@hunsu/protocol-registry 0.1.0

package/LICENSE

@@ -0,0 +1,157 @@
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and
+distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by the copyright
+owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all other entities
+that control, are controlled by, or are under common control with that entity.
+For the purposes of this definition, "control" means (i) the power, direct or
+indirect, to cause the direction or management of such entity, whether by
+contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the
+outstanding shares, or (iii) beneficial ownership of such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising
+permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications, including
+but not limited to software source code, documentation source, and configuration
+files.
+
+"Object" form shall mean any form resulting from mechanical transformation or
+translation of a Source form, including but not limited to compiled object code,
+generated documentation, and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object form,
+made available under the License, as indicated by a copyright notice that is
+included in or attached to the work.
+
+"Derivative Works" shall mean any work, whether in Source or Object form, that
+is based on (or derived from) the Work and for which the editorial revisions,
+annotations, elaborations, or other modifications represent, as a whole, an
+original work of authorship. For the purposes of this License, Derivative Works
+shall not include works that remain separable from, or merely link (or bind by
+name) to the interfaces of, the Work and Derivative Works thereof.
+
+"Contribution" shall mean any work of authorship, including the original version
+of the Work and any modifications or additions to that Work or Derivative Works
+thereof, that is intentionally submitted to Licensor for inclusion in the Work by
+the copyright owner or by an individual or Legal Entity authorized to submit on
+behalf of the copyright owner. For the purposes of this definition, "submitted"
+means any form of electronic, verbal, or written communication sent to the
+Licensor or its representatives, including but not limited to communication on
+electronic mailing lists, source code control systems, and issue tracking systems
+that are managed by, or on behalf of, the Licensor for the purpose of discussing
+and improving the Work, but excluding communication that is conspicuously marked
+or otherwise designated in writing by the copyright owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity on behalf
+of whom a Contribution has been received by Licensor and subsequently
+incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of this
+License, each Contributor hereby grants to You a perpetual, worldwide,
+non-exclusive, no-charge, royalty-free, irrevocable copyright license to
+reproduce, prepare Derivative Works of, publicly display, publicly perform,
+sublicense, and distribute the Work and such Derivative Works in Source or
+Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of this License,
+each Contributor hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable (except as stated in this section) patent
+license to make, have made, use, offer to sell, sell, import, and otherwise
+transfer the Work, where such license applies only to those patent claims
+licensable by such Contributor that are necessarily infringed by their
+Contribution(s) alone or by combination of their Contribution(s) with the Work
+to which such Contribution(s) was submitted. If You institute patent litigation
+against any entity (including a cross-claim or counterclaim in a lawsuit)
+alleging that the Work or a Contribution incorporated within the Work
+constitutes direct or contributory patent infringement, then any patent licenses
+granted to You under this License for that Work shall terminate as of the date
+such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the Work or
+Derivative Works thereof in any medium, with or without modifications, and in
+Source or Object form, provided that You meet the following conditions:
+
+(a) You must give any other recipients of the Work or Derivative Works a copy of
+this License; and
+
+(b) You must cause any modified files to carry prominent notices stating that
+You changed the files; and
+
+(c) You must retain, in the Source form of any Derivative Works that You
+distribute, all copyright, patent, trademark, and attribution notices from the
+Source form of the Work, excluding those notices that do not pertain to any part
+of the Derivative Works; and
+
+(d) If the Work includes a "NOTICE" text file as part of its distribution, then
+any Derivative Works that You distribute must include a readable copy of the
+attribution notices contained within such NOTICE file, excluding those notices
+that do not pertain to any part of the Derivative Works, in at least one of the
+following places: within a NOTICE text file distributed as part of the Derivative
+Works; within the Source form or documentation, if provided along with the
+Derivative Works; or, within a display generated by the Derivative Works, if and
+wherever such third-party notices normally appear. The contents of the NOTICE
+file are for informational purposes only and do not modify the License. You may
+add Your own attribution notices within Derivative Works that You distribute,
+alongside or as an addendum to the NOTICE text from the Work, provided that such
+additional attribution notices cannot be construed as modifying the License.
+
+You may add Your own copyright statement to Your modifications and may provide
+additional or different license terms and conditions for use, reproduction, or
+distribution of Your modifications, or for any such Derivative Works as a whole,
+provided Your use, reproduction, and distribution of the Work otherwise complies
+with the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise, any
+Contribution intentionally submitted for inclusion in the Work by You to the
+Licensor shall be under the terms and conditions of this License, without any
+additional terms or conditions. Notwithstanding the above, nothing herein shall
+supersede or modify the terms of any separate license agreement you may have
+executed with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade names,
+trademarks, service marks, or product names of the Licensor, except as required
+for reasonable and customary use in describing the origin of the Work and
+reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or agreed to in
+writing, Licensor provides the Work (and each Contributor provides its
+Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied, including, without limitation, any warranties or
+conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+PARTICULAR PURPOSE. You are solely responsible for determining the
+appropriateness of using or redistributing the Work and assume any risks
+associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory, whether in
+tort (including negligence), contract, or otherwise, unless required by
+applicable law (such as deliberate and grossly negligent acts) or agreed to in
+writing, shall any Contributor be liable to You for damages, including any
+direct, indirect, special, incidental, or consequential damages of any character
+arising as a result of this License or out of the use or inability to use the
+Work (including but not limited to damages for loss of goodwill, work stoppage,
+computer failure or malfunction, or any and all other commercial damages or
+losses), even if such Contributor has been advised of the possibility of such
+damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing the Work or
+Derivative Works thereof, You may choose to offer, and charge a fee for,
+acceptance of support, warranty, indemnity, or other liability obligations
+and/or rights consistent with this License. However, in accepting such
+obligations, You may act only on Your own behalf and on Your sole
+responsibility, not on behalf of any other Contributor, and only if You agree to
+indemnify, defend, and hold each Contributor harmless for any liability incurred
+by, or claims asserted against, such Contributor by reason of your accepting any
+such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS

package/dist/index.d.ts

@@ -0,0 +1,88 @@
+import { type Harness, type HubPackageKind, type HubPackageLock, type HunsuOrigin, type ManagerConfig, type NonEmptyText, type MemberConfig, type SkillSnapshotFile } from "@hunsu/protocol";
+export type { HubPackageKind, HubPackageLock, HunsuOrigin } from "@hunsu/protocol";
+export declare const HUB_PACKAGE_MANIFEST_SCHEMA: "hunsu.hub-package-manifest.v1";
+export declare const MANIFEST_INTEGRITY_PREFIX_V1: "hunsu-json-c14n-v1+sha256:";
+export type TeamPackageManifest = {
+    schema: typeof HUB_PACKAGE_MANIFEST_SCHEMA;
+    kind: "team";
+    key: string;
+    version: string;
+    team: Harness;
+    integrity?: string;
+};
+export type MemberPackageManifest = {
+    schema: typeof HUB_PACKAGE_MANIFEST_SCHEMA;
+    kind: "member";
+    key: string;
+    version: string;
+    member: MemberConfig;
+    integrity?: string;
+};
+export type ManagerPackageManifest = {
+    schema: typeof HUB_PACKAGE_MANIFEST_SCHEMA;
+    kind: "manager";
+    key: string;
+    version: string;
+    manager: ManagerConfig;
+    integrity?: string;
+};
+export type SkillPackageManifest = {
+    schema: typeof HUB_PACKAGE_MANIFEST_SCHEMA;
+    kind: "skill";
+    key: string;
+    version: string;
+    skill: {
+        name: string;
+        contentHash: string;
+        files?: SkillSnapshotFile[];
+    };
+    integrity?: string;
+};
+export type HubPackageManifest = TeamPackageManifest | MemberPackageManifest | ManagerPackageManifest | SkillPackageManifest;
+export type HubPackageSummary = {
+    origin: string;
+    entryKind: "package" | "executor";
+    kind: HubPackageKind;
+    key: string;
+    version: string;
+    integrity: string;
+    label: string;
+    sourcePackageKind: HubPackageKind;
+    sourcePackageKey: string;
+    sourcePackageVersion: string;
+    executorId?: string;
+    memberOf?: string[];
+    promptTemplateEngine?: string;
+    memberCount?: number;
+    skillCount?: number;
+    pluginRequirementCount?: number;
+};
+export type HubPackageRef = {
+    origin: NonEmptyText;
+    kind: HubPackageKind;
+    key: NonEmptyText;
+    version: NonEmptyText;
+};
+export type HttpHubPackageResolverOptions = {
+    origins: HunsuOrigin[];
+    fetch?: typeof fetch;
+};
+export type ResolvedHubPackageManifest = {
+    lock: HubPackageLock;
+    manifest: HubPackageManifest;
+    integrity: string;
+    origin: HunsuOrigin;
+};
+export declare function hubSeedPackageManifests(): HubPackageManifest[];
+export declare function canonicalizeManifest(manifest: HubPackageManifest | unknown): string;
+export declare function computeManifestIntegrity(manifest: HubPackageManifest | unknown): string;
+export declare function verifyManifestIntegrity(manifest: HubPackageManifest | unknown, integrity: string): boolean;
+export declare function resolveHubPackageManifestFromOrigin(lock: HubPackageLock, options: HttpHubPackageResolverOptions): Promise<ResolvedHubPackageManifest>;
+export declare function hubPackageManifestUrl(originUrl: string, kind: HubPackageKind, key: string, version: string): string;
+export declare function hubPackageEntityRef(origin: string, key: string): string;
+export declare function hubPackageVersionRef(origin: string, key: string, version: string): string;
+export declare function hubPackageHumanUrl(originUrl: string, lock: HubPackageLock): string;
+export declare function parseHubPackageRefFromUrl(rawUrl: string): HubPackageRef;
+export declare function summarizeHubPackageManifest(manifest: HubPackageManifest, origin: string): HubPackageSummary;
+export declare function hydrateTeamPackage(manifest: HubPackageManifest): Harness;
+export declare function assertValidHubPackageManifest(manifest: unknown): asserts manifest is HubPackageManifest;

package/dist/index.js

@@ -0,0 +1,478 @@
+import { createHash } from "node:crypto";
+import { createDefaultHarness, createDefaultManagerConfig, createDefaultMemberConfig, harnessEntityFromSnapshot, makeNonEmptyText, validateHarnessEntity, validateManagerConfig, validateMemberConfig } from "@hunsu/protocol";
+export const HUB_PACKAGE_MANIFEST_SCHEMA = "hunsu.hub-package-manifest.v1";
+export const MANIFEST_INTEGRITY_PREFIX_V1 = "hunsu-json-c14n-v1+sha256:";
+export function hubSeedPackageManifests() {
+    return [
+        superloopyCrewManifest(),
+        skillsCurationManifest(),
+        defaultHunsuManagerManifest(),
+        ideaHelperManagerManifest(),
+        researcherManagerManifest(),
+        researcherSkillManifest()
+    ];
+}
+function superloopyCrewManifest() {
+    const harness = createDefaultHarness("Plan a convergent crew run using only direct Members visible to this Team.");
+    harness.members = [
+        createDefaultMemberConfig("build", "Implement the selected task with focused changes."),
+        createDefaultMemberConfig("review", "Review the implementation for regressions and missed requirements."),
+        createDefaultMemberConfig("test", "Run targeted checks and summarize evidence."),
+        createDefaultMemberConfig("gate", "Decide whether the result is ready to finalize."),
+        createDefaultMemberConfig("audit", "Audit risks, hidden assumptions, and release notes."),
+        createDefaultMemberConfig("navigation", "Keep the crew oriented around the selected Destination.")
+    ];
+    return {
+        schema: HUB_PACKAGE_MANIFEST_SCHEMA,
+        kind: "team",
+        key: "team.superloopy.crew",
+        version: "1.0.2",
+        team: harnessEntityFromSnapshot(harness)
+    };
+}
+function skillsCurationManifest() {
+    const harness = createDefaultHarness("Curate reusable Codex skills and validate installation metadata before publication.");
+    const skillsCatalog = {
+        kind: "skillMeta",
+        name: requireMetadataText("skills-catalog", "team.skills-curation.discover.skills[0].name"),
+        source: requireMetadataText("github:vercel-labs/skills", "team.skills-curation.discover.skills[0].source"),
+        agent: "codex"
+    };
+    harness.members = [
+        createDefaultMemberConfig("discover", "Find candidate skills and summarize their purpose.", [skillsCatalog]),
+        createDefaultMemberConfig("curate", "Normalize skill metadata and prepare installable entries."),
+        createDefaultMemberConfig("verify", "Check skill instructions and installation evidence.")
+    ];
+    return {
+        schema: HUB_PACKAGE_MANIFEST_SCHEMA,
+        kind: "team",
+        key: "team.skills-curation",
+        version: "1.0.2",
+        team: harnessEntityFromSnapshot(harness)
+    };
+}
+function defaultHunsuManagerManifest() {
+    return {
+        schema: HUB_PACKAGE_MANIFEST_SCHEMA,
+        kind: "manager",
+        key: "manager.hunsu.default",
+        version: "1.0.0",
+        manager: createDefaultManagerConfig()
+    };
+}
+function ideaHelperManagerManifest() {
+    return {
+        schema: HUB_PACKAGE_MANIFEST_SCHEMA,
+        kind: "manager",
+        key: "manager.idea-helper",
+        version: "1.0.0",
+        manager: createDefaultManagerConfig("manager.idea-helper", [
+            "Help the user explore divergent Hunsu options before committing to an editable draft.",
+            "Generate alternatives, tradeoffs, naming choices, and likely downstream implications.",
+            "Only edit .hunsu-request files when the user chooses a concrete option."
+        ].join(" "))
+    };
+}
+function researcherManagerManifest() {
+    return {
+        schema: HUB_PACKAGE_MANIFEST_SCHEMA,
+        kind: "manager",
+        key: "manager.researcher",
+        version: "1.0.0",
+        manager: createDefaultManagerConfig("manager.researcher", [
+            "Gather and synthesize context for a proposed Hunsu change before editing draft runtime files.",
+            "Prioritize evidence, source boundaries, and unresolved assumptions.",
+            "When a file-backed change is requested, edit only the relevant .hunsu-request files."
+        ].join(" "), [{
+                kind: "skillMeta",
+                name: requireMetadataText("researcher", "manager.researcher.skills[0].name"),
+                source: requireMetadataText("github:vercel-labs/skills", "manager.researcher.skills[0].source"),
+                agent: "codex"
+            }])
+    };
+}
+function researcherSkillManifest() {
+    return {
+        schema: HUB_PACKAGE_MANIFEST_SCHEMA,
+        kind: "skill",
+        key: "skill.researcher",
+        version: "1.0.0",
+        skill: {
+            name: "researcher",
+            contentHash: "sha256:vercel-labs-skills-researcher-seed",
+            files: [{
+                    path: requireMetadataText("SKILL.md", "skill.researcher.files[0].path"),
+                    text: [
+                        "---",
+                        "name: researcher",
+                        "description: Gather evidence, source boundaries, and unresolved assumptions before Hunsu Draft changes.",
+                        "---",
+                        "",
+                        "# Researcher",
+                        "",
+                        "Use this seed skill as an installable Hub example based on github:vercel-labs/skills for context gathering and synthesis."
+                    ].join("\n")
+                }]
+        }
+    };
+}
+export function canonicalizeManifest(manifest) {
+    assertValidHubPackageManifest(manifest);
+    const { integrity: _integrity, ...manifestWithoutIntegrity } = manifest;
+    return JSON.stringify(toCanonicalJsonValue(manifestWithoutIntegrity, "manifest"));
+}
+export function computeManifestIntegrity(manifest) {
+    const canonical = canonicalizeManifest(manifest);
+    return `${MANIFEST_INTEGRITY_PREFIX_V1}${createHash("sha256").update(canonical, "utf8").digest("hex")}`;
+}
+export function verifyManifestIntegrity(manifest, integrity) {
+    if (!integrity.startsWith(MANIFEST_INTEGRITY_PREFIX_V1)) {
+        return false;
+    }
+    try {
+        return computeManifestIntegrity(manifest) === integrity;
+    }
+    catch {
+        return false;
+    }
+}
+export async function resolveHubPackageManifestFromOrigin(lock, options) {
+    if (!lock.integrity.startsWith(MANIFEST_INTEGRITY_PREFIX_V1)) {
+        throw new Error(`Unsupported Hub package integrity prefix: ${lock.integrity}`);
+    }
+    const origin = options.origins.find(candidate => candidate.name === lock.origin);
+    if (!origin) {
+        throw new Error(`Unknown Origin: ${lock.origin}`);
+    }
+    if (origin.transport !== "http") {
+        throw new Error(`Origin ${origin.name} uses unsupported transport ${origin.transport}`);
+    }
+    const fetchImpl = options.fetch ?? fetch;
+    const response = await fetchImpl(hubPackageManifestUrl(origin.url, lock.kind, lock.key, lock.version));
+    if (!response.ok) {
+        if (response.status === 404) {
+            throw new Error(`Missing Hub package manifest: ${lock.origin}/${lock.kind}/${lock.key}@${lock.version}`);
+        }
+        throw new Error(`Origin ${origin.name} returned ${response.status} for ${lock.kind}/${lock.key}@${lock.version}`);
+    }
+    const parsed = await response.json();
+    assertValidHubPackageManifest(parsed);
+    if (parsed.kind !== lock.kind || parsed.key !== lock.key || parsed.version !== lock.version) {
+        throw new Error(`Hub package manifest from ${origin.name} does not match requested ${lock.kind}/${lock.key}@${lock.version}`);
+    }
+    const integrity = computeManifestIntegrity(parsed);
+    if (integrity !== lock.integrity) {
+        throw new Error(`Hub package integrity mismatch for ${lock.origin}/${lock.kind}/${lock.key}@${lock.version}: expected ${lock.integrity}, got ${integrity}`);
+    }
+    return { lock: { ...lock }, manifest: parsed, integrity, origin: { ...origin } };
+}
+export function hubPackageManifestUrl(originUrl, kind, key, version) {
+    const base = new URL(originUrl);
+    const path = `/v1/packages/${kind}/${encodeURIComponent(key)}/versions/${encodeURIComponent(version)}`;
+    return new URL(path, base).toString();
+}
+export function hubPackageEntityRef(origin, key) {
+    return `@${origin}/${key}`;
+}
+export function hubPackageVersionRef(origin, key, version) {
+    return `${hubPackageEntityRef(origin, key)}@${version}`;
+}
+export function hubPackageHumanUrl(originUrl, lock) {
+    const base = new URL(originUrl);
+    const path = `/hub/${marketplaceIdForPackageKind(lock.kind)}/${lock.kind}/@${encodeURIComponent(lock.origin)}/${encodeURIComponent(lock.key)}/versions/${encodeURIComponent(lock.version)}`;
+    return new URL(path, base).toString();
+}
+export function parseHubPackageRefFromUrl(rawUrl) {
+    const url = new URL(rawUrl, "https://hub.local");
+    const match = url.pathname.match(/^\/hub\/(executor|hunsu|resources)\/(team|member|manager|skill)\/@([^/]+)\/([^/]+)\/versions\/([^/]+)$/);
+    if (!match) {
+        throw new Error("Hub package URL must use /hub/:marketplace/:kind/@:origin/:key/versions/:version");
+    }
+    const marketplaceId = match[1];
+    const kind = match[2];
+    if (marketplaceId !== marketplaceIdForPackageKind(kind)) {
+        throw new Error(`Hub package URL marketplace ${marketplaceId} does not match ${kind}`);
+    }
+    return {
+        origin: requireMetadataText(decodeURIComponent(match[3] ?? ""), "ref.origin"),
+        kind,
+        key: requireMetadataText(decodeURIComponent(match[4] ?? ""), "ref.key"),
+        version: requireMetadataText(decodeURIComponent(match[5] ?? ""), "ref.version")
+    };
+}
+function marketplaceIdForPackageKind(kind) {
+    if (kind === "manager")
+        return "hunsu";
+    if (kind === "skill")
+        return "resources";
+    return "executor";
+}
+function requireMetadataText(value, field) {
+    const result = makeNonEmptyText(value, field);
+    if (!result.ok) {
+        throw new Error(result.error.message);
+    }
+    return result.value;
+}
+export function summarizeHubPackageManifest(manifest, origin) {
+    assertValidHubPackageManifest(manifest);
+    const integrity = manifest.integrity ?? computeManifestIntegrity(manifest);
+    switch (manifest.kind) {
+        case "team": {
+            const rootTeam = rootTeamForPackage(manifest.team);
+            const resourceCounts = resourceCountsForHarness(manifest.team);
+            return {
+                origin,
+                entryKind: "package",
+                kind: manifest.kind,
+                key: manifest.key,
+                version: manifest.version,
+                integrity,
+                label: manifest.key,
+                sourcePackageKind: manifest.kind,
+                sourcePackageKey: manifest.key,
+                sourcePackageVersion: manifest.version,
+                promptTemplateEngine: rootTeam.planner.promptTemplate.engine,
+                memberCount: rootTeam.members.length,
+                skillCount: resourceCounts.skill,
+                pluginRequirementCount: resourceCounts.plugin
+            };
+        }
+        case "member":
+            return {
+                origin,
+                entryKind: "package",
+                kind: manifest.kind,
+                key: manifest.key,
+                version: manifest.version,
+                integrity,
+                label: manifest.member.id,
+                sourcePackageKind: manifest.kind,
+                sourcePackageKey: manifest.key,
+                sourcePackageVersion: manifest.version,
+                executorId: manifest.member.id,
+                promptTemplateEngine: manifest.member.promptTemplate.engine,
+                skillCount: manifest.member.skills.length,
+                pluginRequirementCount: manifest.member.plugins.length
+            };
+        case "manager":
+            return {
+                origin,
+                entryKind: "package",
+                kind: manifest.kind,
+                key: manifest.key,
+                version: manifest.version,
+                integrity,
+                label: manifest.manager.id,
+                sourcePackageKind: manifest.kind,
+                sourcePackageKey: manifest.key,
+                sourcePackageVersion: manifest.version,
+                promptTemplateEngine: manifest.manager.promptTemplate.engine,
+                skillCount: manifest.manager.skills.length,
+                pluginRequirementCount: manifest.manager.plugins.length
+            };
+        case "skill":
+            return {
+                origin,
+                entryKind: "package",
+                kind: manifest.kind,
+                key: manifest.key,
+                version: manifest.version,
+                integrity,
+                label: manifest.skill.name,
+                sourcePackageKind: manifest.kind,
+                sourcePackageKey: manifest.key,
+                sourcePackageVersion: manifest.version
+            };
+    }
+}
+export function hydrateTeamPackage(manifest) {
+    assertValidHubPackageManifest(manifest);
+    if (manifest.kind !== "team") {
+        throw new Error(`Hub package ${manifest.kind}/${manifest.key}@${manifest.version} is not a team package`);
+    }
+    return cloneJson(manifest.team);
+}
+export function assertValidHubPackageManifest(manifest) {
+    const record = requireRecord(manifest, "manifest");
+    if (record.schema !== HUB_PACKAGE_MANIFEST_SCHEMA) {
+        throw new Error(`Unsupported Hub package manifest schema: ${String(record.schema)}`);
+    }
+    requireExactKeys(record, ["integrity", "key", "kind", "team", "member", "manager", "schema", "skill", "version"], "manifest");
+    const kind = requireHubPackageKind(record.kind, "manifest.kind");
+    requireNonEmptyString(record.key, "manifest.key");
+    requireNonEmptyString(record.version, "manifest.version");
+    if (record.integrity !== undefined) {
+        requireNonEmptyString(record.integrity, "manifest.integrity");
+    }
+    switch (kind) {
+        case "team":
+            assertValidTeamPayload(record.team);
+            if (record.member !== undefined || record.manager !== undefined || record.skill !== undefined) {
+                throw new Error("Team package manifest must not include member, manager, or skill payloads");
+            }
+            return;
+        case "member":
+            assertValidMemberPayload(record.member);
+            if (record.team !== undefined || record.manager !== undefined || record.skill !== undefined) {
+                throw new Error("Member package manifest must not include team, manager, or skill payloads");
+            }
+            return;
+        case "manager":
+            assertValidManagerPayload(record.manager);
+            if (record.team !== undefined || record.member !== undefined || record.skill !== undefined) {
+                throw new Error("Manager package manifest must not include team, member, or skill payloads");
+            }
+            return;
+        case "skill":
+            assertValidSkillPayload(record.skill);
+            if (record.team !== undefined || record.member !== undefined || record.manager !== undefined) {
+                throw new Error("Skill package manifest must not include team, member, or manager payloads");
+            }
+            return;
+    }
+}
+function assertValidTeamPayload(value) {
+    const graph = validateHarnessEntity(value, "manifest.team");
+    if (!graph.ok) {
+        throw new Error(`Invalid manifest.team: ${graph.error.message}`);
+    }
+}
+function assertValidMemberPayload(value) {
+    const member = validateMemberConfig(value, "manifest.member");
+    if (!member.ok) {
+        throw new Error(`Invalid manifest.member: ${member.error.message}`);
+    }
+}
+function assertValidManagerPayload(value) {
+    const manager = validateManagerConfig(value, "manifest.manager");
+    if (!manager.ok) {
+        throw new Error(`Invalid manifest.manager: ${manager.error.message}`);
+    }
+}
+function assertValidSkillPayload(value) {
+    const record = requireRecord(value, "manifest.skill");
+    requireExactKeys(record, ["contentHash", "files", "name"], "manifest.skill");
+    requireNonEmptyString(record.name, "manifest.skill.name");
+    requireNonEmptyString(record.contentHash, "manifest.skill.contentHash");
+    if (record.files !== undefined) {
+        if (!Array.isArray(record.files)) {
+            throw new Error("manifest.skill.files must be an array");
+        }
+        for (const [index, file] of record.files.entries()) {
+            const item = requireRecord(file, `manifest.skill.files[${index}]`);
+            requireExactKeys(item, ["path", "text"], `manifest.skill.files[${index}]`);
+            requireNonEmptyString(item.path, `manifest.skill.files[${index}].path`);
+            requireString(item.text, `manifest.skill.files[${index}].text`);
+        }
+    }
+}
+function rootTeamForPackage(team) {
+    const rootTeam = team.executors.find((executor) => executor.kind === "team" && executor.id === team.rootTeamId);
+    if (!rootTeam) {
+        throw new Error(`Team package rootTeamId ${team.rootTeamId} does not reference a Team Executor`);
+    }
+    return rootTeam;
+}
+function resourceCountsForHarness(harness) {
+    const identities = new Set();
+    for (const resource of harness.resources) {
+        identities.add(resourceIdentity(resource.binding));
+    }
+    for (const executor of harness.executors) {
+        if (executor.kind !== "member") {
+            continue;
+        }
+        for (const binding of executor.resources) {
+            identities.add(resourceIdentity(binding));
+        }
+    }
+    let skill = 0;
+    let plugin = 0;
+    for (const identity of identities) {
+        if (identity.startsWith("skill:"))
+            skill += 1;
+        if (identity.startsWith("plugin:"))
+            plugin += 1;
+    }
+    return { skill, plugin };
+}
+function resourceIdentity(binding) {
+    if (binding.kind === "skill") {
+        return `skill:${binding.skill.name}`;
+    }
+    if (binding.kind === "plugin") {
+        return `plugin:${binding.plugin.id}`;
+    }
+    return `package:${binding.lock.kind}:${binding.lock.key}:${binding.lock.version}`;
+}
+function requireHubPackageKind(value, path) {
+    if (value === "team" || value === "member" || value === "manager" || value === "skill") {
+        return value;
+    }
+    throw new Error(`${path} must be team, member, manager, or skill`);
+}
+function requireRecord(value, path) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new Error(`${path} must be an object`);
+    }
+    return value;
+}
+function requireExactKeys(record, allowedKeys, path) {
+    const missing = allowedKeys.filter(key => key !== "integrity" && key !== "team" && key !== "member" && key !== "manager" && key !== "skill" && key !== "files" && !(key in record));
+    if (missing.length > 0) {
+        throw new Error(`${path} is missing required keys: ${missing.join(", ")}`);
+    }
+    const extra = Object.keys(record).filter(key => !allowedKeys.includes(key));
+    if (extra.length > 0) {
+        throw new Error(`${path} has unsupported keys: ${extra.join(", ")}`);
+    }
+}
+function requireString(value, path) {
+    if (typeof value !== "string") {
+        throw new Error(`${path} must be a string`);
+    }
+    return value;
+}
+function requireNonEmptyString(value, path) {
+    const text = requireString(value, path);
+    if (text.trim().length === 0) {
+        throw new Error(`${path} must be non-empty`);
+    }
+    return text;
+}
+function toCanonicalJsonValue(value, path) {
+    if (value === null || typeof value === "string" || typeof value === "boolean") {
+        return value;
+    }
+    if (typeof value === "number") {
+        if (!Number.isFinite(value)) {
+            throw new Error(`${path} must be a finite number`);
+        }
+        return value;
+    }
+    if (Array.isArray(value)) {
+        return value.map((item, index) => {
+            if (item === undefined) {
+                throw new Error(`${path}[${index}] must not be undefined`);
+            }
+            return toCanonicalJsonValue(item, `${path}[${index}]`);
+        });
+    }
+    if (typeof value === "object" && value !== null) {
+        const record = value;
+        const canonical = {};
+        for (const key of Object.keys(record).sort()) {
+            const child = record[key];
+            if (child === undefined) {
+                continue;
+            }
+            canonical[key] = toCanonicalJsonValue(child, `${path}.${key}`);
+        }
+        return canonical;
+    }
+    throw new Error(`${path} must be JSON-serializable`);
+}
+function cloneJson(value) {
+    return JSON.parse(JSON.stringify(value));
+}

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@hunsu/protocol-registry",
+  "version": "0.1.0",
+  "private": false,
+  "description": "Hunsu Hub package manifests, integrity, and Origin resolution.",
+  "license": "Apache-2.0",
+  "type": "module",
+  "exports": {
+    ".": {
+      "development": "./src/index.ts",
+      "types": "./src/index.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=22.18"
+  },
+  "dependencies": {
+    "@hunsu/protocol": "0.1.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  }
+}

package/src/index.ts

@@ -0,0 +1,618 @@
+import { createHash } from "node:crypto";
+import {
+  createDefaultHarness,
+  createDefaultManagerConfig,
+  createDefaultMemberConfig,
+  harnessEntityFromSnapshot,
+  makeNonEmptyText,
+  validateHarnessEntity,
+  validateManagerConfig,
+  validateMemberConfig,
+  type Harness,
+  type HubPackageKind,
+  type HubPackageLock,
+  type HunsuOrigin,
+  type ManagerConfig,
+  type NonEmptyText,
+  type MemberConfig,
+  type SkillSnapshotFile
+} from "@hunsu/protocol";
+
+export type { HubPackageKind, HubPackageLock, HunsuOrigin } from "@hunsu/protocol";
+
+export const HUB_PACKAGE_MANIFEST_SCHEMA = "hunsu.hub-package-manifest.v1" as const;
+export const MANIFEST_INTEGRITY_PREFIX_V1 = "hunsu-json-c14n-v1+sha256:" as const;
+
+export type TeamPackageManifest = {
+  schema: typeof HUB_PACKAGE_MANIFEST_SCHEMA;
+  kind: "team";
+  key: string;
+  version: string;
+  team: Harness;
+  integrity?: string;
+};
+
+export type MemberPackageManifest = {
+  schema: typeof HUB_PACKAGE_MANIFEST_SCHEMA;
+  kind: "member";
+  key: string;
+  version: string;
+  member: MemberConfig;
+  integrity?: string;
+};
+
+export type ManagerPackageManifest = {
+  schema: typeof HUB_PACKAGE_MANIFEST_SCHEMA;
+  kind: "manager";
+  key: string;
+  version: string;
+  manager: ManagerConfig;
+  integrity?: string;
+};
+
+export type SkillPackageManifest = {
+  schema: typeof HUB_PACKAGE_MANIFEST_SCHEMA;
+  kind: "skill";
+  key: string;
+  version: string;
+  skill: {
+    name: string;
+    contentHash: string;
+    files?: SkillSnapshotFile[];
+  };
+  integrity?: string;
+};
+
+export type HubPackageManifest = TeamPackageManifest | MemberPackageManifest | ManagerPackageManifest | SkillPackageManifest;
+
+export type HubPackageSummary = {
+  origin: string;
+  entryKind: "package" | "executor";
+  kind: HubPackageKind;
+  key: string;
+  version: string;
+  integrity: string;
+  label: string;
+  sourcePackageKind: HubPackageKind;
+  sourcePackageKey: string;
+  sourcePackageVersion: string;
+  executorId?: string;
+  memberOf?: string[];
+  promptTemplateEngine?: string;
+  memberCount?: number;
+  skillCount?: number;
+  pluginRequirementCount?: number;
+};
+
+export type HubPackageRef = {
+  origin: NonEmptyText;
+  kind: HubPackageKind;
+  key: NonEmptyText;
+  version: NonEmptyText;
+};
+
+export type HttpHubPackageResolverOptions = {
+  origins: HunsuOrigin[];
+  fetch?: typeof fetch;
+};
+
+export type ResolvedHubPackageManifest = {
+  lock: HubPackageLock;
+  manifest: HubPackageManifest;
+  integrity: string;
+  origin: HunsuOrigin;
+};
+
+export function hubSeedPackageManifests(): HubPackageManifest[] {
+  return [
+    superloopyCrewManifest(),
+    skillsCurationManifest(),
+    defaultHunsuManagerManifest(),
+    ideaHelperManagerManifest(),
+    researcherManagerManifest(),
+    researcherSkillManifest()
+  ];
+}
+
+function superloopyCrewManifest(): TeamPackageManifest {
+  const harness = createDefaultHarness("Plan a convergent crew run using only direct Members visible to this Team.");
+  harness.members = [
+    createDefaultMemberConfig("build", "Implement the selected task with focused changes."),
+    createDefaultMemberConfig("review", "Review the implementation for regressions and missed requirements."),
+    createDefaultMemberConfig("test", "Run targeted checks and summarize evidence."),
+    createDefaultMemberConfig("gate", "Decide whether the result is ready to finalize."),
+    createDefaultMemberConfig("audit", "Audit risks, hidden assumptions, and release notes."),
+    createDefaultMemberConfig("navigation", "Keep the crew oriented around the selected Destination.")
+  ];
+  return {
+    schema: HUB_PACKAGE_MANIFEST_SCHEMA,
+    kind: "team",
+    key: "team.superloopy.crew",
+    version: "1.0.2",
+    team: harnessEntityFromSnapshot(harness)
+  };
+}
+
+function skillsCurationManifest(): TeamPackageManifest {
+  const harness = createDefaultHarness("Curate reusable Codex skills and validate installation metadata before publication.");
+  const skillsCatalog = {
+    kind: "skillMeta" as const,
+    name: requireMetadataText("skills-catalog", "team.skills-curation.discover.skills[0].name"),
+    source: requireMetadataText("github:vercel-labs/skills", "team.skills-curation.discover.skills[0].source"),
+    agent: "codex" as const
+  };
+  harness.members = [
+    createDefaultMemberConfig("discover", "Find candidate skills and summarize their purpose.", [skillsCatalog]),
+    createDefaultMemberConfig("curate", "Normalize skill metadata and prepare installable entries."),
+    createDefaultMemberConfig("verify", "Check skill instructions and installation evidence.")
+  ];
+  return {
+    schema: HUB_PACKAGE_MANIFEST_SCHEMA,
+    kind: "team",
+    key: "team.skills-curation",
+    version: "1.0.2",
+    team: harnessEntityFromSnapshot(harness)
+  };
+}
+
+function defaultHunsuManagerManifest(): ManagerPackageManifest {
+  return {
+    schema: HUB_PACKAGE_MANIFEST_SCHEMA,
+    kind: "manager",
+    key: "manager.hunsu.default",
+    version: "1.0.0",
+    manager: createDefaultManagerConfig()
+  };
+}
+
+function ideaHelperManagerManifest(): ManagerPackageManifest {
+  return {
+    schema: HUB_PACKAGE_MANIFEST_SCHEMA,
+    kind: "manager",
+    key: "manager.idea-helper",
+    version: "1.0.0",
+    manager: createDefaultManagerConfig(
+      "manager.idea-helper",
+      [
+        "Help the user explore divergent Hunsu options before committing to an editable draft.",
+        "Generate alternatives, tradeoffs, naming choices, and likely downstream implications.",
+        "Only edit .hunsu-request files when the user chooses a concrete option."
+      ].join(" ")
+    )
+  };
+}
+
+function researcherManagerManifest(): ManagerPackageManifest {
+  return {
+    schema: HUB_PACKAGE_MANIFEST_SCHEMA,
+    kind: "manager",
+    key: "manager.researcher",
+    version: "1.0.0",
+    manager: createDefaultManagerConfig(
+      "manager.researcher",
+      [
+        "Gather and synthesize context for a proposed Hunsu change before editing draft runtime files.",
+        "Prioritize evidence, source boundaries, and unresolved assumptions.",
+        "When a file-backed change is requested, edit only the relevant .hunsu-request files."
+      ].join(" "),
+      [{
+        kind: "skillMeta",
+        name: requireMetadataText("researcher", "manager.researcher.skills[0].name"),
+        source: requireMetadataText("github:vercel-labs/skills", "manager.researcher.skills[0].source"),
+        agent: "codex"
+      }]
+    )
+  };
+}
+
+function researcherSkillManifest(): SkillPackageManifest {
+  return {
+    schema: HUB_PACKAGE_MANIFEST_SCHEMA,
+    kind: "skill",
+    key: "skill.researcher",
+    version: "1.0.0",
+    skill: {
+      name: "researcher",
+      contentHash: "sha256:vercel-labs-skills-researcher-seed",
+      files: [{
+        path: requireMetadataText("SKILL.md", "skill.researcher.files[0].path"),
+        text: [
+          "---",
+          "name: researcher",
+          "description: Gather evidence, source boundaries, and unresolved assumptions before Hunsu Draft changes.",
+          "---",
+          "",
+          "# Researcher",
+          "",
+          "Use this seed skill as an installable Hub example based on github:vercel-labs/skills for context gathering and synthesis."
+        ].join("\n")
+      }]
+    }
+  };
+}
+
+type JsonPrimitive = string | number | boolean | null;
+type CanonicalJsonValue = JsonPrimitive | CanonicalJsonValue[] | { [key: string]: CanonicalJsonValue };
+
+export function canonicalizeManifest(manifest: HubPackageManifest | unknown): string {
+  assertValidHubPackageManifest(manifest);
+  const { integrity: _integrity, ...manifestWithoutIntegrity } = manifest;
+  return JSON.stringify(toCanonicalJsonValue(manifestWithoutIntegrity, "manifest"));
+}
+
+export function computeManifestIntegrity(manifest: HubPackageManifest | unknown): string {
+  const canonical = canonicalizeManifest(manifest);
+  return `${MANIFEST_INTEGRITY_PREFIX_V1}${createHash("sha256").update(canonical, "utf8").digest("hex")}`;
+}
+
+export function verifyManifestIntegrity(manifest: HubPackageManifest | unknown, integrity: string): boolean {
+  if (!integrity.startsWith(MANIFEST_INTEGRITY_PREFIX_V1)) {
+    return false;
+  }
+  try {
+    return computeManifestIntegrity(manifest) === integrity;
+  } catch {
+    return false;
+  }
+}
+
+export async function resolveHubPackageManifestFromOrigin(lock: HubPackageLock, options: HttpHubPackageResolverOptions): Promise<ResolvedHubPackageManifest> {
+  if (!lock.integrity.startsWith(MANIFEST_INTEGRITY_PREFIX_V1)) {
+    throw new Error(`Unsupported Hub package integrity prefix: ${lock.integrity}`);
+  }
+  const origin = options.origins.find(candidate => candidate.name === lock.origin);
+  if (!origin) {
+    throw new Error(`Unknown Origin: ${lock.origin}`);
+  }
+  if (origin.transport !== "http") {
+    throw new Error(`Origin ${origin.name} uses unsupported transport ${origin.transport}`);
+  }
+  const fetchImpl = options.fetch ?? fetch;
+  const response = await fetchImpl(hubPackageManifestUrl(origin.url, lock.kind, lock.key, lock.version));
+  if (!response.ok) {
+    if (response.status === 404) {
+      throw new Error(`Missing Hub package manifest: ${lock.origin}/${lock.kind}/${lock.key}@${lock.version}`);
+    }
+    throw new Error(`Origin ${origin.name} returned ${response.status} for ${lock.kind}/${lock.key}@${lock.version}`);
+  }
+  const parsed = await response.json() as unknown;
+  assertValidHubPackageManifest(parsed);
+  if (parsed.kind !== lock.kind || parsed.key !== lock.key || parsed.version !== lock.version) {
+    throw new Error(`Hub package manifest from ${origin.name} does not match requested ${lock.kind}/${lock.key}@${lock.version}`);
+  }
+  const integrity = computeManifestIntegrity(parsed);
+  if (integrity !== lock.integrity) {
+    throw new Error(`Hub package integrity mismatch for ${lock.origin}/${lock.kind}/${lock.key}@${lock.version}: expected ${lock.integrity}, got ${integrity}`);
+  }
+  return { lock: { ...lock }, manifest: parsed, integrity, origin: { ...origin } };
+}
+
+export function hubPackageManifestUrl(originUrl: string, kind: HubPackageKind, key: string, version: string): string {
+  const base = new URL(originUrl);
+  const path = `/v1/packages/${kind}/${encodeURIComponent(key)}/versions/${encodeURIComponent(version)}`;
+  return new URL(path, base).toString();
+}
+
+export function hubPackageEntityRef(origin: string, key: string): string {
+  return `@${origin}/${key}`;
+}
+
+export function hubPackageVersionRef(origin: string, key: string, version: string): string {
+  return `${hubPackageEntityRef(origin, key)}@${version}`;
+}
+
+export function hubPackageHumanUrl(originUrl: string, lock: HubPackageLock): string {
+  const base = new URL(originUrl);
+  const path = `/hub/${marketplaceIdForPackageKind(lock.kind)}/${lock.kind}/@${encodeURIComponent(lock.origin)}/${encodeURIComponent(lock.key)}/versions/${encodeURIComponent(lock.version)}`;
+  return new URL(path, base).toString();
+}
+
+export function parseHubPackageRefFromUrl(rawUrl: string): HubPackageRef {
+  const url = new URL(rawUrl, "https://hub.local");
+  const match = url.pathname.match(/^\/hub\/(executor|hunsu|resources)\/(team|member|manager|skill)\/@([^/]+)\/([^/]+)\/versions\/([^/]+)$/);
+  if (!match) {
+    throw new Error("Hub package URL must use /hub/:marketplace/:kind/@:origin/:key/versions/:version");
+  }
+  const marketplaceId = match[1];
+  const kind = match[2] as HubPackageKind;
+  if (marketplaceId !== marketplaceIdForPackageKind(kind)) {
+    throw new Error(`Hub package URL marketplace ${marketplaceId} does not match ${kind}`);
+  }
+  return {
+    origin: requireMetadataText(decodeURIComponent(match[3] ?? ""), "ref.origin"),
+    kind,
+    key: requireMetadataText(decodeURIComponent(match[4] ?? ""), "ref.key"),
+    version: requireMetadataText(decodeURIComponent(match[5] ?? ""), "ref.version")
+  };
+}
+
+function marketplaceIdForPackageKind(kind: HubPackageKind): "executor" | "hunsu" | "resources" {
+  if (kind === "manager") return "hunsu";
+  if (kind === "skill") return "resources";
+  return "executor";
+}
+
+function requireMetadataText(value: unknown, field: string): NonEmptyText {
+  const result = makeNonEmptyText(value, field);
+  if (!result.ok) {
+    throw new Error(result.error.message);
+  }
+  return result.value;
+}
+
+export function summarizeHubPackageManifest(manifest: HubPackageManifest, origin: string): HubPackageSummary {
+  assertValidHubPackageManifest(manifest);
+  const integrity = manifest.integrity ?? computeManifestIntegrity(manifest);
+  switch (manifest.kind) {
+    case "team": {
+      const rootTeam = rootTeamForPackage(manifest.team);
+      const resourceCounts = resourceCountsForHarness(manifest.team);
+      return {
+        origin,
+        entryKind: "package",
+        kind: manifest.kind,
+        key: manifest.key,
+        version: manifest.version,
+        integrity,
+        label: manifest.key,
+        sourcePackageKind: manifest.kind,
+        sourcePackageKey: manifest.key,
+        sourcePackageVersion: manifest.version,
+        promptTemplateEngine: rootTeam.planner.promptTemplate.engine,
+        memberCount: rootTeam.members.length,
+        skillCount: resourceCounts.skill,
+        pluginRequirementCount: resourceCounts.plugin
+      };
+    }
+    case "member":
+      return {
+        origin,
+        entryKind: "package",
+        kind: manifest.kind,
+        key: manifest.key,
+        version: manifest.version,
+        integrity,
+        label: manifest.member.id,
+        sourcePackageKind: manifest.kind,
+        sourcePackageKey: manifest.key,
+        sourcePackageVersion: manifest.version,
+        executorId: manifest.member.id,
+        promptTemplateEngine: manifest.member.promptTemplate.engine,
+        skillCount: manifest.member.skills.length,
+        pluginRequirementCount: manifest.member.plugins.length
+      };
+    case "manager":
+      return {
+        origin,
+        entryKind: "package",
+        kind: manifest.kind,
+        key: manifest.key,
+        version: manifest.version,
+        integrity,
+        label: manifest.manager.id,
+        sourcePackageKind: manifest.kind,
+        sourcePackageKey: manifest.key,
+        sourcePackageVersion: manifest.version,
+        promptTemplateEngine: manifest.manager.promptTemplate.engine,
+        skillCount: manifest.manager.skills.length,
+        pluginRequirementCount: manifest.manager.plugins.length
+      };
+    case "skill":
+      return {
+        origin,
+        entryKind: "package",
+        kind: manifest.kind,
+        key: manifest.key,
+        version: manifest.version,
+        integrity,
+        label: manifest.skill.name,
+        sourcePackageKind: manifest.kind,
+        sourcePackageKey: manifest.key,
+        sourcePackageVersion: manifest.version
+      };
+  }
+}
+
+export function hydrateTeamPackage(manifest: HubPackageManifest): Harness {
+  assertValidHubPackageManifest(manifest);
+  if (manifest.kind !== "team") {
+    throw new Error(`Hub package ${manifest.kind}/${manifest.key}@${manifest.version} is not a team package`);
+  }
+  return cloneJson(manifest.team) as Harness;
+}
+
+export function assertValidHubPackageManifest(manifest: unknown): asserts manifest is HubPackageManifest {
+  const record = requireRecord(manifest, "manifest");
+  if (record.schema !== HUB_PACKAGE_MANIFEST_SCHEMA) {
+    throw new Error(`Unsupported Hub package manifest schema: ${String(record.schema)}`);
+  }
+  requireExactKeys(record, ["integrity", "key", "kind", "team", "member", "manager", "schema", "skill", "version"], "manifest");
+  const kind = requireHubPackageKind(record.kind, "manifest.kind");
+  requireNonEmptyString(record.key, "manifest.key");
+  requireNonEmptyString(record.version, "manifest.version");
+  if (record.integrity !== undefined) {
+    requireNonEmptyString(record.integrity, "manifest.integrity");
+  }
+  switch (kind) {
+    case "team":
+      assertValidTeamPayload(record.team);
+      if (record.member !== undefined || record.manager !== undefined || record.skill !== undefined) {
+        throw new Error("Team package manifest must not include member, manager, or skill payloads");
+      }
+      return;
+    case "member":
+      assertValidMemberPayload(record.member);
+      if (record.team !== undefined || record.manager !== undefined || record.skill !== undefined) {
+        throw new Error("Member package manifest must not include team, manager, or skill payloads");
+      }
+      return;
+    case "manager":
+      assertValidManagerPayload(record.manager);
+      if (record.team !== undefined || record.member !== undefined || record.skill !== undefined) {
+        throw new Error("Manager package manifest must not include team, member, or skill payloads");
+      }
+      return;
+    case "skill":
+      assertValidSkillPayload(record.skill);
+      if (record.team !== undefined || record.member !== undefined || record.manager !== undefined) {
+        throw new Error("Skill package manifest must not include team, member, or manager payloads");
+      }
+      return;
+  }
+}
+
+function assertValidTeamPayload(value: unknown): void {
+  const graph = validateHarnessEntity(value, "manifest.team");
+  if (!graph.ok) {
+    throw new Error(`Invalid manifest.team: ${graph.error.message}`);
+  }
+}
+
+function assertValidMemberPayload(value: unknown): void {
+  const member = validateMemberConfig(value, "manifest.member");
+  if (!member.ok) {
+    throw new Error(`Invalid manifest.member: ${member.error.message}`);
+  }
+}
+
+function assertValidManagerPayload(value: unknown): void {
+  const manager = validateManagerConfig(value, "manifest.manager");
+  if (!manager.ok) {
+    throw new Error(`Invalid manifest.manager: ${manager.error.message}`);
+  }
+}
+
+function assertValidSkillPayload(value: unknown): void {
+  const record = requireRecord(value, "manifest.skill");
+  requireExactKeys(record, ["contentHash", "files", "name"], "manifest.skill");
+  requireNonEmptyString(record.name, "manifest.skill.name");
+  requireNonEmptyString(record.contentHash, "manifest.skill.contentHash");
+  if (record.files !== undefined) {
+    if (!Array.isArray(record.files)) {
+      throw new Error("manifest.skill.files must be an array");
+    }
+    for (const [index, file] of record.files.entries()) {
+      const item = requireRecord(file, `manifest.skill.files[${index}]`);
+      requireExactKeys(item, ["path", "text"], `manifest.skill.files[${index}]`);
+      requireNonEmptyString(item.path, `manifest.skill.files[${index}].path`);
+      requireString(item.text, `manifest.skill.files[${index}].text`);
+    }
+  }
+}
+
+function rootTeamForPackage(team: Harness): Extract<Harness["executors"][number], { kind: "team" }> {
+  const rootTeam = team.executors.find((executor): executor is Extract<Harness["executors"][number], { kind: "team" }> => executor.kind === "team" && executor.id === team.rootTeamId);
+  if (!rootTeam) {
+    throw new Error(`Team package rootTeamId ${team.rootTeamId} does not reference a Team Executor`);
+  }
+  return rootTeam;
+}
+
+function resourceCountsForHarness(harness: Harness): { skill: number; plugin: number } {
+  const identities = new Set<string>();
+  for (const resource of harness.resources) {
+    identities.add(resourceIdentity(resource.binding));
+  }
+  for (const executor of harness.executors) {
+    if (executor.kind !== "member") {
+      continue;
+    }
+    for (const binding of executor.resources) {
+      identities.add(resourceIdentity(binding));
+    }
+  }
+  let skill = 0;
+  let plugin = 0;
+  for (const identity of identities) {
+    if (identity.startsWith("skill:")) skill += 1;
+    if (identity.startsWith("plugin:")) plugin += 1;
+  }
+  return { skill, plugin };
+}
+
+function resourceIdentity(binding: Harness["resources"][number]["binding"]): string {
+  if (binding.kind === "skill") {
+    return `skill:${binding.skill.name}`;
+  }
+  if (binding.kind === "plugin") {
+    return `plugin:${binding.plugin.id}`;
+  }
+  return `package:${binding.lock.kind}:${binding.lock.key}:${binding.lock.version}`;
+}
+
+function requireHubPackageKind(value: unknown, path: string): HubPackageKind {
+  if (value === "team" || value === "member" || value === "manager" || value === "skill") {
+    return value;
+  }
+  throw new Error(`${path} must be team, member, manager, or skill`);
+}
+
+function requireRecord(value: unknown, path: string): Record<string, unknown> {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new Error(`${path} must be an object`);
+  }
+  return value as Record<string, unknown>;
+}
+
+function requireExactKeys(record: Record<string, unknown>, allowedKeys: string[], path: string): void {
+  const missing = allowedKeys.filter(key => key !== "integrity" && key !== "team" && key !== "member" && key !== "manager" && key !== "skill" && key !== "files" && !(key in record));
+  if (missing.length > 0) {
+    throw new Error(`${path} is missing required keys: ${missing.join(", ")}`);
+  }
+  const extra = Object.keys(record).filter(key => !allowedKeys.includes(key));
+  if (extra.length > 0) {
+    throw new Error(`${path} has unsupported keys: ${extra.join(", ")}`);
+  }
+}
+
+function requireString(value: unknown, path: string): string {
+  if (typeof value !== "string") {
+    throw new Error(`${path} must be a string`);
+  }
+  return value;
+}
+
+function requireNonEmptyString(value: unknown, path: string): string {
+  const text = requireString(value, path);
+  if (text.trim().length === 0) {
+    throw new Error(`${path} must be non-empty`);
+  }
+  return text;
+}
+
+function toCanonicalJsonValue(value: unknown, path: string): CanonicalJsonValue {
+  if (value === null || typeof value === "string" || typeof value === "boolean") {
+    return value;
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new Error(`${path} must be a finite number`);
+    }
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return value.map((item, index) => {
+      if (item === undefined) {
+        throw new Error(`${path}[${index}] must not be undefined`);
+      }
+      return toCanonicalJsonValue(item, `${path}[${index}]`);
+    });
+  }
+  if (typeof value === "object" && value !== null) {
+    const record = value as Record<string, unknown>;
+    const canonical: { [key: string]: CanonicalJsonValue } = {};
+    for (const key of Object.keys(record).sort()) {
+      const child = record[key];
+      if (child === undefined) {
+        continue;
+      }
+      canonical[key] = toCanonicalJsonValue(child, `${path}.${key}`);
+    }
+    return canonical;
+  }
+  throw new Error(`${path} must be JSON-serializable`);
+}
+
+function cloneJson(value: unknown): unknown {
+  return JSON.parse(JSON.stringify(value));
+}