@tier0/sdk-v2 0.6.3 → 0.8.0

package/README.md

@@ -2,16 +2,24 @@
 
 Tier0 云端新架构的独立 TypeScript / JavaScript SDK。新仓库、新 npm 包，不覆盖 `@tier0/sdk`。
 
-要求 Node.js 20.19+。HTTP API 统一使用 `/openapi/v2`，Source、Stream、UNS 按领域提供入口；浏览器 HTTP、MQTT、React、Vue 和服务端身份验签分别提供独立入口。
+`0.8.0` 新增不兼容变更：Collection 声明必须同时提供业务名称 `name`（例如「生产工单」）和稳定程序标识 `alias`（例如 `production_orders`）。`name` 是唯一展示名称，不支持 `displayName`；重复 ensure 保留用户改名，同目录重名直接报错。高层声明与底层生成类型已统一，使用前需确认后端已包含 `business-name/1` 契约。新架构版本通过 npm `next` 标签发布。
 
-当前契约版本与后端提交见 [契约来源](contracts/upstream.json)。安装 SDK 后仍需确认目标环境已部署相应后端。
+`0.7.x` 包含不兼容变更：移除旧 Controls 入口、生成操作、DTO 和错误类，不保留别名。Stream 请求与消息交互使用独立 `@tier0/sdk`；本包继续负责数据和 Source/Stream 管理。能力发现不再以可选交互合同阻断 Namespace，未知核心合同仍严格拒绝。V2 的 `execution` / `retry` 和结果未知语义保持不变。
+
+`0.6.0` 的 HTTP Source 只保留 `protocol: http-api`，通过 `config.role: client | server` 区分主动请求与入站服务。旧 `http` / `http_push` 配置需要迁移；响应时机属于 Stream，不再建立独立异步 Source。同步 singlemodel 合同后，Source 配置不再带 configVersion，Stream 输入不再带 sdkVersion；保留完整 module.exports 程序与原生 script 对象/Runtime program 字符串两种既有形态，不能将旧 transform 函数体直接改名迁入。
+
+`0.4.0` 版本变更：相对 0.3.x 移除已退役的 Stream 就绪探针且不保留别名，改用服务端现有统一权限，不再配置逐 Key Control scopes/codes。0.3.0 起统一使用 OpenAPI v2 并退役重复及旧接口；与 0.2.x 存在不兼容变更，迁移方式见下方“本次接口退役”。对应 UNS v2 契约 5.0.0，与 0.1.0 不兼容（新错误模型 `execution` / `retry`、封顶计数、删除 `recordChangesPoll` 等）。Collection 支持 int、float、double 和 datetime 声明；格式注解不新增数值范围或日期格式校验，Sample 外层 time 保持不变。使用时需确认目标环境已部署对应后端。要求 Node.js 20.19+。浏览器 HTTP、MQTT、React、Vue 和服务端身份验签分别提供独立入口。
+
+合同快照的准确 Backend 提交和输入摘要见 contracts/upstream.json；使用前需确认目标环境已部署相应合同。请求统一权限、旧探针退役门禁、Source discovery 的副作用分类及不自动重试语义保持不变。
+
+既有接口收敛：平台接口统一迁移到 `/openapi/v2`；移除 21 个重复 UNS 入口和旧 Agent nodes/relations 方法。完善 Source 操作、Stream 发布回执及 UNS 创建快照的使用说明，保留精确发布编号和完整文档访问规则。
 
 ## 安装与初始化
 
 维护者发布前在本仓库运行 `npm ci`、`npm run check`，并验证生成的 `.tgz`。业务项目安装当前发布版本：
 
 ```sh
-npm install @tier0/sdk-v2
+npm install @tier0/sdk-v2@0.8.0
 ```
 
 ```ts
@@ -41,7 +49,6 @@ const user = await tier0.system.whoami();
 | `tier0.mqttAuth` | 创建、删除 MQTT 凭证 |
 | `tier0.agent` | `analyses`、`canvases`、`cards`、`jobs`、`jobRuns`、`library`、`results` |
 | `tier0.capabilities` | 当前凭证可见的能力发现；就绪状态由服务端判断 |
-| `tier0.controls` | Control 发现、描述、执行及结果未知错误 |
 | `tier0.api` | 44 个平台 OpenAPI v2 的完整生成接口；通常优先使用上面的领域入口 |
 | `@tier0/sdk-v2/mq` | MQTT WebSocket 客户端与 broker 地址工具；不进入根入口依赖图 |
 | `@tier0/sdk-v2/source` | `createSourceClient()`，独立 Source 客户端 |
@@ -52,18 +59,33 @@ const user = await tier0.system.whoami();
 | `@tier0/sdk-v2/data` | App 数据层：`defineCollection()` 声明集合（含 TTL）、`createDataClient()` 首次访问时 ensure，Mongo 风格读写、带总数分页与封顶计数、原子批量与 `transact`、`subscribe` 变更订阅、员工数据主体透传；自动幂等键、并发上限与按 `retry.safe` 重试；仅服务端，需要 `zod` 4 |
 | `@tier0/sdk-v2/data/define` | 集合声明与类型：`defineCollection()`、`Doc` / `NewDoc` 等、`compileCollection()`、`validateDocument()`；可进浏览器包，组件和 route 的客户端代码只从这里取声明和类型 |
 
-Workspace 成员不等于能使用某个 App 的成员；App 成员选择使用 `members.listApp`。
+集合声明必须分别提供稳定程序标识 `alias` 和业务名称 `name`，例如 `alias: 'production_orders'`、`name: '生产工单'`。目录、数据和引用直接用 name 展示，不提供 displayName 或名称回退；name 为 1–63 个 Unicode 字符，无首尾空白，不含 `/` 或空字符。ensure 按 alias 关联集合，仅首次创建设置 name，不覆盖用户改名。名称冲突时选择有区分度的业务名称，不拼随机后缀。
+
+不保留 UNS v1、旧 Flow、`getCurrentProjectId()`、project 成员查询或 `/gw/reload`。Workspace 成员不等于能使用某个 App 的成员，不可用前者在客户端猜测 App 权限。
+
+## 本次接口退役
+
+HTTP 调用统一使用 `/openapi/v2`。21 个重复 UNS 公共入口及生成方法直接移除，没有旧路由回退；升级 SDK 时需同时部署对应后端。
+
+- Source 的 list/get/create/update、connection.update 改用 documents.*；Stream 的 programs.get/create/update/validate/disable 改用 documents.*，停用同时携带 expectedRevision 与 expectedActiveRelease。
+- 低层 findOneAnd* 改用 updateOne/replaceOne/deleteOne 的 returnDocument；批量新增用 bulkWrite 的 insertOne 项；元数据单条读取用 metadataFind + limit:1，去重用 aggregate。
+- App 数据层的 insertMany、findOneAnd*、distinct 等便捷方法保留，由 SDK 映射到当前入口；insertMany 仍是单次原子请求，最多 200 项。
+- Agent 的旧 nodes.searchSemantic/indexSync 和 relations.list/teach 没有 v2 契约，不再导出。旧 Controls 便捷入口、操作、DTO 和错误类不再导出，也没有兼容别名。
+
+升级前应核对旧写请求的最终结果，包括集合初始化 seed。退役入口不再可调用，不能将未知结果的旧请求或幂等键直接改投新入口重做。当前入口的重试仍保留原路径、原键和原载荷。
+
+`client.capabilities.discover()` 使用 `POST /openapi/v2/capabilities/discover` 和空对象，返回直接 JSON。Cloud / Enterprise 使用同一发现合同，只消费 Namespace、Source、Stream 管理能力，不以 App 交互域的版本标签作为前置条件。Source / Stream 的 `operations` 分别描述读取、配置、运行等操作，保留 `reasonCode`、`checkedAt`、`validUntil` 和 `requiresResourceCheck`；领域整体不可用时，读取或安全停用仍可能可用。证明到期后重新发现，实际操作仍需服务端检查具体资源权限和依赖。发现不代表设备在线或操作已成功，不自动重试。
 
 ## Source、Stream 与 UNS 分域
 
-Source 负责连接外部系统，Stream 负责处理与运行，UNS 负责命名空间与业务数据。公开操作由固定的上游契约生成，业务入口按领域组织；Control 使用 `tier0.controls` 的专属契约。目录、Topic、集合基础 CRUD 统一使用 `metadata*`，查询、批量操作、软删除及恢复见 UNS Skill。
+Source 负责连接外部系统，Stream 负责处理与运行，UNS 负责命名空间与业务数据。公开操作由固定的上游契约生成，业务入口按领域组织。Stream 请求与消息交互使用独立包 `@tier0/sdk` 的 `client.streams.requests` / `client.streams.messages`；Scaffold 分别接入交互 SDK 和本数据 SDK。本包不重复提供 Stream 交互 API。目录、Topic、集合基础 CRUD 统一使用 `metadata*`，查询、批量操作、软删除及恢复见 UNS Skill。
 
 ```ts
 const sources = await tier0.source.documents.list({ page: 1, size: 20 });
 const programs = await tier0.stream.programs.list({ page: 1, size: 20 });
 ```
 
-HTTP Source 统一使用 `protocol: 'http-api'`，显式设置 `config.role: 'client'`（主动请求）或 `config.role: 'server'`（接收入站请求），与 Enterprise 一协议两角色保持一致；Cloud 管理文档的角色位于 config 内。Server 不能作为 Client 发起主动请求。HTTPServer 使用固定前缀 `/ingest/v1/{workspaceId}/{sourceId}`，业务路由注册在 Stream；普通返回在处理和提交完成后回复；HTTP `onRequest` 可通过一次 `await ctx.reply(...)` 先回复再继续，仍受超时、并发和权限限制，回复后不随客户端断线取消但可由 shutdown 取消，不保证崩溃重放。202 状态本身不证明处理完成。示例见 [HTTPServer Stream Skill](skills/tier0-sdk-v2/tier0-sdk-v2-stream/references/http-server.md)。使用 `source.protocols.list({})` 核对目标环境支持，再通过现有 `source.documents.*` 管理配置。HTTP Client 单条 inline 创建支持 Basic、Bearer、APIKey、OAuth 四类认证，凭据默认绑定 Source 基址 REQUEST，显式方法继续保留限制；独立 credentialCreate 仍为 coreOnly。SDK 不新增猜测的 HTTP In API；npm 管理 SDK 与执行器中的 Goja Stream 脚本 API 分开使用。
+HTTP Source 统一使用 `protocol: 'http-api'`，显式设置 `config.role: 'client'`（主动请求）或 `config.role: 'server'`（接收入站请求），与 Enterprise 一协议两角色保持一致；Cloud 管理文档的角色位于 config 内。Server 不能作为 Client 发起主动请求。HTTPServer 使用固定前缀 `/ingest/v1/{workspaceId}/{sourceId}`，业务路由注册在 Stream；普通返回在处理和提交完成后回复；HTTP `onRequest` 可通过一次 `await ctx.reply(...)` 先回复再继续，仍受超时、并发和权限限制，回复后不随客户端断线取消但可由 shutdown 取消，不保证崩溃重放。202 状态本身不证明处理完成。示例见 [HTTPServer Stream Skill](skills/tier0-sdk-v2/tier0-sdk-v2-stream/references/http-server.md)。使用 `source.protocols.list({})` 核对目标环境支持，再通过现有 `source.documents.*` 管理配置。HTTP Client 单条 inline 创建支持 Basic、Bearer、APIKey、OAuth 四类认证；普通创建省略 credentials.method，由服务端默认 REQUEST 基址绑定，真实 method/path/query 在 Stream 定义。Basic/Bearer 显式凭据方法同时限制精确 URL，OAuth 旧 GET 保留既有兼容语义，存量限制不自动扩大；独立 credentialCreate 仍为 coreOnly。SDK 不新增猜测的 HTTP In API；npm 管理 SDK 与执行器中的 Goja Stream 脚本 API 分开使用。
 
 Source/Stream 仍保留 `{ code, msg, requestId, data }` 响应以及 `UnsV2Error` 错误类型。Source 配置统一使用 `source.documents`；Stream 草稿统一通过 `stream.documents` 创建、读取、校验和修改，输入 `program` 与 `document` 二选一。发布和回滚仍走 `stream.programs`。保存、部署、运行成功分别判断。
 
@@ -71,7 +93,9 @@ Source/Stream 仍保留 `{ code, msg, requestId, data }` 响应以及 `UnsV2Erro
 - Stream 创建/更新回执的 revision 可直接用于发布；[发布回执](skills/tier0-sdk-v2/tier0-sdk-v2-stream/references/deploy.md) 的 activeRelease 用于观察这次发布，无需前后各查询一次。
 - 单条 Record 新增可用 [returnDocument:'after'](skills/tier0-sdk-v2/tier0-sdk-v2-uns/references/create.md) 同次取得创建快照；[App 数据层](skills/tier0-sdk-v2/tier0-sdk-v2-data/references/read-write.md) 支持相同选择及投影类型。
 
-随包提供 Skill：总入口 [tier0-sdk-v2](skills/tier0-sdk-v2/SKILL.md) 下嵌套 11 个领域子 Skill（`skills/tier0-sdk-v2/tier0-sdk-v2-<领域>/`），每个仍可独立发现，包含完整流程、参数边界、错误处理与可类型检查的示例：[Source](skills/tier0-sdk-v2/tier0-sdk-v2-source/SKILL.md)、[Stream](skills/tier0-sdk-v2/tier0-sdk-v2-stream/SKILL.md)、[UNS](skills/tier0-sdk-v2/tier0-sdk-v2-uns/SKILL.md)、[通知](skills/tier0-sdk-v2/tier0-sdk-v2-notifications/SKILL.md)、[系统](skills/tier0-sdk-v2/tier0-sdk-v2-system/SKILL.md)、[文件](skills/tier0-sdk-v2/tier0-sdk-v2-files/SKILL.md)、[MQTT](skills/tier0-sdk-v2/tier0-sdk-v2-mq/SKILL.md)、[成员](skills/tier0-sdk-v2/tier0-sdk-v2-members/SKILL.md)、[Controls](skills/tier0-sdk-v2/tier0-sdk-v2-controls/SKILL.md)、[Agent](skills/tier0-sdk-v2/tier0-sdk-v2-agent/SKILL.md)、[App 数据](skills/tier0-sdk-v2/tier0-sdk-v2-data/SKILL.md)。复杂流程的参考文档随 Skill 一起打包。在 Tier0 Console 上传时，把整个 `skills/tier0-sdk-v2/` 目录打成一个 zip。
+从最初提交迁移：`uns.sourceList` → `source.documents.list`；`uns.sourceDocumentGet` → `source.documents.get`；`uns.streamProgramDeploy` → `stream.programs.deploy`；`uns.streamDocumentValidate` → `stream.documents.validate`。这些管理方法已移出主入口的 `uns`。底层 `createUnsV2Client()` 仍提供完整生成契约供契约工具使用；数据专用客户端可用 `createUnsDataClient()`。
+
+随包提供 Skill：总入口 [tier0-sdk-v2](skills/tier0-sdk-v2/SKILL.md) 下嵌套 10 个领域子 Skill（`skills/tier0-sdk-v2/tier0-sdk-v2-<领域>/`），每个仍可独立发现，包含完整流程、参数边界、错误处理与可类型检查的示例：[Source](skills/tier0-sdk-v2/tier0-sdk-v2-source/SKILL.md)、[Stream](skills/tier0-sdk-v2/tier0-sdk-v2-stream/SKILL.md)、[UNS](skills/tier0-sdk-v2/tier0-sdk-v2-uns/SKILL.md)、[通知](skills/tier0-sdk-v2/tier0-sdk-v2-notifications/SKILL.md)、[系统](skills/tier0-sdk-v2/tier0-sdk-v2-system/SKILL.md)、[文件](skills/tier0-sdk-v2/tier0-sdk-v2-files/SKILL.md)、[MQTT](skills/tier0-sdk-v2/tier0-sdk-v2-mq/SKILL.md)、[成员](skills/tier0-sdk-v2/tier0-sdk-v2-members/SKILL.md)、[Agent](skills/tier0-sdk-v2/tier0-sdk-v2-agent/SKILL.md)、[App 数据](skills/tier0-sdk-v2/tier0-sdk-v2-data/SKILL.md)。复杂流程的参考文档随 Skill 一起打包。在 Tier0 Console 上传时，把整个 `skills/tier0-sdk-v2/` 目录打成一个 zip。
 
 ## UNS 数据访问
 
@@ -89,13 +113,15 @@ await tier0.uns.recordFind(
 );
 ```
 
+能力发现只校验本包的 Namespace/Source/Stream 管理合同，不要求全局交互标签；其他 SDK 的可选交互能力不阻断 Namespace。核心合同未知仍拒绝，不将方法存在当作授权或运行就绪。
+
 实际集合 ID 和有效权限从平台配置/数据上下文取得。管理操作中，App 凭证只能调用本 App 集合的 `appCollectionsEnsure` / `appCollectionsSchemaReplace` / `appCollectionsArchive` / `appCollectionsRestore`；SDK 中存在 `metadataInsertOne` 等其他管理方法，不表示 App 凭证有对应权限。App 数据授权 `appDataPolicyGet` / `appDataPolicyUpdate` 的调用方必须是：持有 `uns.write` 的登录会话、持有 `uns.write` 且 full_access、不绑定 App 的 personal / agent Key，或治理会话；运行时 App 凭证不能管理授权。Core-only 后台接口不导出到公开 SDK。
 
-UNS 保留 `{ code, msg, requestId, data }` 完整响应。平台 v2 包装接口返回已解包的 `data`，通知/能力发现返回直接对象，Control 外观解包 UNS 回执并保留直接结果对象。业务错误即使 HTTP 为 200 也会抛出 `ApiError`。
+UNS 保留 `{ code, msg, requestId, data }` 完整响应。平台 v2 包装接口返回已解包的 `data`，通知/能力发现返回直接对象。业务错误即使 HTTP 为 200 也会抛出 `ApiError`。
 
 `int64` 和平台整数字段使用 `number | bigint`：安全范围内返回 number，超出范围返回 bigint。UNS 任意 JSON 中无法无损表示的数字用 `UnsV2RawNumber`；传回 SDK 可保持原值。对外输出 JSON 时自行确定 bigint/精确数字的表示，不要直接 `JSON.stringify` 包含这些值的对象。
 
-`createClient()` 的 HTTP 操作不自动重试。UNS v2 错误带 `execution`（`notStarted` / `rolledBack` / `committed` / `unknown`）与 `retry: { safe, afterMs? }`：`safe` 表示可以用同一请求（同一幂等键）重发。`execution` 为 `unknown` 时抛出 `UnsV2OutcomeUnknownError`；它与 `ControlResultUnknownError`、`ApiError.outcomeUnknown` 一样表示写操作可能已执行，先读回对账，按业务意图保留原幂等键，不自动生成新键重放。查询与写入均可受配置超时约束。App 数据层 `@tier0/sdk-v2/data` 另有自己的策略：每次调用从开始算最多 25 秒（含排队与重试）、每进程最多 6 个并发请求、写入自动生成幂等键、按 `retry.safe` 最多自动重试 2 次；`runWithRequestContext(request, …)` 传入请求本身时，请求中止后排队中的调用不再发出。
+`createClient()` 的 HTTP 操作不自动重试。UNS v2 错误带 `execution`（`notStarted` / `rolledBack` / `committed` / `unknown`）与 `retry: { safe, afterMs? }`：`safe` 表示可以用同一请求（同一幂等键）重发。`execution` 为 `unknown` 时抛出 `UnsV2OutcomeUnknownError`；它与 `ApiError.outcomeUnknown` 一样表示写操作可能已执行，先读回对账，按业务意图保留原幂等键，不自动生成新键重放。查询与写入均可受配置超时约束。App 数据层 `@tier0/sdk-v2/data` 另有自己的策略：每次调用从开始算最多 25 秒（含排队与重试）、每进程最多 6 个并发请求、写入自动生成幂等键、按 `retry.safe` 最多自动重试 2 次；`runWithRequestContext(request, …)` 传入请求本身时，请求中止后排队中的调用不再发出。
 
 ## 通知
 

package/dist/cjs/capabilities.d.ts

@@ -1,20 +1,36 @@
 import { type CloudTransportConfig } from './cloud-transport.js';
 import { type HttpClient } from './openapi/client.js';
-export type CapabilityCode = 'namespace.v2' | 'source' | 'stream' | 'control.v1' | 'control.invoke.v1';
+export type CapabilityCode = 'namespace.v2' | 'source' | 'stream';
 export type CapabilityState = 'disabled' | 'not_supported' | 'unavailable' | 'readiness_unknown' | 'ready';
 export type CapabilityAvailability = 'unavailable' | 'unknown' | 'available';
-export interface PublicCapability {
+export interface CapabilityDiagnostics {
+    reasonCode?: string;
+    checkedAt?: string;
+    validUntil?: string;
+    retryAfterMs?: number;
+}
+export interface CapabilityOperation extends CapabilityDiagnostics {
+    operation: string;
+    releaseEnabled: boolean;
+    enabled: boolean;
+    allowed: boolean;
+    state: CapabilityState;
+    availability: CapabilityAvailability;
+    requiresResourceCheck: boolean;
+}
+export interface PublicCapability extends CapabilityDiagnostics {
     code: CapabilityCode;
     /** Public release and workspace gates; does not establish runtime readiness. */
     releaseEnabled: boolean;
     /** Server-assessed implementation/readiness, never inferred from releaseEnabled. */
     enabled: boolean;
-    /** Authorization summary, not a grant for every individual Control code. */
+    /** Authorization summary, not authorization for an individual operation. */
     allowed: boolean;
     state: CapabilityState;
     /** Not device online status or execution/ACK confirmation. */
     availability: CapabilityAvailability;
     contractVersions: string[];
+    operations?: CapabilityOperation[];
 }
 export interface CapabilityDeprecation {
     contract: string;
@@ -22,7 +38,7 @@ export interface CapabilityDeprecation {
     sunsetAt?: string;
 }
 export interface CapabilityDiscoverResponse {
-    product: 'cloud';
+    product: 'cloud' | 'enterprise';
     /** Trusted server configuration only; absent when unconfigured. */
     productVersion?: string;
     contractVersion: '1.0';

package/dist/cjs/capabilities.js

@@ -19,8 +19,6 @@ const contracts = {
     'namespace.v2': ['openapi/v2'],
     'source': ['openapi/v2'],
     'stream': ['openapi/v2'],
-    'control.v1': ['openapi/v1', 'control/v1'],
-    'control.invoke.v1': ['openapi/v1', 'control/v1'],
 };
 function record(value) {
     return value !== null && typeof value === 'object' && !Array.isArray(value);
@@ -31,6 +29,67 @@ function text(value) {
 function strings(value) {
     return Array.isArray(value) && value.every(text) && new Set(value).size === value.length;
 }
+function diagnostics(value, fail) {
+    const result = {};
+    for (const field of ['reasonCode', 'checkedAt', 'validUntil']) {
+        if (value[field] === undefined)
+            continue;
+        if (!text(value[field]))
+            return fail();
+        if (field !== 'reasonCode' && (!/^\d{4}-\d\d-\d\d[Tt]\d\d:\d\d:\d\d(?:\.\d+)?(?:[Zz]|[+-]\d\d:\d\d)$/.test(value[field]) ||
+            !Number.isFinite(Date.parse(value[field]))))
+            return fail();
+        result[field] = value[field];
+    }
+    if (value.retryAfterMs !== undefined) {
+        if (typeof value.retryAfterMs !== 'number' || !Number.isSafeInteger(value.retryAfterMs) || value.retryAfterMs < 0)
+            return fail();
+        result.retryAfterMs = value.retryAfterMs;
+    }
+    if (result.validUntil !== undefined && (value.state !== 'ready' || result.checkedAt === undefined ||
+        Date.parse(result.validUntil) <= Date.parse(result.checkedAt)))
+        return fail();
+    return result;
+}
+const sourceOperations = ['read', 'configure', 'test', 'discover', 'enable', 'disable'];
+const streamOperations = ['read', 'configure', 'validate', 'deploy', 'execute', 'disable'];
+const resourceOperations = {
+    source: ['test', 'discover', 'enable'],
+    stream: ['deploy', 'execute'],
+};
+function operationFields(value, code, fail) {
+    if (value.operations === undefined)
+        return {};
+    if (!Array.isArray(value.operations))
+        return fail();
+    const operations = [];
+    const supported = code === 'source' ? sourceOperations : code === 'stream' ? streamOperations : [];
+    const seen = new Set();
+    for (const item of value.operations) {
+        if (!record(item) || !text(item.operation))
+            return fail();
+        if (!supported.includes(item.operation))
+            continue;
+        if (seen.has(item.operation))
+            return fail();
+        seen.add(item.operation);
+        const ready = item.state === 'ready';
+        const expected = ready ? 'available' : item.state === 'readiness_unknown' ? 'unknown' : 'unavailable';
+        if (typeof item.releaseEnabled !== 'boolean' || typeof item.enabled !== 'boolean' || typeof item.allowed !== 'boolean' ||
+            typeof item.requiresResourceCheck !== 'boolean' ||
+            (resourceOperations[code]?.includes(item.operation) && !item.requiresResourceCheck) ||
+            (value.releaseEnabled === false && item.releaseEnabled !== false) ||
+            !['disabled', 'not_supported', 'unavailable', 'readiness_unknown', 'ready'].includes(item.state) ||
+            item.availability !== expected || item.enabled !== ready ||
+            (ready && (!item.releaseEnabled || !item.allowed)) ||
+            (item.state === 'disabled' ? item.releaseEnabled : !item.releaseEnabled))
+            return fail();
+        operations.push({ operation: item.operation, releaseEnabled: item.releaseEnabled, enabled: item.enabled,
+            allowed: item.allowed, state: item.state, availability: item.availability,
+            requiresResourceCheck: item.requiresResourceCheck, ...diagnostics(item, fail) });
+    }
+    return { operations };
+}
 /** Validate and explicitly project the frozen contract; unknown capabilities/extension fields are ignored. */
 function discovery(value, status) {
     const fail = (version = false) => {
@@ -45,9 +104,8 @@ function discovery(value, status) {
         !Array.isArray(value.capabilities) || !Array.isArray(value.deprecations) ||
         (value.productVersion !== undefined && !text(value.productVersion)))
         return fail();
-    if (value.product !== 'cloud' || value.contractVersion !== '1.0' ||
-        !value.apiContractVersions.includes('openapi/v2') ||
-        !value.sdkContractVersions.includes('control/v1'))
+    if (!['cloud', 'enterprise'].includes(value.product) || value.contractVersion !== '1.0' ||
+        !value.apiContractVersions.includes('openapi/v2'))
         return fail(true);
     const capabilities = [];
     const seen = new Set();
@@ -77,6 +135,8 @@ function discovery(value, status) {
             code, releaseEnabled: item.releaseEnabled, enabled: item.enabled, allowed: item.allowed,
             state: item.state, availability: item.availability,
             contractVersions: [...item.contractVersions],
+            ...diagnostics(item, fail),
+            ...operationFields(item, code, fail),
         });
     }
     const deprecations = [];
@@ -91,7 +151,7 @@ function discovery(value, status) {
         });
     }
     return {
-        product: 'cloud', ...(value.productVersion === undefined ? {} : { productVersion: value.productVersion }),
+        product: value.product, ...(value.productVersion === undefined ? {} : { productVersion: value.productVersion }),
         contractVersion: '1.0', apiContractVersions: [...value.apiContractVersions],
         sdkContractVersions: [...value.sdkContractVersions],
         capabilities, deprecations,

package/dist/cjs/capabilities.js.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../../src/capabilities.ts"],"names":[],"mappings":";;;AAAA,6DAAsG;AACtG,mDAAiE;AA4CjE,MAAa,eAAgB,SAAQ,KAAK;IAC/B,MAAM,CAAU;IAChB,SAAS,CAAS;IAClB,SAAS,GAAG,KAAK,CAAC;IAE3B,YAAY,OAAe,EAAE,IAAyB;QACpD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,CAAC;CACF;AAXD,0CAWC;AAED,MAAM,SAAS,GAAqC;IAClD,cAAc,EAAE,CAAC,YAAY,CAAC;IAC9B,QAAQ,EAAE,CAAC,YAAY,CAAC;IACxB,QAAQ,EAAE,CAAC,YAAY,CAAC;IACxB,YAAY,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;IAC1C,mBAAmB,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;CAClD,CAAC;AAEF,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AACD,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AACD,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC;AAC3F,CAAC;AAED,8GAA8G;AAC9G,SAAS,SAAS,CAAC,KAAc,EAAE,MAAc;IAC/C,MAAM,IAAI,GAAG,CAAC,OAAO,GAAG,KAAK,EAAS,EAAE;QACtC,MAAM,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,wCAAwC,EAAE;YACzH,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,2BAA2B;SAC5F,CAAC,CAAC;IACL,CAAC,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;QACpD,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC;QAC1E,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;QACxE,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IACvF,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,eAAe,KAAK,KAAK;QAC5D,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,YAAY,CAAC;QACjD,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IAEzE,MAAM,YAAY,GAAuB,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAsB,CAAC;QACzC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS;YAClH,CAAC,CAAC,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAe,CAAC;YAC1G,CAAC,CAAC,aAAa,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACrI,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CACjC,CAAE,IAAI,CAAC,gBAA6B,CAAC,QAAQ,CAAC,OAAO,CAAC;YACtD,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAE,KAAK,CAAC,mBAAgC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;QACrH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC;QACrC,MAAM,oBAAoB,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC;QAClH,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,YAAY,KAAK,oBAAoB;YACpE,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClD,CAAC,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAC5F,YAAY,CAAC,IAAI,CAAC;YAChB,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO;YACvF,KAAK,EAAE,IAAI,CAAC,KAAwB,EAAE,YAAY,EAAE,IAAI,CAAC,YAAsC;YAC/F,gBAAgB,EAAE,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC;SAC7C,CAAC,CAAC;IACL,CAAC;IACD,MAAM,YAAY,GAA4B,EAAE,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;YACrC,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC3D,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACzE,YAAY,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACzC,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAqB,EAAE,CAAC;YACtF,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAkB,EAAE,CAAC;SAC9E,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAwB,EAAE,CAAC;QACnH,eAAe,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,GAAG,KAAK,CAAC,mBAAmB,CAAC;QAC3E,mBAAmB,EAAE,CAAC,GAAG,KAAK,CAAC,mBAAmB,CAAC;QACnD,YAAY,EAAE,YAAY;KAC3B,CAAC;AACJ,CAAC;AAED,MAAa,kBAAkB;IACZ,SAAS,CAAiB;IAE3C,YAAY,gBAAkC,qBAAS,EAAE,SAA+B,EAAE;QACxF,IAAI,CAAC,SAAS,GAAG,IAAI,mCAAc,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;IAED,yGAAyG;IACzG,KAAK,CAAC,QAAQ;QACZ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,uDAAuD,CAAC,CAAC;QACzG,IAAI,QAAqD,CAAC;QAC1D,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,wCAAmB,CAAC;gBAAE,MAAM,KAAK,CAAC;YACzD,MAAM,IAAI,eAAe,CAAC,4CAA4C,EAAE;gBACtE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,KAAK,CAAC,IAAI,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAC;QACvC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAClF,MAAM,IAAI,eAAe,CAAC,oCAAoC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACtH,CAAC;YACD,MAAM,IAAI,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;CACF;AA5BD,gDA4BC;AAED,sGAAsG;AACzF,QAAA,YAAY,GAAG,IAAI,kBAAkB,EAAE,CAAC","sourcesContent":["import { CloudTransport, CloudTransportError, type CloudTransportConfig } from './cloud-transport.js';\nimport { getClient, type HttpClient } from './openapi/client.js';\n\nexport type CapabilityCode = 'namespace.v2' | 'source' | 'stream' | 'control.v1' | 'control.invoke.v1';\nexport type CapabilityState = 'disabled' | 'not_supported' | 'unavailable' | 'readiness_unknown' | 'ready';\nexport type CapabilityAvailability = 'unavailable' | 'unknown' | 'available';\n\nexport interface PublicCapability {\n  code: CapabilityCode;\n  /** Public release and workspace gates; does not establish runtime readiness. */\n  releaseEnabled: boolean;\n  /** Server-assessed implementation/readiness, never inferred from releaseEnabled. */\n  enabled: boolean;\n  /** Authorization summary, not a grant for every individual Control code. */\n  allowed: boolean;\n  state: CapabilityState;\n  /** Not device online status or execution/ACK confirmation. */\n  availability: CapabilityAvailability;\n  contractVersions: string[];\n}\n\nexport interface CapabilityDeprecation {\n  contract: string;\n  replacement?: string;\n  sunsetAt?: string;\n}\n\nexport interface CapabilityDiscoverResponse {\n  product: 'cloud';\n  /** Trusted server configuration only; absent when unconfigured. */\n  productVersion?: string;\n  contractVersion: '1.0';\n  apiContractVersions: string[];\n  /** Public SDK contract labels, not npm package versions. */\n  sdkContractVersions: string[];\n  capabilities: PublicCapability[];\n  deprecations: CapabilityDeprecation[];\n}\n\nexport interface CapabilityErrorInfo {\n  status?: number;\n  /** Gateway string code (including unknown future codes), or an SDK-local CAPABILITY_* code. */\n  errorCode: string;\n}\n\nexport class CapabilityError extends Error {\n  readonly status?: number;\n  readonly errorCode: string;\n  readonly retryable = false;\n\n  constructor(message: string, info: CapabilityErrorInfo) {\n    super(message);\n    this.name = 'CapabilityError';\n    this.status = info.status;\n    this.errorCode = info.errorCode;\n  }\n}\n\nconst contracts: Record<CapabilityCode, string[]> = {\n  'namespace.v2': ['openapi/v2'],\n  'source': ['openapi/v2'],\n  'stream': ['openapi/v2'],\n  'control.v1': ['openapi/v1', 'control/v1'],\n  'control.invoke.v1': ['openapi/v1', 'control/v1'],\n};\n\nfunction record(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value);\n}\nfunction text(value: unknown): value is string {\n  return typeof value === 'string' && value.length > 0;\n}\nfunction strings(value: unknown): value is string[] {\n  return Array.isArray(value) && value.every(text) && new Set(value).size === value.length;\n}\n\n/** Validate and explicitly project the frozen contract; unknown capabilities/extension fields are ignored. */\nfunction discovery(value: unknown, status: number): CapabilityDiscoverResponse {\n  const fail = (version = false): never => {\n    throw new CapabilityError(version ? 'Unsupported capability contract version.' : 'Invalid capability discovery response.', {\n      status, errorCode: version ? 'CAPABILITY_UNSUPPORTED_VERSION' : 'CAPABILITY_PROTOCOL_ERROR',\n    });\n  };\n  if (!record(value)) return fail();\n  if (!text(value.product) || !text(value.contractVersion) ||\n      !strings(value.apiContractVersions) || !strings(value.sdkContractVersions) ||\n      !Array.isArray(value.capabilities) || !Array.isArray(value.deprecations) ||\n      (value.productVersion !== undefined && !text(value.productVersion))) return fail();\n  if (value.product !== 'cloud' || value.contractVersion !== '1.0' ||\n      !value.apiContractVersions.includes('openapi/v2') ||\n      !value.sdkContractVersions.includes('control/v1')) return fail(true);\n\n  const capabilities: PublicCapability[] = [];\n  const seen = new Set<string>();\n  for (const item of value.capabilities) {\n    if (!record(item) || !text(item.code)) return fail();\n    if (!Object.prototype.hasOwnProperty.call(contracts, item.code)) continue;\n    const code = item.code as CapabilityCode;\n    if (seen.has(code)) return fail();\n    seen.add(code);\n    if (typeof item.releaseEnabled !== 'boolean' || typeof item.enabled !== 'boolean' || typeof item.allowed !== 'boolean' ||\n        !['disabled', 'not_supported', 'unavailable', 'readiness_unknown', 'ready'].includes(item.state as string) ||\n        !['unavailable', 'unknown', 'available'].includes(item.availability as string) || !strings(item.contractVersions)) return fail();\n    if (contracts[code].some(version =>\n      !(item.contractVersions as string[]).includes(version) ||\n      (version.startsWith('openapi/') && !(value.apiContractVersions as string[]).includes(version)))) return fail(true);\n    const ready = item.state === 'ready';\n    const expectedAvailability = ready ? 'available' : item.state === 'readiness_unknown' ? 'unknown' : 'unavailable';\n    if (item.enabled !== ready || item.availability !== expectedAvailability ||\n        (ready && (!item.releaseEnabled || !item.allowed)) ||\n        (item.state === 'disabled' ? item.releaseEnabled : !item.releaseEnabled)) return fail();\n    capabilities.push({\n      code, releaseEnabled: item.releaseEnabled, enabled: item.enabled, allowed: item.allowed,\n      state: item.state as CapabilityState, availability: item.availability as CapabilityAvailability,\n      contractVersions: [...item.contractVersions],\n    });\n  }\n  const deprecations: CapabilityDeprecation[] = [];\n  for (const item of value.deprecations) {\n    if (!record(item) || !text(item.contract) ||\n        (item.replacement !== undefined && !text(item.replacement)) ||\n        (item.sunsetAt !== undefined && !text(item.sunsetAt))) return fail();\n    deprecations.push({ contract: item.contract,\n      ...(item.replacement === undefined ? {} : { replacement: item.replacement as string }),\n      ...(item.sunsetAt === undefined ? {} : { sunsetAt: item.sunsetAt as string }),\n    });\n  }\n  return {\n    product: 'cloud', ...(value.productVersion === undefined ? {} : { productVersion: value.productVersion as string }),\n    contractVersion: '1.0', apiContractVersions: [...value.apiContractVersions],\n    sdkContractVersions: [...value.sdkContractVersions],\n    capabilities, deprecations,\n  };\n}\n\nexport class CapabilitiesClient {\n  private readonly transport: CloudTransport;\n\n  constructor(resolveClient: () => HttpClient = getClient, config: CloudTransportConfig = {}) {\n    this.transport = new CloudTransport(resolveClient, config);\n  }\n\n  /** Workspace comes exclusively from the authenticated key. One POST, no automatic retries or caching. */\n  async discover(): Promise<CapabilityDiscoverResponse> {\n    if (arguments.length !== 0) throw new TypeError('Tier0 SDK: capability discovery accepts no arguments.');\n    let response: Awaited<ReturnType<CloudTransport['post']>>;\n    try {\n      response = await this.transport.post('/openapi/v2/capabilities/discover', {});\n    } catch (error) {\n      if (!(error instanceof CloudTransportError)) throw error;\n      throw new CapabilityError('Capability discovery HTTP exchange failed.', {\n        status: error.status, errorCode: `CAPABILITY_${error.kind}`,\n      });\n    }\n    const { value, status, ok } = response;\n    if (!ok) {\n      if (!record(value) || !text(value.errorCode) || typeof value.message !== 'string') {\n        throw new CapabilityError('Invalid capability error response.', { status, errorCode: 'CAPABILITY_PROTOCOL_ERROR' });\n      }\n      throw new CapabilityError(value.message, { status, errorCode: value.errorCode });\n    }\n    return discovery(value, status);\n  }\n}\n\n/** Uses configureClient()/runtime environment, resolving the host and workspace key on every call. */\nexport const capabilities = new CapabilitiesClient();\n"]}
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../../src/capabilities.ts"],"names":[],"mappings":";;;AAAA,6DAAsG;AACtG,mDAAiE;AA8DjE,MAAa,eAAgB,SAAQ,KAAK;IAC/B,MAAM,CAAU;IAChB,SAAS,CAAS;IAClB,SAAS,GAAG,KAAK,CAAC;IAE3B,YAAY,OAAe,EAAE,IAAyB;QACpD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IAClC,CAAC;CACF;AAXD,0CAWC;AAED,MAAM,SAAS,GAAqC;IAClD,cAAc,EAAE,CAAC,YAAY,CAAC;IAC9B,QAAQ,EAAE,CAAC,YAAY,CAAC;IACxB,QAAQ,EAAE,CAAC,YAAY,CAAC;CACzB,CAAC;AAEF,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AACD,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AACD,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC;AAC3F,CAAC;AAGD,SAAS,WAAW,CAAC,KAA8B,EAAE,IAAiB;IACpE,MAAM,MAAM,GAA0B,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,YAAY,CAAU,EAAE,CAAC;QACvE,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,SAAS;YAAE,SAAS;QACzC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACvC,IAAI,KAAK,KAAK,YAAY,IAAI,CAAC,CAAC,qEAAqE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpH,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAC/D,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACrC,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,YAAY,GAAG,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACjI,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IAC3C,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,OAAO,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAC7F,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IAClF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AACxF,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AAC3F,MAAM,kBAAkB,GAAuD;IAC7E,MAAM,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC;IACtC,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;CAC9B,CAAC;AAEF,SAAS,eAAe,CAAC,KAA8B,EAAE,IAAoB,EAAE,IAAiB;IAC9F,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IACpD,MAAM,UAAU,GAA0B,EAAE,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;IACnG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAC1D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,SAAS;QAClD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC;QACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC;QACtG,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS;YAClH,OAAO,IAAI,CAAC,qBAAqB,KAAK,SAAS;YAC/C,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC;YACnF,CAAC,KAAK,CAAC,cAAc,KAAK,KAAK,IAAI,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC;YACjE,CAAC,CAAC,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAe,CAAC;YAC1G,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK;YACxD,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClD,CAAC,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAC5F,UAAU,CAAC,IAAI,CAAC,EAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO;YACpG,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAwB,EAAE,YAAY,EAAE,IAAI,CAAC,YAAsC;YACtH,qBAAqB,EAAE,IAAI,CAAC,qBAAqB,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,EAAC,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,CAAC;AACxB,CAAC;AAED,8GAA8G;AAC9G,SAAS,SAAS,CAAC,KAAc,EAAE,MAAc;IAC/C,MAAM,IAAI,GAAG,CAAC,OAAO,GAAG,KAAK,EAAS,EAAE;QACtC,MAAM,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,wCAAwC,EAAE;YACzH,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,2BAA2B;SAC5F,CAAC,CAAC;IACL,CAAC,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;QACpD,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC;QAC1E,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC;QACxE,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAAE,OAAO,IAAI,EAAE,CAAC;IACvF,IAAI,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,eAAe,KAAK,KAAK;QACnF,CAAC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IAEzE,MAAM,YAAY,GAAuB,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAsB,CAAC;QACzC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS;YAClH,CAAC,CAAC,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,mBAAmB,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAe,CAAC;YAC1G,CAAC,CAAC,aAAa,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACrI,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CACjC,CAAE,IAAI,CAAC,gBAA6B,CAAC,QAAQ,CAAC,OAAO,CAAC;YACtD,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAE,KAAK,CAAC,mBAAgC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;QACrH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,OAAO,CAAC;QACrC,MAAM,oBAAoB,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC;QAClH,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,YAAY,KAAK,oBAAoB;YACpE,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClD,CAAC,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAC5F,YAAY,CAAC,IAAI,CAAC;YAChB,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO;YACvF,KAAK,EAAE,IAAI,CAAC,KAAwB,EAAE,YAAY,EAAE,IAAI,CAAC,YAAsC;YAC/F,gBAAgB,EAAE,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC;YAC5C,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC;YAC1B,GAAG,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;SACrC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,YAAY,GAA4B,EAAE,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;YACrC,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC3D,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QACzE,YAAY,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACzC,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAqB,EAAE,CAAC;YACtF,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAkB,EAAE,CAAC;SAC9E,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAgD,EAAE,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAwB,EAAE,CAAC;QAClK,eAAe,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,GAAG,KAAK,CAAC,mBAAmB,CAAC;QAC3E,mBAAmB,EAAE,CAAC,GAAG,KAAK,CAAC,mBAAmB,CAAC;QACnD,YAAY,EAAE,YAAY;KAC3B,CAAC;AACJ,CAAC;AAED,MAAa,kBAAkB;IACZ,SAAS,CAAiB;IAE3C,YAAY,gBAAkC,qBAAS,EAAE,SAA+B,EAAE;QACxF,IAAI,CAAC,SAAS,GAAG,IAAI,mCAAc,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;IAED,yGAAyG;IACzG,KAAK,CAAC,QAAQ;QACZ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,uDAAuD,CAAC,CAAC;QACzG,IAAI,QAAqD,CAAC;QAC1D,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,wCAAmB,CAAC;gBAAE,MAAM,KAAK,CAAC;YACzD,MAAM,IAAI,eAAe,CAAC,4CAA4C,EAAE;gBACtE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,KAAK,CAAC,IAAI,EAAE;aAC5D,CAAC,CAAC;QACL,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAC;QACvC,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAClF,MAAM,IAAI,eAAe,CAAC,oCAAoC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACtH,CAAC;YACD,MAAM,IAAI,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;CACF;AA5BD,gDA4BC;AAED,sGAAsG;AACzF,QAAA,YAAY,GAAG,IAAI,kBAAkB,EAAE,CAAC","sourcesContent":["import { CloudTransport, CloudTransportError, type CloudTransportConfig } from './cloud-transport.js';\nimport { getClient, type HttpClient } from './openapi/client.js';\n\nexport type CapabilityCode = 'namespace.v2' | 'source' | 'stream';\nexport type CapabilityState = 'disabled' | 'not_supported' | 'unavailable' | 'readiness_unknown' | 'ready';\nexport type CapabilityAvailability = 'unavailable' | 'unknown' | 'available';\n\nexport interface CapabilityDiagnostics {\n  reasonCode?: string;\n  checkedAt?: string;\n  validUntil?: string;\n  retryAfterMs?: number;\n}\n\nexport interface CapabilityOperation extends CapabilityDiagnostics {\n  operation: string;\n  releaseEnabled: boolean;\n  enabled: boolean;\n  allowed: boolean;\n  state: CapabilityState;\n  availability: CapabilityAvailability;\n  requiresResourceCheck: boolean;\n}\n\nexport interface PublicCapability extends CapabilityDiagnostics {\n  code: CapabilityCode;\n  /** Public release and workspace gates; does not establish runtime readiness. */\n  releaseEnabled: boolean;\n  /** Server-assessed implementation/readiness, never inferred from releaseEnabled. */\n  enabled: boolean;\n  /** Authorization summary, not authorization for an individual operation. */\n  allowed: boolean;\n  state: CapabilityState;\n  /** Not device online status or execution/ACK confirmation. */\n  availability: CapabilityAvailability;\n  contractVersions: string[];\n  operations?: CapabilityOperation[];\n}\n\nexport interface CapabilityDeprecation {\n  contract: string;\n  replacement?: string;\n  sunsetAt?: string;\n}\n\nexport interface CapabilityDiscoverResponse {\n  product: 'cloud' | 'enterprise';\n  /** Trusted server configuration only; absent when unconfigured. */\n  productVersion?: string;\n  contractVersion: '1.0';\n  apiContractVersions: string[];\n  /** Public SDK contract labels, not npm package versions. */\n  sdkContractVersions: string[];\n  capabilities: PublicCapability[];\n  deprecations: CapabilityDeprecation[];\n}\n\nexport interface CapabilityErrorInfo {\n  status?: number;\n  /** Gateway string code (including unknown future codes), or an SDK-local CAPABILITY_* code. */\n  errorCode: string;\n}\n\nexport class CapabilityError extends Error {\n  readonly status?: number;\n  readonly errorCode: string;\n  readonly retryable = false;\n\n  constructor(message: string, info: CapabilityErrorInfo) {\n    super(message);\n    this.name = 'CapabilityError';\n    this.status = info.status;\n    this.errorCode = info.errorCode;\n  }\n}\n\nconst contracts: Record<CapabilityCode, string[]> = {\n  'namespace.v2': ['openapi/v2'],\n  'source': ['openapi/v2'],\n  'stream': ['openapi/v2'],\n};\n\nfunction record(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value);\n}\nfunction text(value: unknown): value is string {\n  return typeof value === 'string' && value.length > 0;\n}\nfunction strings(value: unknown): value is string[] {\n  return Array.isArray(value) && value.every(text) && new Set(value).size === value.length;\n}\n\n\nfunction diagnostics(value: Record<string, unknown>, fail: () => never): CapabilityDiagnostics {\n  const result: CapabilityDiagnostics = {};\n  for (const field of ['reasonCode', 'checkedAt', 'validUntil'] as const) {\n    if (value[field] === undefined) continue;\n    if (!text(value[field])) return fail();\n    if (field !== 'reasonCode' && (!/^\\d{4}-\\d\\d-\\d\\d[Tt]\\d\\d:\\d\\d:\\d\\d(?:\\.\\d+)?(?:[Zz]|[+-]\\d\\d:\\d\\d)$/.test(value[field]) ||\n        !Number.isFinite(Date.parse(value[field])))) return fail();\n    result[field] = value[field];\n  }\n  if (value.retryAfterMs !== undefined) {\n    if (typeof value.retryAfterMs !== 'number' || !Number.isSafeInteger(value.retryAfterMs) || value.retryAfterMs < 0) return fail();\n    result.retryAfterMs = value.retryAfterMs;\n  }\n  if (result.validUntil !== undefined && (value.state !== 'ready' || result.checkedAt === undefined ||\n      Date.parse(result.validUntil) <= Date.parse(result.checkedAt))) return fail();\n  return result;\n}\n\nconst sourceOperations = ['read', 'configure', 'test', 'discover', 'enable', 'disable'];\nconst streamOperations = ['read', 'configure', 'validate', 'deploy', 'execute', 'disable'];\nconst resourceOperations: Partial<Record<CapabilityCode, readonly string[]>> = {\n  source: ['test', 'discover', 'enable'],\n  stream: ['deploy', 'execute'],\n};\n\nfunction operationFields(value: Record<string, unknown>, code: CapabilityCode, fail: () => never): { operations?: CapabilityOperation[] } {\n  if (value.operations === undefined) return {};\n  if (!Array.isArray(value.operations)) return fail();\n  const operations: CapabilityOperation[] = [];\n  const supported = code === 'source' ? sourceOperations : code === 'stream' ? streamOperations : [];\n  const seen = new Set<string>();\n  for (const item of value.operations) {\n    if (!record(item) || !text(item.operation)) return fail();\n    if (!supported.includes(item.operation)) continue;\n    if (seen.has(item.operation)) return fail();\n    seen.add(item.operation);\n    const ready = item.state === 'ready';\n    const expected = ready ? 'available' : item.state === 'readiness_unknown' ? 'unknown' : 'unavailable';\n    if (typeof item.releaseEnabled !== 'boolean' || typeof item.enabled !== 'boolean' || typeof item.allowed !== 'boolean' ||\n        typeof item.requiresResourceCheck !== 'boolean' ||\n        (resourceOperations[code]?.includes(item.operation) && !item.requiresResourceCheck) ||\n        (value.releaseEnabled === false && item.releaseEnabled !== false) ||\n        !['disabled', 'not_supported', 'unavailable', 'readiness_unknown', 'ready'].includes(item.state as string) ||\n        item.availability !== expected || item.enabled !== ready ||\n        (ready && (!item.releaseEnabled || !item.allowed)) ||\n        (item.state === 'disabled' ? item.releaseEnabled : !item.releaseEnabled)) return fail();\n    operations.push({operation: item.operation, releaseEnabled: item.releaseEnabled, enabled: item.enabled,\n      allowed: item.allowed, state: item.state as CapabilityState, availability: item.availability as CapabilityAvailability,\n      requiresResourceCheck: item.requiresResourceCheck, ...diagnostics(item, fail)});\n  }\n  return { operations };\n}\n\n/** Validate and explicitly project the frozen contract; unknown capabilities/extension fields are ignored. */\nfunction discovery(value: unknown, status: number): CapabilityDiscoverResponse {\n  const fail = (version = false): never => {\n    throw new CapabilityError(version ? 'Unsupported capability contract version.' : 'Invalid capability discovery response.', {\n      status, errorCode: version ? 'CAPABILITY_UNSUPPORTED_VERSION' : 'CAPABILITY_PROTOCOL_ERROR',\n    });\n  };\n  if (!record(value)) return fail();\n  if (!text(value.product) || !text(value.contractVersion) ||\n      !strings(value.apiContractVersions) || !strings(value.sdkContractVersions) ||\n      !Array.isArray(value.capabilities) || !Array.isArray(value.deprecations) ||\n      (value.productVersion !== undefined && !text(value.productVersion))) return fail();\n  if (!['cloud', 'enterprise'].includes(value.product) || value.contractVersion !== '1.0' ||\n      !value.apiContractVersions.includes('openapi/v2')) return fail(true);\n\n  const capabilities: PublicCapability[] = [];\n  const seen = new Set<string>();\n  for (const item of value.capabilities) {\n    if (!record(item) || !text(item.code)) return fail();\n    if (!Object.prototype.hasOwnProperty.call(contracts, item.code)) continue;\n    const code = item.code as CapabilityCode;\n    if (seen.has(code)) return fail();\n    seen.add(code);\n    if (typeof item.releaseEnabled !== 'boolean' || typeof item.enabled !== 'boolean' || typeof item.allowed !== 'boolean' ||\n        !['disabled', 'not_supported', 'unavailable', 'readiness_unknown', 'ready'].includes(item.state as string) ||\n        !['unavailable', 'unknown', 'available'].includes(item.availability as string) || !strings(item.contractVersions)) return fail();\n    if (contracts[code].some(version =>\n      !(item.contractVersions as string[]).includes(version) ||\n      (version.startsWith('openapi/') && !(value.apiContractVersions as string[]).includes(version)))) return fail(true);\n    const ready = item.state === 'ready';\n    const expectedAvailability = ready ? 'available' : item.state === 'readiness_unknown' ? 'unknown' : 'unavailable';\n    if (item.enabled !== ready || item.availability !== expectedAvailability ||\n        (ready && (!item.releaseEnabled || !item.allowed)) ||\n        (item.state === 'disabled' ? item.releaseEnabled : !item.releaseEnabled)) return fail();\n    capabilities.push({\n      code, releaseEnabled: item.releaseEnabled, enabled: item.enabled, allowed: item.allowed,\n      state: item.state as CapabilityState, availability: item.availability as CapabilityAvailability,\n      contractVersions: [...item.contractVersions],\n      ...diagnostics(item, fail),\n      ...operationFields(item, code, fail),\n    });\n  }\n  const deprecations: CapabilityDeprecation[] = [];\n  for (const item of value.deprecations) {\n    if (!record(item) || !text(item.contract) ||\n        (item.replacement !== undefined && !text(item.replacement)) ||\n        (item.sunsetAt !== undefined && !text(item.sunsetAt))) return fail();\n    deprecations.push({ contract: item.contract,\n      ...(item.replacement === undefined ? {} : { replacement: item.replacement as string }),\n      ...(item.sunsetAt === undefined ? {} : { sunsetAt: item.sunsetAt as string }),\n    });\n  }\n  return {\n    product: value.product as CapabilityDiscoverResponse['product'], ...(value.productVersion === undefined ? {} : { productVersion: value.productVersion as string }),\n    contractVersion: '1.0', apiContractVersions: [...value.apiContractVersions],\n    sdkContractVersions: [...value.sdkContractVersions],\n    capabilities, deprecations,\n  };\n}\n\nexport class CapabilitiesClient {\n  private readonly transport: CloudTransport;\n\n  constructor(resolveClient: () => HttpClient = getClient, config: CloudTransportConfig = {}) {\n    this.transport = new CloudTransport(resolveClient, config);\n  }\n\n  /** Workspace comes exclusively from the authenticated key. One POST, no automatic retries or caching. */\n  async discover(): Promise<CapabilityDiscoverResponse> {\n    if (arguments.length !== 0) throw new TypeError('Tier0 SDK: capability discovery accepts no arguments.');\n    let response: Awaited<ReturnType<CloudTransport['post']>>;\n    try {\n      response = await this.transport.post('/openapi/v2/capabilities/discover', {});\n    } catch (error) {\n      if (!(error instanceof CloudTransportError)) throw error;\n      throw new CapabilityError('Capability discovery HTTP exchange failed.', {\n        status: error.status, errorCode: `CAPABILITY_${error.kind}`,\n      });\n    }\n    const { value, status, ok } = response;\n    if (!ok) {\n      if (!record(value) || !text(value.errorCode) || typeof value.message !== 'string') {\n        throw new CapabilityError('Invalid capability error response.', { status, errorCode: 'CAPABILITY_PROTOCOL_ERROR' });\n      }\n      throw new CapabilityError(value.message, { status, errorCode: value.errorCode });\n    }\n    return discovery(value, status);\n  }\n}\n\n/** Uses configureClient()/runtime environment, resolving the host and workspace key on every call. */\nexport const capabilities = new CapabilitiesClient();\n"]}

package/dist/cjs/client.d.ts

@@ -1,5 +1,4 @@
 import { type ClientConfig } from './openapi/client.js';
-import { ControlsClient } from './controls.js';
 import { CapabilitiesClient } from './capabilities.js';
 import { FilesClient } from './files.js';
 import type { CloudTransportConfig } from './cloud-transport.js';
@@ -199,7 +198,6 @@ export declare function createClient(config?: Tier0ClientConfig): Readonly<{
     };
     files: FilesClient;
     capabilities: CapabilitiesClient;
-    controls: ControlsClient;
     source: Readonly<{
         delete: (request: import("./index.js").CloudSourceDeleteReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").CloudSourceDeleteResponse>;
         validate: (request: import("./index.js").UnsV2SourceValidateReq, options?: import("./openapi/client.js").RequestOptions) => Promise<import("./index.js").UnsV2SourceValidateResponse>;
@@ -375,13 +373,17 @@ export declare function createClient(config?: Tier0ClientConfig): Readonly<{
         };
         capabilities: {
             discover: (options?: import("./openapi/client.js").RequestOptions) => Promise<{
-                apiContractVersions: string[];
-                capabilities: import("./index.js").components["schemas"]["PublicCapability"][];
-                contractVersion: string;
-                deprecations: import("./index.js").components["schemas"]["CapabilityDeprecation"][];
-                product: string;
+                product: "cloud" | "enterprise";
                 productVersion?: string;
+                contractVersion: "1.0";
+                apiContractVersions: string[];
                 sdkContractVersions: string[];
+                capabilities: import("./index.js").components["schemas"]["CapabilityDiscoverycapability"][] & (unknown & unknown & unknown & unknown & unknown);
+                deprecations: {
+                    contract: string;
+                    replacement?: string;
+                    sunsetAt?: string;
+                }[];
             }>;
         };
         agent: {

package/dist/cjs/client.js

@@ -7,7 +7,6 @@ const client_js_2 = require("./uns-v2/client.js");
 const data_client_js_1 = require("./uns-v2/data-client.js");
 const source_js_1 = require("./source.js");
 const stream_js_1 = require("./stream.js");
-const controls_js_1 = require("./controls.js");
 const capabilities_js_1 = require("./capabilities.js");
 const files_js_1 = require("./files.js");
 /** Use a fresh instance per incoming request when supplying employee data delegation. */
@@ -25,7 +24,6 @@ function createClient(config = {}) {
         agent: api.agent,
         files: new files_js_1.FilesClient(http),
         capabilities: new capabilities_js_1.CapabilitiesClient(resolve, snapshot),
-        controls: new controls_js_1.ControlsClient(resolve, snapshot),
         source: (0, source_js_1.bindSourceClient)(raw),
         stream: (0, stream_js_1.bindStreamClient)(raw),
         uns: (0, data_client_js_1.bindUnsDataClient)(raw),

package/dist/cjs/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":";;AAaA,oCAoBC;AAjCD,mDAAoE;AACpE,iEAA2D;AAC3D,kDAAuD;AACvD,4DAA4D;AAC5D,2CAA+C;AAC/C,2CAA+C;AAC/C,+CAA+C;AAC/C,uDAAuD;AACvD,yCAAyC;AAIzC,yFAAyF;AACzF,SAAgB,YAAY,CAAC,SAA4B,EAAE;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,sBAAU,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,IAAA,gCAAa,EAAC,IAAI,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAA,6BAAiB,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,IAAI,sBAAW,CAAC,IAAI,CAAC;QAC5B,YAAY,EAAE,IAAI,oCAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC;QACvD,QAAQ,EAAE,IAAI,4BAAc,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC/C,MAAM,EAAE,IAAA,4BAAgB,EAAC,GAAG,CAAC;QAC7B,MAAM,EAAE,IAAA,4BAAgB,EAAC,GAAG,CAAC;QAC7B,GAAG,EAAE,IAAA,kCAAiB,EAAC,GAAG,CAAC;QAC3B,GAAG;KACJ,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { HttpClient, type ClientConfig } from './openapi/client.js';\nimport { createOpenAPI } from './openapi/api.generated.js';\nimport { createUnsV2Client } from './uns-v2/client.js';\nimport { bindUnsDataClient } from './uns-v2/data-client.js';\nimport { bindSourceClient } from './source.js';\nimport { bindStreamClient } from './stream.js';\nimport { ControlsClient } from './controls.js';\nimport { CapabilitiesClient } from './capabilities.js';\nimport { FilesClient } from './files.js';\nimport type { CloudTransportConfig } from './cloud-transport.js';\n\nexport interface Tier0ClientConfig extends ClientConfig, CloudTransportConfig {}\n/** Use a fresh instance per incoming request when supplying employee data delegation. */\nexport function createClient(config: Tier0ClientConfig = {}) {\n  const snapshot = Object.freeze({ ...config });\n  const http = new HttpClient(snapshot);\n  const api = createOpenAPI(http);\n  const resolve = () => http;\n  const raw = createUnsV2Client(resolve, snapshot);\n  return Object.freeze({\n    system: api.system,\n    members: api.members,\n    notifications: api.notifications,\n    mqttAuth: api.mqttAuth,\n    agent: api.agent,\n    files: new FilesClient(http),\n    capabilities: new CapabilitiesClient(resolve, snapshot),\n    controls: new ControlsClient(resolve, snapshot),\n    source: bindSourceClient(raw),\n    stream: bindStreamClient(raw),\n    uns: bindUnsDataClient(raw),\n    api,\n  });\n}\nexport type Tier0Client = ReturnType<typeof createClient>;\n"]}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/client.ts"],"names":[],"mappings":";;AAYA,oCAmBC;AA/BD,mDAAoE;AACpE,iEAA2D;AAC3D,kDAAuD;AACvD,4DAA4D;AAC5D,2CAA+C;AAC/C,2CAA+C;AAC/C,uDAAuD;AACvD,yCAAyC;AAIzC,yFAAyF;AACzF,SAAgB,YAAY,CAAC,SAA4B,EAAE;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,sBAAU,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,IAAA,gCAAa,EAAC,IAAI,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAA,6BAAiB,EAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,IAAI,sBAAW,CAAC,IAAI,CAAC;QAC5B,YAAY,EAAE,IAAI,oCAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC;QACvD,MAAM,EAAE,IAAA,4BAAgB,EAAC,GAAG,CAAC;QAC7B,MAAM,EAAE,IAAA,4BAAgB,EAAC,GAAG,CAAC;QAC7B,GAAG,EAAE,IAAA,kCAAiB,EAAC,GAAG,CAAC;QAC3B,GAAG;KACJ,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { HttpClient, type ClientConfig } from './openapi/client.js';\nimport { createOpenAPI } from './openapi/api.generated.js';\nimport { createUnsV2Client } from './uns-v2/client.js';\nimport { bindUnsDataClient } from './uns-v2/data-client.js';\nimport { bindSourceClient } from './source.js';\nimport { bindStreamClient } from './stream.js';\nimport { CapabilitiesClient } from './capabilities.js';\nimport { FilesClient } from './files.js';\nimport type { CloudTransportConfig } from './cloud-transport.js';\n\nexport interface Tier0ClientConfig extends ClientConfig, CloudTransportConfig {}\n/** Use a fresh instance per incoming request when supplying employee data delegation. */\nexport function createClient(config: Tier0ClientConfig = {}) {\n  const snapshot = Object.freeze({ ...config });\n  const http = new HttpClient(snapshot);\n  const api = createOpenAPI(http);\n  const resolve = () => http;\n  const raw = createUnsV2Client(resolve, snapshot);\n  return Object.freeze({\n    system: api.system,\n    members: api.members,\n    notifications: api.notifications,\n    mqttAuth: api.mqttAuth,\n    agent: api.agent,\n    files: new FilesClient(http),\n    capabilities: new CapabilitiesClient(resolve, snapshot),\n    source: bindSourceClient(raw),\n    stream: bindStreamClient(raw),\n    uns: bindUnsDataClient(raw),\n    api,\n  });\n}\nexport type Tier0Client = ReturnType<typeof createClient>;\n"]}

package/dist/cjs/cloud-transport.d.ts

@@ -1,4 +1,5 @@
 import { type HttpClient, type RequestOptions } from './openapi/client.js';
+import { type UnsV2OperationName, type UnsV2StreamOperationName } from './uns-v2/generated.js';
 export interface CloudTransportConfig {
     /** Whole HTTP exchange including the response body, in milliseconds; default 60,000. */
     transportTimeoutMs?: number;
@@ -33,7 +34,7 @@ export declare class CloudTransport {
     private readonly unsV2MaxResponseBytes;
     constructor(resolveClient?: () => HttpClient, config?: CloudTransportConfig);
     /** `retryAfter`: the raw `Retry-After` header, for answers without a UNS error body. */
-    postText(path: string, body: string, options?: RequestOptions): Promise<{
+    postText(path: string, body: string, options?: RequestOptions, operation?: UnsV2OperationName): Promise<{
         text: string;
         status: number;
         ok: boolean;
@@ -50,7 +51,7 @@ export declare class CloudTransport {
     getEventStream(path: string, options?: {
         lastEventId?: string;
         signal?: AbortSignal;
-    }): Promise<{
+    }, operation?: UnsV2StreamOperationName): Promise<{
         status: number;
         stream: ReadableStream<Uint8Array>;
         close(): void;

package/dist/cjs/cloud-transport.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CloudTransport = exports.CloudTransportError = exports.UNS_V2_MAX_RESPONSE_BYTES = exports.UNS_V2_MAX_REQUEST_BYTES = exports.UNS_V2_APP_DATA_SUBJECT_HEADER = exports.DEFAULT_CLOUD_TRANSPORT_TIMEOUT_MS = void 0;
 const client_js_1 = require("./openapi/client.js");
+const generated_js_1 = require("./uns-v2/generated.js");
 exports.DEFAULT_CLOUD_TRANSPORT_TIMEOUT_MS = 60_000;
 /** Header carrying `unsV2AppDataSubject`; the trusted App Gateway sets it on each business request. */
 exports.UNS_V2_APP_DATA_SUBJECT_HEADER = 'X-Tier0-App-Data-Subject';
@@ -46,16 +47,15 @@ class CloudTransport {
         this.#unsV2AppDataSubject = subject;
     }
     /** `retryAfter`: the raw `Retry-After` header, for answers without a UNS error body. */
-    async postText(path, body, options = {}) {
+    async postText(path, body, options = {}, operation) {
         options.signal?.throwIfAborted();
         const client = this.resolveClient();
         const url = `${client.getBaseURL()}${path}`;
         const key = client.getApiKey();
         const headers = { 'Content-Type': 'application/json' };
-        // Control routes also live under UNS v2, but must never receive data delegation.
-        // Keep this per-client proof out of shared HTTP headers and Control requests.
-        if (path.startsWith('/openapi/v2/uns/') &&
-            !path.startsWith('/openapi/v2/uns/controls/') &&
+        // The registered operation determines data delegation, never a route blacklist.
+        if (operation !== undefined && Object.hasOwn(generated_js_1.UNS_V2_OPERATIONS, operation) &&
+            generated_js_1.UNS_V2_OPERATIONS[operation].scope.startsWith('uns:') &&
             this.#unsV2AppDataSubject !== undefined) {
             headers[exports.UNS_V2_APP_DATA_SUBJECT_HEADER] = this.#unsV2AppDataSubject;
         }
@@ -153,13 +153,14 @@ class CloudTransport {
      * An open stream belongs to the caller: `close()` ends it and drops the
      * link to `signal`, which also ends it.
      */
-    async getEventStream(path, options = {}) {
+    async getEventStream(path, options = {}, operation) {
         options.signal?.throwIfAborted();
         const client = this.resolveClient();
         const url = `${client.getBaseURL()}${path}`;
         const key = client.getApiKey();
         const headers = { Accept: 'text/event-stream' };
-        if (path.startsWith('/openapi/v2/uns/') && this.#unsV2AppDataSubject !== undefined) {
+        if (operation !== undefined && Object.hasOwn(generated_js_1.UNS_V2_STREAM_OPERATIONS, operation) &&
+            generated_js_1.UNS_V2_STREAM_OPERATIONS[operation].scope.startsWith('uns:') && this.#unsV2AppDataSubject !== undefined) {
             headers[exports.UNS_V2_APP_DATA_SUBJECT_HEADER] = this.#unsV2AppDataSubject;
         }
         if (options.lastEventId !== undefined)