@webpresso/agent-kit 3.3.2 → 3.3.3

package/dist/esm/blueprint/lifecycle/review-provenance.js

@@ -139,6 +139,83 @@ function workingContentMatchesRef(repoRoot, file, purpose, ref) {
         return false;
     }
 }
+/**
+ * Candidate delivery subjects for the working path.
+ *
+ * Two sources, in this order:
+ *
+ * 1. **The live tree at HEAD.** This mirrors what {@link readReviewAuthorityAtRef}
+ *    already does for delivery on the ref path: it builds the subject from the
+ *    ref under audit and matches events by digest, never resolving the commit an
+ *    event recorded. Doing the same here removes the working path's outlier
+ *    behaviour.
+ * 2. **Reconstruction at each event's `reviewedCommit`**, for events the live
+ *    subject does not already cover.
+ *
+ * Why the live tree has to come first: `reviewedCommit` is a *locator*, not the
+ * binding. The binding is `subjectDigest`, which content-addresses the reviewed
+ * tree. A squash merge destroys the branch commit while preserving its tree, so
+ * an approval recorded at the branch tip kept a digest that still describes the
+ * post-merge tree exactly — yet resolving its now-orphaned SHA threw, the event
+ * was marked compromised, and a genuinely valid approval was discarded. The
+ * standing workaround was to hand-append a rebind event after every squash.
+ *
+ * Matching on the digest first is not a loosening: an event is accepted only
+ * when the tree it recorded is byte-for-byte the tree we have. Content that
+ * differs still fails, and an event whose commit is gone *and* whose digest
+ * matches nothing reachable is still marked unresolvable — fail-closed.
+ */
+function collectWorkingDeliverySubjects(input) {
+    const { repoRoot, slug, blueprintPath, events, unresolvableEventIds, issues } = input;
+    const candidates = new Map();
+    // Nothing to resolve against: skip before paying for a whole-tree read. This
+    // path also runs for plan-only ledgers, where the old code cost nothing.
+    if (!events.some((event) => event.purpose === "delivery"))
+        return [];
+    let liveDigest = null;
+    try {
+        const live = createDeliverySubjectAtRef(repoRoot, "HEAD", slug, blueprintPath);
+        liveDigest = live.digest;
+        candidates.set(live.digest, { scheme: live.scheme, digest: live.digest });
+    }
+    catch (error) {
+        // No HEAD (fresh repo) or no blueprint document at HEAD (first commit of a
+        // new blueprint). Not fatal: fall through to per-event reconstruction.
+        issues?.push(`Working delivery subject unavailable at HEAD for ${slug}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    for (const event of events) {
+        if (event.purpose !== "delivery")
+            continue;
+        // Already covered by the live tree — the reviewed content is exactly what
+        // we have, so the recorded commit does not need to exist any more.
+        if (liveDigest !== null && event.subjectDigest === liveDigest)
+            continue;
+        // Scope subject-construction failure to THIS event. A rebase rewrites
+        // commit SHAs, so a previously-recorded `reviewedCommit` can become
+        // unresolvable; letting that throw would escape to the outer catch and
+        // discard every approval, including valid ones for commits that still
+        // resolve. Mirror the ref-path's markCompromisedArtifactEvents: record the
+        // issue, mark the event compromised, and drop only it.
+        let subject;
+        try {
+            subject = createDeliverySubjectAtRef(repoRoot, event.reviewedCommit, slug, blueprintPath);
+        }
+        catch (error) {
+            issues?.push(`Working delivery review subject unavailable for ${event.id} at ${event.reviewedCommit}: ${error instanceof Error ? error.message : String(error)}`);
+            // Compromised (not merely skipped) so the event can never grant approval
+            // while still participating in reviewer supersession — see
+            // evaluateReviewEvents.
+            unresolvableEventIds.add(event.id);
+            continue;
+        }
+        if (subject.digest !== event.subjectDigest) {
+            issues?.push(`Working delivery review subject mismatch for ${event.id}: expected ${subject.digest}, found ${event.subjectDigest}.`);
+            continue;
+        }
+        candidates.set(subject.digest, { scheme: subject.scheme, digest: subject.digest });
+    }
+    return [...candidates.values()];
+}
 // Working-ledger acceptance: pre-commit validates a blueprint whose new review
 // events are staged alongside it and therefore not yet at any git ref. An
 // event still counts only when its subjectDigest matches the digest of the
@@ -167,36 +244,14 @@ function collectWorkingV2ReviewProvenance(file, purpose, issues) {
                     createLegacyPlanSubjectDigestForContent(slug, readFileSync(file)),
                 ].map((digest) => [digest, { scheme: "wp-blueprint-v1", digest }])).values(),
             ]
-            : [
-                ...new Map(working.events
-                    .filter((event) => event.purpose === "delivery")
-                    .flatMap((event) => {
-                    // Scope subject-construction failure to THIS event. A rebase
-                    // rewrites commit SHAs, so a previously-recorded
-                    // `reviewedCommit` can become unresolvable; letting that throw
-                    // would escape to the outer catch and discard every approval,
-                    // including valid ones for commits that still resolve. Mirror
-                    // the ref-path's markCompromisedArtifactEvents: record the
-                    // issue, mark the event compromised, and drop only it.
-                    let subject;
-                    try {
-                        subject = createDeliverySubjectAtRef(repoRoot, event.reviewedCommit, slug, normalizePath(path.relative(repoRoot, file)));
-                    }
-                    catch (error) {
-                        issues?.push(`Working delivery review subject unavailable for ${event.id} at ${event.reviewedCommit}: ${error instanceof Error ? error.message : String(error)}`);
-                        // Compromised (not merely skipped) so the event can never
-                        // grant approval while still participating in reviewer
-                        // supersession — see evaluateReviewEvents.
-                        unresolvableEventIds.add(event.id);
-                        return [];
-                    }
-                    if (subject.digest !== event.subjectDigest) {
-                        issues?.push(`Working delivery review subject mismatch for ${event.id}: expected ${subject.digest}, found ${event.subjectDigest}.`);
-                        return [];
-                    }
-                    return [[subject.digest, subject]];
-                })).values(),
-            ];
+            : collectWorkingDeliverySubjects({
+                repoRoot,
+                slug,
+                blueprintPath: normalizePath(path.relative(repoRoot, file)),
+                events: working.events,
+                unresolvableEventIds,
+                issues,
+            });
         return subjects
             .flatMap((subject) => evaluateReviewEvents(working.events, {
             purpose,

package/dist/esm/build/cli-mcp-parity.js

@@ -52,8 +52,9 @@ export const CLI_MCP_PARITY_CLASSIFICATION = {
     },
     "release-progress": {
         command: "release-progress",
-        classification: "follow-up-candidate",
-        reason: "operator/agent Release workflow phase reporter (detect/native-matrix/publish); CLI-only, uses gh API",
+        classification: "existing-mcp",
+        tools: ["wp_release_progress"],
+        reason: "Release workflow phase reporter (detect/native-matrix/publish) is available as wp_release_progress MCP and CLI",
     },
     cleanup: {
         command: "cleanup",

package/dist/esm/build/package-manifest.js

@@ -1,8 +1,8 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { dirname, join } from "node:path";
 import { parse as parseYaml } from "yaml";
-import { assertBuiltBlueprintMigrationSqlAssets } from "./blueprint-migration-assets.js";
-import { assertBuiltSastRuleAssets } from "./sast-rule-assets.js";
+import { assertBuiltBlueprintMigrationSqlAssets, syncBlueprintMigrationSqlAssets, } from "./blueprint-migration-assets.js";
+import { assertBuiltSastRuleAssets, syncSastRuleAssets } from "./sast-rule-assets.js";
 import { SESSION_MEMORY_NATIVE_TARGETS } from "#session-memory/native-targets.js";
 import { RUNTIME_TARGETS } from "./runtime-targets.js";
 const DEPENDENCY_SECTIONS = [
@@ -304,6 +304,11 @@ export function preparePackedManifest(rootDir, options = {}) {
     // out-of-org consumers cannot resolve.
     const packedManifest = createPackedManifest(manifest, readWorkspaceCatalogs(workspacePath), options);
     if (options.assertBlueprintMigrationAssets ?? true) {
+        // Sync authoring sources into dist before assert so pack/prepack paths
+        // (version dry-run, npm pack) do not require a full `pnpm run build` first.
+        // Assert still fails closed on missing source or content drift.
+        syncBlueprintMigrationSqlAssets(rootDir);
+        syncSastRuleAssets(rootDir);
         assertBuiltBlueprintMigrationSqlAssets(rootDir);
         assertBuiltSastRuleAssets(rootDir);
     }

package/dist/esm/cli/commands/audit-core.js

@@ -79,7 +79,15 @@ export async function runAuditDispatch(auditKind, targets, options, deps) {
         case "blueprint-pr-coverage": {
             const { auditBlueprintPrCoverage } = await import("#audit/blueprint-pr-coverage");
             const root = options.root ?? target ?? deps.root;
-            const baseRef = options.baseRef ?? options.base;
+            const explicitBaseRef = options.baseRef ?? options.base;
+            // Same pinned-base hazard as the branch-scoped audits: CI's
+            // `github.event.pull_request.base.sha` stops being the fork point once the
+            // branch is rebased, and this audit diffs `<baseRef>...HEAD`. Narrow it to
+            // the real fork point so coverage is judged on this PR's own files.
+            const { resolveBranchDiffBase } = await import("#git/changed-files");
+            const baseRef = explicitBaseRef
+                ? resolveBranchDiffBase(root, explicitBaseRef)
+                : explicitBaseRef;
             const result = auditBlueprintPrCoverage(root, { baseRef, headRef: options.headRef });
             return { kind: "repo-result", name: "blueprint-pr-coverage", result };
         }

package/dist/esm/cli/commands/audit.js

@@ -9,7 +9,7 @@ import { STRYKER_COMMAND } from "#audit/run-stryker.js";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { addAffectedOptions, resolveAffectedTargets } from "#git/affected";
-import { defaultBranchBaseRef, getBranchRemovedFiles, getStagedRemovedFiles, } from "#git/changed-files";
+import { defaultBranchBaseRef, getBranchRemovedFiles, getStagedRemovedFiles, resolveBranchDiffBase, } from "#git/changed-files";
 import { runAuditDispatch } from "#cli/commands/audit-core.js";
 import { createCliLogSink } from "#cli/commands/quality-log-store.js";
 import { emitCliCommandOutput, runLoggedChildCommand } from "#cli/commands/quality-runner.js";
@@ -284,6 +284,17 @@ export function registerAuditCommand(cli) {
         let dispatchOptions = options;
         let auditScope = "full";
         let changeRemovesFile = false;
+        // A caller-supplied `--base` is a PINNED sha (CI passes
+        // `github.event.pull_request.base.sha`, which does not advance with the
+        // base branch). After a rebase it stops being the fork point, so scoping
+        // off it silently absorbs everything merged into the base branch since
+        // the PR opened. Narrow it to the real fork point once, and use that one
+        // value everywhere the branch scope is derived so the affected file set,
+        // the removal probe, and the audit's own base-vs-head range agree.
+        const explicitBaseRef = options.baseRef ?? options.base;
+        const branchBaseRef = branch && explicitBaseRef
+            ? resolveBranchDiffBase(auditRoot, explicitBaseRef)
+            : explicitBaseRef;
         if (affected || branch) {
             if (kind &&
                 AUDIT_KINDS.includes(kind) &&
@@ -309,7 +320,7 @@ export function registerAuditCommand(cli) {
                 cwd: auditRoot,
                 affected,
                 branch,
-                baseRef: options.baseRef ?? options.base,
+                baseRef: branchBaseRef,
                 explicitTargets: [],
                 policy: "fail-closed",
                 mapChangedFiles: (files) => files,
@@ -360,7 +371,7 @@ export function registerAuditCommand(cli) {
             changeRemovesFile = affected
                 ? affectedChangeRemovesFile(auditRoot, {
                     branch,
-                    baseRef: options.baseRef ?? options.base,
+                    baseRef: branchBaseRef,
                 })
                 : false;
             if (resolution.kind === "empty" && !changeRemovesFile) {
@@ -392,7 +403,7 @@ export function registerAuditCommand(cli) {
                     changedOnly: true,
                     affectedFiles: [],
                     root: options.root ?? resolution.cwd,
-                    baseRef: options.baseRef ?? options.base,
+                    baseRef: branchBaseRef,
                 };
             }
             if (resolution.kind === "scoped") {
@@ -404,7 +415,7 @@ export function registerAuditCommand(cli) {
                     changedOnly: true,
                     affectedFiles: [...resolution.targets],
                     root: options.root ?? resolution.cwd,
-                    baseRef: options.baseRef ?? options.base,
+                    baseRef: branchBaseRef,
                 };
             }
         }

package/dist/esm/cli/commands/init/mcp-spec.d.ts

@@ -36,13 +36,28 @@ export interface WebpressoInstallProbe {
  * machine. Probes the locations consumers use to install webpresso, in order
  * of stability:
  *
- *   1. the stable global `wp` shim available on PATH
- *   2. the currently executing `@webpresso/agent-kit` package
+ *   1. the stable global `wp` shim available on PATH (including the
+ *      vite-plus multi-package shim at `~/.vite-plus/bin/wp`)
+ *   2. the currently executing `@webpresso/agent-kit` package **only when it
+ *      is not a vite-plus `agent-kit#<installId>` payload path**
  *   3. Claude plugin install — `~/.claude/plugins/cache/.../agent-kit/`
  *   4. bun global — `~/.bun/install/global/node_modules/@webpresso/agent-kit/`
- * Returns `null` when none of the candidates contain a usable `bin/wp`.
+ *
+ * Host MCP configs (Grok/Codex/etc.) must never be pinned to a versioned
+ * installId tree: the next `wp update` / `vp update -g` deletes that path and
+ * leaves every host with a dead launcher. Returns `null` when none of the
+ * candidates yield a durable `wp`.
  */
 export declare function findWebpressoMcpEntry(probe?: WebpressoInstallProbe): string | null;
+/**
+ * True when `entryPath` is the stable vite-plus multi-package `wp` shim that
+ * dispatches to `@webpresso/agent-kit` via `~/.vite-plus/bins/wp.json`.
+ *
+ * Unlike {@link isWebpressoWpEntry}, this does **not** require realpath to land
+ * inside a package `bin/wp` tree — vite-plus's `wp` is a symlink to the `vp`
+ * binary, so package-root ownership is proven via the bins metadata instead.
+ */
+export declare function isVitePlusManagedWebpressoWp(entryPath: string): boolean;
 export declare function resolveWebpressoMcpEntry(probe?: WebpressoInstallProbe): {
     entryPath: string | null;
     checked: readonly string[];

package/dist/esm/cli/commands/init/mcp-spec.js

@@ -12,9 +12,10 @@
  */
 import { accessSync, constants, existsSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { execFileSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
+import { isVersionedAgentKitPayloadPath } from "#cli/auto-update/self-invocation.js";
 import { pathCandidates } from "#runtime/command-exists.js";
 export const WEBPRESSO_MCP_SERVER_NAME = "webpresso";
 /**
@@ -67,11 +68,17 @@ const WP_LAUNCHER_REQUIRED_RELATIVES = [
  * machine. Probes the locations consumers use to install webpresso, in order
  * of stability:
  *
- *   1. the stable global `wp` shim available on PATH
- *   2. the currently executing `@webpresso/agent-kit` package
+ *   1. the stable global `wp` shim available on PATH (including the
+ *      vite-plus multi-package shim at `~/.vite-plus/bin/wp`)
+ *   2. the currently executing `@webpresso/agent-kit` package **only when it
+ *      is not a vite-plus `agent-kit#<installId>` payload path**
  *   3. Claude plugin install — `~/.claude/plugins/cache/.../agent-kit/`
  *   4. bun global — `~/.bun/install/global/node_modules/@webpresso/agent-kit/`
- * Returns `null` when none of the candidates contain a usable `bin/wp`.
+ *
+ * Host MCP configs (Grok/Codex/etc.) must never be pinned to a versioned
+ * installId tree: the next `wp update` / `vp update -g` deletes that path and
+ * leaves every host with a dead launcher. Returns `null` when none of the
+ * candidates yield a durable `wp`.
  */
 export function findWebpressoMcpEntry(probe = {}) {
     return resolveWebpressoMcpEntry(probe).entryPath;
@@ -79,6 +86,37 @@ export function findWebpressoMcpEntry(probe = {}) {
 function isUsableWebpressoMcpRoot(root) {
     return WP_LAUNCHER_REQUIRED_RELATIVES.every((relativePath) => existsSync(join(root, relativePath)));
 }
+/**
+ * True when `entryPath` is the stable vite-plus multi-package `wp` shim that
+ * dispatches to `@webpresso/agent-kit` via `~/.vite-plus/bins/wp.json`.
+ *
+ * Unlike {@link isWebpressoWpEntry}, this does **not** require realpath to land
+ * inside a package `bin/wp` tree — vite-plus's `wp` is a symlink to the `vp`
+ * binary, so package-root ownership is proven via the bins metadata instead.
+ */
+export function isVitePlusManagedWebpressoWp(entryPath) {
+    try {
+        if (isVersionedAgentKitPayloadPath(entryPath))
+            return false;
+        const binDir = dirname(entryPath);
+        if (basename(binDir) !== "bin")
+            return false;
+        if (basename(dirname(binDir)) !== ".vite-plus")
+            return false;
+        const base = basename(entryPath).toLowerCase();
+        if (base !== "wp" && base !== "wp.exe")
+            return false;
+        const metaPath = join(dirname(binDir), "bins", "wp.json");
+        const meta = JSON.parse(readFileSync(metaPath, "utf8"));
+        return meta.package === "@webpresso/agent-kit";
+    }
+    catch {
+        return false;
+    }
+}
+function isDurableMcpEntryPath(entryPath) {
+    return !isVersionedAgentKitPayloadPath(entryPath);
+}
 export function resolveWebpressoMcpEntry(probe = {}) {
     const checked = [];
     if (probe.candidates === undefined) {
@@ -88,10 +126,17 @@ export function resolveWebpressoMcpEntry(probe = {}) {
         if (stableEntry) {
             checked.push(stableEntry);
             const packageWp = packageWpFromAdjacentNpmCmdShim(stableEntry);
-            if (packageWp !== null)
+            if (packageWp !== null && isDurableMcpEntryPath(packageWp)) {
                 return { entryPath: packageWp, checked };
+            }
             const verifierAllows = probe.stableEntryIsWebpresso?.(stableEntry) ?? true;
-            if (verifierAllows && isWebpressoWpEntry(stableEntry)) {
+            // Prefer the vite-plus multi-package shim before package-root ownership:
+            // it survives installId swaps and is what PATH `wp` resolves to in the
+            // default consumer install.
+            if (verifierAllows && isVitePlusManagedWebpressoWp(stableEntry)) {
+                return { entryPath: stableEntry, checked };
+            }
+            if (verifierAllows && isWebpressoWpEntry(stableEntry) && isDurableMcpEntryPath(stableEntry)) {
                 return { entryPath: stableEntry, checked };
             }
         }
@@ -103,6 +148,9 @@ export function resolveWebpressoMcpEntry(probe = {}) {
                 continue;
             checked.push(root);
             const wpBin = join(root, WP_BIN_RELATIVE);
+            // Never materialize host MCP configs against a vite-plus installId tree.
+            if (!isDurableMcpEntryPath(wpBin))
+                continue;
             if (isTrustedWebpressoPackageRoot(root))
                 return { entryPath: wpBin, checked };
         }

package/dist/esm/cli/commands/init/scaffold-agents-md.js

@@ -30,13 +30,11 @@ const TECH_STACK_RULES = [
     { dep: /^typescript$/, label: "TypeScript" },
 ];
 // Kept under the 8 KB (8192-byte) hard ceiling. The rendered template embeds
-// the full `native_tool_names` registry list, so this soft target tracks the
-// tool count: adding an MCP tool grows the list by ~15-17 bytes. Bumped
-// 8_100 -> 8_180 for the four-tool batch (wp_ci_preflight, wp_session_id,
-// wp_session_info, wp_review_run), which renders ~8_160 — still 30+ bytes under
-// 8_192. The 8_192 ceiling is the real guardrail; the next addition that would
-// breach it should trigger a conscious restructure (or exclude the
-// auto-generated tool list from the prose budget), not another reflexive bump.
+// the full `native_tool_names` registry list (~15-17 bytes per tool). Soft
+// target 8_180 leaves headroom under 8_192. The ui-compose batch
+// (wp_ui_blocks_list, wp_ui_compose, wp_ui_preview) required trimming catalog
+// AGENTS.md.tpl prose rather than raising the ceiling. Next breach of 8_192
+// should restructure (or stop embedding the full tool list), not bump again.
 export const AGENTS_MD_MAX_BYTES = 8_180;
 export function renderRepositoryMap(consumer) {
     const packages = consumer.workspacePackages;

package/dist/esm/cli/commands/package-manager.js

@@ -184,6 +184,9 @@ function runGlobalUpdateCommand(deps) {
                 else {
                     failed = true;
                     console.error(message);
+                    // Required step failed — stop so optional host refreshes cannot
+                    // look like a successful update after a broken agent-kit install.
+                    break;
                 }
             }
         }
@@ -195,6 +198,7 @@ function runGlobalUpdateCommand(deps) {
             else {
                 failed = true;
                 console.error(message);
+                break;
             }
         }
     }
@@ -313,8 +317,10 @@ function runAgentKitSelfUpdateStep(deps) {
             return spawnLike(status, new Error("another agent-kit installer is active; re-run `wp update` once it finishes"));
         case GUARD_EXIT_OWNERSHIP_LOST:
             return spawnLike(status, new Error("install lease ownership was lost mid-update; the takeover installer verifies the store — re-run `wp update` to confirm"));
-        default:
-            return spawnLike(status === 0 ? 1 : status, new Error(`self-install-guard exited ${status}`));
+        default: {
+            const code = status === 0 ? 1 : status;
+            return spawnLike(code, new Error(`agent-kit self-install failed (self-install-guard exit ${code}); re-run \`wp update\` or \`vp install -g @webpresso/agent-kit\``));
+        }
     }
 }
 function refreshCodexPlugin(deps) {

package/dist/esm/compose/compose.d.ts

@@ -0,0 +1,38 @@
+import { z } from "zod";
+import { type ResolvedBlockRegistry } from "./registry-resolve.js";
+export declare const composeInputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    profile: z.ZodLiteral<"admin-crud">;
+    kind: z.ZodEnum<{
+        detail: "detail";
+        form: "form";
+        list: "list";
+    }>;
+    spec: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strict>, z.ZodObject<{
+    profile: z.ZodLiteral<"ops-report">;
+    spec: z.ZodUnknown;
+}, z.core.$strict>], "profile">;
+export type ComposeInput = z.infer<typeof composeInputSchema>;
+export interface ComposeDiagnostic {
+    readonly path: string;
+    readonly message: string;
+}
+export interface ComposeResult {
+    readonly ok: boolean;
+    readonly profile: "admin-crud" | "ops-report" | "unknown";
+    /** Legal admin-crud returns the input spec unchanged (validate-only). */
+    readonly spec: unknown;
+    readonly diagnostics: readonly ComposeDiagnostic[];
+    readonly registrySource?: "project" | "snapshot";
+    readonly registryVersion?: string;
+    readonly warnings: readonly string[];
+}
+/**
+ * Profile-discriminated compose validation (tool-level).
+ * Registry resolve may walk the filesystem from `cwd` / `process.cwd()` when
+ * `resolvedRegistry` is not injected.
+ */
+export declare function composeValidate(raw: unknown, options?: {
+    readonly cwd?: string;
+    readonly resolvedRegistry?: ResolvedBlockRegistry;
+}): ComposeResult;

package/dist/esm/compose/compose.js

@@ -0,0 +1,143 @@
+import { z } from "zod";
+import { opsReportSpecSchema } from "./ops-report-schema.js";
+import { blockNamesForView, resolveBlockRegistry, } from "./registry-resolve.js";
+const adminKindSchema = z.enum(["list", "detail", "form"]);
+const adminCrudInputSchema = z
+    .object({
+    profile: z.literal("admin-crud"),
+    kind: adminKindSchema,
+    /** Opaque page/spec payload; blocks[] validated against registry when present. */
+    spec: z.record(z.string(), z.unknown()),
+})
+    .strict();
+const opsReportInputSchema = z
+    .object({
+    profile: z.literal("ops-report"),
+    spec: z.unknown(),
+})
+    .strict();
+export const composeInputSchema = z.discriminatedUnion("profile", [
+    adminCrudInputSchema,
+    opsReportInputSchema,
+]);
+function zodToDiagnostics(error) {
+    return error.issues.map((issue) => ({
+        path: issue.path.length > 0 ? issue.path.join(".") : "(root)",
+        message: issue.message,
+    }));
+}
+function validateAdminBlocks(kind, spec, resolved) {
+    const diagnostics = [];
+    const warnings = [];
+    const allowed = blockNamesForView(resolved.registry, kind);
+    const blocks = spec["blocks"];
+    if (blocks === undefined) {
+        warnings.push("admin-crud spec has no top-level blocks[]; registry types were not checked (validate-only passthrough).");
+        return { diagnostics, warnings };
+    }
+    if (!Array.isArray(blocks)) {
+        diagnostics.push({ path: "spec.blocks", message: "blocks must be an array" });
+        return { diagnostics, warnings };
+    }
+    for (const [index, block] of blocks.entries()) {
+        if (block === null || typeof block !== "object" || Array.isArray(block)) {
+            diagnostics.push({ path: `spec.blocks.${index}`, message: "block must be an object" });
+            continue;
+        }
+        const type = block["type"];
+        if (typeof type !== "string" || type.length === 0) {
+            diagnostics.push({
+                path: `spec.blocks.${index}.type`,
+                message: "block requires string type",
+            });
+            continue;
+        }
+        if (!allowed.has(type)) {
+            diagnostics.push({
+                path: `spec.blocks.${index}.type`,
+                message: `illegal block type "${type}" for ${kind}; allowed: ${[...allowed].sort().join(", ")}`,
+            });
+        }
+    }
+    return { diagnostics, warnings };
+}
+/**
+ * Profile-discriminated compose validation (tool-level).
+ * Registry resolve may walk the filesystem from `cwd` / `process.cwd()` when
+ * `resolvedRegistry` is not injected.
+ */
+export function composeValidate(raw, options = {}) {
+    const parsed = composeInputSchema.safeParse(raw);
+    if (!parsed.success) {
+        return {
+            ok: false,
+            profile: "unknown",
+            spec: null,
+            diagnostics: zodToDiagnostics(parsed.error),
+            warnings: [],
+        };
+    }
+    const input = parsed.data;
+    /** Prefer original caller object identity for admin-crud passthrough. */
+    const originalSpec = raw !== null && typeof raw === "object" && !Array.isArray(raw) && "spec" in raw
+        ? raw.spec
+        : input.spec;
+    if (input.profile === "ops-report") {
+        const ops = opsReportSpecSchema.safeParse(input.spec);
+        if (!ops.success) {
+            return {
+                ok: false,
+                profile: "ops-report",
+                spec: originalSpec,
+                diagnostics: zodToDiagnostics(ops.error),
+                warnings: [],
+            };
+        }
+        return {
+            ok: true,
+            profile: "ops-report",
+            spec: ops.data,
+            diagnostics: [],
+            warnings: [],
+        };
+    }
+    // admin-crud: validate-only — return caller's spec object unchanged when legal
+    let resolved = options.resolvedRegistry;
+    if (!resolved) {
+        try {
+            resolved = resolveBlockRegistry({ cwd: options.cwd });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            return {
+                ok: false,
+                profile: "admin-crud",
+                spec: originalSpec,
+                diagnostics: [{ path: "registry", message }],
+                warnings: [],
+            };
+        }
+    }
+    const { diagnostics: blockDiagnostics, warnings: blockWarnings } = validateAdminBlocks(input.kind, input.spec, resolved);
+    const warnings = [...resolved.warnings, ...blockWarnings];
+    if (blockDiagnostics.length > 0) {
+        return {
+            ok: false,
+            profile: "admin-crud",
+            spec: originalSpec,
+            diagnostics: blockDiagnostics,
+            registrySource: resolved.source,
+            registryVersion: resolved.registryVersion,
+            warnings,
+        };
+    }
+    return {
+        ok: true,
+        profile: "admin-crud",
+        spec: originalSpec,
+        diagnostics: [],
+        registrySource: resolved.source,
+        registryVersion: resolved.registryVersion,
+        warnings,
+    };
+}

package/dist/esm/compose/escape-html.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Single HTML encode chokepoint for compose/ops-report output.
+ * All untrusted strings must pass through here before interpolation.
+ */
+export declare function escapeHtml(value: string): string;

package/dist/esm/compose/escape-html.js

@@ -0,0 +1,12 @@
+/**
+ * Single HTML encode chokepoint for compose/ops-report output.
+ * All untrusted strings must pass through here before interpolation.
+ */
+export function escapeHtml(value) {
+    return value
+        .replaceAll("&", "&")
+        .replaceAll("<", "&lt;")
+        .replaceAll(">", "&gt;")
+        .replaceAll('"', "&quot;")
+        .replaceAll("'", "&#39;");
+}

package/dist/esm/compose/ops-report-render.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Render a validated OpsReportSpec to self-contained HTML.
+ * Callers should pass already-validated specs; this re-parses for safety.
+ */
+export declare function renderOpsReportHtml(input: unknown): string;