@pellux/goodvibes-sdk 0.37.2 → 1.0.0

package/dist/platform/control-plane/invoke-input-validation.js

@@ -0,0 +1,163 @@
+/**
+ * invoke-input-validation.ts (W3-S1, Part B)
+ *
+ * A central, catalog-driven input gate for the gateway invoke layer. Before a
+ * resolved verb's handler (or its HTTP delegate) runs, the invocation's params
+ * are validated against the method catalog's `inputSchema`, returning an honest
+ * 400 instead of letting a wrong-typed or missing-required field reach a handler
+ * that would silently coerce or misbehave.
+ *
+ * Scope is deliberately the TYPED subset only:
+ *   - Object schemas that declare `properties` are structurally validated.
+ *   - Generic object schemas (object with no `properties`, e.g. an
+ *     additionalProperties-only "any JSON object") pass through unchanged — the
+ *     status quo — so no verb is falsely rejected for extra fields.
+ *   - A verb with no `inputSchema` is untyped and passes through.
+ *
+ * The validator is lenient on unknown keys (does NOT enforce
+ * `additionalProperties: false`): the goal is to reject provable type/shape
+ * mismatches, not to tighten every loose handler that historically tolerated
+ * extra fields. It reports the first violation it finds.
+ */
+/**
+ * A "generic" object schema declares `type: 'object'` but no `properties` map
+ * (e.g. JSON_OBJECT_SCHEMA / an additionalProperties-only bag). Mirrors
+ * operator-contract.ts:isGenericObjectSchema so coverage accounting and the gate
+ * agree on what counts as typed.
+ */
+function isGenericObjectSchema(schema) {
+    return Boolean(schema && schema.type === 'object' && !Object.hasOwn(schema, 'properties'));
+}
+/**
+ * Classify an inputSchema for both the validate gate and coverage accounting:
+ *   - 'validated' — an object schema with declared properties (structurally checked)
+ *   - 'generic'   — an object schema with no properties (skipped)
+ *   - 'untyped'   — absent, or a non-object root we do not structurally validate (skipped)
+ */
+export function classifyInputSchema(schema) {
+    if (schema === undefined)
+        return 'untyped';
+    if (isGenericObjectSchema(schema))
+        return 'generic';
+    if (schema.type === 'object' && Object.hasOwn(schema, 'properties'))
+        return 'validated';
+    return 'untyped';
+}
+function schemaLabel(path) {
+    return path === '' ? 'value' : path;
+}
+function childPath(path, key) {
+    return path === '' ? key : `${path}.${key}`;
+}
+/**
+ * Validate `value` against a JSON-schema-like `schema`. Returns a human-readable
+ * detail string for the first violation, or null when the value conforms. Schema
+ * forms without a `type` keyword (e.g. the empty "any JSON value" schema), or
+ * with an unrecognized `type`, are treated as permissive (accept).
+ */
+function validateValue(value, schema, path) {
+    if (Array.isArray(schema.anyOf)) {
+        for (const branch of schema.anyOf) {
+            if (branch && typeof branch === 'object' && validateValue(value, branch, path) === null) {
+                return null;
+            }
+        }
+        return `${schemaLabel(path)} did not match any of the allowed types`;
+    }
+    if (Array.isArray(schema.enum) && !schema.enum.includes(value)) {
+        return `${schemaLabel(path)} must be one of ${JSON.stringify(schema.enum)}`;
+    }
+    const type = schema.type;
+    if (typeof type !== 'string')
+        return null; // no type constraint → accept
+    switch (type) {
+        case 'string':
+            return typeof value === 'string' ? null : `${schemaLabel(path)} must be a string`;
+        case 'number':
+        case 'integer':
+            return typeof value === 'number' && !Number.isNaN(value)
+                ? null
+                : `${schemaLabel(path)} must be a number`;
+        case 'boolean':
+            return typeof value === 'boolean' ? null : `${schemaLabel(path)} must be a boolean`;
+        case 'null':
+            return value === null ? null : `${schemaLabel(path)} must be null`;
+        case 'array': {
+            if (!Array.isArray(value))
+                return `${schemaLabel(path)} must be an array`;
+            const items = schema.items;
+            if (items && typeof items === 'object' && !Array.isArray(items)) {
+                for (let i = 0; i < value.length; i++) {
+                    const detail = validateValue(value[i], items, `${schemaLabel(path)}[${i}]`);
+                    if (detail)
+                        return detail;
+                }
+            }
+            return null;
+        }
+        case 'object': {
+            if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+                return `${schemaLabel(path)} must be an object`;
+            }
+            const record = value;
+            const required = Array.isArray(schema.required) ? schema.required : [];
+            for (const key of required) {
+                if (typeof key === 'string' && (!(key in record) || record[key] === undefined)) {
+                    return `${childPath(path, key)} is required`;
+                }
+            }
+            const properties = (schema.properties && typeof schema.properties === 'object')
+                ? schema.properties
+                : {};
+            for (const [key, propValue] of Object.entries(record)) {
+                const propSchema = properties[key];
+                if (propSchema && typeof propSchema === 'object' && !Array.isArray(propSchema)) {
+                    const detail = validateValue(propValue, propSchema, childPath(path, key));
+                    if (detail)
+                        return detail;
+                }
+                // Unknown keys are tolerated (lenient on additionalProperties) so loose
+                // handlers that historically accepted extra fields are not broken.
+            }
+            return null;
+        }
+        default:
+            return null; // unrecognized type keyword → accept
+    }
+}
+/**
+ * Validate an invocation's params against a verb's inputSchema. Returns an
+ * `InvokeValidationError` when a typed schema is violated, or null when the
+ * params conform, the schema is generic/untyped, or there is nothing to check.
+ *
+ * `params` is the request payload the verb receives (the invoke body for
+ * body-carrying verbs). `undefined` is treated as an empty object so a schema
+ * with required fields honestly reports them missing.
+ */
+export function validateInvocationInput(descriptor, params) {
+    const schema = descriptor.inputSchema;
+    if (classifyInputSchema(schema) !== 'validated')
+        return null;
+    const value = params === undefined ? {} : params;
+    const detail = validateValue(value, schema, '');
+    return detail ? { code: 'INVALID_INPUT', detail } : null;
+}
+export function summarizeInvokeValidationCoverage(methods) {
+    let validated = 0;
+    let skippedGeneric = 0;
+    let skippedUntyped = 0;
+    for (const method of methods) {
+        switch (classifyInputSchema(method.inputSchema)) {
+            case 'validated':
+                validated += 1;
+                break;
+            case 'generic':
+                skippedGeneric += 1;
+                break;
+            case 'untyped':
+                skippedUntyped += 1;
+                break;
+        }
+    }
+    return { methods: methods.length, validated, skippedGeneric, skippedUntyped };
+}

package/dist/platform/control-plane/method-catalog-admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"method-catalog-admin.d.ts","sourceRoot":"","sources":["../../../src/platform/control-plane/method-catalog-admin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAe1E,eAAO,MAAM,oCAAoC,EAAE,SAAS,uBAAuB,EAwHlF,CAAC"}
+{"version":3,"file":"method-catalog-admin.d.ts","sourceRoot":"","sources":["../../../src/platform/control-plane/method-catalog-admin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAgB1E,eAAO,MAAM,oCAAoC,EAAE,SAAS,uBAAuB,EAmIlF,CAAC"}

package/dist/platform/control-plane/method-catalog-admin.js

@@ -1,5 +1,5 @@
 import { EMPTY_OBJECT_SCHEMA, STRING_SCHEMA, objectSchema, listOutputSchema, entityOutputSchema, bodyEnvelopeSchema, methodDescriptor } from './method-catalog-shared.js';
-import { CONFIG_SET_OUTPUT_SCHEMA, CONFIG_SNAPSHOT_SCHEMA, LOCAL_AUTH_USER_SCHEMA, LOCAL_AUTH_BOOTSTRAP_DELETE_OUTPUT_SCHEMA, LOCAL_AUTH_DELETE_OUTPUT_SCHEMA, LOCAL_AUTH_SESSION_REVOKE_OUTPUT_SCHEMA, LOCAL_AUTH_STATUS_SCHEMA, LOCAL_AUTH_ROTATE_PASSWORD_OUTPUT_SCHEMA, PANEL_OPEN_OUTPUT_SCHEMA, PANEL_SNAPSHOT_SCHEMA, } from './operator-contract-schemas.js';
+import { CONFIG_SET_OUTPUT_SCHEMA, CONFIG_SNAPSHOT_SCHEMA, CREDENTIALS_SNAPSHOT_SCHEMA, LOCAL_AUTH_USER_SCHEMA, LOCAL_AUTH_BOOTSTRAP_DELETE_OUTPUT_SCHEMA, LOCAL_AUTH_DELETE_OUTPUT_SCHEMA, LOCAL_AUTH_SESSION_REVOKE_OUTPUT_SCHEMA, LOCAL_AUTH_STATUS_SCHEMA, LOCAL_AUTH_ROTATE_PASSWORD_OUTPUT_SCHEMA, PANEL_OPEN_OUTPUT_SCHEMA, PANEL_SNAPSHOT_SCHEMA, } from './operator-contract-schemas.js';
 export const builtinGatewayAdminMethodDescriptors = [
     methodDescriptor({
         id: 'local_auth.status',
@@ -107,6 +107,17 @@ export const builtinGatewayAdminMethodDescriptors = [
         inputSchema: EMPTY_OBJECT_SCHEMA,
         outputSchema: CONFIG_SNAPSHOT_SCHEMA,
     }),
+    methodDescriptor({
+        id: 'credentials.get',
+        title: 'Get Credential Status',
+        description: 'Return secret-free credential status (configured/usable) for the shared store. Never returns raw secret bytes. Optional ?key= narrows to one credential.',
+        category: 'config',
+        scopes: ['read:config'],
+        access: 'admin',
+        http: { method: 'GET', path: '/config/credentials' },
+        inputSchema: objectSchema({ key: STRING_SCHEMA }, []),
+        outputSchema: CREDENTIALS_SNAPSHOT_SCHEMA,
+    }),
     methodDescriptor({
         id: 'config.set',
         title: 'Set Config Value',

package/dist/platform/control-plane/method-catalog-calendar.d.ts

@@ -4,6 +4,22 @@ import type { GatewayMethodDescriptor } from './method-catalog-shared.js';
  * import/export through the standard operator method protocol. Daemon-backed;
  * the SDK publishes the typed contract surface (no internal handler). Local .ics
  * parsing is handled agent-side and does not depend on these contracts.
+ *
+ * Route-reconcile debt (surfaced by W4-A3, retired here): none of these five
+ * http paths are served by the daemon router — there is no /api/calendar
+ * surface at any prefix (confirmed by reading router.ts, every dispatch
+ * chain it delegates to, and grepping the full path across packages/sdk/src
+ * and packages/daemon-sdk/src; there is no calendar-routes.ts and no
+ * calendar handler anywhere). These were originally grandfathered into
+ * KNOWN_PRE_EXISTING_ROUTE_DEBT in test/w4-a3-capability-route-reconcile.test.ts
+ * as an out-of-ownership finding W4-A3 incidentally surfaced; marked
+ * `invokable: false` here so the published contract and the live
+ * method-dispatch path both say "cataloged, not callable" instead of
+ * letting a caller discover the 404 the hard way. Un-mark a method once its
+ * real CalDAV-backed route or handler exists — the route-reconcile
+ * regression gate (method-catalog-route-reconcile.ts, exercised in
+ * test/w4-a3-capability-route-reconcile.test.ts) will catch it if this
+ * comment goes stale and a route reappears without the flag being cleared.
  */
 export declare const builtinGatewayCalendarMethodDescriptors: readonly GatewayMethodDescriptor[];
 //# sourceMappingURL=method-catalog-calendar.d.ts.map

package/dist/platform/control-plane/method-catalog-calendar.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"method-catalog-calendar.d.ts","sourceRoot":"","sources":["../../../src/platform/control-plane/method-catalog-calendar.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAiC1E;;;;;GAKG;AACH,eAAO,MAAM,uCAAuC,EAAE,SAAS,uBAAuB,EAyFrF,CAAC"}
+{"version":3,"file":"method-catalog-calendar.d.ts","sourceRoot":"","sources":["../../../src/platform/control-plane/method-catalog-calendar.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAiC1E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,uCAAuC,EAAE,SAAS,uBAAuB,EA8FrF,CAAC"}

package/dist/platform/control-plane/method-catalog-calendar.js

@@ -24,6 +24,22 @@ const CALENDAR_EVENT_DETAIL_SCHEMA = objectSchema({
  * import/export through the standard operator method protocol. Daemon-backed;
  * the SDK publishes the typed contract surface (no internal handler). Local .ics
  * parsing is handled agent-side and does not depend on these contracts.
+ *
+ * Route-reconcile debt (surfaced by W4-A3, retired here): none of these five
+ * http paths are served by the daemon router — there is no /api/calendar
+ * surface at any prefix (confirmed by reading router.ts, every dispatch
+ * chain it delegates to, and grepping the full path across packages/sdk/src
+ * and packages/daemon-sdk/src; there is no calendar-routes.ts and no
+ * calendar handler anywhere). These were originally grandfathered into
+ * KNOWN_PRE_EXISTING_ROUTE_DEBT in test/w4-a3-capability-route-reconcile.test.ts
+ * as an out-of-ownership finding W4-A3 incidentally surfaced; marked
+ * `invokable: false` here so the published contract and the live
+ * method-dispatch path both say "cataloged, not callable" instead of
+ * letting a caller discover the 404 the hard way. Un-mark a method once its
+ * real CalDAV-backed route or handler exists — the route-reconcile
+ * regression gate (method-catalog-route-reconcile.ts, exercised in
+ * test/w4-a3-capability-route-reconcile.test.ts) will catch it if this
+ * comment goes stale and a route reappears without the flag being cleared.
  */
 export const builtinGatewayCalendarMethodDescriptors = [
     methodDescriptor({
@@ -40,6 +56,7 @@ export const builtinGatewayCalendarMethodDescriptors = [
             limit: NUMBER_SCHEMA,
         }),
         outputSchema: listOutputSchema('events', CALENDAR_EVENT_SUMMARY_SCHEMA),
+        invokable: false,
     }),
     methodDescriptor({
         id: 'calendar.events.get',
@@ -53,6 +70,7 @@ export const builtinGatewayCalendarMethodDescriptors = [
             calendarId: STRING_SCHEMA,
         }, ['eventId']),
         outputSchema: CALENDAR_EVENT_DETAIL_SCHEMA,
+        invokable: false,
     }),
     methodDescriptor({
         id: 'calendar.events.create',
@@ -77,6 +95,7 @@ export const builtinGatewayCalendarMethodDescriptors = [
             uid: STRING_SCHEMA,
             createdAt: STRING_SCHEMA,
         }, ['eventId', 'uid', 'createdAt']),
+        invokable: false,
     }),
     methodDescriptor({
         id: 'calendar.ics.import',
@@ -96,6 +115,7 @@ export const builtinGatewayCalendarMethodDescriptors = [
             eventIds: arraySchema(STRING_SCHEMA),
             errors: arraySchema(STRING_SCHEMA),
         }, ['imported', 'eventIds', 'errors']),
+        invokable: false,
     }),
     methodDescriptor({
         id: 'calendar.ics.export',
@@ -113,5 +133,6 @@ export const builtinGatewayCalendarMethodDescriptors = [
             icsContent: STRING_SCHEMA,
             eventCount: NUMBER_SCHEMA,
         }, ['icsContent', 'eventCount']),
+        invokable: false,
     }),
 ];

package/dist/platform/control-plane/method-catalog-channels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"method-catalog-channels.d.ts","sourceRoot":"","sources":["../../../src/platform/control-plane/method-catalog-channels.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAuF1E,eAAO,MAAM,sCAAsC,EAAE,SAAS,uBAAuB,EAoqBpF,CAAC"}
+{"version":3,"file":"method-catalog-channels.d.ts","sourceRoot":"","sources":["../../../src/platform/control-plane/method-catalog-channels.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAuF1E,eAAO,MAAM,sCAAsC,EAAE,SAAS,uBAAuB,EAisBpF,CAAC"}

package/dist/platform/control-plane/method-catalog-channels.js

@@ -442,9 +442,9 @@ export const builtinGatewayChannelMethodDescriptors = [
         outputSchema: WATCHER_RECORD_SCHEMA,
     }),
     methodDescriptor({
-        id: 'watchers.patch',
-        title: 'Patch Watcher',
-        description: 'Patch an existing watcher.',
+        id: 'watchers.update',
+        title: 'Update Watcher',
+        description: 'Update an existing watcher. (Renamed from watchers.patch in the Wave-6 core-verb pass — canonical verb is update, not patch.)',
         category: 'watchers',
         scopes: ['write:watchers'],
         access: 'admin',
@@ -584,6 +584,27 @@ export const builtinGatewayChannelMethodDescriptors = [
         outputSchema: SERVICE_STATUS_SCHEMA,
         dangerous: true,
     }),
+    /**
+     * Route-reconcile debt (surfaced by W4-A3, retired here): the eight
+     * channels.inbox.* / channels.routing.* / channels.drafts.* methods below
+     * advertise http paths with no dispatch route anywhere — confirmed by
+     * reading router.ts, every dispatch chain it delegates to (operator.ts in
+     * particular, which is where every other channels.* path is matched), and
+     * grepping the full path across packages/sdk/src and
+     * packages/daemon-sdk/src: channel-routes.ts defines no inbox/routing/
+     * drafts handler at all, so there is nothing for a route to call even in
+     * principle. These were originally grandfathered into
+     * KNOWN_PRE_EXISTING_ROUTE_DEBT in test/w4-a3-capability-route-reconcile.test.ts
+     * as an out-of-ownership finding W4-A3 incidentally surfaced; marked
+     * `invokable: false` here so the published contract and the live
+     * method-dispatch path both say "cataloged, not callable" instead of
+     * letting a caller discover the 404 the hard way. Un-mark a method once
+     * its real route or handler exists — the route-reconcile regression gate
+     * (method-catalog-route-reconcile.ts, exercised in
+     * test/w4-a3-capability-route-reconcile.test.ts) will catch it if this
+     * comment goes stale and a route reappears without the flag being
+     * cleared.
+     */
     methodDescriptor({
         id: 'channels.inbox.list',
         title: 'List Channel Inbox',
@@ -602,6 +623,7 @@ export const builtinGatewayChannelMethodDescriptors = [
             truncated: BOOLEAN_SCHEMA,
             cursor: STRING_SCHEMA,
         }, ['items', 'total', 'truncated']),
+        invokable: false,
     }),
     methodDescriptor({
         id: 'channels.routing.list',
@@ -619,6 +641,7 @@ export const builtinGatewayChannelMethodDescriptors = [
             routes: arraySchema(CHANNEL_ROUTING_RULE_SCHEMA),
             total: NUMBER_SCHEMA,
         }, ['routes', 'total']),
+        invokable: false,
     }),
     methodDescriptor({
         id: 'channels.routing.assign',
@@ -646,6 +669,7 @@ export const builtinGatewayChannelMethodDescriptors = [
             updatedAt: STRING_SCHEMA,
         }, ['assignmentId', 'surfaceKind', 'profileId', 'createdAt', 'updatedAt']),
         dangerous: true,
+        invokable: false,
     }),
     methodDescriptor({
         id: 'channels.routing.delete',
@@ -661,6 +685,7 @@ export const builtinGatewayChannelMethodDescriptors = [
             assignmentId: STRING_SCHEMA,
         }, ['deleted', 'assignmentId']),
         dangerous: true,
+        invokable: false,
     }),
     methodDescriptor({
         id: 'channels.drafts.list',
@@ -677,6 +702,7 @@ export const builtinGatewayChannelMethodDescriptors = [
             drafts: arraySchema(CHANNEL_DRAFT_SCHEMA),
             total: NUMBER_SCHEMA,
         }, ['drafts', 'total']),
+        invokable: false,
     }),
     methodDescriptor({
         id: 'channels.drafts.get',
@@ -687,6 +713,7 @@ export const builtinGatewayChannelMethodDescriptors = [
         http: { method: 'GET', path: '/api/channels/drafts/{draftId}' },
         inputSchema: objectSchema({ draftId: STRING_SCHEMA }, ['draftId']),
         outputSchema: CHANNEL_DRAFT_GET_OUTPUT_SCHEMA,
+        invokable: false,
     }),
     methodDescriptor({
         id: 'channels.drafts.save',
@@ -702,6 +729,7 @@ export const builtinGatewayChannelMethodDescriptors = [
             created: BOOLEAN_SCHEMA,
         }, ['draft', 'created']),
         dangerous: true,
+        invokable: false,
     }),
     methodDescriptor({
         id: 'channels.drafts.delete',
@@ -717,5 +745,6 @@ export const builtinGatewayChannelMethodDescriptors = [
             draftId: STRING_SCHEMA,
         }, ['deleted', 'draftId']),
         dangerous: true,
+        invokable: false,
     }),
 ];

package/dist/platform/control-plane/method-catalog-control-automation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"method-catalog-control-automation.d.ts","sourceRoot":"","sources":["../../../src/platform/control-plane/method-catalog-control-automation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAsC1E,eAAO,MAAM,gDAAgD,EAAE,SAAS,uBAAuB,EA0b9F,CAAC"}
+{"version":3,"file":"method-catalog-control-automation.d.ts","sourceRoot":"","sources":["../../../src/platform/control-plane/method-catalog-control-automation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAsC1E,eAAO,MAAM,gDAAgD,EAAE,SAAS,uBAAuB,EA2a9F,CAAC"}

package/dist/platform/control-plane/method-catalog-control-automation.js

@@ -69,9 +69,9 @@ export const builtinGatewayControlAutomationMethodDescriptors = [
         outputSchema: AUTOMATION_JOB_SCHEMA,
     }),
     methodDescriptor({
-        id: 'automation.jobs.patch',
-        title: 'Patch Automation Job',
-        description: 'Patch a durable automation job.',
+        id: 'automation.jobs.update',
+        title: 'Update Automation Job',
+        description: 'Update a durable automation job. (Renamed from automation.jobs.patch in the Wave-6 core-verb pass — canonical verb is update, not patch.)',
         category: 'automation',
         scopes: ['write:automation'],
         http: { method: 'PATCH', path: '/api/automation/jobs/{jobId}' },
@@ -139,28 +139,13 @@ export const builtinGatewayControlAutomationMethodDescriptors = [
         inputSchema: objectSchema({ jobId: STRING_SCHEMA }, ['jobId']),
         outputSchema: objectSchema({ id: STRING_SCHEMA, enabled: BOOLEAN_SCHEMA }, ['id', 'enabled'], { additionalProperties: true }),
     }),
-    methodDescriptor({
-        id: 'automation.jobs.pause',
-        title: 'Pause Automation Job',
-        description: 'Pause a durable automation job.',
-        category: 'automation',
-        scopes: ['write:automation'],
-        http: { method: 'POST', path: '/api/automation/jobs/{jobId}/pause' },
-        events: [runtimeEventId('automation')],
-        inputSchema: objectSchema({ jobId: STRING_SCHEMA }, ['jobId']),
-        outputSchema: objectSchema({ id: STRING_SCHEMA, enabled: BOOLEAN_SCHEMA }, ['id', 'enabled'], { additionalProperties: true }),
-    }),
-    methodDescriptor({
-        id: 'automation.jobs.resume',
-        title: 'Resume Automation Job',
-        description: 'Resume a durable automation job.',
-        category: 'automation',
-        scopes: ['write:automation'],
-        http: { method: 'POST', path: '/api/automation/jobs/{jobId}/resume' },
-        events: [runtimeEventId('automation')],
-        inputSchema: objectSchema({ jobId: STRING_SCHEMA }, ['jobId']),
-        outputSchema: objectSchema({ id: STRING_SCHEMA, enabled: BOOLEAN_SCHEMA }, ['id', 'enabled'], { additionalProperties: true }),
-    }),
+    // automation.jobs.pause / automation.jobs.resume were RETIRED in the Wave-6
+    // core-verb pass (W6-C3): they were a byte-identical redundant lifecycle
+    // pair with automation.jobs.disable/enable (same {id,enabled} output shape,
+    // same semantics — pause==disable, resume==enable). The canonical verbs are
+    // enable/disable; consumers that exposed a "pause"/"resume" user-facing verb
+    // now map it onto automation.jobs.disable/automation.jobs.enable. See
+    // packages/contracts/src/core-verbs.ts and docs/decisions/2026-07-06-core-verb-spec.md.
     methodDescriptor({
         id: 'automation.jobs.run',
         title: 'Run Automation Job Now',
@@ -258,7 +243,7 @@ export const builtinGatewayControlAutomationMethodDescriptors = [
         outputSchema: DELIVERY_OUTPUT_SCHEMA,
     }),
     methodDescriptor({
-        id: 'schedules.list',
+        id: 'automation.schedules.list',
         title: 'List Schedules',
         description: 'Return schedule records.',
         category: 'automation',
@@ -268,7 +253,7 @@ export const builtinGatewayControlAutomationMethodDescriptors = [
         outputSchema: AUTOMATION_SCHEDULES_OUTPUT_SCHEMA,
     }),
     methodDescriptor({
-        id: 'schedules.create',
+        id: 'automation.schedules.create',
         title: 'Create Schedule',
         description: 'Create a schedule record.',
         category: 'automation',
@@ -305,7 +290,7 @@ export const builtinGatewayControlAutomationMethodDescriptors = [
         outputSchema: AUTOMATION_JOB_SCHEMA,
     }),
     methodDescriptor({
-        id: 'schedules.delete',
+        id: 'automation.schedules.delete',
         title: 'Delete Schedule',
         description: 'Delete a schedule record.',
         category: 'automation',
@@ -316,7 +301,7 @@ export const builtinGatewayControlAutomationMethodDescriptors = [
         dangerous: true,
     }),
     methodDescriptor({
-        id: 'schedules.enable',
+        id: 'automation.schedules.enable',
         title: 'Enable Schedule',
         description: 'Enable a schedule record.',
         category: 'automation',
@@ -326,7 +311,7 @@ export const builtinGatewayControlAutomationMethodDescriptors = [
         outputSchema: objectSchema({ id: STRING_SCHEMA, enabled: BOOLEAN_SCHEMA }, ['id', 'enabled'], { additionalProperties: true }),
     }),
     methodDescriptor({
-        id: 'schedules.disable',
+        id: 'automation.schedules.disable',
         title: 'Disable Schedule',
         description: 'Disable a schedule record.',
         category: 'automation',
@@ -336,7 +321,7 @@ export const builtinGatewayControlAutomationMethodDescriptors = [
         outputSchema: objectSchema({ id: STRING_SCHEMA, enabled: BOOLEAN_SCHEMA }, ['id', 'enabled'], { additionalProperties: true }),
     }),
     methodDescriptor({
-        id: 'schedules.run',
+        id: 'automation.schedules.run',
         title: 'Run Schedule Now',
         description: 'Trigger a schedule immediately.',
         category: 'automation',
@@ -407,9 +392,9 @@ export const builtinGatewayControlAutomationMethodDescriptors = [
         outputSchema: ROUTE_BINDING_SCHEMA,
     }),
     methodDescriptor({
-        id: 'routes.bindings.patch',
-        title: 'Patch Route Binding',
-        description: 'Patch an existing route binding.',
+        id: 'routes.bindings.update',
+        title: 'Update Route Binding',
+        description: 'Update an existing route binding. (Renamed from routes.bindings.patch in the Wave-6 core-verb pass — canonical verb is update, not patch.)',
         category: 'routes',
         scopes: ['write:routes'],
         access: 'admin',

package/dist/platform/control-plane/method-catalog-control-companion.d.ts

@@ -0,0 +1,15 @@
+/**
+ * method-catalog-control-companion.ts
+ *
+ * Companion-chat method catalog registration, split out of
+ * method-catalog-control-core.ts (W5-S1) to stay under the repo's 800-line
+ * hand-authored file cap (see scripts/check-line-cap.ts) — this block is
+ * self-contained (companion.chat.* descriptors only) and control.ts folds it
+ * in unchanged, so this is a pure file-organization move with no API surface
+ * change beyond the delete-honesty split it carries (companion.chat.sessions.close
+ * as a distinct soft-close verb alongside a genuinely hard-deleting
+ * companion.chat.sessions.delete).
+ */
+import type { GatewayMethodDescriptor } from './method-catalog-shared.js';
+export declare const builtinGatewayControlCompanionMethodDescriptors: readonly GatewayMethodDescriptor[];
+//# sourceMappingURL=method-catalog-control-companion.d.ts.map

package/dist/platform/control-plane/method-catalog-control-companion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"method-catalog-control-companion.d.ts","sourceRoot":"","sources":["../../../src/platform/control-plane/method-catalog-control-companion.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAkB1E,eAAO,MAAM,+CAA+C,EAAE,SAAS,uBAAuB,EAkI7F,CAAC"}