agent-contracts 0.25.0 → 0.30.0

package/dist/cli.js

@@ -159,11 +159,11 @@ function __metadata(metadataKey, metadataValue) {
 }
 function __awaiter(thisArg, _arguments, P2, generator) {
   function adopt(value) {
-    return value instanceof P2 ? value : new P2(function(resolve9) {
-      resolve9(value);
+    return value instanceof P2 ? value : new P2(function(resolve10) {
+      resolve10(value);
     });
   }
-  return new (P2 || (P2 = Promise))(function(resolve9, reject) {
+  return new (P2 || (P2 = Promise))(function(resolve10, reject) {
     function fulfilled(value) {
       try {
         step(generator.next(value));
@@ -179,7 +179,7 @@ function __awaiter(thisArg, _arguments, P2, generator) {
       }
     }
     function step(result) {
-      result.done ? resolve9(result.value) : adopt(result.value).then(fulfilled, rejected);
+      result.done ? resolve10(result.value) : adopt(result.value).then(fulfilled, rejected);
     }
     step((generator = generator.apply(thisArg, _arguments || [])).next());
   });
@@ -370,14 +370,14 @@ function __asyncValues(o3) {
   }, i3);
   function verb(n3) {
     i3[n3] = o3[n3] && function(v2) {
-      return new Promise(function(resolve9, reject) {
-        v2 = o3[n3](v2), settle(resolve9, reject, v2.done, v2.value);
+      return new Promise(function(resolve10, reject) {
+        v2 = o3[n3](v2), settle(resolve10, reject, v2.done, v2.value);
       });
     };
   }
-  function settle(resolve9, reject, d2, v2) {
+  function settle(resolve10, reject, d2, v2) {
     Promise.resolve(v2).then(function(v3) {
-      resolve9({ value: v3, done: d2 });
+      resolve10({ value: v3, done: d2 });
     }, reject);
   }
 }
@@ -12937,13 +12937,13 @@ var require_yaml2 = __commonJS({
     function getLocationForJsonPath(result, path) {
       return (0, yaml_1.getLocationForJsonPath)(result, path);
     }
-    var parseYaml5 = (input) => (0, yaml_1.parseWithPointers)(input, {
+    var parseYaml6 = (input) => (0, yaml_1.parseWithPointers)(input, {
       ignoreDuplicateKeys: false,
       mergeKeys: true,
       preserveKeyOrder: true,
       attachComments: false
     });
-    exports.parseYaml = parseYaml5;
+    exports.parseYaml = parseYaml6;
     exports.Yaml = {
       parse: exports.parseYaml,
       getLocationForJsonPath,
@@ -13033,11 +13033,11 @@ function __metadata2(metadataKey, metadataValue) {
 }
 function __awaiter2(thisArg, _arguments, P2, generator) {
   function adopt(value) {
-    return value instanceof P2 ? value : new P2(function(resolve9) {
-      resolve9(value);
+    return value instanceof P2 ? value : new P2(function(resolve10) {
+      resolve10(value);
     });
   }
-  return new (P2 || (P2 = Promise))(function(resolve9, reject) {
+  return new (P2 || (P2 = Promise))(function(resolve10, reject) {
     function fulfilled(value) {
       try {
         step(generator.next(value));
@@ -13053,7 +13053,7 @@ function __awaiter2(thisArg, _arguments, P2, generator) {
       }
     }
     function step(result) {
-      result.done ? resolve9(result.value) : adopt(result.value).then(fulfilled, rejected);
+      result.done ? resolve10(result.value) : adopt(result.value).then(fulfilled, rejected);
     }
     step((generator = generator.apply(thisArg, _arguments || [])).next());
   });
@@ -13231,14 +13231,14 @@ function __asyncValues2(o3) {
   }, i3);
   function verb(n3) {
     i3[n3] = o3[n3] && function(v2) {
-      return new Promise(function(resolve9, reject) {
-        v2 = o3[n3](v2), settle(resolve9, reject, v2.done, v2.value);
+      return new Promise(function(resolve10, reject) {
+        v2 = o3[n3](v2), settle(resolve10, reject, v2.done, v2.value);
       });
     };
   }
-  function settle(resolve9, reject, d2, v2) {
+  function settle(resolve10, reject, d2, v2) {
     Promise.resolve(v2).then(function(v3) {
-      resolve9({ value: v3, done: d2 });
+      resolve10({ value: v3, done: d2 });
     }, reject);
   }
 }
@@ -18836,7 +18836,7 @@ function consumeBody() {
   let accum = [];
   let accumBytes = 0;
   let abort = false;
-  return new Body.Promise(function(resolve9, reject) {
+  return new Body.Promise(function(resolve10, reject) {
     let resTimeout;
     if (_this4.timeout) {
       resTimeout = setTimeout(function() {
@@ -18870,7 +18870,7 @@ function consumeBody() {
       }
       clearTimeout(resTimeout);
       try {
-        resolve9(Buffer.concat(accum, accumBytes));
+        resolve10(Buffer.concat(accum, accumBytes));
       } catch (err) {
         reject(new FetchError(`Could not create Buffer from response body for ${_this4.url}: ${err.message}`, "system", err));
       }
@@ -19133,7 +19133,7 @@ function fetch(url, opts) {
     throw new Error("native promise missing, set fetch.Promise to your favorite alternative");
   }
   Body.Promise = fetch.Promise;
-  return new fetch.Promise(function(resolve9, reject) {
+  return new fetch.Promise(function(resolve10, reject) {
     const request = new Request(url, opts);
     const options = getNodeRequestOptions(request);
     const send = (options.protocol === "https:" ? https : http).request;
@@ -19266,7 +19266,7 @@ function fetch(url, opts) {
               requestOpts.body = void 0;
               requestOpts.headers.delete("content-length");
             }
-            resolve9(fetch(new Request(locationURL, requestOpts)));
+            resolve10(fetch(new Request(locationURL, requestOpts)));
             finalize();
             return;
         }
@@ -19287,7 +19287,7 @@ function fetch(url, opts) {
       const codings = headers.get("Content-Encoding");
       if (!request.compress || request.method === "HEAD" || codings === null || res.statusCode === 204 || res.statusCode === 304) {
         response = new Response(body, response_options);
-        resolve9(response);
+        resolve10(response);
         return;
       }
       const zlibOptions = {
@@ -19297,7 +19297,7 @@ function fetch(url, opts) {
       if (codings == "gzip" || codings == "x-gzip") {
         body = body.pipe(zlib.createGunzip(zlibOptions));
         response = new Response(body, response_options);
-        resolve9(response);
+        resolve10(response);
         return;
       }
       if (codings == "deflate" || codings == "x-deflate") {
@@ -19309,12 +19309,12 @@ function fetch(url, opts) {
             body = body.pipe(zlib.createInflateRaw());
           }
           response = new Response(body, response_options);
-          resolve9(response);
+          resolve10(response);
         });
         raw.on("end", function() {
           if (!response) {
             response = new Response(body, response_options);
-            resolve9(response);
+            resolve10(response);
           }
         });
         return;
@@ -19322,11 +19322,11 @@ function fetch(url, opts) {
       if (codings == "br" && typeof zlib.createBrotliDecompress === "function") {
         body = body.pipe(zlib.createBrotliDecompress());
         response = new Response(body, response_options);
-        resolve9(response);
+        resolve10(response);
         return;
       }
       response = new Response(body, response_options);
-      resolve9(response);
+      resolve10(response);
     });
     writeToStream(req, request);
   });
@@ -20039,13 +20039,13 @@ var require_file = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     var fs_1 = __require("fs");
     function resolveFile(ref) {
-      return new Promise((resolve9, reject) => {
+      return new Promise((resolve10, reject) => {
         const path = ref.href();
         fs_1.readFile(path, "utf8", (err, data) => {
           if (err) {
             reject(err);
           } else {
-            resolve9(data);
+            resolve10(data);
           }
         });
       });
@@ -27648,12 +27648,12 @@ var require_reader = __commonJS({
         }
       } else {
         try {
-          return await new Promise((resolve9, reject) => {
+          return await new Promise((resolve10, reject) => {
             fs.readFile(name, opts.encoding, (err, data) => {
               if (err !== null) {
                 reject(err);
               } else {
-                resolve9(data);
+                resolve10(data);
               }
             });
           });
@@ -44538,14 +44538,14 @@ var require_AsyncFromSyncIteratorContinuation = __commonJS({
       if (!$Promise) {
         throw new $SyntaxError("This environment does not support Promises.");
       }
-      return new $Promise(function(resolve9) {
+      return new $Promise(function(resolve10) {
         var done = IteratorComplete(result);
         var value = IteratorValue(result);
         var valueWrapper = PromiseResolve($Promise, value);
         var onFulfilled = function(value2) {
           return CreateIteratorResultObject(value2, done);
         };
-        resolve9($then(valueWrapper, onFulfilled));
+        resolve10($then(valueWrapper, onFulfilled));
       });
     };
   }
@@ -45093,7 +45093,7 @@ var require_CreateAsyncFromSyncIterator = __commonJS({
         var O2 = this;
         SLOT.assert(O2, "[[SyncIteratorRecord]]");
         var argsLength = arguments.length;
-        return new $Promise(function(resolve9) {
+        return new $Promise(function(resolve10) {
           var syncIteratorRecord = SLOT.get(O2, "[[SyncIteratorRecord]]");
           var result;
           if (argsLength > 0) {
@@ -45101,7 +45101,7 @@ var require_CreateAsyncFromSyncIterator = __commonJS({
           } else {
             result = IteratorNext(syncIteratorRecord);
           }
-          resolve9(AsyncFromSyncIteratorContinuation(result));
+          resolve10(AsyncFromSyncIteratorContinuation(result));
         });
       },
       "return": function() {
@@ -45112,12 +45112,12 @@ var require_CreateAsyncFromSyncIterator = __commonJS({
         SLOT.assert(O2, "[[SyncIteratorRecord]]");
         var valueIsPresent = arguments.length > 0;
         var value = valueIsPresent ? arguments[0] : void 0;
-        return new $Promise(function(resolve9, reject) {
+        return new $Promise(function(resolve10, reject) {
           var syncIterator = SLOT.get(O2, "[[SyncIteratorRecord]]")["[[Iterator]]"];
           var iteratorReturn = GetMethod(syncIterator, "return");
           if (typeof iteratorReturn === "undefined") {
             var iterResult = CreateIteratorResultObject(value, true);
-            Call(resolve9, void 0, [iterResult]);
+            Call(resolve10, void 0, [iterResult]);
             return;
           }
           var result;
@@ -45130,7 +45130,7 @@ var require_CreateAsyncFromSyncIterator = __commonJS({
             Call(reject, void 0, [new $TypeError("Iterator `return` method returned a non-object value.")]);
             return;
           }
-          resolve9(AsyncFromSyncIteratorContinuation(result));
+          resolve10(AsyncFromSyncIteratorContinuation(result));
         });
       },
       "throw": function() {
@@ -45141,7 +45141,7 @@ var require_CreateAsyncFromSyncIterator = __commonJS({
         SLOT.assert(O2, "[[SyncIteratorRecord]]");
         var valueIsPresent = arguments.length > 0;
         var value = valueIsPresent ? arguments[0] : void 0;
-        return new $Promise(function(resolve9, reject) {
+        return new $Promise(function(resolve10, reject) {
           var syncIterator = SLOT.get(O2, "[[SyncIteratorRecord]]")["[[Iterator]]"];
           var throwMethod = GetMethod(syncIterator, "throw");
           if (typeof throwMethod === "undefined") {
@@ -45158,7 +45158,7 @@ var require_CreateAsyncFromSyncIterator = __commonJS({
             Call(reject, void 0, [new $TypeError("Iterator `throw` method returned a non-object value.")]);
             return;
           }
-          resolve9(AsyncFromSyncIteratorContinuation(
+          resolve10(AsyncFromSyncIteratorContinuation(
             result
             /* , promiseCapability */
           ));
@@ -48889,9 +48889,9 @@ var require_dist14 = __commonJS({
 });
 
 // src/cli/cli.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync as readFileSync3 } from "fs";
 import { fileURLToPath } from "url";
-import { resolve as resolve8, dirname as dirname8 } from "path";
+import { resolve as resolve9, dirname as dirname8 } from "path";
 
 // src/generated/cli-contract/program.ts
 import { Command } from "commander";
@@ -48930,9 +48930,9 @@ function derivePolicy(input) {
   const riskLevels = [];
   let executionMode;
   let explicitConfirmation;
-  if (input.commandEffects) {
-    const ce2 = input.commandEffects;
-    riskLevels.push(ce2.riskLevel ?? "low");
+  if (input.command_effects) {
+    const ce2 = input.command_effects;
+    riskLevels.push(ce2.risk_level ?? "low");
     if (ce2.writes) {
       sideEffects.add("file_write");
       for (const w2 of ce2.writes) {
@@ -48943,9 +48943,9 @@ function derivePolicy(input) {
           overwrite: w2.overwrite,
           destructive: w2.destructive,
           ...w2.idempotent !== void 0 ? { idempotent: w2.idempotent } : {},
-          ...w2.idempotencyKey ? { idempotencyKey: w2.idempotencyKey } : {},
-          ...w2.idempotentNote ? { idempotentNote: w2.idempotentNote } : {},
-          source: `command:${input.commandId}`
+          ...w2.idempotency_key ? { idempotency_key: w2.idempotency_key } : {},
+          ...w2.idempotent_note ? { idempotent_note: w2.idempotent_note } : {},
+          source: `command:${input.command_id}`
         });
       }
     }
@@ -48955,7 +48955,7 @@ function derivePolicy(input) {
           kind: "semantic",
           target: r3.target,
           description: r3.description,
-          source: `command:${input.commandId}`
+          source: `command:${input.command_id}`
         });
       }
     }
@@ -48966,17 +48966,17 @@ function derivePolicy(input) {
           ...ce2.network.description ? { description: ce2.network.description } : {},
           ...ce2.network.domains ? { domains: ce2.network.domains } : {},
           ...ce2.network.idempotent !== void 0 ? { idempotent: ce2.network.idempotent } : {},
-          ...ce2.network.idempotencyKey ? { idempotencyKey: ce2.network.idempotencyKey } : {},
-          ...ce2.network.idempotentNote ? { idempotentNote: ce2.network.idempotentNote } : {},
-          source: `command:${input.commandId}`
+          ...ce2.network.idempotency_key ? { idempotency_key: ce2.network.idempotency_key } : {},
+          ...ce2.network.idempotent_note ? { idempotent_note: ce2.network.idempotent_note } : {},
+          source: `command:${input.command_id}`
         });
       }
     }
-    if (ce2.executionMode) {
-      executionMode = ce2.executionMode;
+    if (ce2.execution_mode) {
+      executionMode = ce2.execution_mode;
     }
-    if (ce2.requiresConfirmation !== void 0) {
-      explicitConfirmation = ce2.requiresConfirmation;
+    if (ce2.requires_confirmation !== void 0) {
+      explicitConfirmation = ce2.requires_confirmation;
     }
   }
   for (const [optName, optInput] of Object.entries(input.options)) {
@@ -49007,7 +49007,7 @@ function derivePolicy(input) {
     }
     if (definition.effects) {
       const eff = definition.effects;
-      riskLevels.push(eff.riskLevel ?? "low");
+      riskLevels.push(eff.risk_level ?? "low");
       if (eff.writes) {
         sideEffects.add("file_write");
         for (const w2 of eff.writes) {
@@ -49018,8 +49018,8 @@ function derivePolicy(input) {
             overwrite: w2.overwrite,
             destructive: w2.destructive,
             ...w2.idempotent !== void 0 ? { idempotent: w2.idempotent } : {},
-            ...w2.idempotencyKey ? { idempotencyKey: w2.idempotencyKey } : {},
-            ...w2.idempotentNote ? { idempotentNote: w2.idempotentNote } : {},
+            ...w2.idempotency_key ? { idempotency_key: w2.idempotency_key } : {},
+            ...w2.idempotent_note ? { idempotent_note: w2.idempotent_note } : {},
             source: `option:${optName}`
           });
         }
@@ -49041,17 +49041,17 @@ function derivePolicy(input) {
             ...eff.network.description ? { description: eff.network.description } : {},
             ...eff.network.domains ? { domains: eff.network.domains } : {},
             ...eff.network.idempotent !== void 0 ? { idempotent: eff.network.idempotent } : {},
-            ...eff.network.idempotencyKey ? { idempotencyKey: eff.network.idempotencyKey } : {},
-            ...eff.network.idempotentNote ? { idempotentNote: eff.network.idempotentNote } : {},
+            ...eff.network.idempotency_key ? { idempotency_key: eff.network.idempotency_key } : {},
+            ...eff.network.idempotent_note ? { idempotent_note: eff.network.idempotent_note } : {},
             source: `option:${optName}`
           });
         }
       }
-      if (eff.executionMode && !executionMode) {
-        executionMode = eff.executionMode;
+      if (eff.execution_mode && !executionMode) {
+        executionMode = eff.execution_mode;
       }
-      if (eff.requiresConfirmation !== void 0 && explicitConfirmation === void 0) {
-        explicitConfirmation = eff.requiresConfirmation;
+      if (eff.requires_confirmation !== void 0 && explicitConfirmation === void 0) {
+        explicitConfirmation = eff.requires_confirmation;
       }
     }
   }
@@ -49072,15 +49072,15 @@ function derivePolicy(input) {
   const semanticWrites = writes.filter((w2) => w2.kind === "semantic");
   const idempotent = semanticWrites.every((w2) => w2.idempotent === true) && networkEffects.every((n3) => n3.idempotent === true);
   return {
-    riskLevel: finalRiskLevel,
-    requiresConfirmation,
+    risk_level: finalRiskLevel,
+    requires_confirmation: requiresConfirmation,
     idempotent,
-    sideEffects: [...sideEffects],
+    side_effects: [...sideEffects],
     reads,
     writes,
     ...networkEffects.length > 0 ? { network: networkEffects } : {},
-    ...executionMode ? { executionMode } : {},
-    ...requiresSecrets ? { requiresSecrets } : {}
+    ...executionMode ? { execution_mode: executionMode } : {},
+    ...requiresSecrets ? { requires_secrets: requiresSecrets } : {}
   };
 }
 
@@ -49096,7 +49096,7 @@ var commandDefinitions = {
         "file": {
           "mode": "read",
           "exists": false,
-          "mediaType": "application/yaml",
+          "media_type": "application/yaml",
           "encoding": "utf-8"
         }
       },
@@ -49136,7 +49136,7 @@ var commandDefinitions = {
         "file": {
           "mode": "read",
           "exists": false,
-          "mediaType": "application/yaml",
+          "media_type": "application/yaml",
           "encoding": "utf-8"
         }
       },
@@ -49183,7 +49183,7 @@ var commandDefinitions = {
         "file": {
           "mode": "read",
           "exists": false,
-          "mediaType": "application/yaml",
+          "media_type": "application/yaml",
           "encoding": "utf-8"
         }
       },
@@ -49222,14 +49222,14 @@ var commandDefinitions = {
   },
   "render": {
     "effects": {
-      "riskLevel": "medium",
+      "risk_level": "medium",
       "writes": [
         {
           "target": "configured render output paths",
           "description": "rendered template files from DSL input",
           "overwrite": true,
           "idempotent": true,
-          "idempotentNote": "Output is deterministic from DSL input and templates. Repeated runs produce identical files."
+          "idempotent_note": "Output is deterministic from DSL input and templates. Repeated runs produce identical files."
         }
       ]
     },
@@ -49242,7 +49242,7 @@ var commandDefinitions = {
         "file": {
           "mode": "read",
           "exists": false,
-          "mediaType": "application/yaml",
+          "media_type": "application/yaml",
           "encoding": "utf-8"
         }
       },
@@ -49278,7 +49278,7 @@ var commandDefinitions = {
         "file": {
           "mode": "read",
           "exists": false,
-          "mediaType": "application/yaml",
+          "media_type": "application/yaml",
           "encoding": "utf-8"
         }
       },
@@ -49325,7 +49325,7 @@ var commandDefinitions = {
         "file": {
           "mode": "read",
           "exists": false,
-          "mediaType": "application/yaml",
+          "media_type": "application/yaml",
           "encoding": "utf-8"
         }
       },
@@ -49356,11 +49356,11 @@ var commandDefinitions = {
   },
   "audit": {
     "effects": {
-      "riskLevel": "medium",
+      "risk_level": "medium",
       "network": {
         "description": "LLM API calls to configured adapter (e.g. OpenAI, Gemini, Cursor). Incurs token cost and sends DSL content to the LLM provider.",
         "idempotent": false,
-        "idempotentNote": "LLM inference is non-deterministic \u2014 identical inputs may produce different findings across runs."
+        "idempotent_note": "LLM inference is non-deterministic \u2014 identical inputs may produce different findings across runs."
       }
     },
     "options": [
@@ -49372,7 +49372,7 @@ var commandDefinitions = {
         "file": {
           "mode": "read",
           "exists": false,
-          "mediaType": "application/yaml",
+          "media_type": "application/yaml",
           "encoding": "utf-8"
         }
       },
@@ -49458,14 +49458,14 @@ var commandDefinitions = {
   },
   "generate": {
     "effects": {
-      "riskLevel": "low",
+      "risk_level": "low",
       "writes": [
         {
           "target": "configured render, guardrail, and interface output paths",
           "description": "template files, guardrail binding files, and/or team interface files generated from DSL input",
           "overwrite": true,
           "idempotent": true,
-          "idempotentNote": "Output is deterministic from DSL input, templates, policies, and bindings. Repeated runs produce identical files."
+          "idempotent_note": "Output is deterministic from DSL input, templates, policies, and bindings. Repeated runs produce identical files."
         }
       ]
     },
@@ -49478,7 +49478,7 @@ var commandDefinitions = {
         "file": {
           "mode": "read",
           "exists": false,
-          "mediaType": "application/yaml",
+          "media_type": "application/yaml",
           "encoding": "utf-8"
         }
       },
@@ -49509,7 +49509,7 @@ var commandDefinitions = {
         },
         "file": {
           "mode": "write",
-          "mediaType": "application/yaml",
+          "media_type": "application/yaml",
           "encoding": "utf-8"
         }
       },
@@ -49539,29 +49539,75 @@ var commandDefinitions = {
         }
       }
     ]
+  },
+  "navigation-index": {
+    "options": [
+      {
+        "name": "config",
+        "schema": {
+          "type": "string"
+        },
+        "file": {
+          "mode": "read",
+          "exists": false,
+          "media_type": "application/yaml",
+          "encoding": "utf-8"
+        }
+      },
+      {
+        "name": "team",
+        "schema": {
+          "type": "string"
+        }
+      },
+      {
+        "name": "format",
+        "schema": {
+          "type": "string",
+          "enum": [
+            "json",
+            "yaml"
+          ],
+          "default": "json"
+        }
+      },
+      {
+        "name": "artifact",
+        "schema": {
+          "type": "string"
+        }
+      },
+      {
+        "name": "quiet",
+        "schema": {
+          "type": "boolean",
+          "default": false
+        }
+      }
+    ]
   }
 };
-function deriveCommandPolicy(commandId, optionValues) {
-  const def = commandDefinitions[commandId];
-  if (!def) throw new Error(`Unknown command: ${commandId}`);
+function deriveCommandPolicy(command_id, optionValues) {
+  const def = commandDefinitions[command_id];
+  if (!def) throw new Error(`Unknown command: ${command_id}`);
   const cmdDef = def;
   const options = {};
-  const activeOptions = [];
+  const active_options = [];
   for (const optDef of cmdDef.options ?? []) {
     const value = optionValues[optDef.name];
     const specified = optDef.name in optionValues && value !== void 0;
     options[optDef.name] = { value, specified, definition: optDef };
     if (isOptionActive(optDef, value, specified)) {
-      activeOptions.push(optDef.name);
+      active_options.push(optDef.name);
     }
   }
   const policy = derivePolicy({
-    commandId,
-    commandEffects: cmdDef.effects,
+    command_id,
+    command_effects: cmdDef.effects,
     options,
     env: cmdDef.env
   });
-  return { command: commandId, activeOptions, policy };
+  return { command: command_id, active_options, policy };
 }
 
 // src/generated/cli-contract/program.ts
@@ -49641,16 +49687,25 @@ function createProgram(handlers2, version) {
     }
     await handlers2.generate(type, opts, globalOpts);
   });
+  program2.command("navigation-index").description("Build artifact-centric navigation index from resolved DSL.").argument("[dir]", "Path to agent-contracts.yaml.").option("-c, --config <path>", "Path to agent-contracts.config.yaml.").option("--team <id>", "Limit to one team (multi-team config only).").option("--format <format>", "Output format.", "json").option("--artifact <id>", "Filter output to a single artifact by ID.").option("--quiet", "Suppress informational output.", false).action(async (dir, opts, cmd) => {
+    const globalOpts = cmd.optsWithGlobals();
+    if (globalOpts.introspect) {
+      const policy = deriveCommandPolicy("navigation-index", opts);
+      console.log(JSON.stringify(policy, null, 2));
+      return;
+    }
+    await handlers2.navigationIndex(dir, opts, globalOpts);
+  });
   return program2;
 }
 
 // src/cli/handlers.ts
 import { writeFileSync as writeFileSync2 } from "fs";
-import { existsSync, readFileSync } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import { join as join3, dirname as dirname7 } from "path";
 import { resolve as pathResolve } from "path";
 import { access as access2 } from "fs/promises";
-import { stringify as stringify3, parse as parseYaml4 } from "yaml";
+import { stringify as stringify3, parse as parseYaml5 } from "yaml";
 
 // src/config/binding-loader.ts
 import { readFile as readFile3 } from "fs/promises";
@@ -49746,11 +49801,12 @@ var CONTEXT_TYPES = [
   "policy",
   "guardrail",
   "guardrail_policy",
-  "system"
+  "system",
+  "navigation_index"
 ];
 var ContextTypeSchema = z3.enum(CONTEXT_TYPES);
 var ITERABLE_CONTEXT_TYPES = CONTEXT_TYPES.filter(
-  (t3) => t3 !== "system"
+  (t3) => t3 !== "system" && t3 !== "navigation_index"
 );
 
 // src/schema/binding.ts
@@ -49988,7 +50044,9 @@ var CommandSchema = z12.object({
   purpose: z12.string().optional()
 });
 var ToolSchema = z12.object({
-  kind: z12.string(),
+  kind: z12.string().optional(),
+  extends: z12.string().optional(),
+  command: z12.string().optional(),
   description: z12.string().optional(),
   input_artifacts: z12.array(z12.string()).default([]),
   output_artifacts: z12.array(z12.string()).default([]),
@@ -51139,6 +51197,123 @@ function mergeDsl(base, project) {
 
 // src/resolver/resolve.ts
 import { dirname as dirname3, resolve as resolvePath } from "path";
+
+// src/resolver/tool-extends.ts
+var ToolExtendsError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ToolExtendsError";
+  }
+};
+function asStringArray(value) {
+  return Array.isArray(value) ? value : [];
+}
+function asRecord(value) {
+  if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+    return value;
+  }
+  return {};
+}
+function asCommands(value) {
+  return Array.isArray(value) ? value : [];
+}
+function isUnset(value) {
+  return value === void 0 || value === null;
+}
+function mergeToolFields(base, child) {
+  const merged = { ...child };
+  merged.artifact_bindings = {
+    ...asRecord(base.artifact_bindings),
+    ...asRecord(child.artifact_bindings)
+  };
+  if (isUnset(child.kind) && !isUnset(base.kind)) {
+    merged.kind = base.kind;
+  }
+  if (isUnset(child.cli_contract) && !isUnset(base.cli_contract)) {
+    merged.cli_contract = base.cli_contract;
+  }
+  if (isUnset(child.description) && !isUnset(base.description)) {
+    merged.description = base.description;
+  }
+  const childInvokableBy = asStringArray(child.invokable_by);
+  const baseInvokableBy = asStringArray(base.invokable_by);
+  if (childInvokableBy.length === 0 && baseInvokableBy.length > 0) {
+    merged.invokable_by = [...baseInvokableBy];
+  }
+  const childInputArtifacts = asStringArray(child.input_artifacts);
+  const baseInputArtifacts = asStringArray(base.input_artifacts);
+  if (childInputArtifacts.length === 0 && baseInputArtifacts.length > 0) {
+    merged.input_artifacts = [...baseInputArtifacts];
+  }
+  const childOutputArtifacts = asStringArray(child.output_artifacts);
+  const baseOutputArtifacts = asStringArray(base.output_artifacts);
+  if (childOutputArtifacts.length === 0 && baseOutputArtifacts.length > 0) {
+    merged.output_artifacts = [...baseOutputArtifacts];
+  }
+  const childSideEffects = asStringArray(child.side_effects);
+  const baseSideEffects = asStringArray(base.side_effects);
+  if (childSideEffects.length === 0 && baseSideEffects.length > 0) {
+    merged.side_effects = [...baseSideEffects];
+  }
+  const childCommands = asCommands(child.commands);
+  const baseCommands = asCommands(base.commands);
+  if (childCommands.length === 0 && baseCommands.length > 0) {
+    merged.commands = [...baseCommands];
+  }
+  if (isUnset(child.guardrails) && !isUnset(base.guardrails)) {
+    merged.guardrails = base.guardrails;
+  }
+  return merged;
+}
+function resolveToolChain(id, tools, resolving, resolved) {
+  const cached = resolved.get(id);
+  if (cached !== void 0) {
+    return cached;
+  }
+  const tool = tools[id];
+  if (tool === void 0) {
+    throw new ToolExtendsError(`Tool "${id}" not found`);
+  }
+  const extendsId = tool.extends;
+  if (extendsId === void 0) {
+    resolved.set(id, tool);
+    return tool;
+  }
+  if (resolving.has(id)) {
+    throw new ToolExtendsError(
+      `Circular tool extends detected involving "${id}"`
+    );
+  }
+  const baseTool = tools[extendsId];
+  if (baseTool === void 0) {
+    resolved.set(id, tool);
+    return tool;
+  }
+  resolving.add(id);
+  try {
+    const resolvedBase = resolveToolChain(
+      extendsId,
+      tools,
+      resolving,
+      resolved
+    );
+    const merged = mergeToolFields(resolvedBase, tool);
+    resolved.set(id, merged);
+    return merged;
+  } finally {
+    resolving.delete(id);
+  }
+}
+function resolveToolExtends(tools) {
+  const resolved = /* @__PURE__ */ new Map();
+  const result = {};
+  for (const id of Object.keys(tools)) {
+    result[id] = resolveToolChain(id, tools, /* @__PURE__ */ new Set(), resolved);
+  }
+  return result;
+}
+
+// src/resolver/resolve.ts
 async function resolveExtendsChain(data, filePath, seen) {
   const extendsValue = data["extends"];
   if (typeof extendsValue !== "string") {
@@ -51168,6 +51343,10 @@ async function resolve4(projectDirOrFile) {
     projectResult.filePath,
     /* @__PURE__ */ new Set()
   );
+  const tools = data["tools"];
+  if (tools !== void 0 && tools !== null && typeof tools === "object" && !Array.isArray(tools)) {
+    data["tools"] = resolveToolExtends(tools);
+  }
   return {
     data,
     projectPath: projectResult.filePath,
@@ -52156,7 +52335,7 @@ function checkReferences(dsl) {
   for (const [id, art] of Object.entries(dsl.artifacts)) {
     if (art.owner) {
       const ownerAgent = dsl.agents[art.owner];
-      if (ownerAgent && !ownerAgent.can_read_artifacts.includes(id)) {
+      if (ownerAgent && ownerAgent.can_read_artifacts.length > 0 && !ownerAgent.can_read_artifacts.includes(id)) {
         diagnostics.push({
           path: `artifacts.${id}.owner`,
           message: `Agent "${art.owner}" owns artifact "${id}" but cannot read it (missing from can_read_artifacts)`,
@@ -52179,6 +52358,15 @@ function checkReferences(dsl) {
     }
   }
   for (const [id, tool] of Object.entries(dsl.tools)) {
+    if (tool.extends) {
+      checkExists(
+        tool.extends,
+        toolIds,
+        "tools",
+        `tools.${id}.extends`,
+        "tool-extends-not-found"
+      );
+    }
     if (tool.invokable_by.length > 0) {
       for (const ref of tool.invokable_by) {
         checkExists(ref, agentIds, "agents", `tools.${id}.invokable_by`);
@@ -52261,14 +52449,16 @@ function checkReferences(dsl) {
           code: "result-handoff-not-returnable"
         });
       }
-      for (let j2 = 0; j2 < task.input_artifacts.length; j2++) {
-        const inputId = task.input_artifacts[j2];
-        if (!targetAgent.can_read_artifacts.includes(inputId)) {
-          diagnostics.push({
-            path: `tasks.${id}.input_artifacts[${j2}]`,
-            message: `Input artifact "${inputId}" is not in target agent "${task.target_agent}" can_read_artifacts`,
-            code: "input-artifact-not-readable"
-          });
+      if (targetAgent.can_read_artifacts.length > 0) {
+        for (let j2 = 0; j2 < task.input_artifacts.length; j2++) {
+          const inputId = task.input_artifacts[j2];
+          if (!targetAgent.can_read_artifacts.includes(inputId)) {
+            diagnostics.push({
+              path: `tasks.${id}.input_artifacts[${j2}]`,
+              message: `Input artifact "${inputId}" is not in target agent "${task.target_agent}" can_read_artifacts`,
+              code: "input-artifact-not-readable"
+            });
+          }
         }
       }
     }
@@ -52284,7 +52474,7 @@ function checkReferences(dsl) {
     if (agent.prerequisites) {
       for (let j2 = 0; j2 < agent.prerequisites.length; j2++) {
         const pre = agent.prerequisites[j2];
-        if (!agent.can_read_artifacts.includes(pre.target)) {
+        if (agent.can_read_artifacts.length > 0 && !agent.can_read_artifacts.includes(pre.target)) {
           diagnostics.push({
             path: `agents.${id}.prerequisites[${j2}].target`,
             message: `Prerequisite target "${pre.target}" is not in agent "${id}" can_read_artifacts`,
@@ -52675,14 +52865,16 @@ var taskAgentBindingRule = {
     for (const [taskId, task] of Object.entries(dsl.tasks)) {
       const targetAgent = dsl.agents[task.target_agent];
       if (!targetAgent) continue;
-      for (const ref of task.input_artifacts) {
-        if (!targetAgent.can_read_artifacts.includes(ref)) {
-          diagnostics.push({
-            ruleId: "task-agent-binding",
-            severity: "error",
-            path: `tasks.${taskId}.input_artifacts`,
-            message: `Task "${taskId}" input_artifact "${ref}" not in target agent "${task.target_agent}" can_read_artifacts`
-          });
+      if (targetAgent.can_read_artifacts.length > 0) {
+        for (const ref of task.input_artifacts) {
+          if (!targetAgent.can_read_artifacts.includes(ref)) {
+            diagnostics.push({
+              ruleId: "task-agent-binding",
+              severity: "error",
+              path: `tasks.${taskId}.input_artifacts`,
+              message: `Task "${taskId}" input_artifact "${ref}" not in target agent "${task.target_agent}" can_read_artifacts`
+            });
+          }
         }
       }
       if (!targetAgent.can_return_handoffs.includes(task.result_handoff)) {
@@ -52718,7 +52910,7 @@ var taskAgentBindingRule = {
             });
           }
         }
-        if (step.produces_artifact) {
+        if (step.produces_artifact && targetAgent.can_write_artifacts.length > 0) {
           if (!targetAgent.can_write_artifacts.includes(step.produces_artifact)) {
             diagnostics.push({
               ruleId: "task-agent-binding",
@@ -52728,7 +52920,7 @@ var taskAgentBindingRule = {
             });
           }
         }
-        if (step.reads_artifact) {
+        if (step.reads_artifact && targetAgent.can_read_artifacts.length > 0) {
           if (!targetAgent.can_read_artifacts.includes(step.reads_artifact)) {
             diagnostics.push({
               ruleId: "task-agent-binding",
@@ -52793,7 +52985,8 @@ var artifactOwnershipRule = {
         }
         if (step.reads_artifact) {
           const artifact = dsl.artifacts[step.reads_artifact];
-          if (artifact && (artifact.consumers.length > 0 || artifact.producers.length > 0 || artifact.editors.length > 0)) {
+          const hasDeprecatedOwnership = !!artifact?.owner || (artifact?.producers.length ?? 0) > 0 || (artifact?.editors.length ?? 0) > 0 || (artifact?.consumers.length ?? 0) > 0;
+          if (artifact && hasDeprecatedOwnership) {
             const canRead = artifact.consumers.includes(agentId) || artifact.producers.includes(agentId) || artifact.editors.includes(agentId);
             if (!canRead) {
               diagnostics.push({
@@ -53231,6 +53424,7 @@ var artifactOwnershipConsistencyRule = {
   run(dsl) {
     const diagnostics = [];
     for (const [agentId, agent] of Object.entries(dsl.agents)) {
+      if (agent.own_artifacts.length === 0) continue;
       for (const artId of agent.own_artifacts) {
         if (!agent.can_read_artifacts.includes(artId)) {
           diagnostics.push({
@@ -53258,6 +53452,68 @@ var artifactOwnershipConsistencyRule = {
   }
 };
 
+// src/linter/rules/deprecated-ownership-fields.ts
+var ARTIFACT_FIELDS = ["owner", "producers", "editors", "consumers"];
+var AGENT_FIELDS = [
+  "own_artifacts",
+  "can_read_artifacts",
+  "can_write_artifacts"
+];
+function isArtifactFieldUsed(artifact, field) {
+  switch (field) {
+    case "owner":
+      return !!artifact.owner;
+    case "producers":
+      return artifact.producers.length > 0;
+    case "editors":
+      return artifact.editors.length > 0;
+    case "consumers":
+      return artifact.consumers.length > 0;
+  }
+}
+function isAgentFieldUsed(agent, field) {
+  switch (field) {
+    case "own_artifacts":
+      return agent.own_artifacts.length > 0;
+    case "can_read_artifacts":
+      return agent.can_read_artifacts.length > 0;
+    case "can_write_artifacts":
+      return agent.can_write_artifacts.length > 0;
+  }
+}
+var deprecatedOwnershipFieldsRule = {
+  id: "deprecated-ownership-fields",
+  description: "Warn when deprecated ownership/permission fields are used instead of artifact_bindings + artifact_slots",
+  run(dsl) {
+    const diagnostics = [];
+    for (const [artId, artifact] of Object.entries(dsl.artifacts)) {
+      for (const field of ARTIFACT_FIELDS) {
+        if (isArtifactFieldUsed(artifact, field)) {
+          diagnostics.push({
+            ruleId: "deprecated-ownership-fields",
+            severity: "warning",
+            path: `artifacts.${artId}.${field}`,
+            message: `Artifact "${artId}" uses deprecated field "${field}". Ownership is derived from artifact_bindings + artifact_slots in the binding model.`
+          });
+        }
+      }
+    }
+    for (const [agentId, agent] of Object.entries(dsl.agents)) {
+      for (const field of AGENT_FIELDS) {
+        if (isAgentFieldUsed(agent, field)) {
+          diagnostics.push({
+            ruleId: "deprecated-ownership-fields",
+            severity: "warning",
+            path: `agents.${agentId}.${field}`,
+            message: `Agent "${agentId}" uses deprecated field "${field}". Artifact permissions are derived from artifact_bindings + artifact_slots in the binding model.`
+          });
+        }
+      }
+    }
+    return diagnostics;
+  }
+};
+
 // src/linter/rules/extension-consumption.ts
 function isRecord4(v2) {
   return typeof v2 === "object" && v2 !== null && !Array.isArray(v2);
@@ -53428,6 +53684,194 @@ var extensionUndeclaredUsageRule = {
   }
 };
 
+// src/navigation-index/cli-contract-loader.ts
+import { existsSync, readFileSync } from "fs";
+import { isAbsolute, resolve as resolve6 } from "path";
+import { parse as parseYaml4 } from "yaml";
+function extractStringArray(value) {
+  if (!Array.isArray(value)) return [];
+  return value.filter((item) => typeof item === "string");
+}
+function extractArtifactSlots(doc) {
+  const slots = doc.artifact_slots;
+  if (!slots || typeof slots !== "object") return null;
+  const result = {};
+  for (const [name, slotDef] of Object.entries(slots)) {
+    if (!slotDef || typeof slotDef !== "object") continue;
+    const direction = slotDef.direction;
+    if (direction === "read" || direction === "write" || direction === "readwrite") {
+      result[name] = { direction };
+    }
+  }
+  return Object.keys(result).length > 0 ? result : null;
+}
+function extractCommandEffects(doc) {
+  const result = {};
+  const commandSets = doc.command_sets;
+  if (!commandSets || typeof commandSets !== "object") return result;
+  for (const setDef of Object.values(commandSets)) {
+    if (!setDef || typeof setDef !== "object") continue;
+    const commands = setDef.commands;
+    if (!commands || typeof commands !== "object") continue;
+    for (const [cmdName, cmdDef] of Object.entries(commands)) {
+      if (!cmdDef || typeof cmdDef !== "object") continue;
+      const effects = cmdDef.effects;
+      if (!effects || typeof effects !== "object") continue;
+      result[cmdName] = {
+        reads: extractStringArray(effects.reads),
+        writes: extractStringArray(effects.writes)
+      };
+    }
+  }
+  return result;
+}
+function resolveCliContractPath(cliContractPath) {
+  return isAbsolute(cliContractPath) ? cliContractPath : resolve6(process.cwd(), cliContractPath);
+}
+function loadCliContractSlots(cliContractPath) {
+  const filePath = resolveCliContractPath(cliContractPath);
+  if (!existsSync(filePath)) return null;
+  let doc;
+  try {
+    doc = parseYaml4(readFileSync(filePath, "utf8"));
+  } catch {
+    return null;
+  }
+  if (!doc || typeof doc !== "object") return null;
+  const artifactSlots = extractArtifactSlots(doc);
+  if (!artifactSlots) return null;
+  return {
+    artifactSlots,
+    commandEffects: extractCommandEffects(doc)
+  };
+}
+function resolveSlotDirection(slot, command, slotInfo) {
+  const cmdEffects = slotInfo.commandEffects[command];
+  if (cmdEffects) {
+    if (cmdEffects.writes.includes(slot)) return "write";
+    if (cmdEffects.reads.includes(slot)) return "read";
+  }
+  const slotDecl = slotInfo.artifactSlots[slot];
+  if (slotDecl) {
+    if (slotDecl.direction === "write" || slotDecl.direction === "readwrite") {
+      return "write";
+    }
+    return "read";
+  }
+  return "read";
+}
+
+// src/linter/rules/binding-completeness.ts
+var bindingCompletenessRule = {
+  id: "binding-completeness",
+  description: "Check that artifact_bindings cover all slots referenced in the cli-contract command effects",
+  run(dsl) {
+    const diagnostics = [];
+    for (const [toolId, tool] of Object.entries(dsl.tools)) {
+      if (!tool.cli_contract || !tool.artifact_bindings) continue;
+      const slotInfo = loadCliContractSlots(tool.cli_contract);
+      if (!slotInfo?.artifactSlots) continue;
+      const command = tool.command ?? "";
+      const effects = slotInfo.commandEffects[command];
+      if (!effects) continue;
+      const referencedSlots = [...effects.reads, ...effects.writes];
+      const boundSlots = new Set(Object.keys(tool.artifact_bindings));
+      for (const slot of referencedSlots) {
+        if (boundSlots.has(slot)) continue;
+        diagnostics.push({
+          ruleId: "binding-completeness",
+          severity: "warning",
+          path: `tools.${toolId}.artifact_bindings`,
+          message: `Command "${command}" references slot "${slot}" but tool has no artifact_bindings entry for it`
+        });
+      }
+    }
+    return diagnostics;
+  }
+};
+
+// src/linter/rules/binding-direction-match.ts
+function agentCanWriteArtifact(agentId, artifactId, dsl) {
+  const agent = dsl.agents[agentId];
+  if (!agent) return false;
+  return agent.can_write_artifacts.includes(artifactId) || agent.own_artifacts.includes(artifactId);
+}
+var bindingDirectionMatchRule = {
+  id: "binding-direction-match",
+  description: "Check that agents invoking a tool can write artifacts bound via write slots",
+  run(dsl) {
+    const diagnostics = [];
+    for (const [toolId, tool] of Object.entries(dsl.tools)) {
+      if (!tool.cli_contract || !tool.artifact_bindings) continue;
+      const slotInfo = loadCliContractSlots(tool.cli_contract);
+      if (!slotInfo) continue;
+      const command = tool.command ?? "";
+      for (const [slot, artifactId] of Object.entries(tool.artifact_bindings)) {
+        const direction = resolveSlotDirection(slot, command, slotInfo);
+        if (direction !== "write") continue;
+        for (const agentId of tool.invokable_by) {
+          if (agentCanWriteArtifact(agentId, artifactId, dsl)) continue;
+          diagnostics.push({
+            ruleId: "binding-direction-match",
+            severity: "warning",
+            path: `tools.${toolId}.artifact_bindings.${slot}`,
+            message: `Agent "${agentId}" invokes tool "${toolId}" which writes to artifact "${artifactId}" via slot "${slot}", but agent lacks can_write_artifacts or own_artifacts for it`
+          });
+        }
+      }
+    }
+    return diagnostics;
+  }
+};
+
+// src/linter/rules/slot-declaration-exists.ts
+var slotDeclarationExistsRule = {
+  id: "slot-declaration-exists",
+  description: "Check that artifact_bindings keys reference slot names declared in the cli-contract",
+  run(dsl) {
+    const diagnostics = [];
+    for (const [toolId, tool] of Object.entries(dsl.tools)) {
+      if (!tool.cli_contract || !tool.artifact_bindings) continue;
+      const slotInfo = loadCliContractSlots(tool.cli_contract);
+      if (!slotInfo?.artifactSlots) continue;
+      for (const slot of Object.keys(tool.artifact_bindings)) {
+        if (slot in slotInfo.artifactSlots) continue;
+        diagnostics.push({
+          ruleId: "slot-declaration-exists",
+          severity: "warning",
+          path: `tools.${toolId}.artifact_bindings.${slot}`,
+          message: `artifact_bindings key "${slot}" is not declared in cli-contract artifactSlots`
+        });
+      }
+    }
+    return diagnostics;
+  }
+};
+
+// src/linter/rules/config-path-consistency.ts
+var configPathConsistencyRule = {
+  id: "config-path-consistency",
+  description: "Check that control-authority artifacts bound by tools have path_patterns defined",
+  run(dsl) {
+    const diagnostics = [];
+    for (const [toolId, tool] of Object.entries(dsl.tools)) {
+      if (!tool.artifact_bindings) continue;
+      for (const [slot, artifactId] of Object.entries(tool.artifact_bindings)) {
+        const artifact = dsl.artifacts[artifactId];
+        if (!artifact || artifact.authority !== "control") continue;
+        if (artifact.path_patterns && artifact.path_patterns.length > 0) continue;
+        diagnostics.push({
+          ruleId: "config-path-consistency",
+          severity: "info",
+          path: `tools.${toolId}.artifact_bindings.${slot}`,
+          message: `Config artifact "${artifactId}" has no path_patterns; consider adding them for path-based lookup`
+        });
+      }
+    }
+    return diagnostics;
+  }
+};
+
 // src/linter/linter.ts
 var builtinRules = [
   validationCoverageRule,
@@ -53446,9 +53890,14 @@ var builtinRules = [
   guardrailOrphanedRule,
   validationExecutorNoContextRule,
   artifactOwnershipConsistencyRule,
+  deprecatedOwnershipFieldsRule,
   extensionDeclaredButUnusedRule,
   extensionScopeMismatchRule,
-  extensionUndeclaredUsageRule
+  extensionUndeclaredUsageRule,
+  bindingCompletenessRule,
+  bindingDirectionMatchRule,
+  slotDeclarationExistsRule,
+  configPathConsistencyRule
 ];
 function lint(dsl, rules = builtinRules) {
   const diagnostics = [];
@@ -53502,9 +53951,18 @@ var ref_exists_default = (0, import_spectral_core.createRulesetFunction)(
 
 // src/linter/spectral/functions/editors-not-empty.ts
 var import_spectral_core2 = __toESM(require_dist9(), 1);
+function allDeprecatedOwnershipFieldsEmpty(art) {
+  return !art.owner && (art.producers?.length ?? 0) === 0 && (art.editors?.length ?? 0) === 0 && (art.consumers?.length ?? 0) === 0;
+}
 var editors_not_empty_default = (0, import_spectral_core2.createRulesetFunction)(
   { input: { type: "array" }, options: null },
-  (targetVal, _options, _context) => {
+  (targetVal, _options, context) => {
+    const root = context.document.data;
+    const artId = context.path.length >= 2 ? String(context.path[1]) : void 0;
+    const artifact = artId && root.artifacts ? root.artifacts[artId] : void 0;
+    if (artifact && allDeprecatedOwnershipFieldsEmpty(artifact)) {
+      return [];
+    }
     if (targetVal.length === 0) {
       return [{ message: "editors must not be empty" }];
     }
@@ -53536,6 +53994,7 @@ var prerequisite_readable_default = (0, import_spectral_core4.createRulesetFunct
   (targetVal, _options, context) => {
     const readable = new Set(targetVal.can_read_artifacts ?? []);
     const prereqs = targetVal.prerequisites ?? [];
+    if (readable.size === 0) return [];
     const results = [];
     for (let i3 = 0; i3 < prereqs.length; i3++) {
       const p2 = prereqs[i3];
@@ -53937,7 +54396,7 @@ var ruleset = {
     },
     "artifact-owner-exists": {
       description: "(deprecated) Every artifact must have an owner",
-      severity: "warn",
+      severity: "off",
       given: "$.artifacts.*",
       then: {
         field: "owner",
@@ -54796,7 +55255,7 @@ function emitExecutionStep(es, agentAlias2, participants, lines, indent) {
 }
 function emitValidationStep(step, participants, dsl, lastFromAgent, lines, indent) {
   const val = dsl.validations[step.validation];
-  if (!val) return;
+  if (!val || !val.executor) return;
   const executorAlias = participantAlias(participants, val.executor);
   const artifactAlias = participantAlias(participants, val.target_artifact);
   const fromAlias = lastFromAgent ? participantAlias(participants, lastFromAgent) : null;
@@ -55099,6 +55558,299 @@ function generateOverviewFlowchart(dsl) {
   return sections.join("\n\n");
 }
 
+// src/navigation-index/builder.ts
+var VALIDATOR_KINDS = /* @__PURE__ */ new Set(["linter", "checker", "validator", "test"]);
+var VALIDATION_TERMS = ["lint", "check", "validate", "test", "verify", "audit"];
+function sortUnique(values) {
+  return [...new Set(values)].sort();
+}
+function matchesValidationTerm(value) {
+  const lower = value.toLowerCase();
+  return VALIDATION_TERMS.some((term) => lower.includes(term));
+}
+function isValidatorTool(tool) {
+  if (tool.kind && VALIDATOR_KINDS.has(tool.kind)) {
+    return true;
+  }
+  if (tool.command && matchesValidationTerm(tool.command)) {
+    return true;
+  }
+  for (const cmd of tool.commands ?? []) {
+    if (matchesValidationTerm(cmd.category) || matchesValidationTerm(cmd.command)) {
+      return true;
+    }
+  }
+  return false;
+}
+function extractToolArtifactLinks(toolId, tool) {
+  const links = [];
+  if (tool.cli_contract) {
+    const command = tool.command ?? "";
+    const slotInfo = loadCliContractSlots(tool.cli_contract);
+    for (const [slot, artifactId] of Object.entries(tool.artifact_bindings ?? {})) {
+      const direction = slotInfo ? resolveSlotDirection(slot, command, slotInfo) : "read";
+      links.push({
+        toolId,
+        artifactId,
+        direction,
+        slot,
+        command
+      });
+    }
+    return links;
+  }
+  for (const cmd of tool.commands ?? []) {
+    for (const artifactId of cmd.reads ?? []) {
+      links.push({
+        toolId,
+        artifactId,
+        direction: "read",
+        slot: "",
+        command: cmd.command
+      });
+    }
+    for (const artifactId of cmd.writes ?? []) {
+      links.push({
+        toolId,
+        artifactId,
+        direction: "write",
+        slot: "",
+        command: cmd.command
+      });
+    }
+  }
+  return links;
+}
+function buildOperation(toolId, tool, link) {
+  return {
+    tool: toolId,
+    cli_contract: tool.cli_contract ?? "",
+    command: link.command || tool.command || "",
+    slot: link.slot,
+    invokable_by: [...tool.invokable_by ?? []]
+  };
+}
+function operationKey(op) {
+  return `${op.tool}:${op.command}:${op.slot}`;
+}
+function dedupeOperations(operations) {
+  const seen = /* @__PURE__ */ new Set();
+  const result = [];
+  for (const op of operations) {
+    const key = operationKey(op);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    result.push(op);
+  }
+  return result.sort((a3, b3) => a3.tool.localeCompare(b3.tool) || a3.slot.localeCompare(b3.slot));
+}
+function buildAgentMapping(dsl, artifactId) {
+  const owners = [];
+  const editors = [];
+  const readers = [];
+  for (const [agentId, agent] of Object.entries(dsl.agents)) {
+    if (agent.own_artifacts?.includes(artifactId)) owners.push(agentId);
+    if (agent.can_write_artifacts?.includes(artifactId)) editors.push(agentId);
+    if (agent.can_read_artifacts?.includes(artifactId)) readers.push(agentId);
+  }
+  return {
+    owners: sortUnique(owners),
+    editors: sortUnique(editors),
+    readers: sortUnique(readers)
+  };
+}
+function buildRelations(artifactId, authority, linksByArtifact, allLinks) {
+  const sourceArtifacts = /* @__PURE__ */ new Set();
+  const derivedArtifacts = /* @__PURE__ */ new Set();
+  const writesToThis = allLinks.filter(
+    (link) => link.artifactId === artifactId && link.direction === "write"
+  );
+  if (authority === "generated" || authority === "derived") {
+    for (const writeLink of writesToThis) {
+      for (const readLink of allLinks) {
+        if (readLink.toolId === writeLink.toolId && readLink.direction === "read") {
+          sourceArtifacts.add(readLink.artifactId);
+        }
+      }
+    }
+  }
+  const readsThis = allLinks.filter(
+    (link) => link.artifactId === artifactId && link.direction === "read"
+  );
+  for (const readLink of readsThis) {
+    for (const writeLink of allLinks) {
+      if (writeLink.toolId === readLink.toolId && writeLink.direction === "write") {
+        derivedArtifacts.add(writeLink.artifactId);
+      }
+    }
+  }
+  const knownArtifacts = new Set(linksByArtifact.keys());
+  return {
+    source_artifacts: sortUnique(
+      [...sourceArtifacts].filter((id) => id !== artifactId && knownArtifacts.has(id))
+    ),
+    derived_artifacts: sortUnique(
+      [...derivedArtifacts].filter((id) => id !== artifactId && knownArtifacts.has(id))
+    )
+  };
+}
+function buildValidateRoutes(validators) {
+  return validators.map((validator) => ({
+    purpose: "validate",
+    steps: [
+      {
+        type: "run_operation",
+        operation: validator.tool,
+        candidate_agents: [...validator.invokable_by]
+      }
+    ]
+  }));
+}
+function buildRegenerateRoutes(sourceArtifacts, producers, agentsByArtifact) {
+  if (producers.length === 0) return [];
+  const editSteps = sourceArtifacts.map((artifactId) => ({
+    type: "edit_artifact",
+    artifact: artifactId,
+    candidate_agents: agentsByArtifact.get(artifactId)?.editors ?? []
+  }));
+  const runSteps = producers.map((producer) => ({
+    type: "run_operation",
+    operation: producer.tool,
+    candidate_agents: [...producer.invokable_by]
+  }));
+  return [
+    {
+      purpose: "regenerate",
+      steps: [...editSteps, ...runSteps]
+    }
+  ];
+}
+function buildUpdateRoutes(artifactId, validators, editors) {
+  const steps = [
+    {
+      type: "edit_artifact",
+      artifact: artifactId,
+      candidate_agents: [...editors]
+    }
+  ];
+  for (const validator of validators) {
+    steps.push({
+      type: "run_operation",
+      operation: validator.tool,
+      candidate_agents: [...validator.invokable_by]
+    });
+  }
+  return [
+    {
+      purpose: "update",
+      steps
+    }
+  ];
+}
+function defaultProperties(artifact) {
+  return {
+    type: artifact.type,
+    authority: artifact.authority ?? "canonical",
+    manual_edit: artifact.manual_edit ?? "allowed",
+    change_control: artifact.change_control ?? "none"
+  };
+}
+function buildNavigationIndex(dsl) {
+  const resolvedTools = resolveToolExtends(dsl.tools);
+  const allLinks = [];
+  for (const [toolId, tool] of Object.entries(resolvedTools)) {
+    allLinks.push(...extractToolArtifactLinks(toolId, tool));
+  }
+  const linksByArtifact = /* @__PURE__ */ new Map();
+  for (const link of allLinks) {
+    const existing = linksByArtifact.get(link.artifactId) ?? [];
+    existing.push(link);
+    linksByArtifact.set(link.artifactId, existing);
+  }
+  const toolWrites = /* @__PURE__ */ new Map();
+  for (const link of allLinks) {
+    if (link.direction !== "write") continue;
+    const writes = toolWrites.get(link.toolId) ?? /* @__PURE__ */ new Set();
+    writes.add(link.artifactId);
+    toolWrites.set(link.toolId, writes);
+  }
+  const artifacts = {};
+  const agentsByArtifact = /* @__PURE__ */ new Map();
+  for (const [artifactId, artifactDef] of Object.entries(dsl.artifacts)) {
+    const properties = defaultProperties(artifactDef);
+    const agents = buildAgentMapping(dsl, artifactId);
+    agentsByArtifact.set(artifactId, agents);
+    const artifactLinks = linksByArtifact.get(artifactId) ?? [];
+    const producers = [];
+    const validators = [];
+    const consumers = [];
+    const processedPairs = /* @__PURE__ */ new Set();
+    for (const link of artifactLinks) {
+      const tool = resolvedTools[link.toolId];
+      if (!tool) continue;
+      const pairKey = `${link.toolId}:${link.direction}:${link.slot}:${link.command}`;
+      if (processedPairs.has(pairKey)) continue;
+      processedPairs.add(pairKey);
+      const operation = buildOperation(link.toolId, tool, link);
+      const toolWritesArtifacts = toolWrites.get(link.toolId) ?? /* @__PURE__ */ new Set();
+      if (link.direction === "write" || toolWritesArtifacts.has(artifactId)) {
+        producers.push(operation);
+      } else if (isValidatorTool(tool)) {
+        validators.push(operation);
+      } else if (link.direction === "read") {
+        consumers.push(operation);
+      }
+    }
+    const relations = buildRelations(
+      artifactId,
+      properties.authority,
+      linksByArtifact,
+      allLinks
+    );
+    const routes = {};
+    const dedupedValidators = dedupeOperations(validators);
+    const dedupedProducers = dedupeOperations(producers);
+    if (dedupedValidators.length > 0) {
+      routes.validate = buildValidateRoutes(dedupedValidators);
+    }
+    if (properties.authority === "generated" && dedupedProducers.length > 0 && relations.source_artifacts.length > 0) {
+      routes.regenerate = buildRegenerateRoutes(
+        relations.source_artifacts,
+        dedupedProducers,
+        agentsByArtifact
+      );
+    }
+    if (properties.authority === "canonical") {
+      routes.update = buildUpdateRoutes(artifactId, dedupedValidators, agents.editors);
+    }
+    artifacts[artifactId] = {
+      id: artifactId,
+      files: {
+        path_patterns: artifactDef.path_patterns ?? [],
+        exclude_patterns: artifactDef.exclude_patterns ?? []
+      },
+      properties,
+      relations,
+      operations: {
+        producers: dedupeOperations(producers),
+        validators: dedupedValidators,
+        consumers: dedupeOperations(consumers)
+      },
+      agents,
+      routes
+    };
+  }
+  return {
+    version: "1.0.0",
+    generated_at: (/* @__PURE__ */ new Date()).toISOString(),
+    system: {
+      id: dsl.system.id,
+      name: dsl.system.name
+    },
+    artifacts
+  };
+}
+
 // src/renderer/renderer.ts
 Handlebars.registerHelper("eq", (a3, b3) => a3 === b3);
 Handlebars.registerHelper("notEmpty", (obj) => {
@@ -55408,6 +56160,8 @@ function buildEntityContext(dsl, context, entityId) {
       return buildGuardrailPolicyContext(dsl, entityId);
     case "system":
       return buildSystemContext(dsl);
+    case "navigation_index":
+      return buildNavigationIndex(dsl);
   }
 }
 async function loadTemplate(templatePath) {
@@ -55427,8 +56181,8 @@ async function renderFromConfig(dsl, renderTargets, options) {
   for (const target of renderTargets) {
     const templateContent = await loadTemplate(target.template);
     const compiled = Handlebars.compile(templateContent, { noEscape: false });
-    if (target.context === "system") {
-      const ctx = buildSystemContext(dsl, options);
+    if (target.context === "system" || target.context === "navigation_index") {
+      const ctx = target.context === "system" ? buildSystemContext(dsl, options) : buildNavigationIndex(dsl);
       const output = compiled(ctx);
       if (target.skip_empty && isEffectivelyEmpty(output)) {
         await removeIfExists(target.output);
@@ -55484,8 +56238,8 @@ async function checkDriftFromConfig(dsl, renderTargets, options) {
   for (const target of renderTargets) {
     const templateContent = await loadTemplate(target.template);
     const compiled = Handlebars.compile(templateContent, { noEscape: false });
-    if (target.context === "system") {
-      const ctx = buildSystemContext(dsl, options);
+    if (target.context === "system" || target.context === "navigation_index") {
+      const ctx = target.context === "system" ? buildSystemContext(dsl, options) : buildNavigationIndex(dsl);
       const expected = compiled(ctx);
       await checkExpectedVsExisting(expected, target.output, target.skip_empty, diffs);
     } else {
@@ -55764,7 +56518,7 @@ function score(dsl) {
 
 // src/guardrail-generator/generator.ts
 import { readFile as readFile5, writeFile as writeFile2, mkdir as mkdir2, chmod, unlink as unlink2, copyFile } from "fs/promises";
-import { resolve as resolve6, dirname as dirname6 } from "path";
+import { resolve as resolve7, dirname as dirname6 } from "path";
 import Handlebars2 from "handlebars";
 import YAML from "yaml";
 
@@ -55986,9 +56740,9 @@ async function generateGuardrails(options) {
       if (pathResult.diagnostics.some((d2) => d2.severity === "error")) {
         continue;
       }
-      const targetPath = resolve6(config.configDir, pathResult.resolved);
+      const targetPath = resolve7(config.configDir, pathResult.resolved);
       if (outputDef.source) {
-        const sourcePath = resolve6(config.configDir, outputDef.source);
+        const sourcePath = resolve7(config.configDir, outputDef.source);
         if (!dryRun) {
           try {
             await mkdir2(dirname6(targetPath), { recursive: true });
@@ -56024,7 +56778,7 @@ async function generateGuardrails(options) {
           });
           continue;
         }
-        const templatePath = resolve6(config.configDir, outputDef.template);
+        const templatePath = resolve7(config.configDir, outputDef.template);
         try {
           templateContent = await readFile5(templatePath, "utf8");
         } catch {
@@ -56063,7 +56817,7 @@ async function generateGuardrails(options) {
           };
           const compiled = Handlebars2.compile(templateContent, { noEscape: true });
           const rendered = compiled(groupCtx);
-          const groupTarget = resolve6(targetPath, groupKey);
+          const groupTarget = resolve7(targetPath, groupKey);
           if (shouldSkipEmpty && rendered.trim().length === 0) {
             if (!dryRun) {
               try {
@@ -56111,7 +56865,7 @@ async function generateGuardrails(options) {
       if (renderTarget.inline_template) {
         templateContent = renderTarget.inline_template;
       } else if (renderTarget.template) {
-        const templatePath = resolve6(config.configDir, renderTarget.template);
+        const templatePath = resolve7(config.configDir, renderTarget.template);
         try {
           templateContent = await readFile5(templatePath, "utf8");
         } catch {
@@ -56133,12 +56887,12 @@ async function generateGuardrails(options) {
       const compiled = Handlebars2.compile(templateContent, { noEscape: true });
       const shouldSkipEmpty = renderTarget.skip_empty === true;
       const context = renderTarget.context;
-      if (context === "system") {
-        const sysCtx = buildSystemContext(dsl);
-        const mergedCtx = { ...sysCtx, vars, paths, binding, resolved_checks: checkResult.resolved };
+      if (context === "system" || context === "navigation_index") {
+        const baseCtx = context === "system" ? buildSystemContext(dsl) : buildNavigationIndex(dsl);
+        const mergedCtx = { ...baseCtx, vars, paths, binding, resolved_checks: checkResult.resolved };
         const rendered = compiled(mergedCtx);
         const resolvedOutput = resolveBindingRenderOutputPath(renderTarget.output, paths);
-        const outputPath = resolve6(config.configDir, resolvedOutput);
+        const outputPath = resolve7(config.configDir, resolvedOutput);
         if (shouldSkipEmpty && rendered.trim().length === 0) {
           if (!dryRun) {
             try {
@@ -56168,7 +56922,7 @@ async function generateGuardrails(options) {
           const expandedOutput = expandOutputPath(renderTarget.output, context, entityId, entity);
           if (hasUnresolvedPathVars(expandedOutput)) continue;
           const resolvedOutput = resolveBindingRenderOutputPath(expandedOutput, paths);
-          const outputPath = resolve6(config.configDir, resolvedOutput);
+          const outputPath = resolve7(config.configDir, resolvedOutput);
           if (shouldSkipEmpty && rendered.trim().length === 0) {
             if (!dryRun) {
               try {
@@ -56384,10 +57138,10 @@ function collectAllXUsages(dsl) {
 function extractTemplateXReferences(config) {
   const refs = [];
   try {
-    const { readFileSync: readFileSync3 } = __require("fs");
+    const { readFileSync: readFileSync4 } = __require("fs");
     for (const target of config.renders) {
       try {
-        const content = readFileSync3(target.template, "utf8");
+        const content = readFileSync4(target.template, "utf8");
         const matches = content.matchAll(/\{\{[^}]*?(x-[\w-]+)[^}]*?\}\}/g);
         for (const m2 of matches) refs.push(m2[1]);
       } catch {
@@ -56912,7 +57666,7 @@ var DslTaskResultSchema = z20.object({
 });
 var AuditResultSchema = z20.object({
   summary: z20.string(),
-  riskLevel: z20.enum(["low", "medium", "high", "critical"]),
+  risk_level: z20.enum(["low", "medium", "high", "critical"]),
   findings: z20.array(z20.object({
     id: z20.string().optional(),
     severity: z20.enum(["info", "warning", "error", "critical"]),
@@ -56930,7 +57684,7 @@ var AuditResultSchema = z20.object({
     })).optional(),
     details: z20.record(z20.string(), z20.unknown()).optional()
   })),
-  recommendedActions: z20.array(z20.object({
+  recommended_actions: z20.array(z20.object({
     kind: z20.enum(["run_command", "edit_file", "review", "confirm", "block", "ignore"]),
     title: z20.string(),
     command: z20.string().optional(),
@@ -56941,7 +57695,7 @@ var AuditResultSchema = z20.object({
     tool: z20.string().optional(),
     command: z20.string().optional(),
     version: z20.string().optional(),
-    generatedAt: z20.string().optional(),
+    generated_at: z20.string().optional(),
     adapter: z20.string().optional(),
     model: z20.string().optional()
   }).optional()
@@ -57252,13 +58006,13 @@ function getTeamEntries(config, teamFilter) {
 
 // src/cli/commands/generate-interface.ts
 import { writeFileSync } from "fs";
-import { resolve as resolve7 } from "path";
+import { resolve as resolve8 } from "path";
 function runGenerateInterfaceCli(opts) {
   if (!opts.dsl.team_interface) {
     process.stderr.write("Error: DSL has no team_interface section.\n");
     process.exit(1);
   }
-  const outputPath = resolve7(process.cwd(), opts.output ?? "team-interface.yaml");
+  const outputPath = resolve8(process.cwd(), opts.output ?? "team-interface.yaml");
   const result = generateInterface({
     dsl: opts.dsl,
     output: outputPath,
@@ -57654,12 +58408,12 @@ var handleCheck = async (opts) => {
     }
     if (schemaResult.data.team_interface) {
       const interfacePath = join3(config.configDir, "team-interface.yaml");
-      if (existsSync(interfacePath)) {
+      if (existsSync2(interfacePath)) {
         const result = generateInterface({ dsl: schemaResult.data, dryRun: true, format: "yaml" });
-        const existing = readFileSync(interfacePath, "utf8");
+        const existing = readFileSync2(interfacePath, "utf8");
         const normalize = (raw) => {
           try {
-            const parsed = parseYaml4(raw);
+            const parsed = parseYaml5(raw);
             if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
               const { generated_at: _t, ...rest } = parsed;
               return `${stringify3(rest, { sortMapEntries: true })}
@@ -58071,6 +58825,105 @@ var handleGenerate = async (type, opts) => {
     process.exit(1);
   }
 };
+function filterIndexByArtifact(index3, artifactId) {
+  const node = index3.artifacts[artifactId];
+  if (!node) {
+    throw new Error(`Artifact not found: ${artifactId}`);
+  }
+  return {
+    ...index3,
+    artifacts: { [artifactId]: node }
+  };
+}
+function writeNavigationIndex(index3, format2) {
+  if (format2 === "json") {
+    process.stdout.write(JSON.stringify(index3, null, 2) + "\n");
+  } else {
+    process.stdout.write(stringify3(index3));
+  }
+}
+async function buildNavigationIndexForDsl(dslPath, vars, artifactFilter) {
+  const resolved = await resolve4(dslPath);
+  const data = vars ? substituteVars(resolved.data, vars) : resolved.data;
+  const schemaResult = validateSchema(data);
+  if (!schemaResult.success) {
+    const issues = schemaResult.diagnostics.map((d2) => `  ${d2.path}: ${d2.message}`).join("\n");
+    process.stderr.write(`Schema validation failed:
+${issues}
+`);
+    throw new Error("schema validation failed");
+  }
+  let index3 = buildNavigationIndex(schemaResult.data);
+  if (artifactFilter) {
+    index3 = filterIndexByArtifact(index3, artifactFilter);
+  }
+  return index3;
+}
+var handleNavigationIndex = async (dir, opts) => {
+  const fmt = opts.format ?? "json";
+  if (fmt !== "json" && fmt !== "yaml") {
+    process.stderr.write(`Invalid --format: expected json or yaml, got ${fmt}
+`);
+    process.exit(1);
+  }
+  try {
+    const config = await loadConfig(opts.config);
+    if (config !== null && isMultiTeamConfig(config)) {
+      const teamEntries = getTeamEntries(config, opts.team);
+      let hasErrors = false;
+      if (fmt === "json") {
+        const out = {};
+        for (const [teamId, teamConfig] of teamEntries) {
+          try {
+            out[teamId] = await buildNavigationIndexForDsl(
+              teamConfig.dsl,
+              teamConfig.vars,
+              opts.artifact
+            );
+          } catch (err) {
+            if (err instanceof Error && err.message === "schema validation failed") {
+              hasErrors = true;
+              continue;
+            }
+            throw err;
+          }
+        }
+        if (hasErrors) process.exit(1);
+        process.stdout.write(JSON.stringify(out, null, 2) + "\n");
+      } else {
+        for (const [teamId, teamConfig] of teamEntries) {
+          if (!opts.quiet) process.stdout.write(`
+--- Team: ${teamId} ---
+`);
+          try {
+            const index4 = await buildNavigationIndexForDsl(
+              teamConfig.dsl,
+              teamConfig.vars,
+              opts.artifact
+            );
+            process.stdout.write(stringify3(index4));
+          } catch (err) {
+            if (err instanceof Error && err.message === "schema validation failed") {
+              hasErrors = true;
+              continue;
+            }
+            throw err;
+          }
+        }
+        if (hasErrors) process.exit(1);
+      }
+      return;
+    }
+    const dslPath = resolveDslPath(dir ?? DIR_DEFAULT, DIR_DEFAULT, config);
+    const index3 = await buildNavigationIndexForDsl(dslPath, config?.vars, opts.artifact);
+    writeNavigationIndex(index3, fmt);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`Error: ${msg}
+`);
+    process.exit(1);
+  }
+};
 var handlers = {
   resolve: handleResolve,
   validate: handleValidate,
@@ -58079,12 +58932,13 @@ var handlers = {
   check: handleCheck,
   score: handleScore,
   audit: handleAudit,
-  generate: handleGenerate
+  generate: handleGenerate,
+  navigationIndex: handleNavigationIndex
 };
 
 // src/cli/cli.ts
 var __dirname = dirname8(fileURLToPath(import.meta.url));
-var pkg = JSON.parse(readFileSync2(resolve8(__dirname, "../package.json"), "utf8"));
+var pkg = JSON.parse(readFileSync3(resolve9(__dirname, "../package.json"), "utf8"));
 var program = createProgram(handlers, pkg.version);
 program.parse();
 /*! Bundled license information: