@nexusclawhq/cli 0.2.1

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/ai-authoring-context-signing.js

@@ -0,0 +1,243 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AiContextSigningError = void 0;
+exports.assertAiContextSigningKeySet = assertAiContextSigningKeySet;
+exports.buildAiContextDetachedSigningInput = buildAiContextDetachedSigningInput;
+exports.verifyAiContextDetachedJws = verifyAiContextDetachedJws;
+/**
+ * Public-key-only primitives for the AI authoring context detached JWS.
+ *
+ * Private-key parsing and signing stay in the backend owner. This shared file
+ * owns the exact protected header, canonical payload and fail-closed verifier
+ * used by both backend tests and the CLI.
+ */
+const node_crypto_1 = require("node:crypto");
+const contract_versions_1 = require("./contract-versions");
+const canonical_hash_1 = require("./canonical-hash");
+class AiContextSigningError extends Error {
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = 'AiContextSigningError';
+    }
+}
+exports.AiContextSigningError = AiContextSigningError;
+function base64UrlEncode(value) {
+    return Buffer.from(value).toString('base64url');
+}
+function base64UrlDecode(value) {
+    if (!/^[A-Za-z0-9_-]+$/.test(value)) {
+        throw new AiContextSigningError('AI_CONTEXT_SIGNATURE_INVALID');
+    }
+    const decoded = Buffer.from(value, 'base64url');
+    if (decoded.toString('base64url') !== value) {
+        throw new AiContextSigningError('AI_CONTEXT_SIGNATURE_INVALID');
+    }
+    return decoded;
+}
+function exactKeys(value, expected) {
+    const actual = Object.keys(value).sort();
+    const sortedExpected = [...expected].sort();
+    return (actual.length === sortedExpected.length &&
+        actual.every((key, index) => key === sortedExpected[index]));
+}
+function isExactIsoInstant(value) {
+    if (typeof value !== 'string')
+        return false;
+    const epoch = Date.parse(value);
+    return Number.isFinite(epoch) && new Date(epoch).toISOString() === value;
+}
+function requireNonBlank(value) {
+    return (typeof value === 'string' &&
+        value.length > 0 &&
+        value.length <= 512 &&
+        value.trim() === value);
+}
+function assertPublicJwk(value) {
+    if (value === null ||
+        typeof value !== 'object' ||
+        Array.isArray(value) ||
+        !exactKeys(value, ['kty', 'crv', 'x'])) {
+        throw new AiContextSigningError('AI_CONTEXT_SIGNATURE_INVALID');
+    }
+    const jwk = value;
+    if (jwk.kty !== 'OKP' ||
+        jwk.crv !== 'Ed25519' ||
+        typeof jwk.x !== 'string' ||
+        base64UrlDecode(jwk.x).byteLength !== 32) {
+        throw new AiContextSigningError('AI_CONTEXT_SIGNATURE_INVALID');
+    }
+}
+/** Runtime validation for the authenticated public JWK-set response. */
+function assertAiContextSigningKeySet(value) {
+    if (value === null ||
+        typeof value !== 'object' ||
+        Array.isArray(value) ||
+        !exactKeys(value, [
+            'schemaVersion',
+            'issuer',
+            'generatedAt',
+            'cacheUntil',
+            'keys',
+        ])) {
+        throw new AiContextSigningError('AI_CONTEXT_SIGNATURE_INVALID');
+    }
+    const keySet = value;
+    if (keySet.schemaVersion !== contract_versions_1.AI_CONTEXT_SIGNING_KEY_SET_SCHEMA_VERSION ||
+        !requireNonBlank(keySet.issuer) ||
+        !isExactIsoInstant(keySet.generatedAt) ||
+        !isExactIsoInstant(keySet.cacheUntil) ||
+        Date.parse(keySet.cacheUntil) <= Date.parse(keySet.generatedAt) ||
+        !Array.isArray(keySet.keys)) {
+        throw new AiContextSigningError('AI_CONTEXT_SIGNATURE_INVALID');
+    }
+    const seen = new Set();
+    let previousKeyId;
+    for (const rawKey of keySet.keys) {
+        if (rawKey === null ||
+            typeof rawKey !== 'object' ||
+            Array.isArray(rawKey) ||
+            !exactKeys(rawKey, [
+                'keyId',
+                'alg',
+                'publicKeyJwk',
+                'notBefore',
+                'notAfter',
+                'status',
+            ])) {
+            throw new AiContextSigningError('AI_CONTEXT_SIGNATURE_INVALID');
+        }
+        const key = rawKey;
+        if (!requireNonBlank(key.keyId) ||
+            key.alg !== contract_versions_1.AI_CONTEXT_SIGNATURE_ALG_ED25519 ||
+            !isExactIsoInstant(key.notBefore) ||
+            !isExactIsoInstant(key.notAfter) ||
+            Date.parse(key.notAfter) <= Date.parse(key.notBefore) ||
+            (key.status !== 'active' && key.status !== 'retiring') ||
+            seen.has(key.keyId) ||
+            (previousKeyId !== undefined && previousKeyId.localeCompare(key.keyId) >= 0)) {
+            throw new AiContextSigningError('AI_CONTEXT_SIGNATURE_INVALID');
+        }
+        assertPublicJwk(key.publicKeyJwk);
+        seen.add(key.keyId);
+        previousKeyId = key.keyId;
+    }
+}
+function assertSignaturePayload(payload) {
+    if (!exactKeys(payload, [
+        'lockDigest',
+        'workspaceId',
+        'principalScopeDigest',
+        'orgAliasClaim',
+        'generatedAt',
+        'expiresAt',
+    ]) ||
+        !(0, canonical_hash_1.isSha256Digest)(payload.lockDigest) ||
+        !(0, canonical_hash_1.isSha256Digest)(payload.principalScopeDigest) ||
+        !requireNonBlank(payload.workspaceId) ||
+        !requireNonBlank(payload.orgAliasClaim) ||
+        !isExactIsoInstant(payload.generatedAt) ||
+        !isExactIsoInstant(payload.expiresAt) ||
+        Date.parse(payload.expiresAt) <= Date.parse(payload.generatedAt)) {
+        throw new AiContextSigningError('AI_CONTEXT_SIGNATURE_INVALID');
+    }
+}
+/**
+ * Build the exact RFC 8785 payload signing input. The returned JWS protected
+ * segment is combined with a deliberately omitted compact payload by callers:
+ * `<protected>..<signature>`.
+ */
+function buildAiContextDetachedSigningInput(payload, keyId) {
+    assertSignaturePayload(payload);
+    if (!requireNonBlank(keyId)) {
+        throw new AiContextSigningError('AI_CONTEXT_SIGNATURE_INVALID');
+    }
+    const header = {
+        alg: contract_versions_1.AI_CONTEXT_SIGNATURE_ALG_ED25519,
+        typ: contract_versions_1.AI_CONTEXT_SIGNATURE_TYP,
+        kid: keyId,
+    };
+    const protectedHeader = base64UrlEncode((0, canonical_hash_1.canonicalJsonString)(header));
+    const encodedPayload = base64UrlEncode((0, canonical_hash_1.canonicalJsonString)(payload));
+    return {
+        protectedHeader,
+        signingInput: Buffer.from(`${protectedHeader}.${encodedPayload}`, 'utf8'),
+    };
+}
+/**
+ * Verify an Ed25519 detached compact JWS using only the authenticated public
+ * key set. Embedded/untrusted keys and non-canonical/extra header fields are
+ * never accepted.
+ */
+function verifyAiContextDetachedJws(input) {
+    assertAiContextSigningKeySet(input.keySet);
+    const now = input.now ?? new Date();
+    const nowMs = now.getTime();
+    if (!Number.isFinite(nowMs) ||
+        (input.expectedIssuer !== undefined &&
+            input.keySet.issuer !== input.expectedIssuer)) {
+        throw new AiContextSigningError('AI_CONTEXT_SIGNATURE_INVALID');
+    }
+    const segments = input.detachedJws.split('.');
+    if (segments.length !== 3 || segments[1] !== '') {
+        throw new AiContextSigningError('AI_CONTEXT_SIGNATURE_INVALID');
+    }
+    let header;
+    try {
+        header = JSON.parse(base64UrlDecode(segments[0]).toString('utf8'));
+    }
+    catch (error) {
+        if (error instanceof AiContextSigningError)
+            throw error;
+        throw new AiContextSigningError('AI_CONTEXT_SIGNATURE_INVALID');
+    }
+    if (header === null ||
+        typeof header !== 'object' ||
+        Array.isArray(header) ||
+        !exactKeys(header, ['alg', 'typ', 'kid'])) {
+        throw new AiContextSigningError('AI_CONTEXT_SIGNATURE_INVALID');
+    }
+    const protectedHeader = header;
+    if (protectedHeader.alg !== contract_versions_1.AI_CONTEXT_SIGNATURE_ALG_ED25519 ||
+        protectedHeader.typ !== contract_versions_1.AI_CONTEXT_SIGNATURE_TYP ||
+        protectedHeader.kid !== input.expectedKeyId) {
+        throw new AiContextSigningError('AI_CONTEXT_SIGNATURE_INVALID');
+    }
+    const rebuilt = buildAiContextDetachedSigningInput(input.payload, input.expectedKeyId);
+    if (rebuilt.protectedHeader !== segments[0]) {
+        throw new AiContextSigningError('AI_CONTEXT_SIGNATURE_INVALID');
+    }
+    if (nowMs >= Date.parse(input.keySet.cacheUntil) ||
+        nowMs < Date.parse(input.payload.generatedAt) ||
+        nowMs >= Date.parse(input.payload.expiresAt)) {
+        throw new AiContextSigningError('AI_CONTEXT_SIGNING_KEY_UNKNOWN');
+    }
+    const key = input.keySet.keys.find((candidate) => candidate.keyId === input.expectedKeyId);
+    if (!key ||
+        nowMs < Date.parse(key.notBefore) ||
+        nowMs >= Date.parse(key.notAfter)) {
+        throw new AiContextSigningError('AI_CONTEXT_SIGNING_KEY_UNKNOWN');
+    }
+    let valid = false;
+    try {
+        const publicKey = (0, node_crypto_1.createPublicKey)({
+            key: {
+                kty: key.publicKeyJwk.kty,
+                crv: key.publicKeyJwk.crv,
+                x: key.publicKeyJwk.x,
+            },
+            format: 'jwk',
+        });
+        valid = (0, node_crypto_1.verify)(null, rebuilt.signingInput, publicKey, base64UrlDecode(segments[2]));
+    }
+    catch (error) {
+        if (error instanceof AiContextSigningError)
+            throw error;
+        valid = false;
+    }
+    if (!valid) {
+        throw new AiContextSigningError('AI_CONTEXT_SIGNATURE_INVALID');
+    }
+    return { issuer: input.keySet.issuer, keyId: key.keyId };
+}
+//# sourceMappingURL=ai-authoring-context-signing.js.map

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/ai-authoring-context-signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-authoring-context-signing.js","sourceRoot":"","sources":["../../src/agent-executable-assets/ai-authoring-context-signing.ts"],"names":[],"mappings":";;;AA2GA,oEAgEC;AA+BD,gFAuBC;AAOD,gEA4FC;AApUD;;;;;;GAMG;AACH,6CAAsD;AACtD,2DAI6B;AAO7B,qDAAuE;AAOvE,MAAa,qBAAsB,SAAQ,KAAK;IAC9C,YAAqB,IAA+B;QAClD,KAAK,CAAC,IAAI,CAAC,CAAC;QADO,SAAI,GAAJ,IAAI,CAA2B;QAElD,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AALD,sDAKC;AAgBD,SAAS,eAAe,CAAC,KAA0B;IACjD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK,EAAE,CAAC;QAC5C,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,SAAS,CAAC,KAA8B,EAAE,QAA2B;IAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,cAAc,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,OAAO,CACL,MAAM,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM;QACvC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,cAAc,CAAC,KAAK,CAAC,CAAC,CAC5D,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC;AAC3E,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,GAAG,CAAC;QAChB,KAAK,CAAC,MAAM,IAAI,GAAG;QACnB,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,CACvB,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IACE,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,CAAC,SAAS,CAAC,KAAgC,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,EACjE,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,IACE,GAAG,CAAC,GAAG,KAAK,KAAK;QACjB,GAAG,CAAC,GAAG,KAAK,SAAS;QACrB,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ;QACzB,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,EACxC,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,SAAgB,4BAA4B,CAC1C,KAAc;IAEd,IACE,KAAK,KAAK,IAAI;QACd,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,CAAC,SAAS,CAAC,KAAgC,EAAE;YAC3C,eAAe;YACf,QAAQ;YACR,aAAa;YACb,YAAY;YACZ,MAAM;SACP,CAAC,EACF,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IACE,MAAM,CAAC,aAAa,KAAK,6DAAyC;QAClE,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC;QAC/B,CAAC,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC;QACtC,CAAC,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC;QAC/D,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAC3B,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,aAAiC,CAAC;IACtC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,IACE,MAAM,KAAK,IAAI;YACf,OAAO,MAAM,KAAK,QAAQ;YAC1B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACrB,CAAC,SAAS,CAAC,MAAiC,EAAE;gBAC5C,OAAO;gBACP,KAAK;gBACL,cAAc;gBACd,WAAW;gBACX,UAAU;gBACV,QAAQ;aACT,CAAC,EACF,CAAC;YACD,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,GAAG,GAAG,MAAiC,CAAC;QAC9C,IACE,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC;YAC3B,GAAG,CAAC,GAAG,KAAK,oDAAgC;YAC5C,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC;YACjC,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAChC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YACrD,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,CAAC;YACtD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;YACnB,CAAC,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAC5E,CAAC;YACD,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;QAClE,CAAC;QACD,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpB,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAoC;IAEpC,IACE,CAAC,SAAS,CAAC,OAA6C,EAAE;QACxD,YAAY;QACZ,aAAa;QACb,sBAAsB;QACtB,eAAe;QACf,aAAa;QACb,WAAW;KACZ,CAAC;QACF,CAAC,IAAA,+BAAc,EAAC,OAAO,CAAC,UAAU,CAAC;QACnC,CAAC,IAAA,+BAAc,EAAC,OAAO,CAAC,oBAAoB,CAAC;QAC7C,CAAC,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC;QACrC,CAAC,eAAe,CAAC,OAAO,CAAC,aAAa,CAAC;QACvC,CAAC,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC;QACvC,CAAC,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAChE,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,kCAAkC,CAChD,OAAoC,EACpC,KAAa;IAEb,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAA+B;QACzC,GAAG,EAAE,oDAAgC;QACrC,GAAG,EAAE,4CAAwB;QAC7B,GAAG,EAAE,KAAK;KACX,CAAC;IACF,MAAM,eAAe,GAAG,eAAe,CACrC,IAAA,oCAAmB,EAAC,MAA8B,CAAC,CACpD,CAAC;IACF,MAAM,cAAc,GAAG,eAAe,CACpC,IAAA,oCAAmB,EAAC,OAA+B,CAAC,CACrD,CAAC;IACF,OAAO;QACL,eAAe;QACf,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,eAAe,IAAI,cAAc,EAAE,EAAE,MAAM,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,0BAA0B,CACxC,KAAsC;IAEtC,4BAA4B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC5B,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACvB,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS;YACjC,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,cAAc,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAChD,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,qBAAqB;YAAE,MAAM,KAAK,CAAC;QACxD,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;IAClE,CAAC;IACD,IACE,MAAM,KAAK,IAAI;QACf,OAAO,MAAM,KAAK,QAAQ;QAC1B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACrB,CAAC,SAAS,CAAC,MAAiC,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,EACpE,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,eAAe,GAAG,MAAiC,CAAC;IAC1D,IACE,eAAe,CAAC,GAAG,KAAK,oDAAgC;QACxD,eAAe,CAAC,GAAG,KAAK,4CAAwB;QAChD,eAAe,CAAC,GAAG,KAAK,KAAK,CAAC,aAAa,EAC3C,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,OAAO,GAAG,kCAAkC,CAChD,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,aAAa,CACpB,CAAC;IACF,IAAI,OAAO,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;IAClE,CAAC;IAED,IACE,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC;QAC5C,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC;QAC7C,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAC5C,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC,gCAAgC,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAChC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,KAAK,KAAK,CAAC,aAAa,CACvD,CAAC;IACF,IACE,CAAC,GAAG;QACJ,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;QACjC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EACjC,CAAC;QACD,MAAM,IAAI,qBAAqB,CAAC,gCAAgC,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAA,6BAAe,EAAC;YAChC,GAAG,EAAE;gBACH,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG;gBACzB,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG;gBACzB,CAAC,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;aACI;YAC3B,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,KAAK,GAAG,IAAA,oBAAM,EACZ,IAAI,EACJ,OAAO,CAAC,YAAY,EACpB,SAAS,EACT,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAC9B,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,qBAAqB;YAAE,MAAM,KAAK,CAAC;QACxD,KAAK,GAAG,KAAK,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;AAC3D,CAAC"}

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/ai-authoring-context.types.d.ts

@@ -0,0 +1,232 @@
+/**
+ * AI authoring context pack contracts.
+ *
+ * Frozen by executable-asset design §17.1. The context pack is the
+ * machine-readable authoring surface Claude/Codex/GLM consume to discover,
+ * write, validate and test Code + Flow without chat-only instructions (R-15 /
+ * R-18). core/shared/runtime is the contract truth; industry overlay may only
+ * append examples/labels, never override ABI/schema/commands/permissions.
+ */
+import { AI_AUTHORING_CONTEXT_SCHEMA_VERSION, AI_AUTHORING_CONTEXT_LOCK_SCHEMA_VERSION, AI_CONTEXT_SIGNATURE_ALG_ED25519, AI_CONTEXT_SIGNATURE_ALG_NONE, AI_CONTEXT_SIGNATURE_TYP, AI_CONTEXT_SIGNING_KEY_SET_SCHEMA_VERSION, RUNTIME_API_VERSION_V2 } from './contract-versions';
+/** Exact online selector triad; config surface uses caller_preview. */
+export type AiContextPrincipalKind = 'caller_preview' | 'agent';
+/** Selectors — online code|flow|employee|all must provide exactly one of: */
+export type AiContextOnlineSelector = {
+    readonly kind: 'caller_preview';
+} | {
+    readonly kind: 'active_agent';
+    readonly agentApiName: string;
+} | {
+    readonly kind: 'candidate';
+    readonly candidateReleaseSetId: string;
+};
+export type AiContextSurface = 'config' | 'code' | 'flow' | 'employee' | 'all';
+/** SHA-256 digest, lowercase `sha256:<64 hex>`. */
+export type AiContextSha256 = `sha256:${string}`;
+/**
+ * Typed public request used by the GraphQL describe query. The resolver maps
+ * its closed input DTO to this shape; unknown properties never cross the
+ * GraphQL boundary.
+ */
+export interface DescribeAiAuthoringContextRequestV2 {
+    readonly schemaVersion: typeof AI_AUTHORING_CONTEXT_SCHEMA_VERSION;
+    readonly surface: AiContextSurface;
+    readonly targetWorkspaceId: string;
+    readonly selector: AiContextOnlineSelector;
+    readonly knownContractDigest?: AiContextSha256;
+    readonly knownWorkspaceContractHash?: AiContextSha256;
+}
+/** Exact candidate stamp recomputed from persisted release truth. */
+export interface AiAuthoringCandidateReleaseStampV1 {
+    readonly candidateReleaseSetId: string;
+    readonly agentApiName: string;
+    readonly eligibilityStatus: 'staged' | 'eligible' | 'rejected';
+    readonly sourceLockDigest: AiContextSha256;
+    readonly releaseItemSetDigest: AiContextSha256;
+    readonly materializedItemRefsDigest: AiContextSha256;
+    readonly releaseEnvelopeDigest: AiContextSha256 | null;
+    readonly previousReleaseSetId: string | null;
+    readonly headAtStage: {
+        readonly activeReleaseSetId: string | null;
+        readonly generation: number;
+    };
+}
+/**
+ * A catalog document is returned as canonical UTF-8 JSON in a typed envelope.
+ * This keeps the GraphQL surface free of GraphQLJSON while the JSON document
+ * itself remains governed by its versioned, additionalProperties:false
+ * schema included in the exported pack.
+ */
+export interface AiAuthoringCatalogDocumentV1 {
+    readonly schemaVersion: string;
+    readonly digest: AiContextSha256;
+    readonly canonicalJson: string;
+}
+export interface AiAuthoringContextHashesV1 {
+    readonly contractDigest: AiContextSha256;
+    readonly workspaceContractHash: AiContextSha256;
+    readonly principalScopeDigest: AiContextSha256;
+}
+export interface AiAuthoringContextSnapshotV2 extends AiAuthoringContextHashesV1 {
+    readonly schemaVersion: typeof AI_AUTHORING_CONTEXT_SCHEMA_VERSION;
+    readonly coreVersion: string;
+    readonly coreCommitSha: string;
+    readonly cliVersion: string;
+    readonly runtimeApiVersion: typeof RUNTIME_API_VERSION_V2;
+    readonly surface: AiContextSurface;
+    readonly targetWorkspaceId: string;
+    readonly principalKind: AiContextPrincipalKind;
+    readonly principalId: string;
+    readonly agentApiName: string | null;
+    readonly releaseSetId: string | null;
+    readonly releaseStamp: AiAuthoringCandidateReleaseStampV1 | null;
+    readonly generatedAt: string;
+    readonly expiresAt: string;
+    readonly objectCatalog: AiAuthoringCatalogDocumentV1;
+    readonly invokableCatalog: AiAuthoringCatalogDocumentV1;
+    readonly connectorCatalog: AiAuthoringCatalogDocumentV1;
+    readonly aiPolicyCatalog: AiAuthoringCatalogDocumentV1;
+    readonly approvalPolicyCatalog: AiAuthoringCatalogDocumentV1;
+}
+export interface VerifyAiAuthoringContextFreshnessRequestV2 extends DescribeAiAuthoringContextRequestV2, AiAuthoringContextHashesV1 {
+    readonly generatedAt: string;
+    readonly expiresAt: string;
+    readonly contentDigest: AiContextSha256;
+    readonly manifestContentDigest: AiContextSha256;
+    readonly manifestEnvelopeDigest: AiContextSha256;
+    readonly lockDigest: AiContextSha256;
+}
+/**
+ * Additive signing request. Describe/verify remain stable; an online client
+ * may request a signature only after it has computed the complete pack
+ * digests and explicitly supplied the authenticated org-alias claim.
+ */
+export interface SignAiAuthoringContextLockRequestV2 extends VerifyAiAuthoringContextFreshnessRequestV2 {
+    readonly orgAliasClaim: string;
+}
+export interface AiAuthoringContextVerificationV1 {
+    readonly valid: boolean;
+    readonly stale: boolean;
+    readonly reasons: readonly string[];
+    readonly currentHashes: AiAuthoringContextHashesV1;
+}
+/**
+ * Context manifest. `nexusclaw.ai-authoring-context/v2`. Online packs expire
+ * after 24 hours or when core/runtime/workspace contract hash changes.
+ */
+export interface AiAuthoringContextManifestV2 {
+    readonly schemaVersion: typeof AI_AUTHORING_CONTEXT_SCHEMA_VERSION;
+    readonly coreVersion: string;
+    readonly coreCommitSha: string;
+    readonly cliVersion: string;
+    readonly runtimeApiVersion: typeof RUNTIME_API_VERSION_V2;
+    readonly contractDigest: string;
+    readonly workspaceContractHash: string;
+    readonly surfaces: ReadonlyArray<Exclude<AiContextSurface, 'all'>>;
+    readonly mode: 'online' | 'offline';
+    readonly target?: {
+        readonly orgAlias: string;
+        readonly workspaceId: string;
+        readonly principalKind: AiContextPrincipalKind;
+        readonly principalId: string;
+        readonly agentApiName?: string;
+        readonly releaseSetId?: string;
+    };
+    readonly generatedAt: string;
+    readonly expiresAt?: string;
+    readonly files: ReadonlyArray<{
+        readonly path: string;
+        readonly digest: AiContextSha256;
+        readonly mediaType: string;
+    }>;
+}
+/**
+ * Context lock. `nexusclaw.ai-authoring-context-lock/v2`. Holds the four
+ * non-recursive digests plus the detached signature. Online signature is an
+ * Ed25519 detached JWS; offline uses `signatureAlgorithm:'none'` and is
+ * explicitly non-authoritative.
+ *
+ * Digest formulas (design §17.1, owned by `canonical-hash.ts`):
+ *   contentDigest          = SHA256(sorted <path> NUL <rawFileDigest> LF)
+ *   manifestContentDigest  = SHA256(RFC8785(manifest excluding generatedAt/expiresAt))
+ *   manifestEnvelopeDigest = SHA256(RFC8785({manifestContentDigest,generatedAt,expiresAt,target}))
+ *   lockDigest             = SHA256(RFC8785({contentDigest,manifestContentDigest,manifestEnvelopeDigest}))
+ */
+export interface AiAuthoringContextLockV2 {
+    readonly schemaVersion: typeof AI_AUTHORING_CONTEXT_LOCK_SCHEMA_VERSION;
+    readonly contentDigest: AiContextSha256;
+    readonly manifestContentDigest: AiContextSha256;
+    readonly manifestEnvelopeDigest: AiContextSha256;
+    readonly lockDigest: AiContextSha256;
+    readonly signatureAlgorithm: typeof AI_CONTEXT_SIGNATURE_ALG_ED25519 | typeof AI_CONTEXT_SIGNATURE_ALG_NONE;
+    readonly keyId?: string;
+    readonly signature: string;
+}
+export interface AiAuthoringContextDigestSetV1 {
+    readonly contentDigest: AiContextSha256;
+    readonly manifestContentDigest: AiContextSha256;
+    readonly manifestEnvelopeDigest: AiContextSha256;
+    readonly lockDigest: AiContextSha256;
+}
+/**
+ * Online signature JWS payload (Ed25519 detached). Typ/alg frozen.
+ */
+export interface AiContextSignatureHeaderV1 {
+    readonly alg: typeof AI_CONTEXT_SIGNATURE_ALG_ED25519;
+    readonly typ: typeof AI_CONTEXT_SIGNATURE_TYP;
+    readonly kid: string;
+}
+export interface AiContextSignaturePayloadV1 {
+    readonly lockDigest: AiContextSha256;
+    readonly workspaceId: string;
+    readonly principalScopeDigest: AiContextSha256;
+    readonly orgAliasClaim: string;
+    readonly generatedAt: string;
+    readonly expiresAt: string;
+}
+export interface AiContextSigningPublicJwkV1 {
+    readonly kty: 'OKP';
+    readonly crv: 'Ed25519';
+    readonly x: string;
+}
+export interface AiContextSigningKeySetV1 {
+    readonly schemaVersion: typeof AI_CONTEXT_SIGNING_KEY_SET_SCHEMA_VERSION;
+    readonly issuer: string;
+    readonly generatedAt: string;
+    readonly cacheUntil: string;
+    readonly keys: ReadonlyArray<{
+        readonly keyId: string;
+        readonly alg: typeof AI_CONTEXT_SIGNATURE_ALG_ED25519;
+        readonly publicKeyJwk: AiContextSigningPublicJwkV1;
+        readonly notBefore: string;
+        readonly notAfter: string;
+        readonly status: 'active' | 'retiring';
+    }>;
+}
+/** Common pack files — exact path/mediaType matrix lives in design §17.1. */
+export interface AiContextCommonFileEntry {
+    readonly path: string;
+    readonly mediaType: string;
+    readonly schemaVersion?: string;
+}
+/**
+ * Exact set of common files every pack must contain (R-15). Surface-specific
+ * additions are the closed matrix in design §17.1; `all` is the union, each
+ * path once, byte-identical when shared.
+ */
+export declare const AI_CONTEXT_COMMON_FILES: ReadonlyArray<AiContextCommonFileEntry>;
+/**
+ * Closed surface additions from design §17.1. No caller may append a path to
+ * this matrix; verified industry overlays are handled by the separate exact
+ * installed-digest overlay gate.
+ */
+export declare const AI_CONTEXT_SURFACE_FILES: Readonly<Record<Exclude<AiContextSurface, 'all'>, ReadonlyArray<AiContextCommonFileEntry>>>;
+/** Resolve common + selected additions, de-duplicated and lexical by path. */
+export declare function resolveAiContextFileMatrix(surface: AiContextSurface): ReadonlyArray<AiContextCommonFileEntry>;
+/** Manifest file rows exclude the two self-referential envelope documents. */
+export declare function resolveAiContextManifestFileMatrix(surface: AiContextSurface): ReadonlyArray<AiContextCommonFileEntry>;
+/**
+ * Enforce the closed core matrix. Industry overlay paths are intentionally
+ * rejected here and enter only through the installed-digest overlay gate.
+ */
+export declare function assertAiContextDeclaredPaths(surface: AiContextSurface, paths: readonly string[]): void;

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/ai-authoring-context.types.js

@@ -0,0 +1,160 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AI_CONTEXT_SURFACE_FILES = exports.AI_CONTEXT_COMMON_FILES = void 0;
+exports.resolveAiContextFileMatrix = resolveAiContextFileMatrix;
+exports.resolveAiContextManifestFileMatrix = resolveAiContextManifestFileMatrix;
+exports.assertAiContextDeclaredPaths = assertAiContextDeclaredPaths;
+/**
+ * AI authoring context pack contracts.
+ *
+ * Frozen by executable-asset design §17.1. The context pack is the
+ * machine-readable authoring surface Claude/Codex/GLM consume to discover,
+ * write, validate and test Code + Flow without chat-only instructions (R-15 /
+ * R-18). core/shared/runtime is the contract truth; industry overlay may only
+ * append examples/labels, never override ABI/schema/commands/permissions.
+ */
+const contract_versions_1 = require("./contract-versions");
+/**
+ * Exact set of common files every pack must contain (R-15). Surface-specific
+ * additions are the closed matrix in design §17.1; `all` is the union, each
+ * path once, byte-identical when shared.
+ */
+exports.AI_CONTEXT_COMMON_FILES = [
+    {
+        path: 'context-manifest.json',
+        mediaType: 'application/json',
+        schemaVersion: contract_versions_1.AI_AUTHORING_CONTEXT_SCHEMA_VERSION,
+    },
+    {
+        path: 'context-lock.json',
+        mediaType: 'application/json',
+        schemaVersion: contract_versions_1.AI_AUTHORING_CONTEXT_LOCK_SCHEMA_VERSION,
+    },
+    {
+        path: 'cli-contract.json',
+        mediaType: 'application/json',
+        schemaVersion: contract_versions_1.CLI_COMMAND_REGISTRY_SCHEMA_VERSION,
+    },
+    {
+        path: 'workspace-contract.json',
+        mediaType: 'application/json',
+        schemaVersion: contract_versions_1.WORKSPACE_AUTHORING_CONTRACT_SCHEMA_VERSION,
+    },
+    {
+        path: 'authoring/command-order.json',
+        mediaType: 'application/json',
+        schemaVersion: contract_versions_1.COMMAND_ORDER_SCHEMA_VERSION,
+    },
+    { path: 'agent-instructions/codex.md', mediaType: 'text/markdown; charset=utf-8' },
+    { path: 'agent-instructions/claude.md', mediaType: 'text/markdown; charset=utf-8' },
+    { path: 'agent-instructions/glm-5.2.md', mediaType: 'text/markdown; charset=utf-8' },
+    { path: 'agent-instructions/generic.md', mediaType: 'text/markdown; charset=utf-8' },
+];
+const JSON_SCHEMA_MEDIA_TYPE = 'application/schema+json';
+const JSON_MEDIA_TYPE = 'application/json';
+const TYPESCRIPT_MEDIA_TYPE = 'text/typescript; charset=utf-8';
+/**
+ * Closed surface additions from design §17.1. No caller may append a path to
+ * this matrix; verified industry overlays are handled by the separate exact
+ * installed-digest overlay gate.
+ */
+exports.AI_CONTEXT_SURFACE_FILES = Object.freeze({
+    config: Object.freeze([
+        entry('schemas/workspace-authoring-contract-v1.schema.json', JSON_SCHEMA_MEDIA_TYPE, contract_versions_1.WORKSPACE_AUTHORING_CONTRACT_SCHEMA_VERSION),
+        entry('schemas/object-authoring-catalog-v1.schema.json', JSON_SCHEMA_MEDIA_TYPE, contract_versions_1.OBJECT_AUTHORING_CATALOG_SCHEMA_VERSION),
+        entry('catalogs/objects.json', JSON_MEDIA_TYPE, contract_versions_1.OBJECT_AUTHORING_CATALOG_SCHEMA_VERSION),
+    ]),
+    code: Object.freeze([
+        entry('schemas/code-extension-governance-v2.schema.json', JSON_SCHEMA_MEDIA_TYPE, contract_versions_1.CODE_EXTENSION_GOVERNANCE_V2),
+        entry('schemas/agent-code-tool-catalog-v1.schema.json', JSON_SCHEMA_MEDIA_TYPE, contract_versions_1.AGENT_CODE_TOOL_CATALOG_SCHEMA_VERSION),
+        entry('schemas/code-action-cases-v1.schema.json', JSON_SCHEMA_MEDIA_TYPE, contract_versions_1.CODE_ACTION_CASES_SCHEMA_VERSION),
+        entry('schemas/workforce-runtime-bindings-v1.schema.json', JSON_SCHEMA_MEDIA_TYPE, contract_versions_1.RUNTIME_BINDINGS_SCHEMA_VERSION),
+        entry('schemas/approval-policy-authoring-catalog-v1.schema.json', JSON_SCHEMA_MEDIA_TYPE, contract_versions_1.APPROVAL_POLICY_AUTHORING_CATALOG_SCHEMA_VERSION),
+        entry('authoring/code-sdk.d.ts', TYPESCRIPT_MEDIA_TYPE, contract_versions_1.RUNTIME_API_VERSION_V2),
+        entry('catalogs/objects.json', JSON_MEDIA_TYPE, contract_versions_1.OBJECT_AUTHORING_CATALOG_SCHEMA_VERSION),
+        entry('catalogs/connectors.json', JSON_MEDIA_TYPE, contract_versions_1.CONNECTOR_AUTHORING_CATALOG_SCHEMA_VERSION),
+        entry('catalogs/ai-policies.json', JSON_MEDIA_TYPE, contract_versions_1.AI_POLICY_AUTHORING_CATALOG_SCHEMA_VERSION),
+        entry('catalogs/approval-policies.json', JSON_MEDIA_TYPE, contract_versions_1.APPROVAL_POLICY_AUTHORING_CATALOG_SCHEMA_VERSION),
+        entry('catalogs/invokable-units.json', JSON_MEDIA_TYPE, contract_versions_1.INVOKABLE_AUTHORING_CATALOG_SCHEMA_VERSION),
+        entry('examples/code/minimal-action.ts', TYPESCRIPT_MEDIA_TYPE),
+        entry('examples/code/minimal-action.input.schema.json', JSON_SCHEMA_MEDIA_TYPE),
+        entry('examples/code/minimal-action.output.schema.json', JSON_SCHEMA_MEDIA_TYPE),
+        entry('examples/code/minimal-action.cases.json', JSON_MEDIA_TYPE, contract_versions_1.CODE_ACTION_CASES_SCHEMA_VERSION),
+    ]),
+    flow: Object.freeze([
+        entry('schemas/flows-payload-v2.schema.json', JSON_SCHEMA_MEDIA_TYPE, contract_versions_1.FLOWS_PAYLOAD_V2),
+        entry('schemas/flow-package-v1.schema.json', JSON_SCHEMA_MEDIA_TYPE, contract_versions_1.FLOW_PACKAGE_SCHEMA_VERSION),
+        entry('schemas/approval-policy-authoring-catalog-v1.schema.json', JSON_SCHEMA_MEDIA_TYPE, contract_versions_1.APPROVAL_POLICY_AUTHORING_CATALOG_SCHEMA_VERSION),
+        entry('authoring/flow-node-catalog.json', JSON_MEDIA_TYPE, contract_versions_1.FLOW_NODE_CATALOG_SCHEMA_VERSION),
+        entry('catalogs/objects.json', JSON_MEDIA_TYPE, contract_versions_1.OBJECT_AUTHORING_CATALOG_SCHEMA_VERSION),
+        entry('catalogs/approval-policies.json', JSON_MEDIA_TYPE, contract_versions_1.APPROVAL_POLICY_AUTHORING_CATALOG_SCHEMA_VERSION),
+        entry('catalogs/invokable-units.json', JSON_MEDIA_TYPE, contract_versions_1.INVOKABLE_AUTHORING_CATALOG_SCHEMA_VERSION),
+        entry('examples/flow/minimal-manual-flow.json', JSON_MEDIA_TYPE, contract_versions_1.FLOWS_PAYLOAD_V2),
+    ]),
+    employee: Object.freeze([
+        entry('schemas/employee-package-v2.schema.json', JSON_SCHEMA_MEDIA_TYPE, contract_versions_1.EMPLOYEE_PACKAGE_V2_SCHEMA_VERSION),
+        entry('schemas/ai-workforce-executable-bundle-v1.schema.json', JSON_SCHEMA_MEDIA_TYPE, contract_versions_1.BUNDLE_SCHEMA_VERSION),
+        entry('schemas/workforce-runtime-bindings-v1.schema.json', JSON_SCHEMA_MEDIA_TYPE, contract_versions_1.RUNTIME_BINDINGS_SCHEMA_VERSION),
+        entry('schemas/workforce-bundle-lock-v1.schema.json', JSON_SCHEMA_MEDIA_TYPE, contract_versions_1.BUNDLE_LOCK_SCHEMA_VERSION),
+        entry('schemas/workforce-release-evidence-v1.schema.json', JSON_SCHEMA_MEDIA_TYPE, contract_versions_1.WORKFORCE_RELEASE_EVIDENCE_SCHEMA_VERSION),
+        entry('schemas/approval-policy-authoring-catalog-v1.schema.json', JSON_SCHEMA_MEDIA_TYPE, contract_versions_1.APPROVAL_POLICY_AUTHORING_CATALOG_SCHEMA_VERSION),
+        entry('catalogs/objects.json', JSON_MEDIA_TYPE, contract_versions_1.OBJECT_AUTHORING_CATALOG_SCHEMA_VERSION),
+        entry('catalogs/connectors.json', JSON_MEDIA_TYPE, contract_versions_1.CONNECTOR_AUTHORING_CATALOG_SCHEMA_VERSION),
+        entry('catalogs/ai-policies.json', JSON_MEDIA_TYPE, contract_versions_1.AI_POLICY_AUTHORING_CATALOG_SCHEMA_VERSION),
+        entry('catalogs/approval-policies.json', JSON_MEDIA_TYPE, contract_versions_1.APPROVAL_POLICY_AUTHORING_CATALOG_SCHEMA_VERSION),
+        entry('catalogs/invokable-units.json', JSON_MEDIA_TYPE, contract_versions_1.INVOKABLE_AUTHORING_CATALOG_SCHEMA_VERSION),
+    ]),
+});
+/** Resolve common + selected additions, de-duplicated and lexical by path. */
+function resolveAiContextFileMatrix(surface) {
+    const selected = surface === 'all'
+        ? ['config', 'code', 'flow', 'employee']
+        : [surface];
+    const byPath = new Map();
+    for (const candidate of [
+        ...exports.AI_CONTEXT_COMMON_FILES,
+        ...selected.flatMap((key) => exports.AI_CONTEXT_SURFACE_FILES[key]),
+    ]) {
+        const existing = byPath.get(candidate.path);
+        if (existing &&
+            (existing.mediaType !== candidate.mediaType ||
+                existing.schemaVersion !== candidate.schemaVersion)) {
+            throw new Error(`AI_CONTEXT_FILE_MATRIX_COLLISION:${candidate.path}`);
+        }
+        byPath.set(candidate.path, Object.freeze({ ...candidate }));
+    }
+    return Object.freeze([...byPath.values()].sort((left, right) => left.path.localeCompare(right.path)));
+}
+/** Manifest file rows exclude the two self-referential envelope documents. */
+function resolveAiContextManifestFileMatrix(surface) {
+    return Object.freeze(resolveAiContextFileMatrix(surface).filter(({ path }) => path !== 'context-manifest.json' &&
+        path !== 'context-lock.json'));
+}
+/**
+ * Enforce the closed core matrix. Industry overlay paths are intentionally
+ * rejected here and enter only through the installed-digest overlay gate.
+ */
+function assertAiContextDeclaredPaths(surface, paths) {
+    const expected = resolveAiContextFileMatrix(surface).map(({ path }) => path);
+    const actual = [...paths].sort();
+    const duplicates = actual.filter((path, index) => index > 0 && path === actual[index - 1]);
+    if (duplicates.length > 0 ||
+        actual.length !== expected.length ||
+        actual.some((path, index) => path !== expected[index])) {
+        const unexpected = actual.filter((path) => !expected.includes(path));
+        const missing = expected.filter((path) => !actual.includes(path));
+        throw new Error(`AI_CONTEXT_FILE_MATRIX_INVALID:${JSON.stringify({
+            duplicates: [...new Set(duplicates)],
+            missing,
+            unexpected,
+        })}`);
+    }
+}
+function entry(path, mediaType, schemaVersion) {
+    return Object.freeze({
+        path,
+        mediaType,
+        ...(schemaVersion ? { schemaVersion } : {}),
+    });
+}
+//# sourceMappingURL=ai-authoring-context.types.js.map

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/ai-authoring-context.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-authoring-context.types.js","sourceRoot":"","sources":["../../src/agent-executable-assets/ai-authoring-context.types.ts"],"names":[],"mappings":";;;AAwWA,gEA2BC;AAGD,gFAUC;AAMD,oEAwBC;AA9aD;;;;;;;;GAQG;AACH,2DA2B6B;AAmO7B;;;;GAIG;AACU,QAAA,uBAAuB,GAA4C;IAC9E;QACE,IAAI,EAAE,uBAAuB;QAC7B,SAAS,EAAE,kBAAkB;QAC7B,aAAa,EAAE,uDAAmC;KACnD;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,SAAS,EAAE,kBAAkB;QAC7B,aAAa,EAAE,4DAAwC;KACxD;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,SAAS,EAAE,kBAAkB;QAC7B,aAAa,EAAE,uDAAmC;KACnD;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,SAAS,EAAE,kBAAkB;QAC7B,aAAa,EAAE,+DAA2C;KAC3D;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,SAAS,EAAE,kBAAkB;QAC7B,aAAa,EAAE,gDAA4B;KAC5C;IACD,EAAE,IAAI,EAAE,6BAA6B,EAAE,SAAS,EAAE,8BAA8B,EAAE;IAClF,EAAE,IAAI,EAAE,8BAA8B,EAAE,SAAS,EAAE,8BAA8B,EAAE;IACnF,EAAE,IAAI,EAAE,+BAA+B,EAAE,SAAS,EAAE,8BAA8B,EAAE;IACpF,EAAE,IAAI,EAAE,+BAA+B,EAAE,SAAS,EAAE,8BAA8B,EAAE;CACrF,CAAC;AAEF,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AACzD,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAC3C,MAAM,qBAAqB,GAAG,gCAAgC,CAAC;AAE/D;;;;GAIG;AACU,QAAA,wBAAwB,GAEjC,MAAM,CAAC,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,KAAK,CAAC,qDAAqD,EAAE,sBAAsB,EAAE,+DAA2C,CAAC;QACjI,KAAK,CAAC,iDAAiD,EAAE,sBAAsB,EAAE,2DAAuC,CAAC;QACzH,KAAK,CAAC,uBAAuB,EAAE,eAAe,EAAE,2DAAuC,CAAC;KACzF,CAAC;IACF,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QAClB,KAAK,CAAC,kDAAkD,EAAE,sBAAsB,EAAE,gDAA4B,CAAC;QAC/G,KAAK,CAAC,gDAAgD,EAAE,sBAAsB,EAAE,0DAAsC,CAAC;QACvH,KAAK,CAAC,0CAA0C,EAAE,sBAAsB,EAAE,oDAAgC,CAAC;QAC3G,KAAK,CAAC,mDAAmD,EAAE,sBAAsB,EAAE,mDAA+B,CAAC;QACnH,KAAK,CAAC,0DAA0D,EAAE,sBAAsB,EAAE,oEAAgD,CAAC;QAC3I,KAAK,CAAC,yBAAyB,EAAE,qBAAqB,EAAE,0CAAsB,CAAC;QAC/E,KAAK,CAAC,uBAAuB,EAAE,eAAe,EAAE,2DAAuC,CAAC;QACxF,KAAK,CAAC,0BAA0B,EAAE,eAAe,EAAE,8DAA0C,CAAC;QAC9F,KAAK,CAAC,2BAA2B,EAAE,eAAe,EAAE,8DAA0C,CAAC;QAC/F,KAAK,CAAC,iCAAiC,EAAE,eAAe,EAAE,oEAAgD,CAAC;QAC3G,KAAK,CAAC,+BAA+B,EAAE,eAAe,EAAE,8DAA0C,CAAC;QACnG,KAAK,CAAC,iCAAiC,EAAE,qBAAqB,CAAC;QAC/D,KAAK,CAAC,gDAAgD,EAAE,sBAAsB,CAAC;QAC/E,KAAK,CAAC,iDAAiD,EAAE,sBAAsB,CAAC;QAChF,KAAK,CAAC,yCAAyC,EAAE,eAAe,EAAE,oDAAgC,CAAC;KACpG,CAAC;IACF,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QAClB,KAAK,CAAC,sCAAsC,EAAE,sBAAsB,EAAE,oCAAgB,CAAC;QACvF,KAAK,CAAC,qCAAqC,EAAE,sBAAsB,EAAE,+CAA2B,CAAC;QACjG,KAAK,CAAC,0DAA0D,EAAE,sBAAsB,EAAE,oEAAgD,CAAC;QAC3I,KAAK,CAAC,kCAAkC,EAAE,eAAe,EAAE,oDAAgC,CAAC;QAC5F,KAAK,CAAC,uBAAuB,EAAE,eAAe,EAAE,2DAAuC,CAAC;QACxF,KAAK,CAAC,iCAAiC,EAAE,eAAe,EAAE,oEAAgD,CAAC;QAC3G,KAAK,CAAC,+BAA+B,EAAE,eAAe,EAAE,8DAA0C,CAAC;QACnG,KAAK,CAAC,wCAAwC,EAAE,eAAe,EAAE,oCAAgB,CAAC;KACnF,CAAC;IACF,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;QACtB,KAAK,CAAC,yCAAyC,EAAE,sBAAsB,EAAE,sDAAkC,CAAC;QAC5G,KAAK,CAAC,uDAAuD,EAAE,sBAAsB,EAAE,yCAAqB,CAAC;QAC7G,KAAK,CAAC,mDAAmD,EAAE,sBAAsB,EAAE,mDAA+B,CAAC;QACnH,KAAK,CAAC,8CAA8C,EAAE,sBAAsB,EAAE,8CAA0B,CAAC;QACzG,KAAK,CAAC,mDAAmD,EAAE,sBAAsB,EAAE,6DAAyC,CAAC;QAC7H,KAAK,CAAC,0DAA0D,EAAE,sBAAsB,EAAE,oEAAgD,CAAC;QAC3I,KAAK,CAAC,uBAAuB,EAAE,eAAe,EAAE,2DAAuC,CAAC;QACxF,KAAK,CAAC,0BAA0B,EAAE,eAAe,EAAE,8DAA0C,CAAC;QAC9F,KAAK,CAAC,2BAA2B,EAAE,eAAe,EAAE,8DAA0C,CAAC;QAC/F,KAAK,CAAC,iCAAiC,EAAE,eAAe,EAAE,oEAAgD,CAAC;QAC3G,KAAK,CAAC,+BAA+B,EAAE,eAAe,EAAE,8DAA0C,CAAC;KACpG,CAAC;CACH,CAAC,CAAC;AAEH,8EAA8E;AAC9E,SAAgB,0BAA0B,CACxC,OAAyB;IAEzB,MAAM,QAAQ,GACZ,OAAO,KAAK,KAAK;QACf,CAAC,CAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAW;QACnD,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAChB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC3D,KAAK,MAAM,SAAS,IAAI;QACtB,GAAG,+BAAuB;QAC1B,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gCAAwB,CAAC,GAAG,CAAC,CAAC;KAC5D,EAAE,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5C,IACE,QAAQ;YACR,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,CAAC,SAAS;gBACzC,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,aAAa,CAAC,EACrD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACxC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CACpC,CACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAgB,kCAAkC,CAChD,OAAyB;IAEzB,OAAO,MAAM,CAAC,MAAM,CAClB,0BAA0B,CAAC,OAAO,CAAC,CAAC,MAAM,CACxC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CACX,IAAI,KAAK,uBAAuB;QAChC,IAAI,KAAK,mBAAmB,CAC/B,CACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,4BAA4B,CAC1C,OAAyB,EACzB,KAAwB;IAExB,MAAM,QAAQ,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAC9B,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,IAAI,KAAK,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CACzD,CAAC;IACF,IACE,UAAU,CAAC,MAAM,GAAG,CAAC;QACrB,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QACjC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,EACtD,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,kCAAkC,IAAI,CAAC,SAAS,CAAC;YAC/C,UAAU,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;YACpC,OAAO;YACP,UAAU;SACX,CAAC,EAAE,CACL,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CACZ,IAAY,EACZ,SAAiB,EACjB,aAAsB;IAEtB,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI;QACJ,SAAS;QACT,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,CAAC,CAAC;AACL,CAAC"}