@omniaseo/cli 0.1.0

package/node_modules/@omnia/omnia-connect-contracts/src/utils/deep-freeze.ts

@@ -0,0 +1,15 @@
+export function deepFreeze<T>(value: T, seen = new WeakSet<object>()): T {
+  if ((typeof value !== 'object' && typeof value !== 'function') || value === null) {
+    return value;
+  }
+
+  const object = value as object;
+  if (seen.has(object)) return value;
+  seen.add(object);
+
+  for (const key of Reflect.ownKeys(object)) {
+    deepFreeze((object as Record<PropertyKey, unknown>)[key], seen);
+  }
+
+  return Object.freeze(value) as T;
+}

package/node_modules/@omnia/omnia-connect-contracts/src/validation.ts

@@ -0,0 +1,253 @@
+import type { TSchema } from '@sinclair/typebox';
+import { TypeCompiler } from '@sinclair/typebox/compiler';
+import { TypeGuard } from '@sinclair/typebox/type';
+import { Value } from '@sinclair/typebox/value';
+import { ACTION_DEFINITIONS, ENABLED_ACTION_SLUGS } from './actions/catalog';
+import { ActionDefinitionSchema, type ActionDefinition } from './actions/types';
+import { APP_DEFINITIONS, AppDefinitionSchema, type AppDefinition } from './apps/catalog';
+import { BLUEPRINT_DEFINITIONS, BlueprintDefinitionSchema, type BlueprintDefinition } from './blueprints/catalog';
+import { EFFECT_DEFINITIONS, EffectDefinitionSchema, type EffectDefinition } from './effects';
+import { RESOURCE_DEFINITIONS, ResourceDefinitionSchema, type ResourceDefinition } from './resources/catalog';
+import { RECIPE_DEFINITIONS, RecipeDefinitionSchema, type RecipeDefinition } from './recipes/catalog';
+import { PROMPT_DEFINITIONS, PromptDefinitionSchema, type PromptDefinition } from './prompts/catalog';
+import { deepFreeze } from './utils/deep-freeze';
+
+export const LEGACY_PUBLIC_TOKENS = deepFreeze([
+  '/api/agents',
+  '/api/runs',
+  '/api/approvals',
+  'agents-executor',
+  'browser agents',
+] as const);
+
+export type ValidationResult = {
+  valid: boolean;
+  errors: readonly string[];
+};
+
+export type ContractSet = {
+  actions: readonly ActionDefinition[];
+  effects: readonly EffectDefinition[];
+  resources: readonly ResourceDefinition[];
+  apps: readonly AppDefinition[];
+  recipes: readonly RecipeDefinition[];
+  blueprints: readonly BlueprintDefinition[];
+  prompts: readonly PromptDefinition[];
+};
+
+function runtimeErrors(schema: Parameters<typeof Value.Errors>[0], value: unknown): string[] {
+  return [...Value.Errors(schema, value)].map(
+    (error) => `${error.path || '/'} ${error.message}`,
+  );
+}
+
+function isStrictObjectSchema(schema: unknown): boolean {
+  if (!schema || typeof schema !== 'object') return false;
+  const candidate = schema as {
+    type?: unknown;
+    additionalProperties?: unknown;
+    anyOf?: unknown;
+  };
+  if (candidate.type === 'object' && candidate.additionalProperties === false) return true;
+  return Array.isArray(candidate.anyOf) && candidate.anyOf.length > 0
+    && candidate.anyOf.every(branch => isStrictObjectSchema(branch));
+}
+
+function schemaContractErrors(schema: unknown, path: string): string[] {
+  const errors: string[] = [];
+  if (!TypeGuard.IsSchema(schema)) {
+    return [`${path}: malformed or unsupported JSON schema`];
+  }
+
+  try {
+    TypeCompiler.Compile(schema as TSchema);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    errors.push(`${path}: JSON schema does not compile: ${message}`);
+  }
+
+  const seen = new WeakSet<object>();
+  function visit(value: unknown, currentPath: string): void {
+    if (!value || typeof value !== 'object') return;
+    if (seen.has(value)) return;
+    seen.add(value);
+    const candidate = value as Record<string, unknown>;
+    if (candidate.type === 'object' && candidate.additionalProperties !== false) {
+      errors.push(`${currentPath}: every object schema must set additionalProperties=false`);
+    }
+    for (const [key, child] of Object.entries(candidate)) {
+      visit(child, `${currentPath}/${key}`);
+    }
+  }
+  visit(schema, path);
+  return errors;
+}
+
+export function validateContracts(overrides: Partial<ContractSet> = {}): ValidationResult {
+  const actions = overrides.actions ?? ACTION_DEFINITIONS;
+  const effects = overrides.effects ?? EFFECT_DEFINITIONS;
+  const resources = overrides.resources ?? RESOURCE_DEFINITIONS;
+  const apps = overrides.apps ?? APP_DEFINITIONS;
+  const recipes = overrides.recipes ?? RECIPE_DEFINITIONS;
+  const blueprints = overrides.blueprints ?? BLUEPRINT_DEFINITIONS;
+  const prompts = overrides.prompts ?? PROMPT_DEFINITIONS;
+  const errors: string[] = [];
+  const effectSlugs = new Set<string>();
+  const effectBySlug = new Map<string, EffectDefinition>();
+  for (const definition of effects) {
+    errors.push(...runtimeErrors(EffectDefinitionSchema, definition).map((error) => `effect ${definition.slug}: ${error}`));
+    if (effectSlugs.has(definition.slug)) errors.push(`duplicate effect slug: ${definition.slug}`);
+    effectSlugs.add(definition.slug);
+    effectBySlug.set(definition.slug, definition);
+  }
+
+  const actionSlugs = new Set<string>();
+  const enabledSlugs = new Set(ENABLED_ACTION_SLUGS);
+  for (const action of actions) {
+    errors.push(...runtimeErrors(ActionDefinitionSchema, action).map((error) => `action ${action.slug}: ${error}`));
+    if (actionSlugs.has(action.slug)) errors.push(`duplicate action slug: ${action.slug}`);
+    actionSlugs.add(action.slug);
+
+    if (!isStrictObjectSchema(action.inputSchema)) {
+      errors.push(`${action.slug}: input schema must be a strict object`);
+    }
+    if (!isStrictObjectSchema(action.outputSchema)) {
+      errors.push(`${action.slug}: output schema must be a strict object`);
+    }
+    errors.push(...schemaContractErrors(action.inputSchema, `${action.slug}: inputSchema`));
+    errors.push(...schemaContractErrors(action.outputSchema, `${action.slug}: outputSchema`));
+    for (const effect of [...action.effects, ...(action.transitiveEffects ?? [])]) {
+      if (!effectBySlug.has(effect)) errors.push(`${action.slug}: unknown effect ${effect}`);
+    }
+
+    const directEffects = action.effects
+      .map((effect) => effectBySlug.get(effect))
+      .filter((effect): effect is EffectDefinition => effect !== undefined);
+    const write = directEffects.some((effect) => effect.category !== 'read');
+    const expectedIdempotentHint = !write
+      || action.idempotencyMode === 'native'
+      || action.idempotencyMode === 'dedupe';
+    if (action.mcpAnnotations.readOnlyHint !== !write) {
+      errors.push(`${action.slug}: readOnlyHint disagrees with effect taxonomy`);
+    }
+    if (action.mcpAnnotations.destructiveHint !== action.destructive) {
+      errors.push(`${action.slug}: destructiveHint disagrees with destructive metadata`);
+    }
+    if (action.mcpAnnotations.openWorldHint !== action.externalEffect) {
+      errors.push(`${action.slug}: openWorldHint disagrees with external-effect metadata`);
+    }
+    if (action.mcpAnnotations.idempotentHint !== expectedIdempotentHint) {
+      errors.push(`${action.slug}: idempotentHint disagrees with idempotency semantics`);
+    }
+    if (write) {
+      if (action.effects.length === 0) errors.push(`${action.slug}: write has no declared effect`);
+      if (action.dataClassification.length === 0) errors.push(`${action.slug}: write has no data classification`);
+      if (!action.egressPolicy) errors.push(`${action.slug}: write has no egress policy`);
+      if (!action.idempotencyMode) errors.push(`${action.slug}: write has no idempotency mode`);
+      if (action.enabled) {
+        const properties = (action.inputSchema as { properties?: Record<string, unknown> }).properties;
+        if (!properties?.idempotencyKey) {
+          errors.push(`${action.slug}: enabled write input must require idempotencyKey`);
+        }
+        const required = (action.inputSchema as { required?: string[] }).required ?? [];
+        if (!required.includes('idempotencyKey')) {
+          errors.push(`${action.slug}: idempotencyKey must be required`);
+        }
+      }
+    }
+
+    const directDestructive = directEffects.some((effect) => effect.destructive);
+    const directExternal = directEffects.some((effect) => effect.external);
+    if (action.destructive !== directDestructive) {
+      errors.push(`${action.slug}: destructive metadata disagrees with effect taxonomy`);
+    }
+    if (directExternal && !action.externalEffect) {
+      errors.push(`${action.slug}: externalEffect omits a direct external effect`);
+    }
+    if (action.enabled !== enabledSlugs.has(action.slug)) {
+      errors.push(`${action.slug}: enabled state differs from the reference slice`);
+    }
+    if (!action.enabled && action.approvalPolicyDefault !== 'blocked') {
+      errors.push(`${action.slug}: disabled action must default to blocked`);
+    }
+    if (action.enabled && (action.inputSchema.$id === 'DisabledActionInput' || action.outputSchema.$id === 'DisabledActionOutput')) {
+      errors.push(`${action.slug}: enabled action uses a disabled placeholder schema`);
+    }
+  }
+
+  for (const resource of resources) {
+    errors.push(...runtimeErrors(ResourceDefinitionSchema, resource).map((error) => `resource ${resource.uriTemplate}: ${error}`));
+  }
+  for (const app of apps) {
+    errors.push(...runtimeErrors(AppDefinitionSchema, app).map((error) => `app ${app.slug}: ${error}`));
+  }
+
+  const recipeSlugs = new Set<string>();
+  for (const recipe of recipes) {
+    errors.push(...runtimeErrors(RecipeDefinitionSchema, recipe).map((error) => `recipe ${recipe.slug}: ${error}`));
+    if (recipeSlugs.has(recipe.slug)) errors.push(`duplicate recipe slug: ${recipe.slug}`);
+    recipeSlugs.add(recipe.slug);
+    errors.push(...schemaContractErrors(recipe.outputSchema, `recipe ${recipe.slug}: outputSchema`));
+    if (!isStrictObjectSchema(recipe.outputSchema)) {
+      errors.push(`recipe ${recipe.slug}: output schema must be a strict object`);
+    }
+    const requiredActionDefinitions = recipe.requiredActions
+      .map(slug => actions.find(action => action.slug === slug));
+    if (requiredActionDefinitions.some(action => !action)) errors.push(`recipe ${recipe.slug}: unknown required action`);
+    const expectedEffects = [...new Set(requiredActionDefinitions.flatMap(action => action
+      ? [...action.effects, ...(action.transitiveEffects ?? [])] : []))].sort();
+    if (JSON.stringify([...recipe.effects].sort()) !== JSON.stringify(expectedEffects)) {
+      errors.push(`recipe ${recipe.slug}: effect union differs from required actions`);
+    }
+    if (recipe.releaseClass === 'required_core'
+      && requiredActionDefinitions.some(action => !action?.enabled)) {
+      errors.push(`recipe ${recipe.slug}: required core recipe references a disabled action`);
+    }
+  }
+  if (recipes.length !== 10) errors.push('recipe catalog must contain exactly ten definitions');
+
+  const blueprintSlugs = new Set<string>();
+  for (const blueprint of blueprints) {
+    errors.push(...runtimeErrors(BlueprintDefinitionSchema, blueprint).map((error) => `blueprint ${blueprint.slug}: ${error}`));
+    if (blueprintSlugs.has(blueprint.slug)) errors.push(`duplicate blueprint slug: ${blueprint.slug}`);
+    blueprintSlugs.add(blueprint.slug);
+    const included = blueprint.recipes.map(slug => recipes.find(recipe => recipe.slug === slug));
+    if (included.some(recipe => !recipe)) errors.push(`blueprint ${blueprint.slug}: unknown recipe`);
+    const expectedEffects = [...new Set(included.flatMap(recipe => recipe ? recipe.effects : []))].sort();
+    if (JSON.stringify([...blueprint.effects].sort()) !== JSON.stringify(expectedEffects)) {
+      errors.push(`blueprint ${blueprint.slug}: effect union differs from recipes`);
+    }
+  }
+  if (blueprints.length !== 5) errors.push('blueprint catalog must contain exactly five definitions');
+
+  const promptNames = new Set<string>();
+  for (const prompt of prompts) {
+    errors.push(...runtimeErrors(PromptDefinitionSchema, prompt).map((error) => `prompt ${prompt.name}: ${error}`));
+    if (promptNames.has(prompt.name)) errors.push(`duplicate prompt name: ${prompt.name}`);
+    promptNames.add(prompt.name);
+    const argumentNames = new Set(prompt.arguments.map(argument => argument.name));
+    const placeholders = [...prompt.template.matchAll(/\{\{([a-z][a-z0-9_]*)\}\}/g)]
+      .flatMap(match => match[1] ? [match[1]] : []);
+    for (const placeholder of placeholders) {
+      if (!argumentNames.has(placeholder)) errors.push(`prompt ${prompt.name}: undeclared placeholder ${placeholder}`);
+    }
+    for (const required of ['untrusted data', 'never request', 'narrowest action', 'missing scope', 'approvals', 'links', 'opaque ids']) {
+      if (!prompt.template.toLowerCase().includes(required)) errors.push(`prompt ${prompt.name}: missing safety guidance ${required}`);
+    }
+  }
+  if (prompts.length !== 12) errors.push('prompt catalog must contain exactly twelve definitions');
+
+  const serialized = JSON.stringify({ actions, effects, resources, apps, recipes, blueprints, prompts }).toLowerCase();
+  for (const token of LEGACY_PUBLIC_TOKENS) {
+    if (serialized.includes(token)) errors.push(`legacy public token is forbidden: ${token}`);
+  }
+
+  return { valid: errors.length === 0, errors };
+}
+
+export function assertValidContracts(): void {
+  const result = validateContracts();
+  if (!result.valid) {
+    throw new Error(`Invalid Omnia Connect contracts:\n${result.errors.map((error) => `- ${error}`).join('\n')}`);
+  }
+}

package/node_modules/@sinclair/typebox/build/cjs/compiler/compiler.d.ts

@@ -0,0 +1,55 @@
+import { ValueErrorIterator } from '../errors/index';
+import { TypeBoxError } from '../type/error/index';
+import type { TSchema } from '../type/schema/index';
+import type { Static, StaticDecode, StaticEncode } from '../type/static/index';
+export type CheckFunction = (value: unknown) => boolean;
+export declare class TypeCheck<T extends TSchema> {
+    private readonly schema;
+    private readonly references;
+    private readonly checkFunc;
+    private readonly code;
+    private readonly hasTransform;
+    constructor(schema: T, references: TSchema[], checkFunc: CheckFunction, code: string);
+    /** Returns the generated assertion code used to validate this type. */
+    Code(): string;
+    /** Returns the schema type used to validate */
+    Schema(): T;
+    /** Returns reference types used to validate */
+    References(): TSchema[];
+    /** Returns an iterator for each error in this value. */
+    Errors(value: unknown): ValueErrorIterator;
+    /** Returns true if the value matches the compiled type. */
+    Check(value: unknown): value is Static<T>;
+    /** Decodes a value or throws if error */
+    Decode<Static = StaticDecode<T>, Result extends Static = Static>(value: unknown): Result;
+    /** Encodes a value or throws if error */
+    Encode<Static = StaticEncode<T>, Result extends Static = Static>(value: unknown): Result;
+}
+export declare class TypeCompilerUnknownTypeError extends TypeBoxError {
+    readonly schema: TSchema;
+    constructor(schema: TSchema);
+}
+export declare class TypeCompilerTypeGuardError extends TypeBoxError {
+    readonly schema: TSchema;
+    constructor(schema: TSchema);
+}
+export declare namespace Policy {
+    function IsExactOptionalProperty(value: string, key: string, expression: string): string;
+    function IsObjectLike(value: string): string;
+    function IsRecordLike(value: string): string;
+    function IsNumberLike(value: string): string;
+    function IsVoidLike(value: string): string;
+}
+export type TypeCompilerLanguageOption = 'typescript' | 'javascript';
+export interface TypeCompilerCodegenOptions {
+    language?: TypeCompilerLanguageOption;
+}
+/** Compiles Types for Runtime Type Checking */
+export declare namespace TypeCompiler {
+    /** Generates the code used to assert this type and returns it as a string */
+    function Code<T extends TSchema>(schema: T, references: TSchema[], options?: TypeCompilerCodegenOptions): string;
+    /** Generates the code used to assert this type and returns it as a string */
+    function Code<T extends TSchema>(schema: T, options?: TypeCompilerCodegenOptions): string;
+    /** Compiles a TypeBox type for optimal runtime type checking. Types must be valid TypeBox types of TSchema */
+    function Compile<T extends TSchema>(schema: T, references?: TSchema[]): TypeCheck<T>;
+}