@clowder-ai/plugin-contract 0.1.0-beta.3 → 0.1.0-beta.37

package/dist/wire/grants.js

@@ -17,10 +17,10 @@ import { L0_CAPABILITIES, L1_CAPABILITIES, L2_CAPABILITIES, } from '../generated
 // ---------------------------------------------------------------------------
 /**
  * Maximum number of items in effectiveGrants.
- * Derived from the 17-value Capability enum — a plugin cannot hold
+ * Derived from the signed Capability enum — a plugin cannot hold
  * more capabilities than exist.
  */
-export const MAX_GRANT_ITEMS = 17;
+export const MAX_GRANT_ITEMS = 28;
 // ---------------------------------------------------------------------------
 // Validators
 // ---------------------------------------------------------------------------
@@ -35,7 +35,7 @@ export const VALID_CAPABILITIES = new Set([
 ]);
 /**
  * Validate that effectiveGrants:
- *   1. Does not exceed MAX_GRANT_ITEMS (17).
+ *   1. Does not exceed MAX_GRANT_ITEMS (28).
  *   2. Contains no duplicates.
  *   3. Contains only valid Capability enum members (closed-enum check).
  *

package/dist/wire/handshake-byte-bounds.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Derived compact-JSON byte bounds for the beta.8 handshake rows.
+ *
+ * This production module owns only the published summary metadata. The
+ * generic byte-proof kernel remains test-only; keeping it out of the packed
+ * artifact prevents consumers from accidentally treating a proof generator
+ * as a runtime protocol dependency. The test-only templates independently
+ * recompute these values from the same closed grammar.
+ */
+/** Encoding families used for raw UTF-8 boundary evidence. */
+export declare const HANDSHAKE_BYTE_PROOF_ENCODING_FAMILIES: readonly ["ascii", "multibyte", "escaping"];
+export type HandshakeByteProofEncodingFamily = (typeof HANDSHAKE_BYTE_PROOF_ENCODING_FAMILIES)[number];
+/** One rejected N+1 candidate measured alongside a maximum frame. */
+export interface HandshakeNPlusOneByteProof {
+    readonly leaf: string;
+    readonly encodedBytes: number;
+    readonly fitsFrame: boolean;
+}
+/** Raw UTF-8 measurement for one encoding family. */
+export interface HandshakeEncodedByteProofCase {
+    readonly family: HandshakeByteProofEncodingFamily;
+    readonly encodedBytes: number;
+    readonly fitsFrame: boolean;
+    readonly nPlusOne: readonly HandshakeNPlusOneByteProof[];
+}
+/** Published max plus the raw-family proof cases from which it is derived. */
+export interface HandshakeEncodedByteProof {
+    readonly maxEncodedBytes: number;
+    readonly cases: readonly HandshakeEncodedByteProofCase[];
+}
+/** Per-row frame maxima consumed by the public method registry. */
+export interface HandshakeRowEncodedByteBounds {
+    readonly maxEncodedRequestBytes: number;
+    readonly maxEncodedResultBytes: number;
+    readonly maxEncodedErrorBytes: number;
+}
+/** Raw proof of the largest legal broker.hello request. */
+export declare const BROKER_HELLO_REQUEST_BYTE_PROOF: HandshakeEncodedByteProof;
+/** Raw proof of the largest legal broker.hello success result. */
+export declare const BROKER_HELLO_RESULT_BYTE_PROOF: HandshakeEncodedByteProof;
+/** Raw proof of the largest legal broker.ready request. */
+export declare const BROKER_READY_REQUEST_BYTE_PROOF: HandshakeEncodedByteProof;
+/** Raw proof of the largest handshake rejection envelope. */
+export declare const HANDSHAKE_REJECTED_ERROR_BYTE_PROOF: HandshakeEncodedByteProof;
+/** broker.ready succeeds with the exact JSON-RPC result `null`. */
+export declare const BROKER_READY_MAX_ENCODED_RESULT_BYTES: number;
+export declare const BROKER_HELLO_MAX_ENCODED_REQUEST_BYTES: number;
+export declare const BROKER_HELLO_MAX_ENCODED_RESULT_BYTES: number;
+export declare const BROKER_HELLO_MAX_ENCODED_ERROR_BYTES: number;
+export declare const BROKER_READY_MAX_ENCODED_REQUEST_BYTES: number;
+export declare const BROKER_READY_MAX_ENCODED_ERROR_BYTES: number;
+/**
+ * The exact per-row summary consumed by the registry. No byte value is
+ * hand-entered in the registry; all maxima are derived above from the closed
+ * grammar and raw UTF-8 serialization.
+ */
+export declare const HANDSHAKE_ROW_ENCODED_BYTE_BOUNDS: {
+    readonly 'broker.hello': {
+        readonly maxEncodedRequestBytes: number;
+        readonly maxEncodedResultBytes: number;
+        readonly maxEncodedErrorBytes: number;
+    };
+    readonly 'broker.ready': {
+        readonly maxEncodedRequestBytes: number;
+        readonly maxEncodedResultBytes: number;
+        readonly maxEncodedErrorBytes: number;
+    };
+};
+//# sourceMappingURL=handshake-byte-bounds.d.ts.map

package/dist/wire/handshake-byte-bounds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handshake-byte-bounds.d.ts","sourceRoot":"","sources":["../../src/wire/handshake-byte-bounds.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAmBH,8DAA8D;AAC9D,eAAO,MAAM,sCAAsC,6CAIzC,CAAC;AAEX,MAAM,MAAM,gCAAgC,GAC1C,CAAC,OAAO,sCAAsC,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D,qEAAqE;AACrE,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,qDAAqD;AACrD,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,MAAM,EAAE,gCAAgC,CAAC;IAClD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,SAAS,0BAA0B,EAAE,CAAC;CAC1D;AAED,8EAA8E;AAC9E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,SAAS,6BAA6B,EAAE,CAAC;CAC1D;AAED,mEAAmE;AACnE,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAgLD,2DAA2D;AAC3D,eAAO,MAAM,+BAA+B,2BAG3C,CAAC;AAEF,kEAAkE;AAClE,eAAO,MAAM,8BAA8B,2BAG1C,CAAC;AAEF,2DAA2D;AAC3D,eAAO,MAAM,+BAA+B,2BAG3C,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,mCAAmC,2BAG/C,CAAC;AAEF,mEAAmE;AACnE,eAAO,MAAM,qCAAqC,QAGjD,CAAC;AAEF,eAAO,MAAM,sCAAsC,QACF,CAAC;AAClD,eAAO,MAAM,qCAAqC,QACF,CAAC;AACjD,eAAO,MAAM,oCAAoC,QACI,CAAC;AACtD,eAAO,MAAM,sCAAsC,QACF,CAAC;AAClD,eAAO,MAAM,oCAAoC,QACI,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;CAW6C,CAAC"}

package/dist/wire/handshake-byte-bounds.js

@@ -0,0 +1,176 @@
+/**
+ * Derived compact-JSON byte bounds for the beta.8 handshake rows.
+ *
+ * This production module owns only the published summary metadata. The
+ * generic byte-proof kernel remains test-only; keeping it out of the packed
+ * artifact prevents consumers from accidentally treating a proof generator
+ * as a runtime protocol dependency. The test-only templates independently
+ * recompute these values from the same closed grammar.
+ */
+import { MAX_FRAME_BYTES } from './constants.js';
+import { HANDSHAKE_REJECTED_CODE, HANDSHAKE_REJECTED_MESSAGE, HANDSHAKE_REJECT_REASONS, } from './errors.js';
+import { BINDING_NONCE_MAX_LENGTH, HANDSHAKE_VERSION_MAX_LENGTH, HOST_IDENTIFIER_MAX_LENGTH, PACKAGE_DIGEST_LENGTH, PLUGIN_ID_MAX_LENGTH, } from './handshake.js';
+import { MAX_GRANT_ITEMS, VALID_CAPABILITIES } from './grants.js';
+import { REQUEST_ID_MAX_LENGTH } from './request-id.js';
+import { WIRE_UINT53_MAX } from './wire-uint53.js';
+/** Encoding families used for raw UTF-8 boundary evidence. */
+export const HANDSHAKE_BYTE_PROOF_ENCODING_FAMILIES = [
+    'ascii',
+    'multibyte',
+    'escaping',
+];
+const FAMILY_CODE_POINT = {
+    ascii: 'a',
+    multibyte: '😀',
+    escaping: '\u0000',
+};
+const MAX_REQUEST_ID = 'a'.repeat(REQUEST_ID_MAX_LENGTH);
+const MAX_PACKAGE_DIGEST = `sha512-${'A'.repeat(PACKAGE_DIGEST_LENGTH - 9)}==`;
+// Vocabulary may grow without changing the frozen per-frame cardinality limit.
+const MAX_EFFECTIVE_GRANTS = [...VALID_CAPABILITIES]
+    .sort((a, b) => Buffer.byteLength(JSON.stringify(b)) - Buffer.byteLength(JSON.stringify(a)) || a.localeCompare(b))
+    .slice(0, MAX_GRANT_ITEMS);
+const MAX_HANDSHAKE_REJECT_REASON = HANDSHAKE_REJECT_REASONS.reduce((longest, value) => (value.length > longest.length ? value : longest));
+function valueFor(family, leaf, nPlusOneLeaf) {
+    const codePoint = leaf.asciiOnly ? FAMILY_CODE_POINT.ascii : FAMILY_CODE_POINT[family];
+    return codePoint.repeat(leaf.maxCodePoints + Number(leaf.id === nPlusOneLeaf));
+}
+function semverFor(nPlusOneLeaf, leaf) {
+    return `0.0.0-${'a'.repeat(HANDSHAKE_VERSION_MAX_LENGTH - 6 + Number(nPlusOneLeaf === leaf))}`;
+}
+function measureProof(leaves, frameFor) {
+    const cases = HANDSHAKE_BYTE_PROOF_ENCODING_FAMILIES.map((family) => {
+        const encodedBytes = Buffer.byteLength(JSON.stringify(frameFor(family)), 'utf8');
+        return {
+            family,
+            encodedBytes,
+            fitsFrame: encodedBytes <= MAX_FRAME_BYTES,
+            nPlusOne: leaves.map((leaf) => {
+                const nPlusOneBytes = Buffer.byteLength(JSON.stringify(frameFor(family, leaf.id)), 'utf8');
+                return {
+                    leaf: leaf.id,
+                    encodedBytes: nPlusOneBytes,
+                    fitsFrame: nPlusOneBytes <= MAX_FRAME_BYTES,
+                };
+            }),
+        };
+    });
+    return {
+        maxEncodedBytes: Math.max(...cases.map(({ encodedBytes }) => encodedBytes)),
+        cases,
+    };
+}
+const HELLO_REQUEST_LEAVES = [
+    { id: 'requestId', maxCodePoints: REQUEST_ID_MAX_LENGTH, asciiOnly: true },
+    { id: 'pluginId', maxCodePoints: PLUGIN_ID_MAX_LENGTH },
+    { id: 'contractVersion', maxCodePoints: HANDSHAKE_VERSION_MAX_LENGTH, asciiOnly: true },
+    { id: 'wireVersion', maxCodePoints: HANDSHAKE_VERSION_MAX_LENGTH, asciiOnly: true },
+];
+const HELLO_RESULT_LEAVES = [
+    { id: 'requestId', maxCodePoints: REQUEST_ID_MAX_LENGTH, asciiOnly: true },
+    { id: 'pluginId', maxCodePoints: PLUGIN_ID_MAX_LENGTH },
+    { id: 'contractVersion', maxCodePoints: HANDSHAKE_VERSION_MAX_LENGTH, asciiOnly: true },
+    { id: 'wireVersion', maxCodePoints: HANDSHAKE_VERSION_MAX_LENGTH, asciiOnly: true },
+    { id: 'pluginInstanceId', maxCodePoints: HOST_IDENTIFIER_MAX_LENGTH },
+    { id: 'brokerSessionId', maxCodePoints: HOST_IDENTIFIER_MAX_LENGTH },
+    { id: 'bindingNonce', maxCodePoints: BINDING_NONCE_MAX_LENGTH },
+];
+const READY_REQUEST_LEAVES = [
+    { id: 'requestId', maxCodePoints: REQUEST_ID_MAX_LENGTH, asciiOnly: true },
+    { id: 'bindingNonce', maxCodePoints: BINDING_NONCE_MAX_LENGTH },
+];
+const HANDSHAKE_ERROR_LEAVES = [
+    { id: 'requestId', maxCodePoints: REQUEST_ID_MAX_LENGTH, asciiOnly: true },
+];
+function helloRequestFrame(family, nPlusOneLeaf) {
+    const leaf = (entry) => valueFor(family, entry, nPlusOneLeaf);
+    return {
+        jsonrpc: '2.0',
+        id: leaf(HELLO_REQUEST_LEAVES[0]),
+        method: 'broker.hello',
+        params: {
+            meta: { deadlineUnixMs: WIRE_UINT53_MAX },
+            input: {
+                pluginId: leaf(HELLO_REQUEST_LEAVES[1]),
+                packageDigest: MAX_PACKAGE_DIGEST,
+                contractVersion: semverFor(nPlusOneLeaf, 'contractVersion'),
+                wireVersion: semverFor(nPlusOneLeaf, 'wireVersion'),
+            },
+        },
+    };
+}
+function helloResultFrame(family, nPlusOneLeaf) {
+    const leaf = (entry) => valueFor(family, entry, nPlusOneLeaf);
+    return {
+        jsonrpc: '2.0',
+        id: leaf(HELLO_RESULT_LEAVES[0]),
+        result: {
+            pluginId: leaf(HELLO_RESULT_LEAVES[1]),
+            packageDigest: MAX_PACKAGE_DIGEST,
+            contractVersion: semverFor(nPlusOneLeaf, 'contractVersion'),
+            wireVersion: semverFor(nPlusOneLeaf, 'wireVersion'),
+            pluginInstanceId: leaf(HELLO_RESULT_LEAVES[4]),
+            brokerSessionId: leaf(HELLO_RESULT_LEAVES[5]),
+            grantRevision: WIRE_UINT53_MAX,
+            effectiveGrants: MAX_EFFECTIVE_GRANTS,
+            bindingNonce: leaf(HELLO_RESULT_LEAVES[6]),
+        },
+    };
+}
+function readyRequestFrame(family, nPlusOneLeaf) {
+    const leaf = (entry) => valueFor(family, entry, nPlusOneLeaf);
+    return {
+        jsonrpc: '2.0',
+        id: leaf(READY_REQUEST_LEAVES[0]),
+        method: 'broker.ready',
+        params: {
+            meta: { deadlineUnixMs: WIRE_UINT53_MAX },
+            input: { bindingNonce: leaf(READY_REQUEST_LEAVES[1]) },
+        },
+    };
+}
+function handshakeRejectedFrame(family, nPlusOneLeaf) {
+    const requestId = valueFor(family, HANDSHAKE_ERROR_LEAVES[0], nPlusOneLeaf);
+    return {
+        jsonrpc: '2.0',
+        id: requestId,
+        error: {
+            code: HANDSHAKE_REJECTED_CODE,
+            message: HANDSHAKE_REJECTED_MESSAGE,
+            data: { reason: MAX_HANDSHAKE_REJECT_REASON },
+        },
+    };
+}
+/** Raw proof of the largest legal broker.hello request. */
+export const BROKER_HELLO_REQUEST_BYTE_PROOF = measureProof(HELLO_REQUEST_LEAVES, helloRequestFrame);
+/** Raw proof of the largest legal broker.hello success result. */
+export const BROKER_HELLO_RESULT_BYTE_PROOF = measureProof(HELLO_RESULT_LEAVES, helloResultFrame);
+/** Raw proof of the largest legal broker.ready request. */
+export const BROKER_READY_REQUEST_BYTE_PROOF = measureProof(READY_REQUEST_LEAVES, readyRequestFrame);
+/** Raw proof of the largest handshake rejection envelope. */
+export const HANDSHAKE_REJECTED_ERROR_BYTE_PROOF = measureProof(HANDSHAKE_ERROR_LEAVES, handshakeRejectedFrame);
+/** broker.ready succeeds with the exact JSON-RPC result `null`. */
+export const BROKER_READY_MAX_ENCODED_RESULT_BYTES = Buffer.byteLength(JSON.stringify({ jsonrpc: '2.0', id: MAX_REQUEST_ID, result: null }), 'utf8');
+export const BROKER_HELLO_MAX_ENCODED_REQUEST_BYTES = BROKER_HELLO_REQUEST_BYTE_PROOF.maxEncodedBytes;
+export const BROKER_HELLO_MAX_ENCODED_RESULT_BYTES = BROKER_HELLO_RESULT_BYTE_PROOF.maxEncodedBytes;
+export const BROKER_HELLO_MAX_ENCODED_ERROR_BYTES = HANDSHAKE_REJECTED_ERROR_BYTE_PROOF.maxEncodedBytes;
+export const BROKER_READY_MAX_ENCODED_REQUEST_BYTES = BROKER_READY_REQUEST_BYTE_PROOF.maxEncodedBytes;
+export const BROKER_READY_MAX_ENCODED_ERROR_BYTES = HANDSHAKE_REJECTED_ERROR_BYTE_PROOF.maxEncodedBytes;
+/**
+ * The exact per-row summary consumed by the registry. No byte value is
+ * hand-entered in the registry; all maxima are derived above from the closed
+ * grammar and raw UTF-8 serialization.
+ */
+export const HANDSHAKE_ROW_ENCODED_BYTE_BOUNDS = {
+    'broker.hello': {
+        maxEncodedRequestBytes: BROKER_HELLO_MAX_ENCODED_REQUEST_BYTES,
+        maxEncodedResultBytes: BROKER_HELLO_MAX_ENCODED_RESULT_BYTES,
+        maxEncodedErrorBytes: BROKER_HELLO_MAX_ENCODED_ERROR_BYTES,
+    },
+    'broker.ready': {
+        maxEncodedRequestBytes: BROKER_READY_MAX_ENCODED_REQUEST_BYTES,
+        maxEncodedResultBytes: BROKER_READY_MAX_ENCODED_RESULT_BYTES,
+        maxEncodedErrorBytes: BROKER_READY_MAX_ENCODED_ERROR_BYTES,
+    },
+};
+//# sourceMappingURL=handshake-byte-bounds.js.map

package/dist/wire/handshake-byte-bounds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handshake-byte-bounds.js","sourceRoot":"","sources":["../../src/wire/handshake-byte-bounds.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,0BAA0B,EAC1B,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,sCAAsC,GAAG;IACpD,OAAO;IACP,WAAW;IACX,UAAU;CACF,CAAC;AAuCX,MAAM,iBAAiB,GAAqD;IAC1E,KAAK,EAAE,GAAG;IACV,SAAS,EAAE,IAAI;IACf,QAAQ,EAAE,QAAQ;CACnB,CAAC;AAEF,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;AACzD,MAAM,kBAAkB,GAAG,UAAU,GAAG,CAAC,MAAM,CAAC,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC;AAC/E,+EAA+E;AAC/E,MAAM,oBAAoB,GAAG,CAAC,GAAG,kBAAkB,CAAC;KACjD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;KACjH,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;AAC7B,MAAM,2BAA2B,GAAG,wBAAwB,CAAC,MAAM,CACjE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CACtE,CAAC;AAEF,SAAS,QAAQ,CACf,MAAwC,EACxC,IAAiB,EACjB,YAAqB;IAErB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACvF,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,YAAY,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,SAAS,CAAC,YAAqB,EAAE,IAAwC;IAChF,OAAO,SAAS,GAAG,CAAC,MAAM,CACxB,4BAA4B,GAAG,CAAC,GAAG,MAAM,CAAC,YAAY,KAAK,IAAI,CAAC,CACjE,EAAE,CAAC;AACN,CAAC;AAED,SAAS,YAAY,CACnB,MAA8B,EAC9B,QAGW;IAEX,MAAM,KAAK,GAAG,sCAAsC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAClE,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACjF,OAAO;YACL,MAAM;YACN,YAAY;YACZ,SAAS,EAAE,YAAY,IAAI,eAAe;YAC1C,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;gBAC5B,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CACrC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EACzC,MAAM,CACP,CAAC;gBACF,OAAO;oBACL,IAAI,EAAE,IAAI,CAAC,EAAE;oBACb,YAAY,EAAE,aAAa;oBAC3B,SAAS,EAAE,aAAa,IAAI,eAAe;iBAC5C,CAAC;YACJ,CAAC,CAAC;SACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC;QAC3E,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,oBAAoB,GAAG;IAC3B,EAAE,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,qBAAqB,EAAE,SAAS,EAAE,IAAI,EAAE;IAC1E,EAAE,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,oBAAoB,EAAE;IACvD,EAAE,EAAE,EAAE,iBAAiB,EAAE,aAAa,EAAE,4BAA4B,EAAE,SAAS,EAAE,IAAI,EAAE;IACvF,EAAE,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE,4BAA4B,EAAE,SAAS,EAAE,IAAI,EAAE;CAC3E,CAAC;AAEX,MAAM,mBAAmB,GAAG;IAC1B,EAAE,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,qBAAqB,EAAE,SAAS,EAAE,IAAI,EAAE;IAC1E,EAAE,EAAE,EAAE,UAAU,EAAE,aAAa,EAAE,oBAAoB,EAAE;IACvD,EAAE,EAAE,EAAE,iBAAiB,EAAE,aAAa,EAAE,4BAA4B,EAAE,SAAS,EAAE,IAAI,EAAE;IACvF,EAAE,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE,4BAA4B,EAAE,SAAS,EAAE,IAAI,EAAE;IACnF,EAAE,EAAE,EAAE,kBAAkB,EAAE,aAAa,EAAE,0BAA0B,EAAE;IACrE,EAAE,EAAE,EAAE,iBAAiB,EAAE,aAAa,EAAE,0BAA0B,EAAE;IACpE,EAAE,EAAE,EAAE,cAAc,EAAE,aAAa,EAAE,wBAAwB,EAAE;CACvD,CAAC;AAEX,MAAM,oBAAoB,GAAG;IAC3B,EAAE,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,qBAAqB,EAAE,SAAS,EAAE,IAAI,EAAE;IAC1E,EAAE,EAAE,EAAE,cAAc,EAAE,aAAa,EAAE,wBAAwB,EAAE;CACvD,CAAC;AAEX,MAAM,sBAAsB,GAAG;IAC7B,EAAE,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,qBAAqB,EAAE,SAAS,EAAE,IAAI,EAAE;CAClE,CAAC;AAEX,SAAS,iBAAiB,CACxB,MAAwC,EACxC,YAAqB;IAErB,MAAM,IAAI,GAAG,CAAC,KAA4C,EAAE,EAAE,CAC5D,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IACxC,OAAO;QACL,OAAO,EAAE,KAAK;QACd,EAAE,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE;YACN,IAAI,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;YACzC,KAAK,EAAE;gBACL,QAAQ,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;gBACvC,aAAa,EAAE,kBAAkB;gBACjC,eAAe,EAAE,SAAS,CAAC,YAAY,EAAE,iBAAiB,CAAC;gBAC3D,WAAW,EAAE,SAAS,CAAC,YAAY,EAAE,aAAa,CAAC;aACpD;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAwC,EACxC,YAAqB;IAErB,MAAM,IAAI,GAAG,CAAC,KAA2C,EAAE,EAAE,CAC3D,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IACxC,OAAO;QACL,OAAO,EAAE,KAAK;QACd,EAAE,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,EAAE;YACN,QAAQ,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;YACtC,aAAa,EAAE,kBAAkB;YACjC,eAAe,EAAE,SAAS,CAAC,YAAY,EAAE,iBAAiB,CAAC;YAC3D,WAAW,EAAE,SAAS,CAAC,YAAY,EAAE,aAAa,CAAC;YACnD,gBAAgB,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;YAC9C,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;YAC7C,aAAa,EAAE,eAAe;YAC9B,eAAe,EAAE,oBAAoB;YACrC,YAAY,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;SAC3C;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAwC,EACxC,YAAqB;IAErB,MAAM,IAAI,GAAG,CAAC,KAA4C,EAAE,EAAE,CAC5D,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IACxC,OAAO;QACL,OAAO,EAAE,KAAK;QACd,EAAE,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE;YACN,IAAI,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;YACzC,KAAK,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,EAAE;SACvD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,MAAwC,EACxC,YAAqB;IAErB,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAC5E,OAAO;QACL,OAAO,EAAE,KAAK;QACd,EAAE,EAAE,SAAS;QACb,KAAK,EAAE;YACL,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,0BAA0B;YACnC,IAAI,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE;SAC9C;KACF,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,MAAM,CAAC,MAAM,+BAA+B,GAAG,YAAY,CACzD,oBAAoB,EACpB,iBAAiB,CAClB,CAAC;AAEF,kEAAkE;AAClE,MAAM,CAAC,MAAM,8BAA8B,GAAG,YAAY,CACxD,mBAAmB,EACnB,gBAAgB,CACjB,CAAC;AAEF,2DAA2D;AAC3D,MAAM,CAAC,MAAM,+BAA+B,GAAG,YAAY,CACzD,oBAAoB,EACpB,iBAAiB,CAClB,CAAC;AAEF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,mCAAmC,GAAG,YAAY,CAC7D,sBAAsB,EACtB,sBAAsB,CACvB,CAAC;AAEF,mEAAmE;AACnE,MAAM,CAAC,MAAM,qCAAqC,GAAG,MAAM,CAAC,UAAU,CACpE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EACpE,MAAM,CACP,CAAC;AAEF,MAAM,CAAC,MAAM,sCAAsC,GACjD,+BAA+B,CAAC,eAAe,CAAC;AAClD,MAAM,CAAC,MAAM,qCAAqC,GAChD,8BAA8B,CAAC,eAAe,CAAC;AACjD,MAAM,CAAC,MAAM,oCAAoC,GAC/C,mCAAmC,CAAC,eAAe,CAAC;AACtD,MAAM,CAAC,MAAM,sCAAsC,GACjD,+BAA+B,CAAC,eAAe,CAAC;AAClD,MAAM,CAAC,MAAM,oCAAoC,GAC/C,mCAAmC,CAAC,eAAe,CAAC;AAEtD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG;IAC/C,cAAc,EAAE;QACd,sBAAsB,EAAE,sCAAsC;QAC9D,qBAAqB,EAAE,qCAAqC;QAC5D,oBAAoB,EAAE,oCAAoC;KAC3D;IACD,cAAc,EAAE;QACd,sBAAsB,EAAE,sCAAsC;QAC9D,qBAAqB,EAAE,qCAAqC;QAC5D,oBAAoB,EAAE,oCAAoC;KAC3D;CACwF,CAAC"}

package/dist/wire/handshake.d.ts

@@ -23,6 +23,24 @@ export declare const PACKAGE_DIGEST_PATTERN: RegExp;
  * 95 chars (all ASCII) + 2 surrounding quotes = 97 bytes.
  */
 export declare const PACKAGE_DIGEST_ENCODED_BYTES: 97;
+/** H1 wire pluginId minimum length in Unicode code points. */
+export declare const PLUGIN_ID_MIN_LENGTH: 1;
+/** H1 wire pluginId maximum length in Unicode code points. */
+export declare const PLUGIN_ID_MAX_LENGTH: 256;
+/** Worst compact-JSON encoded bytes for H1 pluginId. */
+export declare const PLUGIN_ID_MAX_ENCODED_BYTES: 1538;
+/** Shared H3/H4 SemVer maximum length (the grammar is ASCII-only). */
+export declare const HANDSHAKE_VERSION_MAX_LENGTH: 256;
+/** Worst compact-JSON encoded bytes for H3/H4 version strings. */
+export declare const HANDSHAKE_VERSION_MAX_ENCODED_BYTES: 258;
+/** Exact SemVer 2.0.0 grammar copied from manifest.schema.json $defs.SemVer. */
+export declare const HANDSHAKE_SEMVER_PATTERN: RegExp;
+/** H5/H6 opaque Host-minted identifier minimum length in code points. */
+export declare const HOST_IDENTIFIER_MIN_LENGTH: 1;
+/** H5/H6 opaque Host-minted identifier maximum length in code points. */
+export declare const HOST_IDENTIFIER_MAX_LENGTH: 512;
+/** Worst compact-JSON encoded bytes for either opaque Host identifier. */
+export declare const HOST_IDENTIFIER_MAX_ENCODED_BYTES: 3074;
 /** Minimum code-point length for bindingNonce. */
 export declare const BINDING_NONCE_MIN_LENGTH: 1;
 /** Maximum code-point length for bindingNonce. */
@@ -40,13 +58,13 @@ export declare const BINDING_NONCE_MAX_ENCODED_BYTES: 3074;
  * Additional identity/instance/grant/session fields are REJECTED.
  */
 export interface CandidateHello {
-    /** RESERVED (H1) — manifest pluginId, no maximum bound declared. */
+    /** CLOSED (H1) — manifest pluginId, 1..256 Unicode code points. */
     readonly pluginId: string;
     /** CLOSED (H2) — exactly 95 chars, sha512 SRI digest. */
     readonly packageDigest: string;
-    /** RESERVED (H3) — SemVer contract version, no maximum bound declared. */
+    /** CLOSED (H3) — SemVer contract version, at most 256 ASCII characters. */
     readonly contractVersion: string;
-    /** RESERVED (H4) — wire protocol version, not yet owner-declared. */
+    /** CLOSED (H4) — SemVer wire protocol version, at most 256 ASCII characters. */
     readonly wireVersion: string;
 }
 /**
@@ -63,9 +81,9 @@ export interface SessionBinding {
     readonly contractVersion: string;
     /** Echoed from CandidateHello. */
     readonly wireVersion: string;
-    /** RESERVED (H5) — Host-minted instance id, grammar pending. */
+    /** CLOSED (H5) — Host-minted instance id, 1..512 Unicode code points. */
     readonly pluginInstanceId: string;
-    /** RESERVED (H6) — Host-minted session id, grammar pending. */
+    /** CLOSED (H6) — Host-minted session id, 1..512 Unicode code points. */
     readonly brokerSessionId: string;
     /** CLOSED (H7) — WireUInt53(0, 9_007_199_254_740_991), monotonically increasing. */
     readonly grantRevision: number;
@@ -88,7 +106,17 @@ export interface BrokerReadyParams {
  * Validate a string as a conformant sha512 SRI package digest.
  * Checks exact length (95) and pattern match.
  */
-export declare function validatePackageDigest(value: string): boolean;
+export declare function validatePackageDigest(value: unknown): value is string;
+/** Validate H1's bounded wire representation without narrowing manifest syntax. */
+export declare function validatePluginId(value: unknown): value is string;
+/** Validate H3 contractVersion. Ranges and non-SemVer values are rejected. */
+export declare function validateContractVersion(value: unknown): value is string;
+/** Validate H4 wireVersion. Compatibility negotiation is Host policy, not syntax. */
+export declare function validateWireVersion(value: unknown): value is string;
+/** Validate H5 pluginInstanceId as an opaque Host-minted bounded value. */
+export declare function validatePluginInstanceId(value: unknown): value is string;
+/** Validate H6 brokerSessionId as an opaque Host-minted bounded value. */
+export declare function validateBrokerSessionId(value: unknown): value is string;
 /**
  * Validate a string as a conformant binding nonce.
  * Checks code-point count is within [1, 512].
@@ -96,5 +124,29 @@ export declare function validatePackageDigest(value: string): boolean;
  * Note: uses spread to count code points (not .length, which counts
  * UTF-16 code units and misreports surrogate pairs).
  */
-export declare function validateBindingNonce(value: string): boolean;
+export declare function validateBindingNonce(value: unknown): value is string;
+/** Runtime key set mirror of the {@link CandidateHello} interface. */
+export declare const CANDIDATE_HELLO_KEYS: Set<string>;
+/** Runtime key set mirror of the {@link SessionBinding} interface. */
+export declare const SESSION_BINDING_KEYS: Set<string>;
+/** Runtime key set mirror of the {@link BrokerReadyParams} interface. */
+export declare const BROKER_READY_PARAMS_KEYS: Set<string>;
+/**
+ * Detect caller-supplied fields that belong exclusively to the Host's
+ * SessionBinding authority. These are a closed handshake rejection rather
+ * than an ordinary grammar error.
+ */
+export declare function hasHandshakeAuthorityInjection(value: unknown): boolean;
+/**
+ * Validate the closed plugin-to-Host CandidateHello object. It deliberately
+ * validates only grammar: the Host decides whether the candidate is allowed.
+ */
+export declare function validateCandidateHello(value: unknown): value is CandidateHello;
+/**
+ * Validate the closed Host-to-plugin SessionBinding object. Candidate echo
+ * equality and nonce-use state are peer protocol checks, not schema grammar.
+ */
+export declare function validateSessionBinding(value: unknown): value is SessionBinding;
+/** Validate the closed activation-only broker.ready input object. */
+export declare function validateBrokerReadyParams(value: unknown): value is BrokerReadyParams;
 //# sourceMappingURL=handshake.d.ts.map

package/dist/wire/handshake.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handshake.d.ts","sourceRoot":"","sources":["../../src/wire/handshake.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAMrE,qDAAqD;AACrD,eAAO,MAAM,qBAAqB,EAAG,EAAW,CAAC;AAEjD;;;GAGG;AACH,eAAO,MAAM,sBAAsB,QAAuC,CAAC;AAE3E;;;GAGG;AACH,eAAO,MAAM,4BAA4B,EAAG,EAAW,CAAC;AAMxD,kDAAkD;AAClD,eAAO,MAAM,wBAAwB,EAAG,CAAU,CAAC;AAEnD,kDAAkD;AAClD,eAAO,MAAM,wBAAwB,EAAG,GAAY,CAAC;AAErD;;;GAGG;AACH,eAAO,MAAM,+BAA+B,EAAG,IAAa,CAAC;AAM7D;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,qEAAqE;IACrE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAMD;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,kCAAkC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kCAAkC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,kCAAkC;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,kCAAkC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gEAAgE;IAChE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,+DAA+D;IAC/D,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,oFAAoF;IACpF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,sDAAsD;IACtD,QAAQ,CAAC,eAAe,EAAE,SAAS,UAAU,EAAE,CAAC;IAChD,sDAAsD;IACtD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAMD;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAMD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAG5D;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAQ3D"}
+{"version":3,"file":"handshake.d.ts","sourceRoot":"","sources":["../../src/wire/handshake.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAQrE,qDAAqD;AACrD,eAAO,MAAM,qBAAqB,EAAG,EAAW,CAAC;AAEjD;;;GAGG;AACH,eAAO,MAAM,sBAAsB,QAAuC,CAAC;AAE3E;;;GAGG;AACH,eAAO,MAAM,4BAA4B,EAAG,EAAW,CAAC;AAMxD,8DAA8D;AAC9D,eAAO,MAAM,oBAAoB,EAAG,CAAU,CAAC;AAE/C,8DAA8D;AAC9D,eAAO,MAAM,oBAAoB,EAAG,GAAY,CAAC;AAEjD,wDAAwD;AACxD,eAAO,MAAM,2BAA2B,EAAG,IAAa,CAAC;AAEzD,sEAAsE;AACtE,eAAO,MAAM,4BAA4B,EAAG,GAAY,CAAC;AAEzD,kEAAkE;AAClE,eAAO,MAAM,mCAAmC,EAAG,GAAY,CAAC;AAEhE,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,QAA6L,CAAC;AAEnO,yEAAyE;AACzE,eAAO,MAAM,0BAA0B,EAAG,CAAU,CAAC;AAErD,yEAAyE;AACzE,eAAO,MAAM,0BAA0B,EAAG,GAAY,CAAC;AAEvD,0EAA0E;AAC1E,eAAO,MAAM,iCAAiC,EAAG,IAAa,CAAC;AAM/D,kDAAkD;AAClD,eAAO,MAAM,wBAAwB,EAAG,CAAU,CAAC;AAEnD,kDAAkD;AAClD,eAAO,MAAM,wBAAwB,EAAG,GAAY,CAAC;AAErD;;;GAGG;AACH,eAAO,MAAM,+BAA+B,EAAG,IAAa,CAAC;AAM7D;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,2EAA2E;IAC3E,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,gFAAgF;IAChF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAMD;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,kCAAkC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,kCAAkC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,kCAAkC;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,kCAAkC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,wEAAwE;IACxE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,oFAAoF;IACpF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,sDAAsD;IACtD,QAAQ,CAAC,eAAe,EAAE,SAAS,UAAU,EAAE,CAAC;IAChD,sDAAsD;IACtD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAMD;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAMD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAGrE;AAUD,mFAAmF;AACnF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEhE;AAYD,8EAA8E;AAC9E,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEvE;AAED,qFAAqF;AACrF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEnE;AAED,2EAA2E;AAC3E,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAExE;AAED,0EAA0E;AAC1E,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEvE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEpE;AAQD,sEAAsE;AACtE,eAAO,MAAM,oBAAoB,aAE/B,CAAC;AACH,sEAAsE;AACtE,eAAO,MAAM,oBAAoB,aAI/B,CAAC;AACH,yEAAyE;AACzE,eAAO,MAAM,wBAAwB,aAA4B,CAAC;AAYlE;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEtE;AAOD;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAS9E;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,cAAc,CAiB9E;AAED,qEAAqE;AACrE,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAMpF"}

package/dist/wire/handshake.js

@@ -10,6 +10,8 @@
  * CandidateHello and BrokerReadyParams REJECT any additional
  * identity/instance/grant/session fields (closed surface).
  */
+import { validateEffectiveGrants } from './grants.js';
+import { isWireUInt53 } from './wire-uint53.js';
 // ---------------------------------------------------------------------------
 // Package digest constants (CLOSED — H2)
 // ---------------------------------------------------------------------------
@@ -26,6 +28,27 @@ export const PACKAGE_DIGEST_PATTERN = /^sha512-[A-Za-z0-9+/]{85}[AQgw]==$/;
  */
 export const PACKAGE_DIGEST_ENCODED_BYTES = 97;
 // ---------------------------------------------------------------------------
+// H1/H3/H4/H5/H6 closure bounds
+// ---------------------------------------------------------------------------
+/** H1 wire pluginId minimum length in Unicode code points. */
+export const PLUGIN_ID_MIN_LENGTH = 1;
+/** H1 wire pluginId maximum length in Unicode code points. */
+export const PLUGIN_ID_MAX_LENGTH = 256;
+/** Worst compact-JSON encoded bytes for H1 pluginId. */
+export const PLUGIN_ID_MAX_ENCODED_BYTES = 1538;
+/** Shared H3/H4 SemVer maximum length (the grammar is ASCII-only). */
+export const HANDSHAKE_VERSION_MAX_LENGTH = 256;
+/** Worst compact-JSON encoded bytes for H3/H4 version strings. */
+export const HANDSHAKE_VERSION_MAX_ENCODED_BYTES = 258;
+/** Exact SemVer 2.0.0 grammar copied from manifest.schema.json $defs.SemVer. */
+export const HANDSHAKE_SEMVER_PATTERN = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-(0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(\.(0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$/;
+/** H5/H6 opaque Host-minted identifier minimum length in code points. */
+export const HOST_IDENTIFIER_MIN_LENGTH = 1;
+/** H5/H6 opaque Host-minted identifier maximum length in code points. */
+export const HOST_IDENTIFIER_MAX_LENGTH = 512;
+/** Worst compact-JSON encoded bytes for either opaque Host identifier. */
+export const HOST_IDENTIFIER_MAX_ENCODED_BYTES = 3074;
+// ---------------------------------------------------------------------------
 // Binding nonce bounds (CLOSED — H9)
 // ---------------------------------------------------------------------------
 /** Minimum code-point length for bindingNonce. */
@@ -45,10 +68,46 @@ export const BINDING_NONCE_MAX_ENCODED_BYTES = 3074;
  * Checks exact length (95) and pattern match.
  */
 export function validatePackageDigest(value) {
-    if (value.length !== PACKAGE_DIGEST_LENGTH)
+    if (typeof value !== 'string' || value.length !== PACKAGE_DIGEST_LENGTH)
         return false;
     return PACKAGE_DIGEST_PATTERN.test(value);
 }
+/** Test a string's code-point length using the established H9 convention. */
+function hasCodePointLength(value, min, max) {
+    if (typeof value !== 'string' || value.length === 0)
+        return false;
+    if (value.length <= max)
+        return value.length >= min;
+    const codePointCount = [...value].length;
+    return codePointCount >= min && codePointCount <= max;
+}
+/** Validate H1's bounded wire representation without narrowing manifest syntax. */
+export function validatePluginId(value) {
+    return hasCodePointLength(value, PLUGIN_ID_MIN_LENGTH, PLUGIN_ID_MAX_LENGTH);
+}
+/** Validate an exact, bounded SemVer candidate used by H3 and H4. */
+function validateHandshakeVersion(value) {
+    return (typeof value === 'string' &&
+        value.length >= 1 &&
+        value.length <= HANDSHAKE_VERSION_MAX_LENGTH &&
+        HANDSHAKE_SEMVER_PATTERN.test(value));
+}
+/** Validate H3 contractVersion. Ranges and non-SemVer values are rejected. */
+export function validateContractVersion(value) {
+    return validateHandshakeVersion(value);
+}
+/** Validate H4 wireVersion. Compatibility negotiation is Host policy, not syntax. */
+export function validateWireVersion(value) {
+    return validateHandshakeVersion(value);
+}
+/** Validate H5 pluginInstanceId as an opaque Host-minted bounded value. */
+export function validatePluginInstanceId(value) {
+    return hasCodePointLength(value, HOST_IDENTIFIER_MIN_LENGTH, HOST_IDENTIFIER_MAX_LENGTH);
+}
+/** Validate H6 brokerSessionId as an opaque Host-minted bounded value. */
+export function validateBrokerSessionId(value) {
+    return hasCodePointLength(value, HOST_IDENTIFIER_MIN_LENGTH, HOST_IDENTIFIER_MAX_LENGTH);
+}
 /**
  * Validate a string as a conformant binding nonce.
  * Checks code-point count is within [1, 512].
@@ -57,14 +116,77 @@ export function validatePackageDigest(value) {
  * UTF-16 code units and misreports surrogate pairs).
  */
 export function validateBindingNonce(value) {
-    // Fast path: empty string
-    if (value.length === 0)
-        return false;
-    // Fast path: if byte length <= max, code-point count <= max
-    if (value.length <= BINDING_NONCE_MAX_LENGTH)
-        return true;
-    // Slow path: count actual code points for strings with surrogates
-    const codePointCount = [...value].length;
-    return codePointCount >= BINDING_NONCE_MIN_LENGTH && codePointCount <= BINDING_NONCE_MAX_LENGTH;
+    return hasCodePointLength(value, BINDING_NONCE_MIN_LENGTH, BINDING_NONCE_MAX_LENGTH);
+}
+/** Runtime key set mirror of the {@link CandidateHello} interface. */
+export const CANDIDATE_HELLO_KEYS = new Set([
+    'pluginId', 'packageDigest', 'contractVersion', 'wireVersion',
+]);
+/** Runtime key set mirror of the {@link SessionBinding} interface. */
+export const SESSION_BINDING_KEYS = new Set([
+    'pluginId', 'packageDigest', 'contractVersion', 'wireVersion',
+    'pluginInstanceId', 'brokerSessionId', 'grantRevision', 'effectiveGrants',
+    'bindingNonce',
+]);
+/** Runtime key set mirror of the {@link BrokerReadyParams} interface. */
+export const BROKER_READY_PARAMS_KEYS = new Set(['bindingNonce']);
+const HANDSHAKE_AUTHORITY_KEYS = new Set([
+    'pluginInstanceId',
+    'brokerSessionId',
+    'grantRevision',
+    'effectiveGrants',
+]);
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+/**
+ * Detect caller-supplied fields that belong exclusively to the Host's
+ * SessionBinding authority. These are a closed handshake rejection rather
+ * than an ordinary grammar error.
+ */
+export function hasHandshakeAuthorityInjection(value) {
+    return isRecord(value) && Object.keys(value).some(key => HANDSHAKE_AUTHORITY_KEYS.has(key));
+}
+function hasExactKeys(value, expected) {
+    const keys = Object.keys(value);
+    return keys.length === expected.size && keys.every(key => expected.has(key));
+}
+/**
+ * Validate the closed plugin-to-Host CandidateHello object. It deliberately
+ * validates only grammar: the Host decides whether the candidate is allowed.
+ */
+export function validateCandidateHello(value) {
+    return (isRecord(value) &&
+        hasExactKeys(value, CANDIDATE_HELLO_KEYS) &&
+        validatePluginId(value.pluginId) &&
+        validatePackageDigest(value.packageDigest) &&
+        validateContractVersion(value.contractVersion) &&
+        validateWireVersion(value.wireVersion));
+}
+/**
+ * Validate the closed Host-to-plugin SessionBinding object. Candidate echo
+ * equality and nonce-use state are peer protocol checks, not schema grammar.
+ */
+export function validateSessionBinding(value) {
+    return (isRecord(value) &&
+        hasExactKeys(value, SESSION_BINDING_KEYS) &&
+        validatePluginId(value.pluginId) &&
+        validatePackageDigest(value.packageDigest) &&
+        validateContractVersion(value.contractVersion) &&
+        validateWireVersion(value.wireVersion) &&
+        validatePluginInstanceId(value.pluginInstanceId) &&
+        validateBrokerSessionId(value.brokerSessionId) &&
+        typeof value.grantRevision === 'number' &&
+        isWireUInt53(value.grantRevision) &&
+        Array.isArray(value.effectiveGrants) &&
+        value.effectiveGrants.every(grant => typeof grant === 'string') &&
+        validateEffectiveGrants(value.effectiveGrants) &&
+        validateBindingNonce(value.bindingNonce));
+}
+/** Validate the closed activation-only broker.ready input object. */
+export function validateBrokerReadyParams(value) {
+    return (isRecord(value) &&
+        hasExactKeys(value, BROKER_READY_PARAMS_KEYS) &&
+        validateBindingNonce(value.bindingNonce));
 }
 //# sourceMappingURL=handshake.js.map

package/dist/wire/handshake.js.map

@@ -1 +1 @@
-{"version":3,"file":"handshake.js","sourceRoot":"","sources":["../../src/wire/handshake.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,8EAA8E;AAC9E,yCAAyC;AACzC,8EAA8E;AAE9E,qDAAqD;AACrD,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAW,CAAC;AAEjD;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,oCAAoC,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAW,CAAC;AAExD,8EAA8E;AAC9E,qCAAqC;AACrC,8EAA8E;AAE9E,kDAAkD;AAClD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAU,CAAC;AAEnD,kDAAkD;AAClD,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAY,CAAC;AAErD;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAa,CAAC;AAqE7D,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,qBAAqB;QAAE,OAAO,KAAK,CAAC;IACzD,OAAO,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,0BAA0B;IAC1B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,4DAA4D;IAC5D,IAAI,KAAK,CAAC,MAAM,IAAI,wBAAwB;QAAE,OAAO,IAAI,CAAC;IAC1D,kEAAkE;IAClE,MAAM,cAAc,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC;IACzC,OAAO,cAAc,IAAI,wBAAwB,IAAI,cAAc,IAAI,wBAAwB,CAAC;AAClG,CAAC"}
+{"version":3,"file":"handshake.js","sourceRoot":"","sources":["../../src/wire/handshake.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,8EAA8E;AAC9E,yCAAyC;AACzC,8EAA8E;AAE9E,qDAAqD;AACrD,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAW,CAAC;AAEjD;;;GAGG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,oCAAoC,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAW,CAAC;AAExD,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAE9E,8DAA8D;AAC9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAU,CAAC;AAE/C,8DAA8D;AAC9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAY,CAAC;AAEjD,wDAAwD;AACxD,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAa,CAAC;AAEzD,sEAAsE;AACtE,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAY,CAAC;AAEzD,kEAAkE;AAClE,MAAM,CAAC,MAAM,mCAAmC,GAAG,GAAY,CAAC;AAEhE,gFAAgF;AAChF,MAAM,CAAC,MAAM,wBAAwB,GAAG,0LAA0L,CAAC;AAEnO,yEAAyE;AACzE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAU,CAAC;AAErD,yEAAyE;AACzE,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAY,CAAC;AAEvD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,iCAAiC,GAAG,IAAa,CAAC;AAE/D,8EAA8E;AAC9E,qCAAqC;AACrC,8EAA8E;AAE9E,kDAAkD;AAClD,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAU,CAAC;AAEnD,kDAAkD;AAClD,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAY,CAAC;AAErD;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,IAAa,CAAC;AAqE7D,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,qBAAqB;QAAE,OAAO,KAAK,CAAC;IACtF,OAAO,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,6EAA6E;AAC7E,SAAS,kBAAkB,CAAC,KAAc,EAAE,GAAW,EAAE,GAAW;IAClE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC;IACpD,MAAM,cAAc,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC;IACzC,OAAO,cAAc,IAAI,GAAG,IAAI,cAAc,IAAI,GAAG,CAAC;AACxD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,kBAAkB,CAAC,KAAK,EAAE,oBAAoB,EAAE,oBAAoB,CAAC,CAAC;AAC/E,CAAC;AAED,qEAAqE;AACrE,SAAS,wBAAwB,CAAC,KAAc;IAC9C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,IAAI,CAAC;QACjB,KAAK,CAAC,MAAM,IAAI,4BAA4B;QAC5C,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CACrC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,OAAO,wBAAwB,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,OAAO,kBAAkB,CAAC,KAAK,EAAE,0BAA0B,EAAE,0BAA0B,CAAC,CAAC;AAC3F,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,OAAO,kBAAkB,CAAC,KAAK,EAAE,0BAA0B,EAAE,0BAA0B,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,OAAO,kBAAkB,CAAC,KAAK,EAAE,wBAAwB,EAAE,wBAAwB,CAAC,CAAC;AACvF,CAAC;AAQD,sEAAsE;AACtE,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IAC1C,UAAU,EAAE,eAAe,EAAE,iBAAiB,EAAE,aAAa;CAC9D,CAAC,CAAC;AACH,sEAAsE;AACtE,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IAC1C,UAAU,EAAE,eAAe,EAAE,iBAAiB,EAAE,aAAa;IAC7D,kBAAkB,EAAE,iBAAiB,EAAE,eAAe,EAAE,iBAAiB;IACzE,cAAc;CACf,CAAC,CAAC;AACH,yEAAyE;AACzE,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;AAClE,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,kBAAkB;IAClB,iBAAiB;IACjB,eAAe;IACf,iBAAiB;CAClB,CAAC,CAAC;AAEH,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC3D,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,YAAY,CAAC,KAAoB,EAAE,QAA6B;IACvE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,YAAY,CAAC,KAAK,EAAE,oBAAoB,CAAC;QACzC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC;QAChC,qBAAqB,CAAC,KAAK,CAAC,aAAa,CAAC;QAC1C,uBAAuB,CAAC,KAAK,CAAC,eAAe,CAAC;QAC9C,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,CACvC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,YAAY,CAAC,KAAK,EAAE,oBAAoB,CAAC;QACzC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC;QAChC,qBAAqB,CAAC,KAAK,CAAC,aAAa,CAAC;QAC1C,uBAAuB,CAAC,KAAK,CAAC,eAAe,CAAC;QAC9C,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC;QACtC,wBAAwB,CAAC,KAAK,CAAC,gBAAgB,CAAC;QAChD,uBAAuB,CAAC,KAAK,CAAC,eAAe,CAAC;QAC9C,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ;QACvC,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC;QACjC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC;QACpC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QAC/D,uBAAuB,CAAC,KAAK,CAAC,eAAe,CAAC;QAC9C,oBAAoB,CAAC,KAAK,CAAC,YAAY,CAAC,CACzC,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,YAAY,CAAC,KAAK,EAAE,wBAAwB,CAAC;QAC7C,oBAAoB,CAAC,KAAK,CAAC,YAAY,CAAC,CACzC,CAAC;AACJ,CAAC"}