@deksden-com/dd-flow-cli 0.6.0 → 0.8.0-beta.135

package/dist/services/engines.js

@@ -9,6 +9,10 @@ import { AppError } from "../shared/errors.js";
 import { ensureDir, engineStoreRoot, engineVersionRoot, resolveProjectRoot } from "../storage/paths.js";
 import { classifyCliOperation } from "./cli-operation-classifier.js";
 import { requireProtocol } from "./protocols.js";
+import { resolveCanonRootBeforeContext } from "./canon.js";
+import { appendAudit } from "./audit.js";
+import { findProjectByRoot } from "./projects.js";
+import { allRunEngineBindings, findRunHome, readRunEngineBinding, runEngineBindingSchemaId, writeRunEngineBinding } from "./run-engine-bindings.js";
 export const engineManifestSchemaId = "dd-flow/engine-manifest@1";
 const routerNativeFamilies = new Set(["engine", "version", "schema"]);
 const sourceFile = fileURLToPath(import.meta.url);
@@ -24,7 +28,7 @@ export function isRouterNativeCommand(args) {
         return true;
     if (args.includes("--help") || args.includes("-h"))
         return true;
-    return routerNativeFamilies.has(first);
+    return routerNativeFamilies.has(first) || first === "codex" && args[1] === "hook" && args[2] === "handle";
 }
 export function installCurrentEngine(context, input = {}) {
     const build = getCliBuildInfo();
@@ -63,24 +67,48 @@ export function installCurrentEngine(context, input = {}) {
         fs.rmSync(tmp, { recursive: true, force: true });
         ensureDir(tmp);
         copyPackageSnapshot(packageRoot, tmp);
-        const manifest = buildManifest(context, build.package_name, build.version, packageRoot, target, tmp);
+        const stagedManifest = buildManifest(context, build.package_name, build.version, packageRoot, target, tmp);
+        const stagedChecksum = stagedManifest.integrity.checksum;
+        const activationTarget = input.force
+            && existing
+            && stagedChecksum
+            && stagedChecksum !== existing.integrity.checksum
+            && engineIsBound(context.ddFlowHome, existing)
+            ? `${target}--${stagedChecksum}`
+            : target;
+        const duplicate = stagedChecksum ? findInstalledManifest(context.ddFlowHome, {
+            packageName: build.package_name,
+            packageVersion: build.version,
+            integrityChecksum: stagedChecksum
+        }) : null;
+        if (duplicate) {
+            fs.rmSync(tmp, { recursive: true, force: true });
+            return {
+                ok: true,
+                action: "engine_install",
+                changed: false,
+                ...(input.forRouting ? {} : { engine: manifestSummary(duplicate) }),
+                path: duplicate.snapshot_root
+            };
+        }
+        const manifest = { ...stagedManifest, package_root: activationTarget, snapshot_root: activationTarget };
         fs.writeFileSync(path.join(tmp, "engine.json"), `${JSON.stringify(manifest, null, 2)}\n`);
-        const stagedManifest = requireManifest(path.join(tmp, "engine.json"));
-        const stagedDiagnostics = manifestDiagnostics({ ...stagedManifest, package_root: tmp, snapshot_root: tmp }, { checkEntrypoint: !input.forRouting });
+        const checkedManifest = requireManifest(path.join(tmp, "engine.json"));
+        const stagedDiagnostics = manifestDiagnostics({ ...checkedManifest, package_root: tmp, snapshot_root: tmp }, { checkEntrypoint: !input.forRouting });
         if (stagedDiagnostics.length > 0) {
             throw new AppError("engine_install_failed", "Staged dd-flow engine failed its integrity or dependency health check", 1, {
                 diagnostics: stagedDiagnostics,
                 path: tmp
             });
         }
-        activateEngineAtomically(tmp, target);
-        const installed = requireManifest(path.join(target, "engine.json"));
+        activateEngineAtomically(tmp, activationTarget);
+        const installed = requireManifest(path.join(activationTarget, "engine.json"));
         return {
             ok: true,
             action: "engine_install",
             changed: true,
             ...(input.forRouting ? {} : { engine: manifestSummary(installed) }),
-            path: target
+            path: activationTarget
         };
     }
     finally {
@@ -100,15 +128,14 @@ export function engineInfo(context, input) {
     return { ok: true, schema_id: "dd-flow/engine-info@1", engine: manifest };
 }
 export function resolveEngine(context, input = {}) {
-    installCurrentEngine(context);
-    const selection = selectEngine(context, input);
-    if (selection.status === "missing") {
-        return { ok: false, error: missingEngineError(selection), selection, exit_code: 1 };
+    const classification = input.classification ?? classifyCliOperation(["engine", "resolve"], input.env ?? context.env);
+    const selection = selectEngine(context, input, {}, classification);
+    if (selection.status !== "selected") {
+        return { ok: false, error: missingEngineError(selection, classification), selection, contexts: compatibilityContexts(context, { ...input, classification }), exit_code: 1 };
     }
-    return { ok: true, schema_id: "dd-flow/engine-resolve@1", selection };
+    return { ok: true, schema_id: "dd-flow/engine-resolve@1", selection, contexts: compatibilityContexts(context, { ...input, classification }) };
 }
 export function doctorEngines(context, input = {}) {
-    installCurrentEngine(context);
     const root = engineStoreRoot(context.ddFlowHome);
     const installed = readInstalledManifests(root);
     const checks = installed.map((manifest) => ({
@@ -116,24 +143,30 @@ export function doctorEngines(context, input = {}) {
         status: manifestHealthy(manifest) ? "ok" : "corrupt",
         diagnostics: manifestDiagnostics(manifest)
     }));
-    const selection = selectEngine(context, input);
+    const classification = input.classification ?? classifyCliOperation(["engine", "doctor"], input.env ?? context.env);
+    const selection = selectEngine(context, input, {}, classification);
     return {
-        ok: checks.every((check) => check.status === "ok") && selection.status !== "missing",
+        ok: checks.every((check) => check.status === "ok") && selection.status === "selected",
         schema_id: "dd-flow/engine-doctor@1",
         engine_store: root,
         checks,
         selection,
-        exit_code: checks.every((check) => check.status === "ok") && selection.status !== "missing" ? 0 : 1
+        contexts: compatibilityContexts(context, { ...input, classification }),
+        exit_code: checks.every((check) => check.status === "ok") && selection.status === "selected" ? 0 : 1
     };
 }
 export function routeArgsThroughEngine(context, args, io, stdin, env, resolvedProjectRoot) {
     if (isEngineMode(env) || isRouterNativeCommand(args))
         return Promise.resolve(null);
-    installCurrentEngine(context, { forRouting: true });
-    const selection = selectEngine(context, { projectRoot: resolvedProjectRoot ?? resolveOperationProjectRoot(context, args) ?? undefined }, { allowCurrentInProcess: true });
-    if (selection.status === "missing") {
-        const classification = classifyCliOperation(args, env);
-        if (classification.mode === "read_only_diagnostics" || classification.mode === "mb_upgrade") {
+    const classification = classifyCliOperation(args, env);
+    const bound = boundRunEngineForArgs(context, args, resolvedProjectRoot ?? resolveExplicitProjectRoot(args) ?? undefined);
+    if (bound) {
+        const entrypoint = resolveManifestEntrypoint(bound.manifest);
+        return spawnEngine(bound.manifest, entrypoint, args, io, stdin, env, getCliBuildInfo().version);
+    }
+    const selection = selectEngine(context, { projectRoot: resolvedProjectRoot ?? resolveExplicitProjectRoot(args) ?? undefined, env }, { allowCurrentInProcess: true }, classification);
+    if (selection.status !== "selected") {
+        if (classification.mode === "read_only_diagnostics" || (classification.mode === "mb_upgrade" && isUpgradeDiagnostic(args))) {
             return Promise.resolve(null);
         }
         throw new AppError("missing_engine", "Required dd-flow engine is not installed", 1, missingEngineDetails(selection, classification));
@@ -147,6 +180,179 @@ export function routeArgsThroughEngine(context, args, io, stdin, env, resolvedPr
     const entrypoint = resolveManifestEntrypoint(selection.selected);
     return spawnEngine(selection.selected, entrypoint, args, io, stdin, env, current.version);
 }
+export function bindRunEngine(context, input) {
+    const projectRoot = resolveProjectRoot(input.projectRoot);
+    const located = findRunHome(context.ddFlowHome, projectRoot, input.runId);
+    if (!located)
+        throw new AppError("not_found", `RUN is not registered in router storage: ${input.runId}`, 1, { run_id: input.runId, project_root: projectRoot });
+    const existing = readRunEngineBinding(located.binding_path, { allowMissing: true });
+    const manifest = requireBoundManifest(context.ddFlowHome, {
+        packageName: input.packageName ?? getCliBuildInfo().package_name,
+        packageVersion: input.engineVersion,
+        ...(input.integrityChecksum ? { integrityChecksum: input.integrityChecksum } : {})
+    });
+    const requested = engineIdentity(manifest);
+    if (existing) {
+        if (sameEngineIdentity(existing.engine, requested))
+            return { ok: true, action: "run_engine_bind", changed: false, binding: existing };
+        throw new AppError("run_engine_binding_immutable", "RUN engine binding cannot be changed", 1, {
+            run_id: located.run_id,
+            current: existing.engine,
+            requested
+        });
+    }
+    const probeArgs = ["run", "status", located.run_id, "--project-root", projectRoot, "--json"];
+    const probe = spawnSync(process.execPath, [resolveManifestEntrypoint(manifest), ...probeArgs], {
+        cwd: manifest.snapshot_root,
+        env: { ...process.env, ...context.env, DD_FLOW_HOME: context.ddFlowHome, DD_FLOW_ENGINE_MODE: "1", DD_FLOW_ENGINE_HOME: manifest.snapshot_root },
+        encoding: "utf8",
+        timeout: 30_000
+    });
+    if (probe.status !== 0) {
+        throw new AppError("run_engine_probe_failed", "Selected engine cannot read the RUN authority", 1, {
+            run_id: located.run_id,
+            engine: manifestSummary(manifest),
+            command: `dd-flow ${probeArgs.join(" ")}`,
+            exit_code: probe.status,
+            stderr: probe.stderr.slice(0, 2000)
+        });
+    }
+    const binding = {
+        schema_id: runEngineBindingSchemaId,
+        run_id: located.run_id,
+        project_root: projectRoot,
+        bound_at: context.now(),
+        source: "legacy_recovery",
+        reason: requiredText(input.reason, "reason"),
+        engine: requested,
+        probe: { status: "passed", command: `dd-flow ${probeArgs.join(" ")}` }
+    };
+    const written = writeRunEngineBinding(located.binding_path, binding);
+    const project = context.db.writable ? findProjectByRoot(context, projectRoot) : null;
+    if (project) {
+        appendAudit(context, {
+            projectId: project.id,
+            eventType: "flow_run.engine_bound",
+            payload: { run_id: located.run_id, source: binding.source, engine: binding.engine, probe: binding.probe }
+        });
+    }
+    return { ok: true, action: "run_engine_bind", changed: written.changed, binding: written.binding };
+}
+export function bindCurrentEngineToRun(context, input) {
+    const manifest = executionManifest(context);
+    const binding = {
+        schema_id: runEngineBindingSchemaId,
+        run_id: input.runId,
+        project_root: resolveProjectRoot(input.projectRoot),
+        bound_at: context.now(),
+        source: "run_creation",
+        reason: "RUN created by the selected execution engine.",
+        engine: engineIdentity(manifest),
+        probe: { status: "not_required", command: null }
+    };
+    return writeRunEngineBinding(path.join(input.runHome, "engine-binding.json"), binding).binding;
+}
+function boundRunEngineForArgs(context, args, projectRoot) {
+    const runId = runIdForArgs(args);
+    if (!runId || !projectRoot)
+        return null;
+    const located = findRunHome(context.ddFlowHome, projectRoot, runId);
+    if (!located)
+        return null;
+    const binding = readRunEngineBinding(located.binding_path, { allowMissing: true });
+    if (!binding)
+        return null;
+    const manifest = requireBoundManifest(context.ddFlowHome, {
+        packageName: binding.engine.package_name,
+        packageVersion: binding.engine.package_version,
+        integrityChecksum: binding.engine.integrity_checksum,
+        snapshotRoot: binding.engine.snapshot_root
+    });
+    return { binding, manifest };
+}
+function runIdForArgs(args) {
+    const [family, command, ...rest] = args;
+    const parsed = parseLightArgs(rest);
+    if (family === "run" && command !== "start" && command !== "list") {
+        if (command === "flags")
+            return positional(parsed, 1);
+        return positional(parsed, 0);
+    }
+    if (family === "stage" && command !== "start")
+        return positional(parsed, 0);
+    if (family === "stage" && command === "start" && !parsed.options.has("bootstrap"))
+        return positional(parsed, 0);
+    if (family === "prompt" && command === "render")
+        return option(parsed, "run");
+    if (family === "migration" && ["plan", "report", "verify", "apply"].includes(command ?? ""))
+        return option(parsed, "run");
+    if (family === "protocol" && command === "sync-from-run")
+        return option(parsed, "run");
+    return null;
+}
+function requireBoundManifest(ddFlowHome, input) {
+    const manifest = input.snapshotRoot
+        ? requireManifest(path.join(input.snapshotRoot, "engine.json"))
+        : findInstalledManifest(ddFlowHome, {
+            packageName: input.packageName,
+            packageVersion: input.packageVersion,
+            ...(input.integrityChecksum ? { integrityChecksum: input.integrityChecksum } : {})
+        });
+    if (!manifest
+        || manifest.package_name !== input.packageName
+        || manifest.package_version !== input.packageVersion
+        || input.integrityChecksum !== undefined && manifest.integrity.checksum !== input.integrityChecksum
+        || input.snapshotRoot !== undefined && path.resolve(manifest.snapshot_root) !== path.resolve(input.snapshotRoot)
+        || !manifestHealthy(manifest)) {
+        throw new AppError("run_engine_binding_invalid", "RUN engine binding points to a missing or unhealthy engine snapshot", 1, {
+            package_name: input.packageName,
+            package_version: input.packageVersion,
+            snapshot_root: input.snapshotRoot ?? null,
+            integrity_checksum: input.integrityChecksum ?? null
+        });
+    }
+    return manifest;
+}
+function engineIdentity(manifest) {
+    if (!manifest.integrity.checksum) {
+        throw new AppError("engine_integrity_missing", "Cannot bind a RUN to an engine without a content checksum", 1, {
+            engine: manifestSummary(manifest)
+        });
+    }
+    return {
+        package_name: manifest.package_name,
+        package_version: manifest.package_version,
+        engine_version: manifest.engine_version,
+        integrity_checksum: manifest.integrity.checksum,
+        snapshot_root: path.resolve(manifest.snapshot_root)
+    };
+}
+function sameEngineIdentity(left, right) {
+    return left.package_name === right.package_name
+        && left.package_version === right.package_version
+        && left.engine_version === right.engine_version
+        && left.integrity_checksum === right.integrity_checksum
+        && path.resolve(left.snapshot_root) === path.resolve(right.snapshot_root);
+}
+function executionManifest(context) {
+    const home = context.env.DD_FLOW_ENGINE_HOME;
+    if (home && home !== "in-process")
+        return requireBoundManifest(context.ddFlowHome, { packageName: getCliBuildInfo().package_name, packageVersion: getCliBuildInfo().version, snapshotRoot: home });
+    // Refresh the same-semver snapshot when this build differs. The installer
+    // deduplicates identical checksums and keeps any bound snapshot immutable.
+    const installed = installCurrentEngine(context, { force: true, forRouting: true });
+    return requireManifest(path.join(String(installed.path), "engine.json"));
+}
+function requiredText(value, label) {
+    const normalized = value.trim();
+    if (!normalized)
+        throw new AppError("usage", `Missing required value: ${label}`, 2);
+    return normalized;
+}
+function engineIsBound(ddFlowHome, manifest) {
+    const snapshotRoot = path.resolve(manifest.snapshot_root);
+    return allRunEngineBindings(ddFlowHome).some((binding) => path.resolve(binding.engine.snapshot_root) === snapshotRoot);
+}
 export function engineRoutingMetadata(env) {
     if (env.DD_FLOW_ENGINE_MODE !== "1")
         return null;
@@ -156,25 +362,54 @@ export function engineRoutingMetadata(env) {
         routed_from: env.DD_FLOW_ROUTED_FROM ?? null
     };
 }
-export function selectEngine(context, input, options = {}) {
-    const compatibility = readCompatibilityForProject(input.projectRoot);
+export function selectEngine(context, input, options = {}, classification = input.classification ?? classifyCliOperation(["status"], input.env ?? process.env)) {
+    const projectCompatibility = readCompatibilityForProject(input.projectRoot);
+    const targetCanon = classification.mode === "mb_upgrade" ? resolveCanonRootBeforeContext(input.env ?? process.env) : null;
+    const compatibility = classification.mode === "mb_upgrade"
+        ? readCompatibilityForCanon(targetCanon)
+        : projectCompatibility;
     const build = getCliBuildInfo();
-    const packageName = stringValue(compatibility?.engine?.package_name) ?? build.package_name;
-    const requiredRange = stringValue(compatibility?.engine?.version_range) ?? `>=${build.version} <9999.0.0`;
+    const targetBlockers = classification.mode === "mb_upgrade"
+        ? [
+            ...(targetCanon && !targetCanon.ok ? targetCanon.blockers : []),
+            ...(targetCanon?.ok && !compatibility ? ["upgrade target compatibility manifest is unavailable"] : []),
+            ...targetPinBlockers(input.env ?? process.env, targetCanon)
+        ]
+        : [];
+    const packageName = stringValue(compatibility?.engine?.package_name) ?? (classification.mode === "mb_upgrade" ? build.package_name : build.package_name);
+    const requiredRange = stringValue(compatibility?.engine?.version_range) ?? (classification.mode === "mb_upgrade" ? null : `>=${build.version} <9999.0.0`);
     const recommended = stringValue(compatibility?.engine?.recommended_version) ?? build.version;
     const installHintTemplate = stringValue(compatibility?.engine?.old_engine_install_hint) ?? `npx ${packageName}@<version> engine install`;
     const manifests = readInstalledManifests(engineStoreRoot(context.ddFlowHome))
         .filter((manifest) => manifest.package_name === packageName)
-        .filter((manifest) => satisfiesRange(manifest.package_version, requiredRange))
+        .filter((manifest) => requiredRange !== null && satisfiesRange(manifest.package_version, requiredRange))
         .filter((manifest) => options.allowCurrentInProcess
         && manifest.package_name === build.package_name
         && manifest.package_version === build.version
         ? true
         : manifestHealthy(manifest))
-        .sort((a, b) => compareSemverStrings(b.package_version, a.package_version));
-    const selected = manifests[0] ?? null;
+        .sort((a, b) => {
+        const versionOrder = compareSemverStrings(b.package_version, a.package_version);
+        if (versionOrder !== 0)
+            return versionOrder;
+        const installedOrder = Date.parse(b.installed_at) - Date.parse(a.installed_at);
+        if (Number.isFinite(installedOrder) && installedOrder !== 0)
+            return installedOrder;
+        return b.snapshot_root.localeCompare(a.snapshot_root);
+    });
+    const selected = manifests[0] ?? (options.allowCurrentInProcess &&
+        targetBlockers.length === 0 &&
+        requiredRange !== null &&
+        packageName === build.package_name &&
+        satisfiesRange(build.version, requiredRange)
+        ? currentBuildManifest(context, build)
+        : null);
+    const diagnostics = [
+        ...targetBlockers,
+        ...(selected ? [] : [`No installed engine satisfies ${packageName} ${requiredRange ?? "the pinned target range"}`])
+    ];
     return {
-        status: selected ? "selected" : "missing",
+        status: targetBlockers.length > 0 ? "unsupported" : selected ? "selected" : "missing",
         package_name: packageName,
         required_range: requiredRange,
         recommended_version: recommended,
@@ -182,9 +417,38 @@ export function selectEngine(context, input, options = {}) {
         install_hint: selected ? null : installHintTemplate.replace("<version>", recommended),
         project_root: input.projectRoot ? path.resolve(input.projectRoot) : null,
         memory_bank_version: compatibility?.memory_bank_version ?? null,
-        diagnostics: selected ? [] : [`No installed engine satisfies ${packageName} ${requiredRange}`]
+        diagnostics
+    };
+}
+function currentBuildManifest(context, build) {
+    const packageRoot = findPackageRoot(path.dirname(sourceFile)) ?? process.cwd();
+    return buildManifest(context, build.package_name, build.version, packageRoot, packageRoot, packageRoot);
+}
+export function compatibilityContexts(context, input = {}) {
+    const env = input.env ?? process.env;
+    const classification = input.classification ?? classifyCliOperation(["status"], env);
+    const currentSelection = selectEngine(context, { projectRoot: input.projectRoot, env }, { allowCurrentInProcess: true }, { mode: "normal_write", operation: "project.current", family: "project", command: "current", action: null });
+    const targetCanon = classification.mode === "mb_upgrade" ? resolveCanonRootBeforeContext(env) : null;
+    const targetSelection = classification.mode === "mb_upgrade"
+        ? selectEngine(context, { projectRoot: input.projectRoot, env }, {}, classification)
+        : null;
+    return {
+        project_current: compatibilityContextSummary("project_current", currentSelection, null),
+        upgrade_target: classification.mode === "mb_upgrade"
+            ? compatibilityContextSummary("upgrade_target", targetSelection ?? currentSelection, targetCanon)
+            : null,
+        effective_execution: {
+            operation: classification.operation,
+            mode: classification.mode,
+            package_name: (targetSelection ?? currentSelection).package_name,
+            engine_version: (targetSelection ?? currentSelection).selected?.package_version ?? null,
+            reason: classification.mode === "mb_upgrade" ? "explicit_upgrade_allowlist_target_canon" : "project_current"
+        }
     };
 }
+export function resolveExplicitProjectRoot(args) {
+    return option(parseLightArgs(args), "project-root") ?? option(parseLightArgs(args), "root");
+}
 export function resolveOperationProjectRoot(context, args) {
     const [family, command, ...rest] = args;
     const parsed = parseLightArgs(rest);
@@ -234,6 +498,68 @@ function readCompatibilityForProject(projectRoot) {
     }
     return null;
 }
+function isUpgradeDiagnostic(args) {
+    const [family, command] = args;
+    return family === "status" || family === "engine" && command === "resolve";
+}
+function targetPinBlockers(env, resolution) {
+    if (!resolution?.ok || !resolution.canon)
+        return [];
+    const blockers = [];
+    const expectedVersion = env.DD_FLOW_MB_UPGRADE_TARGET_VERSION;
+    const expectedCommit = env.DD_FLOW_MB_UPGRADE_TARGET_COMMIT;
+    if (expectedVersion && expectedVersion !== resolution.canon.version)
+        blockers.push("target canon version pin does not match resolved canon");
+    if (expectedCommit && expectedCommit !== resolution.canon.commit)
+        blockers.push("target canon commit pin does not match resolved canon");
+    const expectedSha = env.DD_FLOW_MB_UPGRADE_COMPATIBILITY_SHA256;
+    if (expectedSha && expectedSha !== canonCompatibilitySha(resolution.canon.memorybank_root))
+        blockers.push("target compatibility SHA pin does not match resolved canon");
+    return blockers;
+}
+function readCompatibilityForCanon(resolution) {
+    if (!resolution?.ok || !resolution.canon)
+        return null;
+    return readCompatibilityFile(path.join(resolution.canon.memorybank_root, "dd-flow", "compatibility.json"));
+}
+function readCompatibilityFile(file) {
+    try {
+        return JSON.parse(fs.readFileSync(file, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+function compatibilityContextSummary(name, selection, canon) {
+    return {
+        name,
+        canon: canon?.canon ? {
+            root: canon.canon.root,
+            version: canon.canon.version,
+            commit: canon.canon.commit,
+            flow_contract: canon.canon.flow_contract,
+            compatibility_sha256: canonCompatibilitySha(canon.canon.memorybank_root)
+        } : {
+            source: "project_current"
+        },
+        memory_bank_version: selection.memory_bank_version,
+        package_name: selection.package_name,
+        required_engine_range: selection.required_range,
+        recommended_engine_version: selection.recommended_version,
+        resolution: selection.status,
+        engine_version: selection.selected?.package_version ?? null,
+        diagnostics: selection.diagnostics
+    };
+}
+function canonCompatibilitySha(memorybankRoot) {
+    const file = path.join(memorybankRoot, "dd-flow", "compatibility.json");
+    try {
+        return crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
+    }
+    catch {
+        return null;
+    }
+}
 function parseLightArgs(args) {
     const positional = [];
     const options = new Map();
@@ -285,6 +611,7 @@ function buildManifest(context, packageName, version, packageRoot, snapshotRoot,
             version: ["dd-flow/version-report@1"],
             status: ["dd-flow/status-report@1"]
         },
+        schema_registry: buildSchemaRegistry(checksumRoot),
         integrity: {
             source: "package_snapshot",
             checksum: engineSnapshotChecksum(checksumRoot),
@@ -430,6 +757,11 @@ function readInstalledManifests(root) {
     }
     return manifests;
 }
+function findInstalledManifest(ddFlowHome, input) {
+    return readInstalledManifests(engineStoreRoot(ddFlowHome)).find((manifest) => (manifest.package_name === input.packageName
+        && manifest.package_version === input.packageVersion
+        && (input.integrityChecksum === undefined || manifest.integrity.checksum === input.integrityChecksum))) ?? null;
+}
 function requireManifest(file) {
     const manifest = readManifest(file);
     if (!manifest)
@@ -479,6 +811,24 @@ function manifestDiagnostics(manifest, options = {}) {
             diagnostics.push("snapshot_unreadable");
         }
     }
+    if (manifest.schema_registry) {
+        for (const entry of manifest.schema_registry.entries) {
+            const schemaPath = safeResolveSnapshotPath(manifest, entry.path);
+            if (!schemaPath || !fs.existsSync(schemaPath))
+                diagnostics.push(`schema_registry_missing:${entry.name}`);
+            else if (fileChecksum(schemaPath) !== entry.checksum)
+                diagnostics.push(`schema_registry_checksum_mismatch:${entry.name}`);
+            else {
+                try {
+                    if (JSON.parse(fs.readFileSync(schemaPath, "utf8")).$id !== entry.id)
+                        diagnostics.push(`schema_registry_id_mismatch:${entry.name}`);
+                }
+                catch {
+                    diagnostics.push(`schema_registry_unreadable:${entry.name}`);
+                }
+            }
+        }
+    }
     if (options.checkEntrypoint !== false && entrypoint && fs.existsSync(entrypoint) && !diagnostics.includes("entrypoint_outside_snapshot")) {
         const health = spawnSync(process.execPath, [entrypoint, "--version", "--json"], {
             cwd: snapshotRoot,
@@ -503,6 +853,7 @@ function manifestSummary(manifest) {
         package_name: manifest.package_name,
         package_version: manifest.package_version,
         engine_version: manifest.engine_version,
+        ...(manifest.schema_registry ? { schema_registry: manifest.schema_registry } : {}),
         install_source: manifest.install_source,
         entrypoint: manifest.entrypoint,
         snapshot_root: manifest.snapshot_root,
@@ -530,6 +881,33 @@ function safeResolveManifestEntrypoint(manifest) {
         return null;
     return candidate;
 }
+function safeResolveSnapshotPath(manifest, relativePath) {
+    if (path.isAbsolute(relativePath))
+        return null;
+    const snapshotRoot = path.resolve(manifest.snapshot_root || manifest.package_root);
+    const candidate = path.resolve(snapshotRoot, relativePath);
+    return isInside(snapshotRoot, candidate) ? candidate : null;
+}
+function buildSchemaRegistry(snapshotRoot) {
+    const schemaRoot = path.join(snapshotRoot, "dist", "schemas");
+    const entries = !fs.existsSync(schemaRoot) ? [] : fs.readdirSync(schemaRoot, { withFileTypes: true })
+        .filter((entry) => entry.isFile() && entry.name.endsWith(".schema.json") && !entry.name.includes("-legacy-"))
+        .map((entry) => {
+        const file = path.join(schemaRoot, entry.name);
+        const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+        return {
+            name: entry.name.slice(0, -".schema.json".length),
+            id: typeof parsed.$id === "string" ? parsed.$id : entry.name,
+            path: path.join("dist", "schemas", entry.name),
+            checksum: fileChecksum(file)
+        };
+    })
+        .sort((left, right) => left.name.localeCompare(right.name));
+    return { schema_id: "dd-flow/engine-schema-registry@1", entries };
+}
+function fileChecksum(file) {
+    return crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
+}
 function isInside(root, candidate) {
     const relative = path.relative(root, candidate);
     return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));