@fabricorg/assembly 0.4.0 → 0.4.1

package/dist/index.d.cts

@@ -1,3 +1,4 @@
+import { RegisteredAdapter, AdapterCertification } from '@fabricorg/ports';
 import { AdoptionBinding, BindingFinding, ComponentPackManifest } from '@fabricorg/adoption-bindings';
 import { UsageContractDocument, UsageContract } from '@fabricorg/gen-capability';
 
@@ -76,6 +77,20 @@ interface AssemblyContractEntry {
     namespace: string;
     document: UsageContractDocument;
 }
+/**
+ * An adapter the vertical deploys behind a port, with the certification the
+ * port's suite issued. Structurally the output of `certifyAdapter`, so a
+ * vertical passes that straight in. Without a certification the adapter is a
+ * claim, and resolution refuses it for any port a contract requires.
+ */
+interface AssemblyAdapterEntry extends RegisteredAdapter {
+    certification?: AdapterCertification;
+}
+/** A port contract in force, so a certification against an older contract is stale. */
+interface AssemblyPortDefinition {
+    id: string;
+    version: string;
+}
 /**
  * What a vertical assembles: the capabilities it depends on, the component
  * packs it uses, the adoption bindings it declares, and the usage contracts
@@ -90,6 +105,14 @@ interface AssemblyManifest {
     componentPacks: AssemblyComponentPackReference[];
     bindings: AssemblyBindingEntry[];
     contracts: AssemblyContractEntry[];
+    /**
+     * Adapters deployed behind the ports the contracts require. Declaring the
+     * field, even empty, engages the adapter plane: every port a contract
+     * requires must then be satisfied by a certified adapter listed here, or
+     * the assembly does not resolve. An assembly that does not declare it
+     * resolves as before, with port satisfaction as a separate deployment gate.
+     */
+    adapters?: AssemblyAdapterEntry[];
 }
 /** A published capability version available for resolution. */
 interface AvailableCapability {
@@ -148,6 +171,27 @@ interface ResolvedBinding {
     valid: boolean;
     findings: BindingFinding[];
 }
+/**
+ * A certified adapter locked into the assembly. The certification itself is
+ * summarised by digest so the lockfile stays small and the evidence stays
+ * verifiable: the same certification produces the same digest.
+ */
+interface ResolvedAdapter {
+    port: string;
+    vendor: string;
+    version?: string;
+    standard?: {
+        name: string;
+        version?: string;
+    };
+    /** Whether a certification was declared. An uncertified adapter is recorded so the lockfile says what is deployed, and refused wherever a contract requires its port. */
+    certified: boolean;
+    /** Port contract version the adapter was certified against. */
+    portVersion?: string;
+    certifiedAt?: string;
+    /** SHA-256 of the whole canonical certification record. */
+    certificationDigest?: string;
+}
 /**
  * The deterministic, resolved output of assembling a vertical. Every version
  * is locked, every binding is validated, and the whole document carries a
@@ -161,8 +205,10 @@ interface AssemblyLockfile {
     capabilities: ResolvedCapability[];
     componentPacks: ResolvedComponentPack[];
     bindings: ResolvedBinding[];
+    /** Present when the manifest declared adapters; covered by the digest. */
+    adapters?: ResolvedAdapter[];
 }
-type AssemblyFindingCode = "duplicate_capability" | "duplicate_component_pack" | "unresolved_capability" | "unresolved_component_pack" | "invalid_range" | "unknown_contract_for_binding" | "contract_namespace_mismatch" | "contract_manifest_digest_mismatch" | "binding_validation_failed" | "invalid_contract" | "invalid_component_pack" | "missing_component_pack_manifest" | "component_pack_artifact_digest_mismatch" | "duplicate_contract";
+type AssemblyFindingCode = "duplicate_capability" | "duplicate_component_pack" | "unresolved_capability" | "unresolved_component_pack" | "invalid_range" | "unknown_contract_for_binding" | "contract_namespace_mismatch" | "contract_manifest_digest_mismatch" | "binding_validation_failed" | "invalid_contract" | "invalid_component_pack" | "missing_component_pack_manifest" | "component_pack_artifact_digest_mismatch" | "duplicate_contract" | "duplicate_adapter" | "unsatisfied_port" | "standard_not_spoken" | "version_mismatch" | "uncertified_adapter" | "stale_certification";
 interface AssemblyFinding {
     code: AssemblyFindingCode;
     path: string;
@@ -184,6 +230,8 @@ declare function computeUsageContractDocumentDigest(document: UsageContractDocum
  * digest it was validated against.
  */
 declare function computeAssemblyLockfileDigest(lockfile: Omit<AssemblyLockfile, "assemblyDigest">): string;
+/** The digest a certification record locks under: the whole record, keys sorted, checks sorted. */
+declare function computeAdapterCertificationDigest(certification: AdapterCertification): string;
 /**
  * Structural validation of an assembly manifest. Checks the document's own
  * shape; does not resolve ranges or validate contracts/bindings.
@@ -202,7 +250,15 @@ declare function assertAssemblyLockfile(value: unknown, path?: string): asserts
  * Verify that the capability artifacts loaded by a runtime are exactly those
  * approved by an integrity-checked assembly lockfile.
  */
-declare function assertAssemblyRuntimeCompatible(lockfile: AssemblyLockfile, loadedCapabilities: readonly AvailableCapability[]): void;
+declare function assertAssemblyRuntimeCompatible(lockfile: AssemblyLockfile, loadedCapabilities: readonly AvailableCapability[], 
+/**
+ * The adapters this runtime registered, when the lockfile carries an
+ * adapter plane. Every locked certified adapter must be registered under
+ * the same port and vendor with the same certification, and a registered
+ * adapter the lockfile does not know is refused, so what runs behind a
+ * port is what was approved.
+ */
+registeredAdapters?: readonly AssemblyAdapterEntry[]): void;
 interface ResolveAssemblyInput {
     manifest: AssemblyManifest;
     /** Published capability versions available for resolution. */
@@ -215,6 +271,12 @@ interface ResolveAssemblyInput {
     coreComponents?: readonly string[];
     /** Contracts available for cross-capability fragment resolution. */
     availableContracts?: UsageContract[];
+    /**
+     * Port contracts in force. With them, a certification issued against an
+     * older port version is `stale_certification`; without them, only its
+     * presence is checked.
+     */
+    portDefinitions?: readonly AssemblyPortDefinition[];
 }
 /**
  * Resolve an assembly manifest into a deterministic lockfile. This is the
@@ -245,4 +307,4 @@ declare function validateAssemblyBindings(input: {
     availableContracts?: UsageContract[];
 }): AssemblyResult;
 
-export { ASSEMBLY_LOCKFILE_FORMAT_VERSION, ASSEMBLY_MANIFEST_FORMAT_VERSION, type AssemblyBindingEntry, type AssemblyCapabilityReference, type AssemblyComponentPackReference, type AssemblyContractEntry, type AssemblyFinding, type AssemblyFindingCode, type AssemblyLockfile, type AssemblyManifest, type AssemblyResult, type AvailableCapability, type AvailableComponentPack, type ComponentPackRemote, type ResolveAssemblyInput, type ResolvedBinding, type ResolvedCapability, type ResolvedComponentPack, type SemverRange, assertAssemblyLockfile, assertAssemblyManifest, assertAssemblyResolved, assertAssemblyRuntimeCompatible, assertComponentPackManifest, computeAssemblyLockfileDigest, computeUsageContractDocumentDigest, parseSemverRange, resolveAssembly, resolveVersionRange, satisfiesRange, validateAssemblyBindings };
+export { ASSEMBLY_LOCKFILE_FORMAT_VERSION, ASSEMBLY_MANIFEST_FORMAT_VERSION, type AssemblyAdapterEntry, type AssemblyBindingEntry, type AssemblyCapabilityReference, type AssemblyComponentPackReference, type AssemblyContractEntry, type AssemblyFinding, type AssemblyFindingCode, type AssemblyLockfile, type AssemblyManifest, type AssemblyPortDefinition, type AssemblyResult, type AvailableCapability, type AvailableComponentPack, type ComponentPackRemote, type ResolveAssemblyInput, type ResolvedAdapter, type ResolvedBinding, type ResolvedCapability, type ResolvedComponentPack, type SemverRange, assertAssemblyLockfile, assertAssemblyManifest, assertAssemblyResolved, assertAssemblyRuntimeCompatible, assertComponentPackManifest, computeAdapterCertificationDigest, computeAssemblyLockfileDigest, computeUsageContractDocumentDigest, parseSemverRange, resolveAssembly, resolveVersionRange, satisfiesRange, validateAssemblyBindings };

package/dist/index.d.ts

@@ -1,3 +1,4 @@
+import { RegisteredAdapter, AdapterCertification } from '@fabricorg/ports';
 import { AdoptionBinding, BindingFinding, ComponentPackManifest } from '@fabricorg/adoption-bindings';
 import { UsageContractDocument, UsageContract } from '@fabricorg/gen-capability';
 
@@ -76,6 +77,20 @@ interface AssemblyContractEntry {
     namespace: string;
     document: UsageContractDocument;
 }
+/**
+ * An adapter the vertical deploys behind a port, with the certification the
+ * port's suite issued. Structurally the output of `certifyAdapter`, so a
+ * vertical passes that straight in. Without a certification the adapter is a
+ * claim, and resolution refuses it for any port a contract requires.
+ */
+interface AssemblyAdapterEntry extends RegisteredAdapter {
+    certification?: AdapterCertification;
+}
+/** A port contract in force, so a certification against an older contract is stale. */
+interface AssemblyPortDefinition {
+    id: string;
+    version: string;
+}
 /**
  * What a vertical assembles: the capabilities it depends on, the component
  * packs it uses, the adoption bindings it declares, and the usage contracts
@@ -90,6 +105,14 @@ interface AssemblyManifest {
     componentPacks: AssemblyComponentPackReference[];
     bindings: AssemblyBindingEntry[];
     contracts: AssemblyContractEntry[];
+    /**
+     * Adapters deployed behind the ports the contracts require. Declaring the
+     * field, even empty, engages the adapter plane: every port a contract
+     * requires must then be satisfied by a certified adapter listed here, or
+     * the assembly does not resolve. An assembly that does not declare it
+     * resolves as before, with port satisfaction as a separate deployment gate.
+     */
+    adapters?: AssemblyAdapterEntry[];
 }
 /** A published capability version available for resolution. */
 interface AvailableCapability {
@@ -148,6 +171,27 @@ interface ResolvedBinding {
     valid: boolean;
     findings: BindingFinding[];
 }
+/**
+ * A certified adapter locked into the assembly. The certification itself is
+ * summarised by digest so the lockfile stays small and the evidence stays
+ * verifiable: the same certification produces the same digest.
+ */
+interface ResolvedAdapter {
+    port: string;
+    vendor: string;
+    version?: string;
+    standard?: {
+        name: string;
+        version?: string;
+    };
+    /** Whether a certification was declared. An uncertified adapter is recorded so the lockfile says what is deployed, and refused wherever a contract requires its port. */
+    certified: boolean;
+    /** Port contract version the adapter was certified against. */
+    portVersion?: string;
+    certifiedAt?: string;
+    /** SHA-256 of the whole canonical certification record. */
+    certificationDigest?: string;
+}
 /**
  * The deterministic, resolved output of assembling a vertical. Every version
  * is locked, every binding is validated, and the whole document carries a
@@ -161,8 +205,10 @@ interface AssemblyLockfile {
     capabilities: ResolvedCapability[];
     componentPacks: ResolvedComponentPack[];
     bindings: ResolvedBinding[];
+    /** Present when the manifest declared adapters; covered by the digest. */
+    adapters?: ResolvedAdapter[];
 }
-type AssemblyFindingCode = "duplicate_capability" | "duplicate_component_pack" | "unresolved_capability" | "unresolved_component_pack" | "invalid_range" | "unknown_contract_for_binding" | "contract_namespace_mismatch" | "contract_manifest_digest_mismatch" | "binding_validation_failed" | "invalid_contract" | "invalid_component_pack" | "missing_component_pack_manifest" | "component_pack_artifact_digest_mismatch" | "duplicate_contract";
+type AssemblyFindingCode = "duplicate_capability" | "duplicate_component_pack" | "unresolved_capability" | "unresolved_component_pack" | "invalid_range" | "unknown_contract_for_binding" | "contract_namespace_mismatch" | "contract_manifest_digest_mismatch" | "binding_validation_failed" | "invalid_contract" | "invalid_component_pack" | "missing_component_pack_manifest" | "component_pack_artifact_digest_mismatch" | "duplicate_contract" | "duplicate_adapter" | "unsatisfied_port" | "standard_not_spoken" | "version_mismatch" | "uncertified_adapter" | "stale_certification";
 interface AssemblyFinding {
     code: AssemblyFindingCode;
     path: string;
@@ -184,6 +230,8 @@ declare function computeUsageContractDocumentDigest(document: UsageContractDocum
  * digest it was validated against.
  */
 declare function computeAssemblyLockfileDigest(lockfile: Omit<AssemblyLockfile, "assemblyDigest">): string;
+/** The digest a certification record locks under: the whole record, keys sorted, checks sorted. */
+declare function computeAdapterCertificationDigest(certification: AdapterCertification): string;
 /**
  * Structural validation of an assembly manifest. Checks the document's own
  * shape; does not resolve ranges or validate contracts/bindings.
@@ -202,7 +250,15 @@ declare function assertAssemblyLockfile(value: unknown, path?: string): asserts
  * Verify that the capability artifacts loaded by a runtime are exactly those
  * approved by an integrity-checked assembly lockfile.
  */
-declare function assertAssemblyRuntimeCompatible(lockfile: AssemblyLockfile, loadedCapabilities: readonly AvailableCapability[]): void;
+declare function assertAssemblyRuntimeCompatible(lockfile: AssemblyLockfile, loadedCapabilities: readonly AvailableCapability[], 
+/**
+ * The adapters this runtime registered, when the lockfile carries an
+ * adapter plane. Every locked certified adapter must be registered under
+ * the same port and vendor with the same certification, and a registered
+ * adapter the lockfile does not know is refused, so what runs behind a
+ * port is what was approved.
+ */
+registeredAdapters?: readonly AssemblyAdapterEntry[]): void;
 interface ResolveAssemblyInput {
     manifest: AssemblyManifest;
     /** Published capability versions available for resolution. */
@@ -215,6 +271,12 @@ interface ResolveAssemblyInput {
     coreComponents?: readonly string[];
     /** Contracts available for cross-capability fragment resolution. */
     availableContracts?: UsageContract[];
+    /**
+     * Port contracts in force. With them, a certification issued against an
+     * older port version is `stale_certification`; without them, only its
+     * presence is checked.
+     */
+    portDefinitions?: readonly AssemblyPortDefinition[];
 }
 /**
  * Resolve an assembly manifest into a deterministic lockfile. This is the
@@ -245,4 +307,4 @@ declare function validateAssemblyBindings(input: {
     availableContracts?: UsageContract[];
 }): AssemblyResult;
 
-export { ASSEMBLY_LOCKFILE_FORMAT_VERSION, ASSEMBLY_MANIFEST_FORMAT_VERSION, type AssemblyBindingEntry, type AssemblyCapabilityReference, type AssemblyComponentPackReference, type AssemblyContractEntry, type AssemblyFinding, type AssemblyFindingCode, type AssemblyLockfile, type AssemblyManifest, type AssemblyResult, type AvailableCapability, type AvailableComponentPack, type ComponentPackRemote, type ResolveAssemblyInput, type ResolvedBinding, type ResolvedCapability, type ResolvedComponentPack, type SemverRange, assertAssemblyLockfile, assertAssemblyManifest, assertAssemblyResolved, assertAssemblyRuntimeCompatible, assertComponentPackManifest, computeAssemblyLockfileDigest, computeUsageContractDocumentDigest, parseSemverRange, resolveAssembly, resolveVersionRange, satisfiesRange, validateAssemblyBindings };
+export { ASSEMBLY_LOCKFILE_FORMAT_VERSION, ASSEMBLY_MANIFEST_FORMAT_VERSION, type AssemblyAdapterEntry, type AssemblyBindingEntry, type AssemblyCapabilityReference, type AssemblyComponentPackReference, type AssemblyContractEntry, type AssemblyFinding, type AssemblyFindingCode, type AssemblyLockfile, type AssemblyManifest, type AssemblyPortDefinition, type AssemblyResult, type AvailableCapability, type AvailableComponentPack, type ComponentPackRemote, type ResolveAssemblyInput, type ResolvedAdapter, type ResolvedBinding, type ResolvedCapability, type ResolvedComponentPack, type SemverRange, assertAssemblyLockfile, assertAssemblyManifest, assertAssemblyResolved, assertAssemblyRuntimeCompatible, assertComponentPackManifest, computeAdapterCertificationDigest, computeAssemblyLockfileDigest, computeUsageContractDocumentDigest, parseSemverRange, resolveAssembly, resolveVersionRange, satisfiesRange, validateAssemblyBindings };

package/dist/index.js

@@ -1,5 +1,6 @@
 // index.ts
 import { createHash } from "crypto";
+import { PORT_ID, validatePortRequirements } from "@fabricorg/ports";
 import {
   assertAdoptionBinding,
   assertBindingValid,
@@ -203,9 +204,15 @@ function lockfileDigestBody(lockfile) {
     application: lockfile.application,
     capabilities: lockfile.capabilities,
     componentPacks: lockfile.componentPacks,
-    bindings: lockfile.bindings
+    bindings: lockfile.bindings,
+    // Omitted when absent, so a lockfile from before the adapter plane
+    // keeps the digest it was approved with.
+    ...lockfile.adapters ? { adapters: lockfile.adapters } : {}
   };
 }
+function computeAdapterCertificationDigest(certification) {
+  return assemblyDigest({ ...certification, checks: [...certification.checks].sort() });
+}
 function fail(path, message) {
   throw new Error(`Assembly manifest ${path} ${message}.`);
 }
@@ -251,6 +258,42 @@ function assertAssemblyManifest(value, path = "assembly") {
       fail(`${path}.contracts[${index}].document`, error instanceof Error ? error.message : String(error));
     }
   });
+  if (manifest.adapters !== void 0) {
+    requireArray(manifest.adapters, `${path}.adapters`).forEach((entry, index) => {
+      assertAdapterEntry(entry, `${path}.adapters[${index}]`);
+    });
+  }
+}
+function assertAdapterEntry(value, path) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) fail(path, "must be an object");
+  const adapter = value;
+  requireString(adapter.port, `${path}.port`);
+  requireString(adapter.vendor, `${path}.vendor`);
+  if (adapter.version !== void 0) requireString(adapter.version, `${path}.version`);
+  if (adapter.standard !== void 0) {
+    const standard = adapter.standard;
+    if (!standard || typeof standard !== "object" || Array.isArray(standard)) fail(`${path}.standard`, "must be an object");
+    requireString(standard.name, `${path}.standard.name`);
+    if (standard.version !== void 0) requireString(standard.version, `${path}.standard.version`);
+  }
+  if (adapter.certification !== void 0) {
+    const certification = adapter.certification;
+    if (!certification || typeof certification !== "object" || Array.isArray(certification)) fail(`${path}.certification`, "must be an object");
+    requireString(certification.portId, `${path}.certification.portId`);
+    if (!/^\d+\.\d+\.\d+$/.test(requireString(certification.portVersion, `${path}.certification.portVersion`))) {
+      fail(`${path}.certification.portVersion`, "must be a semver version");
+    }
+    const checks = requireArray(certification.checks, `${path}.certification.checks`);
+    if (checks.length === 0 || !checks.every((check) => typeof check === "string" && check.trim())) {
+      fail(`${path}.certification.checks`, "must name at least one check");
+    }
+    if (Number.isNaN(Date.parse(requireString(certification.certifiedAt, `${path}.certification.certifiedAt`)))) {
+      fail(`${path}.certification.certifiedAt`, "must be an instant");
+    }
+    if (certification.portId !== adapter.port) {
+      fail(`${path}.certification.portId`, `must match the adapter's port "${String(adapter.port)}"`);
+    }
+  }
 }
 function assertComponentPackManifest(value, path = "pack") {
   if (!value || typeof value !== "object" || Array.isArray(value)) fail(path, "must be an object");
@@ -342,19 +385,77 @@ function assertAssemblyLockfile(value, path = "lockfile") {
     if (binding?.valid !== true) fail(`${path}.bindings[${index}].valid`, "must be true");
     requireArray(binding?.findings, `${path}.bindings[${index}].findings`);
   }
+  let adapters;
+  if (lockfile.adapters !== void 0) {
+    adapters = requireArray(lockfile.adapters, `${path}.adapters`);
+    const seen = /* @__PURE__ */ new Set();
+    for (const [index, entry] of adapters.entries()) {
+      const adapter = entry;
+      const port = requireString(adapter?.port, `${path}.adapters[${index}].port`);
+      const vendor = requireString(adapter?.vendor, `${path}.adapters[${index}].vendor`);
+      const key = `${port}/${vendor}`;
+      if (seen.has(key)) fail(`${path}.adapters[${index}]`, `declares adapter "${key}" a second time`);
+      seen.add(key);
+      if (adapter?.version !== void 0) requireString(adapter.version, `${path}.adapters[${index}].version`);
+      if (adapter?.standard !== void 0) {
+        const standard = adapter.standard;
+        if (!standard || typeof standard !== "object" || Array.isArray(standard)) fail(`${path}.adapters[${index}].standard`, "must be an object");
+        requireString(standard.name, `${path}.adapters[${index}].standard.name`);
+        if (standard.version !== void 0) requireString(standard.version, `${path}.adapters[${index}].standard.version`);
+      }
+      if (typeof adapter?.certified !== "boolean") fail(`${path}.adapters[${index}].certified`, "must be a boolean");
+      if (adapter.certified) {
+        if (!/^\d+\.\d+\.\d+$/.test(requireString(adapter?.portVersion, `${path}.adapters[${index}].portVersion`))) {
+          fail(`${path}.adapters[${index}].portVersion`, "must be a semver version");
+        }
+        if (Number.isNaN(Date.parse(requireString(adapter?.certifiedAt, `${path}.adapters[${index}].certifiedAt`)))) {
+          fail(`${path}.adapters[${index}].certifiedAt`, "must be an instant");
+        }
+        if (!/^[0-9a-f]{64}$/.test(requireString(adapter?.certificationDigest, `${path}.adapters[${index}].certificationDigest`))) {
+          fail(`${path}.adapters[${index}].certificationDigest`, "must be a lowercase SHA-256 digest");
+        }
+      } else if (adapter.portVersion !== void 0 || adapter.certifiedAt !== void 0 || adapter.certificationDigest !== void 0) {
+        fail(`${path}.adapters[${index}]`, "carries certification fields but is marked uncertified");
+      }
+    }
+  }
   const expected = assemblyDigest(lockfileDigestBody({
     formatVersion: ASSEMBLY_LOCKFILE_FORMAT_VERSION,
     application: lockfile.application,
     capabilities,
     componentPacks,
-    bindings
+    bindings,
+    ...adapters ? { adapters } : {}
   }));
   if (lockfile.assemblyDigest !== expected) {
     fail(`${path}.assemblyDigest`, `does not match resolved lockfile content; expected "${expected}"`);
   }
 }
-function assertAssemblyRuntimeCompatible(lockfile, loadedCapabilities) {
+function assertAssemblyRuntimeCompatible(lockfile, loadedCapabilities, registeredAdapters) {
   assertAssemblyLockfile(lockfile);
+  if (lockfile.adapters !== void 0 && registeredAdapters !== void 0) {
+    const registeredByKey = new Map(registeredAdapters.map((adapter) => [`${adapter.port}/${adapter.vendor}`, adapter]));
+    for (const approved of lockfile.adapters) {
+      const key = `${approved.port}/${approved.vendor}`;
+      const registered = registeredByKey.get(key);
+      if (!registered) throw new Error(`Approved adapter "${key}" is not registered by this runtime.`);
+      if (approved.version !== void 0 && registered.version !== approved.version) {
+        throw new Error(`Registered adapter "${key}" is version "${registered.version ?? "unversioned"}"; the assembly approved "${approved.version}".`);
+      }
+      if (approved.certified) {
+        const digest = registered.certification ? computeAdapterCertificationDigest(registered.certification) : void 0;
+        if (digest !== approved.certificationDigest) {
+          throw new Error(`Registered adapter "${key}" does not carry the certification the assembly approved (digest "${approved.certificationDigest}").`);
+        }
+      }
+    }
+    for (const registered of registeredAdapters) {
+      const key = `${registered.port}/${registered.vendor}`;
+      if (!lockfile.adapters.some((approved) => approved.port === registered.port && approved.vendor === registered.vendor)) {
+        throw new Error(`Registered adapter "${key}" is not approved by assembly "${lockfile.assemblyDigest}".`);
+      }
+    }
+  }
   const loadedByNamespace = /* @__PURE__ */ new Map();
   for (const loaded of loadedCapabilities) {
     if (loadedByNamespace.has(loaded.namespace)) {
@@ -559,6 +660,51 @@ function resolveAssembly(input) {
     }
     contractsByNamespace.set(entry.namespace, entry.document.capability);
   }
+  const resolvedAdapters = [];
+  const declaredAdapters = input.manifest.adapters ?? [];
+  const adapterKeys = /* @__PURE__ */ new Set();
+  for (const adapter of declaredAdapters) {
+    const key = `${adapter.port}/${adapter.vendor}`;
+    if (adapterKeys.has(key)) {
+      add("duplicate_adapter", `assembly.adapters.${key}`, `adapter "${key}" is declared a second time`);
+      continue;
+    }
+    adapterKeys.add(key);
+    resolvedAdapters.push({
+      port: adapter.port,
+      vendor: adapter.vendor,
+      ...adapter.version === void 0 ? {} : { version: adapter.version },
+      ...adapter.standard === void 0 ? {} : { standard: adapter.standard },
+      certified: adapter.certification !== void 0,
+      ...adapter.certification === void 0 ? {} : {
+        portVersion: adapter.certification.portVersion,
+        certifiedAt: adapter.certification.certifiedAt,
+        certificationDigest: computeAdapterCertificationDigest(adapter.certification)
+      }
+    });
+  }
+  const portDefinitions = (input.portDefinitions ?? []).map((definition, index) => {
+    if (typeof definition.id !== "string" || !PORT_ID.test(definition.id)) {
+      fail(`portDefinitions[${index}].id`, `must be a namespaced lowercase port id, received ${JSON.stringify(definition.id)}`);
+    }
+    if (typeof definition.version !== "string" || !/^\d+\.\d+\.\d+$/.test(definition.version)) {
+      fail(`portDefinitions[${index}].version`, `must be a semver version, received ${JSON.stringify(definition.version)}`);
+    }
+    return { id: definition.id, version: definition.version, description: "", checks: () => [] };
+  });
+  for (const [namespace, capability] of contractsByNamespace) {
+    if (input.manifest.adapters === void 0) break;
+    if (!capability.requirements?.ports?.length) continue;
+    const result = validatePortRequirements({
+      capability: { namespace, requirements: { ports: capability.requirements.ports } },
+      adapters: declaredAdapters,
+      definitions: portDefinitions,
+      requireCertification: true
+    });
+    for (const finding of result.findings) {
+      add(finding.code, `assembly.contracts.${namespace}.requirements.ports.${finding.port}`, finding.message);
+    }
+  }
   const resolvedBindings = [];
   for (const entry of input.manifest.bindings) {
     const contract = contractsByNamespace.get(entry.capability);
@@ -609,12 +755,17 @@ function resolveAssembly(input) {
   const bindings = [...resolvedBindings].sort(
     (a, b) => a.capability < b.capability ? -1 : a.capability > b.capability ? 1 : 0
   );
+  const adapters = input.manifest.adapters === void 0 ? void 0 : [...resolvedAdapters].sort((a, b) => {
+    const key = (e) => `${e.port}/${e.vendor}`;
+    return key(a) < key(b) ? -1 : key(a) > key(b) ? 1 : 0;
+  });
   const lockfileBody = {
     formatVersion: ASSEMBLY_LOCKFILE_FORMAT_VERSION,
     application: input.manifest.application,
     capabilities,
     componentPacks,
-    bindings
+    bindings,
+    ...adapters ? { adapters } : {}
   };
   const lockfile = {
     formatVersion: ASSEMBLY_LOCKFILE_FORMAT_VERSION,
@@ -622,7 +773,8 @@ function resolveAssembly(input) {
     assemblyDigest: assemblyDigest(lockfileDigestBody(lockfileBody)),
     capabilities,
     componentPacks,
-    bindings
+    bindings,
+    ...adapters ? { adapters } : {}
   };
   return {
     lockfile: findings.length === 0 ? lockfile : void 0,
@@ -697,6 +849,7 @@ export {
   assertAssemblyResolved,
   assertAssemblyRuntimeCompatible,
   assertComponentPackManifest,
+  computeAdapterCertificationDigest,
   computeAssemblyLockfileDigest,
   computeUsageContractDocumentDigest,
   parseSemverRange,