@vectorlingo/cli 0.1.0

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,MAAM,EACN,sBAAsB,GAKvB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAkB,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAmB3F,MAAM,YAAY,GAAG,CAAC,CAAA;AACtB,MAAM,YAAY,GAAG,KAAK,CAAA;AAC1B,MAAM,UAAU,GAAG,wBAAwB,CAAA;AAE3C,MAAM,OAAO,iBAAiB;IACnB,OAAO,CAAK;IACJ,aAAa,CAAe;IAC5B,KAAK,CAAW;IAChB,WAAW,CAAQ;IAEpC,YAAY,OAAiC;QAC3C,IAAI,CAAC,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAA;QAC1E,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAA;QAC1C,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAA;QAC9C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,KAAK,EAAE,WAAW,IAAI,GAAG,CAAA;IACtD,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,OAAO,IAAI,CAAC,OAAO,CAAqB,KAAK,EAAE,2BAA2B,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;IAC9F,CAAC;IAED,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAC,OAAO,CAAqB,KAAK,EAAE,sBAAsB,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;IACzF,CAAC;IAED,KAAK,CAAC,OAAO,CACX,QAAmC;QAEnC,MAAM,SAAS,GAAG,sBAAsB,CAAC,QAAQ,CAA8B,CAAA;QAC/E,OAAO,IAAI,CAAC,OAAO,CACjB,MAAM,EACN,yBAAyB,EACzB,SAAS,EACT,SAAS,CAAC,UAAU,KAAK,SAAS,CACnC,CAAA;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAoB,WAAmB,EAAE,QAAgB;QACzE,UAAU,CAAC,WAAW,EAAE,aAAa,CAAC,CAAA;QACtC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;QAChC,OAAO,IAAI,CAAC,OAAO,CACjB,KAAK,EACL,2BAA2B,kBAAkB,CAAC,WAAW,CAAC,cAAc,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EACtG,SAAS,EACT,IAAI,CACL,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,MAAsB,EACtB,IAAY,EACZ,IAAa,EACb,SAAkB;QAElB,IAAI,SAAS,GAAG,KAAK,CAAA;QACrB,IAAI,gBAAgB,GAAG,KAAK,CAAA;QAC5B,IAAI,SAAkB,CAAA;QACtB,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAA;QAE7C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,QAAQ,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;gBAC7F,gBAAgB,GAAG,KAAK,CAAA;gBACxB,IAAI,CAAC,KAAK;oBAAE,MAAM,IAAI,UAAU,CAAC,yBAAyB,EAAE,8BAA8B,CAAC,CAAA;gBAC3F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE;oBAC7D,MAAM;oBACN,QAAQ,EAAE,QAAQ;oBAClB,OAAO,EAAE;wBACP,MAAM,EAAE,kBAAkB;wBAC1B,aAAa,EAAE,UAAU,KAAK,EAAE;wBAChC,YAAY,EAAE,UAAU;wBACxB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;qBACtE;oBACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;iBAC9D,CAAC,CAAA;gBACF,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;oBACpD,MAAM,IAAI,UAAU,CAAC,qBAAqB,EAAE,iDAAiD,EAAE;wBAC7F,UAAU,EAAE,QAAQ,CAAC,MAAM;qBAC5B,CAAC,CAAA;gBACJ,CAAC;gBACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;oBAC1C,SAAS,GAAG,IAAI,CAAA;oBAChB,gBAAgB,GAAG,IAAI,CAAA;oBACvB,OAAO,IAAI,CAAC,CAAA;oBACZ,SAAQ;gBACV,CAAC;gBACD,IAAI,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,QAAQ,EAAE,CAAC;oBAC7D,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;oBAC3G,MAAM,IAAI,CAAC,UAAU,CAAC,CAAA;oBACtB,SAAQ;gBACV,CAAC;gBACD,OAAO,MAAM,kBAAkB,CAAI,QAAQ,CAAC,CAAA;YAC9C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,GAAG,KAAK,CAAA;gBACjB,IAAI,KAAK,YAAY,UAAU;oBAAE,MAAM,KAAK,CAAA;gBAC5C,IAAI,OAAO,IAAI,QAAQ;oBAAE,MAAK;gBAC9B,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YAC3E,CAAC;QACH,CAAC;QACD,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,6BAA6B,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;IAC5F,CAAC;CACF;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,KAAa;IAC9C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,GAAG,KAAK,iBAAiB,CAAC,CAAA;IACpE,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAA;AAC7E,CAAC;AAED,SAAS,UAAU,CAAC,KAAoB,EAAE,OAAe,EAAE,IAAY,EAAE,GAAW;IAClF,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;QAC7B,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,GAAG,KAAK,CAAC,CAAA;IACrF,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAA;AACjD,CAAC;AAED,SAAS,IAAI,CAAC,EAAU;IACtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;AAC1D,CAAC"}

package/dist/contracts.d.ts

@@ -0,0 +1,127 @@
+export type JsonSchema = Record<string, unknown>;
+export interface SourceReference {
+    namespace: string;
+    id: string;
+}
+export interface OperationEnvelope<TInput = unknown> {
+    tenant_id: string;
+    operation: string;
+    input: TInput;
+    request_id?: string;
+    source_reference?: SourceReference;
+}
+export type OperationStatus = 'completed' | 'in_progress' | 'failed' | 'reconciliation_required';
+export interface OperationResult<TResult = unknown> {
+    operation_id?: string;
+    status: OperationStatus;
+    result?: TResult;
+}
+export interface OperationLimits {
+    maxBodyBytes?: number;
+    maxArrayItems?: number;
+    maxFileBytes?: number;
+    requestsPerMinute?: number;
+    [name: string]: number | string | boolean | undefined;
+}
+export interface OperationDescriptor {
+    name: string;
+    description: string;
+    inputSchema: JsonSchema;
+    effects: string[];
+    requiredRole: string;
+    schemaVersion: string;
+    limits: OperationLimits;
+    idempotent: boolean;
+    supportsSourceReference?: boolean;
+}
+export interface CapabilityManifest {
+    schema_version: string;
+    operations: OperationDescriptor[];
+    destination_policy?: DestinationPolicy;
+}
+/** Destination limits are data for callers, not an authorisation mechanism. */
+export interface DestinationPolicy {
+    completion: 'per_operation';
+    atomic_batch: false;
+    unknown_input_fields: 'rejected';
+    source_reference_scope: ['tenant', 'entity_type', 'namespace', 'id'];
+    source_reference_conflict: 'reject_changed_input';
+    historical_finance: {
+        invoice_create_state: 'draft';
+        purchase_order_create_state: 'draft';
+        historical_status_input: false;
+        payments: false;
+        accounting_replay: false;
+    };
+    unsupported_operations: string[];
+}
+export interface TenantSummary {
+    id: string;
+    name: string;
+    role: string;
+    plan?: string;
+}
+export interface TenantListResponse {
+    tenants: TenantSummary[];
+}
+export interface UploadInstruction {
+    upload_id: string;
+    method: 'PUT' | 'POST';
+    upload_url: string;
+    headers: Record<string, string>;
+    expires_at: string;
+    transfer_required?: true;
+}
+export type UploadInitialisationResult = UploadInstruction | {
+    upload_id: string;
+    transfer_required: false;
+} | {
+    upload_id: string;
+    completed_file: FileDescriptor;
+};
+export interface FileDescriptor {
+    file_id: string;
+    file_name: string;
+    mime_type: string;
+    size: number;
+    sha256: string;
+}
+export interface DownloadDescriptor {
+    artifact_id: string;
+    file_name: string;
+    mime_type: string;
+    size: number;
+    sha256: string;
+    download_url: string;
+    expires_at: string;
+}
+export interface AgentErrorPayload {
+    code: string;
+    message: string;
+    details?: unknown;
+    operation_id?: string;
+    retry_after_seconds?: number;
+}
+export interface AgentErrorResponse {
+    error: AgentErrorPayload;
+}
+export interface AgentErrorOptions {
+    details?: unknown;
+    httpStatus?: number;
+    operationId?: string;
+    retryAfterSeconds?: number;
+    cause?: unknown;
+}
+export declare class AgentError extends Error {
+    readonly code: string;
+    readonly details?: unknown;
+    readonly httpStatus: number | undefined;
+    readonly operationId: string | undefined;
+    readonly retryAfterSeconds: number | undefined;
+    constructor(code: string, message: string, options?: AgentErrorOptions);
+    toJSON(): AgentErrorPayload;
+}
+export declare function isUuid(value: unknown): value is string;
+export declare function parseOperationEnvelope(value: unknown): OperationEnvelope;
+export declare function isWriteOperation(descriptor: OperationDescriptor): boolean;
+//# sourceMappingURL=contracts.d.ts.map

package/dist/contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../src/contracts.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAEhD,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAA;IACjB,EAAE,EAAE,MAAM,CAAA;CACX;AAED,MAAM,WAAW,iBAAiB,CAAC,MAAM,GAAG,OAAO;IACjD,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,gBAAgB,CAAC,EAAE,eAAe,CAAA;CACnC;AAED,MAAM,MAAM,eAAe,GACvB,WAAW,GACX,aAAa,GACb,QAAQ,GACR,yBAAyB,CAAA;AAE7B,MAAM,WAAW,eAAe,CAAC,OAAO,GAAG,OAAO;IAChD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,eAAe,CAAA;IACvB,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAA;CACtD;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,UAAU,CAAA;IACvB,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,eAAe,CAAA;IACvB,UAAU,EAAE,OAAO,CAAA;IACnB,uBAAuB,CAAC,EAAE,OAAO,CAAA;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAA;IACtB,UAAU,EAAE,mBAAmB,EAAE,CAAA;IACjC,kBAAkB,CAAC,EAAE,iBAAiB,CAAA;CACvC;AAED,+EAA+E;AAC/E,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,eAAe,CAAA;IAC3B,YAAY,EAAE,KAAK,CAAA;IACnB,oBAAoB,EAAE,UAAU,CAAA;IAChC,sBAAsB,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,CAAC,CAAA;IACpE,yBAAyB,EAAE,sBAAsB,CAAA;IACjD,kBAAkB,EAAE;QAClB,oBAAoB,EAAE,OAAO,CAAA;QAC7B,2BAA2B,EAAE,OAAO,CAAA;QACpC,uBAAuB,EAAE,KAAK,CAAA;QAC9B,QAAQ,EAAE,KAAK,CAAA;QACf,iBAAiB,EAAE,KAAK,CAAA;KACzB,CAAA;IACD,sBAAsB,EAAE,MAAM,EAAE,CAAA;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,aAAa,EAAE,CAAA;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,KAAK,GAAG,MAAM,CAAA;IACtB,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,UAAU,EAAE,MAAM,CAAA;IAClB,iBAAiB,CAAC,EAAE,IAAI,CAAA;CACzB;AAED,MAAM,MAAM,0BAA0B,GAAG,iBAAiB,GACtD;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,KAAK,CAAA;CAAE,GAC/C;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,cAAc,CAAA;CAAE,CAAA;AAEzD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,iBAAiB,CAAA;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IACxC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,SAAS,CAAA;gBAElC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB;IAU1E,MAAM,IAAI,iBAAiB;CAW5B;AA2BD,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEtD;AAmBD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,CAoCxE;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,mBAAmB,GAAG,OAAO,CAEzE"}

package/dist/contracts.js

@@ -0,0 +1,105 @@
+export class AgentError extends Error {
+    code;
+    details;
+    httpStatus;
+    operationId;
+    retryAfterSeconds;
+    constructor(code, message, options = {}) {
+        super(message, { cause: options.cause });
+        this.name = 'AgentError';
+        this.code = code;
+        this.details = options.details;
+        this.httpStatus = options.httpStatus;
+        this.operationId = options.operationId;
+        this.retryAfterSeconds = options.retryAfterSeconds;
+    }
+    toJSON() {
+        return {
+            code: this.code,
+            message: this.message,
+            ...(this.details === undefined ? {} : { details: this.details }),
+            ...(this.operationId === undefined ? {} : { operation_id: this.operationId }),
+            ...(this.retryAfterSeconds === undefined
+                ? {}
+                : { retry_after_seconds: this.retryAfterSeconds }),
+        };
+    }
+}
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const OUTER_KEYS = new Set([
+    'tenant_id',
+    'operation',
+    'input',
+    'request_id',
+    'source_reference',
+]);
+const SOURCE_KEYS = new Set(['namespace', 'id']);
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function rejectUnknownKeys(value, allowed, label) {
+    const unknown = Object.keys(value).filter((key) => !allowed.has(key)).sort();
+    if (unknown.length > 0) {
+        throw new AgentError('invalid_request', `${label} contains unknown fields`, {
+            details: { fields: unknown },
+            httpStatus: 400,
+        });
+    }
+}
+export function isUuid(value) {
+    return typeof value === 'string' && UUID_PATTERN.test(value);
+}
+function requireUuid(value, field) {
+    if (!isUuid(value)) {
+        throw new AgentError('invalid_request', `${field} must be a UUID`, { httpStatus: 400 });
+    }
+    return value.toLowerCase();
+}
+function requireBoundedString(value, field, maxLength) {
+    if (typeof value !== 'string' || value.length === 0 || value.length > maxLength) {
+        throw new AgentError('invalid_request', `${field} must be a non-empty string`, {
+            details: { max_length: maxLength },
+            httpStatus: 400,
+        });
+    }
+    return value;
+}
+export function parseOperationEnvelope(value) {
+    if (!isRecord(value)) {
+        throw new AgentError('invalid_request', 'Operation envelope must be an object', {
+            httpStatus: 400,
+        });
+    }
+    rejectUnknownKeys(value, OUTER_KEYS, 'Operation envelope');
+    if (!Object.hasOwn(value, 'input')) {
+        throw new AgentError('invalid_request', 'Operation envelope must include input', {
+            httpStatus: 400,
+        });
+    }
+    let sourceReference;
+    if (value.source_reference !== undefined) {
+        if (!isRecord(value.source_reference)) {
+            throw new AgentError('invalid_request', 'source_reference must be an object', {
+                httpStatus: 400,
+            });
+        }
+        rejectUnknownKeys(value.source_reference, SOURCE_KEYS, 'source_reference');
+        sourceReference = {
+            namespace: requireBoundedString(value.source_reference.namespace, 'source_reference.namespace', 100),
+            id: requireBoundedString(value.source_reference.id, 'source_reference.id', 200),
+        };
+    }
+    return {
+        tenant_id: requireUuid(value.tenant_id, 'tenant_id'),
+        operation: requireBoundedString(value.operation, 'operation', 100),
+        input: value.input,
+        ...(value.request_id === undefined
+            ? {}
+            : { request_id: requireUuid(value.request_id, 'request_id') }),
+        ...(sourceReference === undefined ? {} : { source_reference: sourceReference }),
+    };
+}
+export function isWriteOperation(descriptor) {
+    return descriptor.effects.some((effect) => effect !== 'read');
+}
+//# sourceMappingURL=contracts.js.map

package/dist/contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../src/contracts.ts"],"names":[],"mappings":"AAoIA,MAAM,OAAO,UAAW,SAAQ,KAAK;IAC1B,IAAI,CAAQ;IACZ,OAAO,CAAU;IACjB,UAAU,CAAoB;IAC9B,WAAW,CAAoB;IAC/B,iBAAiB,CAAoB;IAE9C,YAAY,IAAY,EAAE,OAAe,EAAE,UAA6B,EAAE;QACxE,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAA;QACxC,IAAI,CAAC,IAAI,GAAG,YAAY,CAAA;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAA;QAC9B,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;QACpC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAA;QACtC,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAA;IACpD,CAAC;IAED,MAAM;QACJ,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YAChE,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;YAC7E,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,SAAS;gBACtC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC;SACrD,CAAA;IACH,CAAC;CACF;AAED,MAAM,YAAY,GAChB,4EAA4E,CAAA;AAC9E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,WAAW;IACX,WAAW;IACX,OAAO;IACP,YAAY;IACZ,kBAAkB;CACnB,CAAC,CAAA;AACF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAA;AAEhD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA8B,EAAE,OAAoB,EAAE,KAAa;IAC5F,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAC5E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,GAAG,KAAK,0BAA0B,EAAE;YAC1E,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE;YAC5B,UAAU,EAAE,GAAG;SAChB,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC9D,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,KAAa;IAChD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,GAAG,KAAK,iBAAiB,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAA;IACzF,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,EAAE,CAAA;AAC5B,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,KAAa,EAAE,SAAiB;IAC5E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAChF,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,GAAG,KAAK,6BAA6B,EAAE;YAC7E,OAAO,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;YAClC,UAAU,EAAE,GAAG;SAChB,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,sCAAsC,EAAE;YAC9E,UAAU,EAAE,GAAG;SAChB,CAAC,CAAA;IACJ,CAAC;IACD,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAA;IAC1D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,uCAAuC,EAAE;YAC/E,UAAU,EAAE,GAAG;SAChB,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,eAA4C,CAAA;IAChD,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,oCAAoC,EAAE;gBAC5E,UAAU,EAAE,GAAG;aAChB,CAAC,CAAA;QACJ,CAAC;QACD,iBAAiB,CAAC,KAAK,CAAC,gBAAgB,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAA;QAC1E,eAAe,GAAG;YAChB,SAAS,EAAE,oBAAoB,CAAC,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,4BAA4B,EAAE,GAAG,CAAC;YACpG,EAAE,EAAE,oBAAoB,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,EAAE,qBAAqB,EAAE,GAAG,CAAC;SAChF,CAAA;IACH,CAAC;IAED,OAAO;QACL,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC;QACpD,SAAS,EAAE,oBAAoB,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC;QAClE,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS;YAChC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,UAAU,EAAE,WAAW,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC;KAChF,CAAA;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,UAA+B;IAC9D,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;AAC/D,CAAC"}

package/dist/credential-store.d.ts

@@ -0,0 +1,112 @@
+export interface OAuthTokens {
+    accessToken: string;
+    refreshToken?: string;
+    tokenType: 'Bearer';
+    expiresAt: number;
+    scope?: string;
+}
+export interface CredentialProfile {
+    baseUrl: string;
+    issuer: string;
+    resource: string;
+    clientId: string;
+    tokens: OAuthTokens;
+    selectedTenantId?: string;
+}
+/** One broker deployment: an OAuth issuer plus the resource its tokens are bound to. */
+export interface CredentialDeployment {
+    issuer: string;
+    resource: string;
+}
+export interface CredentialStore {
+    /** The active profile, or the stored profile for `deployment` when the store keeps several. */
+    load(deployment?: CredentialDeployment): Promise<CredentialProfile | undefined>;
+    save(profile: CredentialProfile): Promise<void>;
+    clear(): Promise<void>;
+    update(updater: (current: CredentialProfile | undefined) => Promise<CredentialProfile | undefined>): Promise<CredentialProfile | undefined>;
+}
+export type CredentialStoreMode = 'auto' | 'keychain' | 'file';
+export interface CreateCredentialStoreOptions {
+    mode?: CredentialStoreMode;
+    filePath?: string;
+    service?: string;
+}
+export declare function defaultCredentialPath(): string;
+export declare function createCredentialStore(options?: CreateCredentialStoreOptions): CredentialStore;
+export declare class FileCredentialStore implements CredentialStore {
+    readonly filePath: string;
+    constructor(filePath: string);
+    load(): Promise<CredentialProfile | undefined>;
+    save(profile: CredentialProfile): Promise<void>;
+    clear(): Promise<void>;
+    update(updater: (current: CredentialProfile | undefined) => Promise<CredentialProfile | undefined>): Promise<CredentialProfile | undefined>;
+}
+export interface SecretBackend {
+    load(): Promise<string | undefined>;
+    save(value: string): Promise<void>;
+    clear(): Promise<void>;
+}
+/**
+ * One keychain entry per deployment (issuer + resource), so logging in to a second deployment
+ * never overwrites the first. A separate `active` entry names the deployment that commands
+ * without a deployment of their own (tenant, execute, logout) use: the last one logged in to.
+ */
+export declare class KeychainCredentialStore implements CredentialStore {
+    private readonly backendFor;
+    private readonly lockPath;
+    constructor(backendFor: (account: string) => SecretBackend, lockPath: string);
+    private get active();
+    load(deployment?: CredentialDeployment): Promise<CredentialProfile | undefined>;
+    /** Locked like `update()`: two concurrent logins would otherwise race the sealing key (GLM W2). */
+    save(profile: CredentialProfile): Promise<void>;
+    private write;
+    clear(): Promise<void>;
+    update(updater: (current: CredentialProfile | undefined) => Promise<CredentialProfile | undefined>): Promise<CredentialProfile | undefined>;
+}
+type SecretCommandRunner = typeof runSecretCommand;
+/**
+ * macOS keeps only a random 256-bit key per entry in the keychain; the value itself is sealed with
+ * AES-256-GCM in a 0600 file. `security` takes a secret only in argv, on a tty prompt, or on stdin
+ * in `-i` mode, and `-i` hangs on lines near 4 KB — too short for a token profile, fine for a key.
+ * No secret is ever in argv, where process telemetry can log it (Codex Gate 3 r2 A H2).
+ */
+export declare class SealedFileSecret implements SecretBackend {
+    private readonly key;
+    private readonly filePath;
+    constructor(key: SecretBackend, filePath: string);
+    load(): Promise<string | undefined>;
+    save(value: string): Promise<void>;
+    clear(): Promise<void>;
+}
+/** A short secret (the sealing key) in the user's default macOS keychain, written via `security -i` on stdin. */
+export declare class MacOsKeychain implements SecretBackend {
+    private readonly service;
+    private readonly account;
+    private readonly run;
+    constructor(service: string, account: string, run?: SecretCommandRunner);
+    load(): Promise<string | undefined>;
+    save(value: string): Promise<void>;
+    clear(): Promise<void>;
+}
+export interface LockIdentity {
+    ino: number;
+    mtimeMs: number;
+    content: string;
+}
+/** Inode, mtime and content read through one handle, so they describe the same file. */
+export declare function readLockIdentity(lockPath: string): Promise<LockIdentity>;
+/** Remove the lock at `lockPath` only if it is still the file judged stale. Exported for tests. */
+export declare function claimStaleLock(lockPath: string, stale: LockIdentity): Promise<void>;
+/**
+ * Run a keychain helper. The timeout bounds a hung helper, so the caller fails and releases the
+ * credential lock instead of holding it forever; 60 s leaves room for a macOS Keychain prompt.
+ * Exported for tests.
+ */
+export declare function runSecretCommand(command: string, args: string[], stdin?: string, timeoutMs?: number): Promise<{
+    code: number;
+    stdout: string;
+    stderr: string;
+}>;
+export declare function credentialAccountFor(issuer: string, resource: string): string;
+export {};
+//# sourceMappingURL=credential-store.d.ts.map

package/dist/credential-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../src/credential-store.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,QAAQ,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,WAAW,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,wFAAwF;AACxF,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,+FAA+F;IAC/F,IAAI,CAAC,UAAU,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAAA;IAC/E,IAAI,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACtB,MAAM,CACJ,OAAO,EAAE,CAAC,OAAO,EAAE,iBAAiB,GAAG,SAAS,KAAK,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,GAC1F,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAAA;CAC1C;AAED,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,CAAA;AAE9D,MAAM,WAAW,4BAA4B;IAC3C,IAAI,CAAC,EAAE,mBAAmB,CAAA;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,wBAAgB,qBAAqB,IAAI,MAAM,CAG9C;AAED,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,4BAAiC,GAAG,eAAe,CAcjG;AAED,qBAAa,mBAAoB,YAAW,eAAe;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBAAhB,QAAQ,EAAE,MAAM;IAE/B,IAAI,IAAI,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAc9C,IAAI,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAItB,MAAM,CACV,OAAO,EAAE,CAAC,OAAO,EAAE,iBAAiB,GAAG,SAAS,KAAK,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,GAC1F,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;CAQ1C;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IACnC,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAED;;;;GAIG;AACH,qBAAa,uBAAwB,YAAW,eAAe;IAE3D,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBADR,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,aAAa,EAC9C,QAAQ,EAAE,MAAM;IAGnC,OAAO,KAAK,MAAM,GAEjB;IAEK,IAAI,CAAC,UAAU,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAOrF,mGAAmG;IAC7F,IAAI,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;YAIvC,KAAK;IAMb,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAMtB,MAAM,CACV,OAAO,EAAE,CAAC,OAAO,EAAE,iBAAiB,GAAG,SAAS,KAAK,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,GAC1F,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;CAQ1C;AAED,KAAK,mBAAmB,GAAG,OAAO,gBAAgB,CAAA;AAElD;;;;;GAKG;AACH,qBAAa,gBAAiB,YAAW,aAAa;IAElD,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBADR,GAAG,EAAE,aAAa,EAClB,QAAQ,EAAE,MAAM;IAG7B,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAsBnC,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBlC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAI7B;AASD,iHAAiH;AACjH,qBAAa,aAAc,YAAW,aAAa;IAE/C,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAFH,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,mBAAsC;IAOxD,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAOnC,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQlC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAI7B;AAkLD,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,wFAAwF;AACxF,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAQ9E;AAED,mGAAmG;AACnG,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBzF;AAmED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,KAAK,CAAC,EAAE,MAAM,EACd,SAAS,SAAS,GACjB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAqB3D;AAUD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7E"}