@askdkc/dsh-cli 0.11.3

package/lib/types/adapter/channel/ui.js

@@ -0,0 +1,173 @@
+/** In-process renderer capability, deliberately separate from JSON snapshots.
+ * Every returned executable handle captures the same channel lifetime. No
+ * handle can resolve a later registration or bypass policy through a factory.
+ */
+import { assertShadowPolicy } from '../kernel/runtime.js';
+import { completeCommands } from '../../commands.js';
+import { createChannelReadView } from './read-view.js';
+import { CHANNEL_UI_EFFECTS, CHANNEL_UI_PROPERTIES } from './ui-policy.js';
+function throwCleanupFailures(failures, message) {
+    if (failures.length === 1)
+        throw failures[0];
+    if (failures.length > 1)
+        throw new AggregateError(failures, message);
+}
+export function createChannelUiLease(isCurrent) {
+    let active = true;
+    const disposers = new Set();
+    return {
+        assertActive() {
+            if (!active || !isCurrent())
+                throw new Error('dsh-tui: Channel UI lifetime has ended');
+        },
+        own(dispose) {
+            let released = false;
+            const release = () => {
+                if (released)
+                    return;
+                released = true;
+                disposers.delete(release);
+                dispose();
+            };
+            if (!active || !isCurrent())
+                release();
+            else
+                disposers.add(release);
+            return release;
+        },
+        dispose() {
+            if (!active)
+                return;
+            active = false;
+            const failures = [];
+            for (const dispose of [...disposers]) {
+                try {
+                    dispose();
+                }
+                catch (error) {
+                    failures.push(error);
+                }
+            }
+            throwCleanupFailures(failures, 'dsh-tui: Channel UI cleanup failed');
+        },
+    };
+}
+/** The same factory is used by the kernel and bare production composition. */
+export function createChannelUi(channel, mode, lease) {
+    const check = (effect) => {
+        lease.assertActive();
+        assertShadowPolicy(effect, mode);
+    };
+    const read = createChannelReadView(mutation => check(mutation ? 'mutate' : 'read-only'));
+    const project = (value) => read(value, channel.version);
+    const query = (value) => createChannelReadView(mutation => check(mutation ? 'mutate' : 'read-only'))(value, 0);
+    const settle = (value) => {
+        if (value instanceof Promise)
+            return value.then(result => { check('read-only'); return query(result); });
+        return query(value);
+    };
+    function methods(target, effects) {
+        const result = {};
+        for (const key of Object.keys(effects)) {
+            const fn = target[key];
+            if (typeof fn !== 'function')
+                throw new Error(`dsh-tui: missing Channel handle method ${key}`);
+            result[key] = (...args) => {
+                check(effects[key]);
+                return settle(Reflect.apply(fn, target, args));
+            };
+        }
+        return Object.freeze(result);
+    }
+    const view = {};
+    for (const key of CHANNEL_UI_PROPERTIES) {
+        Object.defineProperty(view, key, {
+            enumerable: true,
+            get() {
+                check('read-only');
+                if (key === 'subagentControl')
+                    return methods(channel.subagentControl, { interrupt: 'mutate' });
+                if (key === 'jobControl')
+                    return channel.jobControl === undefined ? undefined : methods(channel.jobControl, { kill: 'mutate' });
+                if (key === 'autoRecapOnOpen' && (mode === 'passive-shadow' || mode === 'replay-shadow'))
+                    return false;
+                if (key === 'pluginScene') {
+                    const scene = channel.pluginScene;
+                    return scene === undefined ? undefined : project({ id: scene.id, title: scene.title });
+                }
+                return project(channel[key]);
+            },
+        });
+    }
+    for (const key of Object.keys(CHANNEL_UI_EFFECTS)) {
+        view[key] = (...args) => {
+            // Shadow probes may read the already-observed catalog/tier table, but
+            // must not warm service caches or emit query-error notifications.
+            if (mode === 'passive-shadow' || mode === 'replay-shadow') {
+                if (key === 'commandCompletions') {
+                    check('read-only');
+                    return completeCommands(String(args[0] ?? ''), channel.commandList);
+                }
+                if (key === 'listEfforts') {
+                    check('read-only');
+                    return Promise.resolve({ efforts: (channel.effortLevels ?? []).map(id => ({ id, name: id })), defaultEffort: undefined });
+                }
+            }
+            // A renderer observes the already-owned Channel emitter, never mounts
+            // upstream service listeners. Keep this local observation distinct from
+            // Host Port subscribe capabilities, whose shadow policy is unchanged.
+            const observation = key === 'subscribe' || key === 'subscribeAgentView' || key === 'subscribeSettingsSections';
+            check(observation ? 'read-only' : CHANNEL_UI_EFFECTS[key]);
+            const result = Reflect.apply(channel[key], channel, args);
+            if (key === 'notify') {
+                const timeout = args[1]?.timeoutMs ?? 4000;
+                let timer;
+                const release = lease.own(() => { if (timer !== undefined)
+                    clearTimeout(timer); result(); });
+                if (timeout > 0)
+                    timer = setTimeout(release, timeout);
+                return release;
+            }
+            if (observation)
+                return lease.own(result);
+            if (key === 'settingsHost' && result !== undefined) {
+                return methods(result, {
+                    listNamespaces: 'read-only', credentialConfigured: 'read-only', write: 'mutate', writeCredential: 'mutate',
+                });
+            }
+            if (key === 'providerSetup' && result !== undefined) {
+                const host = result;
+                const { oauth, ...base } = host;
+                return Object.freeze({
+                    ...methods(base, {
+                        listCatalogProviders: 'read-only', listConfiguredProviders: 'read-only', listRefUsers: 'read-only',
+                        routeExists: 'read-only', envShadows: 'read-only', envValue: 'mutate', readCredential: 'mutate',
+                        discoverModels: 'mutate', writeCredential: 'mutate', removeCredential: 'mutate',
+                        writeProfile: 'mutate', mutateProfile: 'mutate', removeProfile: 'mutate',
+                    }),
+                    ...(oauth === undefined ? {} : { oauth: Object.freeze({
+                            ...methods(oauth, { providers: 'read-only', login: 'mutate', logout: 'mutate' }),
+                            ...(oauth.onCredentialChange === undefined ? {} : methods({
+                                onCredentialChange: (listener) => oauth.onCredentialChange(listener),
+                            }, { onCredentialChange: 'read-only' })),
+                        }) }),
+                });
+            }
+            // The session event log is an append-only, JSON-safe read whose snapshot
+            // array is replaced by the session on every append. Running it through
+            // the detached read projection cost O(events) per call, and Chat folds
+            // the trajectory from it on EVERY render: a long session (hundreds of
+            // thousands of chunks) paid hundreds of milliseconds per frame while
+            // streaming or scrolling — measured 322us @2k events, 2.7ms @20k,
+            // 65ms @200k. The snapshot array is already frozen by the session, so
+            // hand it back as-is; the lease/shadow `check()` above still gates the
+            // call itself (same contract as before the Channel UI split).
+            if (key === 'traceEvents')
+                return result;
+            if (key === 'agentViewRows' || key === 'settingsSections')
+                return project(result);
+            return settle(result);
+        };
+    }
+    return Object.freeze(view);
+}

package/lib/types/adapter/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * TUI Adapter v2 incremental skeleton.
+ *
+ * Layering:
+ * - ports/     pure internal Host Ports (no @deepseek-ai, no dsh-std protocol)
+ * - kernel/    runtime/lifecycle/ownership/host-facade/diagnostics
+ * - upstream/  future-only home for @deepseek-ai/* drivers
+ * - standard/  canonical @dsh-std/* + TUI admission/descriptor/grants
+ * - spec/      thin dsh-ecosystem-spec / conformance loading layer
+ *
+ * Existing public subpaths and Cordis service names are unchanged during this
+ * incremental migration.
+ */
+export * from './ports/index.js';
+export * from './kernel/index.js';
+export * from './upstream/index.js';
+export * from './channel/index.js';
+export * from './standard/index.js';
+export * from './spec/index.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/types/adapter/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapter/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,iBAAiB,CAAA"}

package/lib/types/adapter/index.js

@@ -0,0 +1,19 @@
+/**
+ * TUI Adapter v2 incremental skeleton.
+ *
+ * Layering:
+ * - ports/     pure internal Host Ports (no @deepseek-ai, no dsh-std protocol)
+ * - kernel/    runtime/lifecycle/ownership/host-facade/diagnostics
+ * - upstream/  future-only home for @deepseek-ai/* drivers
+ * - standard/  canonical @dsh-std/* + TUI admission/descriptor/grants
+ * - spec/      thin dsh-ecosystem-spec / conformance loading layer
+ *
+ * Existing public subpaths and Cordis service names are unchanged during this
+ * incremental migration.
+ */
+export * from './ports/index.js';
+export * from './kernel/index.js';
+export * from './upstream/index.js';
+export * from './channel/index.js';
+export * from './standard/index.js';
+export * from './spec/index.js';

package/lib/types/adapter/kernel/contract-catalog.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Kernel-facing view of the spec-derived host contract catalog.
+ *
+ * Upstream drivers receive the concrete contract/event catalog through this
+ * Kernel module rather than importing Standard/Spec implementation files. The
+ * values are still derived once in `src/adapter/spec/protocol-constants.ts`;
+ * this module only re-exports them for the driver boundary.
+ */
+import { HOST_SUPPORTED_CONTRACTS, TUI_DECISION_EVENT_NAMES } from '../spec/protocol-constants.js';
+export { HOST_SUPPORTED_CONTRACTS as KERNEL_HOST_SUPPORTED_CONTRACTS };
+export { TUI_DECISION_EVENT_NAMES as KERNEL_TUI_DECISION_EVENT_NAMES };
+//# sourceMappingURL=contract-catalog.d.ts.map

package/lib/types/adapter/kernel/contract-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract-catalog.d.ts","sourceRoot":"","sources":["../../../../src/adapter/kernel/contract-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AAElG,OAAO,EAAE,wBAAwB,IAAI,+BAA+B,EAAE,CAAA;AACtE,OAAO,EAAE,wBAAwB,IAAI,+BAA+B,EAAE,CAAA"}

package/lib/types/adapter/kernel/contract-catalog.js

@@ -0,0 +1,11 @@
+/**
+ * Kernel-facing view of the spec-derived host contract catalog.
+ *
+ * Upstream drivers receive the concrete contract/event catalog through this
+ * Kernel module rather than importing Standard/Spec implementation files. The
+ * values are still derived once in `src/adapter/spec/protocol-constants.ts`;
+ * this module only re-exports them for the driver boundary.
+ */
+import { HOST_SUPPORTED_CONTRACTS, TUI_DECISION_EVENT_NAMES } from '../spec/protocol-constants.js';
+export { HOST_SUPPORTED_CONTRACTS as KERNEL_HOST_SUPPORTED_CONTRACTS };
+export { TUI_DECISION_EVENT_NAMES as KERNEL_TUI_DECISION_EVENT_NAMES };

package/lib/types/adapter/kernel/diagnostics.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Kernel diagnostics surface.
+ *
+ * @internal P2: a snapshot formatter consumed by `/doctor` and local
+ * diagnostics. The richer `KernelRuntime.diagnosticSnapshot()` is the
+ * canonical kernel state surface; this helper remains for the legacy
+ * /doctor line shape. It never writes, registers, subscribes or mutates host
+ * capabilities.
+ */
+import type { HostDescriptorSnapshot } from '../ports/descriptor.js';
+import type { AdapterRuntimeOptions } from './runtime.js';
+export interface AdapterDiagnostics {
+    readonly runtime: AdapterRuntimeOptions;
+    readonly descriptor: HostDescriptorSnapshot;
+    readonly permissions: readonly string[];
+}
+export declare function collectAdapterDiagnostics(runtime: AdapterRuntimeOptions, descriptor: HostDescriptorSnapshot, permissions: readonly string[]): AdapterDiagnostics;
+//# sourceMappingURL=diagnostics.d.ts.map

package/lib/types/adapter/kernel/diagnostics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.d.ts","sourceRoot":"","sources":["../../../../src/adapter/kernel/diagnostics.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AACpE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAEzD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,qBAAqB,CAAA;IACvC,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAA;IAC3C,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CACxC;AAED,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,qBAAqB,EAC9B,UAAU,EAAE,sBAAsB,EAClC,WAAW,EAAE,SAAS,MAAM,EAAE,GAC7B,kBAAkB,CAMpB"}

package/lib/types/adapter/kernel/diagnostics.js

@@ -0,0 +1,16 @@
+/**
+ * Kernel diagnostics surface.
+ *
+ * @internal P2: a snapshot formatter consumed by `/doctor` and local
+ * diagnostics. The richer `KernelRuntime.diagnosticSnapshot()` is the
+ * canonical kernel state surface; this helper remains for the legacy
+ * /doctor line shape. It never writes, registers, subscribes or mutates host
+ * capabilities.
+ */
+export function collectAdapterDiagnostics(runtime, descriptor, permissions) {
+    return Object.freeze({
+        runtime: Object.freeze({ ...runtime }),
+        descriptor,
+        permissions: Object.freeze([...permissions]),
+    });
+}

package/lib/types/adapter/kernel/driver-types.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Shared plain data types used by the Kernel and upstream driver contract.
+ *
+ * These are deliberately not Standard/Spec protocol definitions: they are the
+ * minimal coordinate/key shapes that drivers, kernel and descriptor plumbing
+ * need to agree on without upstream importing the Standard plane.
+ */
+export interface ContractCoordinate {
+    readonly apiVersion: string;
+    readonly kind: string;
+}
+export interface ContractRef extends ContractCoordinate {
+    readonly optional?: boolean;
+    readonly fallback?: string;
+}
+//# sourceMappingURL=driver-types.d.ts.map

package/lib/types/adapter/kernel/driver-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"driver-types.d.ts","sourceRoot":"","sources":["../../../../src/adapter/kernel/driver-types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,WAAY,SAAQ,kBAAkB;IACrD,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B"}

package/lib/types/adapter/kernel/driver-types.js

@@ -0,0 +1,8 @@
+/**
+ * Shared plain data types used by the Kernel and upstream driver contract.
+ *
+ * These are deliberately not Standard/Spec protocol definitions: they are the
+ * minimal coordinate/key shapes that drivers, kernel and descriptor plumbing
+ * need to agree on without upstream importing the Standard plane.
+ */
+export {};

package/lib/types/adapter/kernel/host-facade.d.ts

@@ -0,0 +1,65 @@
+/**
+ * HostFacade: thin composition / identity entry over mounted Host Ports.
+ *
+ * P2 callers normally obtain this from `KernelRuntime.facade()`, which backs
+ * the descriptor port with the unified kernel lifecycle evidence.
+ * `facadeFromLegacy` remains only as a long-term compatibility fallback for
+ * bare/test compositions (outside P6 removal scope; owner: dsh-tui adapter).
+ * Hard rules:
+ * - It performs no business logic, no protocol translation, no capability
+ *   detection, no registry, and stores no mutable host state.
+ * - It is for TUI host-internal code only. External plugins continue to use
+ *   dsh-std / dsh-ecosystem-spec public protocol surfaces.
+ * - It only exposes Host Ports; admission, permission evaluation and ledger
+ *   writes are Kernel/Standard internal services and must never be exposed
+ *   as ordinary Host Ports.
+ */
+import type { HostDescriptorPort } from '../ports/descriptor.js';
+import type { HostPresentationPort } from '../ports/presentation.js';
+import type { HostWorkspacePort } from '../ports/workspace.js';
+import type { HostScenesPort } from '../ports/scenes.js';
+import type { HostSettingsPort } from '../ports/settings.js';
+import type { HostStatusPort, HostShortcutsPort, HostRenderersPort, HostThemesPort, HostToastPort, HostCommandTreesPort } from '../ports/extensions.js';
+import type { HostDecisionsPort } from '../ports/decisions.js';
+import type { HostChannelPort } from '../ports/channel.js';
+import { type AdapterMode } from './runtime.js';
+export interface HostFacade {
+    readonly descriptor: HostDescriptorPort;
+    readonly presentation?: HostPresentationPort;
+    readonly workspace?: HostWorkspacePort;
+    readonly scenes?: HostScenesPort;
+    readonly settings?: HostSettingsPort;
+    readonly status?: HostStatusPort;
+    readonly shortcuts?: HostShortcutsPort;
+    readonly renderers?: HostRenderersPort;
+    readonly themes?: HostThemesPort;
+    readonly toast?: HostToastPort;
+    readonly commandTrees?: HostCommandTreesPort;
+    readonly decisions?: HostDecisionsPort;
+    readonly channel?: HostChannelPort;
+}
+export interface HostFacadePorts {
+    readonly descriptor: HostDescriptorPort;
+    readonly presentation?: HostPresentationPort;
+    readonly workspace?: HostWorkspacePort;
+    readonly scenes?: HostScenesPort;
+    readonly settings?: HostSettingsPort;
+    readonly status?: HostStatusPort;
+    readonly shortcuts?: HostShortcutsPort;
+    readonly renderers?: HostRenderersPort;
+    readonly themes?: HostThemesPort;
+    readonly toast?: HostToastPort;
+    readonly commandTrees?: HostCommandTreesPort;
+    readonly decisions?: HostDecisionsPort;
+    readonly channel?: HostChannelPort;
+}
+/** Build the immutable facade from already-composed slice implementations. */
+export declare function createHostFacade(ports: HostFacadePorts): HostFacade;
+/**
+ * Build a HostFacade whose descriptor and every mounted Host Port method are
+ * wrapped with the unified shadow-policy assertion. This is what the Kernel
+ * exposes to internal TUI callers: no Port method can silently perform a
+ * mutate/register/subscribe side effect in passive/replay production modes.
+ */
+export declare function createShadowGuardedHostFacade(ports: HostFacadePorts, mode: AdapterMode): HostFacade;
+//# sourceMappingURL=host-facade.d.ts.map

package/lib/types/adapter/kernel/host-facade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-facade.d.ts","sourceRoot":"","sources":["../../../../src/adapter/kernel/host-facade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAChE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AACpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,oBAAoB,EACrB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,cAAc,CAAA;AAGrB,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAA;IACvC,QAAQ,CAAC,YAAY,CAAC,EAAE,oBAAoB,CAAA;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAA;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAA;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAA;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAA;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,oBAAoB,CAAA;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAA;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAA;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAA;IACvC,QAAQ,CAAC,YAAY,CAAC,EAAE,oBAAoB,CAAA;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAA;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAA;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAA;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAA;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAA;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,oBAAoB,CAAA;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAA;IACtC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAA;CACnC;AAoJD,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,eAAe,GAAG,UAAU,CAgBnE;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,GAAG,UAAU,CA2BnG"}

package/lib/types/adapter/kernel/host-facade.js

@@ -0,0 +1,216 @@
+/**
+ * HostFacade: thin composition / identity entry over mounted Host Ports.
+ *
+ * P2 callers normally obtain this from `KernelRuntime.facade()`, which backs
+ * the descriptor port with the unified kernel lifecycle evidence.
+ * `facadeFromLegacy` remains only as a long-term compatibility fallback for
+ * bare/test compositions (outside P6 removal scope; owner: dsh-tui adapter).
+ * Hard rules:
+ * - It performs no business logic, no protocol translation, no capability
+ *   detection, no registry, and stores no mutable host state.
+ * - It is for TUI host-internal code only. External plugins continue to use
+ *   dsh-std / dsh-ecosystem-spec public protocol surfaces.
+ * - It only exposes Host Ports; admission, permission evaluation and ledger
+ *   writes are Kernel/Standard internal services and must never be exposed
+ *   as ordinary Host Ports.
+ */
+import { assertShadowPolicy, effectClassFor, } from './runtime.js';
+import { CHANNEL_PORT_METHOD_CAPABILITIES as CHANNEL_PORT_CAPABILITIES } from '../channel/features.js';
+/**
+ * Per-method shadow-policy capabilities for mounted Host Ports.
+ *
+ * Every method on a mounted Port is guarded by the Kernel effect matrix. This
+ * is the last line of defense after `KernelRuntime.mount()` has already
+ * rejected whole drivers whose mountEffectClass is not allowed in a shadow
+ * mode: even a read-only-mounted Port cannot silently execute a mutate /
+ * register / subscribe method while the runtime is passive/replay-shadow.
+ */
+const PORT_METHOD_CAPABILITIES = Object.freeze({
+    presentation: Object.freeze({
+        ask: 'host.presentation.ask',
+        approve: 'host.presentation.approve',
+        dialog: 'host.presentation.dialog',
+    }),
+    workspace: Object.freeze({
+        list: 'host.workspaces.list',
+        resolve: 'host.workspaces.resolve',
+        describe: 'host.workspaces.describe',
+        commandShell: 'host.workspaces.commandShell',
+        rename: 'host.workspaces.rename',
+        remove: 'host.workspaces.remove',
+        commands: 'host.workspaces.commands',
+        runCommand: 'host.workspaces.runCommand',
+    }),
+    scenes: Object.freeze({
+        register: 'host.scenes.register',
+        list: 'host.scenes.list',
+        open: 'host.scenes.open',
+        close: 'host.scenes.close',
+        active: 'host.scenes.active',
+        subscribe: 'host.scenes.subscribe',
+    }),
+    settings: Object.freeze({
+        register: 'host.settings.register',
+        list: 'host.settings.list',
+        section: 'host.settings.section',
+        subscribe: 'host.settings.subscribe',
+    }),
+    status: Object.freeze({
+        set: 'host.status.set',
+        snapshot: 'host.status.snapshot',
+        subscribe: 'host.status.subscribe',
+    }),
+    shortcuts: Object.freeze({
+        register: 'host.shortcuts.register',
+        list: 'host.shortcuts.list',
+        dispatch: 'host.shortcuts.dispatch',
+    }),
+    renderers: Object.freeze({
+        register: 'host.renderers.register',
+        render: 'host.renderers.render',
+    }),
+    themes: Object.freeze({
+        register: 'host.themes.register',
+        snapshot: 'host.themes.snapshot',
+        resolve: 'host.themes.resolver',
+        subscribe: 'host.themes.subscribe',
+    }),
+    toast: Object.freeze({
+        show: 'host.toast.show',
+    }),
+    commandTrees: Object.freeze({
+        register: 'host.command-trees.register',
+        children: 'host.command-trees.children',
+        descriptions: 'host.command-trees.descriptions',
+    }),
+    decisions: Object.freeze({
+        probe: 'host.decision.probe',
+        subscribe: 'host.decision.subscribe',
+    }),
+});
+function assertPortMethod(mode, capability) {
+    const effectClass = effectClassFor(capability);
+    if (effectClass === undefined) {
+        throw new Error(`dsh-tui: Host Port method has no registered effect class: ${capability}`);
+    }
+    assertShadowPolicy(effectClass, mode);
+}
+function wrapPort(port, portName, mode) {
+    const capabilities = PORT_METHOD_CAPABILITIES[portName];
+    if (capabilities === undefined) {
+        throw new Error(`dsh-tui: no shadow-policy map for Host Port "${portName}"`);
+    }
+    const wrapped = {};
+    for (const key of Object.keys(port)) {
+        const capability = capabilities[key];
+        if (capability === undefined) {
+            throw new Error(`dsh-tui: Host Port "${portName}" method "${key}" is missing from the shadow-policy map`);
+        }
+        const descriptor = Object.getOwnPropertyDescriptor(port, key);
+        if (descriptor?.get !== undefined) {
+            Object.defineProperty(wrapped, key, {
+                enumerable: true,
+                get() {
+                    assertPortMethod(mode, capability);
+                    return descriptor.get.call(port);
+                },
+            });
+        }
+        else {
+            const original = port[key];
+            if (typeof original === 'function') {
+                wrapped[key] = function (...args) {
+                    assertPortMethod(mode, capability);
+                    return Reflect.apply(original, port, args);
+                };
+            }
+            else {
+                wrapped[key] = original;
+            }
+        }
+    }
+    return Object.freeze(wrapped);
+}
+function wrapChannelPort(port, mode) {
+    const wrapped = {};
+    for (const subName of Object.keys(port)) {
+        const subPort = port[subName];
+        if (subPort === undefined)
+            continue;
+        const capabilities = CHANNEL_PORT_CAPABILITIES[subName];
+        if (capabilities === undefined) {
+            throw new Error(`dsh-tui: Host Channel sub-port "${subName}" is missing from the shadow-policy map`);
+        }
+        const subWrapped = {};
+        for (const key of Object.keys(subPort)) {
+            const capability = capabilities[key];
+            if (capability === undefined) {
+                throw new Error(`dsh-tui: Host Channel "${subName}" method "${key}" is missing from the shadow-policy map`);
+            }
+            const original = subPort[key];
+            if (typeof original === 'function') {
+                subWrapped[key] = function (...args) {
+                    assertPortMethod(mode, capability);
+                    return Reflect.apply(original, subPort, args);
+                };
+            }
+            else {
+                subWrapped[key] = original;
+            }
+        }
+        wrapped[subName] = Object.freeze(subWrapped);
+    }
+    return Object.freeze(wrapped);
+}
+/** Build the immutable facade from already-composed slice implementations. */
+export function createHostFacade(ports) {
+    return Object.freeze({
+        descriptor: ports.descriptor,
+        ...(ports.presentation === undefined ? {} : { presentation: ports.presentation }),
+        ...(ports.workspace === undefined ? {} : { workspace: ports.workspace }),
+        ...(ports.scenes === undefined ? {} : { scenes: ports.scenes }),
+        ...(ports.settings === undefined ? {} : { settings: ports.settings }),
+        ...(ports.status === undefined ? {} : { status: ports.status }),
+        ...(ports.shortcuts === undefined ? {} : { shortcuts: ports.shortcuts }),
+        ...(ports.renderers === undefined ? {} : { renderers: ports.renderers }),
+        ...(ports.themes === undefined ? {} : { themes: ports.themes }),
+        ...(ports.toast === undefined ? {} : { toast: ports.toast }),
+        ...(ports.commandTrees === undefined ? {} : { commandTrees: ports.commandTrees }),
+        ...(ports.decisions === undefined ? {} : { decisions: ports.decisions }),
+        ...(ports.channel === undefined ? {} : { channel: ports.channel }),
+    });
+}
+/**
+ * Build a HostFacade whose descriptor and every mounted Host Port method are
+ * wrapped with the unified shadow-policy assertion. This is what the Kernel
+ * exposes to internal TUI callers: no Port method can silently perform a
+ * mutate/register/subscribe side effect in passive/replay production modes.
+ */
+export function createShadowGuardedHostFacade(ports, mode) {
+    const descriptor = Object.freeze({
+        get generationId() {
+            assertShadowPolicy('read-only', mode);
+            return ports.descriptor.generationId;
+        },
+        snapshot() {
+            assertShadowPolicy('read-only', mode);
+            return ports.descriptor.snapshot();
+        },
+    });
+    const wrapped = {
+        descriptor,
+        ...(ports.presentation === undefined ? {} : { presentation: wrapPort(ports.presentation, 'presentation', mode) }),
+        ...(ports.workspace === undefined ? {} : { workspace: wrapPort(ports.workspace, 'workspace', mode) }),
+        ...(ports.scenes === undefined ? {} : { scenes: wrapPort(ports.scenes, 'scenes', mode) }),
+        ...(ports.settings === undefined ? {} : { settings: wrapPort(ports.settings, 'settings', mode) }),
+        ...(ports.status === undefined ? {} : { status: wrapPort(ports.status, 'status', mode) }),
+        ...(ports.shortcuts === undefined ? {} : { shortcuts: wrapPort(ports.shortcuts, 'shortcuts', mode) }),
+        ...(ports.renderers === undefined ? {} : { renderers: wrapPort(ports.renderers, 'renderers', mode) }),
+        ...(ports.themes === undefined ? {} : { themes: wrapPort(ports.themes, 'themes', mode) }),
+        ...(ports.toast === undefined ? {} : { toast: wrapPort(ports.toast, 'toast', mode) }),
+        ...(ports.commandTrees === undefined ? {} : { commandTrees: wrapPort(ports.commandTrees, 'commandTrees', mode) }),
+        ...(ports.decisions === undefined ? {} : { decisions: wrapPort(ports.decisions, 'decisions', mode) }),
+        ...(ports.channel === undefined ? {} : { channel: wrapChannelPort(ports.channel, mode) }),
+    };
+    return createHostFacade(wrapped);
+}