@askdkc/dsh-cli 0.11.3

package/lib/types/adapter/standard/negotiate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"negotiate.d.ts","sourceRoot":"","sources":["../../../../src/adapter/standard/negotiate.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAIlF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAElD,OAAO,KAAK,EAAE,cAAc,EAAsB,mBAAmB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAIzG,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,wBAAgB,SAAS,CACvB,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,cAAc,EACpB,MAAM,GAAE,SAAS,iBAAiB,EAAO,GACxC,mBAAmB,CA6FrB"}

package/lib/types/adapter/standard/negotiate.js

@@ -0,0 +1,97 @@
+/** Five-state admission decision using dsh-std projection and ProtocolCatalog. */
+import { defineProtocolDeclaration } from '@dsh-std/core';
+import { projectManifest } from '@dsh-std/manifest';
+import { rawScopeCovers } from './permission-scope.js';
+const coordinateKey = (ref) => `${ref.apiVersion}#${ref.kind}`;
+export function negotiate(index, manifest, host, grants = []) {
+    const supported = new Map(host.contracts.map(contract => [coordinateKey(contract), contract]));
+    const required = manifest.requires.contracts.filter(reference => reference.optional !== true);
+    const optional = manifest.requires.contracts.filter(reference => reference.optional === true);
+    const unknown = manifest.requires.contracts.filter(reference => {
+        try {
+            return index.resolveContractRef(reference).unregisteredVersion;
+        }
+        catch {
+            return false;
+        }
+    });
+    if (unknown.length > 0) {
+        return {
+            decision: 'unknown',
+            reasonCode: 'UNKNOWN_PROTOCOL_VERSION',
+            unknownContracts: unknown.map(coordinateKey),
+        };
+    }
+    if (!host.facetApiVersions.includes(manifest.facets.host.apiVersion)) {
+        return {
+            decision: 'rejected',
+            reasonCode: 'FACET_API_VERSION_UNAVAILABLE',
+            facetApiVersion: manifest.facets.host.apiVersion,
+            hostFacetApiVersions: host.facetApiVersions,
+        };
+    }
+    const missingRequired = required.filter(reference => !supported.has(coordinateKey(reference)));
+    const missingOptional = optional.filter(reference => !supported.has(coordinateKey(reference)));
+    if (missingRequired.length > 0) {
+        return {
+            decision: 'rejected',
+            reasonCode: 'REQUIRED_PROTOCOL_UNAVAILABLE',
+            missingRequired: missingRequired.map(coordinateKey),
+        };
+    }
+    const projected = projectManifest(manifest);
+    const facet = projected.spec.facets.find(candidate => candidate.name === 'host');
+    const supportedKeys = new Set(host.contracts.map(contract => coordinateKey(contract)));
+    const declaration = defineProtocolDeclaration({
+        participant: { id: manifest.id },
+        // An optional protocol that is absent is intentionally omitted from the
+        // evaluator input; its degraded state was already recorded above. This
+        // keeps ProtocolCatalog's required-support error meaningful for every
+        // remaining requirement.
+        requires: (facet?.protocols?.requires ?? []).filter(reference => reference.optional !== true || supportedKeys.has(coordinateKey(reference))),
+    });
+    const hostDeclaration = defineProtocolDeclaration({
+        participant: { id: host.hostId },
+        supports: host.contracts.map(contract => ({
+            apiVersion: contract.apiVersion,
+            kind: contract.kind,
+            ...(Object.hasOwn(contract, 'spec') ? { spec: contract.spec } : {}),
+        })),
+    });
+    const report = index.protocols.negotiate([declaration, hostDeclaration]);
+    if (!report.compatible) {
+        return {
+            decision: 'rejected',
+            reasonCode: 'PROTOCOL_NEGOTIATION_FAILED',
+            issues: report.issues,
+        };
+    }
+    const hostPermissions = new Set(host.contracts.flatMap(contract => contract.permissions));
+    const denied = manifest.permissions.filter((request) => {
+        if (!hostPermissions.has(request.name))
+            return true;
+        const definition = index.permissions.permissions.find(permission => permission.name === request.name);
+        if (definition === undefined)
+            return true;
+        const matching = grants.filter(grant => grant.name === request.name
+            && rawScopeCovers(grant.name, grant.scope, request.scope, manifest.id));
+        // Explicit revocation wins over an allow-default permission. This keeps
+        // admission diagnostics aligned with the runtime checkpoint instead of
+        // reporting a plugin as compatible until its first invocation fails.
+        if (matching.some(grant => grant.granted === false))
+            return true;
+        if (definition.default === 'allow')
+            return false;
+        return !matching.some(grant => grant.granted !== false);
+    });
+    if (denied.length > 0) {
+        return {
+            decision: 'waiting_authorization',
+            reasonCode: 'PERMISSION_NOT_GRANTED',
+            deniedPermissions: denied.map(request => `${request.name}@${request.scope}`),
+        };
+    }
+    return missingOptional.length > 0
+        ? { decision: 'compatible_degraded', missingOptional: missingOptional.map(coordinateKey) }
+        : { decision: 'compatible' };
+}

package/lib/types/adapter/standard/permission-scope.d.ts

@@ -0,0 +1,27 @@
+/** Permission scope normalization shared by admission and runtime checks. */
+import { INTERCEPT_PERMISSIONS, INTERCEPT_EVENT_SCOPE_BY_PERMISSION, TUI_EVENT_SCOPE_NAMES } from '../spec/protocol-constants.js';
+export { INTERCEPT_PERMISSIONS, INTERCEPT_EVENT_SCOPE_BY_PERMISSION, TUI_EVENT_SCOPE_NAMES };
+/** Storage permission names are derived from the same vendored registry. */
+export declare const STORAGE_PERMISSIONS: Set<string>;
+/** A session scope is carried through the message envelope and may also be
+ * used by an intercept grant. Keep the canonical bound here so admission,
+ * grant evaluation, and runtime delivery cannot disagree about whether a
+ * scope is executable. */
+export declare const SESSION_SCOPE_MAX_CHARS = 256;
+export type ScopeKind = 'component' | 'command' | 'session' | 'event';
+export interface NormalizedPermissionScope {
+    kind: ScopeKind;
+    value: string;
+}
+/** Return undefined when this adapter cannot enforce the supplied scope. */
+export declare function normalizePermissionScope(permission: string, scope: string, componentId: string): NormalizedPermissionScope | undefined;
+export declare function scopeCovers(declared: NormalizedPermissionScope, actual: NormalizedPermissionScope): boolean;
+/**
+ * Permission-aware containment.  An event-point grant is the parent scope of
+ * the sessions delivered through that point, while a session grant can never
+ * be promoted into an event-point grant.  This relation is also used for
+ * denies, so a narrow `session:<id>` deny wins over a broad event grant.
+ */
+export declare function permissionScopeCovers(permission: string, declared: NormalizedPermissionScope, actual: NormalizedPermissionScope): boolean;
+export declare function rawScopeCovers(permission: string, declared: string, actual: string, componentId: string): boolean;
+//# sourceMappingURL=permission-scope.d.ts.map

package/lib/types/adapter/standard/permission-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-scope.d.ts","sourceRoot":"","sources":["../../../../src/adapter/standard/permission-scope.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAE7E,OAAO,EAEL,qBAAqB,EACrB,mCAAmC,EACnC,qBAAqB,EACtB,MAAM,+BAA+B,CAAA;AAEtC,OAAO,EAAE,qBAAqB,EAAE,mCAAmC,EAAE,qBAAqB,EAAE,CAAA;AAE5F,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB,aAE/B,CAAA;AAGD;;;0BAG0B;AAC1B,eAAO,MAAM,uBAAuB,MAAM,CAAA;AAI1C,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAA;AAErE,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,SAAS,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;CACd;AAED,4EAA4E;AAC5E,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,yBAAyB,GAAG,SAAS,CA2BvC;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,yBAAyB,EAAE,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAI3G;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,yBAAyB,EACnC,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAKT;AAED,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAMjH"}

package/lib/types/adapter/standard/permission-scope.js

@@ -0,0 +1,68 @@
+/** Permission scope normalization shared by admission and runtime checks. */
+import { EXPECTED_PERMISSIONS, INTERCEPT_PERMISSIONS, INTERCEPT_EVENT_SCOPE_BY_PERMISSION, TUI_EVENT_SCOPE_NAMES, } from '../spec/protocol-constants.js';
+export { INTERCEPT_PERMISSIONS, INTERCEPT_EVENT_SCOPE_BY_PERMISSION, TUI_EVENT_SCOPE_NAMES };
+/** Storage permission names are derived from the same vendored registry. */
+export const STORAGE_PERMISSIONS = new Set(EXPECTED_PERMISSIONS.filter(permission => permission.name.startsWith('storage.local.')).map(permission => permission.name));
+/** A session scope is carried through the message envelope and may also be
+ * used by an intercept grant. Keep the canonical bound here so admission,
+ * grant evaluation, and runtime delivery cannot disagree about whether a
+ * scope is executable. */
+export const SESSION_SCOPE_MAX_CHARS = 256;
+const CONTROL_CHARS = /[\x00-\x1f\x7f-\x9f]/u;
+/** Return undefined when this adapter cannot enforce the supplied scope. */
+export function normalizePermissionScope(permission, scope, componentId) {
+    if (typeof scope !== 'string' || scope === '')
+        return undefined;
+    if (STORAGE_PERMISSIONS.has(permission)) {
+        return scope === componentId ? { kind: 'component', value: componentId } : undefined;
+    }
+    if (permission === 'commands.invoke') {
+        return /^[a-z][a-z0-9]*(?:[.-][a-z0-9][a-z0-9-]*)+$/u.test(scope)
+            ? { kind: 'command', value: scope }
+            : undefined;
+    }
+    if (INTERCEPT_PERMISSIONS.has(permission) && TUI_EVENT_SCOPE_NAMES.has(scope)) {
+        return INTERCEPT_EVENT_SCOPE_BY_PERMISSION[permission] === scope
+            ? { kind: 'event', value: scope }
+            : undefined;
+    }
+    if (permission === 'messages.observe.read' || INTERCEPT_PERMISSIONS.has(permission)) {
+        if (scope === 'session:*')
+            return { kind: 'session', value: scope };
+        if (scope.startsWith('session:')
+            && scope.length <= SESSION_SCOPE_MAX_CHARS
+            && scope.length > 'session:'.length
+            && !scope.includes('*')
+            && !CONTROL_CHARS.test(scope)) {
+            return { kind: 'session', value: scope };
+        }
+        return undefined;
+    }
+    return undefined;
+}
+export function scopeCovers(declared, actual) {
+    if (declared.kind !== actual.kind)
+        return false;
+    return declared.value === actual.value
+        || (declared.kind === 'session' && declared.value === 'session:*' && actual.value.startsWith('session:'));
+}
+/**
+ * Permission-aware containment.  An event-point grant is the parent scope of
+ * the sessions delivered through that point, while a session grant can never
+ * be promoted into an event-point grant.  This relation is also used for
+ * denies, so a narrow `session:<id>` deny wins over a broad event grant.
+ */
+export function permissionScopeCovers(permission, declared, actual) {
+    if (scopeCovers(declared, actual))
+        return true;
+    return INTERCEPT_PERMISSIONS.has(permission)
+        && declared.kind === 'event'
+        && actual.kind === 'session';
+}
+export function rawScopeCovers(permission, declared, actual, componentId) {
+    const normalizedDeclared = normalizePermissionScope(permission, declared, componentId);
+    const normalizedActual = normalizePermissionScope(permission, actual, componentId);
+    return normalizedDeclared !== undefined
+        && normalizedActual !== undefined
+        && permissionScopeCovers(permission, normalizedDeclared, normalizedActual);
+}

package/lib/types/adapter/standard/protocols.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Canonical re-export surface for dsh-std public protocol packages.
+ *
+ * This is the only place in the new adapter where dsh-std runtime/type APIs
+ * are re-exported for the legacy adapter layer. Consumer modules that still
+ * live in `src/dsh-adapter/` during incremental migration should import from
+ * here instead of importing `@dsh-std/*` directly.
+ */
+export { parseManifest, projectManifest } from '@dsh-std/manifest';
+export { validateMessageEvent } from '@dsh-std/messages';
+export { validateDeleteInput, validateDeleteOutput, validateGetInput, validateGetOutput, validateSetInput, validateSetOutput, } from '@dsh-std/storage';
+//# sourceMappingURL=protocols.d.ts.map

package/lib/types/adapter/standard/protocols.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocols.d.ts","sourceRoot":"","sources":["../../../../src/adapter/standard/protocols.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,kBAAkB,CAAA"}

package/lib/types/adapter/standard/protocols.js

@@ -0,0 +1,11 @@
+/**
+ * Canonical re-export surface for dsh-std public protocol packages.
+ *
+ * This is the only place in the new adapter where dsh-std runtime/type APIs
+ * are re-exported for the legacy adapter layer. Consumer modules that still
+ * live in `src/dsh-adapter/` during incremental migration should import from
+ * here instead of importing `@dsh-std/*` directly.
+ */
+export { parseManifest, projectManifest } from '@dsh-std/manifest';
+export { validateMessageEvent } from '@dsh-std/messages';
+export { validateDeleteInput, validateDeleteOutput, validateGetInput, validateGetOutput, validateSetInput, validateSetOutput, } from '@dsh-std/storage';

package/lib/types/adapter/standard/registry.d.ts

@@ -0,0 +1,23 @@
+/** Load and verify the pinned dsh-TUI admission profile. */
+import type { ContractRegistry, PermissionRegistry, RegistryEntry } from './types.js';
+export declare const DSH_STD_REVISION = "614dfa1ac168db79fcf4577cf0ebb34e2e3b944b";
+export declare const ECOSYSTEM_SPEC_REVISION = "d28c267fe7fd775428ec2dccd65b0b7efd4dacee";
+export interface SpecData {
+    dir: string;
+    registry: ContractRegistry;
+    permissions: PermissionRegistry;
+    schemas: {
+        host: Record<string, unknown>;
+        ledger: Record<string, unknown>;
+        claim: Record<string, unknown>;
+    };
+}
+export declare function locateSpecDir(start?: string): string | undefined;
+export declare function loadSpecData(dir?: string | undefined): SpecData | undefined;
+export declare function registryEntries(registry: ContractRegistry): RegistryEntry[];
+export declare function digestFile(dir: string, relative: string): `sha256:${string}`;
+/** Verify definition availability and private profile digest pins. */
+export declare function verifyRegistry(data: SpecData): string[];
+/** Verify the TUI-owned definitions; public definitions live in dsh-std. */
+export declare function verifyContractProfiles(data: SpecData): string[];
+//# sourceMappingURL=registry.d.ts.map

package/lib/types/adapter/standard/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../../src/adapter/standard/registry.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAQ5D,OAAO,KAAK,EAAE,gBAAgB,EAAmB,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAEtG,eAAO,MAAM,gBAAgB,6CAA6C,CAAA;AAC1E,eAAO,MAAM,uBAAuB,6CAA6C,CAAA;AAEjF,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,WAAW,EAAE,kBAAkB,CAAA;IAC/B,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC/B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAC/B,CAAA;CACF;AASD,wBAAgB,aAAa,CAAC,KAAK,GAAE,MAAgD,GAAG,MAAM,GAAG,SAAS,CASzG;AAiFD,wBAAgB,YAAY,CAAC,GAAG,GAAE,MAAM,GAAG,SAA2B,GAAG,QAAQ,GAAG,SAAS,CAiB5F;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,gBAAgB,GAAG,aAAa,EAAE,CAI3E;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,UAAU,MAAM,EAAE,CAE5E;AAED,sEAAsE;AACtE,wBAAgB,cAAc,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,EAAE,CAuCvD;AAED,4EAA4E;AAC5E,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,EAAE,CA2C/D"}

package/lib/types/adapter/standard/registry.js

@@ -0,0 +1,240 @@
+/** Load and verify the pinned dsh-TUI admission profile. */
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { getAdmissionCatalog } from './tui-extension.js';
+import { EXPECTED_PERMISSIONS } from '../spec/protocol-constants.js';
+export const DSH_STD_REVISION = '614dfa1ac168db79fcf4577cf0ebb34e2e3b944b';
+export const ECOSYSTEM_SPEC_REVISION = 'd28c267fe7fd775428ec2dccd65b0b7efd4dacee';
+const REGISTRY_FILE = join('registry', 'registry-0.15.json');
+const EXPECTED_PROFILE_VERSION = 'tui-admission/0.15';
+const EXPECTED_STD_REPOSITORY = 'https://github.com/Yan-Zero/dsh-std';
+const EXPECTED_STD_SUBMODULE = 'vendor/dsh-std';
+const EXPECTED_STD_MANIFEST_VERSION = '0.15';
+const EXPECTED_PERMISSION_REGISTRY_VERSION = '0.1';
+export function locateSpecDir(start = dirname(fileURLToPath(import.meta.url))) {
+    let dir = start;
+    for (let index = 0; index < 8; index++) {
+        if (existsSync(join(dir, 'dsh-ecosystem-spec', REGISTRY_FILE)))
+            return join(dir, 'dsh-ecosystem-spec');
+        const parent = dirname(dir);
+        if (parent === dir)
+            return undefined;
+        dir = parent;
+    }
+    return undefined;
+}
+function loadJson(dir, relative) {
+    return JSON.parse(readFileSync(join(dir, relative), 'utf8'));
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function soundEntry(value, privateDefinition) {
+    if (!isRecord(value) || typeof value.name !== 'string' || value.name === ''
+        || (value.kind !== 'capability' && value.kind !== 'event'))
+        return false;
+    if (!isRecord(value.coordinates)
+        || typeof value.coordinates.apiVersion !== 'string' || value.coordinates.apiVersion === ''
+        || typeof value.coordinates.kind !== 'string' || value.coordinates.kind === '')
+        return false;
+    if (!Array.isArray(value.permissions) || !value.permissions.every(permission => typeof permission === 'string'))
+        return false;
+    if (privateDefinition) {
+        return value.authority === 'dsh-tui'
+            && typeof value.profile === 'string'
+            && value.profile.length > 0
+            && typeof value.profileHash === 'string'
+            && /^sha256:[0-9a-f]{64}$/u.test(value.profileHash);
+    }
+    return typeof value.package === 'string' && /^@dsh-std\/[a-z0-9][a-z0-9-]*$/u.test(value.package);
+}
+function structurallySound(data) {
+    if (!isRecord(data.registry)
+        || data.registry.profileVersion !== EXPECTED_PROFILE_VERSION
+        || !isRecord(data.registry.std)
+        || data.registry.std.repository !== EXPECTED_STD_REPOSITORY
+        || data.registry.std.submodule !== EXPECTED_STD_SUBMODULE
+        || data.registry.std.manifestVersion !== EXPECTED_STD_MANIFEST_VERSION
+        || !Array.isArray(data.registry.imports)
+        || !Array.isArray(data.registry.definitions)
+        || !Array.isArray(data.registry.facetApiVersions)
+        || data.registry.facetApiVersions.length === 0
+        || !data.registry.facetApiVersions.every(version => typeof version === 'string'
+            && /^v[0-9]+(?:alpha[0-9]+|beta[0-9]+)?$/u.test(version)))
+        return false;
+    if (new Set(data.registry.facetApiVersions).size !== data.registry.facetApiVersions.length)
+        return false;
+    if (!data.registry.imports.every(entry => soundEntry(entry, false)))
+        return false;
+    if (!data.registry.definitions.every(entry => soundEntry(entry, true)))
+        return false;
+    const entries = [...data.registry.imports, ...data.registry.definitions];
+    const names = new Set();
+    const coordinates = new Set();
+    for (const entry of entries) {
+        if (names.has(entry.name))
+            return false;
+        names.add(entry.name);
+        const key = `${entry.coordinates.apiVersion}#${entry.coordinates.kind}`;
+        if (coordinates.has(key))
+            return false;
+        coordinates.add(key);
+        if ('authority' in entry && !entry.coordinates.apiVersion.startsWith('tui.dsh/'))
+            return false;
+    }
+    if (!isRecord(data.permissions)
+        || data.permissions.registryVersion !== EXPECTED_PERMISSION_REGISTRY_VERSION
+        || !Array.isArray(data.permissions.permissions)
+        || data.permissions.permissions.length !== EXPECTED_PERMISSIONS.length)
+        return false;
+    const expectedPermissions = new Map(EXPECTED_PERMISSIONS.map(permission => [permission.name, permission]));
+    const permissionNames = new Set();
+    for (const permission of data.permissions.permissions) {
+        if (!isRecord(permission) || typeof permission.name !== 'string'
+            || (permission.default !== 'allow' && permission.default !== 'deny')
+            || typeof permission.revocable !== 'boolean'
+            || typeof permission.scope !== 'string'
+            || permission.scope.trim() === '')
+            return false;
+        if (permissionNames.has(permission.name))
+            return false;
+        permissionNames.add(permission.name);
+        const expected = expectedPermissions.get(permission.name);
+        if (expected === undefined
+            || permission.default !== expected.default
+            || permission.revocable !== expected.revocable
+            || permission.scope !== expected.scope)
+            return false;
+        if ('rationale' in permission && permission.rationale !== undefined && typeof permission.rationale !== 'string')
+            return false;
+    }
+    if (permissionNames.size !== expectedPermissions.size)
+        return false;
+    const knownPermissions = new Set(expectedPermissions.keys());
+    if (!entries.every(entry => entry.permissions.every(permission => knownPermissions.has(permission))))
+        return false;
+    return Object.values(data.schemas).every(isRecord);
+}
+export function loadSpecData(dir = locateSpecDir()) {
+    if (dir === undefined)
+        return undefined;
+    try {
+        const data = {
+            dir,
+            registry: loadJson(dir, REGISTRY_FILE),
+            permissions: loadJson(dir, join('registry', 'permissions-0.1.json')),
+            schemas: {
+                host: loadJson(dir, join('schemas', 'host-descriptor.schema.json')),
+                ledger: loadJson(dir, join('schemas', 'effect-ledger-record.schema.json')),
+                claim: loadJson(dir, join('schemas', 'conformance-claim.schema.json')),
+            },
+        };
+        return structurallySound(data) ? data : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function registryEntries(registry) {
+    return Array.isArray(registry.imports) && Array.isArray(registry.definitions)
+        ? [...registry.imports, ...registry.definitions]
+        : [];
+}
+export function digestFile(dir, relative) {
+    return `sha256:${createHash('sha256').update(readFileSync(join(dir, relative))).digest('hex')}`;
+}
+/** Verify definition availability and private profile digest pins. */
+export function verifyRegistry(data) {
+    const failures = [];
+    const registry = data?.registry;
+    if (!isRecord(registry)
+        || !Array.isArray(registry.imports)
+        || !Array.isArray(registry.definitions)) {
+        return ['registry imports/definitions are malformed'];
+    }
+    const names = new Set();
+    const coordinates = new Set();
+    const { protocols } = getAdmissionCatalog();
+    for (const raw of [...registry.imports, ...registry.definitions]) {
+        const privateDefinition = registry.definitions.includes(raw);
+        if (!soundEntry(raw, privateDefinition)) {
+            failures.push('registry entry is malformed');
+            continue;
+        }
+        const entry = raw;
+        const key = `${entry.coordinates.apiVersion}#${entry.coordinates.kind}`;
+        if (names.has(entry.name))
+            failures.push(`${entry.name}: duplicate registry name`);
+        names.add(entry.name);
+        if (coordinates.has(key))
+            failures.push(`${key}: duplicate registry coordinate`);
+        coordinates.add(key);
+        if ('authority' in entry && !entry.coordinates.apiVersion.startsWith('tui.dsh/')) {
+            failures.push(`${key}: dsh-tui definition must use the private protocol group`);
+        }
+        if (!protocols.understands(entry.coordinates))
+            failures.push(`${key}: ProtocolCatalog definition unavailable`);
+        if ('profile' in entry) {
+            let actual;
+            try {
+                actual = digestFile(data.dir, entry.profile);
+            }
+            catch {
+                failures.push(`${entry.name}: private profile unreadable (${entry.profile})`);
+                continue;
+            }
+            if (actual !== entry.profileHash)
+                failures.push(`${entry.name}: profileHash drifted (registry ${entry.profileHash}, actual ${actual})`);
+        }
+    }
+    return failures;
+}
+/** Verify the TUI-owned definitions; public definitions live in dsh-std. */
+export function verifyContractProfiles(data) {
+    const requiredKeys = [
+        'name', 'version', 'kind', 'coordinates', 'caller', 'permissions',
+        'errors', 'concurrency', 'timeout', 'cleanup', 'privacyClass', 'securityBoundary',
+    ];
+    const failures = [];
+    if (!isRecord(data?.registry)
+        || !Array.isArray(data.registry.definitions)) {
+        return ['registry definitions are malformed'];
+    }
+    for (const entry of data.registry.definitions) {
+        if (!soundEntry(entry, true)) {
+            failures.push('registry definition is malformed');
+            continue;
+        }
+        let profile;
+        try {
+            const loaded = loadJson(data.dir, entry.profile);
+            if (!isRecord(loaded)) {
+                failures.push(`${entry.name}: private profile is not an object (${entry.profile})`);
+                continue;
+            }
+            profile = loaded;
+        }
+        catch {
+            failures.push(`${entry.name}: private profile unreadable (${entry.profile})`);
+            continue;
+        }
+        for (const key of requiredKeys) {
+            if (!(key in profile))
+                failures.push(`${entry.name}: contract profile missing "${key}"`);
+        }
+        const coordinates = profile.coordinates;
+        if (coordinates?.apiVersion !== entry.coordinates.apiVersion || coordinates.kind !== entry.coordinates.kind) {
+            failures.push(`${entry.name}: profile/registry coordinates mismatch`);
+        }
+        const actualPermissions = [...(profile.permissions ?? [])].sort();
+        if (JSON.stringify(actualPermissions) !== JSON.stringify([...entry.permissions].sort())) {
+            failures.push(`${entry.name}: profile/registry permissions mismatch`);
+        }
+        if (!('operations' in profile) || profile.securityBoundary !== false) {
+            failures.push(`${entry.name}: capability boundary is incomplete`);
+        }
+    }
+    return failures;
+}

package/lib/types/adapter/standard/schema-check.d.ts

@@ -0,0 +1,17 @@
+/**
+ * 零依赖 JSON Schema 校验器——上游 `conformance/tests/run.js` 的 check()
+ * 的保真 TS 移植。刻意只实现 vendored schemas 用到的子集：本地 $ref、
+ * oneOf（恰好一个匹配）、const/enum、object（required/additionalProperties:
+ * false/patternProperties）、array（min/maxItems/items/uniqueItems）、
+ * string（min/maxLength/pattern/format uri|date-time）、integer（minimum）、
+ * boolean。遇到子集之外的构件不静默放行——schema 更新引入新构件时这里
+ * 必须显式扩展（fixtures 矩阵会当场抓住）。
+ */
+type JsonSchema = Record<string, unknown>;
+/**
+ * Validate `value` against `schema`; throws an Error with the failing path
+ * (`$.a.b[0]: reason`) on the first violation.
+ */
+export declare function check(value: unknown, schema: JsonSchema, rootSchema?: JsonSchema, where?: string): void;
+export {};
+//# sourceMappingURL=schema-check.d.ts.map

package/lib/types/adapter/standard/schema-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-check.d.ts","sourceRoot":"","sources":["../../../../src/adapter/standard/schema-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAqCzC;;;GAGG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAE,UAAmB,EAAE,KAAK,SAAM,GAAG,IAAI,CA4G5G"}