@neuraloom/contracts 0.0.0-stage → 0.1.22

package/dist/schemas/graph/index.js

@@ -0,0 +1,30 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * NeuraLoom — Knowledge Graph v2 schema barrel.
+ *
+ * Refs: GH umbrella #689.
+ * Canvas: canvases/mega-sprint-01-knowledge-graph-foundation.canvas.tsx
+ *
+ * KG-v2 lives alongside the existing traceability/* schemas; this barrel
+ * intentionally exports only the v2 additions to keep the public surface
+ * minimal until consumers opt-in.
+ */
+__exportStar(require("./node-v2.schema"), exports);
+__exportStar(require("./edge-v2.schema"), exports);
+__exportStar(require("./graph-query-v2.schema"), exports);
+__exportStar(require("./sql-security-findings.schema"), exports);

package/dist/schemas/graph/node-v2.schema.d.ts

@@ -0,0 +1,68 @@
+/**
+ * NeuraLoom — Knowledge Graph v2 node types (skeleton)
+ *
+ * Refs: GH umbrella #689, tasks #697 (schema), #698 (zod schemas).
+ * Canvas: canvases/mega-sprint-01-knowledge-graph-foundation.canvas.tsx
+ *
+ * This complements (does NOT replace) the existing
+ * `packages/contracts/src/schemas/traceability/traceability-graph.schema.ts`,
+ * which already covers requirement / task / file / pull_request / deployment /
+ * runtime_check node kinds.
+ *
+ * KG-v2 adds the 3-layer ontology (Intent / Architecture / Code Reality) plus
+ * the broader node-type registry needed by the indexer (Architecture +
+ * Code Reality layers).
+ */
+import { z } from "zod";
+/** Three-layer ontology. */
+export declare const KgLayerSchema: z.ZodEnum<["intent", "architecture", "code_reality"]>;
+export type KgLayer = z.infer<typeof KgLayerSchema>;
+/** Canonical registry of node types per layer. */
+export declare const KgIntentNodeType: z.ZodEnum<["ProductConcept", "Requirement", "AcceptanceCriterion", "Constraint", "Risk", "DomainEntity", "Workflow", "UserRole", "Policy", "NonFunctionalRequirement", "SecurityRequirement", "ComplianceRequirement"]>;
+export declare const KgArchitectureNodeType: z.ZodEnum<["Package", "Module", "FilePlan", "DBTable", "DBColumn", "DBIndex", "DBConstraint", "RLSPolicy", "APIEndpoint", "APIRoute", "FrontendRoute", "UIComponent", "Component", "Service", "Job", "Event", "Queue", "ExternalIntegration", "EnvVar", "SecretRef", "Permission", "TestPlan", "ConstitutionRule", "GuardianReport", "Task", "CodePatch"]>;
+export declare const KgCodeRealityNodeType: z.ZodEnum<["File", "Symbol", "Function", "Class", "Type", "Import", "Export", "RouteHandler", "ServerAction", "ReactComponent", "ZodSchema", "SQLMigration", "SupabaseTable", "RLSActualPolicy", "GitHubIssue", "Branch", "PR", "Commit", "CheckRun", "Deployment", "RuntimeProbe", "SecurityFinding", "Vulnerability", "DriftFinding"]>;
+/** Union of all node-type names (string-only; payload validation comes per-type). */
+export declare const KgNodeTypeSchema: z.ZodUnion<[z.ZodEnum<["ProductConcept", "Requirement", "AcceptanceCriterion", "Constraint", "Risk", "DomainEntity", "Workflow", "UserRole", "Policy", "NonFunctionalRequirement", "SecurityRequirement", "ComplianceRequirement"]>, z.ZodEnum<["Package", "Module", "FilePlan", "DBTable", "DBColumn", "DBIndex", "DBConstraint", "RLSPolicy", "APIEndpoint", "APIRoute", "FrontendRoute", "UIComponent", "Component", "Service", "Job", "Event", "Queue", "ExternalIntegration", "EnvVar", "SecretRef", "Permission", "TestPlan", "ConstitutionRule", "GuardianReport", "Task", "CodePatch"]>, z.ZodEnum<["File", "Symbol", "Function", "Class", "Type", "Import", "Export", "RouteHandler", "ServerAction", "ReactComponent", "ZodSchema", "SQLMigration", "SupabaseTable", "RLSActualPolicy", "GitHubIssue", "Branch", "PR", "Commit", "CheckRun", "Deployment", "RuntimeProbe", "SecurityFinding", "Vulnerability", "DriftFinding"]>]>;
+export type KgNodeType = z.infer<typeof KgNodeTypeSchema>;
+/**
+ * Columns added to `public.knowledge_nodes` for KG v2 (overlay).
+ * Physical PK remains UUID id — deterministic keys live in kg_stable_key / proof helpers.
+ */
+export declare const KnowledgeNodeKgOverlaySchema: z.ZodObject<{
+    kg_layer: z.ZodOptional<z.ZodNullable<z.ZodEnum<["intent", "architecture", "code_reality"]>>>;
+    kg_ontology_type: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    kg_stable_key: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    kg_proof_slice: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    kg_proof_slice: Record<string, unknown>;
+    kg_layer?: "intent" | "architecture" | "code_reality" | null | undefined;
+    kg_ontology_type?: string | null | undefined;
+    kg_stable_key?: string | null | undefined;
+}, {
+    kg_layer?: "intent" | "architecture" | "code_reality" | null | undefined;
+    kg_ontology_type?: string | null | undefined;
+    kg_stable_key?: string | null | undefined;
+    kg_proof_slice?: Record<string, unknown> | undefined;
+}>;
+export type KnowledgeNodeKgOverlay = z.infer<typeof KnowledgeNodeKgOverlaySchema>;
+/**
+ * Logical proof-slice identity (indexer / apiClient) — not a DB PK.
+ * Format: `{layer}:{ontologyType}:{sha256HexPrefix}`
+ */
+export declare const KgProofSliceRefSchema: z.ZodObject<{
+    proofRef: z.ZodString;
+    layer: z.ZodEnum<["intent", "architecture", "code_reality"]>;
+    ontology_type: z.ZodUnion<[z.ZodEnum<["ProductConcept", "Requirement", "AcceptanceCriterion", "Constraint", "Risk", "DomainEntity", "Workflow", "UserRole", "Policy", "NonFunctionalRequirement", "SecurityRequirement", "ComplianceRequirement"]>, z.ZodEnum<["Package", "Module", "FilePlan", "DBTable", "DBColumn", "DBIndex", "DBConstraint", "RLSPolicy", "APIEndpoint", "APIRoute", "FrontendRoute", "UIComponent", "Component", "Service", "Job", "Event", "Queue", "ExternalIntegration", "EnvVar", "SecretRef", "Permission", "TestPlan", "ConstitutionRule", "GuardianReport", "Task", "CodePatch"]>, z.ZodEnum<["File", "Symbol", "Function", "Class", "Type", "Import", "Export", "RouteHandler", "ServerAction", "ReactComponent", "ZodSchema", "SQLMigration", "SupabaseTable", "RLSActualPolicy", "GitHubIssue", "Branch", "PR", "Commit", "CheckRun", "Deployment", "RuntimeProbe", "SecurityFinding", "Vulnerability", "DriftFinding"]>]>;
+    natural_key: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    proofRef: string;
+    layer: "intent" | "architecture" | "code_reality";
+    ontology_type: "ProductConcept" | "Requirement" | "AcceptanceCriterion" | "Constraint" | "Risk" | "DomainEntity" | "Workflow" | "UserRole" | "Policy" | "NonFunctionalRequirement" | "SecurityRequirement" | "ComplianceRequirement" | "Package" | "Module" | "FilePlan" | "DBTable" | "DBColumn" | "DBIndex" | "DBConstraint" | "RLSPolicy" | "APIEndpoint" | "APIRoute" | "FrontendRoute" | "UIComponent" | "Component" | "Service" | "Job" | "Event" | "Queue" | "ExternalIntegration" | "EnvVar" | "SecretRef" | "Permission" | "TestPlan" | "ConstitutionRule" | "GuardianReport" | "Task" | "CodePatch" | "File" | "Symbol" | "Function" | "Class" | "Type" | "Import" | "Export" | "RouteHandler" | "ServerAction" | "ReactComponent" | "ZodSchema" | "SQLMigration" | "SupabaseTable" | "RLSActualPolicy" | "GitHubIssue" | "Branch" | "PR" | "Commit" | "CheckRun" | "Deployment" | "RuntimeProbe" | "SecurityFinding" | "Vulnerability" | "DriftFinding";
+    natural_key: string;
+}, {
+    proofRef: string;
+    layer: "intent" | "architecture" | "code_reality";
+    ontology_type: "ProductConcept" | "Requirement" | "AcceptanceCriterion" | "Constraint" | "Risk" | "DomainEntity" | "Workflow" | "UserRole" | "Policy" | "NonFunctionalRequirement" | "SecurityRequirement" | "ComplianceRequirement" | "Package" | "Module" | "FilePlan" | "DBTable" | "DBColumn" | "DBIndex" | "DBConstraint" | "RLSPolicy" | "APIEndpoint" | "APIRoute" | "FrontendRoute" | "UIComponent" | "Component" | "Service" | "Job" | "Event" | "Queue" | "ExternalIntegration" | "EnvVar" | "SecretRef" | "Permission" | "TestPlan" | "ConstitutionRule" | "GuardianReport" | "Task" | "CodePatch" | "File" | "Symbol" | "Function" | "Class" | "Type" | "Import" | "Export" | "RouteHandler" | "ServerAction" | "ReactComponent" | "ZodSchema" | "SQLMigration" | "SupabaseTable" | "RLSActualPolicy" | "GitHubIssue" | "Branch" | "PR" | "Commit" | "CheckRun" | "Deployment" | "RuntimeProbe" | "SecurityFinding" | "Vulnerability" | "DriftFinding";
+    natural_key: string;
+}>;
+export type KgProofSliceRef = z.infer<typeof KgProofSliceRefSchema>;

package/dist/schemas/graph/node-v2.schema.js

@@ -0,0 +1,120 @@
+"use strict";
+/**
+ * NeuraLoom — Knowledge Graph v2 node types (skeleton)
+ *
+ * Refs: GH umbrella #689, tasks #697 (schema), #698 (zod schemas).
+ * Canvas: canvases/mega-sprint-01-knowledge-graph-foundation.canvas.tsx
+ *
+ * This complements (does NOT replace) the existing
+ * `packages/contracts/src/schemas/traceability/traceability-graph.schema.ts`,
+ * which already covers requirement / task / file / pull_request / deployment /
+ * runtime_check node kinds.
+ *
+ * KG-v2 adds the 3-layer ontology (Intent / Architecture / Code Reality) plus
+ * the broader node-type registry needed by the indexer (Architecture +
+ * Code Reality layers).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KgProofSliceRefSchema = exports.KnowledgeNodeKgOverlaySchema = exports.KgNodeTypeSchema = exports.KgCodeRealityNodeType = exports.KgArchitectureNodeType = exports.KgIntentNodeType = exports.KgLayerSchema = void 0;
+const zod_1 = require("zod");
+/** Three-layer ontology. */
+exports.KgLayerSchema = zod_1.z.enum([
+    "intent",
+    "architecture",
+    "code_reality",
+]);
+/** Canonical registry of node types per layer. */
+exports.KgIntentNodeType = zod_1.z.enum([
+    "ProductConcept",
+    "Requirement",
+    "AcceptanceCriterion",
+    "Constraint",
+    "Risk",
+    "DomainEntity",
+    "Workflow",
+    "UserRole",
+    "Policy",
+    "NonFunctionalRequirement",
+    "SecurityRequirement",
+    "ComplianceRequirement",
+]);
+exports.KgArchitectureNodeType = zod_1.z.enum([
+    "Package",
+    "Module",
+    "FilePlan",
+    "DBTable",
+    "DBColumn",
+    "DBIndex",
+    "DBConstraint",
+    "RLSPolicy",
+    "APIEndpoint",
+    "APIRoute",
+    "FrontendRoute",
+    "UIComponent",
+    "Component",
+    "Service",
+    "Job",
+    "Event",
+    "Queue",
+    "ExternalIntegration",
+    "EnvVar",
+    "SecretRef",
+    "Permission",
+    "TestPlan",
+    "ConstitutionRule",
+    "GuardianReport",
+    "Task",
+    "CodePatch",
+]);
+exports.KgCodeRealityNodeType = zod_1.z.enum([
+    "File",
+    "Symbol",
+    "Function",
+    "Class",
+    "Type",
+    "Import",
+    "Export",
+    "RouteHandler",
+    "ServerAction",
+    "ReactComponent",
+    "ZodSchema",
+    "SQLMigration",
+    "SupabaseTable",
+    "RLSActualPolicy",
+    "GitHubIssue",
+    "Branch",
+    "PR",
+    "Commit",
+    "CheckRun",
+    "Deployment",
+    "RuntimeProbe",
+    "SecurityFinding",
+    "Vulnerability",
+    "DriftFinding",
+]);
+/** Union of all node-type names (string-only; payload validation comes per-type). */
+exports.KgNodeTypeSchema = zod_1.z.union([
+    exports.KgIntentNodeType,
+    exports.KgArchitectureNodeType,
+    exports.KgCodeRealityNodeType,
+]);
+/**
+ * Columns added to `public.knowledge_nodes` for KG v2 (overlay).
+ * Physical PK remains UUID id — deterministic keys live in kg_stable_key / proof helpers.
+ */
+exports.KnowledgeNodeKgOverlaySchema = zod_1.z.object({
+    kg_layer: exports.KgLayerSchema.nullable().optional(),
+    kg_ontology_type: zod_1.z.string().nullable().optional(),
+    kg_stable_key: zod_1.z.string().nullable().optional(),
+    kg_proof_slice: zod_1.z.record(zod_1.z.unknown()).default({}),
+});
+/**
+ * Logical proof-slice identity (indexer / apiClient) — not a DB PK.
+ * Format: `{layer}:{ontologyType}:{sha256HexPrefix}`
+ */
+exports.KgProofSliceRefSchema = zod_1.z.object({
+    proofRef: zod_1.z.string().regex(/^[a-z_]+:[A-Za-z0-9_]+:[a-f0-9]{16}$/),
+    layer: exports.KgLayerSchema,
+    ontology_type: exports.KgNodeTypeSchema,
+    natural_key: zod_1.z.string().min(1).max(4096),
+});

package/dist/schemas/graph/sql-security-findings.schema.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Static SQL / migration analysis findings mapped toward KG `SecurityFinding` nodes.
+ * Refs: GH #726 (RLS & SQL security scanner), #770 (Supabase advisor class correlation).
+ *
+ * Live Supabase advisors expose remediation rows with advisor-specific metadata; when that
+ * export is unavailable, consumers should populate only `kind` + `resource` + `sqlEvidence`
+ * and leave `supabaseAdvisorClass` unset (see #770 — missing service-role advisor export).
+ */
+import { z } from "zod";
+/** Canonical finding kinds produced by deterministic migration SQL analysis. */
+export declare const SqlGraphSecurityFindingKindSchema: z.ZodEnum<["MISSING_RLS_ON_PUBLIC_TABLE", "RLS_POLICY_ALWAYS_TRUE", "SECURITY_DEFINER_VIEW_RISK", "EXTENSION_IN_PUBLIC_SCHEMA"]>;
+export type SqlGraphSecurityFindingKind = z.infer<typeof SqlGraphSecurityFindingKindSchema>;
+/** Optional correlation ids when bridging from Supabase Dashboard advisors API / CLI. */
+export declare const SupabaseAdvisorClassSchema: z.ZodEnum<["rls_disabled_in_public", "rls_policy_always_true", "security_definer_view", "extension_in_public"]>;
+export type SupabaseAdvisorClass = z.infer<typeof SupabaseAdvisorClassSchema>;
+export declare const SqlSecurityResourceSchema: z.ZodObject<{
+    schema: z.ZodString;
+    name: z.ZodString;
+    objectType: z.ZodEnum<["table", "policy", "view", "function", "extension"]>;
+}, "strip", z.ZodTypeAny, {
+    schema: string;
+    name: string;
+    objectType: "function" | "table" | "policy" | "view" | "extension";
+}, {
+    schema: string;
+    name: string;
+    objectType: "function" | "table" | "policy" | "view" | "extension";
+}>;
+export type SqlSecurityResource = z.infer<typeof SqlSecurityResourceSchema>;
+export declare const SqlGraphSecurityFindingSchema: z.ZodObject<{
+    kind: z.ZodEnum<["MISSING_RLS_ON_PUBLIC_TABLE", "RLS_POLICY_ALWAYS_TRUE", "SECURITY_DEFINER_VIEW_RISK", "EXTENSION_IN_PUBLIC_SCHEMA"]>;
+    /** Human-readable detail for graph SecurityFinding.label / inspector UI. */
+    message: z.ZodString;
+    resource: z.ZodObject<{
+        schema: z.ZodString;
+        name: z.ZodString;
+        objectType: z.ZodEnum<["table", "policy", "view", "function", "extension"]>;
+    }, "strip", z.ZodTypeAny, {
+        schema: string;
+        name: string;
+        objectType: "function" | "table" | "policy" | "view" | "extension";
+    }, {
+        schema: string;
+        name: string;
+        objectType: "function" | "table" | "policy" | "view" | "extension";
+    }>;
+    /** When matched from live Supabase advisors (#770); omitted for SQL-only analysis. */
+    supabaseAdvisorClass: z.ZodOptional<z.ZodEnum<["rls_disabled_in_public", "rls_policy_always_true", "security_definer_view", "extension_in_public"]>>;
+    sqlEvidence: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+    message: string;
+    kind: "MISSING_RLS_ON_PUBLIC_TABLE" | "RLS_POLICY_ALWAYS_TRUE" | "SECURITY_DEFINER_VIEW_RISK" | "EXTENSION_IN_PUBLIC_SCHEMA";
+    resource: {
+        schema: string;
+        name: string;
+        objectType: "function" | "table" | "policy" | "view" | "extension";
+    };
+    supabaseAdvisorClass?: "rls_disabled_in_public" | "rls_policy_always_true" | "security_definer_view" | "extension_in_public" | undefined;
+    sqlEvidence?: Record<string, unknown> | undefined;
+}, {
+    message: string;
+    kind: "MISSING_RLS_ON_PUBLIC_TABLE" | "RLS_POLICY_ALWAYS_TRUE" | "SECURITY_DEFINER_VIEW_RISK" | "EXTENSION_IN_PUBLIC_SCHEMA";
+    resource: {
+        schema: string;
+        name: string;
+        objectType: "function" | "table" | "policy" | "view" | "extension";
+    };
+    supabaseAdvisorClass?: "rls_disabled_in_public" | "rls_policy_always_true" | "security_definer_view" | "extension_in_public" | undefined;
+    sqlEvidence?: Record<string, unknown> | undefined;
+}>;
+export type SqlGraphSecurityFinding = z.infer<typeof SqlGraphSecurityFindingSchema>;

package/dist/schemas/graph/sql-security-findings.schema.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SqlGraphSecurityFindingSchema = exports.SqlSecurityResourceSchema = exports.SupabaseAdvisorClassSchema = exports.SqlGraphSecurityFindingKindSchema = void 0;
+/**
+ * Static SQL / migration analysis findings mapped toward KG `SecurityFinding` nodes.
+ * Refs: GH #726 (RLS & SQL security scanner), #770 (Supabase advisor class correlation).
+ *
+ * Live Supabase advisors expose remediation rows with advisor-specific metadata; when that
+ * export is unavailable, consumers should populate only `kind` + `resource` + `sqlEvidence`
+ * and leave `supabaseAdvisorClass` unset (see #770 — missing service-role advisor export).
+ */
+const zod_1 = require("zod");
+/** Canonical finding kinds produced by deterministic migration SQL analysis. */
+exports.SqlGraphSecurityFindingKindSchema = zod_1.z.enum([
+    "MISSING_RLS_ON_PUBLIC_TABLE",
+    "RLS_POLICY_ALWAYS_TRUE",
+    "SECURITY_DEFINER_VIEW_RISK",
+    "EXTENSION_IN_PUBLIC_SCHEMA",
+]);
+/** Optional correlation ids when bridging from Supabase Dashboard advisors API / CLI. */
+exports.SupabaseAdvisorClassSchema = zod_1.z.enum([
+    "rls_disabled_in_public",
+    "rls_policy_always_true",
+    "security_definer_view",
+    "extension_in_public",
+]);
+exports.SqlSecurityResourceSchema = zod_1.z.object({
+    schema: zod_1.z.string(),
+    name: zod_1.z.string(),
+    objectType: zod_1.z.enum(["table", "policy", "view", "function", "extension"]),
+});
+exports.SqlGraphSecurityFindingSchema = zod_1.z.object({
+    kind: exports.SqlGraphSecurityFindingKindSchema,
+    /** Human-readable detail for graph SecurityFinding.label / inspector UI. */
+    message: zod_1.z.string(),
+    resource: exports.SqlSecurityResourceSchema,
+    /** When matched from live Supabase advisors (#770); omitted for SQL-only analysis. */
+    supabaseAdvisorClass: exports.SupabaseAdvisorClassSchema.optional(),
+    sqlEvidence: zod_1.z.record(zod_1.z.unknown()).optional(),
+});

package/dist/schemas/guardian/guardian-score.schema.d.ts

@@ -0,0 +1,13 @@
+import { z } from "zod";
+/**
+ * Canonical Guardian quality score for all product surfaces: integer 0–100.
+ * Issue #237 — not for normalized non-Guardian ratios (e.g. cosine similarity in 0–1).
+ */
+export declare const GuardianScoreSchema: z.ZodNumber;
+/**
+ * LLMs often emit fractional percentages; coerce with Math.round before enforcing integers.
+ */
+export declare const GuardianScoreFromModelSchema: z.ZodPipeline<z.ZodEffects<z.ZodNumber, number, number>, z.ZodNumber>;
+export declare const GuardianScoreNullableSchema: z.ZodUnion<[z.ZodNumber, z.ZodNull]>;
+/** Optional/nullable variant for artifact envelopes that may omit scores. */
+export declare const GuardianScoreNullishFromModelSchema: z.ZodOptional<z.ZodUnion<[z.ZodPipeline<z.ZodEffects<z.ZodNumber, number, number>, z.ZodNumber>, z.ZodNull]>>;

package/dist/schemas/guardian/guardian-score.schema.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GuardianScoreNullishFromModelSchema = exports.GuardianScoreNullableSchema = exports.GuardianScoreFromModelSchema = exports.GuardianScoreSchema = void 0;
+const zod_1 = require("zod");
+/**
+ * Canonical Guardian quality score for all product surfaces: integer 0–100.
+ * Issue #237 — not for normalized non-Guardian ratios (e.g. cosine similarity in 0–1).
+ */
+exports.GuardianScoreSchema = zod_1.z.number().int().min(0).max(100);
+/**
+ * LLMs often emit fractional percentages; coerce with Math.round before enforcing integers.
+ */
+exports.GuardianScoreFromModelSchema = zod_1.z
+    .number()
+    .transform((value) => Math.round(value))
+    .pipe(exports.GuardianScoreSchema);
+exports.GuardianScoreNullableSchema = zod_1.z.union([
+    exports.GuardianScoreSchema,
+    zod_1.z.null(),
+]);
+/** Optional/nullable variant for artifact envelopes that may omit scores. */
+exports.GuardianScoreNullishFromModelSchema = zod_1.z
+    .union([exports.GuardianScoreFromModelSchema, zod_1.z.null()])
+    .optional();

package/dist/schemas/guardian/validate.schema.d.ts

@@ -0,0 +1,51 @@
+import { z } from "zod";
+export declare const GuardianModeSchema: z.ZodEnum<["project_guardian", "chapter_guardian", "manuscript_guardian", "publication_guardian"]>;
+export type GuardianMode = z.infer<typeof GuardianModeSchema>;
+/** POST /api/guardian/validate request body — SSOT for Guardian validation API */
+export declare const GuardianValidateInputSchema: z.ZodEffects<z.ZodObject<{
+    projectId: z.ZodOptional<z.ZodString>;
+    phase: z.ZodOptional<z.ZodEnum<["discover", "design", "develop", "validate", "ship", "monitor"]>>;
+    constitutionVersion: z.ZodDefault<z.ZodNumber>;
+    autoResolve: z.ZodDefault<z.ZodBoolean>;
+    scope: z.ZodOptional<z.ZodEnum<["ai", "db", "constitution"]>>;
+    orchestrationId: z.ZodOptional<z.ZodString>;
+    mode: z.ZodOptional<z.ZodEnum<["project_guardian", "chapter_guardian", "manuscript_guardian", "publication_guardian"]>>;
+    chapterIndex: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    constitutionVersion: number;
+    autoResolve: boolean;
+    projectId?: string | undefined;
+    phase?: "monitor" | "design" | "ship" | "discover" | "develop" | "validate" | undefined;
+    mode?: "project_guardian" | "chapter_guardian" | "manuscript_guardian" | "publication_guardian" | undefined;
+    scope?: "constitution" | "ai" | "db" | undefined;
+    chapterIndex?: number | undefined;
+    orchestrationId?: string | undefined;
+}, {
+    projectId?: string | undefined;
+    phase?: "monitor" | "design" | "ship" | "discover" | "develop" | "validate" | undefined;
+    mode?: "project_guardian" | "chapter_guardian" | "manuscript_guardian" | "publication_guardian" | undefined;
+    scope?: "constitution" | "ai" | "db" | undefined;
+    chapterIndex?: number | undefined;
+    constitutionVersion?: number | undefined;
+    autoResolve?: boolean | undefined;
+    orchestrationId?: string | undefined;
+}>, {
+    constitutionVersion: number;
+    autoResolve: boolean;
+    projectId?: string | undefined;
+    phase?: "monitor" | "design" | "ship" | "discover" | "develop" | "validate" | undefined;
+    mode?: "project_guardian" | "chapter_guardian" | "manuscript_guardian" | "publication_guardian" | undefined;
+    scope?: "constitution" | "ai" | "db" | undefined;
+    chapterIndex?: number | undefined;
+    orchestrationId?: string | undefined;
+}, {
+    projectId?: string | undefined;
+    phase?: "monitor" | "design" | "ship" | "discover" | "develop" | "validate" | undefined;
+    mode?: "project_guardian" | "chapter_guardian" | "manuscript_guardian" | "publication_guardian" | undefined;
+    scope?: "constitution" | "ai" | "db" | undefined;
+    chapterIndex?: number | undefined;
+    constitutionVersion?: number | undefined;
+    autoResolve?: boolean | undefined;
+    orchestrationId?: string | undefined;
+}>;
+export type GuardianValidateInput = z.infer<typeof GuardianValidateInputSchema>;

package/dist/schemas/guardian/validate.schema.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GuardianValidateInputSchema = exports.GuardianModeSchema = void 0;
+const zod_1 = require("zod");
+exports.GuardianModeSchema = zod_1.z.enum([
+    "project_guardian",
+    "chapter_guardian",
+    "manuscript_guardian",
+    "publication_guardian",
+]);
+/** POST /api/guardian/validate request body — SSOT for Guardian validation API */
+exports.GuardianValidateInputSchema = zod_1.z
+    .object({
+    projectId: zod_1.z.string().uuid().optional(),
+    phase: zod_1.z
+        .enum(["discover", "design", "develop", "validate", "ship", "monitor"])
+        .optional(),
+    constitutionVersion: zod_1.z.number().default(1),
+    autoResolve: zod_1.z.boolean().default(false),
+    scope: zod_1.z.enum(["ai", "db", "constitution"]).optional(),
+    orchestrationId: zod_1.z.string().uuid().optional(),
+    mode: exports.GuardianModeSchema.optional(),
+    chapterIndex: zod_1.z.number().int().min(0).max(999).optional(),
+})
+    // No .strict(): useAIMutation forwards agentRole/attempt; UI may send checkScope /
+    // includeRecommendations. Strip unknown keys instead of 400.
+    .superRefine((data, ctx) => {
+    if (data.mode === "chapter_guardian" &&
+        data.chapterIndex === undefined) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            message: "chapterIndex is required when mode is chapter_guardian",
+            path: ["chapterIndex"],
+        });
+    }
+});

package/dist/schemas/implement/nextjs-scaffold-manifest.schema.d.ts

@@ -0,0 +1,44 @@
+import { z } from "zod";
+/** Stable metadata for scaffold manifest templating — no semver SSOT here. */
+export declare const NextjsScaffoldProjectMetaSchema: z.ZodObject<{
+    projectSlug: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    projectSlug: string;
+}, {
+    projectSlug: string;
+}>;
+export type NextjsScaffoldProjectMeta = z.infer<typeof NextjsScaffoldProjectMetaSchema>;
+export declare const ScaffoldManifestEntrySchema: z.ZodObject<{
+    path: z.ZodString;
+    template: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    path: string;
+    template: string;
+}, {
+    path: string;
+    template: string;
+}>;
+export type ScaffoldManifestEntry = z.infer<typeof ScaffoldManifestEntrySchema>;
+export declare const ScaffoldManifestSchema: z.ZodObject<{
+    entries: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        template: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        path: string;
+        template: string;
+    }, {
+        path: string;
+        template: string;
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    entries: {
+        path: string;
+        template: string;
+    }[];
+}, {
+    entries: {
+        path: string;
+        template: string;
+    }[];
+}>;
+export type ScaffoldManifest = z.infer<typeof ScaffoldManifestSchema>;

package/dist/schemas/implement/nextjs-scaffold-manifest.schema.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScaffoldManifestSchema = exports.ScaffoldManifestEntrySchema = exports.NextjsScaffoldProjectMetaSchema = void 0;
+const zod_1 = require("zod");
+/** Stable metadata for scaffold manifest templating — no semver SSOT here. */
+exports.NextjsScaffoldProjectMetaSchema = zod_1.z
+    .object({
+    projectSlug: zod_1.z
+        .string()
+        .min(1)
+        .max(64)
+        .regex(/^[a-z0-9-]+$/),
+})
+    .strict();
+exports.ScaffoldManifestEntrySchema = zod_1.z
+    .object({
+    path: zod_1.z.string().min(1),
+    template: zod_1.z.string(),
+})
+    .strict();
+exports.ScaffoldManifestSchema = zod_1.z
+    .object({
+    entries: zod_1.z.array(exports.ScaffoldManifestEntrySchema),
+})
+    .strict();

package/dist/schemas/implement/patch-validation-diagnostic.schema.d.ts

@@ -0,0 +1,17 @@
+import { z } from 'zod';
+export declare const PatchValidationDiagnosticCodeSchema: z.ZodEnum<["JSX_IN_API_ROUTE_TS", "JSX_IN_TS_FILE", "CONTRACTS_PACKAGE_UI_LEAK", "INTERNAL_WORKSPACE_IMPORT_UNRESOLVED", "EXTERNAL_DEPENDENCY_UNDECLARED", "PATCH_OUTSIDE_PACKET_SCOPE", "PATCH_DID_NOT_TOUCH_PACKET_FILES", "PATCH_VALIDATOR_TSCONFIG_MISCONFIGURED"]>;
+export type PatchValidationDiagnosticCode = z.infer<typeof PatchValidationDiagnosticCodeSchema>;
+export declare const ImplementGraphValidationFailureSchema: z.ZodObject<{
+    code: z.ZodEnum<["JSX_IN_API_ROUTE_TS", "JSX_IN_TS_FILE", "CONTRACTS_PACKAGE_UI_LEAK", "INTERNAL_WORKSPACE_IMPORT_UNRESOLVED", "EXTERNAL_DEPENDENCY_UNDECLARED", "PATCH_OUTSIDE_PACKET_SCOPE", "PATCH_DID_NOT_TOUCH_PACKET_FILES", "PATCH_VALIDATOR_TSCONFIG_MISCONFIGURED"]>;
+    message: z.ZodString;
+    filePath: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    code: "PATCH_OUTSIDE_PACKET_SCOPE" | "JSX_IN_API_ROUTE_TS" | "JSX_IN_TS_FILE" | "CONTRACTS_PACKAGE_UI_LEAK" | "INTERNAL_WORKSPACE_IMPORT_UNRESOLVED" | "EXTERNAL_DEPENDENCY_UNDECLARED" | "PATCH_DID_NOT_TOUCH_PACKET_FILES" | "PATCH_VALIDATOR_TSCONFIG_MISCONFIGURED";
+    message: string;
+    filePath?: string | undefined;
+}, {
+    code: "PATCH_OUTSIDE_PACKET_SCOPE" | "JSX_IN_API_ROUTE_TS" | "JSX_IN_TS_FILE" | "CONTRACTS_PACKAGE_UI_LEAK" | "INTERNAL_WORKSPACE_IMPORT_UNRESOLVED" | "EXTERNAL_DEPENDENCY_UNDECLARED" | "PATCH_DID_NOT_TOUCH_PACKET_FILES" | "PATCH_VALIDATOR_TSCONFIG_MISCONFIGURED";
+    message: string;
+    filePath?: string | undefined;
+}>;
+export type ImplementGraphValidationFailure = z.infer<typeof ImplementGraphValidationFailureSchema>;

package/dist/schemas/implement/patch-validation-diagnostic.schema.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ImplementGraphValidationFailureSchema = exports.PatchValidationDiagnosticCodeSchema = void 0;
+const zod_1 = require("zod");
+exports.PatchValidationDiagnosticCodeSchema = zod_1.z.enum([
+    'JSX_IN_API_ROUTE_TS',
+    'JSX_IN_TS_FILE',
+    'CONTRACTS_PACKAGE_UI_LEAK',
+    'INTERNAL_WORKSPACE_IMPORT_UNRESOLVED',
+    'EXTERNAL_DEPENDENCY_UNDECLARED',
+    'PATCH_OUTSIDE_PACKET_SCOPE',
+    'PATCH_DID_NOT_TOUCH_PACKET_FILES',
+    'PATCH_VALIDATOR_TSCONFIG_MISCONFIGURED',
+]);
+exports.ImplementGraphValidationFailureSchema = zod_1.z.object({
+    code: exports.PatchValidationDiagnosticCodeSchema,
+    message: zod_1.z.string(),
+    filePath: zod_1.z.string().optional(),
+});