@open-agent-toolkit/cli 0.2.51 → 0.2.53

package/dist/providers/identity/runtime-observation.d.ts

@@ -0,0 +1,100 @@
+import { z } from 'zod';
+import type { GenericDispatchRecord } from './generic-dispatch-record.js';
+import { type RuntimeObservation } from './oat-dispatch-record.js';
+/**
+ * Envelope shape only. Size is deliberately *not* enforced here.
+ *
+ * A shape, provider, or content violation is a caller error and fails closed.
+ * A size violation is not: the observation layer is optional and
+ * non-authoritative, so refusing an oversized transcript by throwing would
+ * destroy the mandatory record write over an optional attachment. Size is
+ * checked separately and degrades to `not-reported`.
+ */
+declare const runtimeObservationEnvelopeSchema: z.ZodObject<{
+    provider: z.ZodString;
+    observedAt: z.ZodString;
+    entries: z.ZodArray<z.ZodUnknown, "many">;
+}, "strict", z.ZodTypeAny, {
+    provider: string;
+    observedAt: string;
+    entries: unknown[];
+}, {
+    provider: string;
+    observedAt: string;
+    entries: unknown[];
+}>;
+/**
+ * True when the envelope is too large to project. Degrading rather than fatal.
+ *
+ * Bounded by entry count alone, and deliberately not by serialized size. An
+ * earlier revision measured bytes with `JSON.stringify`, which did the very
+ * unbounded work the bound exists to prevent — serializing tens of megabytes to
+ * conclude they were too big — and, worse, *read every conversation field on
+ * the way*. That put the one read of `content` in the codebase inside the
+ * bounding step, while the parsers themselves touched nothing.
+ *
+ * Entry count is O(1) and reads nothing. It is a sufficient bound because
+ * projection work is O(entries x a fixed allowlist of scalar keys) and each
+ * value read is length-capped at 256 characters by the shared identifier
+ * validator, so a single entry cannot carry unbounded cost no matter how large
+ * its unread fields are.
+ */
+export declare function runtimeObservationEnvelopeExceedsBounds(entries: readonly unknown[]): boolean;
+/**
+ * The closed, neutral set of facts an observation can carry.
+ *
+ * Every key is owned by this module and checked against the sensitive-key
+ * classifier. Provider field names never appear here, so a provider renaming a
+ * field cannot change what the boundary sees.
+ */
+export interface ObservedRuntimeFacts {
+    lineage?: string | null;
+    role?: string | null;
+    model?: string | null;
+    effort?: string | null;
+    serviceTier?: string | null;
+    /** Provider-declared OAT request correlation, when the provider states one. */
+    correlation?: string | null;
+}
+export declare const OBSERVED_RUNTIME_FACT_KEYS: readonly ['lineage', 'role', 'model', 'effort', 'serviceTier', 'correlation'];
+export type RuntimeObservationEnvelope = z.infer<typeof runtimeObservationEnvelopeSchema>;
+/**
+ * Project raw provider output down to the neutral fact set.
+ *
+ * Callers may hand over an unmodified rollout or transcript. All provider
+ * parsing happens inside the provider module; only the neutral facts come back,
+ * so nothing of the source shape — including its key names — reaches the
+ * boundary. Returns `null` for an unsupported provider, an over-bound envelope,
+ * or output that yields no facts.
+ */
+export declare function projectRuntimeObservationFacts(provider: string, entries: readonly unknown[]): ObservedRuntimeFacts | null;
+/**
+ * Why an observation degraded. `null` reason means facts were produced.
+ */
+export interface ProjectedRuntimeObservation {
+    facts: ObservedRuntimeFacts | null;
+    reason: string | null;
+}
+export declare function projectRuntimeObservation(provider: string, entries: readonly unknown[]): ProjectedRuntimeObservation;
+/**
+ * Build the observation from already-projected neutral facts.
+ *
+ * `source` names the path that produced the evidence and is supplied by the
+ * caller of this function, never by the dispatch caller.
+ */
+export declare function observationFromFacts(input: {
+    record: GenericDispatchRecord;
+    provider: string;
+    source: string;
+    observedAt: string;
+    facts: ObservedRuntimeFacts | null;
+}): RuntimeObservation;
+export declare function providerSupportsRuntimeObservation(provider: string): boolean;
+/**
+ * Validate the envelope shape. Provider metadata entries stay opaque here: the
+ * parsers read only allowlisted metadata fields out of them, and only the
+ * extracted identifiers ever reach the strict observation schema.
+ */
+export declare function parseRuntimeObservationEnvelope(value: unknown): RuntimeObservationEnvelope;
+export {};
+//# sourceMappingURL=runtime-observation.d.ts.map

package/dist/providers/identity/runtime-observation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-observation.d.ts","sourceRoot":"","sources":["../../../src/providers/identity/runtime-observation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AA0C/B;;;;;;;;GAQG;AACH,QAAA,MAAM,gCAAgC;;;;;;;;;;;;EAM3B,CAAC;AAEZ;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uCAAuC,CACrD,OAAO,EAAE,SAAS,OAAO,EAAE,GAC1B,OAAO,CAET;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,eAAO,MAAM,0BAA0B,YACrC,SAAS,EACT,MAAM,EACN,OAAO,EACP,QAAQ,EACR,aAAa,EACb,aAAa,CACL,CAAC;AAEX,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,SAAS,OAAO,EAAE,GAC1B,oBAAoB,GAAG,IAAI,CAE7B;AAED;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACnC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,SAAS,OAAO,EAAE,GAC1B,2BAA2B,CAsC7B;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,MAAM,EAAE,qBAAqB,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,oBAAoB,GAAG,IAAI,CAAC;CACpC,GAAG,kBAAkB,CAerB;AAED,wBAAgB,kCAAkC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE5E;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,OAAO,GACb,0BAA0B,CAE5B"}

package/dist/providers/identity/runtime-observation.js

@@ -0,0 +1,169 @@
+import { z } from 'zod';
+import { observeClaudeRuntimeFacts } from './claude-runtime-observation.js';
+import { observeCodexRuntimeFacts } from './codex-runtime-observation.js';
+import { buildRuntimeObservation, configuredInvocationForObservation, } from './oat-dispatch-record.js';
+/**
+ * Cross-provider runtime observation normalizer.
+ *
+ * This is the one place a provider's post-launch metadata is turned into the
+ * record's optional observation layer. It reads the immutable configured
+ * invocation only to compare against it: launch, fallback, and every configured
+ * control are untouched, and a mismatch or absence is evidence rather than
+ * authorization.
+ *
+ * Observation is capability-gated. A provider with no metadata channel — Cursor
+ * today — stays explicitly `not-reported` instead of having requested arguments
+ * or materialized pins copied into observed state.
+ *
+ * ## Why projection emits a neutral shape
+ *
+ * The projection deliberately does **not** mirror the provider's own entry
+ * shape. An earlier revision emitted provider-shaped entries, which carried
+ * `sessionId` and a synthesized `message` into the output; both classify
+ * sensitive under the Phase 6 key classifier, so every real Claude transcript
+ * was refused at the durable-write boundary and the whole record write aborted.
+ * Mirroring a source shape means inheriting its key names, and a provider is
+ * free to name a field anything.
+ *
+ * Projection therefore emits {@link ObservedRuntimeFacts}: a flat, closed set
+ * of purpose-built keys owned by this module. Provider-specific parsing happens
+ * entirely inside the provider modules and nothing of the source shape escapes
+ * them, so no upstream rename can reintroduce a collision. The keys are checked
+ * against the classifier by `neutral projection keys are not sensitive` in this
+ * module's tests.
+ */
+const OBSERVING_PROVIDERS = new Set(['codex', 'claude']);
+/**
+ * Bound on how much provider metadata one observation may be derived from. The
+ * entries are never persisted, but an unbounded input would still be unbounded
+ * work at a durable-write boundary.
+ */
+const MAX_ENVELOPE_ENTRIES = 5000;
+/**
+ * Envelope shape only. Size is deliberately *not* enforced here.
+ *
+ * A shape, provider, or content violation is a caller error and fails closed.
+ * A size violation is not: the observation layer is optional and
+ * non-authoritative, so refusing an oversized transcript by throwing would
+ * destroy the mandatory record write over an optional attachment. Size is
+ * checked separately and degrades to `not-reported`.
+ */
+const runtimeObservationEnvelopeSchema = z
+    .object({
+    provider: z.string().min(1).max(256),
+    observedAt: z.string().datetime(),
+    entries: z.array(z.unknown()),
+})
+    .strict();
+/**
+ * True when the envelope is too large to project. Degrading rather than fatal.
+ *
+ * Bounded by entry count alone, and deliberately not by serialized size. An
+ * earlier revision measured bytes with `JSON.stringify`, which did the very
+ * unbounded work the bound exists to prevent — serializing tens of megabytes to
+ * conclude they were too big — and, worse, *read every conversation field on
+ * the way*. That put the one read of `content` in the codebase inside the
+ * bounding step, while the parsers themselves touched nothing.
+ *
+ * Entry count is O(1) and reads nothing. It is a sufficient bound because
+ * projection work is O(entries x a fixed allowlist of scalar keys) and each
+ * value read is length-capped at 256 characters by the shared identifier
+ * validator, so a single entry cannot carry unbounded cost no matter how large
+ * its unread fields are.
+ */
+export function runtimeObservationEnvelopeExceedsBounds(entries) {
+    return entries.length > MAX_ENVELOPE_ENTRIES;
+}
+export const OBSERVED_RUNTIME_FACT_KEYS = [
+    'lineage',
+    'role',
+    'model',
+    'effort',
+    'serviceTier',
+    'correlation',
+];
+/**
+ * Project raw provider output down to the neutral fact set.
+ *
+ * Callers may hand over an unmodified rollout or transcript. All provider
+ * parsing happens inside the provider module; only the neutral facts come back,
+ * so nothing of the source shape — including its key names — reaches the
+ * boundary. Returns `null` for an unsupported provider, an over-bound envelope,
+ * or output that yields no facts.
+ */
+export function projectRuntimeObservationFacts(provider, entries) {
+    return projectRuntimeObservation(provider, entries).facts;
+}
+export function projectRuntimeObservation(provider, entries) {
+    if (!providerSupportsRuntimeObservation(provider)) {
+        return {
+            facts: null,
+            reason: `provider ${provider} exposes no runtime observation channel`,
+        };
+    }
+    if (!Array.isArray(entries)) {
+        return { facts: null, reason: 'observation metadata was not a list' };
+    }
+    if (runtimeObservationEnvelopeExceedsBounds(entries)) {
+        return {
+            facts: null,
+            reason: `observation metadata is too large to project (${entries.length} entries, limit ${MAX_ENVELOPE_ENTRIES})`,
+        };
+    }
+    const facts = provider === 'codex'
+        ? observeCodexRuntimeFacts(entries)
+        : observeClaudeRuntimeFacts(entries);
+    if (facts === null) {
+        return {
+            facts: null,
+            reason: 'observation metadata reported no identity facts',
+        };
+    }
+    // Re-emit through the owned key list so only declared facts can escape.
+    const projected = {};
+    for (const key of OBSERVED_RUNTIME_FACT_KEYS) {
+        const value = facts[key];
+        if (typeof value === 'string' && value !== '')
+            projected[key] = value;
+    }
+    return Object.keys(projected).length > 0
+        ? { facts: projected, reason: null }
+        : {
+            facts: null,
+            reason: 'observation metadata reported no identity facts',
+        };
+}
+/**
+ * Build the observation from already-projected neutral facts.
+ *
+ * `source` names the path that produced the evidence and is supplied by the
+ * caller of this function, never by the dispatch caller.
+ */
+export function observationFromFacts(input) {
+    if (input.facts === null)
+        return { status: 'not-reported' };
+    const { correlation, lineage, ...axes } = input.facts;
+    // Declared-correlation guard, on the path that actually writes records.
+    // A session that names a different request is not evidence about this one.
+    if (correlation != null && correlation !== input.record.request_id) {
+        return { status: 'not-reported' };
+    }
+    return buildRuntimeObservation({
+        provider: input.provider,
+        source: input.source,
+        observedAt: input.observedAt,
+        metadata: { childLineage: lineage, ...axes },
+        configured: configuredInvocationForObservation(input.record),
+    });
+}
+export function providerSupportsRuntimeObservation(provider) {
+    return OBSERVING_PROVIDERS.has(provider);
+}
+/**
+ * Validate the envelope shape. Provider metadata entries stay opaque here: the
+ * parsers read only allowlisted metadata fields out of them, and only the
+ * extracted identifiers ever reach the strict observation schema.
+ */
+export function parseRuntimeObservationEnvelope(value) {
+    return runtimeObservationEnvelopeSchema.parse(value);
+}

package/dist/providers/shared/index.d.ts

@@ -5,4 +5,6 @@ export type { ProviderAgentCodec, ProviderAgentRecord, } from './agent-codec.typ
 export { exportMarkdownAgentRecord, importMarkdownAgentRecord, } from './markdown-agent-codec.js';
 export type { MaterializationAction, MaterializationApplyResult, MaterializationContext, MaterializationExtension, MaterializationOperation, MaterializationPlan, MaterializationPlanSummary, MaterializationWriteOperation, } from './materialization-extension.js';
 export { hasMaterializationChanges, summarizeMaterializationPlan, toMaterializationOperations, } from './materialization-extension.js';
+export type { ManagedContentKind, ProviderActivationEvidence, ProviderActivationSource, ProviderCapabilitySupport, ProviderCatalogRefreshPolicy, ProviderContentCapability, ProviderProjectionMode, ProviderRegistration, ProviderScopeContext, } from './registry.js';
+export { getProviderRegistrations, recomputeProviderScopeContext, resolveProviderScopeContext, validateProviderRegistrations, } from './registry.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/providers/shared/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/providers/shared/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,YAAY,EACZ,WAAW,EACX,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/providers/shared/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,YAAY,EACZ,WAAW,EACX,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,qBAAqB,EACrB,0BAA0B,EAC1B,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,kBAAkB,EAClB,0BAA0B,EAC1B,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC5B,yBAAyB,EACzB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,wBAAwB,EACxB,6BAA6B,EAC7B,2BAA2B,EAC3B,6BAA6B,GAC9B,MAAM,YAAY,CAAC"}

package/dist/providers/shared/index.js

@@ -1,3 +1,4 @@
 export { getActiveAdapters, getConfigAwareAdapters, getSyncMappings, } from './adapter.utils.js';
 export { exportMarkdownAgentRecord, importMarkdownAgentRecord, } from './markdown-agent-codec.js';
 export { hasMaterializationChanges, summarizeMaterializationPlan, toMaterializationOperations, } from './materialization-extension.js';
+export { getProviderRegistrations, recomputeProviderScopeContext, resolveProviderScopeContext, validateProviderRegistrations, } from './registry.js';

package/dist/providers/shared/materialization-extension.d.ts

@@ -22,6 +22,18 @@ export interface MaterializationApplyResult {
     applied: number;
     failed: number;
     skipped: number;
+    /** Additive per-operation evidence; optional for legacy extensions. */
+    operations?: MaterializationOperationResult[];
+}
+export type MaterializationOperationStatus = 'changed' | 'current' | 'missing' | 'failed' | 'unsupported' | 'unknown';
+export interface MaterializationOperationResult {
+    provider: string;
+    target: string;
+    path: string;
+    entryName?: string;
+    action: MaterializationAction;
+    status: MaterializationOperationStatus;
+    failure?: string;
 }
 export interface MaterializationContext<TOptions = undefined> {
     scopeRoot: string;

package/dist/providers/shared/materialization-extension.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"materialization-extension.d.ts","sourceRoot":"","sources":["../../../src/providers/shared/materialization-extension.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE5E,MAAM,WAAW,wBAAwB,CACvC,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,OAAO,SAAS,MAAM,GAAG,MAAM;IAE/B,QAAQ,EAAE,SAAS,CAAC;IACpB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,6BAA6B,CAC5C,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,OAAO,SAAS,MAAM,GAAG,MAAM,CAC/B,SAAQ,wBAAwB,CAAC,SAAS,EAAE,OAAO,CAAC;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB,CAClC,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,GAAG,OAAO;IAEnB,QAAQ,EAAE,SAAS,CAAC;IACpB,UAAU,EAAE,6BAA6B,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;IAChE,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,SAAS,CAAC;CACrB;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB,CAAC,QAAQ,GAAG,SAAS;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,cAAc,EAAE,CAAC;IACnC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,OAAO,EAAE,QAAQ,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB,CACvC,KAAK,SAAS,mBAAmB,GAAG,mBAAmB,EACvD,QAAQ,SAAS,sBAAsB,CAAC,OAAO,CAAC,GAC9C,sBAAsB,CAAC,OAAO,CAAC;IAEjC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5B,WAAW,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/C,SAAS,CACP,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,KAAK,GACV,OAAO,CAAC,0BAA0B,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,0BAA0B;IACzC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAE5E;AAED,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,mBAAmB,GACxB,0BAA0B,CAa5B;AAED,wBAAgB,2BAA2B,CACzC,SAAS,SAAS,MAAM,EACxB,OAAO,SAAS,MAAM,EAEtB,IAAI,EAAE,mBAAmB,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,GACrD,wBAAwB,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAShD"}
+{"version":3,"file":"materialization-extension.d.ts","sourceRoot":"","sources":["../../../src/providers/shared/materialization-extension.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE5E,MAAM,WAAW,wBAAwB,CACvC,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,OAAO,SAAS,MAAM,GAAG,MAAM;IAE/B,QAAQ,EAAE,SAAS,CAAC;IACpB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,6BAA6B,CAC5C,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,OAAO,SAAS,MAAM,GAAG,MAAM,CAC/B,SAAQ,wBAAwB,CAAC,SAAS,EAAE,OAAO,CAAC;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB,CAClC,SAAS,SAAS,MAAM,GAAG,MAAM,EACjC,OAAO,SAAS,MAAM,GAAG,MAAM,EAC/B,SAAS,GAAG,OAAO;IAEnB,QAAQ,EAAE,SAAS,CAAC;IACpB,UAAU,EAAE,6BAA6B,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;IAChE,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,SAAS,CAAC;CACrB;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,UAAU,CAAC,EAAE,8BAA8B,EAAE,CAAC;CAC/C;AAED,MAAM,MAAM,8BAA8B,GACtC,SAAS,GACT,SAAS,GACT,SAAS,GACT,QAAQ,GACR,aAAa,GACb,SAAS,CAAC;AAEd,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,qBAAqB,CAAC;IAC9B,MAAM,EAAE,8BAA8B,CAAC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB,CAAC,QAAQ,GAAG,SAAS;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,cAAc,EAAE,CAAC;IACnC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,OAAO,EAAE,QAAQ,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB,CACvC,KAAK,SAAS,mBAAmB,GAAG,mBAAmB,EACvD,QAAQ,SAAS,sBAAsB,CAAC,OAAO,CAAC,GAC9C,sBAAsB,CAAC,OAAO,CAAC;IAEjC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC5B,WAAW,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/C,SAAS,CACP,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,KAAK,GACV,OAAO,CAAC,0BAA0B,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,0BAA0B;IACzC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAE5E;AAED,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,mBAAmB,GACxB,0BAA0B,CAa5B;AAED,wBAAgB,2BAA2B,CACzC,SAAS,SAAS,MAAM,EACxB,OAAO,SAAS,MAAM,EAEtB,IAAI,EAAE,mBAAmB,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,GACrD,wBAAwB,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAShD"}

package/dist/providers/shared/registry.d.ts

@@ -0,0 +1,69 @@
+import type { SyncConfig } from '../../config/sync-config.js';
+import type { ConcreteScope, ContentType } from '../../shared/types.js';
+import type { ProviderAdapter } from './adapter.types.js';
+import type { MaterializationExtension } from './materialization-extension.js';
+export type ProviderProjectionMode = 'native-read' | 'entry-sync' | 'materialization-extension' | 'unsupported';
+export type ManagedContentKind = ContentType | 'directory';
+export type ProviderCapabilitySupport = 'supported' | 'unsupported' | 'unknown';
+export type ProviderCatalogRefreshPolicy = {
+    state: 'live' | 'manual-refresh' | 'restart-required';
+    provenance: {
+        kind: 'official-contract' | 'validated-local-behavior' | 'repository-decision';
+        reference: string;
+        verifiedAt: string;
+        providerVersion?: string;
+    };
+} | {
+    state: 'unknown';
+    reason: string;
+};
+export interface ProviderContentCapability {
+    scope: ConcreteScope;
+    contentKind: ManagedContentKind;
+    support: ProviderCapabilitySupport;
+    projectionModes: readonly ProviderProjectionMode[];
+    nativeRoleSurface: boolean;
+    collectionAlias: 'supported' | 'unsupported';
+    catalogRefresh: ProviderCatalogRefreshPolicy;
+    unsupportedReason?: string;
+}
+export interface ProviderRegistration {
+    adapter: ProviderAdapter;
+    extensions: readonly MaterializationExtension[];
+    capabilities: readonly ProviderContentCapability[];
+}
+export type ProviderActivationSource = 'config-enabled' | 'config-disabled' | 'detected-unset' | 'undetected-unset';
+export interface ProviderActivationEvidence {
+    provider: string;
+    state: 'active' | 'inactive';
+    source: ProviderActivationSource;
+    reason: string;
+}
+export interface ProviderScopeContext {
+    scope: ConcreteScope;
+    configSource: string;
+    activeProviders: readonly string[];
+    detectedProviders: readonly string[];
+    mismatches: {
+        detectedUnset: readonly string[];
+        detectedDisabled: readonly string[];
+    };
+    activation: readonly ProviderActivationEvidence[];
+    registrations: readonly ProviderRegistration[];
+}
+export declare function resolveCatalogRefreshPolicy(supported: boolean, providerPolicy?: ProviderCatalogRefreshPolicy): ProviderCatalogRefreshPolicy;
+export type UserAgentMaterializationCoverage = 'none' | 'bundled' | 'all';
+export declare function userAgentMaterializationCoverage(input: {
+    registrations: readonly ProviderRegistration[];
+    activeProviders: readonly string[];
+}): UserAgentMaterializationCoverage;
+export declare function validateProviderRegistrations(registrations: readonly ProviderRegistration[]): void;
+export declare function getProviderRegistrations(): readonly ProviderRegistration[];
+export declare function resolveProviderScopeContext(input: {
+    scope: ConcreteScope;
+    scopeRoot: string;
+    config: SyncConfig;
+    registrations?: readonly ProviderRegistration[];
+}): Promise<ProviderScopeContext>;
+export declare function recomputeProviderScopeContext(snapshot: Pick<ProviderScopeContext, 'scope' | 'configSource' | 'detectedProviders' | 'registrations'>, config: SyncConfig): ProviderScopeContext;
+//# sourceMappingURL=registry.d.ts.map

package/dist/providers/shared/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/providers/shared/registry.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAQtD,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAE5E,MAAM,MAAM,sBAAsB,GAC9B,aAAa,GACb,YAAY,GACZ,2BAA2B,GAC3B,aAAa,CAAC;AAClB,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,WAAW,CAAC;AAC3D,MAAM,MAAM,yBAAyB,GAAG,WAAW,GAAG,aAAa,GAAG,SAAS,CAAC;AAEhF,MAAM,MAAM,4BAA4B,GACpC;IACE,KAAK,EAAE,MAAM,GAAG,gBAAgB,GAAG,kBAAkB,CAAC;IACtD,UAAU,EAAE;QACV,IAAI,EACA,mBAAmB,GACnB,0BAA0B,GAC1B,qBAAqB,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH,GACD;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,aAAa,CAAC;IACrB,WAAW,EAAE,kBAAkB,CAAC;IAChC,OAAO,EAAE,yBAAyB,CAAC;IACnC,eAAe,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACnD,iBAAiB,EAAE,OAAO,CAAC;IAC3B,eAAe,EAAE,WAAW,GAAG,aAAa,CAAC;IAC7C,cAAc,EAAE,4BAA4B,CAAC;IAC7C,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,eAAe,CAAC;IACzB,UAAU,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAChD,YAAY,EAAE,SAAS,yBAAyB,EAAE,CAAC;CACpD;AAED,MAAM,MAAM,wBAAwB,GAChC,gBAAgB,GAChB,iBAAiB,GACjB,gBAAgB,GAChB,kBAAkB,CAAC;AAEvB,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC7B,MAAM,EAAE,wBAAwB,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,aAAa,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,UAAU,EAAE;QACV,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;QACjC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;KACrC,CAAC;IACF,UAAU,EAAE,SAAS,0BAA0B,EAAE,CAAC;IAClD,aAAa,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAChD;AA4BD,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,OAAO,EAClB,cAAc,CAAC,EAAE,4BAA4B,GAC5C,4BAA4B,CAG9B;AAyCD,MAAM,MAAM,gCAAgC,GAAG,MAAM,GAAG,SAAS,GAAG,KAAK,CAAC;AAE1E,wBAAgB,gCAAgC,CAAC,KAAK,EAAE;IACtD,aAAa,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC/C,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,GAAG,gCAAgC,CAiBnC;AAkFD,wBAAgB,6BAA6B,CAC3C,aAAa,EAAE,SAAS,oBAAoB,EAAE,GAC7C,IAAI,CAoDN;AAED,wBAAgB,wBAAwB,IAAI,SAAS,oBAAoB,EAAE,CAG1E;AAED,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,UAAU,CAAC;IACnB,aAAa,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACjD,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA0BhC;AAED,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,IAAI,CACZ,oBAAoB,EACpB,OAAO,GAAG,cAAc,GAAG,mBAAmB,GAAG,eAAe,CACjE,EACD,MAAM,EAAE,UAAU,GACjB,oBAAoB,CA+CtB"}

package/dist/providers/shared/registry.js

@@ -0,0 +1,252 @@
+import { join } from 'node:path';
+import { claudeAdapter } from '../claude/index.js';
+import { codexAdapter } from '../codex/index.js';
+import { codexMaterializationExtension } from '../codex/codec/sync-extension.js';
+import { copilotAdapter } from '../copilot/index.js';
+import { cursorAdapter } from '../cursor/index.js';
+import { cursorMaterializationExtension } from '../cursor/codec/sync-extension.js';
+import { geminiAdapter } from '../gemini/index.js';
+const CONTENT_KINDS = [
+    'skill',
+    'agent',
+    'rule',
+    'directory',
+];
+const SCOPES = ['project', 'user'];
+const UNKNOWN_REFRESH = {
+    state: 'unknown',
+    reason: 'No sourced provider-version refresh contract is registered',
+};
+const CONSERVATIVE_NEW_SESSION_REFRESH = {
+    state: 'restart-required',
+    provenance: {
+        kind: 'repository-decision',
+        reference: '.oat/projects/shared/tool-pack-scope-provider-truthfulness/implementation.md#hill-decision-conservative-new-session-advice',
+        verifiedAt: '2026-08-31',
+    },
+};
+const REFRESH_PROVENANCE_KINDS = new Set([
+    'official-contract',
+    'validated-local-behavior',
+    'repository-decision',
+]);
+export function resolveCatalogRefreshPolicy(supported, providerPolicy) {
+    if (!supported)
+        return UNKNOWN_REFRESH;
+    return providerPolicy ?? CONSERVATIVE_NEW_SESSION_REFRESH;
+}
+function hasValidRefreshProvenance(policy) {
+    if (policy.state === 'unknown')
+        return true;
+    const provenance = policy.provenance;
+    if (!provenance || !REFRESH_PROVENANCE_KINDS.has(provenance.kind)) {
+        return false;
+    }
+    if (typeof provenance.reference !== 'string' ||
+        provenance.reference.trim().length === 0) {
+        return false;
+    }
+    if (provenance.providerVersion !== undefined &&
+        (typeof provenance.providerVersion !== 'string' ||
+            provenance.providerVersion.trim().length === 0)) {
+        return false;
+    }
+    if (typeof provenance.verifiedAt !== 'string' ||
+        !/^\d{4}-\d{2}-\d{2}$/.test(provenance.verifiedAt)) {
+        return false;
+    }
+    const date = new Date(`${provenance.verifiedAt}T00:00:00.000Z`);
+    return (!Number.isNaN(date.getTime()) &&
+        date.toISOString().slice(0, 10) === provenance.verifiedAt);
+}
+export function userAgentMaterializationCoverage(input) {
+    const active = new Set(input.activeProviders);
+    let coverage = 'none';
+    for (const registration of input.registrations) {
+        if (!active.has(registration.adapter.name))
+            continue;
+        const capability = registration.capabilities.find(({ scope, contentKind }) => scope === 'user' && contentKind === 'agent');
+        if (capability?.support !== 'supported')
+            continue;
+        if (capability.projectionModes.includes('entry-sync'))
+            return 'all';
+        if (capability.projectionModes.includes('materialization-extension')) {
+            coverage = 'bundled';
+        }
+        else if (capability.projectionModes.includes('native-read')) {
+            return 'all';
+        }
+    }
+    return coverage;
+}
+function capabilitiesFor(adapter, extensionContentKinds = [], refreshPolicies = {}) {
+    return SCOPES.flatMap((scope) => {
+        const mappings = scope === 'project' ? adapter.projectMappings : adapter.userMappings;
+        return CONTENT_KINDS.map((contentKind) => {
+            const mapping = mappings.find(({ contentType }) => contentType === contentKind);
+            const hasExtension = extensionContentKinds.includes(contentKind);
+            const projectionModes = [];
+            if (mapping) {
+                projectionModes.push(mapping.nativeRead ? 'native-read' : 'entry-sync');
+            }
+            if (hasExtension)
+                projectionModes.push('materialization-extension');
+            const supported = mapping !== undefined || hasExtension;
+            if (!supported)
+                projectionModes.push('unsupported');
+            return {
+                scope,
+                contentKind,
+                support: supported ? 'supported' : 'unsupported',
+                projectionModes,
+                nativeRoleSurface: contentKind === 'agent' && supported,
+                collectionAlias: contentKind === 'skill' && mapping !== undefined
+                    ? 'supported'
+                    : 'unsupported',
+                // A sourced provider/content policy takes precedence over the
+                // repository-wide conservative new-session decision.
+                catalogRefresh: resolveCatalogRefreshPolicy(supported, refreshPolicies[contentKind]),
+                ...(supported
+                    ? {}
+                    : {
+                        unsupportedReason: `${adapter.displayName} has no ${scope} ${contentKind} projection`,
+                    }),
+            };
+        });
+    });
+}
+const REGISTRATIONS = [
+    {
+        adapter: claudeAdapter,
+        extensions: [],
+        capabilities: capabilitiesFor(claudeAdapter),
+    },
+    {
+        adapter: cursorAdapter,
+        get extensions() {
+            return [cursorMaterializationExtension];
+        },
+        capabilities: capabilitiesFor(cursorAdapter, ['agent']),
+    },
+    {
+        adapter: codexAdapter,
+        get extensions() {
+            return [codexMaterializationExtension];
+        },
+        capabilities: capabilitiesFor(codexAdapter, ['agent']),
+    },
+    {
+        adapter: copilotAdapter,
+        extensions: [],
+        capabilities: capabilitiesFor(copilotAdapter),
+    },
+    {
+        adapter: geminiAdapter,
+        extensions: [],
+        capabilities: capabilitiesFor(geminiAdapter),
+    },
+];
+export function validateProviderRegistrations(registrations) {
+    const names = new Set();
+    for (const registration of registrations) {
+        const name = registration.adapter.name;
+        if (names.has(name)) {
+            throw new Error(`Provider ${name} is registered more than once`);
+        }
+        names.add(name);
+        for (const extension of registration.extensions) {
+            if (extension.provider !== name) {
+                throw new Error(`Provider ${name} owns contradictory extension ${extension.provider}`);
+            }
+        }
+        for (const scope of SCOPES) {
+            for (const contentKind of CONTENT_KINDS) {
+                const rows = registration.capabilities.filter((capability) => capability.scope === scope &&
+                    capability.contentKind === contentKind);
+                if (rows.length !== 1) {
+                    throw new Error(`Provider ${name} must register exactly one ${scope} ${contentKind} capability`);
+                }
+                const [row] = rows;
+                if ((row.support === 'unsupported') !==
+                    row.projectionModes.includes('unsupported')) {
+                    throw new Error(`Provider ${name} has contradictory ${scope} ${contentKind} support`);
+                }
+                if (row.support === 'unsupported' &&
+                    row.catalogRefresh.state !== 'unknown') {
+                    throw new Error(`Provider ${name} has unsupported ${scope} ${contentKind} with non-unknown refresh policy`);
+                }
+                if (!hasValidRefreshProvenance(row.catalogRefresh)) {
+                    throw new Error(`Provider ${name} has invalid ${scope} ${contentKind} refresh policy provenance`);
+                }
+            }
+        }
+    }
+}
+export function getProviderRegistrations() {
+    validateProviderRegistrations(REGISTRATIONS);
+    return REGISTRATIONS;
+}
+export async function resolveProviderScopeContext(input) {
+    const registrations = input.registrations ?? getProviderRegistrations();
+    validateProviderRegistrations(registrations);
+    const detection = await Promise.all(registrations.map(async ({ adapter }) => ({
+        adapter,
+        detected: await adapter.detect(input.scopeRoot),
+    })));
+    const detectedProviders = detection
+        .filter(({ detected }) => detected)
+        .map(({ adapter }) => adapter.name);
+    return recomputeProviderScopeContext({
+        scope: input.scope,
+        configSource: join(input.scope === 'project' ? '<project>' : '~', '.oat', 'sync', 'config.json'),
+        detectedProviders,
+        registrations,
+    }, input.config);
+}
+export function recomputeProviderScopeContext(snapshot, config) {
+    const detected = new Set(snapshot.detectedProviders);
+    const active = new Set();
+    const detectedUnset = [];
+    const detectedDisabled = [];
+    const activation = snapshot.registrations.map(({ adapter }) => {
+        const isDetected = detected.has(adapter.name);
+        const configured = config.providers[adapter.name]?.enabled;
+        const isActive = configured === true || (configured === undefined && isDetected);
+        if (isActive)
+            active.add(adapter.name);
+        if (configured === undefined && isDetected)
+            detectedUnset.push(adapter.name);
+        if (configured === false && isDetected)
+            detectedDisabled.push(adapter.name);
+        const source = configured === true
+            ? 'config-enabled'
+            : configured === false
+                ? 'config-disabled'
+                : isActive
+                    ? 'detected-unset'
+                    : 'undetected-unset';
+        return {
+            provider: adapter.name,
+            state: isActive ? 'active' : 'inactive',
+            source,
+            reason: source === 'config-enabled'
+                ? 'Explicitly enabled in sync config'
+                : source === 'config-disabled'
+                    ? 'Explicitly disabled in sync config'
+                    : source === 'detected-unset'
+                        ? 'Detected with no explicit provider setting'
+                        : 'Not detected and no explicit provider setting',
+        };
+    });
+    return {
+        ...snapshot,
+        activeProviders: snapshot.registrations
+            .map(({ adapter }) => adapter.name)
+            .filter((name) => active.has(name)),
+        mismatches: {
+            detectedUnset,
+            detectedDisabled,
+        },
+        activation,
+    };
+}