@microck/canonfig 2.0.0

package/dist/domain/profile.js

@@ -0,0 +1,950 @@
+import { Schema } from "effect";
+import { defaultPolicyForKind, ApplyPolicy as ApplyPolicySchema, ResourceKind as ResourceKindSchema, ToolRecipeRef, policyCompatibleWithKind, } from "./resource.js";
+import { canonicalRecipeIndexUrl, recipeValidationError, } from "./recipe-versions.js";
+import { BlobId, ContentDigest as ContentDigestSchema, CredentialReference as CredentialReferenceSchema, GroupName, ProfileId as ProfileIdSchema, ProfileRevisionId as ProfileRevisionIdSchema, ResourceId as ResourceIdSchema, SourceSignature, Timestamp, ToolId, } from "./brand.js";
+import { canonicalJson, decodeJsonc, digestOf, sha256Hex, } from "../profile/profile-codec.js";
+const ConfigValueInputSchema = Schema.Union([
+    Schema.String,
+    Schema.Number,
+    Schema.Boolean,
+    Schema.Array(Schema.String),
+]);
+const AuthoringFileSchema = Schema.Struct({
+    kind: Schema.Literal("file"),
+    content: Schema.String,
+    executable: Schema.optional(Schema.Boolean),
+    symlinkTo: Schema.optional(Schema.NonEmptyString),
+});
+const AuthoringDirectoryFileSchema = Schema.Struct({
+    path: Schema.NonEmptyString,
+    content: Schema.String,
+    executable: Schema.optional(Schema.Boolean),
+});
+const AuthoringLoginSchema = Schema.Union([
+    Schema.Struct({ required: Schema.Literal(false) }),
+    Schema.Struct({
+        required: Schema.Literal(true),
+        howTo: Schema.NonEmptyString,
+    }),
+]);
+export const ResourceSpecInputSchema = Schema.Union([
+    AuthoringFileSchema,
+    Schema.Struct({
+        kind: Schema.Literal("directory"),
+        files: Schema.Array(AuthoringDirectoryFileSchema),
+    }),
+    Schema.Struct({
+        kind: Schema.Literal("config"),
+        format: Schema.Literals(["toml", "json", "yaml"]),
+        keys: Schema.Array(Schema.Struct({
+            path: Schema.NonEmptyString,
+            value: ConfigValueInputSchema,
+        })),
+    }),
+    Schema.Struct({
+        kind: Schema.Literal("skill"),
+        name: Schema.NonEmptyString,
+        files: Schema.Array(AuthoringDirectoryFileSchema),
+    }),
+    Schema.Struct({
+        kind: Schema.Literal("tool"),
+        toolId: ToolId,
+        recipes: Schema.Array(ToolRecipeRef),
+        login: Schema.optional(AuthoringLoginSchema),
+    }),
+    Schema.Struct({
+        kind: Schema.Literal("credential"),
+        reference: CredentialReferenceSchema,
+    }),
+    Schema.Struct({
+        kind: Schema.Literal("schedule"),
+        calendar: Schema.Union([
+            Schema.Struct({ type: Schema.Literal("daily"), at: Schema.NonEmptyString }),
+            Schema.Struct({
+                type: Schema.Literal("weekly"),
+                days: Schema.Array(Schema.NonEmptyString),
+                at: Schema.NonEmptyString,
+            }),
+            Schema.Struct({
+                type: Schema.Literal("custom"),
+                expression: Schema.NonEmptyString,
+            }),
+        ]),
+        timezone: Schema.NonEmptyString,
+    }),
+]);
+export const VerificationInputSchema = Schema.Union([
+    Schema.Struct({ method: Schema.Literal("digest"), digest: ContentDigestSchema }),
+    Schema.Struct({
+        method: Schema.Literal("command"),
+        command: Schema.Array(Schema.NonEmptyString),
+        expectContains: Schema.optional(Schema.String),
+    }),
+    Schema.Struct({
+        method: Schema.Literal("executable-present"),
+        executable: Schema.NonEmptyString,
+    }),
+    Schema.Struct({
+        method: Schema.Literal("credential-present"),
+        reference: CredentialReferenceSchema,
+    }),
+    Schema.Struct({ method: Schema.Literal("symlink"), target: Schema.NonEmptyString }),
+]);
+const verificationAllowedForSpec = (kind, spec, method) => {
+    if (spec.kind !== kind)
+        return verificationAllowed(kind, method);
+    if (spec.kind === "file") {
+        return spec.symlinkTo === undefined
+            ? method === "digest"
+            : method === "symlink";
+    }
+    return verificationAllowed(kind, method);
+};
+const verificationContentIssue = (resource) => {
+    if (resource.kind !== "file" || resource.spec.kind !== "file")
+        return undefined;
+    if (resource.spec.symlinkTo === undefined) {
+        return resource.verify.method === "digest"
+            && resource.verify.digest !== sha256Hex(resource.spec.content)
+            ? "digest verification does not match authored file content"
+            : undefined;
+    }
+    return resource.verify.method === "symlink"
+        && resource.verify.target !== resource.spec.symlinkTo
+        ? "symlink verification target does not match authored symlink target"
+        : undefined;
+};
+export const ProfileResourceInputSchema = Schema.Struct({
+    id: ResourceIdSchema,
+    kind: ResourceKindSchema,
+    policy: Schema.optional(ApplyPolicySchema),
+    target: Schema.NonEmptyString,
+    groups: Schema.optional(Schema.Array(GroupName)),
+    dependsOn: Schema.optional(Schema.Array(ResourceIdSchema)),
+    spec: ResourceSpecInputSchema,
+    verify: VerificationInputSchema,
+}).check(Schema.makeFilter((resource) => {
+    const policy = resource.policy ?? defaultPolicyForKind[resource.kind];
+    if (!policyCompatibleWithKind(resource.kind, policy)) {
+        return {
+            path: ["policy"],
+            issue: `policy ${policy} is not compatible with resource kind ${resource.kind}`,
+        };
+    }
+    const verificationIssue = verificationContentIssue(resource);
+    if (verificationIssue !== undefined) {
+        return {
+            path: ["verify"],
+            issue: verificationIssue,
+        };
+    }
+    return undefined;
+}));
+export const ProfileGroupSchema = Schema.Struct({
+    name: GroupName,
+    description: Schema.optional(Schema.NonEmptyString),
+});
+export const ScheduleDefaultSchema = Schema.Union([
+    Schema.Struct({
+        type: Schema.Literal("daily"),
+        at: Schema.NonEmptyString,
+        timezone: Schema.NonEmptyString,
+    }),
+    Schema.Struct({
+        type: Schema.Literal("weekly"),
+        days: Schema.Array(Schema.NonEmptyString),
+        at: Schema.NonEmptyString,
+        timezone: Schema.NonEmptyString,
+    }),
+    Schema.Struct({
+        type: Schema.Literal("custom"),
+        expression: Schema.NonEmptyString,
+        timezone: Schema.NonEmptyString,
+    }),
+]);
+/** Strict schema for the normalized v2 authoring contract. */
+export const MachineProfileSchema = Schema.Struct({
+    id: ProfileIdSchema,
+    version: Schema.Literal(2),
+    name: Schema.NonEmptyString,
+    groups: Schema.Array(ProfileGroupSchema),
+    resources: Schema.Array(ProfileResourceInputSchema),
+    scheduleDefault: ScheduleDefaultSchema,
+});
+/** Authoring schema permits only documented fields and fills omissions in normalization. */
+export const MachineProfileAuthoringSchema = Schema.Struct({
+    id: ProfileIdSchema,
+    version: Schema.optional(Schema.Literal(2)),
+    name: Schema.NonEmptyString,
+    groups: Schema.optional(Schema.Array(ProfileGroupSchema)),
+    resources: Schema.optional(Schema.Array(ProfileResourceInputSchema)),
+    scheduleDefault: Schema.optional(ScheduleDefaultSchema),
+});
+export const PublishedResourceSchema = Schema.Struct({
+    id: ResourceIdSchema,
+    kind: ResourceKindSchema,
+    policy: ApplyPolicySchema,
+    target: Schema.NonEmptyString,
+    groups: Schema.optional(Schema.Array(GroupName)),
+    dependsOn: Schema.Array(ResourceIdSchema),
+    blobs: Schema.Array(BlobId),
+});
+export const ProfileRevisionSchema = Schema.Struct({
+    id: ProfileRevisionIdSchema,
+    profileId: ProfileIdSchema,
+    sequence: Schema.Natural,
+    canonicalBytes: Schema.String,
+    digest: ContentDigestSchema,
+    signature: SourceSignature,
+    publishedAt: Timestamp,
+    resources: Schema.Array(PublishedResourceSchema),
+    groups: Schema.Array(ProfileGroupSchema),
+    scheduleDefault: Schema.optional(ScheduleDefaultSchema),
+});
+export const DiscoveryEvidenceRecordSchema = Schema.Struct({
+    source: Schema.NonEmptyString,
+    line: Schema.Int.check(Schema.isGreaterThan(0)),
+    excerpt: Schema.String,
+    kind: Schema.Literals([
+        "invocation",
+        "config",
+        "hook",
+        "mcp",
+        "package-metadata",
+        "prose",
+    ]),
+});
+export const ProfileChangeProposalSchema = Schema.Struct({
+    createdAt: Timestamp,
+    reason: Schema.NonEmptyString,
+    additions: Schema.Array(ProfileResourceInputSchema),
+    modifications: Schema.Array(ProfileResourceInputSchema),
+    removals: Schema.Array(ResourceIdSchema),
+    evidence: Schema.Array(DiscoveryEvidenceRecordSchema),
+});
+export const CredentialDescriptorSchema = Schema.Struct({
+    reference: CredentialReferenceSchema,
+    description: Schema.NonEmptyString,
+    loginRequired: Schema.Boolean,
+});
+/** Runtime schema aliases share names with their corresponding domain types. */
+export const ResourceSpecInput = ResourceSpecInputSchema;
+export const VerificationInput = VerificationInputSchema;
+export const ProfileResourceInput = ProfileResourceInputSchema;
+export const ProfileGroup = ProfileGroupSchema;
+export const ScheduleDefault = ScheduleDefaultSchema;
+export const MachineProfile = MachineProfileSchema;
+export const PublishedResource = PublishedResourceSchema;
+export const ProfileRevision = ProfileRevisionSchema;
+export const DiscoveryEvidenceRecord = DiscoveryEvidenceRecordSchema;
+export const ProfileChangeProposal = ProfileChangeProposalSchema;
+export const CredentialDescriptor = CredentialDescriptorSchema;
+/**
+ * Validation failures as tagged errors.
+ */
+export class DuplicateResourceError extends Schema.TaggedError()("DuplicateResourceError", { id: Schema.String }) {
+}
+export class MissingDependencyError extends Schema.TaggedError()("MissingDependencyError", { id: Schema.String, dependsOn: Schema.String }) {
+}
+export class DependencyCycleError extends Schema.TaggedError()("DependencyCycleError", { cycle: Schema.Array(Schema.String) }) {
+}
+export class PolicyKindMismatchError extends Schema.TaggedError()("PolicyKindMismatchError", { id: Schema.String, kind: Schema.String, policy: Schema.String }) {
+}
+export class InvalidTargetError extends Schema.TaggedError()("InvalidTargetError", { id: Schema.String, target: Schema.String, reason: Schema.String }) {
+}
+export class ConflictingResourceTargetError extends Schema.TaggedError()("ConflictingResourceTargetError", {
+    id: Schema.String,
+    target: Schema.String,
+    conflictsWith: Schema.String,
+    reason: Schema.String,
+}) {
+}
+export class InvalidScheduleError extends Schema.TaggedError()("InvalidScheduleError", { id: Schema.String, reason: Schema.String }) {
+}
+export class DuplicateGroupError extends Schema.TaggedError()("DuplicateGroupError", { name: Schema.String }) {
+}
+export class MissingGroupReferenceError extends Schema.TaggedError()("MissingGroupReferenceError", { id: Schema.String, group: Schema.String }) {
+}
+export class ResourceSpecKindMismatchError extends Schema.TaggedError()("ResourceSpecKindMismatchError", { id: Schema.String, kind: Schema.String, specKind: Schema.String }) {
+}
+export class VerificationKindMismatchError extends Schema.TaggedError()("VerificationKindMismatchError", { id: Schema.String, kind: Schema.String, method: Schema.String }) {
+}
+export class VerificationContentMismatchError extends Schema.TaggedError()("VerificationContentMismatchError", { id: Schema.String, method: Schema.String, reason: Schema.String }) {
+}
+export class InvalidBuildPolicyError extends Schema.TaggedError()("InvalidBuildPolicyError", { id: Schema.String, reason: Schema.String }) {
+}
+export class InvalidRecipeError extends Schema.TaggedError()("InvalidRecipeError", { id: Schema.String, reason: Schema.String }) {
+}
+/** Aggregate contract failure preserving all precise tagged graph errors. */
+export class ProfileContractError extends Error {
+    errors;
+    constructor(errors) {
+        super(errors.map((error) => error._tag).join(", "));
+        this.name = "ProfileContractError";
+        this.errors = errors;
+    }
+}
+export const validateMachineProfile = (profile, platform = "windows") => {
+    const errors = [];
+    const groups = new Set();
+    for (const group of profile.groups) {
+        if (groups.has(group.name)) {
+            errors.push(new DuplicateGroupError({ name: group.name }));
+        }
+        groups.add(group.name);
+    }
+    errors.push(...validateProfileResources(profile.resources, groups, platform));
+    const scheduleError = validateScheduleDefault(profile.scheduleDefault);
+    if (scheduleError !== null)
+        errors.push(scheduleError);
+    return errors;
+};
+/** Validate resource graph: returns every violation, not just the first. */
+export const validateProfileResources = (resources, declaredGroups, platform = "windows") => {
+    const errors = [];
+    const seen = new Set();
+    for (const resource of resources) {
+        if (seen.has(resource.id)) {
+            errors.push(new DuplicateResourceError({ id: resource.id }));
+        }
+        seen.add(resource.id);
+    }
+    const byId = new Map(resources.map((resource) => [resource.id, resource]));
+    for (const resource of resources) {
+        if (resource.spec.kind !== resource.kind) {
+            errors.push(new ResourceSpecKindMismatchError({
+                id: resource.id,
+                kind: resource.kind,
+                specKind: resource.spec.kind,
+            }));
+        }
+        for (const dep of resource.dependsOn ?? []) {
+            if (!byId.has(dep)) {
+                errors.push(new MissingDependencyError({ id: resource.id, dependsOn: dep }));
+            }
+        }
+        if (declaredGroups !== undefined) {
+            for (const group of resource.groups ?? []) {
+                if (!declaredGroups.has(group)) {
+                    errors.push(new MissingGroupReferenceError({ id: resource.id, group }));
+                }
+            }
+        }
+        const kind = resource.kind;
+        const policy = resource.policy ?? defaultPolicy(kind);
+        if (!policyAllowed(kind, policy)) {
+            errors.push(new PolicyKindMismatchError({ id: resource.id, kind, policy }));
+        }
+        if (resource.spec.kind === "schedule") {
+            const scheduleError = validateSchedule(resource);
+            if (scheduleError !== null)
+                errors.push(scheduleError);
+        }
+        errors.push(...validateRecipes(resource));
+        errors.push(...validateVerificationContent(resource));
+        errors.push(...validateBuildPolicies(resource));
+        if (!verificationAllowedForSpec(resource.kind, resource.spec, resource.verify.method)) {
+            errors.push(new VerificationKindMismatchError({
+                id: resource.id,
+                kind: resource.kind,
+                method: resource.verify.method,
+            }));
+        }
+    }
+    errors.push(...validateResourceTargetConflicts(resources, platform));
+    const cycle = findDependencyCycle(resources);
+    if (cycle !== null)
+        errors.push(new DependencyCycleError({ cycle }));
+    return errors;
+};
+const validateRecipes = (resource) => {
+    if (resource.spec.kind !== "tool")
+        return [];
+    return resource.spec.recipes.flatMap((recipe) => {
+        const reason = recipeValidationError(recipe);
+        return reason === undefined
+            ? []
+            : [new InvalidRecipeError({
+                    id: resource.id,
+                    reason: `recipe ${recipe.method}/${recipe.package}: ${reason}`,
+                })];
+    });
+};
+const validateVerificationContent = (resource) => {
+    const reason = verificationContentIssue(resource);
+    return reason !== undefined
+        ? [new VerificationContentMismatchError({
+                id: resource.id,
+                method: resource.verify.method,
+                reason,
+            })]
+        : [];
+};
+const validateBuildPolicies = (resource) => {
+    if (resource.spec.kind !== "tool")
+        return [];
+    const errors = [];
+    for (const recipe of resource.spec.recipes) {
+        const policy = recipe.buildPolicy ?? { mode: "scripts-disabled" };
+        if (policy.mode === "scripts-disabled")
+            continue;
+        if (!Number.isFinite(Date.parse(policy.reviewedAt))) {
+            errors.push(new InvalidBuildPolicyError({
+                id: resource.id,
+                reason: `recipe ${recipe.method}/${recipe.package} has an invalid review timestamp`,
+            }));
+        }
+        if (policy.executables.length === 0
+            || policy.paths.length === 0
+            || policy.steps.length === 0) {
+            errors.push(new InvalidBuildPolicyError({
+                id: resource.id,
+                reason: `recipe ${recipe.method}/${recipe.package} requires executable, path, and build-step bounds`,
+            }));
+        }
+        if (!policy.capabilities.includes("execute")) {
+            errors.push(new InvalidBuildPolicyError({
+                id: resource.id,
+                reason: `recipe ${recipe.method}/${recipe.package} must explicitly allow execute`,
+            }));
+        }
+        if (policy.steps.some((step) => !policy.executables.includes(step.executable))) {
+            errors.push(new InvalidBuildPolicyError({
+                id: resource.id,
+                reason: `recipe ${recipe.method}/${recipe.package} has an unbounded build executable`,
+            }));
+        }
+        for (const origin of policy.origins) {
+            try {
+                const url = new URL(origin);
+                if (url.protocol !== "https:" || url.origin !== origin) {
+                    errors.push(new InvalidBuildPolicyError({
+                        id: resource.id,
+                        reason: `recipe ${recipe.method}/${recipe.package} has a non-exact HTTPS origin`,
+                    }));
+                }
+            }
+            catch {
+                errors.push(new InvalidBuildPolicyError({
+                    id: resource.id,
+                    reason: `recipe ${recipe.method}/${recipe.package} has an invalid origin`,
+                }));
+            }
+        }
+    }
+    return errors;
+};
+const defaultPolicy = (kind) => {
+    return defaultPolicyForKind[kind];
+};
+const policyAllowed = (kind, policy) => {
+    return policyCompatibleWithKind(kind, policy);
+};
+const verificationAllowed = (kind, method) => {
+    switch (kind) {
+        case "file":
+            return method === "digest" || method === "symlink" || method === "command";
+        case "directory":
+        case "config":
+        case "skill":
+            return method === "digest" || method === "command";
+        case "tool":
+            return method === "executable-present" || method === "command";
+        case "credential":
+            return method === "credential-present" || method === "command";
+        case "schedule":
+            return method === "command";
+    }
+};
+const invalidTargetReason = (target) => {
+    if (target.trim().length === 0) {
+        return "empty target";
+    }
+    if (target.includes("\0")) {
+        return "null byte in target";
+    }
+    const pathSegments = target.replaceAll("\\", "/").split("/");
+    if (pathSegments.some((segment) => segment === "..")) {
+        return "parent traversal in target";
+    }
+    if (/[*?[\]]/u.test(target)) {
+        return "glob in target";
+    }
+    return undefined;
+};
+const normalizedTargetPath = (value, platform = "windows") => {
+    const slashSeparated = value.replaceAll("\\", "/");
+    const drive = /^([A-Za-z]):(?=\/|$)/u.exec(slashSeparated);
+    const prefix = drive === null
+        ? slashSeparated.startsWith("/")
+            ? "/"
+            : ""
+        : `${drive[1].toLowerCase()}:`;
+    const body = drive === null
+        ? slashSeparated
+        : slashSeparated.slice(2);
+    const segments = [];
+    for (const segment of body.split("/")) {
+        if (segment === "" || segment === ".")
+            continue;
+        segments.push(segment.normalize("NFC"));
+    }
+    const normalized = segments.join("/");
+    const normalizedValue = prefix === "/"
+        ? normalized.length === 0 ? "/" : `/${normalized}`
+        : prefix.length > 0
+            ? normalized.length === 0 ? `${prefix}/` : `${prefix}/${normalized}`
+            : normalized.length === 0 ? "." : normalized;
+    return platform === "windows" ? normalizedValue.toLowerCase() : normalizedValue;
+};
+const invalidRelativeTargetReason = (path, platform) => {
+    if (path.trim().length === 0)
+        return "empty managed file path";
+    if (path.includes("\0"))
+        return "null byte in managed file path";
+    if (path.startsWith("/")
+        || path.startsWith("\\")
+        || /^[A-Za-z]:/u.test(path)) {
+        return "managed file path must be relative to its resource target";
+    }
+    if (path.replaceAll("\\", "/").split("/").some((segment) => segment === "..")) {
+        return "parent traversal in managed file path";
+    }
+    if (path.includes("\\"))
+        return "alternate path separator in managed file path";
+    const segments = path.split("/");
+    if (segments.some((segment) => segment.length === 0 || segment === ".")) {
+        return "managed file path is not canonical";
+    }
+    if (path.normalize("NFC") !== path) {
+        return "managed file path is not canonical";
+    }
+    if (platform === "windows") {
+        for (const segment of segments) {
+            if (/[<>:"|?*]/u.test(segment)) {
+                return "reserved character in managed file path";
+            }
+            if (segment.endsWith(".") || segment.endsWith(" ")) {
+                return "trailing dot or space in managed file path";
+            }
+            if (/^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\..*)?$/iu.test(segment)) {
+                return "reserved Windows name in managed file path";
+            }
+        }
+    }
+    if (/[*?[\]]/u.test(path))
+        return "glob in managed file path";
+    return undefined;
+};
+const resourceEntries = (resource) => {
+    if (resource.spec.kind !== "directory" && resource.spec.kind !== "skill")
+        return [];
+    return resource.spec.files.map((file) => file.path);
+};
+const canonicalResourcePathClaims = (resource, platform) => {
+    const claims = [];
+    const errors = [];
+    for (const rawPath of [...resource.entries].sort(compareText)) {
+        const reason = invalidRelativeTargetReason(rawPath, platform);
+        if (reason !== undefined) {
+            errors.push(new InvalidTargetError({
+                id: resource.id,
+                target: rawPath,
+                reason,
+            }));
+            continue;
+        }
+        claims.push({
+            resource,
+            rawPath,
+            path: normalizedTargetPath(`${resource.target}/${rawPath}`, platform),
+        });
+    }
+    return { claims, errors };
+};
+/**
+ * Validate filesystem claims at a profile or planner boundary. The resource
+ * target itself is the explicitly represented directory ancestry; every
+ * declared entry is otherwise a file or symlink leaf.
+ */
+export const validateResourcePathConflicts = (resources, platform = "windows") => {
+    const errors = [];
+    const orderedResources = [...resources].sort((left, right) => compareText(left.id, right.id));
+    const claimsByResource = new Map();
+    for (const resource of orderedResources) {
+        const targetReason = invalidTargetReason(resource.target);
+        if (targetReason !== undefined) {
+            errors.push(new InvalidTargetError({
+                id: resource.id,
+                target: resource.target,
+                reason: targetReason,
+            }));
+        }
+        const result = canonicalResourcePathClaims(resource, platform);
+        errors.push(...result.errors);
+        claimsByResource.set(resource.id, result.claims);
+    }
+    const claims = orderedResources
+        .flatMap((resource) => {
+        if (resource.kind !== "file"
+            && resource.kind !== "directory"
+            && resource.kind !== "config"
+            && resource.kind !== "skill"
+            && resource.kind !== "schedule")
+            return [];
+        const root = {
+            resource,
+            path: normalizedTargetPath(resource.target, platform),
+            rawPath: resource.target,
+            namespace: resource.kind === "schedule" ? "schedule" : "filesystem",
+            isRoot: true,
+        };
+        if (resource.kind === "schedule")
+            return [root];
+        return [
+            root,
+            ...(claimsByResource.get(resource.id) ?? []).map((claim) => ({
+                resource,
+                path: claim.path,
+                rawPath: claim.rawPath,
+                namespace: "filesystem",
+                isRoot: false,
+            })),
+        ];
+    })
+        .sort((left, right) => compareText(left.resource.id, right.resource.id)
+        || compareText(left.path, right.path)
+        || compareText(left.rawPath, right.rawPath));
+    const overlaps = (left, right) => left === right
+        || left.startsWith(`${right}/`)
+        || right.startsWith(`${left}/`);
+    for (let index = 0; index < claims.length; index += 1) {
+        const claim = claims[index];
+        for (let otherIndex = index + 1; otherIndex < claims.length; otherIndex += 1) {
+            const other = claims[otherIndex];
+            if (claim.namespace !== other.namespace
+                || !overlaps(claim.path, other.path)) {
+                continue;
+            }
+            if (claim.resource.id === other.resource.id) {
+                if (claim.isRoot || other.isRoot)
+                    continue;
+                if (claim.rawPath === other.rawPath) {
+                    errors.push(new ConflictingResourceTargetError({
+                        id: claim.resource.id,
+                        target: claim.rawPath,
+                        conflictsWith: other.resource.id,
+                        reason: `managed path ${claim.path} is declared more than once`,
+                    }));
+                }
+                else if (claim.rawPath !== other.rawPath) {
+                    errors.push(new ConflictingResourceTargetError({
+                        id: claim.resource.id,
+                        target: claim.rawPath,
+                        conflictsWith: other.resource.id,
+                        reason: `managed path ${claim.path} overlaps managed path ${other.path}`,
+                    }));
+                }
+                continue;
+            }
+            const duplicate = errors.some((error) => error._tag === "ConflictingResourceTargetError"
+                && error.id === claim.resource.id
+                && error.conflictsWith === other.resource.id);
+            if (!duplicate) {
+                errors.push(new ConflictingResourceTargetError({
+                    id: claim.resource.id,
+                    target: claim.resource.target,
+                    conflictsWith: other.resource.id,
+                    reason: `target ${claim.path} overlaps target ${other.path}`,
+                }));
+            }
+        }
+    }
+    return errors;
+};
+const pathClaimsResource = (resource) => ({
+    id: resource.id,
+    kind: resource.kind,
+    target: resource.target,
+    entries: resourceEntries(resource),
+});
+const validateResourceTargetConflicts = (resources, platform) => validateResourcePathConflicts(resources.map(pathClaimsResource), platform);
+const timePattern = /^([01]\d|2[0-3]):[0-5]\d$/u;
+const dayNames = new Set(["mon", "tue", "wed", "thu", "fri", "sat", "sun"]);
+const validateScheduleDefault = (schedule) => {
+    if (schedule.type === "daily" && !timePattern.test(schedule.at)) {
+        return new InvalidScheduleError({
+            id: "$scheduleDefault",
+            reason: `invalid daily time ${schedule.at}`,
+        });
+    }
+    if (schedule.type === "weekly") {
+        if (!timePattern.test(schedule.at)) {
+            return new InvalidScheduleError({
+                id: "$scheduleDefault",
+                reason: `invalid weekly time ${schedule.at}`,
+            });
+        }
+        if (schedule.days.length === 0) {
+            return new InvalidScheduleError({
+                id: "$scheduleDefault",
+                reason: "weekly schedule needs at least one day",
+            });
+        }
+        for (const day of schedule.days) {
+            if (!dayNames.has(day)) {
+                return new InvalidScheduleError({
+                    id: "$scheduleDefault",
+                    reason: `unknown day ${day}`,
+                });
+            }
+        }
+    }
+    return null;
+};
+const validateSchedule = (resource) => {
+    const spec = resource.spec;
+    if (spec.kind !== "schedule")
+        return null;
+    const calendar = spec.calendar;
+    if (calendar.type === "daily" && !timePattern.test(calendar.at)) {
+        return new InvalidScheduleError({ id: resource.id, reason: `invalid daily time ${calendar.at}` });
+    }
+    if (calendar.type === "weekly") {
+        if (!timePattern.test(calendar.at)) {
+            return new InvalidScheduleError({ id: resource.id, reason: `invalid weekly time ${calendar.at}` });
+        }
+        if (calendar.days.length === 0) {
+            return new InvalidScheduleError({ id: resource.id, reason: "weekly schedule needs at least one day" });
+        }
+        for (const day of calendar.days) {
+            if (!dayNames.has(day)) {
+                return new InvalidScheduleError({ id: resource.id, reason: `unknown day ${day}` });
+            }
+        }
+    }
+    if (calendar.type === "custom" && calendar.expression.trim().length === 0) {
+        return new InvalidScheduleError({ id: resource.id, reason: "empty custom expression" });
+    }
+    return null;
+};
+/** Detect a dependency cycle; returns one cycle path or null. */
+export const findDependencyCycle = (resources) => {
+    const graph = new Map();
+    for (const resource of resources) {
+        graph.set(resource.id, resource.dependsOn ?? []);
+    }
+    const visiting = [];
+    const visited = new Set();
+    const dfs = (node) => {
+        if (visited.has(node))
+            return null;
+        const index = visiting.indexOf(node);
+        if (index >= 0)
+            return [...visiting.slice(index), node];
+        visiting.push(node);
+        const deps = graph.get(node) ?? [];
+        for (const dep of deps) {
+            if (!graph.has(dep))
+                continue;
+            const found = dfs(dep);
+            if (found !== null)
+                return found;
+        }
+        visiting.pop();
+        visited.add(node);
+        return null;
+    };
+    for (const resource of resources) {
+        const found = dfs(resource.id);
+        if (found !== null)
+            return found;
+    }
+    return null;
+};
+/** Topological order of resource ids; deterministic (stable input order, deps first). */
+export const topologicalOrder = (resources) => {
+    const byId = new Map(resources.map((r) => [r.id, r]));
+    const ordered = [];
+    const emitted = new Set();
+    const visiting = new Set();
+    const visit = (id) => {
+        if (emitted.has(id) || visiting.has(id))
+            return;
+        visiting.add(id);
+        const resource = byId.get(id);
+        if (resource !== undefined) {
+            for (const dep of resource.dependsOn ?? [])
+                visit(dep);
+        }
+        visiting.delete(id);
+        emitted.add(id);
+        ordered.push(id);
+    };
+    for (const resource of resources)
+        visit(resource.id);
+    return ordered;
+};
+const compareText = (left, right) => {
+    if (left < right)
+        return -1;
+    if (left > right)
+        return 1;
+    return 0;
+};
+const uniqueSorted = (values) => [...new Set(values)].sort(compareText);
+const normalizeResourceSpec = (spec) => {
+    switch (spec.kind) {
+        case "file": {
+            const base = {
+                kind: spec.kind,
+                content: spec.content,
+                executable: spec.executable ?? false,
+            };
+            if (spec.symlinkTo === undefined)
+                return base;
+            return { ...base, symlinkTo: spec.symlinkTo };
+        }
+        case "directory":
+            return {
+                kind: spec.kind,
+                files: spec.files
+                    .map((file) => ({
+                    path: file.path,
+                    content: file.content,
+                    executable: file.executable ?? false,
+                }))
+                    .sort((left, right) => compareText(left.path, right.path)),
+            };
+        case "config":
+            return {
+                kind: spec.kind,
+                format: spec.format,
+                keys: [...spec.keys].sort((left, right) => compareText(left.path, right.path)),
+            };
+        case "skill":
+            return {
+                kind: spec.kind,
+                name: spec.name,
+                files: spec.files
+                    .map((file) => ({
+                    path: file.path,
+                    content: file.content,
+                    executable: file.executable ?? false,
+                }))
+                    .sort((left, right) => compareText(left.path, right.path)),
+            };
+        case "tool":
+            return {
+                kind: spec.kind,
+                toolId: spec.toolId,
+                recipes: [...spec.recipes].sort((left, right) => compareText(`${left.platform}\0${left.method}\0${left.package}\0${left.version ?? ""}\0${JSON.stringify(left.indexPolicy)}\0${JSON.stringify(left.source)}`, `${right.platform}\0${right.method}\0${right.package}\0${right.version ?? ""}\0${JSON.stringify(right.indexPolicy)}\0${JSON.stringify(right.source)}`)).map((recipe) => {
+                    const indexPolicy = recipe.indexPolicy === undefined
+                        ? undefined
+                        : {
+                            ...recipe.indexPolicy,
+                            url: canonicalRecipeIndexUrl(recipe.indexPolicy.url) ?? recipe.indexPolicy.url,
+                        };
+                    const { indexPolicy: _indexPolicy, ...recipeWithoutIndex } = recipe;
+                    const base = {
+                        ...recipeWithoutIndex,
+                        buildPolicy: recipe.buildPolicy ?? { mode: "scripts-disabled" },
+                    };
+                    return indexPolicy === undefined
+                        ? base
+                        : { ...base, indexPolicy };
+                }),
+                login: spec.login ?? { required: false },
+            };
+        case "credential":
+            return { kind: spec.kind, reference: spec.reference };
+        case "schedule": {
+            if (spec.calendar.type !== "weekly") {
+                return {
+                    kind: spec.kind,
+                    calendar: spec.calendar,
+                    timezone: spec.timezone,
+                };
+            }
+            const dayOrder = ["mon", "tue", "wed", "thu", "fri", "sat", "sun"];
+            const days = [...new Set(spec.calendar.days)].sort((left, right) => dayOrder.indexOf(left) - dayOrder.indexOf(right));
+            return {
+                kind: spec.kind,
+                calendar: { ...spec.calendar, days },
+                timezone: spec.timezone,
+            };
+        }
+    }
+};
+const normalizeResource = (resource) => {
+    const base = {
+        id: resource.id,
+        kind: resource.kind,
+        policy: resource.policy ?? defaultPolicy(resource.kind),
+        target: resource.target,
+        dependsOn: uniqueSorted(resource.dependsOn ?? []),
+        spec: normalizeResourceSpec(resource.spec),
+        verify: resource.verify,
+    };
+    if (resource.groups === undefined)
+        return base;
+    return { ...base, groups: uniqueSorted(resource.groups) };
+};
+/** Apply all v2 defaults and order unordered collections deterministically. */
+export const normalizeMachineProfile = (profile) => {
+    const groups = (profile.groups ?? [])
+        .map((group) => group.description === undefined
+        ? { name: group.name }
+        : { name: group.name, description: group.description })
+        .sort((left, right) => compareText(left.name, right.name));
+    const resources = (profile.resources ?? [])
+        .map(normalizeResource)
+        .sort((left, right) => compareText(left.id, right.id));
+    const scheduleDefault = profile.scheduleDefault ?? {
+        type: "daily",
+        at: "00:00",
+        timezone: "local",
+    };
+    const normalizedSchedule = scheduleDefault.type === "weekly"
+        ? { ...scheduleDefault, days: uniqueSorted(scheduleDefault.days) }
+        : scheduleDefault;
+    return {
+        id: profile.id,
+        version: 2,
+        name: profile.name,
+        groups,
+        resources,
+        scheduleDefault: normalizedSchedule,
+    };
+};
+/** Decode strict JSONC authoring input, normalize it, then reject invalid graphs. */
+export const decodeMachineProfileJsonc = (text) => {
+    const authored = decodeJsonc(MachineProfileAuthoringSchema)(text);
+    const normalized = normalizeMachineProfile(authored);
+    Schema.decodeUnknownSync(MachineProfileSchema, { onExcessProperty: "error" })(normalized);
+    const errors = validateMachineProfile(normalized);
+    if (errors.length > 0)
+        throw new ProfileContractError(errors);
+    return normalized;
+};
+/** Backwards-friendly concise name for the JSONC authoring boundary. */
+export const decodeMachineProfile = decodeMachineProfileJsonc;
+const profileJsonValue = (profile) => Schema.decodeUnknownSync(Schema.MutableJson)(profile);
+/** Canonical publication encoding of a validated, normalized profile. */
+export const encodeMachineProfile = (profile) => {
+    const normalized = normalizeMachineProfile(profile);
+    Schema.decodeUnknownSync(MachineProfileSchema, { onExcessProperty: "error" })(normalized);
+    const errors = validateMachineProfile(normalized);
+    if (errors.length > 0)
+        throw new ProfileContractError(errors);
+    return canonicalJson(profileJsonValue(normalized));
+};
+/** Stable SHA-256 digest of the canonical publication encoding. */
+export const digestMachineProfile = (profile) => {
+    const normalized = normalizeMachineProfile(profile);
+    Schema.decodeUnknownSync(MachineProfileSchema, { onExcessProperty: "error" })(normalized);
+    const errors = validateMachineProfile(normalized);
+    if (errors.length > 0)
+        throw new ProfileContractError(errors);
+    return digestOf(profileJsonValue(normalized));
+};