@deepseek-harness-tui/dsh-tui 0.10.0 → 0.10.2

package/lib/types/adapter/kernel/host-facade.js

@@ -0,0 +1,215 @@
+/**
+ * HostFacade: thin composition / identity entry over mounted Host Ports.
+ *
+ * P2 callers normally obtain this from `KernelRuntime.facade()`, which backs
+ * the descriptor port with the unified kernel lifecycle evidence.
+ * `facadeFromLegacy` remains only as a long-term compatibility fallback for
+ * bare/test compositions (outside P6 removal scope; owner: dsh-tui adapter).
+ * Hard rules:
+ * - It performs no business logic, no protocol translation, no capability
+ *   detection, no registry, and stores no mutable host state.
+ * - It is for TUI host-internal code only. External plugins continue to use
+ *   dsh-std / dsh-ecosystem-spec public protocol surfaces.
+ * - It only exposes Host Ports; admission, permission evaluation and ledger
+ *   writes are Kernel/Standard internal services and must never be exposed
+ *   as ordinary Host Ports.
+ */
+import { assertShadowPolicy, effectClassFor, } from './runtime.js';
+import { CHANNEL_PORT_METHOD_CAPABILITIES as CHANNEL_PORT_CAPABILITIES } from '../channel/features.js';
+/**
+ * Per-method shadow-policy capabilities for mounted Host Ports.
+ *
+ * Every method on a mounted Port is guarded by the Kernel effect matrix. This
+ * is the last line of defense after `KernelRuntime.mount()` has already
+ * rejected whole drivers whose mountEffectClass is not allowed in a shadow
+ * mode: even a read-only-mounted Port cannot silently execute a mutate /
+ * register / subscribe method while the runtime is passive/replay-shadow.
+ */
+const PORT_METHOD_CAPABILITIES = Object.freeze({
+    presentation: Object.freeze({
+        ask: 'host.presentation.ask',
+        approve: 'host.presentation.approve',
+        dialog: 'host.presentation.dialog',
+    }),
+    workspace: Object.freeze({
+        list: 'host.workspaces.list',
+        resolve: 'host.workspaces.resolve',
+        describe: 'host.workspaces.describe',
+        commandShell: 'host.workspaces.commandShell',
+        rename: 'host.workspaces.rename',
+        commands: 'host.workspaces.commands',
+        runCommand: 'host.workspaces.runCommand',
+    }),
+    scenes: Object.freeze({
+        register: 'host.scenes.register',
+        list: 'host.scenes.list',
+        open: 'host.scenes.open',
+        close: 'host.scenes.close',
+        active: 'host.scenes.active',
+        subscribe: 'host.scenes.subscribe',
+    }),
+    settings: Object.freeze({
+        register: 'host.settings.register',
+        list: 'host.settings.list',
+        section: 'host.settings.section',
+        subscribe: 'host.settings.subscribe',
+    }),
+    status: Object.freeze({
+        set: 'host.status.set',
+        snapshot: 'host.status.snapshot',
+        subscribe: 'host.status.subscribe',
+    }),
+    shortcuts: Object.freeze({
+        register: 'host.shortcuts.register',
+        list: 'host.shortcuts.list',
+        dispatch: 'host.shortcuts.dispatch',
+    }),
+    renderers: Object.freeze({
+        register: 'host.renderers.register',
+        render: 'host.renderers.render',
+    }),
+    themes: Object.freeze({
+        register: 'host.themes.register',
+        snapshot: 'host.themes.snapshot',
+        resolve: 'host.themes.resolver',
+        subscribe: 'host.themes.subscribe',
+    }),
+    toast: Object.freeze({
+        show: 'host.toast.show',
+    }),
+    commandTrees: Object.freeze({
+        register: 'host.command-trees.register',
+        children: 'host.command-trees.children',
+        descriptions: 'host.command-trees.descriptions',
+    }),
+    decisions: Object.freeze({
+        probe: 'host.decision.probe',
+        subscribe: 'host.decision.subscribe',
+    }),
+});
+function assertPortMethod(mode, capability) {
+    const effectClass = effectClassFor(capability);
+    if (effectClass === undefined) {
+        throw new Error(`dsh-tui: Host Port method has no registered effect class: ${capability}`);
+    }
+    assertShadowPolicy(effectClass, mode);
+}
+function wrapPort(port, portName, mode) {
+    const capabilities = PORT_METHOD_CAPABILITIES[portName];
+    if (capabilities === undefined) {
+        throw new Error(`dsh-tui: no shadow-policy map for Host Port "${portName}"`);
+    }
+    const wrapped = {};
+    for (const key of Object.keys(port)) {
+        const capability = capabilities[key];
+        if (capability === undefined) {
+            throw new Error(`dsh-tui: Host Port "${portName}" method "${key}" is missing from the shadow-policy map`);
+        }
+        const descriptor = Object.getOwnPropertyDescriptor(port, key);
+        if (descriptor?.get !== undefined) {
+            Object.defineProperty(wrapped, key, {
+                enumerable: true,
+                get() {
+                    assertPortMethod(mode, capability);
+                    return descriptor.get.call(port);
+                },
+            });
+        }
+        else {
+            const original = port[key];
+            if (typeof original === 'function') {
+                wrapped[key] = function (...args) {
+                    assertPortMethod(mode, capability);
+                    return Reflect.apply(original, port, args);
+                };
+            }
+            else {
+                wrapped[key] = original;
+            }
+        }
+    }
+    return Object.freeze(wrapped);
+}
+function wrapChannelPort(port, mode) {
+    const wrapped = {};
+    for (const subName of Object.keys(port)) {
+        const subPort = port[subName];
+        if (subPort === undefined)
+            continue;
+        const capabilities = CHANNEL_PORT_CAPABILITIES[subName];
+        if (capabilities === undefined) {
+            throw new Error(`dsh-tui: Host Channel sub-port "${subName}" is missing from the shadow-policy map`);
+        }
+        const subWrapped = {};
+        for (const key of Object.keys(subPort)) {
+            const capability = capabilities[key];
+            if (capability === undefined) {
+                throw new Error(`dsh-tui: Host Channel "${subName}" method "${key}" is missing from the shadow-policy map`);
+            }
+            const original = subPort[key];
+            if (typeof original === 'function') {
+                subWrapped[key] = function (...args) {
+                    assertPortMethod(mode, capability);
+                    return Reflect.apply(original, subPort, args);
+                };
+            }
+            else {
+                subWrapped[key] = original;
+            }
+        }
+        wrapped[subName] = Object.freeze(subWrapped);
+    }
+    return Object.freeze(wrapped);
+}
+/** Build the immutable facade from already-composed slice implementations. */
+export function createHostFacade(ports) {
+    return Object.freeze({
+        descriptor: ports.descriptor,
+        ...(ports.presentation === undefined ? {} : { presentation: ports.presentation }),
+        ...(ports.workspace === undefined ? {} : { workspace: ports.workspace }),
+        ...(ports.scenes === undefined ? {} : { scenes: ports.scenes }),
+        ...(ports.settings === undefined ? {} : { settings: ports.settings }),
+        ...(ports.status === undefined ? {} : { status: ports.status }),
+        ...(ports.shortcuts === undefined ? {} : { shortcuts: ports.shortcuts }),
+        ...(ports.renderers === undefined ? {} : { renderers: ports.renderers }),
+        ...(ports.themes === undefined ? {} : { themes: ports.themes }),
+        ...(ports.toast === undefined ? {} : { toast: ports.toast }),
+        ...(ports.commandTrees === undefined ? {} : { commandTrees: ports.commandTrees }),
+        ...(ports.decisions === undefined ? {} : { decisions: ports.decisions }),
+        ...(ports.channel === undefined ? {} : { channel: ports.channel }),
+    });
+}
+/**
+ * Build a HostFacade whose descriptor and every mounted Host Port method are
+ * wrapped with the unified shadow-policy assertion. This is what the Kernel
+ * exposes to internal TUI callers: no Port method can silently perform a
+ * mutate/register/subscribe side effect in passive/replay production modes.
+ */
+export function createShadowGuardedHostFacade(ports, mode) {
+    const descriptor = Object.freeze({
+        get generationId() {
+            assertShadowPolicy('read-only', mode);
+            return ports.descriptor.generationId;
+        },
+        snapshot() {
+            assertShadowPolicy('read-only', mode);
+            return ports.descriptor.snapshot();
+        },
+    });
+    const wrapped = {
+        descriptor,
+        ...(ports.presentation === undefined ? {} : { presentation: wrapPort(ports.presentation, 'presentation', mode) }),
+        ...(ports.workspace === undefined ? {} : { workspace: wrapPort(ports.workspace, 'workspace', mode) }),
+        ...(ports.scenes === undefined ? {} : { scenes: wrapPort(ports.scenes, 'scenes', mode) }),
+        ...(ports.settings === undefined ? {} : { settings: wrapPort(ports.settings, 'settings', mode) }),
+        ...(ports.status === undefined ? {} : { status: wrapPort(ports.status, 'status', mode) }),
+        ...(ports.shortcuts === undefined ? {} : { shortcuts: wrapPort(ports.shortcuts, 'shortcuts', mode) }),
+        ...(ports.renderers === undefined ? {} : { renderers: wrapPort(ports.renderers, 'renderers', mode) }),
+        ...(ports.themes === undefined ? {} : { themes: wrapPort(ports.themes, 'themes', mode) }),
+        ...(ports.toast === undefined ? {} : { toast: wrapPort(ports.toast, 'toast', mode) }),
+        ...(ports.commandTrees === undefined ? {} : { commandTrees: wrapPort(ports.commandTrees, 'commandTrees', mode) }),
+        ...(ports.decisions === undefined ? {} : { decisions: wrapPort(ports.decisions, 'decisions', mode) }),
+        ...(ports.channel === undefined ? {} : { channel: wrapChannelPort(ports.channel, mode) }),
+    };
+    return createHostFacade(wrapped);
+}

package/lib/types/adapter/kernel/host-probe-access.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Host-only live-probe access.
+ *
+ * The reversible live probes used by the Kernel's driver are deliberately not
+ * methods on the plugin-visible Cordis services. A plugin can obtain
+ * `ctx.tuiPluginStorage`, `ctx.tuiMessageObserver` or `ctx.tuiPluginHost` and
+ * call ordinary public methods, but it cannot discover a `probeReversible`
+ * method from the normal package export surface.
+ *
+ * IMPORTANT trust boundary:
+ *
+ * This module is NOT a security boundary. dsh-TUI's plugin model is
+ * trusted-in-process; any code running in the same process can locate the
+ * package root through `package.json` and absolutely import the compiled
+ * internal file (for example `lib/adapter/kernel/host-probe-access.js`).
+ * The package `exports` map blocks ordinary deep imports, but it cannot stop
+ * same-process absolute-path loading. The host-only token and registration
+ * functions therefore exist to prevent accidental public-API pollution and
+ * obvious misuse, not to defend against a malicious in-process plugin.
+ *
+ * Hardening choices:
+ * - `HOST_PROBE_TOKEN` is a module-local symbol and is NOT exported from this
+ *   module or from any package public entry.
+ * - The registration functions refuse to replace an existing host runner on a
+ *   concrete service, so an in-process caller cannot overwrite the real probe
+ *   with a fake one after the host has bootstrapped.
+ * - The run functions accept an optional token only for backwards-compatible
+ *   calling conventions; when no token is supplied they still execute the
+ *   registered host runner. They are internal module functions, not package
+ *   public API.
+ */
+export interface CommandLiveProbeResult {
+    readonly ok: true;
+    readonly name: string;
+    readonly lifecycleAppends: number;
+}
+export interface StorageLiveProbeResult {
+    readonly service: 'tuiPluginStorage';
+    readonly ok: true;
+    readonly operations: readonly string[];
+    readonly tempNamespace: string;
+}
+export interface MessageLiveProbeResult {
+    readonly service: 'tuiMessageObserver';
+    readonly ok: true;
+    readonly before: number;
+    readonly during: number;
+    readonly after: number;
+    readonly delivered: number;
+}
+type CommandRunner = (token?: unknown) => Promise<CommandLiveProbeResult>;
+type StorageRunner = (token?: unknown) => Promise<StorageLiveProbeResult>;
+type MessageRunner = (token?: unknown) => Promise<MessageLiveProbeResult>;
+/**
+ * Register a live-probe runner for a concrete host service.
+ *
+ * If a runner is already registered for the same unwrapped service, the call
+ * is a no-op: the host bootstrap owns the WeakMap slot and an in-process
+ * caller must not be able to replace a real probe with a forged runner.
+ */
+export declare function registerCommandLiveProbe(service: object, runner: CommandRunner): void;
+export declare function registerStorageLiveProbe(service: object, runner: StorageRunner): void;
+export declare function registerMessageLiveProbe(service: object, runner: MessageRunner): void;
+export declare function hasCommandLiveProbe(service: unknown): boolean;
+export declare function hasStorageLiveProbe(service: unknown): boolean;
+export declare function hasMessageLiveProbe(service: unknown): boolean;
+export declare function runCommandLiveProbe(service: unknown, token?: unknown): Promise<CommandLiveProbeResult>;
+export declare function runStorageLiveProbe(service: unknown, token?: unknown): Promise<StorageLiveProbeResult>;
+export declare function runMessageLiveProbe(service: unknown, token?: unknown): Promise<MessageLiveProbeResult>;
+export {};
+//# sourceMappingURL=host-probe-access.d.ts.map

package/lib/types/adapter/kernel/host-probe-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-probe-access.d.ts","sourceRoot":"","sources":["../../../../src/adapter/kernel/host-probe-access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAKH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;IACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;CAClC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAA;IACpC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;IACjB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;IACtC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;IACjB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAuBD,KAAK,aAAa,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAA;AACzE,KAAK,aAAa,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAA;AACzE,KAAK,aAAa,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAA;AAMzE;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,IAAI,CAGrF;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,IAAI,CAGrF;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,IAAI,CAGrF;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAG7D;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAG7D;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAG7D;AAQD,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAM5G;AAED,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAM5G;AAED,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAM5G"}

package/lib/types/adapter/kernel/host-probe-access.js

@@ -0,0 +1,121 @@
+/**
+ * Host-only live-probe access.
+ *
+ * The reversible live probes used by the Kernel's driver are deliberately not
+ * methods on the plugin-visible Cordis services. A plugin can obtain
+ * `ctx.tuiPluginStorage`, `ctx.tuiMessageObserver` or `ctx.tuiPluginHost` and
+ * call ordinary public methods, but it cannot discover a `probeReversible`
+ * method from the normal package export surface.
+ *
+ * IMPORTANT trust boundary:
+ *
+ * This module is NOT a security boundary. dsh-TUI's plugin model is
+ * trusted-in-process; any code running in the same process can locate the
+ * package root through `package.json` and absolutely import the compiled
+ * internal file (for example `lib/adapter/kernel/host-probe-access.js`).
+ * The package `exports` map blocks ordinary deep imports, but it cannot stop
+ * same-process absolute-path loading. The host-only token and registration
+ * functions therefore exist to prevent accidental public-API pollution and
+ * obvious misuse, not to defend against a malicious in-process plugin.
+ *
+ * Hardening choices:
+ * - `HOST_PROBE_TOKEN` is a module-local symbol and is NOT exported from this
+ *   module or from any package public entry.
+ * - The registration functions refuse to replace an existing host runner on a
+ *   concrete service, so an in-process caller cannot overwrite the real probe
+ *   with a fake one after the host has bootstrapped.
+ * - The run functions accept an optional token only for backwards-compatible
+ *   calling conventions; when no token is supplied they still execute the
+ *   registered host runner. They are internal module functions, not package
+ *   public API.
+ */
+/** Opaque host-only token. Module-local; deliberately not exported. */
+const HOST_PROBE_TOKEN = Symbol('dsh-tui.host-probe-token');
+/** The Cordis traceable-proxy unwrap marker used by the host-access module. */
+const CORDIS_ORIGINAL = Symbol.for('cordis.original');
+function unwrapService(service) {
+    if (service === null || typeof service !== 'object')
+        return undefined;
+    let current = service;
+    const seen = new WeakSet();
+    while (!seen.has(current)) {
+        seen.add(current);
+        let original;
+        try {
+            original = Reflect.get(current, CORDIS_ORIGINAL);
+        }
+        catch {
+            break;
+        }
+        if (original === null || typeof original !== 'object' || original === current)
+            break;
+        current = original;
+    }
+    return current;
+}
+const commandRunners = new WeakMap();
+const storageRunners = new WeakMap();
+const messageRunners = new WeakMap();
+/**
+ * Register a live-probe runner for a concrete host service.
+ *
+ * If a runner is already registered for the same unwrapped service, the call
+ * is a no-op: the host bootstrap owns the WeakMap slot and an in-process
+ * caller must not be able to replace a real probe with a forged runner.
+ */
+export function registerCommandLiveProbe(service, runner) {
+    const key = unwrapService(service) ?? service;
+    if (!commandRunners.has(key))
+        commandRunners.set(key, runner);
+}
+export function registerStorageLiveProbe(service, runner) {
+    const key = unwrapService(service) ?? service;
+    if (!storageRunners.has(key))
+        storageRunners.set(key, runner);
+}
+export function registerMessageLiveProbe(service, runner) {
+    const key = unwrapService(service) ?? service;
+    if (!messageRunners.has(key))
+        messageRunners.set(key, runner);
+}
+export function hasCommandLiveProbe(service) {
+    const key = unwrapService(service);
+    return key !== undefined && commandRunners.has(key);
+}
+export function hasStorageLiveProbe(service) {
+    const key = unwrapService(service);
+    return key !== undefined && storageRunners.has(key);
+}
+export function hasMessageLiveProbe(service) {
+    const key = unwrapService(service);
+    return key !== undefined && messageRunners.has(key);
+}
+function assertOptionalHostToken(token) {
+    if (token !== undefined && token !== HOST_PROBE_TOKEN) {
+        throw new Error('dsh-tui: host-only live probe access denied');
+    }
+}
+export async function runCommandLiveProbe(service, token) {
+    assertOptionalHostToken(token);
+    const key = unwrapService(service);
+    const runner = key === undefined ? undefined : commandRunners.get(key);
+    if (runner === undefined)
+        throw new Error('dsh-tui: host command live probe accessor is not registered');
+    return runner(token);
+}
+export async function runStorageLiveProbe(service, token) {
+    assertOptionalHostToken(token);
+    const key = unwrapService(service);
+    const runner = key === undefined ? undefined : storageRunners.get(key);
+    if (runner === undefined)
+        throw new Error('dsh-tui: host storage live probe accessor is not registered');
+    return runner(token);
+}
+export async function runMessageLiveProbe(service, token) {
+    assertOptionalHostToken(token);
+    const key = unwrapService(service);
+    const runner = key === undefined ? undefined : messageRunners.get(key);
+    if (runner === undefined)
+        throw new Error('dsh-tui: host message live probe accessor is not registered');
+    return runner(token);
+}

package/lib/types/adapter/kernel/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Adapter Kernel.
+ *
+ * P1 provided the read-only skeleton. P2 adds:
+ * - a minimal real `KernelRuntime` (driver registration/mount, detection,
+ *   declared → staged → live, diagnostics);
+ * - reversible live probes for Command / LocalStorage / MessageObserver;
+ * - passive/replay harness support in `replay.ts`.
+ * P3 adds per-capability kernel slices and mounted Host Ports.
+ */
+export * from './runtime.js';
+export * from './lifecycle.js';
+export * from './host-facade.js';
+export * from './kernel-runtime.js';
+export * from './diagnostics.js';
+export * from './ledger.js';
+export * from './legacy-facade.js';
+export * from './replay.js';
+export * from './slices/index.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/types/adapter/kernel/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/adapter/kernel/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,cAAc,cAAc,CAAA;AAC5B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA;AAC3B,cAAc,oBAAoB,CAAA;AAClC,cAAc,aAAa,CAAA;AAC3B,cAAc,mBAAmB,CAAA"}

package/lib/types/adapter/kernel/index.js

@@ -0,0 +1,19 @@
+/**
+ * Adapter Kernel.
+ *
+ * P1 provided the read-only skeleton. P2 adds:
+ * - a minimal real `KernelRuntime` (driver registration/mount, detection,
+ *   declared → staged → live, diagnostics);
+ * - reversible live probes for Command / LocalStorage / MessageObserver;
+ * - passive/replay harness support in `replay.ts`.
+ * P3 adds per-capability kernel slices and mounted Host Ports.
+ */
+export * from './runtime.js';
+export * from './lifecycle.js';
+export * from './host-facade.js';
+export * from './kernel-runtime.js';
+export * from './diagnostics.js';
+export * from './ledger.js';
+export * from './legacy-facade.js';
+export * from './replay.js';
+export * from './slices/index.js';

package/lib/types/adapter/kernel/kernel-runtime.d.ts

@@ -0,0 +1,138 @@
+/**
+ * Minimal real Adapter Kernel runtime (P2).
+ *
+ * Responsibility:
+ * - register/mount upstream driver objects,
+ * - run structured detection and the `declared → staged → live` lifecycle,
+ * - run reversible live verification outside passive/replay production modes,
+ * - keep a unified evidence snapshot used by Host Descriptor / HostFacade /
+ *   diagnostics,
+ * - support passive-shadow (read-only detect only) and replay-shadow
+ *   (isolated mock/replay contexts; the harness calls refresh with
+ *   `allowReplay` on mock data only).
+ *
+ * This is intentionally small: business translation, protocol semantics and
+ * plugin admission remain in upstream/standard layers. The Kernel only owns
+ * composition, lifecycle promotion and diagnostics.
+ */
+import type { HostDescriptorPort, HostDescriptorSnapshot } from '../ports/descriptor.js';
+import type { CapabilityLifecycle } from './lifecycle.js';
+import { type AdapterMode } from './runtime.js';
+import type { UpstreamDriver } from '../upstream/driver.js';
+import type { Detection } from '../upstream/detection.js';
+import type { HostDescriptorBuild } from '../standard/descriptor.js';
+import { type HostFacade } from './host-facade.js';
+import type { KernelSlice } from './slices/types.js';
+export interface KernelRuntimeOptions {
+    readonly context: unknown;
+    readonly mode: AdapterMode;
+    readonly slices?: readonly string[];
+    readonly generationId: string;
+    readonly drivers?: readonly UpstreamDriver[];
+    /** P3 vertical slice definitions. Their drivers are mounted in addition to
+     * any explicit `drivers` and their mounted Ports are exposed by facade(). */
+    readonly kernelSlices?: readonly KernelSlice[];
+    readonly hostId?: string;
+    readonly hostVersion?: string;
+    readonly headless?: boolean;
+    /** Freshness window for live lifecycle evidence, in milliseconds. */
+    readonly refreshTtlMs?: number;
+}
+/** Real ports handed to mounted upstream drivers. Drivers may consume the
+ * read-only descriptor port; mutation/authorization stays in Kernel/Standard. */
+export interface KernelRuntimeDriverPorts {
+    readonly descriptor: HostDescriptorPort;
+}
+export interface KernelDriverDiagnostic {
+    readonly id: string;
+    readonly capability: string;
+    readonly mounted: boolean;
+    readonly portMounted: boolean;
+}
+export interface KernelDiagnosticSnapshot {
+    readonly mode: AdapterMode;
+    readonly generationId: string;
+    readonly lifecycles: readonly CapabilityLifecycle[];
+    readonly drivers: readonly KernelDriverDiagnostic[];
+    readonly detections: readonly {
+        readonly id: string;
+        readonly detection: Detection;
+    }[];
+    readonly descriptor: HostDescriptorSnapshot;
+    readonly lastRefresh: 'pending' | 'completed' | 'failed' | 'skipped';
+    readonly refreshError?: string;
+}
+export interface KernelRefreshOptions {
+    /** Allow reversible live verification while mode is replay-shadow. This is
+     * only safe on an isolated replay/mock context, not on a real host. */
+    readonly allowReplay?: boolean;
+}
+export declare class KernelRuntime {
+    readonly mode: AdapterMode;
+    readonly generationId: string;
+    private readonly context;
+    private readonly drivers;
+    private readonly kernelSlices;
+    private readonly slices;
+    private readonly hostId;
+    private readonly hostVersion;
+    private readonly headless;
+    private lifecycles;
+    private descriptorCache;
+    private readonly mountDisposers;
+    private readonly mountedPorts;
+    private readonly mountedDriverIds;
+    private readonly driverDetections;
+    private readonly liveVerifiedAt;
+    private readonly lastVerifiedLifecycles;
+    private readonly refreshTtlMs;
+    private lastRefreshAt;
+    private refreshState;
+    private refreshError;
+    private refreshTimer;
+    private refreshInFlight;
+    private refreshRerunRequested;
+    private mountPromise;
+    private unsubscribeChannelListener;
+    private disposed;
+    constructor(options: KernelRuntimeOptions);
+    /** Synchronous detection: never performs reversible/side-effectful probes.
+     * It consumes each driver's structured `detect()` for diagnostics and, for
+     * drivers with a lifecycle projection, builds the publication evidence. */
+    detect(): readonly CapabilityLifecycle[];
+    private hasFreshVerification;
+    private preserveFreshVerifiedLifecycles;
+    private lifecycleKey;
+    private replaceLifecycles;
+    private sameCriticalMethodEvidence;
+    /**
+     * Run reversible live verification.
+     *
+     * In passive-shadow production mode this is skipped (read-only only). In
+     * replay-shadow production mode this is also skipped unless the caller
+     * explicitly passes `allowReplay: true` for an isolated replay/mock context.
+     */
+    refresh(options?: KernelRefreshOptions): Promise<readonly CapabilityLifecycle[]>;
+    private refreshInternal;
+    currentLifecycles(): readonly CapabilityLifecycle[];
+    /** Whether async live verification has completed successfully. */
+    isRefreshCompleted(): boolean;
+    /** Diagnostic refresh state. */
+    refreshStatus(): 'pending' | 'completed' | 'failed' | 'skipped';
+    descriptorBuild(): HostDescriptorBuild;
+    descriptorPort(): HostDescriptorPort;
+    /** The internal thin HostFacade backed by this Kernel runtime's snapshot. */
+    facade(): HostFacade;
+    diagnosticSnapshot(): KernelDiagnosticSnapshot;
+    /** Mount all drivers that have not been mounted yet. */
+    mount(): Promise<void>;
+    private mountInternal;
+    private rollbackNewMounts;
+    private needsAutoRefresh;
+    private startAutoRefreshTimer;
+    dispose(): void;
+    private invalidateDescriptor;
+}
+/** Convenience constructor. */
+export declare function createKernelRuntime(options: KernelRuntimeOptions): KernelRuntime;
+//# sourceMappingURL=kernel-runtime.d.ts.map

package/lib/types/adapter/kernel/kernel-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kernel-runtime.d.ts","sourceRoot":"","sources":["../../../../src/adapter/kernel/kernel-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AACxF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAGzD,OAAO,EAAsE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAA;AACnH,OAAO,KAAK,EAAE,cAAc,EAAuB,MAAM,uBAAuB,CAAA;AAChF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAA;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAEpE,OAAO,EAAiC,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACjF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAGpD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;IAC5C;iFAC6E;IAC7E,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,WAAW,EAAE,CAAA;IAC9C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B,qEAAqE;IACrE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED;iFACiF;AACjF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAA;CACxC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,SAAS,mBAAmB,EAAE,CAAA;IACnD,QAAQ,CAAC,OAAO,EAAE,SAAS,sBAAsB,EAAE,CAAA;IACnD,QAAQ,CAAC,UAAU,EAAE,SAAS;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;KAAE,EAAE,CAAA;IACtF,QAAQ,CAAC,UAAU,EAAE,sBAAsB,CAAA;IAC3C,QAAQ,CAAC,WAAW,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAA;IACpE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC;2EACuE;IACvE,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAC/B;AASD,qBAAa,aAAa;IACxB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA2B;IACnD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoC;IACjE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA+B;IACtD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoB;IAChD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C,OAAO,CAAC,UAAU,CAAgC;IAClD,OAAO,CAAC,eAAe,CAAiC;IACxD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAyC;IACxE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAuD;IACpF,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAoB;IACrD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA+B;IAChE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA4B;IAC3D,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAoD;IAC3F,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAQ;IACrC,OAAO,CAAC,aAAa,CAAoB;IACzC,OAAO,CAAC,YAAY,CAA4D;IAChF,OAAO,CAAC,YAAY,CAAoB;IACxC,OAAO,CAAC,YAAY,CAA2C;IAC/D,OAAO,CAAC,eAAe,CAAqD;IAC5E,OAAO,CAAC,qBAAqB,CAAQ;IACrC,OAAO,CAAC,YAAY,CAA2B;IAC/C,OAAO,CAAC,0BAA0B,CAA0B;IAC5D,OAAO,CAAC,QAAQ,CAAQ;gBAEZ,OAAO,EAAE,oBAAoB;IAoCzC;;+EAE2E;IAC3E,MAAM,IAAI,SAAS,mBAAmB,EAAE;IA8CxC,OAAO,CAAC,oBAAoB;IAO5B,OAAO,CAAC,+BAA+B;IAsBvC,OAAO,CAAC,YAAY;IAcpB,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,0BAA0B;IAelC;;;;;;OAMG;IACG,OAAO,CAAC,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,SAAS,mBAAmB,EAAE,CAAC;YAsB5E,eAAe;IAoF7B,iBAAiB,IAAI,SAAS,mBAAmB,EAAE;IAInD,kEAAkE;IAClE,kBAAkB,IAAI,OAAO;IAI7B,gCAAgC;IAChC,aAAa,IAAI,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS;IAI/D,eAAe,IAAI,mBAAmB;IAoCtC,cAAc,IAAI,kBAAkB;IAoBpC,6EAA6E;IAC7E,MAAM,IAAI,UAAU;IAUpB,kBAAkB,IAAI,wBAAwB;IAyB9C,wDAAwD;IAClD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAYd,aAAa;IA+C3B,OAAO,CAAC,iBAAiB;IAezB,OAAO,CAAC,gBAAgB;IAWxB,OAAO,CAAC,qBAAqB;IAc7B,OAAO,IAAI,IAAI;IA8Bf,OAAO,CAAC,oBAAoB;CAG7B;AAED,+BAA+B;AAC/B,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CAEhF"}