@magicvr/schema-ui-shell 0.1.0

package/app/App.d.ts

@@ -0,0 +1,23 @@
+import { type Branding } from "@/app/branding";
+import { type AppManifest, type NavigationContext } from "@/protocol/app-manifest";
+export interface AppProps {
+    manifest: AppManifest;
+    navigationContext?: NavigationContext;
+    /** Set when the boot /me session failed; surfaces a non-blocking notice. */
+    accountError?: unknown;
+    /** Injectable fetch for page-schema documents (defaults to `globalThis.fetch`). */
+    schemaFetcher?: typeof fetch;
+    /** Injectable fetch for table data sources such as `/api/users` (GOAL-011). */
+    resourceFetcher?: typeof fetch;
+    /** Authenticated user rendered in the header; present → show a sign-out button. */
+    currentUser?: {
+        id: string;
+        name?: string;
+        avatarUrl?: string;
+    } | null;
+    /** Revokes the session (AuthProvider flips to the login page). */
+    onLogout?: () => void;
+    /** Optional branding override (tests); defaults to live GET /api/branding. */
+    branding?: Branding;
+}
+export declare function App({ manifest, navigationContext, accountError, schemaFetcher, resourceFetcher, currentUser, onLogout, branding: brandingProp, }: AppProps): import("react").JSX.Element;

package/app/AuthGate.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Production auth gate (ADR-0035 stage order): renders the anonymous surfaces
+ * (login / invite accept / forced password change / terminal failure screens)
+ * and mounts the schema-driven shell `<App>` for an authenticated session.
+ *
+ * W14 F-001: extracted verbatim from main.tsx so the PRODUCTION assembly of
+ * <App> is unit-testable. The entry point runs createRoot side effects on
+ * import, which made its wiring invisible to tests — the exact gap that let
+ * GOAL-013 F-010 (`/api/schema` 挂认证) ship without a matching schemaFetcher
+ * Bearer transport, so every page failed D-VAL loading with an anonymous 401
+ * ("无法显示此页面"). The production-wiring regression lock lives in
+ * auth-gate.wiring.test.tsx.
+ */
+import type { AppManifest } from "@/protocol/app-manifest";
+/** Boot placeholder while the session adapter resolves (ADR-0035 D4). */
+export declare function BootScreen(): import("react").JSX.Element;
+/** Renders the login page when unauthenticated, the shell when authenticated. */
+export declare function AuthGate({ manifest }: {
+    manifest: AppManifest;
+}): import("react").JSX.Element;

package/app/HostFailureScreen.d.ts

@@ -0,0 +1,18 @@
+import type { HostFailure } from "@/host/failure";
+export interface HostFailureScreenProps {
+    failure: HostFailure;
+    onAction: (action: {
+        type: string;
+        url?: string;
+    }) => void;
+    /** When true, render as a section (caller provides the landmark, e.g. the shell main). */
+    bare?: boolean;
+}
+/**
+ * Global failure surface (ADR-0036 D7 / spec 10 §3.8 behavioral conformance):
+ * unique error title inside the `main` landmark, focus moved to the title on
+ * first terminal entry, assertive/polite live-region announcement by kind,
+ * no re-announcement for the same failureId, keyboard-reachable recovery
+ * actions.
+ */
+export declare function HostFailureScreen({ failure, onAction, bare }: HostFailureScreenProps): import("react").JSX.Element;

package/app/LoginPage.d.ts

@@ -0,0 +1,11 @@
+import { type LoginCaptcha } from "@/account/auth-client";
+/**
+ * R2 login surface (GOAL-005) + S3 visual upgrade (workspace-006 / D-004 Sign in).
+ * Uses design-system Card / Input / Label / Button primitives (not one-off inputs).
+ */
+export declare function LoginPage({ onLogin, }: {
+    onLogin: (username: string, password: string, captcha?: LoginCaptcha, resolveMFA?: (proof: string) => Promise<{
+        code: string;
+        recoveryCode?: string;
+    }>) => Promise<void>;
+}): import("react").JSX.Element;

package/app/ManifestFailure.d.ts

@@ -0,0 +1,3 @@
+export declare function ManifestFailure({ error }: {
+    error: unknown;
+}): import("react").JSX.Element;

package/app/branding.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Site branding / startup configuration (GOAL-013 + VP-007 S3): loads the
+ * Settings contribution's public startup projection for shell title + logos,
+ * the browser favicon, and the site-wide defaults (locale / timezone / theme).
+ * Empty logoUrl means hide logo in UI; document title always uses siteTitle.
+ */
+export declare const DEFAULT_SITE_TITLE = "Schema UI Core";
+export interface Branding {
+    siteTitle: string;
+    logoUrl: string;
+    logoUrlLight: string;
+    logoUrlDark: string;
+    faviconUrl: string;
+    defaultLocale: string;
+    supportedLocales: string[];
+    siteTimezone: string;
+    /** Site-wide default currency (ISO 4217; ""/unset = per-locale map). */
+    defaultCurrency: string;
+    defaultTheme: string;
+    copyrightText: string;
+    icpNumber: string;
+}
+export declare function subscribeToBrandingChanges(listener: () => void): () => void;
+/** Same-origin path or http(s) URL — mirrors the API normalizeLogoURL gate. */
+export declare function isSafeBrandingUrl(url: string): boolean;
+export declare function fetchBranding(fetcher?: typeof fetch): Promise<Branding>;
+export declare function defaultBranding(): Branding;
+/**
+ * Applies site title + favicon to the document; clears the favicon link when
+ * no favicon/logo URL is available. VP-007 S3: the favicon comes from
+ * `faviconUrl` (falling back to `logoUrl` for backward compatibility).
+ */
+export declare function applyDocumentBranding(branding: Branding): void;

package/app/config-events.d.ts

@@ -0,0 +1,18 @@
+export declare const CONFIG_CHANGED_EVENT = "schema-ui:config-changed";
+export declare const CONFIG_CHANGED_HEADER = "X-Schema-UI-Config-Changed";
+export declare const SETTINGS_BRANDING_NAMESPACE = "settings.branding";
+/** Account self-service profile saves (W13 T-05): the session refreshes /me. */
+export declare const ACCOUNT_PROFILE_NAMESPACE = "account.profile";
+/** Notification read/read-all (W13 T-06): the header badge refreshes at once. */
+export declare const NOTIFICATIONS_READ_NAMESPACE = "notifications.read";
+export interface ConfigChangedDetail {
+    namespace: string;
+}
+/** Wraps a resource fetcher with the host-level configuration change hook. */
+export declare function createConfigAwareFetcher(authFetch: typeof fetch): typeof fetch;
+/** Converts a successful module response into a namespaced host event. */
+export declare function publishConfigChangeFromResponse(response: Response): void;
+/** Publishes a host configuration change without naming a product endpoint. */
+export declare function notifyConfigChanged(namespace: string): void;
+/** Subscribes to one configuration namespace and returns its cleanup hook. */
+export declare function subscribeToConfigChanges(namespace: string, listener: () => void): () => void;

package/app/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * @schema-ui/shell 聚合导出：应用壳 + Host 互操作面（R3 六包化）。
+ */
+export * from "./App";
+export * from "./AuthGate";
+export * from "./LoginPage";
+export * from "./HostFailureScreen";
+export * from "./ManifestFailure";
+export * from "./branding";
+export * from "./config-events";
+export * from "./navigation";
+export * from "./notification-bell";
+export * from "../host/boot";
+export * from "../host/bootstrap";
+export * from "../host/claim";

package/app/navigation.d.ts

@@ -0,0 +1,27 @@
+import { type AppManifest, type NavigationContext } from "@/protocol/app-manifest";
+import { type MessageParams } from "@/i18n/catalog";
+export interface ProjectedLink {
+    type: "link";
+    href?: string;
+    label: string;
+    pageRef?: string;
+    url?: string;
+    icon?: string;
+    active: boolean;
+}
+export interface ProjectedGroup {
+    type: "group";
+    label: string;
+    icon?: string;
+    items: ProjectedLink[];
+}
+export type ProjectedItem = ProjectedLink | ProjectedGroup;
+export interface NavigationProjection {
+    top: ProjectedItem[];
+    sidebar: ProjectedItem[];
+    user: ProjectedItem[];
+}
+/** Translator used for labelKey/titleKey resolution; defaults to identity. */
+type Translator = (key: string, params?: MessageParams, literalFallback?: string) => string;
+export declare function projectNavigation(manifest: AppManifest, currentPath: string, context?: NavigationContext, t?: Translator): NavigationProjection;
+export {};

package/app/notification-bell.d.ts

@@ -0,0 +1,10 @@
+export interface NotificationBellProps {
+    /** Authed same-origin fetch (defaults to globalThis.fetch for bare tests). */
+    fetcher?: typeof fetch;
+    /** Navigation callback for the "view all" link (kept out of router). */
+    onViewAll: () => void;
+    /** W13 T-06: opens one notification — navigate to the list page with the
+     * detail target (/notifications?open=<id>); the page expands + marks read. */
+    onOpenItem: (id: string) => void;
+}
+export declare function NotificationBell({ fetcher, onViewAll, onOpenItem }: NotificationBellProps): import("react").JSX.Element;

package/components/data-table.d.ts

@@ -0,0 +1,43 @@
+import type { ReactNode } from "react";
+export type SortOrder = "asc" | "desc";
+export interface SortState {
+    field: string;
+    order: SortOrder;
+}
+export interface DataTableColumn<T> {
+    key: string;
+    /** Cell content or header node (checkboxes render in headers for selection). */
+    label: ReactNode;
+    sortable?: boolean;
+    /** W4 · GOAL-005: render the string fallback single-line truncated with a
+     *  native title full-text affordance so long values do not crowd out
+     *  sibling columns. Custom render cells are unaffected. Since the
+     *  table-style refresh every string cell truncates by default; this flag
+     *  is kept for schema declarations that opt into the 16rem cap. */
+    truncate?: boolean;
+    /** Column width hint (px number or CSS length). Content-driven auto layout
+     *  otherwise; a column that declares a width skips the default max-width
+     *  cap so it can exceed it (table-layout auto still grows on content). */
+    width?: number | string;
+    /** Minimum column width (px number or CSS length). */
+    minWidth?: number | string;
+    render?: (row: T) => ReactNode;
+}
+export interface DataTableProps<T> {
+    columns: DataTableColumn<T>[];
+    rows: T[];
+    rowKey: (row: T) => string;
+    sort?: SortState;
+    onSortChange?: (sort: SortState | null) => void;
+    loading?: boolean;
+    error?: string | null;
+    emptyMessage?: string;
+    caption?: string;
+    /** Invoked when a data row is clicked (row selection, S4 · GOAL-007). */
+    onRowClick?: (row: T) => void;
+    /** Row key of the currently selected row (highlight), S4 · GOAL-007. */
+    selectedKey?: string;
+    /** W15-F02: retry control shown in the error state. */
+    onRetry?: () => void;
+}
+export declare function DataTable<T>({ columns, rows, rowKey, sort, onSortChange, loading, error, emptyMessage, caption, onRowClick, selectedKey, onRetry, }: DataTableProps<T>): import("react").JSX.Element;

package/components/force-password-change.d.ts

@@ -0,0 +1 @@
+export declare function ForcePasswordChange(): import("react").JSX.Element;

package/components/invite-accept.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Public invitation acceptance surface (workspace-019 R3 · GOAL-004 C4):
+ * mounted at /invite/accept?token=… for unauthenticated visitors. Success
+ * returns WITHOUT tokens — the new user signs in with their chosen password.
+ */
+export declare function InviteAcceptPage(): import("react").JSX.Element;

package/components/locale-switcher.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Language switcher (S1 · C4) — refactored to a lightweight header
+ * dropdown (2026-08-14, user request):
+ *
+ * - Trigger: pure icon button (lucide Languages), same size/shape as the
+ *   theme toggle and notification bell (size-9 rounded-md ghost).
+ * - Menu: absolutely positioned panel (NO portal — the app root carries
+ *   the `dark` class, so the panel inherits the dark theme variables
+ *   automatically; no Radix/Headless portal scope issue).
+ * - Dark-mode styling via design tokens (shadcn convention): bg-popover
+ *   resolves to ~neutral-900 in dark, border-border to white/10
+ *   (~neutral-800), accent hover to ~neutral-800, popover-foreground to
+ *   ~neutral-200 — exactly the requested palette; light mode stays
+ *   correct automatically.
+ * - Selected item shows a checkmark (lucide Check) on the right.
+ *
+ * Reachable from the Shell and the anonymous login page — no settings
+ * permission required (VP-007 requirement).
+ */
+export interface LocaleSwitcherProps {
+    className?: string;
+}
+export declare function LocaleSwitcher({ className }: LocaleSwitcherProps): import("react").JSX.Element;

package/components/theme-toggle.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Theme toggle (S1 · C3) — W8 visual unification (GOAL-009):
+ *
+ * The trigger now matches the neighbouring header icon buttons (language
+ * switcher and notification bell): size-9 rounded-md ghost with
+ * text-muted-foreground + hover:bg-accent — instead of the form-styled
+ * outline Button. The tooltip / aria-label follow the active locale via
+ * the i18n catalog (shell.theme.toggle) — no hardcoded English.
+ */
+export declare function ThemeToggle(): import("react").JSX.Element;

package/components/timezone-switcher.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Timezone switcher (workspace-020 · R2 · C2).
+ *
+ * User-level timezone override next to the language switcher in the header
+ * locale channel (contract GOAL-002 D-001 §4.2): persists via the single
+ * localStorage channel "schema-ui:timezone"; "auto" removes the key.
+ * The option list is the documented common set (contract §6 permits a
+ * verifiable, extendable list); the effective timezone always degrades
+ * safely through the L1–L4 resolver in i18n/timezone.
+ */
+/** Common IANA set offered in the header menu (extendable per contract §6). */
+export declare const TIMEZONE_OPTIONS: readonly string[];
+export interface TimezoneSwitcherProps {
+    className?: string;
+}
+export declare function TimezoneSwitcher({ className }: TimezoneSwitcherProps): import("react").JSX.Element;

package/components/ui/async-state.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Shared pure state determination for async display regions (S4 · GOAL-004).
+ *
+ * statCard / chart / list-table each fetch a resource independently and used
+ * to invent their own ad-hoc "Loading…" text placeholder. This module
+ * centralizes the loading / error / empty / ready decision into one pure,
+ * directly-testable function so every consumer renders the same sequence
+ * (Skeleton while loading, a `role="alert"` message on error, a muted empty
+ * message otherwise) instead of drifting independently.
+ */
+export type AsyncDisplayState = "loading" | "error" | "empty" | "ready";
+export interface AsyncDisplayInput {
+    /** True while the underlying fetch/request has not yet settled. */
+    loading: boolean;
+    /** Non-null when the fetch/request failed. */
+    error: string | null;
+    /** True when the fetch succeeded but produced no renderable rows/points. */
+    isEmpty?: boolean;
+}
+/**
+ * Resolves the single display state a region should show.
+ *
+ * Precedence: `error` wins over `loading` (a failed fetch is not "still
+ * loading" even if a stale loading flag lingers), and `loading` wins over
+ * `isEmpty` (emptiness is unknown until the fetch settles).
+ */
+export declare function resolveAsyncDisplayState({ loading, error, isEmpty, }: AsyncDisplayInput): AsyncDisplayState;

package/components/ui/breadcrumbs.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Breadcrumb navigation for nested admin pages (GOAL-015).
+ *
+ * Semantic hierarchy, not visit history (user ruling 2026-08-14):
+ * the trail is the page's place in the manifest navigation tree
+ * (slot → group labels → page) plus consumer-declared parents for
+ * inner pages reached by row navigation (e.g. dictionary-entries →
+ * data-dictionary, task-runs → scheduled-tasks). No protocol change:
+ * the parent map is a web-shell declaration (BREADCRUMB_PAGE_PARENTS).
+ *
+ * Trail shape: 首页 => 一级页 => ... => n级内页 — the home page
+ * (manifest homePageRef, the domain-root default) always leads, then nav
+ * group labels and declared parents, then the current page. Visual: compact
+ * 12px trail — muted clickable ancestors (hover brighten + underline), thin
+ * "/" separators, brighter non-clickable current item, and an optional
+ * small circular ghost back button (semantic parent) at the far left.
+ */
+import { type MessageParams } from "@/i18n/catalog";
+export interface BreadcrumbEntry {
+    /** Page id (manifest pageId); group labels use the label text as key. */
+    pageId: string;
+    label: string;
+    /** Application route of this ancestor; empty for group labels. */
+    route: string;
+    /** True for the current (deepest) page. */
+    current: boolean;
+}
+export interface BreadcrumbPage {
+    pageId: string;
+    title?: string;
+    titleKey?: string;
+    route: string;
+}
+interface BreadcrumbNavItem {
+    pageRef?: string;
+    label?: string;
+    labelKey?: string;
+    items?: BreadcrumbNavItem[];
+}
+export declare function Breadcrumbs({ entries, onNavigate, onBack, showBack, }: {
+    entries: BreadcrumbEntry[];
+    onNavigate: (route: string) => void;
+    onBack: () => void;
+    /** Compact circular ghost back button (semantic parent), far left. */
+    showBack?: boolean;
+}): import("react").JSX.Element | null;
+/**
+ * Resolves the SEMANTIC breadcrumb trail for a matched page.
+ *
+ * Sources, in order:
+ *   1. manifest navigation tree — a page rendered under a group shows the
+ *      group labels as non-clickable ancestors (outermost first);
+ *   2. declared parents (options.parents) — inner pages reached by row
+ *      navigation declare their parent pageId; the chain walks up until a
+ *      page with no declared parent (its nav group chain, if any, is
+ *      included). Unknown declared parents fail safe (skipped).
+ *   3. pages not in the tree and without a declared parent are
+ *      single-level (no trail UI).
+ *
+ * This is NOT the visit history: the same page always shows the same
+ * trail regardless of how the user got there (user ruling 2026-08-14).
+ */
+export declare function resolveBreadcrumbTrail(pages: BreadcrumbPage[], currentPage: BreadcrumbPage | undefined, t: (key: string, params?: MessageParams, literalFallback?: string) => string, options?: {
+    navigation?: {
+        top?: BreadcrumbNavItem[];
+        sidebar?: BreadcrumbNavItem[];
+        user?: BreadcrumbNavItem[];
+    };
+    /** Consumer-declared parent pageId per inner page (web-shell level). */
+    parents?: Record<string, string>;
+    /**
+     * Home pageId (manifest app.homePageRef — the domain-root default page,
+     * not necessarily the dashboard). The trail ALWAYS starts with it:
+     * 首页 => 一级页 => ... => n级内页 (user spec 2026-08-14).
+     */
+    homePageId?: string;
+}): BreadcrumbEntry[];
+export {};

package/components/ui/button.d.ts

@@ -0,0 +1,11 @@
+import * as React from "react";
+import { type VariantProps } from "class-variance-authority";
+declare const buttonVariants: (props?: ({
+    variant?: "default" | "outline" | "secondary" | "ghost" | null | undefined;
+    size?: "default" | "sm" | "lg" | null | undefined;
+} & import("class-variance-authority/types").ClassProp) | undefined) => string;
+export interface ButtonProps extends React.ButtonHTMLAttributes<HTMLButtonElement>, VariantProps<typeof buttonVariants> {
+    asChild?: boolean;
+}
+declare const Button: React.ForwardRefExoticComponent<ButtonProps & React.RefAttributes<HTMLButtonElement>>;
+export { Button, buttonVariants };

package/components/ui/card.d.ts

@@ -0,0 +1,8 @@
+import * as React from "react";
+declare const Card: React.ForwardRefExoticComponent<React.HTMLAttributes<HTMLDivElement> & React.RefAttributes<HTMLDivElement>>;
+declare const CardHeader: React.ForwardRefExoticComponent<React.HTMLAttributes<HTMLDivElement> & React.RefAttributes<HTMLDivElement>>;
+declare const CardTitle: React.ForwardRefExoticComponent<React.HTMLAttributes<HTMLHeadingElement> & React.RefAttributes<HTMLParagraphElement>>;
+declare const CardDescription: React.ForwardRefExoticComponent<React.HTMLAttributes<HTMLParagraphElement> & React.RefAttributes<HTMLParagraphElement>>;
+declare const CardContent: React.ForwardRefExoticComponent<React.HTMLAttributes<HTMLDivElement> & React.RefAttributes<HTMLDivElement>>;
+declare const CardFooter: React.ForwardRefExoticComponent<React.HTMLAttributes<HTMLDivElement> & React.RefAttributes<HTMLDivElement>>;
+export { Card, CardHeader, CardFooter, CardTitle, CardDescription, CardContent };

package/components/ui/input.d.ts

@@ -0,0 +1,5 @@
+import * as React from "react";
+export interface InputProps extends React.InputHTMLAttributes<HTMLInputElement> {
+}
+declare const Input: React.ForwardRefExoticComponent<InputProps & React.RefAttributes<HTMLInputElement>>;
+export { Input };

package/components/ui/label.d.ts

@@ -0,0 +1,3 @@
+import * as React from "react";
+declare const Label: React.ForwardRefExoticComponent<React.LabelHTMLAttributes<HTMLLabelElement> & React.RefAttributes<HTMLLabelElement>>;
+export { Label };

package/components/ui/skeleton.d.ts

@@ -0,0 +1,2 @@
+declare function Skeleton({ className, ...props }: React.HTMLAttributes<HTMLDivElement>): import("react").JSX.Element;
+export { Skeleton };

package/components/ui/textarea.d.ts

@@ -0,0 +1,5 @@
+import * as React from "react";
+export interface TextareaProps extends React.TextareaHTMLAttributes<HTMLTextAreaElement> {
+}
+declare const Textarea: React.ForwardRefExoticComponent<TextareaProps & React.RefAttributes<HTMLTextAreaElement>>;
+export { Textarea };

package/host/boot.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Production host boot orchestration (ADR-0035 §2.3 stage order).
+ *
+ * Stage order is mandatory: availability-gate terminals must render WITHOUT
+ * fetching the manifest; auth-resolution terminals likewise. Each decision
+ * reuses the fixture-pinned `evaluateBootstrap`, so the vendored upstream
+ * host-bootstrap suite covers every stage this orchestrator executes.
+ */
+import type { AppManifest } from "@/protocol/app-manifest";
+import { discoverBootstrapDocument, type BootstrapAuth, type BootstrapEvaluation } from "@/host/bootstrap";
+import { type HostFailure } from "@/host/failure";
+/** Session adapter state (ADR-0035 D4): normalized by AuthContext. */
+export type SessionAdapterState = "loading" | "authenticated" | "unauthenticated" | "reauth-required" | "locked";
+/** Maps the session adapter state to the bootstrap normalized auth input (D4). */
+export declare function adapterAuthFor(status: SessionAdapterState, user: {
+    id: string;
+    name?: string;
+} | null): BootstrapAuth;
+export interface HostBootState {
+    evaluation: BootstrapEvaluation;
+    failure: HostFailure | null;
+    manifest: AppManifest | null;
+}
+export interface HostBootInput {
+    documentResult: Awaited<ReturnType<typeof discoverBootstrapDocument>>;
+    auth: BootstrapAuth;
+    manifestLoader: () => Promise<{
+        manifest: AppManifest;
+        bytes: Uint8Array;
+    }>;
+    registry?: unknown;
+}
+/**
+ * Executes the deterministic bootstrap lifecycle in production stage order.
+ *
+ * 1. discovery result (already resolved by the caller);
+ * 2. bootstrap-validation + availability-gate + auth-resolution (no manifest
+ *    fetch happens before terminals are decided);
+ * 3. manifest load + integrity check (declared sha256);
+ * 4. manifest capability narrowing (degraded);
+ * 5. READY / READY_DEGRADED.
+ */
+export declare function bootHost(input: HostBootInput): Promise<HostBootState>;
+/** Login/session gate: locked and reauth-required must never reach ready. */
+export declare function isBootTerminal(state: HostBootState): boolean;
+/**
+ * Reauth-required terminal for the post-boot session-loss path (ADR-0035 D7):
+ * the same closed failure result the boot orchestrator produces when the
+ * adapter reports reauth-required before manifest-load.
+ */
+export declare function reauthFailure(): HostFailure;
+/**
+ * Account-lock terminal (GOAL-004 S4-6, ADR-0035 D7 / ADR-0036 D6): the
+ * closed failure result for the locked adapter state. account-locked allows
+ * home/support only — no reauth, no retry loop.
+ */
+export declare function lockedFailure(): HostFailure;
+/** Executes a recovery action; bootstrap retry always rebuilds the instance. */
+export declare function executeBootRecovery(action: {
+    type: string;
+    url?: string;
+}): void;
+/** W13 F-015: a support URL is only navigable when it resolves to http(s). */
+export declare function isSafeSupportUrl(raw: string): boolean;

package/host/bootstrap.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Host bootstrap runtime (ADR-0035 / spec 10 §2, `host.bootstrap`).
+ *
+ * Production entry: `discoverBootstrapDocument()` fetches the optional public
+ * bootstrap document from the real entry; `evaluateBootstrap()` implements
+ * the deterministic lifecycle stages. This module is consumed by the
+ * production boot path (`main.tsx`) — it is not a fixture adapter.
+ *
+ * Pinned upstream machine contracts: `src/protocol/upstream/provenance-v2.8.json`.
+ */
+export declare const DEFAULT_BOOTSTRAP_PATH = "/.well-known/schema-ui/host-bootstrap.json";
+export declare const BOOTSTRAP_VERSION: "1.0";
+export type BootstrapAvailabilityMode = "normal" | "maintenance" | "upgrade-required" | "degraded";
+export interface BootstrapAvailability {
+    mode: BootstrapAvailabilityMode;
+    messageKey?: string;
+    retryAfterSeconds?: number;
+    minimumHostVersion?: string;
+    disabledCapabilities?: string[];
+}
+export interface BootstrapDocument {
+    bootstrapVersion: string;
+    requiredCapabilities: string[];
+    manifest: {
+        url: string;
+        sha256?: string;
+    };
+    availability: BootstrapAvailability;
+}
+export type BootstrapAuthState = "anonymous" | "authenticated" | "reauth-required" | "locked";
+export interface BootstrapAuth {
+    state: BootstrapAuthState;
+    principal?: {
+        id?: string;
+        name?: string;
+        roles?: string[];
+    };
+    expiresAt?: string;
+    provenance?: string;
+}
+export interface HostSupport {
+    supportedBootstrapVersions: string[];
+    supportedCapabilities: string[];
+}
+export type BootstrapResultCode = "OK" | "INVALID_HOST_SUPPORT" | "INVALID_REQUIRED_CAPABILITIES" | "UNSUPPORTED_BOOTSTRAP_VERSION" | "INVALID_BOOTSTRAP_DOCUMENT" | "MISSING_REQUIRED_CAPABILITY" | "BOOTSTRAP_DOCUMENT_FAILED" | "MANIFEST_CAPABILITY_REJECTED" | "MANIFEST_INTEGRITY_FAILED";
+export type BootstrapResult = "READY" | "READY_DEGRADED" | "MAINTENANCE" | "UPGRADE_REQUIRED" | "REAUTH_REQUIRED" | "ACCOUNT_LOCKED" | "BOOTSTRAP_DOCUMENT_FAILED" | "BOOTSTRAP_NEGOTIATION_REJECTED" | "MANIFEST_CAPABILITY_REJECTED" | "MANIFEST_INTEGRITY_FAILED";
+export type BootstrapFetchClassification = "rate-limited" | "timeout" | "offline" | "unavailable" | "protocol";
+export interface BootstrapEvaluation {
+    code: BootstrapResultCode;
+    result: BootstrapResult;
+    phase: string;
+    fetchClassification: BootstrapFetchClassification | null;
+    missingCapabilities: string[];
+    effectiveCapabilities: string[] | null;
+    context: {
+        user: {
+            id: string;
+            name: string;
+            roles: string[];
+        };
+    } | null;
+}
+export interface BootstrapDiscovery {
+    status: "ok" | "not-provided" | "failed";
+    document: BootstrapDocument | null;
+    classification: BootstrapFetchClassification | null;
+    bytesSha256: string | null;
+}
+/**
+ * Discovery (stage 1): GET the default (or explicit) bootstrap URL with
+ * `credentials: omit`. Only 200 succeeds; 404/410 on the default entry means
+ * "not provided" (fallback to the ADR-0025 manifest entry); every other
+ * status, redirect, wrong content type or parse failure is fail-closed.
+ */
+export declare function discoverBootstrapDocument(options?: {
+    url?: string;
+    fetcher?: typeof fetch;
+}): Promise<BootstrapDiscovery>;
+/**
+ * Deterministic lifecycle evaluation (stages 2–9). Mirrors the upstream B1
+ * reference (`host-bootstrap.js`) so the vendored conformance fixtures must
+ * pass against this production implementation without exclusions.
+ */
+export declare function evaluateBootstrap(input: {
+    document: BootstrapDocument | null;
+    fetch: {
+        status: "ok" | "not-provided" | "failed";
+        classification?: string | null;
+    };
+    hostSupport: HostSupport;
+    auth: BootstrapAuth;
+    manifest: {
+        protocolVersion: string;
+        requiredCapabilities?: string[];
+    } | null;
+    integrity: {
+        declaredSha256: string;
+        computedSha256: string;
+    } | null;
+    capabilityRegistry: {
+        capabilities: Record<string, unknown>;
+    };
+}): BootstrapEvaluation;
+/** SHA-256 of raw bytes as lowercase hex (Web Crypto, browser + node). */
+export declare function sha256Hex(bytes: Uint8Array): Promise<string>;