@ai-agent-forge/agent-forge 0.85.0

package/dist/profile/plugin-profiles.js

@@ -0,0 +1,192 @@
+import { VERSION } from "../config.js";
+import { comparePluginVersionsV1 } from "../plugins/ecosystem/catalog.js";
+import { resolvePluginProfileV1 } from "../plugins/ecosystem/resolver.js";
+import { assembleProfile } from "./profile-assembly.js";
+// D-075 S3: every first-party category-A plugin now ships as an independent
+// package under `plugins/` with the `agent-forge.plugin.<name>` id domain
+// (design §4.1). No embedded manifests remain; profiles resolve through the
+// install store (host-provided `manifestOverrides` from active bindings).
+const manifests = Object.freeze({});
+const profiles = Object.freeze([
+    { id: "coding-core", version: "1", pluginIds: [] },
+    {
+        id: "desktop-qa",
+        version: "1",
+        pluginIds: ["agent-forge.plugin.desktop-windows-observe", "agent-forge.plugin.desktop-windows-input"],
+    },
+    { id: "desktop-observe", version: "1", pluginIds: ["agent-forge.plugin.desktop-windows-observe"] },
+    {
+        id: "desktop-control",
+        version: "1",
+        pluginIds: ["agent-forge.plugin.desktop-windows-observe", "agent-forge.plugin.desktop-windows-input"],
+    },
+    { id: "lsp-diagnostics", version: "1", pluginIds: ["agent-forge.plugin.lsp-diagnostics"] },
+    { id: "process-exec", version: "1", pluginIds: ["agent-forge.plugin.process-exec"] },
+    { id: "test-runner", version: "1", pluginIds: ["agent-forge.plugin.test-runner"] },
+    { id: "workspace-files", version: "1", pluginIds: ["agent-forge.plugin.workspace-files"] },
+    { id: "workspace-files-write", version: "1", pluginIds: ["agent-forge.plugin.workspace-files-write"] },
+    {
+        // D-075 S2: the plugin code ships as the independent package
+        // `agent-forge.plugin.formatter-linter` (design §4.1 id domain); this
+        // Profile stays the stable user entry (`--plugin-profile formatter-linter`)
+        // and resolves through the install store, not an embedded manifest.
+        id: "formatter-linter",
+        version: "1",
+        pluginIds: ["agent-forge.plugin.formatter-linter"],
+    },
+    { id: "git-repository", version: "1", pluginIds: ["agent-forge.plugin.git-repository"] },
+]);
+export function listBuiltinPluginProfilesV1() {
+    return profiles;
+}
+/** Return the first-party manifest projection for catalog and selection UIs. */
+export function listBuiltinPluginManifestsV1() {
+    return Object.freeze(Object.values(manifests).sort((left, right) => {
+        const idOrder = `${left.id}@${left.pluginVersion}`.localeCompare(`${right.id}@${right.pluginVersion}`);
+        return idOrder === 0 ? comparePluginVersionsV1(left.pluginVersion, right.pluginVersion) : idOrder;
+    }));
+}
+/**
+ * First-party plugins of an explicitly selected Profile are trusted by
+ * default: builtins ship with the product and the user chose the Profile
+ * explicitly. Installed third-party versions are still verified through the
+ * active-binding resolver; host-injected verifiedPlugins always win.
+ */
+export function defaultBuiltinVerifiedPluginsV1(profileId) {
+    const profile = profiles.find((candidate) => candidate.id === profileId);
+    if (profile === undefined)
+        return [];
+    return profile.pluginIds.flatMap((pluginId) => {
+        const manifest = manifests[pluginId];
+        return manifest === undefined ? [] : [{ pluginId: manifest.id, version: manifest.pluginVersion }];
+    });
+}
+export function resolveBuiltinPluginProfileV1(input) {
+    const profile = profiles.find((candidate) => candidate.id === input.profileId);
+    if (profile === undefined)
+        return { status: "not_found", profileId: input.profileId };
+    const requestedPluginIds = input.selectedPluginIds;
+    const requestedDisabledPluginIds = input.disabledPluginIds;
+    if (requestedPluginIds !== undefined || requestedDisabledPluginIds !== undefined) {
+        const availablePluginIds = new Set(profile.pluginIds);
+        const duplicatePluginIds = [];
+        const unknownPluginIds = [];
+        for (const requestedIds of [requestedPluginIds ?? [], requestedDisabledPluginIds ?? []]) {
+            const seen = new Set();
+            for (const pluginId of requestedIds) {
+                if (!availablePluginIds.has(pluginId) && !unknownPluginIds.includes(pluginId))
+                    unknownPluginIds.push(pluginId);
+                if (seen.has(pluginId) && !duplicatePluginIds.includes(pluginId))
+                    duplicatePluginIds.push(pluginId);
+                seen.add(pluginId);
+            }
+        }
+        if (unknownPluginIds.length > 0 || duplicatePluginIds.length > 0) {
+            return {
+                status: "invalid_selection",
+                profileId: input.profileId,
+                unknownPluginIds: Object.freeze([...new Set(unknownPluginIds)]),
+                duplicatePluginIds: Object.freeze(duplicatePluginIds),
+            };
+        }
+    }
+    const selected = requestedPluginIds === undefined
+        ? profile.pluginIds
+        : profile.pluginIds.filter((pluginId) => requestedPluginIds.includes(pluginId));
+    const selectedProfile = requestedPluginIds === undefined
+        ? profile
+        : Object.freeze({ ...profile, pluginIds: Object.freeze([...selected]) });
+    const disabled = new Set(input.disabledPluginIds ?? []);
+    // D-075 S2: a Profile plugin without a builtin manifest and without a
+    // host-installed override is a structured miss, not a startup failure. The
+    // plugin is omitted from the resolved manifest and runtime bindings; the
+    // remaining Profile plugins resolve normally (soft degradation).
+    const manifestByPluginId = new Map(selectedProfile.pluginIds.map((pluginId) => [pluginId, manifestFor(pluginId, input.manifestOverrides)]));
+    const missingPluginIds = selectedProfile.pluginIds.filter((pluginId) => manifestByPluginId.get(pluginId) === undefined);
+    const resolution = resolvePluginProfileV1({
+        profileId: selectedProfile.id,
+        profileVersion: selectedProfile.version,
+        plugins: selectedProfile.pluginIds.flatMap((pluginId) => {
+            const manifest = manifestByPluginId.get(pluginId);
+            return manifest === undefined
+                ? []
+                : [
+                    {
+                        manifest,
+                        // A user-disabled plugin must not block the remaining profile. It is
+                        // still represented in the resolution diagnostics, but is omitted from
+                        // the active resolved manifest and runtime bindings.
+                        required: !disabled.has(pluginId),
+                        disabled: disabled.has(pluginId),
+                    },
+                ];
+        }),
+        host: input.host,
+        // The host's own version enforces each manifest's minHostVersion floor
+        // at the single builtin profile resolution funnel used by production
+        // loading paths.
+        hostVersion: VERSION,
+    });
+    const merged = mergeMissingPluginResolutionsV1(resolution, missingPluginIds, disabled);
+    if (merged.status !== "ready")
+        return { status: "resolved", profile: selectedProfile, resolution: merged };
+    const resolvedPlugins = merged.resolvedManifest.plugins.map((plugin) => ({
+        pluginId: plugin.pluginId,
+        pluginVersion: plugin.pluginVersion,
+        capabilityRefs: plugin.capabilityRefs,
+        ...(plugin.selectedAdapter === undefined ? {} : { selectedAdapter: plugin.selectedAdapter }),
+    }));
+    const verifiedPlugins = input.verifiedPlugins ?? [];
+    const assembly = assembleProfile({
+        profileId: selectedProfile.id,
+        profileVersion: selectedProfile.version,
+        resolvedPlugins,
+        verifiedPlugins,
+    });
+    return {
+        status: "resolved",
+        profile: selectedProfile,
+        resolution: merged,
+        assembly,
+    };
+}
+function manifestFor(pluginId, overrides) {
+    const manifest = overrides?.[pluginId] ?? manifests[pluginId];
+    // A mismatched override stays a hard host error: the host selected it
+    // explicitly, so silence would hide an identity bug. A plain absent
+    // manifest (no builtin, no installed override) is the structured miss.
+    if (manifest !== undefined && manifest.id !== pluginId)
+        throw new Error(`builtin manifest override does not match plugin ${pluginId}`);
+    return manifest;
+}
+/**
+ * Merge structured `manifest_missing` resolutions for Profile plugins that
+ * have no builtin manifest and no installed override into the resolver
+ * result. Missing plugins never block the Profile (soft degradation): the
+ * remaining diagnostics and the resolved manifest stay exactly what the
+ * resolver produced, and the merged plugin list keeps the resolver's
+ * deterministic id sort.
+ */
+function mergeMissingPluginResolutionsV1(resolution, missingPluginIds, disabled) {
+    if (missingPluginIds.length === 0)
+        return resolution;
+    const missing = missingPluginIds.map((pluginId) => ({
+        pluginId,
+        pluginVersion: "",
+        required: !disabled.has(pluginId),
+        status: "manifest-missing",
+        diagnostics: [
+            {
+                code: "manifest_missing",
+                message: `Plugin ${pluginId} has no builtin manifest and no installed active override; the plugin is omitted from this profile (install it with agent-forge plugin install)`,
+            },
+        ],
+    }));
+    const plugins = [...resolution.plugins, ...missing].sort((left, right) => left.pluginId.localeCompare(right.pluginId));
+    return Object.freeze({
+        ...resolution,
+        plugins: Object.freeze(plugins),
+        diagnostics: Object.freeze(plugins.flatMap((plugin) => plugin.diagnostics)),
+    });
+}
+//# sourceMappingURL=plugin-profiles.js.map

package/dist/profile/plugin-profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-profiles.js","sourceRoot":"","sources":["../../src/profile/plugin-profiles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAO1E,OAAO,EAAE,eAAe,EAA2D,MAAM,uBAAuB,CAAC;AAgDjH,4EAA4E;AAC5E,0EAA0E;AAC1E,6EAA4E;AAC5E,0EAA0E;AAC1E,MAAM,SAAS,GAA+C,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAEhF,MAAM,QAAQ,GAAsC,MAAM,CAAC,MAAM,CAAC;IACjE,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE;IAClD;QACC,EAAE,EAAE,YAAY;QAChB,OAAO,EAAE,GAAG;QACZ,SAAS,EAAE,CAAC,4CAA4C,EAAE,0CAA0C,CAAC;KACrG;IACD,EAAE,EAAE,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,4CAA4C,CAAC,EAAE;IAClG;QACC,EAAE,EAAE,iBAAiB;QACrB,OAAO,EAAE,GAAG;QACZ,SAAS,EAAE,CAAC,4CAA4C,EAAE,0CAA0C,CAAC;KACrG;IACD,EAAE,EAAE,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,oCAAoC,CAAC,EAAE;IAC1F,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,iCAAiC,CAAC,EAAE;IACpF,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,gCAAgC,CAAC,EAAE;IAClF,EAAE,EAAE,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,oCAAoC,CAAC,EAAE;IAC1F,EAAE,EAAE,EAAE,uBAAuB,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,0CAA0C,CAAC,EAAE;IACtG;QACC,6DAA6D;QAC7D,uEAAsE;QACtE,4EAA4E;QAC5E,oEAAoE;QACpE,EAAE,EAAE,kBAAkB;QACtB,OAAO,EAAE,GAAG;QACZ,SAAS,EAAE,CAAC,qCAAqC,CAAC;KAClD;IACD,EAAE,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,mCAAmC,CAAC,EAAE;CACxF,CAAC,CAAC;AAEH,MAAM,UAAU,2BAA2B,GAAsC;IAChF,OAAO,QAAQ,CAAC;AAAA,CAChB;AAED,gFAAgF;AAChF,MAAM,UAAU,4BAA4B,GAAgC;IAC3E,OAAO,MAAM,CAAC,MAAM,CACnB,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;QACvG,OAAO,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAAA,CAClG,CAAC,CACF,CAAC;AAAA,CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B,CAAC,SAAiB,EAAmC;IACnG,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;IACzE,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrC,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC;IAAA,CAClG,CAAC,CAAC;AAAA,CACH;AAED,MAAM,UAAU,6BAA6B,CAAC,KAS7C,EAAoC;IACpC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/E,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;IACtF,MAAM,kBAAkB,GAAG,KAAK,CAAC,iBAAiB,CAAC;IACnD,MAAM,0BAA0B,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAC3D,IAAI,kBAAkB,KAAK,SAAS,IAAI,0BAA0B,KAAK,SAAS,EAAE,CAAC;QAClF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,kBAAkB,GAAa,EAAE,CAAC;QACxC,MAAM,gBAAgB,GAAa,EAAE,CAAC;QACtC,KAAK,MAAM,YAAY,IAAI,CAAC,kBAAkB,IAAI,EAAE,EAAE,0BAA0B,IAAI,EAAE,CAAC,EAAE,CAAC;YACzF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;gBACrC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAC5E,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACjC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC;oBAAE,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACpG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACpB,CAAC;QACF,CAAC;QACD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClE,OAAO;gBACN,MAAM,EAAE,mBAAmB;gBAC3B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBAC/D,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC;aACrD,CAAC;QACH,CAAC;IACF,CAAC;IACD,MAAM,QAAQ,GACb,kBAAkB,KAAK,SAAS;QAC/B,CAAC,CAAC,OAAO,CAAC,SAAS;QACnB,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAClF,MAAM,eAAe,GACpB,kBAAkB,KAAK,SAAS;QAC/B,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IACxD,sEAAsE;IACtE,2EAA2E;IAC3E,yEAAyE;IACzE,iEAAiE;IACjE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CACjC,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAU,CAAC,CAChH,CAAC;IACF,MAAM,gBAAgB,GAAG,eAAe,CAAC,SAAS,CAAC,MAAM,CACxD,CAAC,QAAQ,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,SAAS,CAC5D,CAAC;IACF,MAAM,UAAU,GAAG,sBAAsB,CAAC;QACzC,SAAS,EAAE,eAAe,CAAC,EAAE;QAC7B,cAAc,EAAE,eAAe,CAAC,OAAO;QACvC,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;YACxD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClD,OAAO,QAAQ,KAAK,SAAS;gBAC5B,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACA;wBACC,QAAQ;wBACR,qEAAqE;wBACrE,uEAAuE;wBACvE,qDAAqD;wBACrD,QAAQ,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;wBACjC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;qBAChC;iBACD,CAAC;QAAA,CACJ,CAAC;QACF,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,uEAAuE;QACvE,qEAAqE;QACrE,iBAAiB;QACjB,WAAW,EAAE,OAAO;KACpB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,+BAA+B,CAAC,UAAU,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IACvF,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAC3G,MAAM,eAAe,GAAG,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxE,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,GAAG,CAAC,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC;KAC5F,CAAC,CAAC,CAAC;IACJ,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC;IACpD,MAAM,QAAQ,GAAG,eAAe,CAAC;QAChC,SAAS,EAAE,eAAe,CAAC,EAAE;QAC7B,cAAc,EAAE,eAAe,CAAC,OAAO;QACvC,eAAe;QACf,eAAe;KACf,CAAC,CAAC;IACH,OAAO;QACN,MAAM,EAAE,UAAU;QAClB,OAAO,EAAE,eAAe;QACxB,UAAU,EAAE,MAAM;QAClB,QAAQ;KACR,CAAC;AAAA,CACF;AAED,SAAS,WAAW,CACnB,QAAgB,EAChB,SAAuD,EACxB;IAC/B,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC9D,sEAAsE;IACtE,oEAAoE;IACpE,uEAAuE;IACvE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,QAAQ;QACrD,MAAM,IAAI,KAAK,CAAC,mDAAmD,QAAQ,EAAE,CAAC,CAAC;IAChF,OAAO,QAAQ,CAAC;AAAA,CAChB;AAED;;;;;;;GAOG;AACH,SAAS,+BAA+B,CACvC,UAA+B,EAC/B,gBAAmC,EACnC,QAA6B,EACP;IACtB,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC;IACrD,MAAM,OAAO,GAAyB,gBAAgB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACzE,QAAQ;QACR,aAAa,EAAE,EAAE;QACjB,QAAQ,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QACjC,MAAM,EAAE,kBAAkB;QAC1B,WAAW,EAAE;YACZ;gBACC,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,UAAU,QAAQ,iJAAiJ;aAC5K;SACD;KACD,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACxE,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAC3C,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,GAAG,UAAU;QACb,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QAC/B,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;KAC3E,CAAC,CAAC;AAAA,CACH","sourcesContent":["import { VERSION } from \"../config.ts\";\nimport { comparePluginVersionsV1 } from \"../plugins/ecosystem/catalog.ts\";\nimport { resolvePluginProfileV1 } from \"../plugins/ecosystem/resolver.ts\";\nimport type {\n\tHostFactsV1,\n\tPluginManifestV1,\n\tPluginResolutionV1,\n\tProfileResolutionV1,\n} from \"../plugins/ecosystem/types.ts\";\nimport { assembleProfile, type ProfileAssemblyResultV1, type VerifiedToolPluginV1 } from \"./profile-assembly.ts\";\n\nexport type BuiltinPluginProfileIdV1 =\n\t| \"coding-core\"\n\t| \"desktop-qa\"\n\t| \"desktop-observe\"\n\t| \"desktop-control\"\n\t| \"lsp-diagnostics\"\n\t| \"process-exec\"\n\t| \"test-runner\"\n\t| \"workspace-files\"\n\t| \"workspace-files-write\"\n\t| \"formatter-linter\"\n\t| \"git-repository\";\n\nexport interface BuiltinPluginProfileV1 {\n\treadonly id: BuiltinPluginProfileIdV1;\n\treadonly version: string;\n\treadonly pluginIds: readonly string[];\n}\n\n/**\n * Host-owned manifest replacements for installed, verified package versions.\n *\n * Builtin manifests remain the default. A host may explicitly provide one\n * replacement per builtin plugin ID when a staged/verified/active install is\n * selected for a new Profile. The resolver never discovers files or chooses a\n * version implicitly; the replacement is part of the resulting Profile\n * identity and must still pass normal compatibility and verification checks.\n */\nexport type BuiltinPluginManifestOverridesV1 = Readonly<Record<string, PluginManifestV1>>;\n\nexport type BuiltinPluginProfileResolutionV1 =\n\t| { readonly status: \"not_found\"; readonly profileId: string }\n\t| { readonly status: \"host_facts_required\"; readonly profileId: string }\n\t| {\n\t\t\treadonly status: \"invalid_selection\";\n\t\t\treadonly profileId: string;\n\t\t\treadonly unknownPluginIds: readonly string[];\n\t\t\treadonly duplicatePluginIds: readonly string[];\n\t  }\n\t| {\n\t\t\treadonly status: \"resolved\";\n\t\t\treadonly profile: BuiltinPluginProfileV1;\n\t\t\treadonly resolution: ProfileResolutionV1;\n\t\t\treadonly assembly?: ProfileAssemblyResultV1;\n\t  };\n\n// D-075 S3: every first-party category-A plugin now ships as an independent\n// package under `plugins/` with the `agent-forge.plugin.<name>` id domain\n// (design §4.1). No embedded manifests remain; profiles resolve through the\n// install store (host-provided `manifestOverrides` from active bindings).\nconst manifests: Readonly<Record<string, PluginManifestV1>> = Object.freeze({});\n\nconst profiles: readonly BuiltinPluginProfileV1[] = Object.freeze([\n\t{ id: \"coding-core\", version: \"1\", pluginIds: [] },\n\t{\n\t\tid: \"desktop-qa\",\n\t\tversion: \"1\",\n\t\tpluginIds: [\"agent-forge.plugin.desktop-windows-observe\", \"agent-forge.plugin.desktop-windows-input\"],\n\t},\n\t{ id: \"desktop-observe\", version: \"1\", pluginIds: [\"agent-forge.plugin.desktop-windows-observe\"] },\n\t{\n\t\tid: \"desktop-control\",\n\t\tversion: \"1\",\n\t\tpluginIds: [\"agent-forge.plugin.desktop-windows-observe\", \"agent-forge.plugin.desktop-windows-input\"],\n\t},\n\t{ id: \"lsp-diagnostics\", version: \"1\", pluginIds: [\"agent-forge.plugin.lsp-diagnostics\"] },\n\t{ id: \"process-exec\", version: \"1\", pluginIds: [\"agent-forge.plugin.process-exec\"] },\n\t{ id: \"test-runner\", version: \"1\", pluginIds: [\"agent-forge.plugin.test-runner\"] },\n\t{ id: \"workspace-files\", version: \"1\", pluginIds: [\"agent-forge.plugin.workspace-files\"] },\n\t{ id: \"workspace-files-write\", version: \"1\", pluginIds: [\"agent-forge.plugin.workspace-files-write\"] },\n\t{\n\t\t// D-075 S2: the plugin code ships as the independent package\n\t\t// `agent-forge.plugin.formatter-linter` (design §4.1 id domain); this\n\t\t// Profile stays the stable user entry (`--plugin-profile formatter-linter`)\n\t\t// and resolves through the install store, not an embedded manifest.\n\t\tid: \"formatter-linter\",\n\t\tversion: \"1\",\n\t\tpluginIds: [\"agent-forge.plugin.formatter-linter\"],\n\t},\n\t{ id: \"git-repository\", version: \"1\", pluginIds: [\"agent-forge.plugin.git-repository\"] },\n]);\n\nexport function listBuiltinPluginProfilesV1(): readonly BuiltinPluginProfileV1[] {\n\treturn profiles;\n}\n\n/** Return the first-party manifest projection for catalog and selection UIs. */\nexport function listBuiltinPluginManifestsV1(): readonly PluginManifestV1[] {\n\treturn Object.freeze(\n\t\tObject.values(manifests).sort((left, right) => {\n\t\t\tconst idOrder = `${left.id}@${left.pluginVersion}`.localeCompare(`${right.id}@${right.pluginVersion}`);\n\t\t\treturn idOrder === 0 ? comparePluginVersionsV1(left.pluginVersion, right.pluginVersion) : idOrder;\n\t\t}),\n\t);\n}\n\n/**\n * First-party plugins of an explicitly selected Profile are trusted by\n * default: builtins ship with the product and the user chose the Profile\n * explicitly. Installed third-party versions are still verified through the\n * active-binding resolver; host-injected verifiedPlugins always win.\n */\nexport function defaultBuiltinVerifiedPluginsV1(profileId: string): readonly VerifiedToolPluginV1[] {\n\tconst profile = profiles.find((candidate) => candidate.id === profileId);\n\tif (profile === undefined) return [];\n\treturn profile.pluginIds.flatMap((pluginId) => {\n\t\tconst manifest = manifests[pluginId];\n\t\treturn manifest === undefined ? [] : [{ pluginId: manifest.id, version: manifest.pluginVersion }];\n\t});\n}\n\nexport function resolveBuiltinPluginProfileV1(input: {\n\treadonly profileId: string;\n\treadonly host: HostFactsV1;\n\t/** Optional subset of the selected builtin Profile's plugins. */\n\treadonly selectedPluginIds?: readonly string[];\n\treadonly disabledPluginIds?: readonly string[];\n\treadonly verifiedPlugins?: readonly VerifiedToolPluginV1[];\n\t/** Explicit host-selected active manifests; never inferred from disk. */\n\treadonly manifestOverrides?: BuiltinPluginManifestOverridesV1;\n}): BuiltinPluginProfileResolutionV1 {\n\tconst profile = profiles.find((candidate) => candidate.id === input.profileId);\n\tif (profile === undefined) return { status: \"not_found\", profileId: input.profileId };\n\tconst requestedPluginIds = input.selectedPluginIds;\n\tconst requestedDisabledPluginIds = input.disabledPluginIds;\n\tif (requestedPluginIds !== undefined || requestedDisabledPluginIds !== undefined) {\n\t\tconst availablePluginIds = new Set(profile.pluginIds);\n\t\tconst duplicatePluginIds: string[] = [];\n\t\tconst unknownPluginIds: string[] = [];\n\t\tfor (const requestedIds of [requestedPluginIds ?? [], requestedDisabledPluginIds ?? []]) {\n\t\t\tconst seen = new Set<string>();\n\t\t\tfor (const pluginId of requestedIds) {\n\t\t\t\tif (!availablePluginIds.has(pluginId) && !unknownPluginIds.includes(pluginId))\n\t\t\t\t\tunknownPluginIds.push(pluginId);\n\t\t\t\tif (seen.has(pluginId) && !duplicatePluginIds.includes(pluginId)) duplicatePluginIds.push(pluginId);\n\t\t\t\tseen.add(pluginId);\n\t\t\t}\n\t\t}\n\t\tif (unknownPluginIds.length > 0 || duplicatePluginIds.length > 0) {\n\t\t\treturn {\n\t\t\t\tstatus: \"invalid_selection\",\n\t\t\t\tprofileId: input.profileId,\n\t\t\t\tunknownPluginIds: Object.freeze([...new Set(unknownPluginIds)]),\n\t\t\t\tduplicatePluginIds: Object.freeze(duplicatePluginIds),\n\t\t\t};\n\t\t}\n\t}\n\tconst selected =\n\t\trequestedPluginIds === undefined\n\t\t\t? profile.pluginIds\n\t\t\t: profile.pluginIds.filter((pluginId) => requestedPluginIds.includes(pluginId));\n\tconst selectedProfile =\n\t\trequestedPluginIds === undefined\n\t\t\t? profile\n\t\t\t: Object.freeze({ ...profile, pluginIds: Object.freeze([...selected]) });\n\tconst disabled = new Set(input.disabledPluginIds ?? []);\n\t// D-075 S2: a Profile plugin without a builtin manifest and without a\n\t// host-installed override is a structured miss, not a startup failure. The\n\t// plugin is omitted from the resolved manifest and runtime bindings; the\n\t// remaining Profile plugins resolve normally (soft degradation).\n\tconst manifestByPluginId = new Map(\n\t\tselectedProfile.pluginIds.map((pluginId) => [pluginId, manifestFor(pluginId, input.manifestOverrides)] as const),\n\t);\n\tconst missingPluginIds = selectedProfile.pluginIds.filter(\n\t\t(pluginId) => manifestByPluginId.get(pluginId) === undefined,\n\t);\n\tconst resolution = resolvePluginProfileV1({\n\t\tprofileId: selectedProfile.id,\n\t\tprofileVersion: selectedProfile.version,\n\t\tplugins: selectedProfile.pluginIds.flatMap((pluginId) => {\n\t\t\tconst manifest = manifestByPluginId.get(pluginId);\n\t\t\treturn manifest === undefined\n\t\t\t\t? []\n\t\t\t\t: [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tmanifest,\n\t\t\t\t\t\t\t// A user-disabled plugin must not block the remaining profile. It is\n\t\t\t\t\t\t\t// still represented in the resolution diagnostics, but is omitted from\n\t\t\t\t\t\t\t// the active resolved manifest and runtime bindings.\n\t\t\t\t\t\t\trequired: !disabled.has(pluginId),\n\t\t\t\t\t\t\tdisabled: disabled.has(pluginId),\n\t\t\t\t\t\t},\n\t\t\t\t\t];\n\t\t}),\n\t\thost: input.host,\n\t\t// The host's own version enforces each manifest's minHostVersion floor\n\t\t// at the single builtin profile resolution funnel used by production\n\t\t// loading paths.\n\t\thostVersion: VERSION,\n\t});\n\tconst merged = mergeMissingPluginResolutionsV1(resolution, missingPluginIds, disabled);\n\tif (merged.status !== \"ready\") return { status: \"resolved\", profile: selectedProfile, resolution: merged };\n\tconst resolvedPlugins = merged.resolvedManifest.plugins.map((plugin) => ({\n\t\tpluginId: plugin.pluginId,\n\t\tpluginVersion: plugin.pluginVersion,\n\t\tcapabilityRefs: plugin.capabilityRefs,\n\t\t...(plugin.selectedAdapter === undefined ? {} : { selectedAdapter: plugin.selectedAdapter }),\n\t}));\n\tconst verifiedPlugins = input.verifiedPlugins ?? [];\n\tconst assembly = assembleProfile({\n\t\tprofileId: selectedProfile.id,\n\t\tprofileVersion: selectedProfile.version,\n\t\tresolvedPlugins,\n\t\tverifiedPlugins,\n\t});\n\treturn {\n\t\tstatus: \"resolved\",\n\t\tprofile: selectedProfile,\n\t\tresolution: merged,\n\t\tassembly,\n\t};\n}\n\nfunction manifestFor(\n\tpluginId: string,\n\toverrides: BuiltinPluginManifestOverridesV1 | undefined,\n): PluginManifestV1 | undefined {\n\tconst manifest = overrides?.[pluginId] ?? manifests[pluginId];\n\t// A mismatched override stays a hard host error: the host selected it\n\t// explicitly, so silence would hide an identity bug. A plain absent\n\t// manifest (no builtin, no installed override) is the structured miss.\n\tif (manifest !== undefined && manifest.id !== pluginId)\n\t\tthrow new Error(`builtin manifest override does not match plugin ${pluginId}`);\n\treturn manifest;\n}\n\n/**\n * Merge structured `manifest_missing` resolutions for Profile plugins that\n * have no builtin manifest and no installed override into the resolver\n * result. Missing plugins never block the Profile (soft degradation): the\n * remaining diagnostics and the resolved manifest stay exactly what the\n * resolver produced, and the merged plugin list keeps the resolver's\n * deterministic id sort.\n */\nfunction mergeMissingPluginResolutionsV1(\n\tresolution: ProfileResolutionV1,\n\tmissingPluginIds: readonly string[],\n\tdisabled: ReadonlySet<string>,\n): ProfileResolutionV1 {\n\tif (missingPluginIds.length === 0) return resolution;\n\tconst missing: PluginResolutionV1[] = missingPluginIds.map((pluginId) => ({\n\t\tpluginId,\n\t\tpluginVersion: \"\",\n\t\trequired: !disabled.has(pluginId),\n\t\tstatus: \"manifest-missing\",\n\t\tdiagnostics: [\n\t\t\t{\n\t\t\t\tcode: \"manifest_missing\",\n\t\t\t\tmessage: `Plugin ${pluginId} has no builtin manifest and no installed active override; the plugin is omitted from this profile (install it with agent-forge plugin install)`,\n\t\t\t},\n\t\t],\n\t}));\n\tconst plugins = [...resolution.plugins, ...missing].sort((left, right) =>\n\t\tleft.pluginId.localeCompare(right.pluginId),\n\t);\n\treturn Object.freeze({\n\t\t...resolution,\n\t\tplugins: Object.freeze(plugins),\n\t\tdiagnostics: Object.freeze(plugins.flatMap((plugin) => plugin.diagnostics)),\n\t});\n}\n"]}

package/dist/profile/policy-manifest.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Default policy manifest (2.7e) — an explicit, declarative manifest of the
+ * confirmation / permission / dangerous-operation policies a profile wants,
+ * with an external selection path.
+ *
+ * The manifest is PURE DECLARATION: the kernel ships no policy enforcement —
+ * an enforcement plugin (or none at all) attaches externally. Every entry
+ * states its `enabled` flag explicitly; selecting an external policy
+ * replaces or nulls (disables) a declaration and produces a NEW frozen
+ * manifest plus a change record — the previous manifest stays untouched.
+ * Digests reuse the key-order-stable serialization so declarations are
+ * replayable.
+ */
+import type { JsonValue } from "@agent-forge/ai";
+export type PolicyKindV1 = "confirmation" | "permission" | "dangerous_operation";
+export interface PolicyDeclarationV1 {
+    readonly policyKind: PolicyKindV1;
+    readonly policyId: string;
+    readonly description: string;
+    /** Stated explicitly — a policy the profile does not want is `false`. */
+    readonly enabled: boolean;
+    readonly defaults?: JsonValue;
+}
+export interface PolicyManifestV1 {
+    readonly manifestVersion: 1;
+    readonly profileId: string;
+    readonly declarations: readonly PolicyDeclarationV1[];
+    readonly manifestDigest: string;
+}
+export interface PolicyChangeRecordV1 {
+    readonly policyKind: PolicyKindV1;
+    readonly policyId: string;
+    readonly action: "disabled" | "external_selected";
+    readonly reason: string;
+}
+export interface PolicyManifestBuilderV1 {
+    buildManifest(input: {
+        readonly profileId: string;
+        readonly declarations: readonly PolicyDeclarationV1[];
+    }): PolicyManifestV1;
+    /** The external selection path: swap in an external declaration or disable one (null). */
+    selectExternalPolicy(manifest: PolicyManifestV1, input: {
+        readonly policyKind: PolicyKindV1;
+        readonly policyId: string;
+        readonly external: PolicyDeclarationV1 | null;
+        readonly reason: string;
+    }): {
+        readonly manifest: PolicyManifestV1;
+        readonly change: PolicyChangeRecordV1;
+    };
+}
+export declare function createPolicyManifestBuilder(): PolicyManifestBuilderV1;
+//# sourceMappingURL=policy-manifest.d.ts.map

package/dist/profile/policy-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-manifest.d.ts","sourceRoot":"","sources":["../../src/profile/policy-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAGjD,MAAM,MAAM,YAAY,GAAG,cAAc,GAAG,YAAY,GAAG,qBAAqB,CAAC;AAEjF,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,2EAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACtD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,mBAAmB,CAAC;IAClD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACvC,aAAa,CAAC,KAAK,EAAE;QACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,YAAY,EAAE,SAAS,mBAAmB,EAAE,CAAC;KACtD,GAAG,gBAAgB,CAAC;IACrB,0FAA0F;IAC1F,oBAAoB,CACnB,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE;QACN,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC;QAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAC;QAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;KACxB,GACC;QAAE,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAA;KAAE,CAAC;CAClF;AAcD,wBAAgB,2BAA2B,IAAI,uBAAuB,CA4CrE","sourcesContent":["/**\n * Default policy manifest (2.7e) — an explicit, declarative manifest of the\n * confirmation / permission / dangerous-operation policies a profile wants,\n * with an external selection path.\n *\n * The manifest is PURE DECLARATION: the kernel ships no policy enforcement —\n * an enforcement plugin (or none at all) attaches externally. Every entry\n * states its `enabled` flag explicitly; selecting an external policy\n * replaces or nulls (disables) a declaration and produces a NEW frozen\n * manifest plus a change record — the previous manifest stays untouched.\n * Digests reuse the key-order-stable serialization so declarations are\n * replayable.\n */\nimport type { JsonValue } from \"@agent-forge/ai\";\nimport { stableJsonDigest } from \"./identity.ts\";\n\nexport type PolicyKindV1 = \"confirmation\" | \"permission\" | \"dangerous_operation\";\n\nexport interface PolicyDeclarationV1 {\n\treadonly policyKind: PolicyKindV1;\n\treadonly policyId: string;\n\treadonly description: string;\n\t/** Stated explicitly — a policy the profile does not want is `false`. */\n\treadonly enabled: boolean;\n\treadonly defaults?: JsonValue;\n}\n\nexport interface PolicyManifestV1 {\n\treadonly manifestVersion: 1;\n\treadonly profileId: string;\n\treadonly declarations: readonly PolicyDeclarationV1[];\n\treadonly manifestDigest: string;\n}\n\nexport interface PolicyChangeRecordV1 {\n\treadonly policyKind: PolicyKindV1;\n\treadonly policyId: string;\n\treadonly action: \"disabled\" | \"external_selected\";\n\treadonly reason: string;\n}\n\nexport interface PolicyManifestBuilderV1 {\n\tbuildManifest(input: {\n\t\treadonly profileId: string;\n\t\treadonly declarations: readonly PolicyDeclarationV1[];\n\t}): PolicyManifestV1;\n\t/** The external selection path: swap in an external declaration or disable one (null). */\n\tselectExternalPolicy(\n\t\tmanifest: PolicyManifestV1,\n\t\tinput: {\n\t\t\treadonly policyKind: PolicyKindV1;\n\t\t\treadonly policyId: string;\n\t\t\treadonly external: PolicyDeclarationV1 | null;\n\t\t\treadonly reason: string;\n\t\t},\n\t): { readonly manifest: PolicyManifestV1; readonly change: PolicyChangeRecordV1 };\n}\n\nfunction assertDeclaration(value: PolicyDeclarationV1): void {\n\tif (![\"confirmation\", \"permission\", \"dangerous_operation\"].includes(value.policyKind)) {\n\t\tthrow new Error(`Policy manifest policyKind is invalid: ${String(value.policyKind)}`);\n\t}\n\tif (typeof value.policyId !== \"string\" || value.policyId.trim().length === 0) {\n\t\tthrow new Error(\"Policy manifest policyId must be a non-empty string\");\n\t}\n\tif (typeof value.enabled !== \"boolean\") {\n\t\tthrow new Error(`Policy manifest ${value.policyId}: enabled must be stated explicitly`);\n\t}\n}\n\nexport function createPolicyManifestBuilder(): PolicyManifestBuilderV1 {\n\tconst buildManifest = (input: {\n\t\treadonly profileId: string;\n\t\treadonly declarations: readonly PolicyDeclarationV1[];\n\t}): PolicyManifestV1 => {\n\t\tif (input.profileId.trim().length === 0) throw new Error(\"Policy manifest profileId must be a non-empty string\");\n\t\tfor (const declaration of input.declarations) assertDeclaration(declaration);\n\t\tconst declarations = Object.freeze(input.declarations.map((declaration) => Object.freeze({ ...declaration })));\n\t\treturn Object.freeze({\n\t\t\tmanifestVersion: 1 as const,\n\t\t\tprofileId: input.profileId,\n\t\t\tdeclarations,\n\t\t\tmanifestDigest: stableJsonDigest(declarations as unknown as JsonValue),\n\t\t});\n\t};\n\n\treturn {\n\t\tbuildManifest,\n\t\tselectExternalPolicy(manifest, input) {\n\t\t\tassertDeclaration(\n\t\t\t\tinput.external ?? {\n\t\t\t\t\tpolicyKind: input.policyKind,\n\t\t\t\t\tpolicyId: input.policyId,\n\t\t\t\t\tdescription: \"\",\n\t\t\t\t\tenabled: false,\n\t\t\t\t},\n\t\t\t);\n\t\t\tconst kept = manifest.declarations.filter(\n\t\t\t\t(declaration) => !(declaration.policyKind === input.policyKind && declaration.policyId === input.policyId),\n\t\t\t);\n\t\t\tconst existed = kept.length !== manifest.declarations.length;\n\t\t\tconst declarations = input.external === null ? kept : [...kept, input.external];\n\t\t\tconst next = buildManifest({ profileId: manifest.profileId, declarations });\n\t\t\treturn {\n\t\t\t\tmanifest: next,\n\t\t\t\tchange: {\n\t\t\t\t\tpolicyKind: input.policyKind,\n\t\t\t\t\tpolicyId: input.policyId,\n\t\t\t\t\taction: input.external === null ? \"disabled\" : existed ? \"external_selected\" : \"external_selected\",\n\t\t\t\t\treason: input.reason,\n\t\t\t\t},\n\t\t\t};\n\t\t},\n\t};\n}\n"]}

package/dist/profile/policy-manifest.js

@@ -0,0 +1,52 @@
+import { stableJsonDigest } from "./identity.js";
+function assertDeclaration(value) {
+    if (!["confirmation", "permission", "dangerous_operation"].includes(value.policyKind)) {
+        throw new Error(`Policy manifest policyKind is invalid: ${String(value.policyKind)}`);
+    }
+    if (typeof value.policyId !== "string" || value.policyId.trim().length === 0) {
+        throw new Error("Policy manifest policyId must be a non-empty string");
+    }
+    if (typeof value.enabled !== "boolean") {
+        throw new Error(`Policy manifest ${value.policyId}: enabled must be stated explicitly`);
+    }
+}
+export function createPolicyManifestBuilder() {
+    const buildManifest = (input) => {
+        if (input.profileId.trim().length === 0)
+            throw new Error("Policy manifest profileId must be a non-empty string");
+        for (const declaration of input.declarations)
+            assertDeclaration(declaration);
+        const declarations = Object.freeze(input.declarations.map((declaration) => Object.freeze({ ...declaration })));
+        return Object.freeze({
+            manifestVersion: 1,
+            profileId: input.profileId,
+            declarations,
+            manifestDigest: stableJsonDigest(declarations),
+        });
+    };
+    return {
+        buildManifest,
+        selectExternalPolicy(manifest, input) {
+            assertDeclaration(input.external ?? {
+                policyKind: input.policyKind,
+                policyId: input.policyId,
+                description: "",
+                enabled: false,
+            });
+            const kept = manifest.declarations.filter((declaration) => !(declaration.policyKind === input.policyKind && declaration.policyId === input.policyId));
+            const existed = kept.length !== manifest.declarations.length;
+            const declarations = input.external === null ? kept : [...kept, input.external];
+            const next = buildManifest({ profileId: manifest.profileId, declarations });
+            return {
+                manifest: next,
+                change: {
+                    policyKind: input.policyKind,
+                    policyId: input.policyId,
+                    action: input.external === null ? "disabled" : existed ? "external_selected" : "external_selected",
+                    reason: input.reason,
+                },
+            };
+        },
+    };
+}
+//# sourceMappingURL=policy-manifest.js.map

package/dist/profile/policy-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-manifest.js","sourceRoot":"","sources":["../../src/profile/policy-manifest.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AA4CjD,SAAS,iBAAiB,CAAC,KAA0B,EAAQ;IAC5D,IAAI,CAAC,CAAC,cAAc,EAAE,YAAY,EAAE,qBAAqB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,KAAK,CAAC,0CAA0C,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,CAAC,QAAQ,qCAAqC,CAAC,CAAC;IACzF,CAAC;AAAA,CACD;AAED,MAAM,UAAU,2BAA2B,GAA4B;IACtE,MAAM,aAAa,GAAG,CAAC,KAGtB,EAAoB,EAAE,CAAC;QACvB,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACjH,KAAK,MAAM,WAAW,IAAI,KAAK,CAAC,YAAY;YAAE,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAC7E,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/G,OAAO,MAAM,CAAC,MAAM,CAAC;YACpB,eAAe,EAAE,CAAU;YAC3B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,YAAY;YACZ,cAAc,EAAE,gBAAgB,CAAC,YAAoC,CAAC;SACtE,CAAC,CAAC;IAAA,CACH,CAAC;IAEF,OAAO;QACN,aAAa;QACb,oBAAoB,CAAC,QAAQ,EAAE,KAAK,EAAE;YACrC,iBAAiB,CAChB,KAAK,CAAC,QAAQ,IAAI;gBACjB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,EAAE;gBACf,OAAO,EAAE,KAAK;aACd,CACD,CAAC;YACF,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CACxC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,IAAI,WAAW,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC,CAC1G,CAAC;YACF,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC;YAC7D,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YAChF,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;YAC5E,OAAO;gBACN,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE;oBACP,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,MAAM,EAAE,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,mBAAmB;oBAClG,MAAM,EAAE,KAAK,CAAC,MAAM;iBACpB;aACD,CAAC;QAAA,CACF;KACD,CAAC;AAAA,CACF","sourcesContent":["/**\n * Default policy manifest (2.7e) — an explicit, declarative manifest of the\n * confirmation / permission / dangerous-operation policies a profile wants,\n * with an external selection path.\n *\n * The manifest is PURE DECLARATION: the kernel ships no policy enforcement —\n * an enforcement plugin (or none at all) attaches externally. Every entry\n * states its `enabled` flag explicitly; selecting an external policy\n * replaces or nulls (disables) a declaration and produces a NEW frozen\n * manifest plus a change record — the previous manifest stays untouched.\n * Digests reuse the key-order-stable serialization so declarations are\n * replayable.\n */\nimport type { JsonValue } from \"@agent-forge/ai\";\nimport { stableJsonDigest } from \"./identity.ts\";\n\nexport type PolicyKindV1 = \"confirmation\" | \"permission\" | \"dangerous_operation\";\n\nexport interface PolicyDeclarationV1 {\n\treadonly policyKind: PolicyKindV1;\n\treadonly policyId: string;\n\treadonly description: string;\n\t/** Stated explicitly — a policy the profile does not want is `false`. */\n\treadonly enabled: boolean;\n\treadonly defaults?: JsonValue;\n}\n\nexport interface PolicyManifestV1 {\n\treadonly manifestVersion: 1;\n\treadonly profileId: string;\n\treadonly declarations: readonly PolicyDeclarationV1[];\n\treadonly manifestDigest: string;\n}\n\nexport interface PolicyChangeRecordV1 {\n\treadonly policyKind: PolicyKindV1;\n\treadonly policyId: string;\n\treadonly action: \"disabled\" | \"external_selected\";\n\treadonly reason: string;\n}\n\nexport interface PolicyManifestBuilderV1 {\n\tbuildManifest(input: {\n\t\treadonly profileId: string;\n\t\treadonly declarations: readonly PolicyDeclarationV1[];\n\t}): PolicyManifestV1;\n\t/** The external selection path: swap in an external declaration or disable one (null). */\n\tselectExternalPolicy(\n\t\tmanifest: PolicyManifestV1,\n\t\tinput: {\n\t\t\treadonly policyKind: PolicyKindV1;\n\t\t\treadonly policyId: string;\n\t\t\treadonly external: PolicyDeclarationV1 | null;\n\t\t\treadonly reason: string;\n\t\t},\n\t): { readonly manifest: PolicyManifestV1; readonly change: PolicyChangeRecordV1 };\n}\n\nfunction assertDeclaration(value: PolicyDeclarationV1): void {\n\tif (![\"confirmation\", \"permission\", \"dangerous_operation\"].includes(value.policyKind)) {\n\t\tthrow new Error(`Policy manifest policyKind is invalid: ${String(value.policyKind)}`);\n\t}\n\tif (typeof value.policyId !== \"string\" || value.policyId.trim().length === 0) {\n\t\tthrow new Error(\"Policy manifest policyId must be a non-empty string\");\n\t}\n\tif (typeof value.enabled !== \"boolean\") {\n\t\tthrow new Error(`Policy manifest ${value.policyId}: enabled must be stated explicitly`);\n\t}\n}\n\nexport function createPolicyManifestBuilder(): PolicyManifestBuilderV1 {\n\tconst buildManifest = (input: {\n\t\treadonly profileId: string;\n\t\treadonly declarations: readonly PolicyDeclarationV1[];\n\t}): PolicyManifestV1 => {\n\t\tif (input.profileId.trim().length === 0) throw new Error(\"Policy manifest profileId must be a non-empty string\");\n\t\tfor (const declaration of input.declarations) assertDeclaration(declaration);\n\t\tconst declarations = Object.freeze(input.declarations.map((declaration) => Object.freeze({ ...declaration })));\n\t\treturn Object.freeze({\n\t\t\tmanifestVersion: 1 as const,\n\t\t\tprofileId: input.profileId,\n\t\t\tdeclarations,\n\t\t\tmanifestDigest: stableJsonDigest(declarations as unknown as JsonValue),\n\t\t});\n\t};\n\n\treturn {\n\t\tbuildManifest,\n\t\tselectExternalPolicy(manifest, input) {\n\t\t\tassertDeclaration(\n\t\t\t\tinput.external ?? {\n\t\t\t\t\tpolicyKind: input.policyKind,\n\t\t\t\t\tpolicyId: input.policyId,\n\t\t\t\t\tdescription: \"\",\n\t\t\t\t\tenabled: false,\n\t\t\t\t},\n\t\t\t);\n\t\t\tconst kept = manifest.declarations.filter(\n\t\t\t\t(declaration) => !(declaration.policyKind === input.policyKind && declaration.policyId === input.policyId),\n\t\t\t);\n\t\t\tconst existed = kept.length !== manifest.declarations.length;\n\t\t\tconst declarations = input.external === null ? kept : [...kept, input.external];\n\t\t\tconst next = buildManifest({ profileId: manifest.profileId, declarations });\n\t\t\treturn {\n\t\t\t\tmanifest: next,\n\t\t\t\tchange: {\n\t\t\t\t\tpolicyKind: input.policyKind,\n\t\t\t\t\tpolicyId: input.policyId,\n\t\t\t\t\taction: input.external === null ? \"disabled\" : existed ? \"external_selected\" : \"external_selected\",\n\t\t\t\t\treason: input.reason,\n\t\t\t\t},\n\t\t\t};\n\t\t},\n\t};\n}\n"]}

package/dist/profile/profile-assembly.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Profile assembly (2.5b) — assembles a Profile from VERIFIED tool plugins
+ * only, locks the assembly with the 2.0a identity digest, and provides the
+ * single explicit replacement path.
+ *
+ * Assembly fails structurally for any plugin that is not in the verified
+ * set (same pluginId AND same version). The assembled record is deep-frozen
+ * and carries the identity digest, so a locked assembly can be checked for
+ * drift later. `replacePlugin` is the only mutation: it requires the
+ * replacement to be verified, emits a replacement record, and returns a NEW
+ * frozen assembly — the previous one stays untouched. MCP/CLI functionality
+ * itself is Stage 4; this slice only verifies assembly, version lock, and
+ * replacement.
+ */
+import { type ProfileIdentityV1, type ResolvedPluginManifestV1 } from "./identity.ts";
+export interface VerifiedToolPluginV1 {
+    readonly pluginId: string;
+    readonly version: string;
+}
+export interface ProfileAssemblyV1 {
+    readonly profileId: string;
+    readonly profileVersion: string;
+    readonly identity: ProfileIdentityV1;
+    readonly plugins: readonly ResolvedPluginManifestV1[];
+}
+export interface PluginReplacementRecordV1 {
+    readonly from: {
+        readonly pluginId: string;
+        readonly pluginVersion: string;
+    };
+    readonly to: {
+        readonly pluginId: string;
+        readonly pluginVersion: string;
+    };
+    readonly reason: string;
+}
+export type ProfileAssemblyResultV1 = {
+    readonly status: "assembled";
+    readonly assembly: ProfileAssemblyV1;
+} | {
+    readonly status: "unverified";
+    readonly unverified: readonly {
+        readonly pluginId: string;
+        readonly pluginVersion: string;
+    }[];
+};
+export type ProfileReplacementResultV1 = {
+    readonly status: "replaced";
+    readonly assembly: ProfileAssemblyV1;
+    readonly replacement: PluginReplacementRecordV1;
+} | {
+    readonly status: "unverified";
+    readonly unverified: readonly {
+        readonly pluginId: string;
+        readonly pluginVersion: string;
+    }[];
+} | {
+    readonly status: "absent";
+    readonly pluginId: string;
+};
+export declare function assembleProfile(input: {
+    readonly profileId: string;
+    readonly profileVersion: string;
+    readonly resolvedPlugins: readonly ResolvedPluginManifestV1[];
+    readonly verifiedPlugins: readonly VerifiedToolPluginV1[];
+}): ProfileAssemblyResultV1;
+/** The single explicit replacement path; the source assembly stays frozen. */
+export declare function replaceProfilePlugin(assembly: ProfileAssemblyV1, input: {
+    readonly fromPluginId: string;
+    readonly replacement: ResolvedPluginManifestV1;
+    readonly verifiedPlugins: readonly VerifiedToolPluginV1[];
+    readonly reason: string;
+}): ProfileReplacementResultV1;
+//# sourceMappingURL=profile-assembly.d.ts.map

package/dist/profile/profile-assembly.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-assembly.d.ts","sourceRoot":"","sources":["../../src/profile/profile-assembly.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAA0B,KAAK,iBAAiB,EAAE,KAAK,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9G,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,SAAS,wBAAwB,EAAE,CAAC;CACtD;AAED,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7E,QAAQ,CAAC,EAAE,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,uBAAuB,GAChC;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAA;CAAE,GACtE;IACA,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,SAAS;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC7F,CAAC;AAEL,MAAM,MAAM,0BAA0B,GACnC;IACA,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,yBAAyB,CAAC;CAC/C,GACD;IACA,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,SAAS;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC7F,GACD;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAwC5D,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAC9D,QAAQ,CAAC,eAAe,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAC1D,GAAG,uBAAuB,CAgB1B;AAED,8EAA8E;AAC9E,wBAAgB,oBAAoB,CACnC,QAAQ,EAAE,iBAAiB,EAC3B,KAAK,EAAE;IACN,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,wBAAwB,CAAC;IAC/C,QAAQ,CAAC,eAAe,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC1D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB,GACC,0BAA0B,CA6B5B","sourcesContent":["/**\n * Profile assembly (2.5b) — assembles a Profile from VERIFIED tool plugins\n * only, locks the assembly with the 2.0a identity digest, and provides the\n * single explicit replacement path.\n *\n * Assembly fails structurally for any plugin that is not in the verified\n * set (same pluginId AND same version). The assembled record is deep-frozen\n * and carries the identity digest, so a locked assembly can be checked for\n * drift later. `replacePlugin` is the only mutation: it requires the\n * replacement to be verified, emits a replacement record, and returns a NEW\n * frozen assembly — the previous one stays untouched. MCP/CLI functionality\n * itself is Stage 4; this slice only verifies assembly, version lock, and\n * replacement.\n */\nimport { buildProfileIdentityV1, type ProfileIdentityV1, type ResolvedPluginManifestV1 } from \"./identity.ts\";\n\nexport interface VerifiedToolPluginV1 {\n\treadonly pluginId: string;\n\treadonly version: string;\n}\n\nexport interface ProfileAssemblyV1 {\n\treadonly profileId: string;\n\treadonly profileVersion: string;\n\treadonly identity: ProfileIdentityV1;\n\treadonly plugins: readonly ResolvedPluginManifestV1[];\n}\n\nexport interface PluginReplacementRecordV1 {\n\treadonly from: { readonly pluginId: string; readonly pluginVersion: string };\n\treadonly to: { readonly pluginId: string; readonly pluginVersion: string };\n\treadonly reason: string;\n}\n\nexport type ProfileAssemblyResultV1 =\n\t| { readonly status: \"assembled\"; readonly assembly: ProfileAssemblyV1 }\n\t| {\n\t\t\treadonly status: \"unverified\";\n\t\t\treadonly unverified: readonly { readonly pluginId: string; readonly pluginVersion: string }[];\n\t  };\n\nexport type ProfileReplacementResultV1 =\n\t| {\n\t\t\treadonly status: \"replaced\";\n\t\t\treadonly assembly: ProfileAssemblyV1;\n\t\t\treadonly replacement: PluginReplacementRecordV1;\n\t  }\n\t| {\n\t\t\treadonly status: \"unverified\";\n\t\t\treadonly unverified: readonly { readonly pluginId: string; readonly pluginVersion: string }[];\n\t  }\n\t| { readonly status: \"absent\"; readonly pluginId: string };\n\nfunction freezeAssembly(assembly: ProfileAssemblyV1): ProfileAssemblyV1 {\n\treturn Object.freeze({\n\t\t...assembly,\n\t\tplugins: Object.freeze(\n\t\t\tassembly.plugins.map((plugin) =>\n\t\t\t\tObject.freeze({\n\t\t\t\t\t...plugin,\n\t\t\t\t\tcapabilityRefs: Object.freeze(plugin.capabilityRefs.map((ref) => Object.freeze({ ...ref }))),\n\t\t\t\t\t...(plugin.selectedAdapter === undefined\n\t\t\t\t\t\t? {}\n\t\t\t\t\t\t: { selectedAdapter: Object.freeze({ ...plugin.selectedAdapter }) }),\n\t\t\t\t}),\n\t\t\t),\n\t\t),\n\t});\n}\n\nfunction assembleIdentity(input: {\n\treadonly profileId: string;\n\treadonly profileVersion: string;\n\treadonly plugins: readonly ResolvedPluginManifestV1[];\n}): ProfileAssemblyV1 {\n\tconst identity = buildProfileIdentityV1({\n\t\tprofileId: input.profileId,\n\t\tprofileVersion: input.profileVersion,\n\t\tresolvedPlugins: input.plugins,\n\t\tcapabilityVersions: [...new Set(input.plugins.flatMap((plugin) => plugin.capabilityRefs))].sort(\n\t\t\t(a, b) => a.id.localeCompare(b.id) || a.version - b.version,\n\t\t),\n\t});\n\treturn freezeAssembly({\n\t\tprofileId: input.profileId,\n\t\tprofileVersion: input.profileVersion,\n\t\tidentity,\n\t\tplugins: [...input.plugins],\n\t});\n}\n\nexport function assembleProfile(input: {\n\treadonly profileId: string;\n\treadonly profileVersion: string;\n\treadonly resolvedPlugins: readonly ResolvedPluginManifestV1[];\n\treadonly verifiedPlugins: readonly VerifiedToolPluginV1[];\n}): ProfileAssemblyResultV1 {\n\tconst verified = new Map(input.verifiedPlugins.map((entry) => [`${entry.pluginId}@${entry.version}`, true]));\n\tconst unverified = input.resolvedPlugins\n\t\t.filter((plugin) => !verified.has(`${plugin.pluginId}@${plugin.pluginVersion}`))\n\t\t.map((plugin) => ({ pluginId: plugin.pluginId, pluginVersion: plugin.pluginVersion }));\n\tif (unverified.length > 0) {\n\t\treturn { status: \"unverified\", unverified };\n\t}\n\treturn {\n\t\tstatus: \"assembled\",\n\t\tassembly: assembleIdentity({\n\t\t\tprofileId: input.profileId,\n\t\t\tprofileVersion: input.profileVersion,\n\t\t\tplugins: input.resolvedPlugins,\n\t\t}),\n\t};\n}\n\n/** The single explicit replacement path; the source assembly stays frozen. */\nexport function replaceProfilePlugin(\n\tassembly: ProfileAssemblyV1,\n\tinput: {\n\t\treadonly fromPluginId: string;\n\t\treadonly replacement: ResolvedPluginManifestV1;\n\t\treadonly verifiedPlugins: readonly VerifiedToolPluginV1[];\n\t\treadonly reason: string;\n\t},\n): ProfileReplacementResultV1 {\n\tconst fromPlugin = assembly.plugins.find((plugin) => plugin.pluginId === input.fromPluginId);\n\tif (!fromPlugin) {\n\t\treturn { status: \"absent\", pluginId: input.fromPluginId };\n\t}\n\tconst verified = new Map(input.verifiedPlugins.map((entry) => [`${entry.pluginId}@${entry.version}`, true]));\n\tif (!verified.has(`${input.replacement.pluginId}@${input.replacement.pluginVersion}`)) {\n\t\treturn {\n\t\t\tstatus: \"unverified\",\n\t\t\tunverified: [{ pluginId: input.replacement.pluginId, pluginVersion: input.replacement.pluginVersion }],\n\t\t};\n\t}\n\tconst nextPlugins = assembly.plugins\n\t\t.filter((plugin) => plugin.pluginId !== input.fromPluginId)\n\t\t.concat([input.replacement]);\n\tconst next = assembleIdentity({\n\t\tprofileId: assembly.profileId,\n\t\tprofileVersion: assembly.profileVersion,\n\t\tplugins: nextPlugins,\n\t});\n\treturn {\n\t\tstatus: \"replaced\",\n\t\tassembly: next,\n\t\treplacement: {\n\t\t\tfrom: { pluginId: fromPlugin.pluginId, pluginVersion: fromPlugin.pluginVersion },\n\t\t\tto: { pluginId: input.replacement.pluginId, pluginVersion: input.replacement.pluginVersion },\n\t\t\treason: input.reason,\n\t\t},\n\t};\n}\n"]}

package/dist/profile/profile-assembly.js

@@ -0,0 +1,90 @@
+/**
+ * Profile assembly (2.5b) — assembles a Profile from VERIFIED tool plugins
+ * only, locks the assembly with the 2.0a identity digest, and provides the
+ * single explicit replacement path.
+ *
+ * Assembly fails structurally for any plugin that is not in the verified
+ * set (same pluginId AND same version). The assembled record is deep-frozen
+ * and carries the identity digest, so a locked assembly can be checked for
+ * drift later. `replacePlugin` is the only mutation: it requires the
+ * replacement to be verified, emits a replacement record, and returns a NEW
+ * frozen assembly — the previous one stays untouched. MCP/CLI functionality
+ * itself is Stage 4; this slice only verifies assembly, version lock, and
+ * replacement.
+ */
+import { buildProfileIdentityV1 } from "./identity.js";
+function freezeAssembly(assembly) {
+    return Object.freeze({
+        ...assembly,
+        plugins: Object.freeze(assembly.plugins.map((plugin) => Object.freeze({
+            ...plugin,
+            capabilityRefs: Object.freeze(plugin.capabilityRefs.map((ref) => Object.freeze({ ...ref }))),
+            ...(plugin.selectedAdapter === undefined
+                ? {}
+                : { selectedAdapter: Object.freeze({ ...plugin.selectedAdapter }) }),
+        }))),
+    });
+}
+function assembleIdentity(input) {
+    const identity = buildProfileIdentityV1({
+        profileId: input.profileId,
+        profileVersion: input.profileVersion,
+        resolvedPlugins: input.plugins,
+        capabilityVersions: [...new Set(input.plugins.flatMap((plugin) => plugin.capabilityRefs))].sort((a, b) => a.id.localeCompare(b.id) || a.version - b.version),
+    });
+    return freezeAssembly({
+        profileId: input.profileId,
+        profileVersion: input.profileVersion,
+        identity,
+        plugins: [...input.plugins],
+    });
+}
+export function assembleProfile(input) {
+    const verified = new Map(input.verifiedPlugins.map((entry) => [`${entry.pluginId}@${entry.version}`, true]));
+    const unverified = input.resolvedPlugins
+        .filter((plugin) => !verified.has(`${plugin.pluginId}@${plugin.pluginVersion}`))
+        .map((plugin) => ({ pluginId: plugin.pluginId, pluginVersion: plugin.pluginVersion }));
+    if (unverified.length > 0) {
+        return { status: "unverified", unverified };
+    }
+    return {
+        status: "assembled",
+        assembly: assembleIdentity({
+            profileId: input.profileId,
+            profileVersion: input.profileVersion,
+            plugins: input.resolvedPlugins,
+        }),
+    };
+}
+/** The single explicit replacement path; the source assembly stays frozen. */
+export function replaceProfilePlugin(assembly, input) {
+    const fromPlugin = assembly.plugins.find((plugin) => plugin.pluginId === input.fromPluginId);
+    if (!fromPlugin) {
+        return { status: "absent", pluginId: input.fromPluginId };
+    }
+    const verified = new Map(input.verifiedPlugins.map((entry) => [`${entry.pluginId}@${entry.version}`, true]));
+    if (!verified.has(`${input.replacement.pluginId}@${input.replacement.pluginVersion}`)) {
+        return {
+            status: "unverified",
+            unverified: [{ pluginId: input.replacement.pluginId, pluginVersion: input.replacement.pluginVersion }],
+        };
+    }
+    const nextPlugins = assembly.plugins
+        .filter((plugin) => plugin.pluginId !== input.fromPluginId)
+        .concat([input.replacement]);
+    const next = assembleIdentity({
+        profileId: assembly.profileId,
+        profileVersion: assembly.profileVersion,
+        plugins: nextPlugins,
+    });
+    return {
+        status: "replaced",
+        assembly: next,
+        replacement: {
+            from: { pluginId: fromPlugin.pluginId, pluginVersion: fromPlugin.pluginVersion },
+            to: { pluginId: input.replacement.pluginId, pluginVersion: input.replacement.pluginVersion },
+            reason: input.reason,
+        },
+    };
+}
+//# sourceMappingURL=profile-assembly.js.map

package/dist/profile/profile-assembly.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-assembly.js","sourceRoot":"","sources":["../../src/profile/profile-assembly.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,sBAAsB,EAAyD,MAAM,eAAe,CAAC;AAuC9G,SAAS,cAAc,CAAC,QAA2B,EAAqB;IACvE,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,GAAG,QAAQ;QACX,OAAO,EAAE,MAAM,CAAC,MAAM,CACrB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAC/B,MAAM,CAAC,MAAM,CAAC;YACb,GAAG,MAAM;YACT,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;YAC5F,GAAG,CAAC,MAAM,CAAC,eAAe,KAAK,SAAS;gBACvC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC,EAAE,CAAC;SACrE,CAAC,CACF,CACD;KACD,CAAC,CAAC;AAAA,CACH;AAED,SAAS,gBAAgB,CAAC,KAIzB,EAAqB;IACrB,MAAM,QAAQ,GAAG,sBAAsB,CAAC;QACvC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,eAAe,EAAE,KAAK,CAAC,OAAO;QAC9B,kBAAkB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAC9F,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAC3D;KACD,CAAC,CAAC;IACH,OAAO,cAAc,CAAC;QACrB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ;QACR,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;KAC3B,CAAC,CAAC;AAAA,CACH;AAED,MAAM,UAAU,eAAe,CAAC,KAK/B,EAA2B;IAC3B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7G,MAAM,UAAU,GAAG,KAAK,CAAC,eAAe;SACtC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;SAC/E,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;IACxF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO;QACN,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,gBAAgB,CAAC;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO,EAAE,KAAK,CAAC,eAAe;SAC9B,CAAC;KACF,CAAC;AAAA,CACF;AAED,8EAA8E;AAC9E,MAAM,UAAU,oBAAoB,CACnC,QAA2B,EAC3B,KAKC,EAC4B;IAC7B,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7F,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;IAC3D,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7G,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,QAAQ,IAAI,KAAK,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC,EAAE,CAAC;QACvF,OAAO;YACN,MAAM,EAAE,YAAY;YACpB,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;SACtG,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO;SAClC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,YAAY,CAAC;SAC1D,MAAM,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,gBAAgB,CAAC;QAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,OAAO,EAAE,WAAW;KACpB,CAAC,CAAC;IACH,OAAO;QACN,MAAM,EAAE,UAAU;QAClB,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE;YACZ,IAAI,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,aAAa,EAAE;YAChF,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,aAAa,EAAE;YAC5F,MAAM,EAAE,KAAK,CAAC,MAAM;SACpB;KACD,CAAC;AAAA,CACF","sourcesContent":["/**\n * Profile assembly (2.5b) — assembles a Profile from VERIFIED tool plugins\n * only, locks the assembly with the 2.0a identity digest, and provides the\n * single explicit replacement path.\n *\n * Assembly fails structurally for any plugin that is not in the verified\n * set (same pluginId AND same version). The assembled record is deep-frozen\n * and carries the identity digest, so a locked assembly can be checked for\n * drift later. `replacePlugin` is the only mutation: it requires the\n * replacement to be verified, emits a replacement record, and returns a NEW\n * frozen assembly — the previous one stays untouched. MCP/CLI functionality\n * itself is Stage 4; this slice only verifies assembly, version lock, and\n * replacement.\n */\nimport { buildProfileIdentityV1, type ProfileIdentityV1, type ResolvedPluginManifestV1 } from \"./identity.ts\";\n\nexport interface VerifiedToolPluginV1 {\n\treadonly pluginId: string;\n\treadonly version: string;\n}\n\nexport interface ProfileAssemblyV1 {\n\treadonly profileId: string;\n\treadonly profileVersion: string;\n\treadonly identity: ProfileIdentityV1;\n\treadonly plugins: readonly ResolvedPluginManifestV1[];\n}\n\nexport interface PluginReplacementRecordV1 {\n\treadonly from: { readonly pluginId: string; readonly pluginVersion: string };\n\treadonly to: { readonly pluginId: string; readonly pluginVersion: string };\n\treadonly reason: string;\n}\n\nexport type ProfileAssemblyResultV1 =\n\t| { readonly status: \"assembled\"; readonly assembly: ProfileAssemblyV1 }\n\t| {\n\t\t\treadonly status: \"unverified\";\n\t\t\treadonly unverified: readonly { readonly pluginId: string; readonly pluginVersion: string }[];\n\t  };\n\nexport type ProfileReplacementResultV1 =\n\t| {\n\t\t\treadonly status: \"replaced\";\n\t\t\treadonly assembly: ProfileAssemblyV1;\n\t\t\treadonly replacement: PluginReplacementRecordV1;\n\t  }\n\t| {\n\t\t\treadonly status: \"unverified\";\n\t\t\treadonly unverified: readonly { readonly pluginId: string; readonly pluginVersion: string }[];\n\t  }\n\t| { readonly status: \"absent\"; readonly pluginId: string };\n\nfunction freezeAssembly(assembly: ProfileAssemblyV1): ProfileAssemblyV1 {\n\treturn Object.freeze({\n\t\t...assembly,\n\t\tplugins: Object.freeze(\n\t\t\tassembly.plugins.map((plugin) =>\n\t\t\t\tObject.freeze({\n\t\t\t\t\t...plugin,\n\t\t\t\t\tcapabilityRefs: Object.freeze(plugin.capabilityRefs.map((ref) => Object.freeze({ ...ref }))),\n\t\t\t\t\t...(plugin.selectedAdapter === undefined\n\t\t\t\t\t\t? {}\n\t\t\t\t\t\t: { selectedAdapter: Object.freeze({ ...plugin.selectedAdapter }) }),\n\t\t\t\t}),\n\t\t\t),\n\t\t),\n\t});\n}\n\nfunction assembleIdentity(input: {\n\treadonly profileId: string;\n\treadonly profileVersion: string;\n\treadonly plugins: readonly ResolvedPluginManifestV1[];\n}): ProfileAssemblyV1 {\n\tconst identity = buildProfileIdentityV1({\n\t\tprofileId: input.profileId,\n\t\tprofileVersion: input.profileVersion,\n\t\tresolvedPlugins: input.plugins,\n\t\tcapabilityVersions: [...new Set(input.plugins.flatMap((plugin) => plugin.capabilityRefs))].sort(\n\t\t\t(a, b) => a.id.localeCompare(b.id) || a.version - b.version,\n\t\t),\n\t});\n\treturn freezeAssembly({\n\t\tprofileId: input.profileId,\n\t\tprofileVersion: input.profileVersion,\n\t\tidentity,\n\t\tplugins: [...input.plugins],\n\t});\n}\n\nexport function assembleProfile(input: {\n\treadonly profileId: string;\n\treadonly profileVersion: string;\n\treadonly resolvedPlugins: readonly ResolvedPluginManifestV1[];\n\treadonly verifiedPlugins: readonly VerifiedToolPluginV1[];\n}): ProfileAssemblyResultV1 {\n\tconst verified = new Map(input.verifiedPlugins.map((entry) => [`${entry.pluginId}@${entry.version}`, true]));\n\tconst unverified = input.resolvedPlugins\n\t\t.filter((plugin) => !verified.has(`${plugin.pluginId}@${plugin.pluginVersion}`))\n\t\t.map((plugin) => ({ pluginId: plugin.pluginId, pluginVersion: plugin.pluginVersion }));\n\tif (unverified.length > 0) {\n\t\treturn { status: \"unverified\", unverified };\n\t}\n\treturn {\n\t\tstatus: \"assembled\",\n\t\tassembly: assembleIdentity({\n\t\t\tprofileId: input.profileId,\n\t\t\tprofileVersion: input.profileVersion,\n\t\t\tplugins: input.resolvedPlugins,\n\t\t}),\n\t};\n}\n\n/** The single explicit replacement path; the source assembly stays frozen. */\nexport function replaceProfilePlugin(\n\tassembly: ProfileAssemblyV1,\n\tinput: {\n\t\treadonly fromPluginId: string;\n\t\treadonly replacement: ResolvedPluginManifestV1;\n\t\treadonly verifiedPlugins: readonly VerifiedToolPluginV1[];\n\t\treadonly reason: string;\n\t},\n): ProfileReplacementResultV1 {\n\tconst fromPlugin = assembly.plugins.find((plugin) => plugin.pluginId === input.fromPluginId);\n\tif (!fromPlugin) {\n\t\treturn { status: \"absent\", pluginId: input.fromPluginId };\n\t}\n\tconst verified = new Map(input.verifiedPlugins.map((entry) => [`${entry.pluginId}@${entry.version}`, true]));\n\tif (!verified.has(`${input.replacement.pluginId}@${input.replacement.pluginVersion}`)) {\n\t\treturn {\n\t\t\tstatus: \"unverified\",\n\t\t\tunverified: [{ pluginId: input.replacement.pluginId, pluginVersion: input.replacement.pluginVersion }],\n\t\t};\n\t}\n\tconst nextPlugins = assembly.plugins\n\t\t.filter((plugin) => plugin.pluginId !== input.fromPluginId)\n\t\t.concat([input.replacement]);\n\tconst next = assembleIdentity({\n\t\tprofileId: assembly.profileId,\n\t\tprofileVersion: assembly.profileVersion,\n\t\tplugins: nextPlugins,\n\t});\n\treturn {\n\t\tstatus: \"replaced\",\n\t\tassembly: next,\n\t\treplacement: {\n\t\t\tfrom: { pluginId: fromPlugin.pluginId, pluginVersion: fromPlugin.pluginVersion },\n\t\t\tto: { pluginId: input.replacement.pluginId, pluginVersion: input.replacement.pluginVersion },\n\t\t\treason: input.reason,\n\t\t},\n\t};\n}\n"]}

package/dist/profile/profile-migration.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Profile migration / reload policy (2.7b) — the explicit session-reopen
+ * policy over the 2.0b lock.
+ *
+ * Reload outcomes map one-to-one onto the lock verification: `current`
+ * reopens silently; `migration_required` (profile version changed) and
+ * `drift` (digest/capability mismatch at the same version) both require an
+ * EXPLICIT authorized migration — nothing about the session history changes
+ * until it succeeds. A failed migration leaves the previous lock and the
+ * session history untouched; the old lock stays openable against its own
+ * identity. Silent drift absorption is impossible by construction: every
+ * non-current outcome must pass through `applyMigration` with an explicit
+ * `authorizedBy`.
+ */
+import type { ProfileIdentityV1 } from "./identity.ts";
+import { type ProfileLockV1 } from "./lock.ts";
+export interface ProfileMigrationPlanV1 {
+    readonly status: "current" | "migration_required" | "drift";
+    readonly fromProfileVersion: string;
+    readonly toProfileVersion: string;
+    readonly needsExplicitMigration: boolean;
+    readonly reason?: string;
+}
+export type ProfileMigrationResultV1 = {
+    readonly status: "migrated";
+    readonly lock: ProfileLockV1;
+} | {
+    readonly status: "current";
+    readonly lock: ProfileLockV1;
+} | {
+    readonly status: "failed";
+    readonly lock: ProfileLockV1;
+    readonly reason: string;
+};
+export interface ProfileMigrationPolicyV1 {
+    /**
+     * Evaluates a reopen against the locked identity. Deterministic and free
+     * of side effects: no lock is written, no history changes.
+     */
+    planMigration(input: {
+        readonly lock: ProfileLockV1;
+        readonly current: ProfileIdentityV1;
+    }): ProfileMigrationPlanV1;
+    /**
+     * The ONLY way a migrated lock comes into existence. Requires an explicit
+     * authorizer; on any failure the previous lock survives unchanged.
+     */
+    applyMigration(input: {
+        readonly lock: ProfileLockV1;
+        readonly current: ProfileIdentityV1;
+        readonly authorizedBy: string;
+        readonly now?: () => number;
+    }): ProfileMigrationResultV1;
+}
+export declare function createProfileMigrationPolicy(): ProfileMigrationPolicyV1;
+//# sourceMappingURL=profile-migration.d.ts.map