z.number().int().min(1).max(20).default(20), requestRef: z.string().regex(/^tenant-collection-request:\/\/[a-f0-9]{64}\/[a-f0-9]{64}$/).optional() }).strict().superRefine((v, ctx) => { if (v.requestRef && (v.kind !== 'REQUESTS' || v.after))
+    ctx.addIssue({ code: 'custom', message: 'Exact request lookup requires REQUESTS without a page cursor' }); });
+export const tenantRuntimeProcessSchema = z.object({ runtimeNodeId: projectKeySchema, workloadId: z.string().min(1).max(256), runId: z.string().min(1).max(256), attribution: z.enum(['COMPLETION_RUN', 'FAILURE_RUN', 'SOURCE_WORKLOAD_LATEST', 'PROJECT_WORKLOAD_LATEST']), batchMatches: z.boolean().nullable(), outcome: z.enum(['SUCCEEDED', 'FAILED', 'TIMED_OUT', 'OUTPUT_LIMIT', 'SPAWN_FAILED', 'RECEIPT_MISSING']).nullable(), receiptStatus: z.enum(['SUCCEEDED', 'PARTIAL', 'FAILED', 'BLOCKED', 'SKIPPED']).nullable(), durationMs: count.nullable(), finishedAt: isoDateTimeSchema, category: z.enum(['NONE', 'TIMEOUT', 'OUTPUT_LIMIT', 'SPAWN_FAILURE', 'V8_HEAP_EXHAUSTED', 'NATIVE_ASSERTION_FAILURE', 'UNCAUGHT_EXCEPTION', 'PROCESS_SIGNAL', 'UNKNOWN_FAILURE']).nullable(), peakRssBytes: count.nullable(), sampleCount: count.nullable() }).strict();
+export const tenantRuntimeResourceSchema = z.object({ ref: tenantResourceRefSchema, contentHash: sha256Schema.nullable(), recordedBytes: count.nullable(), manifest: z.enum(['PRESENT', 'MISSING', 'UNAVAILABLE', 'INTEGRITY_MISMATCH']), blob: z.enum(['PRESENT_UNVERIFIED', 'MISSING', 'UNAVAILABLE', 'INTEGRITY_MISMATCH']), contentHashReverified: z.literal(false), catalog: state, directory: state, search: state }).strict();
+const request = z.object({ kind: z.literal('REQUESTS'), requestRef: stableUriSchema, batchRef: stableUriSchema, admission: z.enum(['PENDING', 'STOPPED', 'COMPLETED', 'FAILED']), failureCode: z.literal('TENANT_SOURCE_HTTP_TERMINAL').nullable().optional(), stopReason: z.enum(['GRANT_REVOKED', 'DELEGATION_SUPERSEDED']).nullable(), executionAuthority: z.enum(['CURRENT', 'BLOCKED', 'NOT_CONFIGURED', 'NOT_PENDING', 'UNAVAILABLE']), budgetReason: tenantBudgetReasonSchema.nullable(), captureRecord: z.enum(['PRESENT', 'MISSING', 'UNAVAILABLE']), raw: tenantRuntimeResourceSchema, derivation: z.enum(['NOT_REQUIRED', 'REGISTERED', 'PENDING', 'UNAVAILABLE']), completedPhase: z.enum(['RAW_REGISTERED', 'DERIVED_REGISTERED']).nullable(), process: tenantRuntimeProcessSchema.nullable() }).strict();
+const resources = tenantRuntimeResourceSchema.extend({ kind: z.literal('RESOURCES') }).strict(), projection = tenantRuntimeResourceSchema.extend({ kind: z.literal('PROJECTIONS'), expectedManifestRevision: sha256Schema, preparedAt: isoDateTimeSchema }).strict();
+const project = z.object({ kind: z.literal('PROJECTS'), projectKey: projectKeySchema, lifecycle: z.enum(['ACTIVE', 'ARCHIVED']), runtimeState: z.enum(['AVAILABLE', 'UNAVAILABLE']), projection: z.object({ requestedGeneration: count, completedGeneration: count, pendingGenerationDelta: count }).strict().nullable(), checkpointState: z.enum(['READY', 'UNAVAILABLE', 'EPOCH_MISMATCH']), directoryThroughSeq: count.nullable(), searchThroughSeq: count.nullable(), searchObservedMaxSeq: count.nullable(), searchSequenceDelta: count.nullable(), process: tenantRuntimeProcessSchema.nullable() }).strict();
+const budget = z.discriminatedUnion('state', [
+    z.object({ state: z.literal('READY'), scope: z.literal('RUNTIME_OWNER_DATA_ROOT'), windowStart: isoDateTimeSchema, windowEnd: isoDateTimeSchema, usage: z.object({ inFlight: count, workUnits: count, runtimeMs: count }).strict(), limits: tenantBudgetPolicySchema, maxWaitRounds: z.number().int().min(1).max(2048) }).strict(),
+    z.object({ state: z.enum(['NOT_CONFIGURED', 'UNAVAILABLE']), reason: z.enum(['CONFIGURATION_REQUIRED', 'TENANT_NOT_CONFIGURED', 'BINDING_MISMATCH', 'STATE_UNAVAILABLE']) }).strict(),
+]);
+export const tenantRuntimeDataSchema = z.object({ nodeId: projectKeySchema, kind: tenantRuntimeKindSchema, observedAt: isoDateTimeSchema, coverage: z.literal('OWN_TENANT_METADATA_SAMPLE'), metadataOnly: z.literal(true), pageState: z.enum(['READY', 'UNAVAILABLE']), items: z.array(z.discriminatedUnion('kind', [request, resources, projection, project])).max(20), nextAfter: cursor.nullable(), sampleCount: count.max(20), total: z.null(), budget, delivery: z.object({ headSeq: count, retainedThroughSeq: count, businessOutcome: z.literal('NOT_ASSERTED') }).strict() }).strict().superRefine((v, ctx) => { if (v.items.some(item => item.kind !== v.kind) || v.sampleCount !== v.items.length || v.pageState === 'UNAVAILABLE' && (v.items.length || v.nextAfter !== null))
+    ctx.addIssue({ code: 'custom', message: 'Metadata sample preserves kind and actual bounded row count' }); });
+export const tenantRuntimeToolSchemas = { tenant_runtime_status: tenantRuntimeInputSchema };
+export const tenantRuntimeWorkspaceToolSchemas = { ...tenantProjectWorkspaceToolSchemas, ...tenantRuntimeToolSchemas };
+export const tenantRuntimeWorkspaceDataSchemas = { ...tenantProjectWorkspaceDataSchemas, tenant_runtime_status: tenantRuntimeDataSchema };
+export function tenantRuntimeScopesForInput(name, raw) { if (name === 'tenant_runtime_status') {
+    tenantRuntimeInputSchema.parse(raw);
+    return ['knowledge.runtime.read'];
+} return tenantProjectScopesForInput(name, raw); }
+export function tenantRuntimeAuthorization(name) { return name === 'tenant_runtime_status' ? { selection: 'FIXED', scopeAlternatives: [['knowledge.runtime.read']] } : tenantProjectAuthorization(name); }
+export const tenantRuntimeStatusEnvelopeSchema = z.object({ schemaVersion: z.literal(2), tenantId: materialTenantIdSchema, tool: z.literal('tenant_runtime_status'), data: tenantRuntimeDataSchema }).strict().superRefine((value, ctx) => {
+    const { data } = value, key = tenantStorageKey(value.tenantId), mine = (ref) => parseTenantResourceRef(ref)?.storageKey === key;
+    if (data.budget.state === 'READY' && data.budget.limits.tenantId !== value.tenantId || data.items.some(item => item.kind === 'REQUESTS' ? !(new RegExp('^tenant-collection-request://' + key + '/[a-f0-9]{64}$').test(item.requestRef)) || parseTenantCollectionBatchRef(item.batchRef)?.storageKey !== key || !mine(item.raw.ref) || parseTenantResourceRef(item.raw.ref)?.resourceType !== 'evidence' : item.kind === 'PROJECTS' ? false : !mine(item.ref)))
+        ctx.addIssue({ code: 'custom', message: 'Runtime metadata retains exact Tenant scope' });
+});
+export function tenantRuntimeEnvelopeSchema(tool) { return tool === 'tenant_runtime_status' ? tenantRuntimeStatusEnvelopeSchema : z.object({ schemaVersion: z.literal(2), tenantId: materialTenantIdSchema, tool: z.literal(tool), data: tenantRuntimeWorkspaceDataSchemas[tool] }).strict(); }
+export const tenantRuntimeInputJsonSchemas = Object.fromEntries(Object.entries(tenantRuntimeWorkspaceToolSchemas).map(([name, schema]) => [name, z.toJSONSchema(schema, { target: 'draft-07' })]));
+export const tenantRuntimeOutputJsonSchemas = Object.fromEntries(Object.keys(tenantRuntimeWorkspaceToolSchemas).map(name => [name, { type: 'object', oneOf: [z.toJSONSchema(tenantRuntimeEnvelopeSchema(name), { target: 'draft-07' }), z.toJSONSchema(tenantProjectErrorSchema, { target: 'draft-07' })] }]));
+export const tenantRuntimeProviderSchema = z.object({ ...tenantProjectProviderSchema.shape, schemaVersion: z.literal(20), tools: z.array(z.string()).length(Object.keys(tenantRuntimeWorkspaceToolSchemas).length), capabilities: z.tuple([z.literal('TENANT_MANAGEMENT_V1'), z.literal('TENANT_WORKFLOW_V1'), z.literal('TENANT_CURRENTNESS_V2'), z.literal('TENANT_SOURCE_V1'), z.literal('TENANT_WORKSPACE_METADATA_V1'), z.literal('TENANT_PROJECT_CONTEXT_V1'), z.literal('TENANT_RUNTIME_STATUS_V1')]) }).strict().superRefine((value, ctx) => { if (new Set(value.tools).size !== Object.keys(tenantRuntimeWorkspaceToolSchemas).length || value.tools.some(name => !Object.hasOwn(tenantRuntimeWorkspaceToolSchemas, name)))
+    ctx.addIssue({ code: 'custom', message: 'Runtime tools must match exact version20 contract' }); });

package/dist/internal/serving-contracts/tenant-session.js

@@ -0,0 +1,8 @@
+import { z } from 'zod';
+const endpoint = z.string().url(), id = z.string().min(1).max(512), scopes = z.array(z.string().min(1).max(100)).max(32);
+export const tenantSessionSchema = z.object({ schemaVersion: z.literal(1), issuer: endpoint, resource: endpoint, clientId: id, userId: id, tenantId: id, tenantRef: z.string().startsWith('knowledge-tenant://'), contextType: z.literal('TENANT'), authorityVersion: z.union([z.literal(1), z.literal(2)]), tokenScopes: scopes, effectiveScopes: scopes, expiresAt: z.string().datetime(), managementConfigured: z.boolean(), blockers: z.array(z.string()).max(16) }).strict();
+export const tenantOperationStatusInputSchema = z.object({ requestId: z.string().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._:-]*$/) }).strict();
+export const tenantOperationStatusSchema = z.object({ schemaVersion: z.literal(1), tenantId: id, requestId: z.string(), state: z.enum(['NOT_FOUND', 'INTENT_PERSISTED']), operationRef: z.string().nullable(), action: z.string().nullable(), receivedAt: z.string().datetime().nullable(), completion: z.literal('NOT_PROVEN') }).strict();
+export const tenantClientProviderSchema = z.object({ schemaVersion: z.literal(26), provider: z.literal('knowledge-v2'), revision: z.string(), issuer: endpoint, resource: endpoint, authorizationServerMetadataUrl: endpoint, tenantSessionEndpoint: endpoint, tenantOperationStatusEndpoint: endpoint, resourceCallEndpoint: endpoint, resourceFileEndpoint: endpoint, registrationModes: z.array(z.enum(['PRE_REGISTERED_NATIVE', 'CIMD_READ_ONLY'])).max(2), callbackModes: z.array(z.literal('NATIVE_LOOPBACK_PORT_V1')).max(1), providers: z.array(z.object({ version: z.number().int().min(16).max(26), endpoint }).strict()).max(11), tools: z.array(z.object({ name: z.string(), endpoint, method: z.enum(['GET', 'POST']).default('POST'), inputSchema: z.json(), outputSchema: z.json(), scopeAlternatives: z.array(scopes).max(8) }).strict()).max(100), limits: z.object({ requestMaxBytes: z.literal(131072), resultMaxBytes: z.literal(524288) }).strict() }).strict();
+export const tenantOperationStatusInputJsonSchema = z.toJSONSchema(tenantOperationStatusInputSchema, { target: 'draft-07' });
+export const tenantOperationStatusOutputJsonSchema = z.toJSONSchema(tenantOperationStatusSchema, { target: 'draft-07' });

package/dist/internal/serving-contracts/tenant-web-content.js

@@ -0,0 +1,20 @@
+import { z } from 'zod';
+import { tenantWebContentDocumentSchema, tenantWebContentInputSchema, tenantWebContentPlanSchema, tenantWebContentStatusSchema, tenantWebContentOutcomeSchema, tenantWebJobRefSchema, materialTenantIdSchema, tenantStorageKey, tenantWebContentRevision, tenantWebDynamicSpecRevision } from '../contracts/index.js';
+import { tenantWebDynamicToolSchemas, tenantWebDynamicWorkspaceToolSchemas, tenantWebDynamicDataSchemas, tenantWebDynamicProviderSchema } from './tenant-web-dynamic.js';
+import { tenantWebErrorSchema, tenantWebScopesForInput } from './tenant-web.js';
+import { tenantRuntimeEnvelopeSchema } from './tenant-runtime.js';
+const extraction = tenantWebContentInputSchema.default({ mode: 'NATURAL_LANGUAGE' });
+export const tenantWebContentToolSchemas = { tenant_web_collect_preview: z.object({ ...tenantWebDynamicToolSchemas.tenant_web_collect_preview.shape, extraction }).strict(), tenant_web_collect_submit: z.object({ ...tenantWebDynamicToolSchemas.tenant_web_collect_submit.shape, extraction, retainedFrom: tenantWebJobRefSchema.nullable().default(null) }).strict(), tenant_web_collect_status: z.object({ ...tenantWebDynamicToolSchemas.tenant_web_collect_status.shape, resultIndex: z.number().int().min(0).max(21999).optional(), includeContent: z.boolean().default(false) }).strict().refine(v => !v.includeContent || v.resultIndex !== undefined) };
+export const tenantWebContentWorkspaceToolSchemas = { ...tenantWebDynamicWorkspaceToolSchemas, ...tenantWebContentToolSchemas };
+export const tenantWebContentErrorSchema = z.object({ ...tenantWebErrorSchema.shape, errorCode: z.enum([...tenantWebErrorSchema.shape.errorCode.options, 'TENANT_WEB_SEMANTIC_COMPILER_UNAVAILABLE', 'TENANT_WEB_CONTENT_FIELD_PLAN_REQUIRED', 'TENANT_WEB_RETAINED_SCOPE_FORBIDDEN', 'TENANT_WEB_RESULT_NOT_FOUND']) }).strict();
+export const tenantWebContentDataSchemas = { tenant_web_collect_preview: z.object({ spec: tenantWebDynamicDataSchemas.tenant_web_collect_preview.shape.spec, specRevision: tenantWebDynamicDataSchemas.tenant_web_collect_preview.shape.specRevision, contentPlan: tenantWebContentPlanSchema, contentRevision: tenantWebContentStatusSchema.shape.contentRevision, networkValidated: z.literal(false), budgetReserved: z.literal(false), execution: z.literal('EXPLICIT_HOST_DISPATCH'), requirementsState: z.literal('PENDING') }).strict().refine(v => v.contentRevision === tenantWebContentRevision(v.contentPlan) && v.specRevision === tenantWebDynamicSpecRevision(v.spec)), tenant_web_collect_submit: z.object({ inserted: z.boolean(), job: tenantWebContentStatusSchema }).strict(), tenant_web_collect_status: z.object({ ...tenantWebContentStatusSchema.shape, result: tenantWebContentOutcomeSchema.nullable(), resultDocument: tenantWebContentDocumentSchema.nullable(), resultDelivery: z.enum(['NONE', 'INLINE', 'DOWNLOAD']) }).strict() };
+export function tenantWebContentEnvelopeSchema(tool) { return z.object({ schemaVersion: z.literal(2), tenantId: materialTenantIdSchema, tool: z.literal(tool), data: tenantWebContentDataSchemas[tool] }).strict().superRefine((v, c) => { const data = v.data, key = tenantStorageKey(v.tenantId), ref = data.jobRef ?? data.job?.jobRef; if (data.resultDocument && (data.resultDocument.jobRef !== ref || !data.resultDocument.parentEvidenceRef.startsWith('tenant-resource://' + key + '/evidence/')))
+    c.addIssue({ code: 'custom', message: 'Exact result document required' }); if (ref && !ref.startsWith('tenant-web-collection://' + key + '/') || data.result?.documentRef && !data.result.documentRef.startsWith('tenant-resource://' + key + '/source_document/'))
+    c.addIssue({ code: 'custom', message: 'Exact Tenant content identity required' }); }); }
+export function tenantWebContentScopesForInput(name, raw) { if (Object.hasOwn(tenantWebContentToolSchemas, name)) {
+    const input = tenantWebContentToolSchemas[name].parse(raw);
+    return name === 'tenant_web_collect_status' && 'includeContent' in input && input.includeContent ? ['knowledge.collect', 'knowledge.material.read'] : name === 'tenant_web_collect_status' ? ['knowledge.collect'] : ['knowledge.source.manage', 'knowledge.collect'];
+} return tenantWebScopesForInput(name, raw); }
+export const tenantWebContentInputJsonSchemas = Object.fromEntries(Object.entries(tenantWebContentWorkspaceToolSchemas).map(([name, schema]) => [name, z.toJSONSchema(schema, { target: 'draft-07' })]));
+export const tenantWebContentOutputJsonSchemas = Object.fromEntries(Object.keys(tenantWebContentWorkspaceToolSchemas).map(name => [name, { type: 'object', oneOf: [z.toJSONSchema(Object.hasOwn(tenantWebContentToolSchemas, name) ? tenantWebContentEnvelopeSchema(name) : tenantRuntimeEnvelopeSchema(name), { target: 'draft-07' }), z.toJSONSchema(tenantWebContentErrorSchema, { target: 'draft-07' })] }]));
+export const tenantWebContentProviderSchema = z.object({ ...tenantWebDynamicProviderSchema.shape, schemaVersion: z.literal(24), capabilities: z.tuple([z.literal('TENANT_MANAGEMENT_V1'), z.literal('TENANT_WORKFLOW_V1'), z.literal('TENANT_CURRENTNESS_V2'), z.literal('TENANT_SOURCE_V1'), z.literal('TENANT_WORKSPACE_METADATA_V1'), z.literal('TENANT_PROJECT_CONTEXT_V1'), z.literal('TENANT_RUNTIME_STATUS_V1'), z.literal('TENANT_WEB_COLLECTION_SPEC_V1'), z.literal('TENANT_WEB_CRAWL_V1'), z.literal('TENANT_WEB_DYNAMIC_V1'), z.literal('TENANT_WEB_CONTENT_V1')]) }).strict().refine(v => new Set(v.tools).size === Object.keys(tenantWebContentWorkspaceToolSchemas).length && v.tools.every(t => Object.hasOwn(tenantWebContentWorkspaceToolSchemas, t)));

package/dist/internal/serving-contracts/tenant-web-crawl.js

@@ -0,0 +1,13 @@
+/** Provider22 与 Provider21 共享输入名字，执行合同通过新版本显式选择。 */
+import { z } from 'zod';
+import { tenantWebCrawlStatusSchema, materialTenantIdSchema, tenantStorageKey, tenantWebSpecRevision, TENANT_WEB_CRAWL_CAPABILITY } from '../contracts/index.js';
+import { tenantWebToolSchemas, tenantWebWorkspaceToolSchemas, tenantWebProviderSchema, tenantWebDataSchemas, tenantWebErrorSchema, tenantWebInputJsonSchemas } from './tenant-web.js';
+import { tenantRuntimeEnvelopeSchema } from './tenant-runtime.js';
+export const tenantWebCrawlDataSchemas = { tenant_web_collect_preview: z.object({ spec: tenantWebDataSchemas.tenant_web_collect_preview.shape.spec, specRevision: tenantWebDataSchemas.tenant_web_collect_preview.shape.specRevision, networkValidated: z.literal(false), budgetReserved: z.literal(false), execution: z.literal('EXPLICIT_HOST_DISPATCH'), requirementsState: z.literal('DECLARED_NOT_EVALUATED') }).strict().superRefine((v, ctx) => { if (v.specRevision !== tenantWebSpecRevision(v.spec))
+        ctx.addIssue({ code: 'custom', message: 'Preview specification mismatch' }); }), tenant_web_collect_submit: z.object({ inserted: z.boolean(), job: tenantWebCrawlStatusSchema }).strict(), tenant_web_collect_status: tenantWebCrawlStatusSchema };
+export function tenantWebCrawlEnvelopeSchema(tool) { return z.object({ schemaVersion: z.literal(2), tenantId: materialTenantIdSchema, tool: z.literal(tool), data: tenantWebCrawlDataSchemas[tool] }).strict().superRefine((v, ctx) => { const row = v, ref = row.data.jobRef ?? row.data.job?.jobRef; if (ref && !ref.startsWith('tenant-web-collection://' + tenantStorageKey(row.tenantId) + '/'))
+    ctx.addIssue({ code: 'custom', message: 'Exact Tenant website job required' }); }); }
+export const tenantWebCrawlInputJsonSchemas = tenantWebInputJsonSchemas;
+export const tenantWebCrawlOutputJsonSchemas = Object.fromEntries(Object.keys(tenantWebWorkspaceToolSchemas).map(name => [name, { type: 'object', oneOf: [z.toJSONSchema(Object.hasOwn(tenantWebToolSchemas, name) ? tenantWebCrawlEnvelopeSchema(name) : tenantRuntimeEnvelopeSchema(name), { target: 'draft-07' }), z.toJSONSchema(tenantWebErrorSchema, { target: 'draft-07' })] }]));
+export const tenantWebCrawlProviderSchema = z.object({ ...tenantWebProviderSchema.shape, schemaVersion: z.literal(22), capabilities: z.tuple([z.literal('TENANT_MANAGEMENT_V1'), z.literal('TENANT_WORKFLOW_V1'), z.literal('TENANT_CURRENTNESS_V2'), z.literal('TENANT_SOURCE_V1'), z.literal('TENANT_WORKSPACE_METADATA_V1'), z.literal('TENANT_PROJECT_CONTEXT_V1'), z.literal('TENANT_RUNTIME_STATUS_V1'), z.literal('TENANT_WEB_COLLECTION_SPEC_V1'), z.literal(TENANT_WEB_CRAWL_CAPABILITY)]) }).strict().superRefine((v, ctx) => { if (new Set(v.tools).size !== Object.keys(tenantWebWorkspaceToolSchemas).length || v.tools.some(name => !Object.hasOwn(tenantWebWorkspaceToolSchemas, name)))
+    ctx.addIssue({ code: 'custom', message: 'Provider22 exact registry required' }); });

package/dist/internal/serving-contracts/tenant-web-dynamic.js

@@ -0,0 +1,20 @@
+/** Provider23 与 Provider21 共享输入名字，执行合同通过新版本显式选择。 */
+import { z } from 'zod';
+import { tenantWebDynamicSpecSchema, tenantWebDynamicStatusSchema, materialTenantIdSchema, tenantStorageKey, tenantWebDynamicSpecRevision, TENANT_WEB_DYNAMIC_CAPABILITY } from '../contracts/index.js';
+import { tenantWebToolSchemas, tenantWebWorkspaceToolSchemas, tenantWebProviderSchema, tenantWebDataSchemas, tenantWebErrorSchema, tenantWebInputJsonSchemas, tenantWebScopesForInput } from './tenant-web.js';
+import { tenantWebCrawlProviderSchema } from './tenant-web-crawl.js';
+export const tenantWebDynamicToolSchemas = { ...tenantWebToolSchemas, tenant_web_collect_preview: z.object({ spec: tenantWebDynamicSpecSchema }).strict(), tenant_web_collect_submit: z.object({ ...tenantWebToolSchemas.tenant_web_collect_submit.shape, spec: tenantWebDynamicSpecSchema }).strict() };
+export const tenantWebDynamicWorkspaceToolSchemas = { ...tenantWebWorkspaceToolSchemas, ...tenantWebDynamicToolSchemas };
+export function tenantWebDynamicScopesForInput(name, raw) { if (Object.hasOwn(tenantWebDynamicToolSchemas, name)) {
+    tenantWebDynamicToolSchemas[name].parse(raw);
+    return name === 'tenant_web_collect_status' ? ['knowledge.collect'] : ['knowledge.source.manage', 'knowledge.collect'];
+} return tenantWebScopesForInput(name, raw); }
+import { tenantRuntimeEnvelopeSchema } from './tenant-runtime.js';
+export const tenantWebDynamicDataSchemas = { tenant_web_collect_preview: z.object({ spec: tenantWebDynamicSpecSchema, specRevision: tenantWebDataSchemas.tenant_web_collect_preview.shape.specRevision, networkValidated: z.literal(false), budgetReserved: z.literal(false), execution: z.literal('EXPLICIT_HOST_DISPATCH'), requirementsState: z.literal('DECLARED_NOT_EVALUATED') }).strict().superRefine((v, ctx) => { if (v.specRevision !== tenantWebDynamicSpecRevision(v.spec))
+        ctx.addIssue({ code: 'custom', message: 'Preview specification mismatch' }); }), tenant_web_collect_submit: z.object({ inserted: z.boolean(), job: tenantWebDynamicStatusSchema }).strict(), tenant_web_collect_status: tenantWebDynamicStatusSchema };
+export function tenantWebDynamicEnvelopeSchema(tool) { return z.object({ schemaVersion: z.literal(2), tenantId: materialTenantIdSchema, tool: z.literal(tool), data: tenantWebDynamicDataSchemas[tool] }).strict().superRefine((v, ctx) => { const row = v, ref = row.data.jobRef ?? row.data.job?.jobRef; if (ref && !ref.startsWith('tenant-web-collection://' + tenantStorageKey(row.tenantId) + '/'))
+    ctx.addIssue({ code: 'custom', message: 'Exact Tenant website job required' }); }); }
+export const tenantWebDynamicInputJsonSchemas = Object.fromEntries(Object.entries(tenantWebDynamicWorkspaceToolSchemas).map(([name, schema]) => [name, z.toJSONSchema(schema, { target: 'draft-07' })]));
+export const tenantWebDynamicOutputJsonSchemas = Object.fromEntries(Object.keys(tenantWebWorkspaceToolSchemas).map(name => [name, { type: 'object', oneOf: [z.toJSONSchema(Object.hasOwn(tenantWebToolSchemas, name) ? tenantWebDynamicEnvelopeSchema(name) : tenantRuntimeEnvelopeSchema(name), { target: 'draft-07' }), z.toJSONSchema(tenantWebErrorSchema, { target: 'draft-07' })] }]));
+export const tenantWebDynamicProviderSchema = z.object({ ...tenantWebCrawlProviderSchema.shape, schemaVersion: z.literal(23), capabilities: z.tuple([z.literal('TENANT_MANAGEMENT_V1'), z.literal('TENANT_WORKFLOW_V1'), z.literal('TENANT_CURRENTNESS_V2'), z.literal('TENANT_SOURCE_V1'), z.literal('TENANT_WORKSPACE_METADATA_V1'), z.literal('TENANT_PROJECT_CONTEXT_V1'), z.literal('TENANT_RUNTIME_STATUS_V1'), z.literal('TENANT_WEB_COLLECTION_SPEC_V1'), z.literal('TENANT_WEB_CRAWL_V1'), z.literal(TENANT_WEB_DYNAMIC_CAPABILITY)]) }).strict().superRefine((v, ctx) => { if (new Set(v.tools).size !== Object.keys(tenantWebWorkspaceToolSchemas).length || v.tools.some(name => !Object.hasOwn(tenantWebWorkspaceToolSchemas, name)))
+    ctx.addIssue({ code: 'custom', message: 'Provider23 exact registry required' }); });

package/dist/internal/serving-contracts/tenant-web-workflow.js

@@ -0,0 +1,36 @@
+/** Explicit Provider25 operations; earlier registries remain frozen. */
+import { z } from 'zod';
+import { tenantWebWorkflowStatusSchema, tenantWebScheduleSchema, tenantWebControlInputSchema, tenantWebLifecycleReceiptSchema, tenantWebWorkflowJobSchema, tenantWebContentOutcomeSchema, tenantWebJobRefSchema, tenantCollectionCycleSchema, tenantResourceRefSchema, sha256Schema, isoDateTimeSchema, materialTenantIdSchema, tenantStorageKey, resourceDataSchemas } from '../contracts/index.js';
+import { tenantWebContentToolSchemas, tenantWebContentDataSchemas, tenantWebContentWorkspaceToolSchemas, tenantWebContentProviderSchema, tenantWebContentErrorSchema } from './tenant-web-content.js';
+import { tenantWebScopesForInput } from './tenant-web.js';
+import { tenantRuntimeEnvelopeSchema } from './tenant-runtime.js';
+const count = z.number().int().nonnegative().safe(), cursor = z.string().min(1).max(4096), job = z.object({ jobRef: tenantWebJobRefSchema }).strict(), page = job.extend({ after: cursor.optional(), limit: z.number().int().min(1).max(100).default(20) }), schedule = tenantWebScheduleSchema.default({ mode: 'ONCE' }), observation = z.object({ ref: tenantResourceRefSchema, contentHash: sha256Schema, sourceUrl: z.string().url(), observedAt: isoDateTimeSchema }).strict().nullable();
+export const tenantWebWorkflowToolSchemas = {
+    tenant_web_collect_preview: tenantWebContentToolSchemas.tenant_web_collect_preview.extend({ schedule }),
+    tenant_web_collect_submit: tenantWebContentToolSchemas.tenant_web_collect_submit.extend({ schedule }),
+    tenant_web_collect_status: job, tenant_web_collect_results: page, tenant_web_collect_cycles: page,
+    tenant_web_collect_control: tenantWebControlInputSchema,
+    tenant_web_collect_refresh: job.extend({ requestId: tenantCollectionCycleSchema, expectedEpoch: count }),
+    tenant_web_collect_read: job.extend({ kind: z.enum(['ORIGINAL', 'DOM', 'RESULT']), index: count.max(21999), stateIndex: count.max(100).optional() }).refine(v => v.kind === 'DOM' ? v.stateIndex !== undefined : v.stateIndex === undefined),
+    tenant_web_collect_index_status: z.object({}).strict(),
+};
+export const tenantWebWorkflowWorkspaceToolSchemas = { ...tenantWebContentWorkspaceToolSchemas, ...tenantWebWorkflowToolSchemas };
+export function tenantWebWorkflowScopesForInput(name, raw) { if (!Object.hasOwn(tenantWebWorkflowToolSchemas, name))
+    return tenantWebScopesForInput(name, raw); tenantWebWorkflowToolSchemas[name].parse(raw); return name === 'tenant_web_collect_read' || name === 'tenant_web_collect_index_status' ? ['knowledge.collect', 'knowledge.material.read'] : ['tenant_web_collect_status', 'tenant_web_collect_results', 'tenant_web_collect_cycles'].includes(name) ? ['knowledge.collect'] : ['knowledge.collect', 'knowledge.source.manage']; }
+export const tenantWebWorkflowDataSchemas = {
+    tenant_web_collect_preview: tenantWebContentDataSchemas.tenant_web_collect_preview.safeExtend({ schedule: tenantWebScheduleSchema }),
+    tenant_web_collect_submit: z.object({ inserted: z.boolean(), job: tenantWebWorkflowStatusSchema }).strict(),
+    tenant_web_collect_status: tenantWebWorkflowStatusSchema,
+    tenant_web_collect_results: job.extend({ items: z.array(tenantWebContentOutcomeSchema.safeExtend({ original: observation, observation })).max(100), through: count, nextAfter: cursor.nullable(), available: count, terminal: z.boolean() }),
+    tenant_web_collect_cycles: job.extend({ rootJobRef: tenantWebJobRefSchema, items: z.array(z.object({ jobRef: tenantWebJobRefSchema, cycle: tenantWebWorkflowJobSchema.shape.cycle, submittedAt: isoDateTimeSchema }).strict()).max(100), through: count, nextAfter: cursor.nullable() }),
+    tenant_web_collect_control: z.object({ replayed: z.boolean(), receipt: tenantWebLifecycleReceiptSchema, job: tenantWebWorkflowStatusSchema }).strict(),
+    tenant_web_collect_refresh: z.object({ inserted: z.boolean(), job: tenantWebWorkflowStatusSchema }).strict(),
+    tenant_web_collect_read: job.extend({ ref: tenantResourceRefSchema, result: resourceDataSchemas.knowledge_resource_read }),
+    tenant_web_collect_index_status: resourceDataSchemas.knowledge_resource_index_status,
+};
+export const tenantWebWorkflowErrorSchema = tenantWebContentErrorSchema.extend({ completedPhase: z.enum([...tenantWebContentErrorSchema.shape.completedPhase.unwrap().options, 'WEB_CONTROL_COMMITTED']).optional(), errorCode: z.enum([...tenantWebContentErrorSchema.shape.errorCode.options, 'TENANT_WEB_CONTROL_CONFLICT', 'TENANT_WEB_CANCELLED', 'TENANT_WEB_PAUSED', 'TENANT_WEB_CYCLE_PENDING', 'TENANT_WEB_RUNTIME_OR_DELEGATION_UNAVAILABLE']) }).strict();
+export function tenantWebWorkflowEnvelopeSchema(tool) { return z.object({ schemaVersion: z.literal(2), tenantId: materialTenantIdSchema, tool: z.literal(tool), data: tenantWebWorkflowDataSchemas[tool] }).strict().superRefine((v, c) => { const d = v.data, key = tenantStorageKey(v.tenantId); if ([d.jobRef, d.rootJobRef, d.job?.jobRef, ...(d.items ?? []).map(i => i.jobRef)].some(ref => ref && !ref.startsWith('tenant-web-collection://' + key + '/')) || [d.ref, ...(d.items ?? []).flatMap(i => [i.documentRef, i.original?.ref, i.observation?.ref])].some(ref => ref && !ref.startsWith('tenant-resource://' + key + '/')) || d.result?.item && (d.result.item.ownerTenantId !== v.tenantId || d.result.item.ref !== d.ref))
+    c.addIssue({ code: 'custom', message: 'Exact Tenant workflow/result identity required' }); }); }
+export const tenantWebWorkflowInputJsonSchemas = Object.fromEntries(Object.entries(tenantWebWorkflowWorkspaceToolSchemas).map(([n, s]) => [n, z.toJSONSchema(s, { target: 'draft-07' })]));
+export const tenantWebWorkflowOutputJsonSchemas = Object.fromEntries(Object.keys(tenantWebWorkflowWorkspaceToolSchemas).map(n => [n, { type: 'object', oneOf: [z.toJSONSchema(Object.hasOwn(tenantWebWorkflowToolSchemas, n) ? tenantWebWorkflowEnvelopeSchema(n) : tenantRuntimeEnvelopeSchema(n), { target: 'draft-07' }), z.toJSONSchema(tenantWebWorkflowErrorSchema, { target: 'draft-07' })] }]));
+export const tenantWebWorkflowProviderSchema = z.object({ ...tenantWebContentProviderSchema.shape, schemaVersion: z.literal(25), collectionMode: z.literal('EXPLICIT_HOST_WITH_OPT_IN_DUE'), tools: z.array(z.string()).length(Object.keys(tenantWebWorkflowWorkspaceToolSchemas).length), capabilities: z.tuple([z.literal('TENANT_MANAGEMENT_V1'), z.literal('TENANT_WORKFLOW_V1'), z.literal('TENANT_CURRENTNESS_V2'), z.literal('TENANT_SOURCE_V1'), z.literal('TENANT_WORKSPACE_METADATA_V1'), z.literal('TENANT_PROJECT_CONTEXT_V1'), z.literal('TENANT_RUNTIME_STATUS_V1'), z.literal('TENANT_WEB_COLLECTION_SPEC_V1'), z.literal('TENANT_WEB_CRAWL_V1'), z.literal('TENANT_WEB_DYNAMIC_V1'), z.literal('TENANT_WEB_CONTENT_V1'), z.literal('TENANT_WEB_WORKFLOW_V1')]) }).strict().refine(v => new Set(v.tools).size === Object.keys(tenantWebWorkflowWorkspaceToolSchemas).length && v.tools.every(t => Object.hasOwn(tenantWebWorkflowWorkspaceToolSchemas, t)));

package/dist/internal/serving-contracts/tenant-web.js

@@ -0,0 +1,53 @@
+/** Provider21 增量能力；17–20 的注册表、默认版本和既有错误合同保持。 */
+import { z } from 'zod';
+import { tenantWebSpecSchema, tenantWebSummarySchema, tenantWebJobRefSchema, tenantWebSpecRevision, tenantCollectionCycleSchema, materialTenantIdSchema, tenantStorageKey, TENANT_WEB_SPEC_CAPABILITY } from '../contracts/index.js';
+import { tenantRuntimeWorkspaceToolSchemas, tenantRuntimeWorkspaceDataSchemas, tenantRuntimeEnvelopeSchema, tenantRuntimeProviderSchema, tenantRuntimeScopesForInput, tenantRuntimeAuthorization } from './tenant-runtime.js';
+import { tenantProjectErrorSchema } from './tenant-project.js';
+import { tenantManagementSafeErrorRef } from './tenant-management.js';
+export const tenantWebToolSchemas = {
+    tenant_web_collect_preview: z.object({ spec: tenantWebSpecSchema }).strict(),
+    tenant_web_collect_submit: z.object({ requestId: tenantCollectionCycleSchema, spec: tenantWebSpecSchema }).strict(),
+    tenant_web_collect_status: z.object({ jobRef: tenantWebJobRefSchema }).strict(),
+};
+export const tenantWebDataSchemas = {
+    tenant_web_collect_preview: z.object({ spec: tenantWebSpecSchema, specRevision: tenantWebSummarySchema.shape.specRevision, networkValidated: z.literal(false), budgetReserved: z.literal(false), execution: z.literal('UNAVAILABLE'), reason: z.literal('S2_NOT_IMPLEMENTED'), requirementsState: z.literal('DECLARED_NOT_EVALUATED') }).strict().superRefine((v, ctx) => { if (v.specRevision !== tenantWebSpecRevision(v.spec))
+        ctx.addIssue({ code: 'custom', message: 'Preview specification identity mismatch' }); }),
+    tenant_web_collect_submit: z.object({ inserted: z.boolean(), job: tenantWebSummarySchema }).strict(),
+    tenant_web_collect_status: tenantWebSummarySchema,
+};
+export const tenantWebWorkspaceToolSchemas = { ...tenantRuntimeWorkspaceToolSchemas, ...tenantWebToolSchemas };
+export const tenantWebWorkspaceDataSchemas = { ...tenantRuntimeWorkspaceDataSchemas, ...tenantWebDataSchemas };
+export const tenantWebErrorSchema = tenantProjectErrorSchema.extend({ completedPhase: z.enum([...tenantProjectErrorSchema.shape.completedPhase.unwrap().options, 'WEB_INTENT_PERSISTED']).optional() }).strict();
+export function tenantWebSafeErrorRef(raw, tenantId) {
+    if (typeof raw === 'string' && new RegExp('^tenant-web-collection://' + tenantStorageKey(tenantId) + '/[a-f0-9]{64}$').test(raw))
+        return raw;
+    return tenantManagementSafeErrorRef(raw, tenantId);
+}
+export function tenantWebScopesForInput(name, raw) {
+    if (Object.hasOwn(tenantWebToolSchemas, name)) {
+        tenantWebToolSchemas[name].parse(raw);
+        return name === 'tenant_web_collect_status' ? ['knowledge.collect'] : ['knowledge.source.manage', 'knowledge.collect'];
+    }
+    return tenantRuntimeScopesForInput(name, raw);
+}
+export function tenantWebAuthorization(name) {
+    if (Object.hasOwn(tenantWebToolSchemas, name))
+        return { selection: 'FIXED', scopeAlternatives: [name === 'tenant_web_collect_status' ? ['knowledge.collect'] : ['knowledge.source.manage', 'knowledge.collect']] };
+    return tenantRuntimeAuthorization(name);
+}
+export function tenantWebEnvelopeSchema(tool) {
+    return z.object({ schemaVersion: z.literal(2), tenantId: materialTenantIdSchema, tool: z.literal(tool), data: tenantWebDataSchemas[tool] }).strict().superRefine((value, ctx) => {
+        const envelope = value, ref = envelope.data.jobRef ?? envelope.data.job?.jobRef;
+        if (ref && !ref.startsWith('tenant-web-collection://' + tenantStorageKey(envelope.tenantId) + '/'))
+            ctx.addIssue({ code: 'custom', message: 'Web intent must belong to the exact authenticated Tenant' });
+    });
+}
+export const tenantWebInputJsonSchemas = Object.fromEntries(Object.entries(tenantWebWorkspaceToolSchemas).map(([name, schema]) => [name, z.toJSONSchema(schema, { target: 'draft-07' })]));
+export const tenantWebOutputJsonSchemas = Object.fromEntries(Object.keys(tenantWebWorkspaceToolSchemas).map(name => [name, { type: 'object', oneOf: [z.toJSONSchema(Object.hasOwn(tenantWebToolSchemas, name) ? tenantWebEnvelopeSchema(name) : tenantRuntimeEnvelopeSchema(name), { target: 'draft-07' }), z.toJSONSchema(tenantWebErrorSchema, { target: 'draft-07' })] }]));
+export const tenantWebProviderSchema = z.object({ ...tenantRuntimeProviderSchema.shape,
+    schemaVersion: z.literal(21), tools: z.array(z.string()).length(Object.keys(tenantWebWorkspaceToolSchemas).length),
+    capabilities: z.tuple([z.literal('TENANT_MANAGEMENT_V1'), z.literal('TENANT_WORKFLOW_V1'), z.literal('TENANT_CURRENTNESS_V2'), z.literal('TENANT_SOURCE_V1'), z.literal('TENANT_WORKSPACE_METADATA_V1'), z.literal('TENANT_PROJECT_CONTEXT_V1'), z.literal('TENANT_RUNTIME_STATUS_V1'), z.literal(TENANT_WEB_SPEC_CAPABILITY)]),
+}).strict().superRefine((value, ctx) => {
+    if (new Set(value.tools).size !== Object.keys(tenantWebWorkspaceToolSchemas).length || value.tools.some(name => !Object.hasOwn(tenantWebWorkspaceToolSchemas, name)))
+        ctx.addIssue({ code: 'custom', message: 'Provider21 tools must match the exact versioned registry' });
+});

package/dist/internal/serving-contracts/tenant-workspace.js

@@ -0,0 +1,28 @@
+/** Provider18 adds explicit metadata reads; Provider17 remains the exact original twenty tools. */
+import { z } from 'zod';
+import { tenantResourceRefSchema, tenantSourceIdSchema, collectionRefreshSchema, stableUriSchema, isoDateTimeSchema, materialTenantIdSchema } from '../contracts/index.js';
+import { tenantManagementToolSchemas, tenantManagementDataSchemas, tenantManagementScopesForInput, tenantManagementAuthorization, tenantManagementProviderBaseSchema, tenantManagementErrorSchema } from './tenant-management.js';
+const page = { after: z.string().min(1).max(4096).optional(), limit: z.number().int().min(1).max(100).optional() };
+export const tenantWorkStageSchema = z.enum(['ALL', 'RESEARCH', 'DRAFT', 'READY_FOR_REVIEW', 'REWORK_REQUIRED', 'APPROVED']);
+export const tenantWorkspaceExtraToolSchemas = { tenant_source_inventory: z.object(page).strict(), tenant_work_queue: z.object({ ...page, stage: tenantWorkStageSchema.default('ALL') }).strict() };
+const source = z.object({ sourceId: tenantSourceIdSchema, title: z.string().min(1).max(512).nullable(), revisionRef: stableUriSchema.nullable(), generation: z.number().int().positive().safe().nullable(), paused: z.boolean().nullable(), tenantEnabled: z.boolean().nullable(), refresh: collectionRefreshSchema.nullable(), canonicalState: z.enum(['READY', 'UNAVAILABLE', 'INTEGRITY_MISMATCH']) }).strict();
+const artifact = z.object({ ref: tenantResourceRefSchema, title: z.string().max(512), kind: z.string().max(128).nullable(), status: z.string().max(128).nullable(), version: z.number().int().positive().safe().nullable(), recordedAt: isoDateTimeSchema.nullable(), availability: z.enum(['READY', 'UNAVAILABLE', 'INTEGRITY_MISMATCH']), succession: z.enum(['SUCCESSOR_VISIBLE', 'NO_VISIBLE_SUCCESSOR', 'UNCONFIRMED']) }).strict();
+export const tenantWorkspaceExtraDataSchemas = {
+    tenant_source_inventory: z.object({ items: z.array(source).max(100), nextAfter: z.string().max(4096).nullable(), coverage: z.literal('REGISTERED_TENANT_SOURCES') }).strict(),
+    tenant_work_queue: z.object({ items: z.array(artifact).max(100), nextAfter: z.string().max(4096).nullable(), stage: tenantWorkStageSchema, candidateCount: z.number().int().min(0).max(100), coverage: z.literal('AUTHORIZED_NATIVE_ARTIFACT_METADATA'), total: z.null() }).strict(),
+};
+export const tenantWorkspaceToolSchemas = { ...tenantManagementToolSchemas, ...tenantWorkspaceExtraToolSchemas };
+export const tenantWorkspaceDataSchemas = { ...tenantManagementDataSchemas, ...tenantWorkspaceExtraDataSchemas };
+export function tenantWorkspaceScopesForInput(name, raw) { if (name === 'tenant_source_inventory') {
+    tenantWorkspaceExtraToolSchemas[name].parse(raw);
+    return ['knowledge.source.read'];
+} if (name === 'tenant_work_queue') {
+    tenantWorkspaceExtraToolSchemas[name].parse(raw);
+    return ['knowledge.workflow.read'];
+} return tenantManagementScopesForInput(name, raw); }
+export function tenantWorkspaceAuthorization(name) { return name === 'tenant_source_inventory' || name === 'tenant_work_queue' ? { selection: 'FIXED', scopeAlternatives: [[name === 'tenant_source_inventory' ? 'knowledge.source.read' : 'knowledge.workflow.read']] } : tenantManagementAuthorization(name); }
+export function tenantWorkspaceEnvelopeSchema(tool) { return z.object({ schemaVersion: z.literal(2), tenantId: materialTenantIdSchema, tool: z.literal(tool), data: tenantWorkspaceDataSchemas[tool] }).strict(); }
+export const tenantWorkspaceInputJsonSchemas = Object.fromEntries(Object.entries(tenantWorkspaceToolSchemas).map(([name, schema]) => [name, z.toJSONSchema(schema, { target: 'draft-07' })]));
+export const tenantWorkspaceOutputJsonSchemas = Object.fromEntries(Object.keys(tenantWorkspaceToolSchemas).map(name => [name, { type: 'object', oneOf: [z.toJSONSchema(tenantWorkspaceEnvelopeSchema(name), { target: 'draft-07' }), z.toJSONSchema(tenantManagementErrorSchema, { target: 'draft-07' })] }]));
+export const tenantWorkspaceProviderSchema = tenantManagementProviderBaseSchema.extend({ schemaVersion: z.literal(18), tools: z.array(z.string()).length(Object.keys(tenantWorkspaceToolSchemas).length), capabilities: z.tuple([z.literal('TENANT_MANAGEMENT_V1'), z.literal('TENANT_WORKFLOW_V1'), z.literal('TENANT_CURRENTNESS_V2'), z.literal('TENANT_SOURCE_V1'), z.literal('TENANT_WORKSPACE_METADATA_V1')]) }).strict().superRefine((value, ctx) => { if (new Set(value.tools).size !== Object.keys(tenantWorkspaceToolSchemas).length || value.tools.some(name => !Object.hasOwn(tenantWorkspaceToolSchemas, name)))
+    ctx.addIssue({ code: 'custom', message: 'Workspace tools must match the exact version18 contract' }); });

package/dist/internal/serving-contracts/workflow.js

@@ -0,0 +1,37 @@
+/** Agent 的治理合同描述真实状态和下一步，不把写入权限解释为审核或正文权限。 */
+import { z } from 'zod';
+import { artifactStatusSchema, idSchema, isoDateTimeSchema, publicationReadinessReportSchema, sha256Schema, stableUriSchema } from '../contracts/index.js';
+import { consumerProjectRefSchema } from './consumer.js';
+import { managementToolInputSchemas } from './management.js';
+const project = z.object({ projectRef: consumerProjectRefSchema }).strict();
+export const workflowPlanInputSchema = project.extend({ ref: stableUriSchema }).strict();
+export const workflowGuideInputSchema = project;
+export const workflowActionSchema = z.enum(['PREPARE_SOURCE', 'SUBMIT_REVIEW', 'FINALIZE_REVIEW', 'REGISTER']);
+export const workflowAdvanceInputSchema = workflowPlanInputSchema.extend({ action: workflowActionSchema, expectedVersion: z.number().int().nonnegative().optional(), actedAt: isoDateTimeSchema.optional() }).strict().superRefine((value, ctx) => {
+    if (['SUBMIT_REVIEW', 'FINALIZE_REVIEW'].includes(value.action) && (!value.expectedVersion || !value.actedAt))
+        ctx.addIssue({ code: 'custom', message: 'transition requires exact expectedVersion and actedAt' });
+});
+export const agentSubmitInputSchema = project.extend({ sourceId: idSchema, contentBase64: z.string().min(1).max(87384), mediaType: z.string().trim().min(1).max(256), access: z.enum(['PUBLIC', 'TENANT', 'INTERNAL', 'FDE_INTERNAL']).default('TENANT'), submittedAt: isoDateTimeSchema.optional(), freshnessSeconds: z.number().int().min(60).max(86400).optional() }).strict();
+const argumentsSchema = z.record(z.string(), z.json());
+export const workflowNextActionSchema = z.object({ id: z.string(), tool: z.string().nullable(), arguments: argumentsSchema, requiredScopes: z.array(z.string()), missingScopes: z.array(z.string()), missingFields: z.array(z.string()), canExecute: z.boolean(), automatic: z.boolean(), reasonCode: z.string(), cli: z.object({ command: z.string(), flags: argumentsSchema }).strict(), http: z.object({ method: z.literal('POST'), path: z.literal('/mcp/management'), tool: z.string().nullable() }).strict() }).strict();
+const readDecision = z.object({ action: z.enum(['ALLOW', 'REVIEW_REQUIRED', 'DENY']), reasonCodes: z.array(z.string()), authority: z.enum(['AUTHENTICATED_READER', 'LOCAL_PROFILE_SIMULATION']) }).strict();
+export const workflowPlanSchema = z.object({ schemaVersion: z.literal(1), projectRef: consumerProjectRefSchema, ref: stableUriSchema, contentHash: sha256Schema, kind: z.string(), version: z.number().int().positive().nullable(), status: artifactStatusSchema.or(z.enum(['RAW_EVIDENCE', 'RAW_MATERIAL'])), productionPhase: z.enum(['PERSISTED', 'CATALOG_PROJECTED', 'REGISTERED']), rawMaterialAvailable: z.boolean().nullable(), readiness: publicationReadinessReportSchema.nullable(), reviewRef: stableUriSchema.nullable(), reviewDecision: z.enum(['PASS', 'REWORK', 'REJECT']).nullable(), support: z.object({ action: z.enum(['ALLOW', 'REVIEW_REQUIRED', 'DENY']), reasonCodes: z.array(z.string()), missingEvidenceRefs: z.array(stableUriSchema) }).strict().nullable(), governedPolicyReady: z.boolean(), consumerReadDecision: readDecision.nullable(), externalReady: z.boolean(), successorRef: stableUriSchema.nullable(), blockers: z.array(z.string()), nextActions: z.array(workflowNextActionSchema).max(70) }).strict();
+export const workflowAdvanceResultSchema = z.object({ schemaVersion: z.literal(1), action: workflowActionSchema, previousRef: stableUriSchema, inserted: z.boolean(), plan: workflowPlanSchema }).strict();
+export const workflowErrorSchema = z.object({ errorCode: z.string(), completedPhase: z.enum(['VALIDATED', 'PERSISTED', 'CATALOG_PROJECTED', 'REGISTERED']).optional(), ref: stableUriSchema.optional() }).strict();
+export const workflowToolInputSchemas = { knowledge_workflow_guide: z.toJSONSchema(workflowGuideInputSchema, { target: 'draft-07' }), knowledge_workflow_plan: z.toJSONSchema(workflowPlanInputSchema, { target: 'draft-07' }), knowledge_workflow_advance: z.toJSONSchema(workflowAdvanceInputSchema, { target: 'draft-07' }), knowledge_agent_submit: z.toJSONSchema(agentSubmitInputSchema, { target: 'draft-07' }) };
+export const workflowToolScopes = { knowledge_workflow_guide: 'knowledge.workflow.read', knowledge_workflow_plan: 'knowledge.workflow.read', knowledge_workflow_advance: 'knowledge.workflow.read', knowledge_agent_submit: 'knowledge.material.write' };
+export const workflowActionScopes = { PREPARE_SOURCE: 'knowledge.compose', SUBMIT_REVIEW: 'knowledge.compose', FINALIZE_REVIEW: 'knowledge.approve', REGISTER: 'knowledge.material.write' };
+/** 网络成功和失败共享可发现 schema，阶段包含已经完成注册后的尾部失败。 */
+export const agentSubmitResultSchema = z.object({ schemaVersion: z.literal(1), production: z.object({ phase: z.enum(['CATALOG_PROJECTED', 'REGISTERED']), ref: stableUriSchema, registered: z.boolean(), identity: z.enum(['CONFIGURED', 'NOT_CONFIGURED']) }).strict(), presentation: z.object({ documentRef: stableUriSchema, inserted: z.boolean(), contentHash: sha256Schema }).strict().nullable(), evidenceRef: stableUriSchema, projectRef: consumerProjectRefSchema, contentHash: sha256Schema, byteLength: z.number().int().min(1).max(65536), inserted: z.boolean(), lifecycle: z.literal('QUEUED'), contentClass: z.literal('RAW_EVIDENCE'), nextStep: z.object({ tool: z.literal('knowledge_workflow_plan'), arguments: workflowPlanInputSchema }).strict() }).strict();
+const guideSchema = z.object({ schemaVersion: z.literal(1), model: z.record(z.string(), z.json()), rules: z.array(z.string()), tools: z.record(z.string(), z.object({ requiredScope: z.string(), inputSchema: z.json() }).strict()), advanceScopes: z.record(z.string(), z.string()), https: z.json() }).strict();
+const output = (success) => ({ type: 'object', oneOf: [z.toJSONSchema(success, { target: 'draft-07' }), z.toJSONSchema(workflowErrorSchema, { target: 'draft-07' })] });
+export const workflowToolOutputSchemas = { knowledge_workflow_guide: output(guideSchema), knowledge_workflow_plan: output(workflowPlanSchema), knowledge_workflow_advance: output(workflowAdvanceResultSchema), knowledge_agent_submit: output(agentSubmitResultSchema) };
+/** 同一份模型与参数 schema 供 CLI、MCP guide 和文档示例使用；不给 review 默认 PASS。 */
+export function workflowGuide() {
+    const tools = {};
+    for (const [name, schema] of Object.entries(workflowToolInputSchemas))
+        tools[name] = { requiredScope: workflowToolScopes[name], inputSchema: schema };
+    for (const [name, schema] of Object.entries(managementToolInputSchemas))
+        tools[name] = { requiredScope: name === 'knowledge_review' ? 'knowledge.review' : name === 'knowledge_finalize_review' ? 'knowledge.approve' : 'knowledge.compose', inputSchema: schema };
+    return { schemaVersion: 1, model: { raw: 'Evidence / Material 保留原字节和 provenance；原文可读不等于结论已审核。', reviewed: 'KNOWLEDGE / INSIGHT', lifecycle: ['DRAFT', 'READY_FOR_REVIEW', 'REVIEW(PASS|REWORK|REJECT)', 'APPROVED|REWORK_REQUIRED|REJECTED'], publication: ['PERSISTED', 'CATALOG_PROJECTED', 'REGISTERED', 'consumer read ALLOW'] }, rules: ['先调用 knowledge_workflow_plan，再执行 canExecute 动作；缺字段由 Agent 补齐并重新计划。', '读取原文、核对引用和适用范围后，获授权 reviewer 显式写 PASS / REWORK / REJECT；不根据写入成功推断 PASS。', 'RESEARCH 先正式合成为 KNOWLEDGE / INSIGHT；Claim Currentness proposal 使用专门审核链。', 'freshnessSeconds 仅为作者在系统内首次保存的精确快照时效，不证明外部网页已复核；同身份重放不延长时效。', 'externalReady 需要注册、治理门通过及当前已鉴权消费者实际 read ALLOW；CLI profile 是模拟。', 'Plan 不提供正文或 Review summary；审核时使用独立 read scope 读取 exact ref。'], tools, advanceScopes: workflowActionScopes, https: { method: 'POST', path: '/mcp/management', body: { tool: 'tool name', arguments: '对应 inputSchema' }, authorization: 'OAuth Bearer + client/project binding；API key 不授予管理权限' } };
+}

package/dist/profile-store.js

@@ -0,0 +1,142 @@
+/** 客户端只持久化私有配置与凭据，不包含资料或运行数据库。 */
+import { open, mkdir, lstat, rename, unlink } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import path from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { AuthError } from '@native-knowledge/knowledge-sdk';
+export class ProfileStore {
+    root;
+    constructor(root) {
+        this.root = root;
+        if (!path.isAbsolute(root))
+            throw new AuthError('AUTH_CONFIG_PATH_INVALID');
+    }
+    name(name) { if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(name))
+        throw new AuthError('AUTH_PROFILE_INVALID'); return name; }
+    async directory(create = false) { if (create)
+        await mkdir(this.root, { recursive: true, mode: 0o700 }); let s; try {
+        s = await lstat(this.root);
+    }
+    catch (e) {
+        if (e.code === 'ENOENT' && !create)
+            return false;
+        throw e;
+    } if (!s.isDirectory() || s.isSymbolicLink() || s.uid !== process.getuid?.() || (s.mode & 0o077) !== 0)
+        throw new AuthError('AUTH_CONFIG_PERMISSIONS'); return true; }
+    async read(name) {
+        if (!await this.directory())
+            return null;
+        let h;
+        try {
+            h = await open(path.join(this.root, name), constants.O_RDONLY | constants.O_NOFOLLOW);
+        }
+        catch (e) {
+            if (e.code === 'ENOENT')
+                return null;
+            throw new AuthError('AUTH_CONFIG_PERMISSIONS');
+        }
+        try {
+            const s = await h.stat();
+            if (!s.isFile() || s.uid !== process.getuid?.() || (s.mode & 0o077) !== 0 || s.size > 65536)
+                throw new AuthError('AUTH_CONFIG_PERMISSIONS');
+            return JSON.parse(await h.readFile('utf8'));
+        }
+        catch (e) {
+            if (e instanceof AuthError)
+                throw e;
+            throw new AuthError('AUTH_CONFIG_INVALID');
+        }
+        finally {
+            await h.close();
+        }
+    }
+    async write(name, value) { await this.directory(true); const temp = path.join(this.root, '.write-' + randomBytes(16).toString('hex')), h = await open(temp, 'wx', 0o600); try {
+        await h.writeFile(JSON.stringify(value));
+        await h.sync();
+        await h.close();
+        await rename(temp, path.join(this.root, name));
+        const d = await open(this.root, 'r');
+        try {
+            await d.sync();
+        }
+        finally {
+            await d.close();
+        }
+    }
+    catch (e) {
+        await h.close().catch(() => { });
+        await unlink(temp).catch(() => { });
+        throw e;
+    } }
+    async config() { const c = await this.read('profiles.json') ?? { version: 1, selected: null, profiles: {} }; if (c.version !== 1 || !c.profiles || Array.isArray(c.profiles) || typeof c.profiles !== 'object' || c.selected !== null && typeof c.selected !== 'string')
+        throw new AuthError('AUTH_CONFIG_INVALID'); return c; }
+    async selected(explicit) { const c = await this.config(), name = explicit ?? c.selected; if (!name || !Object.hasOwn(c.profiles, this.name(name)))
+        throw new AuthError('AUTH_REQUIRED'); return { name, profile: c.profiles[name] }; }
+    async secret(name) { const s = await this.read(this.name(name) + '.secret.json'); if (s && (!Number.isSafeInteger(s.generation) || s.generation < 1 || !['READY', 'REFRESH_PENDING', 'REAUTH_REQUIRED'].includes(s.state) || typeof s.expiresAt !== 'string' || !Number.isFinite(Date.parse(s.expiresAt)) || !/^[-\w]{43}$/.test(s.accessToken) || !/^[-\w]{43}$/.test(s.refreshToken) || !Array.isArray(s.scopes)))
+        throw new AuthError('AUTH_CONFIG_INVALID'); return s; }
+    async putSecret(name, s) { await this.write(this.name(name) + '.secret.json', s); }
+    async lock(operation) {
+        await this.directory(true);
+        const file = path.join(this.root, 'operation.lock'), deadline = Date.now() + 20000;
+        let h;
+        while (!h) {
+            try {
+                h = await open(file, 'wx', 0o600);
+                await h.writeFile(JSON.stringify({ pid: process.pid, at: Date.now() }));
+            }
+            catch (e) {
+                if (h) {
+                    await h.close();
+                    h = undefined;
+                    await unlink(file).catch(() => { });
+                    throw e;
+                }
+                if (e.code !== 'EEXIST')
+                    throw e;
+                let old;
+                try {
+                    old = await this.read('operation.lock');
+                }
+                catch (e) {
+                    if (!(e instanceof AuthError) || e.code !== 'AUTH_CONFIG_INVALID' || Date.now() >= deadline)
+                        throw e;
+                    await new Promise(r => setTimeout(r, 50));
+                    continue;
+                }
+                if (old && Number.isSafeInteger(old.pid) && old.pid > 0 && Date.now() - old.at > 60000) {
+                    let alive = true;
+                    try {
+                        process.kill(old.pid, 0);
+                    }
+                    catch (e) {
+                        if (e.code === 'ESRCH')
+                            alive = false;
+                    }
+                    if (!alive) {
+                        await unlink(file).catch(() => { });
+                        continue;
+                    }
+                }
+                if (Date.now() >= deadline)
+                    throw new AuthError('AUTH_CONFIG_BUSY');
+                await new Promise(r => setTimeout(r, 50));
+            }
+        }
+        try {
+            return await operation();
+        }
+        finally {
+            await h.close();
+            await unlink(file);
+        }
+    }
+    async save(name, p, t) { this.name(name); return this.lock(async () => { const c = await this.config(), old = c.profiles[name]; if (old && ['issuer', 'resource', 'clientId', 'userId', 'tenantId', 'authorityVersion'].some(k => old.session[k] !== p.session[k]))
+        throw new AuthError('AUTH_CONTEXT_MISMATCH'); const previous = await this.secret(name); await this.putSecret(name, { ...t, generation: (previous?.generation ?? 0) + 1, state: 'READY' }); c.profiles[name] = p; c.selected = name; await this.write('profiles.json', c); }); }
+    async clear(name) { await this.directory(); await unlink(path.join(this.root, this.name(name) + '.secret.json')).catch(e => { if (e.code !== 'ENOENT')
+        throw e; }); }
+    async use(name) { return this.lock(async () => { const c = await this.config(); if (!Object.hasOwn(c.profiles, this.name(name)))
+        throw new AuthError('AUTH_PROFILE_INVALID'); c.selected = name; await this.write('profiles.json', c); return { selected: name }; }); }
+    async remove(name) { return this.lock(async () => { const c = await this.config(); if (await this.secret(name))
+        throw new AuthError('AUTH_LOGOUT_REQUIRED'); delete c.profiles[this.name(name)]; if (c.selected === name)
+        c.selected = null; await this.write('profiles.json', c); return { removed: name }; }); }
+}

package/package.json

@@ -1,33 +1,23 @@
 {
-  "version": "0.1.0-rc.1",
+  "name": "@native-knowledge/cli",
+  "version": "0.1.0-rc.3",
   "private": false,
   "type": "module",
-  "license": "MIT",
   "engines": {
     "node": ">=24"
   },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/SENLIN746/native-knowledge.git"
-  },
-  "publishConfig": {
-    "access": "public",
-    "tag": "next",
-    "registry": "https://registry.npmjs.org/"
-  },
+  "license": "Apache-2.0",
   "files": [
     "dist",
-    "README.md",
-    "LICENSE"
+    "LICENSE",
+    "NOTICE"
   ],
-  "name": "@native-knowledge/cli",
-  "description": "Network CLI for native-knowledge",
   "bin": {
     "native-knowledge": "./dist/cli.js",
     "knowledge-v2": "./dist/cli.js"
   },
   "dependencies": {
-    "@native-knowledge/knowledge-sdk": "0.1.0-rc.1",
-    "zod": "4.6.7"
+    "@native-knowledge/knowledge-sdk": "0.1.0-rc.3",
+    "zod": "^4.6.7"
   }
 }

package/README.md

@@ -1,28 +0,0 @@
-# native-knowledge CLI
-
-Node.js 24+ network client for native-knowledge. MIT licensed.
-
-```sh
-npm install --global @native-knowledge/cli@next
-native-knowledge help
-native-knowledge agent find --query "saved materials" \
-  --server https://knowledge.example.com --tenant-id your-tenant-id
-```
-
-The `knowledge-v2` command is a supported alias. Read the access token from
-`KNOWLEDGE_V2_OAUTH_ACCESS_TOKEN` or `--token-file /path/to/private-token`.
-Keep token files accessible only to your operating-system account. Tokens are
-never accepted as command-line arguments or embedded in URLs.
-
-Commands: `agent find`, `agent tool`, `agent task`, `agent input`, `agent call`.
-Use `--input-file` for structured operation input. Calls execute only when
-explicitly requested. Guidance never automatically follows suggestions, approves
-reviews, schedules collection or retries writes. `--guided` preserves safe
-failure receipts. On `OUTCOME_UNKNOWN`, inspect the exact state/receipt before
-deciding whether any further action is appropriate.
-
-HTTPS and a 30-second request/body deadline apply by default. HTTP requires the
-explicit `--allow-insecure-http` opt-in for a trusted local test server.
-The public CLI contains no direct database access, local Host administration,
-collector runtime or install hooks. Existing private Host commands are maintained
-separately. Installation, help and discovery do not start collection.