agent-contracts 0.12.4 → 0.14.0

package/dist/cli.js

@@ -6293,7 +6293,7 @@ var init_index_es = __esm({
         return { drive: t4.toLowerCase() + ":" };
       }, k2 = function() {
         return { drive: null };
-      }, z17 = function() {
+      }, z18 = function() {
         return { drive: null };
       }, B2 = function(t4) {
         return { protocol: null, origin: null, absolute: false, drive: null, ...t4 };
@@ -6334,7 +6334,7 @@ var init_index_es = __esm({
           var t4, n4, r4, e4, o4;
           return t4 = K2, (n4 = rt()) !== c2 && (r4 = et()) !== c2 && (e4 = ut()) !== c2 && (o4 = it()) !== c2 ? (n4 = s2(n4, r4, e4, o4), t4 = n4) : (K2 = t4, t4 = c2), t4 === c2 && (t4 = K2, (n4 = rt()) !== c2 && (r4 = et()) !== c2 && (e4 = (function() {
             var t5;
-            return (t5 = x3) !== c2 && (t5 = z17()), t5;
+            return (t5 = x3) !== c2 && (t5 = z18()), t5;
           })()) !== c2 ? (n4 = f2(n4, r4, e4), t4 = n4) : (K2 = t4, t4 = c2)), t4;
         })()) === c2 && (n3 = (function() {
           var n4, r4, e4, o4;
@@ -8023,7 +8023,7 @@ __export(index_es_exports2, {
   resolveExternalRef: () => ye,
   resolveExternalRefWithLocation: () => ge,
   resolveInlineRef: () => B,
-  resolveInlineRefWithLocation: () => z16,
+  resolveInlineRefWithLocation: () => z17,
   safeParse: () => de,
   safeStringify: () => ve,
   startsWith: () => be,
@@ -8067,9 +8067,9 @@ function* L(e3, t3, r3) {
   for (const [n3, o3] of t3.entries()) O(e3.value, o3, r3), e3.value = e3.value[o3], A(e3.value) && (j(e3.value), yield [n3, e3.value]);
 }
 function B(e3, t3) {
-  return z16(e3, t3).value;
+  return z17(e3, t3).value;
 }
-function z16(e3, t3) {
+function z17(e3, t3) {
   return (function e4(t4, r3, n3, o3) {
     if (null !== V(r3)) throw new ReferenceError("Cannot resolve external references");
     const i3 = K(r3);
@@ -16899,7 +16899,7 @@ var require_immer_cjs_production_min = __commonJS({
       var t4 = n4[H2];
       return (t4 ? s2(t4) : n4)[r4];
     }
-    function z17(n4, r4) {
+    function z18(n4, r4) {
       if (r4 in n4) for (var t4 = Object.getPrototypeOf(n4); t4; ) {
         var e4 = Object.getOwnPropertyDescriptor(t4, r4);
         if (e4) return e4;
@@ -17292,7 +17292,7 @@ var require_immer_cjs_production_min = __commonJS({
       if (r4 === H2) return n4;
       var e4 = s2(n4);
       if (!u2(e4, r4)) return (function(n5, r5, t4) {
-        var e5, i5 = z17(r5, t4);
+        var e5, i5 = z18(r5, t4);
         return i5 ? "value" in i5 ? i5.value : null === (e5 = i5.get) || void 0 === e5 ? void 0 : e5.call(n5.k) : void 0;
       })(n4, e4, r4);
       var i4 = e4[r4];
@@ -17302,7 +17302,7 @@ var require_immer_cjs_production_min = __commonJS({
     }, ownKeys: function(n4) {
       return Reflect.ownKeys(s2(n4));
     }, set: function(n4, r4, t4) {
-      var e4 = z17(s2(n4), r4);
+      var e4 = z18(s2(n4), r4);
       if (null == e4 ? void 0 : e4.set) return e4.set.call(n4.k, t4), true;
       if (!n4.g) {
         var i4 = A2(s2(n4), r4), o4 = null == i4 ? void 0 : i4[H2];
@@ -35641,11 +35641,11 @@ var require_brace_expansion = __commonJS({
             if (pad) {
               var need = width - c2.length;
               if (need > 0) {
-                var z17 = new Array(need + 1).join("0");
+                var z18 = new Array(need + 1).join("0");
                 if (i3 < 0)
-                  c2 = "-" + z17 + c2.slice(1);
+                  c2 = "-" + z18 + c2.slice(1);
                 else
-                  c2 = z17 + c2;
+                  c2 = z18 + c2;
               }
             }
           }
@@ -49169,7 +49169,7 @@ var require_dist10 = __commonJS({
     var getSiblings = (parent) => (node) => getChildren(parent).filter(not(eq(node)));
     var concatAll = (
       /*::<T>*/
-      (xs) => (ys) => ys.reduce((zs, z17) => zs.concat(z17), xs)
+      (xs) => (ys) => ys.reduce((zs, z18) => zs.concat(z18), xs)
     );
     function getLastSegment(instancePath) {
       const index4 = instancePath.lastIndexOf("/");
@@ -49864,7 +49864,7 @@ var require_dist12 = __commonJS({
     var draft4MetaSchema = require_json_schema_draft_04();
     var META_SUPPORT_DATA = ["/properties"];
     var META_SCHEMA_ID = "http://json-schema.org/draft-04/schema";
-    var Ajv2 = class extends core_1.default {
+    var Ajv3 = class extends core_1.default {
       constructor(opts = {}) {
         super({
           ...opts,
@@ -49889,9 +49889,9 @@ var require_dist12 = __commonJS({
         return this.opts.defaultMeta = super.defaultMeta() || (this.getSchema(META_SCHEMA_ID) ? META_SCHEMA_ID : void 0);
       }
     };
-    module.exports = exports = Ajv2;
+    module.exports = exports = Ajv3;
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.default = Ajv2;
+    exports.default = Ajv3;
     var core_2 = __require("ajv/dist/core");
     Object.defineProperty(exports, "KeywordCxt", { enumerable: true, get: function() {
       return core_2.KeywordCxt;
@@ -50088,8 +50088,8 @@ var require_ajv2 = __commonJS({
       log: console.log,
       error: console.error
     };
-    function createAjvInstance(Ajv2, allErrors) {
-      const ajv2 = new Ajv2({
+    function createAjvInstance(Ajv3, allErrors) {
+      const ajv2 = new Ajv3({
         allErrors,
         meta: true,
         messages: true,
@@ -50102,22 +50102,22 @@ var require_ajv2 = __commonJS({
       if (allErrors) {
         (0, ajv_errors_1.default)(ajv2);
       }
-      if (Ajv2 === ajv_1.default) {
+      if (Ajv3 === ajv_1.default) {
         ajv2.addSchema(draft4MetaSchema);
         ajv2.addSchema(draft6MetaSchema);
       }
       return ajv2;
     }
-    function _createAjvInstances(Ajv2) {
+    function _createAjvInstances(Ajv3) {
       let _default;
       let _allErrors;
       return {
         get default() {
-          _default !== null && _default !== void 0 ? _default : _default = createAjvInstance(Ajv2, false);
+          _default !== null && _default !== void 0 ? _default : _default = createAjvInstance(Ajv3, false);
           return _default;
         },
         get allErrors() {
-          _allErrors !== null && _allErrors !== void 0 ? _allErrors : _allErrors = createAjvInstance(Ajv2, true);
+          _allErrors !== null && _allErrors !== void 0 ? _allErrors : _allErrors = createAjvInstance(Ajv3, true);
           return _allErrors;
         }
       };
@@ -50499,44 +50499,66 @@ var ArtifactSchema = z2.object({
 }).passthrough();
 
 // src/schema/binding.ts
+import { z as z4 } from "zod";
+
+// src/schema/context-type.ts
 import { z as z3 } from "zod";
-var CommandRegexMatcherSchema = z3.object({
-  type: z3.literal("command_regex"),
-  pattern: z3.string()
+var CONTEXT_TYPES = [
+  "agent",
+  "task",
+  "artifact",
+  "tool",
+  "validation",
+  "handoff_type",
+  "workflow",
+  "policy",
+  "guardrail",
+  "guardrail_policy",
+  "system"
+];
+var ContextTypeSchema = z3.enum(CONTEXT_TYPES);
+var ITERABLE_CONTEXT_TYPES = CONTEXT_TYPES.filter(
+  (t3) => t3 !== "system"
+);
+
+// src/schema/binding.ts
+var CommandRegexMatcherSchema = z4.object({
+  type: z4.literal("command_regex"),
+  pattern: z4.string()
 }).passthrough();
-var ContentRegexMatcherSchema = z3.object({
-  type: z3.literal("content_regex"),
-  pattern: z3.string(),
-  file_glob: z3.string().optional(),
-  exclude_glob: z3.string().optional()
+var ContentRegexMatcherSchema = z4.object({
+  type: z4.literal("content_regex"),
+  pattern: z4.string(),
+  file_glob: z4.string().optional(),
+  exclude_glob: z4.string().optional()
 }).passthrough();
-var FileGlobMatcherSchema = z3.object({
-  type: z3.literal("file_glob"),
-  pattern: z3.string(),
-  exclude_glob: z3.string().optional()
+var FileGlobMatcherSchema = z4.object({
+  type: z4.literal("file_glob"),
+  pattern: z4.string(),
+  exclude_glob: z4.string().optional()
 }).passthrough();
-var MatcherSchema = z3.discriminatedUnion("type", [
+var MatcherSchema = z4.discriminatedUnion("type", [
   CommandRegexMatcherSchema,
   ContentRegexMatcherSchema,
   FileGlobMatcherSchema
 ]);
-var CheckSchema = z3.object({
+var CheckSchema = z4.object({
   matcher: MatcherSchema.optional(),
-  script: z3.string().optional(),
-  message: z3.string().optional()
+  script: z4.string().optional(),
+  message: z4.string().optional()
 }).passthrough();
-var BindingOutputSchema = z3.object({
-  target: z3.string(),
-  template: z3.string().optional(),
-  inline_template: z3.string().optional(),
-  source: z3.string().optional(),
-  mode: z3.enum(["write", "patch"]).default("write"),
-  format: z3.enum(["json", "yaml", "text"]).optional(),
-  patch_strategy: z3.enum(["deep_merge", "append"]).optional(),
-  array_merge_key: z3.string().optional(),
-  group_by: z3.string().optional(),
-  executable: z3.boolean().optional(),
-  skip_empty: z3.boolean().optional()
+var BindingOutputSchema = z4.object({
+  target: z4.string(),
+  template: z4.string().optional(),
+  inline_template: z4.string().optional(),
+  source: z4.string().optional(),
+  mode: z4.enum(["write", "patch"]).default("write"),
+  format: z4.enum(["json", "yaml", "text"]).optional(),
+  patch_strategy: z4.enum(["deep_merge", "append"]).optional(),
+  array_merge_key: z4.string().optional(),
+  group_by: z4.string().optional(),
+  executable: z4.boolean().optional(),
+  skip_empty: z4.boolean().optional()
 }).passthrough().refine(
   (data) => {
     const count = [data.template, data.inline_template, data.source].filter(Boolean).length;
@@ -50544,247 +50566,300 @@ var BindingOutputSchema = z3.object({
   },
   { message: "Only one of template, inline_template, or source may be specified" }
 );
-var ReportingSchema = z3.object({
-  commands: z3.record(z3.string(), z3.string()),
-  fail_open: z3.boolean().default(true),
-  timeout_ms: z3.number().default(5e3)
+var ReportingSchema = z4.object({
+  commands: z4.record(z4.string(), z4.string()),
+  fail_open: z4.boolean().default(true),
+  timeout_ms: z4.number().default(5e3)
 }).passthrough();
-var GuardrailImplSchema = z3.object({
-  checks: z3.array(CheckSchema)
-});
-var SoftwareBindingSchema = z3.object({
-  software: z3.string(),
-  version: z3.literal(1),
-  extends: z3.string().optional(),
-  guardrail_impl: z3.record(z3.string(), GuardrailImplSchema).optional(),
-  outputs: z3.record(z3.string(), BindingOutputSchema).optional(),
+var GuardrailImplSchema = z4.object({
+  checks: z4.array(CheckSchema)
+});
+var BindingRenderTargetSchema = z4.object({
+  template: z4.string().optional(),
+  inline_template: z4.string().optional(),
+  context: ContextTypeSchema,
+  output: z4.string(),
+  include: z4.array(z4.string()).optional(),
+  exclude: z4.array(z4.string()).optional(),
+  skip_empty: z4.boolean().optional(),
+  executable: z4.boolean().optional()
+}).passthrough().refine(
+  (data) => {
+    const count = [data.template, data.inline_template].filter(Boolean).length;
+    return count === 1;
+  },
+  { message: "Exactly one of template or inline_template must be specified" }
+).refine(
+  (data) => !(data.include && data.exclude),
+  { message: "include and exclude are mutually exclusive" }
+).refine(
+  (data) => {
+    if (data.context === "system" && (data.include || data.exclude)) {
+      return false;
+    }
+    return true;
+  },
+  { message: "include/exclude cannot be used with context: system" }
+);
+var SoftwareBindingSchema = z4.object({
+  software: z4.string(),
+  version: z4.literal(1),
+  extends: z4.string().optional(),
+  guardrail_impl: z4.record(z4.string(), GuardrailImplSchema).optional(),
+  outputs: z4.record(z4.string(), BindingOutputSchema).optional(),
+  renders: z4.array(BindingRenderTargetSchema).optional(),
   reporting: ReportingSchema.optional()
 }).passthrough();
 
 // src/schema/dsl.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 
 // src/schema/handoff-type.ts
-import { z as z4 } from "zod";
-var HandoffTypeSchema = z4.object({
-  version: z4.number(),
-  description: z4.string().optional(),
-  schema: z4.record(z4.string(), z4.any()),
-  example: z4.record(z4.string(), z4.any()).optional()
+import { z as z5 } from "zod";
+var HandoffTypeSchema = z5.object({
+  version: z5.number(),
+  description: z5.string().optional(),
+  schema: z5.record(z5.string(), z5.any()),
+  example: z5.record(z5.string(), z5.any()).optional()
 }).passthrough();
 
 // src/schema/guardrail.ts
-import { z as z5 } from "zod";
-var GuardrailScopeSchema = z5.object({
-  agents: z5.array(z5.string()).optional(),
-  tasks: z5.array(z5.string()).optional(),
-  tools: z5.array(z5.string()).optional(),
-  artifacts: z5.array(z5.string()).optional(),
-  workflows: z5.array(z5.string()).optional()
+import { z as z6 } from "zod";
+var GuardrailScopeSchema = z6.object({
+  agents: z6.array(z6.string()).optional(),
+  tasks: z6.array(z6.string()).optional(),
+  tools: z6.array(z6.string()).optional(),
+  artifacts: z6.array(z6.string()).optional(),
+  workflows: z6.array(z6.string()).optional()
 }).passthrough();
-var GuardrailSchema = z5.object({
-  description: z5.string(),
+var GuardrailSchema = z6.object({
+  description: z6.string(),
   scope: GuardrailScopeSchema,
-  rationale: z5.string().optional(),
-  tags: z5.array(z5.string()).default([]),
-  exemptions: z5.array(z5.string()).optional()
+  rationale: z6.string().optional(),
+  tags: z6.array(z6.string()).default([]),
+  exemptions: z6.array(z6.string()).optional()
 }).passthrough();
-var GuardrailPolicyRuleEscalationSchema = z5.object({
-  target: z5.string(),
-  condition: z5.string().optional()
+var GuardrailPolicyRuleEscalationSchema = z6.object({
+  target: z6.string(),
+  condition: z6.string().optional()
 }).passthrough();
-var GuardrailPolicyRuleSchema = z5.object({
-  guardrail: z5.string(),
-  severity: z5.enum(["critical", "mandatory", "warning", "info"]),
-  action: z5.enum(["block", "warn", "shadow", "info"]),
-  allow_override: z5.boolean().default(false),
-  override_requires: z5.array(z5.string()).optional(),
+var GuardrailPolicyRuleSchema = z6.object({
+  guardrail: z6.string(),
+  severity: z6.enum(["critical", "mandatory", "warning", "info"]),
+  action: z6.enum(["block", "warn", "shadow", "info"]),
+  allow_override: z6.boolean().default(false),
+  override_requires: z6.array(z6.string()).optional(),
   escalation: GuardrailPolicyRuleEscalationSchema.optional()
 }).passthrough();
-var GuardrailPolicySchema = z5.object({
-  description: z5.string().optional(),
-  rules: z5.array(GuardrailPolicyRuleSchema)
+var GuardrailPolicySchema = z6.object({
+  description: z6.string().optional(),
+  rules: z6.array(GuardrailPolicyRuleSchema)
 }).passthrough();
 
 // src/schema/policy.ts
-import { z as z6 } from "zod";
-var PolicyWhenSchema = z6.object({
-  artifact_type: z6.string().optional(),
-  workflow: z6.string().optional()
+import { z as z7 } from "zod";
+var PolicyWhenSchema = z7.object({
+  artifact_type: z7.string().optional(),
+  workflow: z7.string().optional()
 }).passthrough();
-var PolicySchema = z6.object({
+var PolicySchema = z7.object({
   when: PolicyWhenSchema,
-  requires_validations: z6.array(z6.string()).optional(),
-  requires: z6.array(z6.string()).optional()
+  requires_validations: z7.array(z7.string()).optional(),
+  requires: z7.array(z7.string()).optional()
 }).passthrough();
 
 // src/schema/system.ts
-import { z as z7 } from "zod";
-var VersionLiteralSchema = z7.literal(1);
-var ExtendsSchema = z7.string().optional();
-var SystemSchema = z7.object({
-  id: z7.string(),
-  name: z7.string(),
-  default_workflow_order: z7.array(z7.string())
-}).passthrough();
-
-// src/schema/task.ts
 import { z as z8 } from "zod";
-var ExecutionStepSchema = z8.object({
+var VersionLiteralSchema = z8.literal(1);
+var ExtendsSchema = z8.string().optional();
+var SystemSchema = z8.object({
   id: z8.string(),
-  action: z8.string(),
-  description: z8.string().optional(),
-  required: z8.boolean().optional(),
-  abort_on_failure: z8.boolean().optional(),
-  uses_tool: z8.string().optional(),
-  produces_artifact: z8.string().optional(),
-  reads_artifact: z8.string().optional(),
-  depends_on: z8.array(z8.string()).optional(),
-  skip_condition: z8.string().optional(),
-  wait_for_approval: z8.boolean().optional()
-}).passthrough();
-var TaskSchema = z8.object({
-  description: z8.string(),
-  target_agent: z8.string(),
-  allowed_from_agents: z8.array(z8.string()),
-  workflow: z8.string(),
-  input_artifacts: z8.array(z8.string()),
-  invocation_handoff: z8.string(),
-  result_handoff: z8.string(),
-  default_priority: z8.string().optional(),
-  responsibilities: z8.array(z8.string()).optional(),
-  constraints: z8.array(z8.string()).optional(),
-  execution_steps: z8.array(ExecutionStepSchema).optional(),
-  completion_criteria: z8.array(z8.string()).optional(),
-  rules: z8.array(RuleSchema).optional(),
-  anti_patterns: z8.array(z8.string()).optional(),
-  escalation_criteria: z8.array(EscalationCriterionSchema).optional(),
-  validations: z8.array(z8.string()).default([]),
-  guardrails: z8.array(z8.string()).optional()
+  name: z8.string(),
+  default_workflow_order: z8.array(z8.string())
 }).passthrough();
 
-// src/schema/tool.ts
+// src/schema/task.ts
 import { z as z9 } from "zod";
-var CommandSchema = z9.object({
-  command: z9.string(),
-  category: z9.string(),
-  reads: z9.array(z9.string()).default([]),
-  writes: z9.array(z9.string()).default([]),
-  purpose: z9.string().optional()
-});
-var ToolSchema = z9.object({
-  kind: z9.string(),
+var ExecutionStepSchema = z9.object({
+  id: z9.string(),
+  action: z9.string(),
   description: z9.string().optional(),
-  input_artifacts: z9.array(z9.string()).default([]),
-  output_artifacts: z9.array(z9.string()).default([]),
-  invokable_by: z9.array(z9.string()),
-  side_effects: z9.array(z9.string()).default([]),
-  commands: z9.array(CommandSchema).default([]),
+  required: z9.boolean().optional(),
+  abort_on_failure: z9.boolean().optional(),
+  uses_tool: z9.string().optional(),
+  produces_artifact: z9.string().optional(),
+  reads_artifact: z9.string().optional(),
+  depends_on: z9.array(z9.string()).optional(),
+  skip_condition: z9.string().optional(),
+  wait_for_approval: z9.boolean().optional()
+}).passthrough();
+var TaskSchema = z9.object({
+  description: z9.string(),
+  target_agent: z9.string(),
+  allowed_from_agents: z9.array(z9.string()),
+  workflow: z9.string(),
+  input_artifacts: z9.array(z9.string()),
+  invocation_handoff: z9.string(),
+  result_handoff: z9.string(),
+  default_priority: z9.string().optional(),
+  responsibilities: z9.array(z9.string()).optional(),
+  constraints: z9.array(z9.string()).optional(),
+  execution_steps: z9.array(ExecutionStepSchema).optional(),
+  completion_criteria: z9.array(z9.string()).optional(),
+  rules: z9.array(RuleSchema).optional(),
+  anti_patterns: z9.array(z9.string()).optional(),
+  escalation_criteria: z9.array(EscalationCriterionSchema).optional(),
+  validations: z9.array(z9.string()).default([]),
   guardrails: z9.array(z9.string()).optional()
 }).passthrough();
 
-// src/schema/validation.ts
+// src/schema/tool.ts
 import { z as z10 } from "zod";
-var ValidationSchema = z10.object({
-  target_artifact: z10.string(),
-  kind: z10.enum(["schema", "mechanical", "semantic", "approval", "provenance", "traceability", "fidelity"]),
-  executor_type: z10.enum(["tool", "agent"]),
-  executor: z10.string(),
-  blocking: z10.boolean(),
-  produces_evidence: z10.string().optional()
+var CommandSchema = z10.object({
+  command: z10.string(),
+  category: z10.string(),
+  reads: z10.array(z10.string()).default([]),
+  writes: z10.array(z10.string()).default([]),
+  purpose: z10.string().optional()
+});
+var ToolSchema = z10.object({
+  kind: z10.string(),
+  description: z10.string().optional(),
+  input_artifacts: z10.array(z10.string()).default([]),
+  output_artifacts: z10.array(z10.string()).default([]),
+  invokable_by: z10.array(z10.string()),
+  side_effects: z10.array(z10.string()).default([]),
+  commands: z10.array(CommandSchema).default([]),
+  guardrails: z10.array(z10.string()).optional()
 }).passthrough();
 
-// src/schema/workflow.ts
+// src/schema/validation.ts
 import { z as z11 } from "zod";
-var RetrySchema = z11.object({
-  condition: z11.string(),
-  fix_task: z11.string(),
-  revalidate_task: z11.string().optional()
-});
-var ExternalParticipantSchema = z11.object({
-  id: z11.string(),
-  kind: z11.enum(["actor", "participant"]),
-  label: z11.string(),
-  description: z11.string().optional()
-});
-var WorkflowDelegateStepSchema = z11.object({
-  type: z11.literal("delegate"),
-  description: z11.string().optional(),
-  task: z11.string(),
-  from_agent: z11.string(),
-  group: z11.string().optional(),
+var ValidationSchema = z11.object({
+  target_artifact: z11.string(),
+  kind: z11.enum(["schema", "mechanical", "semantic", "approval", "provenance", "traceability", "fidelity"]),
+  executor_type: z11.enum(["tool", "agent"]),
+  executor: z11.string(),
+  blocking: z11.boolean(),
+  produces_evidence: z11.string().optional()
+}).passthrough();
+
+// src/schema/workflow.ts
+import { z as z12 } from "zod";
+var RetrySchema = z12.object({
+  condition: z12.string(),
+  fix_task: z12.string(),
+  revalidate_task: z12.string().optional()
+});
+var ExternalParticipantSchema = z12.object({
+  id: z12.string(),
+  kind: z12.enum(["actor", "participant"]),
+  label: z12.string(),
+  description: z12.string().optional()
+});
+var WorkflowDelegateStepSchema = z12.object({
+  type: z12.literal("delegate"),
+  description: z12.string().optional(),
+  task: z12.string(),
+  from_agent: z12.string(),
+  group: z12.string().optional(),
   retry: RetrySchema.optional()
 }).passthrough();
-var WorkflowGateStepSchema = z11.object({
-  type: z11.literal("gate"),
-  description: z11.string().optional(),
-  gate_kind: z11.string(),
-  group: z11.string().optional()
+var WorkflowGateStepSchema = z12.object({
+  type: z12.literal("gate"),
+  description: z12.string().optional(),
+  gate_kind: z12.string(),
+  group: z12.string().optional()
 }).passthrough();
-var WorkflowHandoffStepSchema = z11.object({
-  type: z11.literal("handoff"),
-  description: z11.string().optional(),
-  handoff_kind: z11.string(),
-  task: z11.string().optional(),
-  from_agent: z11.string().optional(),
-  group: z11.string().optional(),
+var WorkflowHandoffStepSchema = z12.object({
+  type: z12.literal("handoff"),
+  description: z12.string().optional(),
+  handoff_kind: z12.string(),
+  task: z12.string().optional(),
+  from_agent: z12.string().optional(),
+  group: z12.string().optional(),
   retry: RetrySchema.optional()
 }).passthrough();
-var WorkflowValidationStepSchema = z11.object({
-  type: z11.literal("validation"),
-  description: z11.string().optional(),
-  validation: z11.string(),
-  group: z11.string().optional()
+var WorkflowValidationStepSchema = z12.object({
+  type: z12.literal("validation"),
+  description: z12.string().optional(),
+  validation: z12.string(),
+  group: z12.string().optional()
 }).passthrough();
-var WorkflowDecisionStepSchema = z11.object({
-  type: z11.literal("decision"),
-  description: z11.string().optional(),
+var WorkflowDecisionStepSchema = z12.object({
+  type: z12.literal("decision"),
+  description: z12.string().optional(),
   /** @deprecated Use `routing_key` instead. `on` is kept for backward compatibility. */
-  on: z11.string().optional(),
-  routing_key: z11.string().optional(),
-  branches: z11.record(z11.string(), z11.array(z11.string())),
-  group: z11.string().optional()
+  on: z12.string().optional(),
+  routing_key: z12.string().optional(),
+  branches: z12.record(z12.string(), z12.array(z12.string())),
+  group: z12.string().optional()
 }).passthrough();
-var WorkflowStepSchema = z11.discriminatedUnion("type", [
+var WorkflowStepSchema = z12.discriminatedUnion("type", [
   WorkflowDelegateStepSchema,
   WorkflowGateStepSchema,
   WorkflowHandoffStepSchema,
   WorkflowValidationStepSchema,
   WorkflowDecisionStepSchema
 ]);
-var WorkflowSchema = z11.object({
-  description: z11.string().optional(),
-  entry_conditions: z11.array(z11.string()).default([]),
-  trigger: z11.string().optional(),
-  steps: z11.array(WorkflowStepSchema),
-  external_participants: z11.array(ExternalParticipantSchema).default([])
+var WorkflowSchema = z12.object({
+  description: z12.string().optional(),
+  entry_conditions: z12.array(z12.string()).default([]),
+  trigger: z12.string().optional(),
+  steps: z12.array(WorkflowStepSchema),
+  external_participants: z12.array(ExternalParticipantSchema).default([])
 }).passthrough();
 
 // src/schema/dsl.ts
-var ComponentsSchema = z12.object({
-  schemas: z12.record(z12.string(), z12.record(z12.string(), z12.any())).default({})
+var ComponentsSchema = z13.object({
+  schemas: z13.record(z13.string(), z13.record(z13.string(), z13.any())).default({})
 }).passthrough();
-var XExtensionDeclSchema = z12.object({
-  type: z12.string(),
-  items: z12.string().optional(),
-  description: z12.string().optional()
-});
-var DslSchema = z12.object({
-  version: z12.literal(1),
-  extends: z12.string().optional(),
+var SCOPE_NODE_TYPES = [
+  "root",
+  "system",
+  "agent",
+  "task",
+  "execution_step",
+  "artifact",
+  "tool",
+  "tool_command",
+  "validation",
+  "handoff_type",
+  "workflow",
+  "workflow_step",
+  "policy",
+  "guardrail",
+  "guardrail_policy",
+  "rule",
+  "escalation_criterion",
+  "prerequisite"
+];
+var ScopeNodeTypeSchema = z13.enum(SCOPE_NODE_TYPES);
+var XExtensionDeclSchema = z13.object({
+  type: z13.string(),
+  items: z13.string().optional(),
+  description: z13.string().optional(),
+  scope: z13.array(ScopeNodeTypeSchema).optional(),
+  schema: z13.record(z13.string(), z13.any()).optional(),
+  required: z13.boolean().default(false)
+});
+var DslSchema = z13.object({
+  version: z13.literal(1),
+  extends: z13.string().optional(),
   system: SystemSchema,
-  agents: z12.record(z12.string(), AgentSchema).default({}),
-  tasks: z12.record(z12.string(), TaskSchema).default({}),
-  artifacts: z12.record(z12.string(), ArtifactSchema).default({}),
-  tools: z12.record(z12.string(), ToolSchema).default({}),
-  validations: z12.record(z12.string(), ValidationSchema).default({}),
-  handoff_types: z12.record(z12.string(), HandoffTypeSchema).default({}),
-  workflow: z12.record(z12.string(), WorkflowSchema).default({}),
-  policies: z12.record(z12.string(), PolicySchema).default({}),
-  guardrails: z12.record(z12.string(), GuardrailSchema).default({}),
-  guardrail_policies: z12.record(z12.string(), GuardrailPolicySchema).default({}),
+  agents: z13.record(z13.string(), AgentSchema).default({}),
+  tasks: z13.record(z13.string(), TaskSchema).default({}),
+  artifacts: z13.record(z13.string(), ArtifactSchema).default({}),
+  tools: z13.record(z13.string(), ToolSchema).default({}),
+  validations: z13.record(z13.string(), ValidationSchema).default({}),
+  handoff_types: z13.record(z13.string(), HandoffTypeSchema).default({}),
+  workflow: z13.record(z13.string(), WorkflowSchema).default({}),
+  policies: z13.record(z13.string(), PolicySchema).default({}),
+  guardrails: z13.record(z13.string(), GuardrailSchema).default({}),
+  guardrail_policies: z13.record(z13.string(), GuardrailPolicySchema).default({}),
   components: ComponentsSchema.default({ schemas: {} }),
-  "x-extensions": z12.record(z12.string(), XExtensionDeclSchema).optional()
+  extensions: z13.record(z13.string(), XExtensionDeclSchema).default({}),
+  extensions_strict: z13.boolean().default(false)
 }).passthrough();
 
 // src/schema/json-schema-utils.ts
@@ -50836,22 +50911,22 @@ function resolveAllOf(schema) {
 }
 
 // src/schema/merge-operators.ts
-import { z as z13 } from "zod";
-var AppendOperatorSchema = z13.object({
-  $append: z13.record(z13.string(), z13.any())
+import { z as z14 } from "zod";
+var AppendOperatorSchema = z14.object({
+  $append: z14.record(z14.string(), z14.any())
 });
-var PrependOperatorSchema = z13.object({
-  $prepend: z13.record(z13.string(), z13.any())
+var PrependOperatorSchema = z14.object({
+  $prepend: z14.record(z14.string(), z14.any())
 });
-var InsertAfterOperatorSchema = z13.object({
-  $insert_after: z13.object({
-    after: z13.string(),
-    entries: z13.record(z13.string(), z13.any())
+var InsertAfterOperatorSchema = z14.object({
+  $insert_after: z14.object({
+    after: z14.string(),
+    entries: z14.record(z14.string(), z14.any())
   })
 });
-var ReplaceOperatorSchema = z13.object({ $replace: z13.any() });
-var RemoveOperatorSchema = z13.object({
-  $remove: z13.array(z13.string())
+var ReplaceOperatorSchema = z14.object({ $replace: z14.any() });
+var RemoveOperatorSchema = z14.object({
+  $remove: z14.array(z14.string())
 });
 
 // src/config/loader.ts
@@ -50860,31 +50935,14 @@ import { resolve, dirname } from "path";
 import { parse as parseYaml } from "yaml";
 
 // src/config/types.ts
-import { z as z14 } from "zod";
-var CONTEXT_TYPES = [
-  "agent",
-  "task",
-  "artifact",
-  "tool",
-  "validation",
-  "handoff_type",
-  "workflow",
-  "policy",
-  "guardrail",
-  "guardrail_policy",
-  "system"
-];
-var ContextTypeSchema = z14.enum(CONTEXT_TYPES);
-var ITERABLE_CONTEXT_TYPES = CONTEXT_TYPES.filter(
-  (t3) => t3 !== "system"
-);
-var RenderTargetSchema = z14.object({
-  template: z14.string(),
+import { z as z15 } from "zod";
+var RenderTargetSchema = z15.object({
+  template: z15.string(),
   context: ContextTypeSchema,
-  output: z14.string(),
-  include: z14.array(z14.string()).optional(),
-  exclude: z14.array(z14.string()).optional(),
-  skip_empty: z14.boolean().optional()
+  output: z15.string(),
+  include: z15.array(z15.string()).optional(),
+  exclude: z15.array(z15.string()).optional(),
+  skip_empty: z15.boolean().optional()
 }).refine(
   (data) => !(data.include && data.exclude),
   { message: "include and exclude are mutually exclusive" }
@@ -50897,13 +50955,13 @@ var RenderTargetSchema = z14.object({
   },
   { message: "include/exclude cannot be used with context: system" }
 );
-var AgentContractsConfigSchema = z14.object({
-  dsl: z14.string(),
-  vars: z14.record(z14.string(), z14.string()).optional(),
-  renders: z14.array(RenderTargetSchema).min(1),
-  bindings: z14.array(z14.string()).default([]),
-  active_guardrail_policy: z14.string().optional(),
-  paths: z14.record(z14.string(), z14.string()).optional()
+var AgentContractsConfigSchema = z15.object({
+  dsl: z15.string(),
+  vars: z15.record(z15.string(), z15.string()).optional(),
+  renders: z15.array(RenderTargetSchema).default([]),
+  bindings: z15.array(z15.string()).default([]),
+  active_guardrail_policy: z15.string().optional(),
+  paths: z15.record(z15.string(), z15.string()).optional()
 });
 
 // src/config/loader.ts
@@ -51541,7 +51599,8 @@ var MERGE_SECTIONS = [
   "policies",
   "guardrails",
   "guardrail_policies",
-  "components"
+  "components",
+  "extensions"
 ];
 function mergeDsl(base, project) {
   const hasExtends = typeof project["extends"] === "string";
@@ -51650,11 +51709,12 @@ function expandDefaults(data) {
 function isRecord3(v2) {
   return typeof v2 === "object" && v2 !== null && !Array.isArray(v2);
 }
-var BINDING_MERGE_SECTIONS = ["guardrail_impl", "outputs"];
+var BINDING_MAP_MERGE_SECTIONS = ["guardrail_impl", "outputs"];
+var BINDING_ARRAY_MERGE_SECTIONS = ["renders"];
 function mergeBinding(base, project) {
   const hasExtends = typeof project["extends"] === "string";
   const result = { ...base, ...project };
-  for (const section of BINDING_MERGE_SECTIONS) {
+  for (const section of BINDING_MAP_MERGE_SECTIONS) {
     const baseVal = base[section];
     const projVal = project[section];
     if (projVal === void 0) {
@@ -51668,6 +51728,14 @@ function mergeBinding(base, project) {
       hasExtends
     );
   }
+  for (const section of BINDING_ARRAY_MERGE_SECTIONS) {
+    const baseVal = base[section];
+    const projVal = project[section];
+    if (projVal === void 0) continue;
+    const baseArr = Array.isArray(baseVal) ? baseVal : [];
+    const projArr = Array.isArray(projVal) ? projVal : [];
+    result[section] = [...baseArr, ...projArr];
+  }
   if (project["reporting"] !== void 0 && isRecord3(base["reporting"]) && isRecord3(project["reporting"])) {
     result["reporting"] = deepMergeEntities(
       base["reporting"],
@@ -51812,16 +51880,17 @@ var resolveCommand = new Command("resolve").description("Resolve DSL (load + mer
 import { Command as Command2 } from "commander";
 
 // src/validator/schema-validator.ts
-import { z as z15 } from "zod";
+import Ajv from "ajv";
+import { z as z16 } from "zod";
 function unwrap(schema) {
-  if (schema instanceof z15.ZodOptional) return unwrap(schema.unwrap());
-  if (schema instanceof z15.ZodDefault) return unwrap(schema.removeDefault());
-  if (schema instanceof z15.ZodNullable) return unwrap(schema.unwrap());
+  if (schema instanceof z16.ZodOptional) return unwrap(schema.unwrap());
+  if (schema instanceof z16.ZodDefault) return unwrap(schema.removeDefault());
+  if (schema instanceof z16.ZodNullable) return unwrap(schema.unwrap());
   return schema;
 }
 function checkCustomPropsRecursive(data, schema, path) {
   const inner = unwrap(schema);
-  if (inner instanceof z15.ZodObject) {
+  if (inner instanceof z16.ZodObject) {
     if (typeof data !== "object" || data === null || Array.isArray(data)) return [];
     const obj = data;
     const shape = inner.shape;
@@ -51842,7 +51911,7 @@ function checkCustomPropsRecursive(data, schema, path) {
     }
     return diagnostics;
   }
-  if (inner instanceof z15.ZodRecord) {
+  if (inner instanceof z16.ZodRecord) {
     if (typeof data !== "object" || data === null || Array.isArray(data)) return [];
     const valueSchema = inner._def.valueType;
     const diagnostics = [];
@@ -51851,7 +51920,7 @@ function checkCustomPropsRecursive(data, schema, path) {
     }
     return diagnostics;
   }
-  if (inner instanceof z15.ZodArray) {
+  if (inner instanceof z16.ZodArray) {
     if (!Array.isArray(data)) return [];
     const diagnostics = [];
     for (let i3 = 0; i3 < data.length; i3++) {
@@ -51859,28 +51928,28 @@ function checkCustomPropsRecursive(data, schema, path) {
     }
     return diagnostics;
   }
-  if (inner instanceof z15.ZodDiscriminatedUnion) {
+  if (inner instanceof z16.ZodDiscriminatedUnion) {
     if (typeof data !== "object" || data === null) return [];
     const obj = data;
     const disc = inner._def.discriminator;
     const discValue = obj[disc];
     const match = inner.options.find((opt) => {
       const shape = opt.shape;
-      return shape[disc] instanceof z15.ZodLiteral && shape[disc].value === discValue;
+      return shape[disc] instanceof z16.ZodLiteral && shape[disc].value === discValue;
     });
     if (match) return checkCustomPropsRecursive(data, match, path);
     return [];
   }
   return [];
 }
-function checkXExtensionsKeys(data) {
-  const extensions = data["x-extensions"];
+function checkExtensionsKeys(data) {
+  const extensions = data["extensions"];
   if (typeof extensions !== "object" || extensions === null) return [];
   const diagnostics = [];
   for (const key of Object.keys(extensions)) {
     if (!key.startsWith("x-")) {
       diagnostics.push({
-        path: `x-extensions.${key}`,
+        path: `extensions.${key}`,
         message: `Extension key "${key}" must start with "x-" prefix.`,
         code: "x-extension-key-prefix"
       });
@@ -51914,29 +51983,634 @@ function checkDecisionStepRoutingKey(data) {
   }
   return diagnostics;
 }
-function validateSchema(data) {
-  const result = DslSchema.safeParse(data);
-  if (!result.success) {
-    const diagnostics = result.error.issues.map((issue) => ({
-      path: issue.path.join("."),
-      message: issue.message,
-      code: "schema-validation"
-    }));
-    return { success: false, diagnostics };
+function isRecord4(v2) {
+  return typeof v2 === "object" && v2 !== null && !Array.isArray(v2);
+}
+function* enumerateEntitiesByType(data, nodeType) {
+  switch (nodeType) {
+    case "root":
+      yield { path: "", obj: data };
+      return;
+    case "system": {
+      const sys = data["system"];
+      if (isRecord4(sys)) yield { path: "system", obj: sys };
+      return;
+    }
+    case "agent": {
+      const agents = data["agents"];
+      if (!isRecord4(agents)) return;
+      for (const [id, a3] of Object.entries(agents)) {
+        if (isRecord4(a3)) yield { path: `agents.${id}`, obj: a3 };
+      }
+      return;
+    }
+    case "rule": {
+      const agents = data["agents"];
+      if (!isRecord4(agents)) return;
+      for (const [aid, a3] of Object.entries(agents)) {
+        if (!isRecord4(a3)) continue;
+        const rules = a3["rules"];
+        if (!Array.isArray(rules)) continue;
+        for (let i3 = 0; i3 < rules.length; i3++) {
+          const r3 = rules[i3];
+          if (isRecord4(r3)) yield { path: `agents.${aid}.rules[${i3}]`, obj: r3 };
+        }
+      }
+      return;
+    }
+    case "escalation_criterion": {
+      const agents = data["agents"];
+      if (!isRecord4(agents)) return;
+      for (const [aid, a3] of Object.entries(agents)) {
+        if (!isRecord4(a3)) continue;
+        const esc = a3["escalation_criteria"];
+        if (!Array.isArray(esc)) continue;
+        for (let i3 = 0; i3 < esc.length; i3++) {
+          const e3 = esc[i3];
+          if (isRecord4(e3)) {
+            yield {
+              path: `agents.${aid}.escalation_criteria[${i3}]`,
+              obj: e3
+            };
+          }
+        }
+      }
+      return;
+    }
+    case "prerequisite": {
+      const agents = data["agents"];
+      if (!isRecord4(agents)) return;
+      for (const [aid, a3] of Object.entries(agents)) {
+        if (!isRecord4(a3)) continue;
+        const pre = a3["prerequisites"];
+        if (!Array.isArray(pre)) continue;
+        for (let i3 = 0; i3 < pre.length; i3++) {
+          const p2 = pre[i3];
+          if (isRecord4(p2)) {
+            yield { path: `agents.${aid}.prerequisites[${i3}]`, obj: p2 };
+          }
+        }
+      }
+      return;
+    }
+    case "task": {
+      const tasks = data["tasks"];
+      if (!isRecord4(tasks)) return;
+      for (const [id, t3] of Object.entries(tasks)) {
+        if (isRecord4(t3)) yield { path: `tasks.${id}`, obj: t3 };
+      }
+      return;
+    }
+    case "execution_step": {
+      const tasks = data["tasks"];
+      if (!isRecord4(tasks)) return;
+      for (const [tid, t3] of Object.entries(tasks)) {
+        if (!isRecord4(t3)) continue;
+        const steps = t3["execution_steps"];
+        if (!Array.isArray(steps)) continue;
+        for (let i3 = 0; i3 < steps.length; i3++) {
+          const s2 = steps[i3];
+          if (isRecord4(s2)) {
+            yield {
+              path: `tasks.${tid}.execution_steps[${i3}]`,
+              obj: s2
+            };
+          }
+        }
+      }
+      return;
+    }
+    case "artifact": {
+      const arts = data["artifacts"];
+      if (!isRecord4(arts)) return;
+      for (const [id, a3] of Object.entries(arts)) {
+        if (isRecord4(a3)) yield { path: `artifacts.${id}`, obj: a3 };
+      }
+      return;
+    }
+    case "tool": {
+      const tools = data["tools"];
+      if (!isRecord4(tools)) return;
+      for (const [id, t3] of Object.entries(tools)) {
+        if (isRecord4(t3)) yield { path: `tools.${id}`, obj: t3 };
+      }
+      return;
+    }
+    case "tool_command": {
+      const tools = data["tools"];
+      if (!isRecord4(tools)) return;
+      for (const [tid, t3] of Object.entries(tools)) {
+        if (!isRecord4(t3)) continue;
+        const cmds = t3["commands"];
+        if (!Array.isArray(cmds)) continue;
+        for (let i3 = 0; i3 < cmds.length; i3++) {
+          const c2 = cmds[i3];
+          if (isRecord4(c2)) {
+            yield { path: `tools.${tid}.commands[${i3}]`, obj: c2 };
+          }
+        }
+      }
+      return;
+    }
+    case "validation": {
+      const vals = data["validations"];
+      if (!isRecord4(vals)) return;
+      for (const [id, v2] of Object.entries(vals)) {
+        if (isRecord4(v2)) yield { path: `validations.${id}`, obj: v2 };
+      }
+      return;
+    }
+    case "handoff_type": {
+      const ht = data["handoff_types"];
+      if (!isRecord4(ht)) return;
+      for (const [id, h2] of Object.entries(ht)) {
+        if (isRecord4(h2)) yield { path: `handoff_types.${id}`, obj: h2 };
+      }
+      return;
+    }
+    case "workflow": {
+      const wf = data["workflow"];
+      if (!isRecord4(wf)) return;
+      for (const [id, w2] of Object.entries(wf)) {
+        if (isRecord4(w2)) yield { path: `workflow.${id}`, obj: w2 };
+      }
+      return;
+    }
+    case "workflow_step": {
+      const wf = data["workflow"];
+      if (!isRecord4(wf)) return;
+      for (const [wid, w2] of Object.entries(wf)) {
+        if (!isRecord4(w2)) continue;
+        const steps = w2["steps"];
+        if (!Array.isArray(steps)) continue;
+        for (let i3 = 0; i3 < steps.length; i3++) {
+          const s2 = steps[i3];
+          if (isRecord4(s2)) {
+            yield { path: `workflow.${wid}.steps[${i3}]`, obj: s2 };
+          }
+        }
+      }
+      return;
+    }
+    case "policy": {
+      const pol = data["policies"];
+      if (!isRecord4(pol)) return;
+      for (const [id, p2] of Object.entries(pol)) {
+        if (isRecord4(p2)) yield { path: `policies.${id}`, obj: p2 };
+      }
+      return;
+    }
+    case "guardrail": {
+      const gr = data["guardrails"];
+      if (!isRecord4(gr)) return;
+      for (const [id, g2] of Object.entries(gr)) {
+        if (isRecord4(g2)) yield { path: `guardrails.${id}`, obj: g2 };
+      }
+      return;
+    }
+    case "guardrail_policy": {
+      const gp = data["guardrail_policies"];
+      if (!isRecord4(gp)) return;
+      for (const [id, p2] of Object.entries(gp)) {
+        if (isRecord4(p2)) yield { path: `guardrail_policies.${id}`, obj: p2 };
+      }
+      return;
+    }
+    default:
+      return;
+  }
+}
+function validateDeclaredExtension(parentPath, nodeType, key, val, declMap, diagnostics, ajvInstance, strict) {
+  const path = parentPath ? `${parentPath}.${key}` : key;
+  const decl = declMap[key];
+  if (decl === void 0) {
+    diagnostics.push({
+      path,
+      message: `Extension "${key}" is not declared in extensions.`,
+      code: "undeclared-extension",
+      ...!strict ? { severity: "warning" } : {}
+    });
+    return;
+  }
+  const scope = decl.scope;
+  if (scope && scope.length > 0 && !scope.includes(nodeType)) {
+    diagnostics.push({
+      path,
+      message: `Extension "${key}" is not allowed on ${nodeType} (declared scope: ${scope.join(", ")}).`,
+      code: "extension-scope-mismatch"
+    });
+    return;
+  }
+  if (decl.schema && typeof decl.schema === "object" && decl.schema !== null && Object.keys(decl.schema).length > 0) {
+    try {
+      const validate = ajvInstance.compile(decl.schema);
+      if (!validate(val)) {
+        diagnostics.push({
+          path,
+          message: `Extension "${key}" value does not match declared schema: ${ajvInstance.errorsText(validate.errors)}`,
+          code: "extension-schema-violation"
+        });
+      }
+    } catch (e3) {
+      diagnostics.push({
+        path,
+        message: `Extension "${key}" has invalid JSON Schema in declaration: ${e3 instanceof Error ? e3.message : String(e3)}`,
+        code: "extension-schema-violation"
+      });
+    }
+  }
+}
+function walkExtensionNodes(value, path, nodeType, declMap, diagnostics, ajvInstance, strict) {
+  if (!isRecord4(value)) return;
+  const obj = value;
+  for (const key of Object.keys(obj)) {
+    if (key === "extensions" || key === "extensions_strict" || key === "x-extensions" || key === "x-extensions-strict") {
+      continue;
+    }
+    if (key.startsWith("x-")) {
+      validateDeclaredExtension(
+        path,
+        nodeType,
+        key,
+        obj[key],
+        declMap,
+        diagnostics,
+        ajvInstance,
+        strict
+      );
+    }
+  }
+  switch (nodeType) {
+    case "root": {
+      const sys = obj["system"];
+      if (isRecord4(sys)) {
+        walkExtensionNodes(
+          sys,
+          "system",
+          "system",
+          declMap,
+          diagnostics,
+          ajvInstance,
+          strict
+        );
+      }
+      const agents = obj["agents"];
+      if (isRecord4(agents)) {
+        for (const [id, a3] of Object.entries(agents)) {
+          if (isRecord4(a3)) {
+            walkExtensionNodes(
+              a3,
+              `agents.${id}`,
+              "agent",
+              declMap,
+              diagnostics,
+              ajvInstance,
+              strict
+            );
+          }
+        }
+      }
+      const tasks = obj["tasks"];
+      if (isRecord4(tasks)) {
+        for (const [id, t3] of Object.entries(tasks)) {
+          if (isRecord4(t3)) {
+            walkExtensionNodes(
+              t3,
+              `tasks.${id}`,
+              "task",
+              declMap,
+              diagnostics,
+              ajvInstance,
+              strict
+            );
+          }
+        }
+      }
+      const artifacts = obj["artifacts"];
+      if (isRecord4(artifacts)) {
+        for (const [id, a3] of Object.entries(artifacts)) {
+          if (isRecord4(a3)) {
+            walkExtensionNodes(
+              a3,
+              `artifacts.${id}`,
+              "artifact",
+              declMap,
+              diagnostics,
+              ajvInstance,
+              strict
+            );
+          }
+        }
+      }
+      const tools = obj["tools"];
+      if (isRecord4(tools)) {
+        for (const [id, t3] of Object.entries(tools)) {
+          if (isRecord4(t3)) {
+            walkExtensionNodes(
+              t3,
+              `tools.${id}`,
+              "tool",
+              declMap,
+              diagnostics,
+              ajvInstance,
+              strict
+            );
+          }
+        }
+      }
+      const validations = obj["validations"];
+      if (isRecord4(validations)) {
+        for (const [id, v2] of Object.entries(validations)) {
+          if (isRecord4(v2)) {
+            walkExtensionNodes(
+              v2,
+              `validations.${id}`,
+              "validation",
+              declMap,
+              diagnostics,
+              ajvInstance,
+              strict
+            );
+          }
+        }
+      }
+      const handoffTypes = obj["handoff_types"];
+      if (isRecord4(handoffTypes)) {
+        for (const [id, h2] of Object.entries(handoffTypes)) {
+          if (isRecord4(h2)) {
+            walkExtensionNodes(
+              h2,
+              `handoff_types.${id}`,
+              "handoff_type",
+              declMap,
+              diagnostics,
+              ajvInstance,
+              strict
+            );
+          }
+        }
+      }
+      const workflow = obj["workflow"];
+      if (isRecord4(workflow)) {
+        for (const [id, w2] of Object.entries(workflow)) {
+          if (isRecord4(w2)) {
+            walkExtensionNodes(
+              w2,
+              `workflow.${id}`,
+              "workflow",
+              declMap,
+              diagnostics,
+              ajvInstance,
+              strict
+            );
+          }
+        }
+      }
+      const policies = obj["policies"];
+      if (isRecord4(policies)) {
+        for (const [id, p2] of Object.entries(policies)) {
+          if (isRecord4(p2)) {
+            walkExtensionNodes(
+              p2,
+              `policies.${id}`,
+              "policy",
+              declMap,
+              diagnostics,
+              ajvInstance,
+              strict
+            );
+          }
+        }
+      }
+      const guardrails = obj["guardrails"];
+      if (isRecord4(guardrails)) {
+        for (const [id, g2] of Object.entries(guardrails)) {
+          if (isRecord4(g2)) {
+            walkExtensionNodes(
+              g2,
+              `guardrails.${id}`,
+              "guardrail",
+              declMap,
+              diagnostics,
+              ajvInstance,
+              strict
+            );
+          }
+        }
+      }
+      const guardrailPolicies = obj["guardrail_policies"];
+      if (isRecord4(guardrailPolicies)) {
+        for (const [id, p2] of Object.entries(guardrailPolicies)) {
+          if (isRecord4(p2)) {
+            walkExtensionNodes(
+              p2,
+              `guardrail_policies.${id}`,
+              "guardrail_policy",
+              declMap,
+              diagnostics,
+              ajvInstance,
+              strict
+            );
+          }
+        }
+      }
+      break;
+    }
+    case "agent": {
+      const rules = obj["rules"];
+      if (Array.isArray(rules)) {
+        for (let i3 = 0; i3 < rules.length; i3++) {
+          const r3 = rules[i3];
+          if (isRecord4(r3)) {
+            walkExtensionNodes(
+              r3,
+              `${path}.rules[${i3}]`,
+              "rule",
+              declMap,
+              diagnostics,
+              ajvInstance,
+              strict
+            );
+          }
+        }
+      }
+      const esc = obj["escalation_criteria"];
+      if (Array.isArray(esc)) {
+        for (let i3 = 0; i3 < esc.length; i3++) {
+          const e3 = esc[i3];
+          if (isRecord4(e3)) {
+            walkExtensionNodes(
+              e3,
+              `${path}.escalation_criteria[${i3}]`,
+              "escalation_criterion",
+              declMap,
+              diagnostics,
+              ajvInstance,
+              strict
+            );
+          }
+        }
+      }
+      const pre = obj["prerequisites"];
+      if (Array.isArray(pre)) {
+        for (let i3 = 0; i3 < pre.length; i3++) {
+          const p2 = pre[i3];
+          if (isRecord4(p2)) {
+            walkExtensionNodes(
+              p2,
+              `${path}.prerequisites[${i3}]`,
+              "prerequisite",
+              declMap,
+              diagnostics,
+              ajvInstance,
+              strict
+            );
+          }
+        }
+      }
+      break;
+    }
+    case "task": {
+      const steps = obj["execution_steps"];
+      if (Array.isArray(steps)) {
+        for (let i3 = 0; i3 < steps.length; i3++) {
+          const s2 = steps[i3];
+          if (isRecord4(s2)) {
+            walkExtensionNodes(
+              s2,
+              `${path}.execution_steps[${i3}]`,
+              "execution_step",
+              declMap,
+              diagnostics,
+              ajvInstance,
+              strict
+            );
+          }
+        }
+      }
+      break;
+    }
+    case "tool": {
+      const cmds = obj["commands"];
+      if (Array.isArray(cmds)) {
+        for (let i3 = 0; i3 < cmds.length; i3++) {
+          const c2 = cmds[i3];
+          if (isRecord4(c2)) {
+            walkExtensionNodes(
+              c2,
+              `${path}.commands[${i3}]`,
+              "tool_command",
+              declMap,
+              diagnostics,
+              ajvInstance,
+              strict
+            );
+          }
+        }
+      }
+      break;
+    }
+    case "workflow": {
+      const steps = obj["steps"];
+      if (Array.isArray(steps)) {
+        for (let i3 = 0; i3 < steps.length; i3++) {
+          const s2 = steps[i3];
+          if (isRecord4(s2)) {
+            walkExtensionNodes(
+              s2,
+              `${path}.steps[${i3}]`,
+              "workflow_step",
+              declMap,
+              diagnostics,
+              ajvInstance,
+              strict
+            );
+          }
+        }
+      }
+      break;
+    }
+    default:
+      break;
   }
-  const customPropDiagnostics = checkCustomPropsRecursive(data, DslSchema, "");
-  if (customPropDiagnostics.length > 0) {
-    return { success: false, diagnostics: customPropDiagnostics };
+}
+function checkExtensionValidation(data) {
+  const strict = data["extensions_strict"] === true;
+  const raw = data["extensions"];
+  let declMap;
+  if (!isRecord4(raw) || Object.keys(raw).length === 0) {
+    if (!strict) return [];
+    declMap = {};
+  } else {
+    declMap = raw;
   }
-  const decisionDiagnostics = checkDecisionStepRoutingKey(data);
-  if (decisionDiagnostics.length > 0) {
-    return { success: false, diagnostics: decisionDiagnostics };
+  const diagnostics = [];
+  const ajvInstance = new Ajv({ allErrors: true, strict: false });
+  walkExtensionNodes(data, "", "root", declMap, diagnostics, ajvInstance, strict);
+  for (const [extKey, decl] of Object.entries(declMap)) {
+    if (!decl.required) continue;
+    const applicableTypes = decl.scope && decl.scope.length > 0 ? decl.scope : [...SCOPE_NODE_TYPES];
+    for (const t3 of applicableTypes) {
+      for (const { path, obj } of enumerateEntitiesByType(data, t3)) {
+        if (!(extKey in obj)) {
+          diagnostics.push({
+            path,
+            message: `Required extension "${extKey}" is missing on ${t3}.`,
+            code: "extension-required-missing"
+          });
+        }
+      }
+    }
+  }
+  return diagnostics;
+}
+function hasBlockingDiagnostic(diagnostics) {
+  return diagnostics.some((d2) => d2.severity !== "warning");
+}
+function validateSchema(data) {
+  const deprecationWarnings = [];
+  if ("x-extensions" in data && !("extensions" in data)) {
+    data["extensions"] = data["x-extensions"];
+    deprecationWarnings.push({
+      path: "x-extensions",
+      message: '"x-extensions" is deprecated. Use "extensions" instead.',
+      code: "deprecated-property",
+      severity: "warning"
+    });
   }
-  const xExtDiagnostics = checkXExtensionsKeys(data);
-  if (xExtDiagnostics.length > 0) {
-    return { success: false, diagnostics: xExtDiagnostics };
+  if ("x-extensions-strict" in data && !("extensions_strict" in data)) {
+    data["extensions_strict"] = data["x-extensions-strict"];
+    deprecationWarnings.push({
+      path: "x-extensions-strict",
+      message: '"x-extensions-strict" is deprecated. Use "extensions_strict" instead.',
+      code: "deprecated-property",
+      severity: "warning"
+    });
   }
-  return { success: true, data: result.data, diagnostics: [] };
+  const result = DslSchema.safeParse(data);
+  if (!result.success) {
+    const diagnostics2 = [
+      ...deprecationWarnings,
+      ...result.error.issues.map((issue) => ({
+        path: issue.path.join("."),
+        message: issue.message,
+        code: "schema-validation"
+      }))
+    ];
+    return { success: false, diagnostics: diagnostics2 };
+  }
+  const diagnostics = [
+    ...deprecationWarnings,
+    ...checkCustomPropsRecursive(data, DslSchema, ""),
+    ...checkDecisionStepRoutingKey(data),
+    ...checkExtensionsKeys(data),
+    ...checkExtensionValidation(data)
+  ];
+  return {
+    success: !hasBlockingDiagnostic(diagnostics),
+    data: result.data,
+    diagnostics
+  };
 }
 
 // src/validator/reference-resolver.ts
@@ -52244,8 +52918,8 @@ function checkReferences(dsl) {
 }
 
 // src/validator/handoff-schema-validator.ts
-import Ajv from "ajv";
-var ajv = new Ajv({ allErrors: true, strict: false });
+import Ajv2 from "ajv";
+var ajv = new Ajv2({ allErrors: true, strict: false });
 function validateHandoffSchemas(dsl) {
   const diagnostics = [];
   for (const [kind, ht] of Object.entries(dsl.handoff_types)) {
@@ -52280,13 +52954,16 @@ function formatDiagnostics(diagnostics, options) {
 
 // src/cli/commands/validate.ts
 var DIR_DEFAULT2 = "agent-contracts.yaml";
-var validateCommand = new Command2("validate").description("Validate DSL against schema and check references").argument("[dir]", "Path to agent-contracts.yaml", DIR_DEFAULT2).option("-c, --config <path>", "Path to agent-contracts.config.yaml").option("--format <format>", "Output format (text|json)", "text").option("--quiet", "Suppress output on success", false).action(async (dir, opts) => {
+var validateCommand = new Command2("validate").description("Validate DSL against schema and check references").argument("[dir]", "Path to agent-contracts.yaml", DIR_DEFAULT2).option("-c, --config <path>", "Path to agent-contracts.config.yaml").option("--format <format>", "Output format (text|json)", "text").option("--quiet", "Suppress output on success", false).option("--strict", "Treat warnings as errors", false).action(async (dir, opts) => {
   try {
     const config = await loadConfig(opts.config);
     const dslPath = resolveDslPath(dir, DIR_DEFAULT2, config);
     const resolved = await resolve4(dslPath);
     const data = config?.vars ? substituteVars(resolved.data, config.vars) : resolved.data;
     const schemaResult = validateSchema(data);
+    const schemaWarnings = schemaResult.diagnostics.filter(
+      (d2) => d2.severity === "warning"
+    );
     if (!schemaResult.success) {
       const output = formatDiagnostics(schemaResult.diagnostics, opts);
       if (output) process.stderr.write(output + "\n");
@@ -52294,13 +52971,18 @@ var validateCommand = new Command2("validate").description("Validate DSL against
     }
     const refDiags = checkReferences(schemaResult.data);
     const handoffDiags = validateHandoffSchemas(schemaResult.data);
-    const allDiags = [...refDiags, ...handoffDiags];
+    const allDiags = [...refDiags, ...handoffDiags, ...schemaWarnings];
+    const hasWarnings = allDiags.some(
+      (d2) => "severity" in d2 && d2.severity === "warning"
+    );
     if (allDiags.length > 0) {
       const output = formatDiagnostics(allDiags, opts);
       if (output) process.stderr.write(output + "\n");
-      process.exit(1);
+      if (refDiags.length > 0 || handoffDiags.length > 0 || opts.strict && hasWarnings) {
+        process.exit(1);
+      }
     }
-    if (!opts.quiet) {
+    if (!opts.quiet && allDiags.length === 0) {
       process.stdout.write("Validation passed.\n");
     }
   } catch (err) {
@@ -53715,6 +54397,9 @@ var lintCommand = new Command3("lint").description("Run semantic lint rules on r
       const resolved = await resolve4(dslPath);
       const data = config?.vars ? substituteVars(resolved.data, config.vars) : resolved.data;
       const schemaResult = validateSchema(data);
+      const schemaWarnings = schemaResult.diagnostics.filter(
+        (d2) => d2.severity === "warning"
+      );
       if (!schemaResult.success) {
         const output = formatDiagnostics(schemaResult.diagnostics, {
           format: opts.format,
@@ -53725,7 +54410,7 @@ var lintCommand = new Command3("lint").description("Run semantic lint rules on r
       }
       const tsDiagnostics = lint(schemaResult.data);
       const spectralDiagnostics = await spectralLint(schemaResult.data);
-      const diagnostics = [...tsDiagnostics, ...spectralDiagnostics];
+      const diagnostics = [...tsDiagnostics, ...spectralDiagnostics, ...schemaWarnings];
       if (diagnostics.length > 0) {
         const output = formatDiagnostics(diagnostics, {
           format: opts.format,
@@ -55230,6 +55915,9 @@ var checkCommand = new Command5("check").description("Run full pipeline: resolve
       const resolved = await resolve4(config.dsl);
       const data = config.vars ? substituteVars(resolved.data, config.vars) : resolved.data;
       const schemaResult = validateSchema(data);
+      const schemaWarnings = schemaResult.diagnostics.filter(
+        (d2) => d2.severity === "warning"
+      );
       if (!schemaResult.success) {
         const output = formatDiagnostics(schemaResult.diagnostics, {
           format: opts.format,
@@ -55240,7 +55928,7 @@ var checkCommand = new Command5("check").description("Run full pipeline: resolve
       }
       const refDiags = checkReferences(schemaResult.data);
       const handoffDiags = validateHandoffSchemas(schemaResult.data);
-      const allRefDiags = [...refDiags, ...handoffDiags];
+      const allRefDiags = [...refDiags, ...handoffDiags, ...schemaWarnings];
       if (allRefDiags.length > 0) {
         const output = formatDiagnostics(allRefDiags, {
           format: opts.format,
@@ -55504,7 +56192,7 @@ async function generateGuardrails(options) {
     if (filterBindings && !filterBindings.includes(binding.software)) {
       continue;
     }
-    if (!binding.outputs) continue;
+    if (!binding.outputs && !binding.renders) continue;
     const checkResult = resolveChecks(dsl, binding, policy);
     diagnostics.push(...checkResult.diagnostics);
     const ctx = {
@@ -55516,9 +56204,14 @@ async function generateGuardrails(options) {
       vars,
       paths,
       reporting,
-      resolved_checks: checkResult.resolved
-    };
-    for (const [outputId, outputDef] of Object.entries(binding.outputs)) {
+      resolved_checks: checkResult.resolved,
+      tasks: dsl.tasks,
+      artifacts: dsl.artifacts,
+      agents: dsl.agents,
+      handoff_types: dsl.handoff_types,
+      workflow: dsl.workflow
+    };
+    for (const [outputId, outputDef] of Object.entries(binding.outputs ?? {})) {
       const pathResult = resolveBindingTargetPath(
         outputDef.target,
         paths,
@@ -55648,9 +56341,98 @@ async function generateGuardrails(options) {
         }
       }
     }
+    for (const renderTarget of binding.renders ?? []) {
+      let templateContent;
+      if (renderTarget.inline_template) {
+        templateContent = renderTarget.inline_template;
+      } else if (renderTarget.template) {
+        const templatePath = resolve6(config.configDir, renderTarget.template);
+        try {
+          templateContent = await readFile5(templatePath, "utf8");
+        } catch {
+          diagnostics.push({
+            path: `binding.${binding.software}.renders`,
+            message: `Template file not found: ${templatePath}`,
+            severity: "error"
+          });
+          continue;
+        }
+      } else {
+        diagnostics.push({
+          path: `binding.${binding.software}.renders`,
+          message: "Render target has neither template nor inline_template",
+          severity: "error"
+        });
+        continue;
+      }
+      const compiled = Handlebars2.compile(templateContent, { noEscape: true });
+      const shouldSkipEmpty = renderTarget.skip_empty === true;
+      const context = renderTarget.context;
+      if (context === "system") {
+        const sysCtx = buildSystemContext(dsl);
+        const mergedCtx = { ...sysCtx, vars, paths, binding, resolved_checks: checkResult.resolved };
+        const rendered = compiled(mergedCtx);
+        const resolvedOutput = resolveBindingRenderOutputPath(renderTarget.output, paths);
+        const outputPath = resolve6(config.configDir, resolvedOutput);
+        if (shouldSkipEmpty && rendered.trim().length === 0) {
+          if (!dryRun) {
+            try {
+              await unlink2(outputPath);
+            } catch {
+            }
+          }
+          continue;
+        }
+        if (!dryRun) {
+          await mkdir2(dirname6(outputPath), { recursive: true });
+          await writeFile2(outputPath, rendered, "utf8");
+          if (renderTarget.executable) {
+            await chmod(outputPath, 493);
+          }
+        }
+        outputFiles.push(outputPath);
+      } else {
+        const section = getDslSection(dsl, context);
+        const allIds = Object.keys(section);
+        const ids = filterIds(allIds, renderTarget.include, renderTarget.exclude);
+        for (const entityId of ids) {
+          const entityCtx = buildEntityContext(dsl, context, entityId);
+          const mergedCtx = { ...entityCtx, vars, paths, binding, resolved_checks: checkResult.resolved };
+          const rendered = compiled(mergedCtx);
+          const resolvedOutput = resolveBindingRenderOutputPath(
+            expandOutputPath(renderTarget.output, context, entityId),
+            paths
+          );
+          const outputPath = resolve6(config.configDir, resolvedOutput);
+          if (shouldSkipEmpty && rendered.trim().length === 0) {
+            if (!dryRun) {
+              try {
+                await unlink2(outputPath);
+              } catch {
+              }
+            }
+            continue;
+          }
+          if (!dryRun) {
+            await mkdir2(dirname6(outputPath), { recursive: true });
+            await writeFile2(outputPath, rendered, "utf8");
+            if (renderTarget.executable) {
+              await chmod(outputPath, 493);
+            }
+          }
+          outputFiles.push(outputPath);
+        }
+      }
+    }
   }
   return { outputFiles, diagnostics };
 }
+function resolveBindingRenderOutputPath(output, paths) {
+  return output.replace(/\{(\w+)\}/g, (match, varName) => {
+    const value = paths[varName];
+    return value !== void 0 ? value : match;
+  });
+}
 
 // src/cli/commands/generate-guardrails.ts
 var generateGuardrailsCommand = new Command6("generate").description("Generate guardrail runtime artifacts from DSL, policies, and bindings").argument("[type]", "Type of artifacts to generate", "guardrails").option("-c, --config <path>", "Path to agent-contracts.config.yaml").option("--binding <name...>", "Filter to specific software binding(s)").option("--dry-run", "Print what would be generated without writing files", false).option("--quiet", "Suppress output on success", false).action(