@knitli/openapi-mcp 0.0.0

package/dist/cli.js

@@ -0,0 +1,249 @@
+#!/usr/bin/env node
+import { readFile, unlink, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { parseArgs } from "node:util";
+import { compile } from "./compile.js";
+import { compileRelease } from "./release/compile-release.js";
+import { publishRelease } from "./release/publish.js";
+import { generateKeypair, signArtifact, verifyArtifact } from "./sign.js";
+const USAGE = `openapi-mcp — compile OpenAPI documents into signed MCP artifacts
+
+  compile --spec <path> --api <name> --out <path> [--append] [--permissions <path>] [--sign-key <path>]  (legacy v3)
+  compile-release --spec <path> (--source-uri <https-uri> | --source-label <label>) --source-revision <revision>
+    --catalog <id> --release <id> --generation <n> --issuer <id> --key-id <id>
+    --policy-id <id> --allowed-origin <https-origin> --out <directory> --sign-key <path>
+    [--permissions <path>] [--reference-root <path> --reference-map <path>]
+  verify --artifact <path> --sig <path> --pub <path>  (legacy v3 exact-file signature)
+  keygen [--out <dir>]
+  serve --config <absolute-config-path>
+`;
+const DIAGNOSTIC_UNSAFE_CHARACTERS = 
+// biome-ignore lint/suspicious/noControlCharactersInRegex: diagnostics must visibly encode terminal controls.
+/[\u0000-\u001F\u007F-\u009F\u2028\u2029\p{Cf}]/gu;
+function renderDiagnostic(message) {
+    return message.replace(DIAGNOSTIC_UNSAFE_CHARACTERS, (character) => {
+        const codePoint = character.codePointAt(0);
+        if (codePoint === undefined)
+            return "�";
+        return `\\u${codePoint.toString(16).toUpperCase().padStart(4, "0")}`;
+    });
+}
+function fail(message, opts = {}) {
+    console.error(opts.usage === false
+        ? `error: ${renderDiagnostic(message)}`
+        : `error: ${renderDiagnostic(message)}\n\n${USAGE}`);
+    process.exit(1);
+}
+/** parseArgs throws on unknown flags and missing values; route that through fail. */
+function parseOrFail(config) {
+    try {
+        return parseArgs(config);
+    }
+    catch (err) {
+        fail(err instanceof Error ? err.message : String(err));
+    }
+}
+const [command, ...rest] = process.argv.slice(2);
+if (command === "serve") {
+    const { values } = parseOrFail({
+        args: rest,
+        options: { config: { type: "string" } },
+        strict: true,
+    });
+    if (!values.config)
+        fail("--config is required");
+    try {
+        const { parseOpenApiStdioConfig, serveOpenApiStdio } = await import("./stdio/index.js");
+        await serveOpenApiStdio(parseOpenApiStdioConfig(await readFile(values.config, "utf8")));
+    }
+    catch {
+        fail("OpenAPI stdio startup failed", { usage: false });
+    }
+}
+if (command === "keygen") {
+    const { values } = parseOrFail({
+        args: rest,
+        options: { out: { type: "string" } },
+        strict: true,
+    });
+    const dir = values.out ?? ".";
+    const pubPath = join(dir, "openapi-mcp.pub");
+    const keyPath = join(dir, "openapi-mcp.key");
+    try {
+        const { publicKeyPem, privateKeyPem } = generateKeypair();
+        // "wx" fails with EEXIST on any existing file *or* symlink (dangling or
+        // not) instead of following it — existsSync + a separate write would
+        // both race and let a pre-planted symlink redirect these bytes.
+        await writeFile(pubPath, publicKeyPem, { flag: "wx" });
+        try {
+            await writeFile(keyPath, privateKeyPem, { flag: "wx", mode: 0o600 });
+        }
+        catch (err) {
+            // All-or-nothing: never leave a public key with no matching private key.
+            await unlink(pubPath).catch(() => { });
+            throw err;
+        }
+    }
+    catch (err) {
+        const e = err;
+        if (e.code === "EEXIST")
+            fail(`${e.path} exists`, { usage: false });
+        fail(e instanceof Error ? e.message : String(e), { usage: false });
+    }
+    console.log(pubPath);
+    console.log(keyPath);
+    process.exit(0);
+}
+if (command === "verify") {
+    const { values } = parseOrFail({
+        args: rest,
+        options: {
+            artifact: { type: "string" },
+            sig: { type: "string" },
+            pub: { type: "string" },
+        },
+        strict: true,
+    });
+    if (!values.artifact)
+        fail("--artifact is required");
+    if (!values.sig)
+        fail("--sig is required");
+    if (!values.pub)
+        fail("--pub is required");
+    let ok;
+    try {
+        const sigB64 = (await readFile(values.sig, "utf8")).trim();
+        const pubPem = await readFile(values.pub, "utf8");
+        ok = await verifyArtifact(values.artifact, sigB64, pubPem);
+    }
+    catch (err) {
+        fail(err instanceof Error ? err.message : String(err), { usage: false });
+    }
+    console.log(ok ? "valid" : "invalid");
+    process.exit(ok ? 0 : 1);
+}
+if (command === "compile-release") {
+    const { values } = parseOrFail({
+        args: rest,
+        options: {
+            spec: { type: "string" },
+            "source-uri": { type: "string" },
+            "source-label": { type: "string" },
+            "source-revision": { type: "string" },
+            catalog: { type: "string" },
+            release: { type: "string" },
+            generation: { type: "string" },
+            issuer: { type: "string" },
+            "key-id": { type: "string" },
+            "policy-id": { type: "string" },
+            "allowed-origin": { type: "string", multiple: true },
+            out: { type: "string" },
+            "sign-key": { type: "string" },
+            permissions: { type: "string" },
+            "reference-root": { type: "string" },
+            "reference-map": { type: "string" },
+        },
+        strict: true,
+    });
+    for (const [flag, value] of [
+        ["--spec", values.spec],
+        ["--source-revision", values["source-revision"]],
+        ["--catalog", values.catalog],
+        ["--release", values.release],
+        ["--generation", values.generation],
+        ["--issuer", values.issuer],
+        ["--key-id", values["key-id"]],
+        ["--policy-id", values["policy-id"]],
+        ["--allowed-origin", values["allowed-origin"]?.[0]],
+        ["--out", values.out],
+        ["--sign-key", values["sign-key"]],
+    ])
+        if (!value)
+            fail(`${flag} is required`);
+    if ((values["source-uri"] === undefined) ===
+        (values["source-label"] === undefined)) {
+        fail("exactly one of --source-uri or --source-label is required");
+    }
+    if ((values["reference-root"] === undefined) !==
+        (values["reference-map"] === undefined)) {
+        fail("--reference-root and --reference-map must be supplied together");
+    }
+    const generation = Number(values.generation);
+    if (!Number.isSafeInteger(generation) || generation < 0)
+        fail("--generation must be a non-negative safe integer");
+    try {
+        const privateKeyPem = await readFile(values["sign-key"], "utf8").catch((error) => {
+            throw new Error("signing key could not be read", { cause: error });
+        });
+        const provenance = values["source-uri"] !== undefined
+            ? { sourceUri: values["source-uri"] }
+            : { sourceLabel: values["source-label"] };
+        const compiled = await compileRelease({
+            ...provenance,
+            specPath: values.spec,
+            sourceRevision: values["source-revision"],
+            catalogId: values.catalog,
+            releaseId: values.release,
+            generation,
+            issuer: values.issuer,
+            keyId: values["key-id"],
+            policyId: values["policy-id"],
+            allowedOrigins: values["allowed-origin"],
+            outDir: values.out,
+            privateKeyPem,
+            permissionsPath: values.permissions,
+            referenceRoot: values["reference-root"],
+            referenceMapPath: values["reference-map"],
+        });
+        await publishRelease(compiled, { directory: values.out });
+        console.log(`compiled immutable v5 release ${values.release}`);
+    }
+    catch (err) {
+        fail(err instanceof Error ? err.message : String(err), { usage: false });
+    }
+    process.exit(0);
+}
+if (command !== "serve") {
+    if (command !== "compile") {
+        fail(command ? `unknown command "${command}"` : "no command given");
+    }
+    const { values } = parseOrFail({
+        args: rest,
+        options: {
+            spec: { type: "string" },
+            api: { type: "string" },
+            out: { type: "string" },
+            append: { type: "boolean" },
+            permissions: { type: "string" },
+            "sign-key": { type: "string" },
+        },
+        strict: true,
+    });
+    if (!values.spec)
+        fail("--spec is required");
+    if (!values.api)
+        fail("--api is required");
+    if (!values.out)
+        fail("--out is required");
+    const started = Date.now();
+    try {
+        const result = await compile({
+            specPath: values.spec,
+            api: values.api,
+            outPath: values.out,
+            append: values.append === true,
+            permissionsPath: values.permissions,
+        });
+        console.log(`compiled ${result.operations} operations, ${result.schemas} schemas ` +
+            `(${result.mapped} permission-mapped) in ${Date.now() - started} ms -> ${values.out}`);
+        if (values["sign-key"]) {
+            const privateKeyPem = await readFile(values["sign-key"], "utf8");
+            const sig = await signArtifact(values.out, privateKeyPem);
+            await writeFile(`${values.out}.sig`, sig);
+            console.log(`signed -> ${values.out}.sig`);
+        }
+    }
+    catch (err) {
+        fail(err instanceof Error ? err.message : String(err), { usage: false });
+    }
+}

package/dist/compile.d.ts

@@ -0,0 +1,14 @@
+export interface CompileOptions {
+    specPath: string;
+    api: string;
+    outPath: string;
+    permissionsPath?: string;
+    /** Mount into an existing artifact instead of replacing it. */
+    append?: boolean;
+}
+export interface CompileResult {
+    operations: number;
+    schemas: number;
+    mapped: number;
+}
+export declare function compile(options: CompileOptions): Promise<CompileResult>;

package/dist/compile.js

@@ -0,0 +1,132 @@
+import { existsSync, renameSync, unlinkSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { DatabaseSync } from "node:sqlite";
+import { loadSpec } from "./load.js";
+import { extractOperations } from "./operations.js";
+import { applyPermissions, buildPermissionIndex, } from "./permissions.js";
+import { createSchema, LEGACY_FORMAT_VERSION } from "./schema.js";
+import { extractSchemas } from "./schemas.js";
+const COMPILER_VERSION = "0.1.0";
+export async function compile(options) {
+    const doc = await loadSpec(options.specPath);
+    const operations = extractOperations(doc, options.api);
+    const schemas = extractSchemas(doc, options.api);
+    if (options.permissionsPath) {
+        const dataset = JSON.parse(await readFile(options.permissionsPath, "utf8"));
+        applyPermissions(operations, buildPermissionIndex(dataset));
+    }
+    else {
+        // Still recompute risk so unmapped writes land on `high`.
+        applyPermissions(operations, { byMethod: new Map(), privilege: new Map() });
+    }
+    const exists = existsSync(options.outPath);
+    if (options.append && !exists) {
+        throw new Error(`${options.outPath} does not exist; cannot append`);
+    }
+    // A fresh compile builds into a sibling and renames over the target only
+    // after a clean close. Replacing in place would destroy a valid artifact the
+    // instant anything downstream failed — rollback can only empty the new
+    // database, it cannot bring the old one back. Append has nothing to protect:
+    // it mutates the existing artifact under its own transaction.
+    const buildPath = options.append
+        ? options.outPath
+        : `${options.outPath}.building`;
+    if (!options.append) {
+        try {
+            unlinkSync(buildPath);
+        }
+        catch {
+            // No leftover build file from an interrupted run.
+        }
+    }
+    let existingApis = [];
+    let committed = false;
+    const db = new DatabaseSync(buildPath);
+    try {
+        db.exec("BEGIN");
+        if (options.append) {
+            const version = db
+                .prepare("SELECT value FROM meta WHERE key = ?")
+                .get("format_version")?.value;
+            if (version !== String(LEGACY_FORMAT_VERSION)) {
+                throw new Error(`format_version mismatch: artifact is ${version}, compiler is ${LEGACY_FORMAT_VERSION}`);
+            }
+            const mounted = JSON.parse(db.prepare("SELECT value FROM meta WHERE key = ?").get("apis")?.value ?? "[]");
+            if (mounted.includes(options.api)) {
+                throw new Error(`api "${options.api}" is already mounted`);
+            }
+            existingApis = mounted;
+        }
+        else {
+            createSchema(db);
+        }
+        const insertOp = db.prepare(`INSERT INTO operations
+       (qualified_id, api, operation_id, method, path, safety, risk,
+        operation_type, pageable, deprecated, permissions, perm_confidence,
+        privilege_level, summary, tags, params_json, search_text, body_ref,
+        body_schema, body_media_type, server_url)
+       VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`);
+        for (const op of operations) {
+            insertOp.run(op.qualifiedId, op.api, op.operationId, op.method, op.path, op.safety, op.risk, op.operationType, op.pageable ? 1 : 0, op.deprecated ? 1 : 0, op.permissions ? JSON.stringify(op.permissions) : null, op.permConfidence, op.privilegeLevel, op.summary, op.tags, op.paramsJson, op.searchText, op.bodyRef, op.bodySchemaJson, op.bodyMediaType, op.serverUrl);
+        }
+        const insertSchema = db.prepare("INSERT INTO schemas (api, name, json) VALUES (?,?,?)");
+        for (const s of schemas)
+            insertSchema.run(s.api, s.name, s.json);
+        // External-content fts5: populate from the base table after loading it.
+        // Appending only indexes the newly mounted api's rows — the first
+        // mount's rows are already indexed and must not be touched again.
+        if (options.append) {
+            db.prepare(`INSERT INTO operations_fts (rowid, qualified_id, operation_id, summary, path, tags, api, search_text)
+         SELECT rowid, qualified_id, operation_id, summary, path, tags, api, search_text
+         FROM operations WHERE api = ?`).run(options.api);
+        }
+        else {
+            db.exec(`INSERT INTO operations_fts (rowid, qualified_id, operation_id, summary, path, tags, api, search_text)
+         SELECT rowid, qualified_id, operation_id, summary, path, tags, api, search_text FROM operations`);
+        }
+        // Global keys plus per-api namespaced provenance. `apis` is a JSON array so
+        // a second mount can append to it without rewriting anything.
+        const insertMeta = db.prepare("INSERT OR REPLACE INTO meta (key, value) VALUES (?,?)");
+        for (const [key, value] of Object.entries({
+            format_version: String(LEGACY_FORMAT_VERSION),
+            compiler_version: COMPILER_VERSION,
+            apis: JSON.stringify([...existingApis, options.api]),
+            [`${options.api}.source_path`]: options.specPath,
+            [`${options.api}.compiled_at`]: new Date().toISOString(),
+        })) {
+            insertMeta.run(key, value);
+        }
+        db.exec("COMMIT");
+        committed = true;
+    }
+    catch (err) {
+        try {
+            db.exec("ROLLBACK");
+        }
+        catch {
+            // No active transaction (e.g. BEGIN itself failed) — the original
+            // error is what matters; don't let a rollback failure mask it.
+        }
+        throw err;
+    }
+    finally {
+        db.close();
+        // Cleared only after the handle is closed, so this is safe on platforms
+        // that refuse to unlink an open file.
+        if (!committed && buildPath !== options.outPath) {
+            try {
+                unlinkSync(buildPath);
+            }
+            catch {
+                // Never created, or already gone.
+            }
+        }
+    }
+    if (buildPath !== options.outPath)
+        renameSync(buildPath, options.outPath);
+    return {
+        operations: operations.length,
+        schemas: schemas.length,
+        mapped: operations.filter((o) => o.permissions !== null).length,
+    };
+}

package/dist/compiler.d.ts

@@ -0,0 +1,13 @@
+export type { CompileOptions, CompileResult } from "./compile.ts";
+export { compile } from "./compile.ts";
+export { resolveLocalPointer } from "./operations.ts";
+export type { CompileReleaseOptions } from "./release/compile-release.ts";
+export { compileRelease } from "./release/compile-release.ts";
+export type { CompilerLimits } from "./release/load-v4.ts";
+export { DEFAULT_COMPILER_LIMITS, loadSpecV4, parseDocumentBytesV4, parseSpecBytesV4, redactSourcePath, } from "./release/load-v4.ts";
+export type { CompiledRelease, CompiledReleasePaths, } from "./release/publish.ts";
+export { discardCompiledRelease, publishRelease, } from "./release/publish.ts";
+export type { ReferenceMapEntryV1, ReferenceMapV1, ReferenceResolver, ResolvedReferenceV1, } from "./release/reference-map.ts";
+export { normalizeGraphUri, normalizeHttpsUri, referenceGraphDigest, sourceUriFromLabel, } from "./release/reference-map.ts";
+export { deriveReleasePublicKeyV4, generateKeypair, signArtifact, signReleaseManifestV4, verifyArtifact, } from "./sign.ts";
+export type { OperationRecord, PermConfidence, Risk, Safety, SchemaRecord, } from "./types.ts";

package/dist/compiler.js

@@ -0,0 +1,7 @@
+export { compile } from "./compile.js";
+export { resolveLocalPointer } from "./operations.js";
+export { compileRelease } from "./release/compile-release.js";
+export { DEFAULT_COMPILER_LIMITS, loadSpecV4, parseDocumentBytesV4, parseSpecBytesV4, redactSourcePath, } from "./release/load-v4.js";
+export { discardCompiledRelease, publishRelease, } from "./release/publish.js";
+export { normalizeGraphUri, normalizeHttpsUri, referenceGraphDigest, sourceUriFromLabel, } from "./release/reference-map.js";
+export { deriveReleasePublicKeyV4, generateKeypair, signArtifact, signReleaseManifestV4, verifyArtifact, } from "./sign.js";

package/dist/conformance/fixtures.d.ts

@@ -0,0 +1,24 @@
+import type { CandidateRef, CatalogId, ManifestEnvelope, ManifestTrust, OperationRecordV4, ReleaseId, SchemaRecordV4, StoredRecord, TypedOperationId, TypedSchemaId } from "../runtime/index.ts";
+export interface RuntimeConformanceFixture {
+    readonly catalogId: CatalogId;
+    readonly releaseA: ReleaseId;
+    readonly releaseB: ReleaseId;
+    readonly operationId: TypedOperationId;
+    readonly missingOperationId: TypedOperationId;
+    readonly schemaIds: readonly TypedSchemaId[];
+    readonly searchQuery: string;
+    readonly api: string;
+    readonly expectedCandidates: readonly CandidateRef[];
+    readonly envelopeA: ManifestEnvelope;
+    readonly envelopeB: ManifestEnvelope;
+    readonly trust: ManifestTrust;
+    readonly operationA: StoredRecord<OperationRecordV4>;
+    readonly operationB: StoredRecord<OperationRecordV4>;
+    readonly schemasA: readonly StoredRecord<SchemaRecordV4>[];
+    readonly schemasB: readonly StoredRecord<SchemaRecordV4>[];
+}
+/**
+ * Stable, cryptographically valid public fixture for every store adapter.
+ * The matching private key is deliberately not included.
+ */
+export declare const RUNTIME_CONFORMANCE_FIXTURE: RuntimeConformanceFixture;

package/dist/conformance/fixtures.js

@@ -0,0 +1,119 @@
+const catalogId = "conformance";
+const releaseA = "release-a";
+const releaseB = "release-b";
+const operationId = "operation:conformance:get-item";
+const itemSchemaId = "schema:conformance:#/components/schemas/Item";
+const tagSchemaId = "schema:conformance:#/components/schemas/Tag";
+const envelopeA = {
+    manifestJson: '{"allowedOrigins":["https://api.example.invalid"],"catalogId":"conformance","compiledAt":"2026-09-04T00:00:00.000Z","compilerVersion":"fixture-v1","contract":1,"format":4,"generation":1,"issuer":"conformance.example","keyId":"fixture-key","policyId":"fixture-policy","records":{"operation:conformance:get-item":"8eeb54ce7802f5e33d8cdfd0c2c59965f9867a18b3c5dbc81082fd3b8b9d5753","schema:conformance:#/components/schemas/Item":"e10267890d908b2db1fac5cb17b139c08f9cd8bf887600d8aec9e80156f42d66","schema:conformance:#/components/schemas/Tag":"5c28908d43c68938ba560687c098e8339f93564471043f7aefe4bdc2fb42a1dd"},"releaseId":"release-a","source":{"contentSha256":"0000000000000000000000000000000000000000000000000000000000000000","referenceGraphDigest":"1111111111111111111111111111111111111111111111111111111111111111","revision":"release-a","uri":"https://specs.example.invalid/conformance.json"}}',
+    signature: {
+        algorithm: "Ed25519",
+        keyId: "fixture-key",
+        signature: "ol9usPjzs-FujMZnOP8uSwCrSxnQc1LLuaMZp2oJXMJU0vFLX3tlLEfFNr6mzaF83ZU2xUlyUpoAzMQPlo5YBw",
+    },
+};
+const envelopeB = {
+    manifestJson: '{"allowedOrigins":["https://api.example.invalid"],"catalogId":"conformance","compiledAt":"2026-09-04T00:00:00.000Z","compilerVersion":"fixture-v1","contract":1,"format":4,"generation":2,"issuer":"conformance.example","keyId":"fixture-key","policyId":"fixture-policy","records":{"operation:conformance:get-item":"ab223e9204df8dbb2dd94982f10080db4517efc7b181fa02b3999b6657b893cd","schema:conformance:#/components/schemas/Item":"8416a81dbe1c8fe3ef459701d787384cc63f55953103a28bf1b384760cf59273","schema:conformance:#/components/schemas/Tag":"5c28908d43c68938ba560687c098e8339f93564471043f7aefe4bdc2fb42a1dd"},"releaseId":"release-b","source":{"contentSha256":"0000000000000000000000000000000000000000000000000000000000000000","referenceGraphDigest":"1111111111111111111111111111111111111111111111111111111111111111","revision":"release-b","uri":"https://specs.example.invalid/conformance.json"}}',
+    signature: {
+        algorithm: "Ed25519",
+        keyId: "fixture-key",
+        signature: "t2vi58Ars0_amzBA2NfBlb7NzEM6Bl7v5n5tFu437b1hxDSx6YxnuV7TFEDcvXJY06Fj_GEWE0cjExU6fJE_Cg",
+    },
+};
+function operation(summary, logicalDigest) {
+    return {
+        id: operationId,
+        logicalDigest: logicalDigest,
+        record: {
+            id: operationId,
+            api: "conformance",
+            operationId: "get-item",
+            method: "POST",
+            path: "/items",
+            origin: "https://api.example.invalid",
+            summary,
+            deprecated: false,
+            parameters: [],
+            requestBody: {
+                required: true,
+                content: [
+                    {
+                        mediaType: "application/json",
+                        schemaId: itemSchemaId,
+                        encoding: [],
+                    },
+                ],
+            },
+            schemaIds: [itemSchemaId],
+            advisory: {},
+        },
+    };
+}
+function schemas(title, itemDigest) {
+    return [
+        {
+            id: itemSchemaId,
+            logicalDigest: itemDigest,
+            record: {
+                id: itemSchemaId,
+                schema: {
+                    properties: { tag: { $ref: tagSchemaId } },
+                    title,
+                    type: "object",
+                },
+            },
+        },
+        {
+            id: tagSchemaId,
+            logicalDigest: "5c28908d43c68938ba560687c098e8339f93564471043f7aefe4bdc2fb42a1dd",
+            record: {
+                id: tagSchemaId,
+                schema: { type: "string" },
+            },
+        },
+    ];
+}
+function deepFreeze(value) {
+    if (typeof value !== "object" || value === null)
+        return value;
+    for (const key of Reflect.ownKeys(value)) {
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (descriptor && "value" in descriptor)
+            deepFreeze(descriptor.value);
+    }
+    return Object.freeze(value);
+}
+/**
+ * Stable, cryptographically valid public fixture for every store adapter.
+ * The matching private key is deliberately not included.
+ */
+export const RUNTIME_CONFORMANCE_FIXTURE = deepFreeze({
+    catalogId,
+    releaseA,
+    releaseB,
+    operationId,
+    missingOperationId: "operation:conformance:missing",
+    schemaIds: Object.freeze([itemSchemaId, tagSchemaId]),
+    searchQuery: "item",
+    api: "conformance",
+    expectedCandidates: Object.freeze([
+        { catalogId, releaseId: releaseA, operationId },
+        { catalogId, releaseId: releaseB, operationId },
+    ]),
+    envelopeA: Object.freeze(envelopeA),
+    envelopeB: Object.freeze(envelopeB),
+    trust: Object.freeze({
+        releaseKeys: Object.freeze([
+            Object.freeze({
+                issuer: "conformance.example",
+                keyId: "fixture-key",
+                publicKey: "MCowBQYDK2VwAyEAQujfB1nZVWKU0z212f9rLQ8SanSmrjKOv7Ah40_oMQU",
+            }),
+        ]),
+        rollbackKeys: Object.freeze([]),
+    }),
+    operationA: Object.freeze(operation("release a", "8eeb54ce7802f5e33d8cdfd0c2c59965f9867a18b3c5dbc81082fd3b8b9d5753")),
+    operationB: Object.freeze(operation("release b", "ab223e9204df8dbb2dd94982f10080db4517efc7b181fa02b3999b6657b893cd")),
+    schemasA: Object.freeze(schemas("release a", "e10267890d908b2db1fac5cb17b139c08f9cd8bf887600d8aec9e80156f42d66")),
+    schemasB: Object.freeze(schemas("release b", "8416a81dbe1c8fe3ef459701d787384cc63f55953103a28bf1b384760cf59273")),
+});

package/dist/conformance/index.d.ts

@@ -0,0 +1,2 @@
+export { RUNTIME_CONFORMANCE_FIXTURE, type RuntimeConformanceFixture, } from "./fixtures.ts";
+export { type CatalogStoreFactory, type CatalogStoreFactoryResult, type ConformanceTestAdapter, type RuntimeConformanceCandidateFault, type RuntimeConformanceDriverFault, type RuntimeConformanceDuplicateFault, type RuntimeConformanceOptions, type RuntimeConformanceScenario, runRuntimeConformanceSuite, } from "./runtime-suite.ts";

package/dist/conformance/index.js

@@ -0,0 +1,2 @@
+export { RUNTIME_CONFORMANCE_FIXTURE, } from "./fixtures.js";
+export { runRuntimeConformanceSuite, } from "./runtime-suite.js";

package/dist/conformance/runtime-suite.d.ts

@@ -0,0 +1,31 @@
+import { type CatalogStore } from "../runtime/index.ts";
+import type { RuntimeConformanceFixture } from "./fixtures.ts";
+export interface CatalogStoreFactoryResult {
+    readonly store: CatalogStore;
+    readonly fixture: RuntimeConformanceFixture;
+    readonly dispose?: () => void | Promise<void>;
+}
+export type RuntimeConformanceDuplicateFault = "duplicate-candidates" | "duplicate-manifest" | "duplicate-operation" | "duplicate-schemas";
+export type RuntimeConformanceCandidateFault = "candidate-malformed-operation-id" | "candidate-non-operation-id" | "candidate-cross-api";
+export type RuntimeConformanceDriverFault = "driver-candidates" | "driver-manifest" | "driver-operation" | "driver-schemas";
+export type RuntimeConformanceScenario = {
+    readonly fault: RuntimeConformanceDuplicateFault;
+} | {
+    readonly fault: RuntimeConformanceCandidateFault;
+} | {
+    readonly fault: RuntimeConformanceDriverFault;
+    readonly injectedDriverError: string;
+};
+export type CatalogStoreFactory = (scenario?: RuntimeConformanceScenario) => CatalogStoreFactoryResult | Promise<CatalogStoreFactoryResult>;
+export interface ConformanceTestAdapter {
+    test(name: string, run: () => void | Promise<void>): void;
+    equal(actual: unknown, expected: unknown, message?: string): void;
+    deepEqual(actual: unknown, expected: unknown, message?: string): void;
+    ok(value: unknown, message?: string): void;
+    rejects(run: () => unknown | Promise<unknown>, code: string, message?: string): Promise<void>;
+}
+export interface RuntimeConformanceOptions {
+    readonly testAdapter: ConformanceTestAdapter;
+}
+/** Register the transport-independent CatalogStore contract against a factory. */
+export declare function runRuntimeConformanceSuite(factory: CatalogStoreFactory, options: RuntimeConformanceOptions): void;