@ethisyscore/protocol 0.7.0-alpha.3

package/dist/index.d.ts

@@ -0,0 +1,899 @@
+import { z } from 'zod';
+
+declare const BRIDGE_VERSION: "2026-06";
+type BridgeVersion = typeof BRIDGE_VERSION;
+
+/**
+ * How a plugin's UI is rendered to the end user.
+ *
+ * - `host-rendered`: the host application renders the plugin UI from a declarative description.
+ * - `remote-runtime`: the plugin ships its own runtime that the host loads into an isolation boundary.
+ * - `first-party-host-extension`: the plugin is bundled with the host as a first-party extension
+ *   sharing the host's runtime.
+ */
+declare const RenderMode: z.ZodEnum<["host-rendered", "remote-runtime", "first-party-host-extension"]>;
+type RenderMode = z.infer<typeof RenderMode>;
+/**
+ * Plugin classification enum — wire values mirror the C# `JsonStringEnumMemberName`
+ * tokens on `PluginType` (`CORE`, `PLATFORM_APP`, `TENANT_APP`), so the TypeScript schema
+ * round-trips through the .NET serialiser and through the JSON Schema enum gates.
+ *
+ * Earlier revisions accepted the C# member names (`Core`, `PlatformPlugin`, `TenantPlugin`),
+ * which silently disagreed with the wire format. Exported as a dedicated Zod enum so
+ * downstream consumers can validate `type` independently of the full manifest.
+ */
+declare const PluginType: z.ZodEnum<["CORE", "PLATFORM_APP", "TENANT_APP"]>;
+type PluginType = z.infer<typeof PluginType>;
+/**
+ * UI sub-shape of the plugin manifest.
+ *
+ * Mirrors a strict subset of the C# `UiContributions` record. Only the fields the TS contract
+ * currently consumes are modelled here — future tasks extend this schema additively as new
+ * fields (pages, surfaces, navigation, etc.) come in.
+ *
+ * Wire-shape parity: every member is optional, matching the C# `UiContributions` record
+ * where each sibling (`MenuItems`, `Pages`, `Surfaces`, `PortalContributions`, ...) is
+ * nullable / property-omitted. Omitting `portalContributions` leaves it `undefined` on
+ * parse — the consumer is responsible for treating undefined as "no contributions".
+ *
+ * The schema is `.passthrough()` so unrecognised UI sibling fields (e.g. `pages`,
+ * `surfaces`, `declarativeSurfaces`, `workerPages`, `navigation`) survive parse → re-emit
+ * unchanged instead of being silently stripped. The documented permissive intent
+ * (additive evolution of UI contributions) requires this — Zod object schemas strip
+ * unknown keys by default.
+ */
+declare const PluginUi: z.ZodObject<{
+    /**
+     * Plugin contributions to well-known host UI slots. Optional: omitting the field leaves
+     * it `undefined`, matching the C# `UiContributions.PortalContributions` null encoding.
+     */
+    portalContributions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        slot: z.ZodEnum<["sidebar", "header", "dashboard", "command-palette", "entity-detail"]>;
+        capability: z.ZodEffects<z.ZodString, string, string>;
+        priority: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        slot: "sidebar" | "header" | "dashboard" | "command-palette" | "entity-detail";
+        capability: string;
+        priority: number;
+    }, {
+        slot: "sidebar" | "header" | "dashboard" | "command-palette" | "entity-detail";
+        capability: string;
+        priority: number;
+    }>, "many">>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    /**
+     * Plugin contributions to well-known host UI slots. Optional: omitting the field leaves
+     * it `undefined`, matching the C# `UiContributions.PortalContributions` null encoding.
+     */
+    portalContributions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        slot: z.ZodEnum<["sidebar", "header", "dashboard", "command-palette", "entity-detail"]>;
+        capability: z.ZodEffects<z.ZodString, string, string>;
+        priority: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        slot: "sidebar" | "header" | "dashboard" | "command-palette" | "entity-detail";
+        capability: string;
+        priority: number;
+    }, {
+        slot: "sidebar" | "header" | "dashboard" | "command-palette" | "entity-detail";
+        capability: string;
+        priority: number;
+    }>, "many">>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    /**
+     * Plugin contributions to well-known host UI slots. Optional: omitting the field leaves
+     * it `undefined`, matching the C# `UiContributions.PortalContributions` null encoding.
+     */
+    portalContributions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        slot: z.ZodEnum<["sidebar", "header", "dashboard", "command-palette", "entity-detail"]>;
+        capability: z.ZodEffects<z.ZodString, string, string>;
+        priority: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        slot: "sidebar" | "header" | "dashboard" | "command-palette" | "entity-detail";
+        capability: string;
+        priority: number;
+    }, {
+        slot: "sidebar" | "header" | "dashboard" | "command-palette" | "entity-detail";
+        capability: string;
+        priority: number;
+    }>, "many">>;
+}, z.ZodTypeAny, "passthrough">>;
+type PluginUi = z.infer<typeof PluginUi>;
+/**
+ * Canonical plugin manifest contract. Mirrors the C# `PluginManifest` record on the .NET side.
+ *
+ * The schema is intentionally permissive about additional fields the host hasn't been taught
+ * yet — `.passthrough()` keeps unknown root fields on the parsed object so a manifest
+ * round-trip (parse → re-emit) does not silently drop fields the C# / JSON Schema layers
+ * still recognise. Use a future `.strict()` variant for trust-boundary ingest where unknown
+ * keys must be rejected.
+ */
+declare const PluginManifest: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    version: z.ZodString;
+    type: z.ZodEnum<["CORE", "PLATFORM_APP", "TENANT_APP"]>;
+    owner: z.ZodString;
+    compatibleCoreVersion: z.ZodEffects<z.ZodString, string, string>;
+    renderMode: z.ZodDefault<z.ZodEnum<["host-rendered", "remote-runtime", "first-party-host-extension"]>>;
+    bridgeVersion: z.ZodOptional<z.ZodString>;
+    ui: z.ZodOptional<z.ZodObject<{
+        /**
+         * Plugin contributions to well-known host UI slots. Optional: omitting the field leaves
+         * it `undefined`, matching the C# `UiContributions.PortalContributions` null encoding.
+         */
+        portalContributions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            slot: z.ZodEnum<["sidebar", "header", "dashboard", "command-palette", "entity-detail"]>;
+            capability: z.ZodEffects<z.ZodString, string, string>;
+            priority: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            slot: "sidebar" | "header" | "dashboard" | "command-palette" | "entity-detail";
+            capability: string;
+            priority: number;
+        }, {
+            slot: "sidebar" | "header" | "dashboard" | "command-palette" | "entity-detail";
+            capability: string;
+            priority: number;
+        }>, "many">>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /**
+         * Plugin contributions to well-known host UI slots. Optional: omitting the field leaves
+         * it `undefined`, matching the C# `UiContributions.PortalContributions` null encoding.
+         */
+        portalContributions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            slot: z.ZodEnum<["sidebar", "header", "dashboard", "command-palette", "entity-detail"]>;
+            capability: z.ZodEffects<z.ZodString, string, string>;
+            priority: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            slot: "sidebar" | "header" | "dashboard" | "command-palette" | "entity-detail";
+            capability: string;
+            priority: number;
+        }, {
+            slot: "sidebar" | "header" | "dashboard" | "command-palette" | "entity-detail";
+            capability: string;
+            priority: number;
+        }>, "many">>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /**
+         * Plugin contributions to well-known host UI slots. Optional: omitting the field leaves
+         * it `undefined`, matching the C# `UiContributions.PortalContributions` null encoding.
+         */
+        portalContributions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            slot: z.ZodEnum<["sidebar", "header", "dashboard", "command-palette", "entity-detail"]>;
+            capability: z.ZodEffects<z.ZodString, string, string>;
+            priority: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            slot: "sidebar" | "header" | "dashboard" | "command-palette" | "entity-detail";
+            capability: string;
+            priority: number;
+        }, {
+            slot: "sidebar" | "header" | "dashboard" | "command-palette" | "entity-detail";
+            capability: string;
+            priority: number;
+        }>, "many">>;
+    }, z.ZodTypeAny, "passthrough">>>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    id: z.ZodString;
+    name: z.ZodString;
+    version: z.ZodString;
+    type: z.ZodEnum<["CORE", "PLATFORM_APP", "TENANT_APP"]>;
+    owner: z.ZodString;
+    compatibleCoreVersion: z.ZodEffects<z.ZodString, string, string>;
+    renderMode: z.ZodDefault<z.ZodEnum<["host-rendered", "remote-runtime", "first-party-host-extension"]>>;
+    bridgeVersion: z.ZodOptional<z.ZodString>;
+    ui: z.ZodOptional<z.ZodObject<{
+        /**
+         * Plugin contributions to well-known host UI slots. Optional: omitting the field leaves
+         * it `undefined`, matching the C# `UiContributions.PortalContributions` null encoding.
+         */
+        portalContributions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            slot: z.ZodEnum<["sidebar", "header", "dashboard", "command-palette", "entity-detail"]>;
+            capability: z.ZodEffects<z.ZodString, string, string>;
+            priority: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            slot: "sidebar" | "header" | "dashboard" | "command-palette" | "entity-detail";
+            capability: string;
+            priority: number;
+        }, {
+            slot: "sidebar" | "header" | "dashboard" | "command-palette" | "entity-detail";
+            capability: string;
+            priority: number;
+        }>, "many">>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /**
+         * Plugin contributions to well-known host UI slots. Optional: omitting the field leaves
+         * it `undefined`, matching the C# `UiContributions.PortalContributions` null encoding.
+         */
+        portalContributions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            slot: z.ZodEnum<["sidebar", "header", "dashboard", "command-palette", "entity-detail"]>;
+            capability: z.ZodEffects<z.ZodString, string, string>;
+            priority: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            slot: "sidebar" | "header" | "dashboard" | "command-palette" | "entity-detail";
+            capability: string;
+            priority: number;
+        }, {
+            slot: "sidebar" | "header" | "dashboard" | "command-palette" | "entity-detail";
+            capability: string;
+            priority: number;
+        }>, "many">>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /**
+         * Plugin contributions to well-known host UI slots. Optional: omitting the field leaves
+         * it `undefined`, matching the C# `UiContributions.PortalContributions` null encoding.
+         */
+        portalContributions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            slot: z.ZodEnum<["sidebar", "header", "dashboard", "command-palette", "entity-detail"]>;
+            capability: z.ZodEffects<z.ZodString, string, string>;
+            priority: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            slot: "sidebar" | "header" | "dashboard" | "command-palette" | "entity-detail";
+            capability: string;
+            priority: number;
+        }, {
+            slot: "sidebar" | "header" | "dashboard" | "command-palette" | "entity-detail";
+            capability: string;
+            priority: number;
+        }>, "many">>;
+    }, z.ZodTypeAny, "passthrough">>>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    id: z.ZodString;
+    name: z.ZodString;
+    version: z.ZodString;
+    type: z.ZodEnum<["CORE", "PLATFORM_APP", "TENANT_APP"]>;
+    owner: z.ZodString;
+    compatibleCoreVersion: z.ZodEffects<z.ZodString, string, string>;
+    renderMode: z.ZodDefault<z.ZodEnum<["host-rendered", "remote-runtime", "first-party-host-extension"]>>;
+    bridgeVersion: z.ZodOptional<z.ZodString>;
+    ui: z.ZodOptional<z.ZodObject<{
+        /**
+         * Plugin contributions to well-known host UI slots. Optional: omitting the field leaves
+         * it `undefined`, matching the C# `UiContributions.PortalContributions` null encoding.
+         */
+        portalContributions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            slot: z.ZodEnum<["sidebar", "header", "dashboard", "command-palette", "entity-detail"]>;
+            capability: z.ZodEffects<z.ZodString, string, string>;
+            priority: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            slot: "sidebar" | "header" | "dashboard" | "command-palette" | "entity-detail";
+            capability: string;
+            priority: number;
+        }, {
+            slot: "sidebar" | "header" | "dashboard" | "command-palette" | "entity-detail";
+            capability: string;
+            priority: number;
+        }>, "many">>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        /**
+         * Plugin contributions to well-known host UI slots. Optional: omitting the field leaves
+         * it `undefined`, matching the C# `UiContributions.PortalContributions` null encoding.
+         */
+        portalContributions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            slot: z.ZodEnum<["sidebar", "header", "dashboard", "command-palette", "entity-detail"]>;
+            capability: z.ZodEffects<z.ZodString, string, string>;
+            priority: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            slot: "sidebar" | "header" | "dashboard" | "command-palette" | "entity-detail";
+            capability: string;
+            priority: number;
+        }, {
+            slot: "sidebar" | "header" | "dashboard" | "command-palette" | "entity-detail";
+            capability: string;
+            priority: number;
+        }>, "many">>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        /**
+         * Plugin contributions to well-known host UI slots. Optional: omitting the field leaves
+         * it `undefined`, matching the C# `UiContributions.PortalContributions` null encoding.
+         */
+        portalContributions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            slot: z.ZodEnum<["sidebar", "header", "dashboard", "command-palette", "entity-detail"]>;
+            capability: z.ZodEffects<z.ZodString, string, string>;
+            priority: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            slot: "sidebar" | "header" | "dashboard" | "command-palette" | "entity-detail";
+            capability: string;
+            priority: number;
+        }, {
+            slot: "sidebar" | "header" | "dashboard" | "command-palette" | "entity-detail";
+            capability: string;
+            priority: number;
+        }>, "many">>;
+    }, z.ZodTypeAny, "passthrough">>>;
+}, z.ZodTypeAny, "passthrough">>;
+type PluginManifest = z.infer<typeof PluginManifest>;
+
+/**
+ * The closed v1 host slot taxonomy.
+ *
+ * The host owns the slot taxonomy; plugins target slot names by string. Adding a new slot
+ * is a coordinated host change — plugins cannot introduce slot names ad hoc.
+ */
+declare const KNOWN_SLOTS: readonly ["sidebar", "header", "dashboard", "command-palette", "entity-detail"];
+/**
+ * Zod schema for a host slot name. Rejects values outside the closed v1 taxonomy.
+ */
+declare const HostSlot: z.ZodEnum<["sidebar", "header", "dashboard", "command-palette", "entity-detail"]>;
+type HostSlot = z.infer<typeof HostSlot>;
+/**
+ * A single plugin contribution targeting a host slot.
+ *
+ * - `slot`: the host slot the contribution targets (must be one of {@link KNOWN_SLOTS}).
+ * - `capability`: the capability gate the viewer must hold for the host to render the contribution.
+ *   Must be a non-empty, non-whitespace string — whitespace-only values would render an
+ *   unaddressable contribution or, depending on host interpretation, an accidentally
+ *   unrestricted one. Wire-form parity with the C# `PortalContribution.Capability` init guard
+ *   and the JSON Schemas, which all reject whitespace-only strings.
+ * - `priority`: arbitration weight when multiple plugins target the same slot. Higher wins.
+ *   Range `0..1000` inclusive to keep the priority space bounded and reviewable.
+ */
+declare const PortalContribution: z.ZodObject<{
+    slot: z.ZodEnum<["sidebar", "header", "dashboard", "command-palette", "entity-detail"]>;
+    capability: z.ZodEffects<z.ZodString, string, string>;
+    priority: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    slot: "sidebar" | "header" | "dashboard" | "command-palette" | "entity-detail";
+    capability: string;
+    priority: number;
+}, {
+    slot: "sidebar" | "header" | "dashboard" | "command-palette" | "entity-detail";
+    capability: string;
+    priority: number;
+}>;
+type PortalContribution = z.infer<typeof PortalContribution>;
+
+/**
+ * The closed set of reactive rule kinds supported by the SDUI runtime.
+ *
+ * Plugins declare reactivity via these five kinds; the host owns evaluation order
+ * and side-effect semantics. Adding a new kind is a coordinated host change.
+ */
+declare const KNOWN_RULE_KINDS: readonly ["when", "visible", "required", "compute", "validate"];
+/**
+ * The closed JsonLogic operator subset permitted in reactive rule expressions.
+ *
+ * The vocabulary is intentionally minimal: comparison, boolean, arithmetic, and `var`.
+ * No custom operators, no async, no loops, no mutation. Adding an operator is a
+ * coordinated protocol change — plugins cannot extend the vocabulary ad hoc.
+ */
+declare const KNOWN_OPERATORS: readonly ["==", "!=", ">", "<", ">=", "<=", "and", "or", "not", "+", "-", "*", "/", "%", "var"];
+/**
+ * Zod schema for a reactive rule kind. Rejects values outside {@link KNOWN_RULE_KINDS}.
+ */
+declare const RuleKind: z.ZodEnum<["when", "visible", "required", "compute", "validate"]>;
+type RuleKind = z.infer<typeof RuleKind>;
+/**
+ * Literal scalar values permitted inside a reactive expression tree.
+ *
+ * Functions, `undefined`, and arbitrary objects are intentionally rejected to keep
+ * the expression vocabulary serialisable and free of host-side side effects.
+ */
+type LiteralValue = string | number | boolean | null;
+/**
+ * Operator name from the closed JsonLogic subset {@link KNOWN_OPERATORS}.
+ */
+type OperatorName = (typeof KNOWN_OPERATORS)[number];
+/**
+ * An operator-object form for {@link Expr} — a single-key record whose key is one of the
+ * closed {@link KNOWN_OPERATORS} and whose value is itself an {@link Expr}.
+ *
+ * The mapped-then-indexed shape `{ [K in OperatorName]: Record<K, Expr> }[OperatorName]`
+ * collapses to the discriminated union
+ * `{ "==": Expr } | { "!=": Expr } | ... | { var: Expr }`. Unlike the earlier optional-key
+ * form (`{ [K in OperatorName]?: Expr }`), this:
+ *
+ * - rejects the empty object literal `{}` at compile time;
+ * - rejects multi-key objects like `{ "==": a, "!=": b }` at compile time;
+ * - matches the runtime schema, which requires exactly one known operator key.
+ *
+ * Authors and tooling no longer have to wait for a Zod parse failure to discover an
+ * impossible-on-the-wire expression — the TypeScript compiler rejects it first.
+ *
+ * Modelled as an interface so the recursive `Expr` reference is resolved lazily; a plain
+ * `type` alias with an indexed mapped type triggers TS2456 (circular reference) under
+ * tsup's `--dts` build.
+ */
+interface ExprObject extends Partial<Record<OperatorName, Expr>> {
+}
+/**
+ * A JsonLogic expression in the closed operator subset.
+ *
+ * An expression is one of:
+ * - a {@link LiteralValue} (`string | number | boolean | null`)
+ * - an array of expressions (operand list)
+ * - an {@link ExprObject} (single-key object whose key is from {@link KNOWN_OPERATORS})
+ *
+ * The discriminated form lets consumers narrow on `typeof expr` / `Array.isArray` / object
+ * key inspection without resorting to `unknown` casts.
+ *
+ * Runtime validation (the `Expr` Zod schema below) is the authoritative check that the
+ * object carries exactly one known operator key. The TypeScript type narrows the *kind* of
+ * value an author may construct (it rules out arbitrary string keys); the schema enforces
+ * the single-key invariant on the wire.
+ */
+type Expr = LiteralValue | Expr[] | ExprObject;
+/**
+ * Zod schema for a single reactive rule: a {@link RuleKind} paired with an expression
+ * built from the closed JsonLogic operator subset.
+ */
+declare const ReactiveRule: z.ZodObject<{
+    kind: z.ZodEnum<["when", "visible", "required", "compute", "validate"]>;
+    expr: z.ZodType<Expr, z.ZodTypeDef, Expr>;
+}, "strip", z.ZodTypeAny, {
+    kind: "when" | "visible" | "required" | "compute" | "validate";
+    expr: Expr;
+}, {
+    kind: "when" | "visible" | "required" | "compute" | "validate";
+    expr: Expr;
+}>;
+type ReactiveRule = z.infer<typeof ReactiveRule>;
+
+/**
+ * The closed v1 SDUI primitive vocabulary.
+ *
+ * Plugins author UI trees using only these primitive names; the host owns the rendering
+ * for each. Adding a new primitive is a coordinated host change — plugins cannot extend
+ * the vocabulary ad hoc. Deferred-vocabulary names (`Wizard`, `Timeline`, `Chart`,
+ * `EntityPicker`, `Detail`) are intentionally absent from v1 and are rejected by the
+ * {@link PrimitiveName} schema.
+ *
+ * `Portal` is the 17th primitive: it lets a plugin contribute a subtree into a host slot
+ * (see `./portal.ts` for the v1 slot taxonomy).
+ */
+declare const KNOWN_PRIMITIVES: readonly ["Page", "Section", "Stack", "Grid", "Form", "Field", "DataTable", "Card", "Stat", "Action", "Tabs", "Toolbar", "Filter", "EmptyState", "LoadingState", "ErrorState", "Portal"];
+/**
+ * Zod schema for a SDUI primitive name. Rejects values outside the closed v1 vocabulary.
+ */
+declare const PrimitiveName: z.ZodEnum<["Page", "Section", "Stack", "Grid", "Form", "Field", "DataTable", "Card", "Stat", "Action", "Tabs", "Toolbar", "Filter", "EmptyState", "LoadingState", "ErrorState", "Portal"]>;
+type PrimitiveName = z.infer<typeof PrimitiveName>;
+
+/**
+ * A SDUI tree node.
+ *
+ * - `type`: one of the closed v1 primitive names (see {@link PrimitiveName}).
+ * - `props`: arbitrary per-primitive properties; the host owns interpretation.
+ * - `children`: optional child nodes; recursion is type-checked end-to-end.
+ * - `bindings`: optional reactive rules keyed by prop name (see {@link ReactiveRule}).
+ *
+ * The type alias and the Zod schema deliberately share the identifier `SduiNode` —
+ * TypeScript's declaration-merging rules allow a `type` and a `const` of the same name
+ * to coexist. The recursive schema is built with {@link z.lazy} so unknown primitives
+ * are rejected at any depth of the tree.
+ */
+type SduiNode = {
+    type: z.infer<typeof PrimitiveName>;
+    props?: Record<string, unknown>;
+    children?: SduiNode[];
+    bindings?: Record<string, z.infer<typeof ReactiveRule>>;
+};
+/**
+ * Recursive Zod schema for {@link SduiNode}.
+ *
+ * Validates the full tree: an unknown primitive at any depth fails the parse. `props`
+ * and `bindings` are permissive on the value side (props: `unknown`, bindings: a
+ * {@link ReactiveRule}) — the host owns prop semantics per primitive.
+ */
+declare const SduiNode: z.ZodType<SduiNode>;
+
+/**
+ * A single design-token category: a map of token name -> CSS value.
+ *
+ * The host owns the exact set of token names per category. At the protocol level we only
+ * enforce that values are strings; the schema deliberately admits an empty category so
+ * plugins can omit any category they do not care about.
+ */
+declare const TokenCategory: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+type TokenCategory = z.infer<typeof TokenCategory>;
+/**
+ * The full token tree exchanged between host and plugin.
+ *
+ * Eight core categories carry the surface-level design language; six extended categories
+ * supply interaction-specific tokens (focus rings, overlays, dividers, shadows, inputs).
+ *
+ * Each category defaults to an empty record, mirroring the host-side `BridgeThemeTokens`
+ * shape in `sdk/app-bridge`.
+ */
+declare const BridgeThemeTokens: z.ZodObject<{
+    brand: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    background: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    text: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    status: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    border: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    radius: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    spacing: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    typography: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    focus: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    interaction: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    overlay: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    divider: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    shadow: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    input: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, "strip", z.ZodTypeAny, {
+    status: Record<string, string>;
+    brand: Record<string, string>;
+    background: Record<string, string>;
+    text: Record<string, string>;
+    border: Record<string, string>;
+    radius: Record<string, string>;
+    spacing: Record<string, string>;
+    typography: Record<string, string>;
+    focus: Record<string, string>;
+    interaction: Record<string, string>;
+    overlay: Record<string, string>;
+    divider: Record<string, string>;
+    shadow: Record<string, string>;
+    input: Record<string, string>;
+}, {
+    status?: Record<string, string> | undefined;
+    brand?: Record<string, string> | undefined;
+    background?: Record<string, string> | undefined;
+    text?: Record<string, string> | undefined;
+    border?: Record<string, string> | undefined;
+    radius?: Record<string, string> | undefined;
+    spacing?: Record<string, string> | undefined;
+    typography?: Record<string, string> | undefined;
+    focus?: Record<string, string> | undefined;
+    interaction?: Record<string, string> | undefined;
+    overlay?: Record<string, string> | undefined;
+    divider?: Record<string, string> | undefined;
+    shadow?: Record<string, string> | undefined;
+    input?: Record<string, string> | undefined;
+}>;
+type BridgeThemeTokens = z.infer<typeof BridgeThemeTokens>;
+/**
+ * Color scheme reported by the host. The plugin must subscribe to `onThemeChange`; the
+ * user can toggle modes at runtime without a route change.
+ */
+declare const BridgeThemeMode: z.ZodEnum<["light", "dark"]>;
+type BridgeThemeMode = z.infer<typeof BridgeThemeMode>;
+/**
+ * Accessibility signals piggy-backed on the theme payload.
+ *
+ * - `highContrast`: viewer has enabled the OS-level high-contrast preference.
+ * - `reducedMotion`: viewer has enabled the OS-level reduced-motion preference. Animation
+ *   tokens should be disabled or shortened when this is `true`.
+ */
+declare const BridgeThemeAccessibility: z.ZodObject<{
+    highContrast: z.ZodBoolean;
+    reducedMotion: z.ZodBoolean;
+}, "strip", z.ZodTypeAny, {
+    highContrast: boolean;
+    reducedMotion: boolean;
+}, {
+    highContrast: boolean;
+    reducedMotion: boolean;
+}>;
+type BridgeThemeAccessibility = z.infer<typeof BridgeThemeAccessibility>;
+/**
+ * The full theme payload delivered to a plugin surface.
+ *
+ * - `tokenVersion`: semantic version of the host's token schema. Plugins compare this
+ *   against their `Manifest.TokenVersion` to detect incompatibilities at boot.
+ * - `mode`: current color scheme.
+ * - `accessibility`: viewer accessibility preferences.
+ * - `tokens`: full 14-category token tree.
+ */
+declare const BridgeTheme: z.ZodObject<{
+    tokenVersion: z.ZodString;
+    mode: z.ZodEnum<["light", "dark"]>;
+    accessibility: z.ZodObject<{
+        highContrast: z.ZodBoolean;
+        reducedMotion: z.ZodBoolean;
+    }, "strip", z.ZodTypeAny, {
+        highContrast: boolean;
+        reducedMotion: boolean;
+    }, {
+        highContrast: boolean;
+        reducedMotion: boolean;
+    }>;
+    tokens: z.ZodObject<{
+        brand: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        background: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        text: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        status: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        border: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        radius: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        spacing: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        typography: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        focus: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        interaction: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        overlay: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        divider: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        shadow: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        input: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+        status: Record<string, string>;
+        brand: Record<string, string>;
+        background: Record<string, string>;
+        text: Record<string, string>;
+        border: Record<string, string>;
+        radius: Record<string, string>;
+        spacing: Record<string, string>;
+        typography: Record<string, string>;
+        focus: Record<string, string>;
+        interaction: Record<string, string>;
+        overlay: Record<string, string>;
+        divider: Record<string, string>;
+        shadow: Record<string, string>;
+        input: Record<string, string>;
+    }, {
+        status?: Record<string, string> | undefined;
+        brand?: Record<string, string> | undefined;
+        background?: Record<string, string> | undefined;
+        text?: Record<string, string> | undefined;
+        border?: Record<string, string> | undefined;
+        radius?: Record<string, string> | undefined;
+        spacing?: Record<string, string> | undefined;
+        typography?: Record<string, string> | undefined;
+        focus?: Record<string, string> | undefined;
+        interaction?: Record<string, string> | undefined;
+        overlay?: Record<string, string> | undefined;
+        divider?: Record<string, string> | undefined;
+        shadow?: Record<string, string> | undefined;
+        input?: Record<string, string> | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    tokenVersion: string;
+    mode: "light" | "dark";
+    accessibility: {
+        highContrast: boolean;
+        reducedMotion: boolean;
+    };
+    tokens: {
+        status: Record<string, string>;
+        brand: Record<string, string>;
+        background: Record<string, string>;
+        text: Record<string, string>;
+        border: Record<string, string>;
+        radius: Record<string, string>;
+        spacing: Record<string, string>;
+        typography: Record<string, string>;
+        focus: Record<string, string>;
+        interaction: Record<string, string>;
+        overlay: Record<string, string>;
+        divider: Record<string, string>;
+        shadow: Record<string, string>;
+        input: Record<string, string>;
+    };
+}, {
+    tokenVersion: string;
+    mode: "light" | "dark";
+    accessibility: {
+        highContrast: boolean;
+        reducedMotion: boolean;
+    };
+    tokens: {
+        status?: Record<string, string> | undefined;
+        brand?: Record<string, string> | undefined;
+        background?: Record<string, string> | undefined;
+        text?: Record<string, string> | undefined;
+        border?: Record<string, string> | undefined;
+        radius?: Record<string, string> | undefined;
+        spacing?: Record<string, string> | undefined;
+        typography?: Record<string, string> | undefined;
+        focus?: Record<string, string> | undefined;
+        interaction?: Record<string, string> | undefined;
+        overlay?: Record<string, string> | undefined;
+        divider?: Record<string, string> | undefined;
+        shadow?: Record<string, string> | undefined;
+        input?: Record<string, string> | undefined;
+    };
+}>;
+type BridgeTheme = z.infer<typeof BridgeTheme>;
+
+/**
+ * Tool permission flags. Bit values mirror the C# `EthisysCore.Protocol.Security.ToolPermission`
+ * enum verbatim — these integers are part of the wire contract and must stay in sync.
+ *
+ * @remarks
+ * Combine atomic flags with bitwise OR (e.g. `ToolPermission.View | ToolPermission.Read`)
+ * and test membership with {@link hasPermission}. The composite values (`ReaderAccess`,
+ * `ContributorAccess`, `OwnerAccess`) are convenience aliases for the most common
+ * combinations.
+ */
+declare const ToolPermission: {
+    /** No permissions required. */
+    readonly None: 0;
+    /** Permission to assign resources or roles. */
+    readonly Assign: number;
+    /** Permission to view resources in a summary or listing context. */
+    readonly View: number;
+    /** Permission to delete resources. */
+    readonly Delete: number;
+    /** Permission to create or modify resources. Default for tools. */
+    readonly Write: number;
+    /** Permission to read detailed resource content. */
+    readonly Read: number;
+    /** Permission to approve workflows or submissions. */
+    readonly Approve: number;
+    /** Permission to publish resources globally across tenants. */
+    readonly PublishGlobal: number;
+    /** Composite: `View | Read` (18). */
+    readonly ReaderAccess: number;
+    /** Composite: `View | Write | Read` (26). */
+    readonly ContributorAccess: number;
+    /** Composite: all atomic permissions combined (127). */
+    readonly OwnerAccess: number;
+};
+type ToolPermission = (typeof ToolPermission)[keyof typeof ToolPermission];
+/**
+ * Returns `true` when `set` contains every bit in `required`.
+ *
+ * Semantics match the C# `HasFlag` behaviour: a required mask with multiple bits demands
+ * that all of them are present in the granted set, not just any one of them.
+ */
+declare function hasPermission(set: number, required: number): boolean;
+/**
+ * Runtime validator for a serialized `ToolPermission` value. Accepts a non-negative
+ * **signed 32-bit** integer (0..0x7FFFFFFF) because:
+ *
+ *   1. The C# `ToolPermission` enum's underlying type is `int` (signed 32-bit). Values
+ *      outside that range have no in-protocol representation.
+ *   2. `hasPermission` performs `set & required` — JavaScript's bitwise `&` coerces both
+ *      operands to signed 32-bit, so values at or above 0x80000000 silently overflow
+ *      (the high bit becomes the sign bit). A schema that accepted them would let an
+ *      out-of-range manifest validate while `hasPermission` returned nonsense.
+ *
+ * Callers may still combine atomic flags into composites the protocol has not named
+ * (e.g. `Write | Approve`) — any combination of the currently-defined bits fits inside
+ * the 32-bit signed range with margin.
+ */
+declare const ToolPermissionFlags: z.ZodNumber;
+type ToolPermissionFlags = z.infer<typeof ToolPermissionFlags>;
+
+/**
+ * Audience claim pinned to the CoreConnect MCP boundary.
+ *
+ * Capability tokens are minted by the Api for a single audience. The literal type prevents
+ * accidental cross-audience reuse at parse time; cryptographic verification happens in the
+ * Api layer, not here.
+ */
+declare const CapabilityTokenAudience: z.ZodLiteral<"coreconnect-mcp">;
+type CapabilityTokenAudience = z.infer<typeof CapabilityTokenAudience>;
+/**
+ * Surface taxonomy that the capability token is bound to.
+ *
+ * - `page` — a top-level routed surface inside an extension.
+ * - `dialog` — modal dialog opened over the host.
+ * - `panel` — non-modal side panel.
+ * - `portal` — a contribution rendered into a host-owned slot (sidebar, header, etc.).
+ *
+ * @remarks
+ * Distinct from the manifest-level `SurfaceType` enum: that enum describes how a plugin
+ * *declares* a surface contribution, whereas this enum describes *which* surface a runtime
+ * capability token is bound to at invocation time.
+ */
+declare const CapabilityTokenSurfaceKind: z.ZodEnum<["page", "dialog", "panel", "portal"]>;
+type CapabilityTokenSurfaceKind = z.infer<typeof CapabilityTokenSurfaceKind>;
+/**
+ * Runtime implementation the surface is being rendered under.
+ *
+ * - `host-rendered` — host application renders the surface from a declarative description.
+ * - `worker-remote-dom` — plugin ships a remote runtime hosted in a Web Worker /
+ *   isolation boundary, communicating with the host via remote-DOM.
+ * - `first-party-host-extension` — plugin is bundled with the host and shares its runtime.
+ *
+ * @remarks
+ * `worker-remote-dom` is the runtime-level analogue of the manifest's `remote-runtime`
+ * `RenderMode`. The names diverge intentionally: the manifest declares an intent
+ * (RenderMode.RemoteRuntime), and the token records the concrete runtime the host chose
+ * to honour it with.
+ */
+declare const CapabilityTokenRuntimeImplementation: z.ZodEnum<["host-rendered", "worker-remote-dom", "first-party-host-extension"]>;
+type CapabilityTokenRuntimeImplementation = z.infer<typeof CapabilityTokenRuntimeImplementation>;
+/**
+ * Claim shape for a CoreConnect capability token.
+ *
+ * The schema enforces structural validity only — cryptographic signature verification,
+ * issuer trust, and expiry enforcement live in the Api. JWT registered claims (`iss`,
+ * `sub`, `aud`, `iat`, `exp`, `jti`) are kept in their canonical lower-case form; the
+ * tenancy + surface claims use snake_case to match how the Api emits them on the wire.
+ *
+ * Tightenings (beyond the bare JWT shape):
+ *
+ * - All required string claims are `.min(1)` — empty `tenant_id` / `extension_id` / `jti`
+ *   etc. are not meaningful tenancy values and must be rejected at parse time, not at
+ *   downstream rendering.
+ * - `org_id`, `tenant_id`, `user_id`, `extension_id`, and `surface_instance_id` are
+ *   contractually UUIDs — `.uuid()` rejects free-form identifiers before they reach the
+ *   tenant boundary.
+ * - `iat` / `exp` are Unix seconds; non-negative integers only. A `.refine()` then asserts
+ *   `exp > iat` so a token cannot validate with an expiry at-or-before its issuance.
+ *
+ * Cryptographic verification continues to be the Api's responsibility — these rules cover
+ * the structural plane.
+ */
+declare const CapabilityTokenClaims: z.ZodEffects<z.ZodObject<{
+    /** JWT issuer (`iss`) — the Api endpoint that minted the token. */
+    iss: z.ZodString;
+    /** JWT subject (`sub`) — typically the acting user principal. */
+    sub: z.ZodString;
+    /** JWT audience (`aud`) — pinned to the MCP boundary. */
+    aud: z.ZodLiteral<"coreconnect-mcp">;
+    /** JWT issued-at (`iat`) — Unix seconds, non-negative. */
+    iat: z.ZodNumber;
+    /** JWT expiry (`exp`) — Unix seconds, non-negative. */
+    exp: z.ZodNumber;
+    /** Organisation the surface is scoped to. */
+    org_id: z.ZodString;
+    /** Tenant the surface is scoped to within the organisation. */
+    tenant_id: z.ZodString;
+    /** Acting user principal. */
+    user_id: z.ZodString;
+    /** Identifier of the extension that owns the surface. */
+    extension_id: z.ZodString;
+    /** Specific version of the extension currently rendered. */
+    extension_version: z.ZodString;
+    /** Stable identifier of the surface instance (per open dialog/page). */
+    surface_instance_id: z.ZodString;
+    /** Taxonomic kind of the surface this token is bound to. */
+    surface_kind: z.ZodEnum<["page", "dialog", "panel", "portal"]>;
+    /** Runtime implementation rendering the surface. */
+    runtime_implementation: z.ZodEnum<["host-rendered", "worker-remote-dom", "first-party-host-extension"]>;
+    /** JWT identifier (`jti`) — unique per token, supports replay detection. */
+    jti: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    iss: string;
+    sub: string;
+    aud: "coreconnect-mcp";
+    iat: number;
+    exp: number;
+    org_id: string;
+    tenant_id: string;
+    user_id: string;
+    extension_id: string;
+    extension_version: string;
+    surface_instance_id: string;
+    surface_kind: "page" | "dialog" | "panel" | "portal";
+    runtime_implementation: "host-rendered" | "first-party-host-extension" | "worker-remote-dom";
+    jti: string;
+}, {
+    iss: string;
+    sub: string;
+    aud: "coreconnect-mcp";
+    iat: number;
+    exp: number;
+    org_id: string;
+    tenant_id: string;
+    user_id: string;
+    extension_id: string;
+    extension_version: string;
+    surface_instance_id: string;
+    surface_kind: "page" | "dialog" | "panel" | "portal";
+    runtime_implementation: "host-rendered" | "first-party-host-extension" | "worker-remote-dom";
+    jti: string;
+}>, {
+    iss: string;
+    sub: string;
+    aud: "coreconnect-mcp";
+    iat: number;
+    exp: number;
+    org_id: string;
+    tenant_id: string;
+    user_id: string;
+    extension_id: string;
+    extension_version: string;
+    surface_instance_id: string;
+    surface_kind: "page" | "dialog" | "panel" | "portal";
+    runtime_implementation: "host-rendered" | "first-party-host-extension" | "worker-remote-dom";
+    jti: string;
+}, {
+    iss: string;
+    sub: string;
+    aud: "coreconnect-mcp";
+    iat: number;
+    exp: number;
+    org_id: string;
+    tenant_id: string;
+    user_id: string;
+    extension_id: string;
+    extension_version: string;
+    surface_instance_id: string;
+    surface_kind: "page" | "dialog" | "panel" | "portal";
+    runtime_implementation: "host-rendered" | "first-party-host-extension" | "worker-remote-dom";
+    jti: string;
+}>;
+type CapabilityTokenClaims = z.infer<typeof CapabilityTokenClaims>;
+
+declare const PROTOCOL_PACKAGE = "@ethisyscore/protocol";
+
+export { BRIDGE_VERSION, BridgeTheme, BridgeThemeAccessibility, BridgeThemeMode, BridgeThemeTokens, type BridgeVersion, CapabilityTokenAudience, CapabilityTokenClaims, CapabilityTokenRuntimeImplementation, CapabilityTokenSurfaceKind, type Expr, type ExprObject, HostSlot, KNOWN_OPERATORS, KNOWN_PRIMITIVES, KNOWN_RULE_KINDS, KNOWN_SLOTS, type LiteralValue, type OperatorName, PROTOCOL_PACKAGE, PluginManifest, PluginType, PluginUi, PortalContribution, PrimitiveName, ReactiveRule, RenderMode, RuleKind, SduiNode, TokenCategory, ToolPermission, ToolPermissionFlags, hasPermission };