@mindpal/protocol 0.0.2-alpha

package/README.md

@@ -0,0 +1,60 @@
+# @mindpal/protocol
+
+**MindPal Agent OS 协议层标准定义包**
+
+智能体操作系统的协议基座，定义了 Skill RPC、协作消息、设备握手、审计系统和状态机的标准类型、接口和工具函数。
+
+## 特性
+
+- **零依赖** — 仅 TypeScript 类型 + 纯函数工具，无任何外部 npm 依赖
+- **协议级抽象** — 纯接口/类型/常量/工具函数，不包含业务逻辑
+- **独立可用** — 每个子模块可单独导入，支持 tree-shaking
+
+## 安装
+
+```bash
+pnpm add @mindpal/protocol
+```
+
+## 模块概览
+
+| 子模块 | 导入路径 | 说明 |
+|--------|---------|------|
+| Skill RPC | `@mindpal/protocol/skill-rpc` | JSON-RPC 2.0 over stdio 协议：请求/响应/通知类型、序列化、版本协商 |
+| Skill Manifest | `@mindpal/protocol/skill-manifest` | Skill 清单定义与校验：内置/外部 Manifest、工具声明 |
+| Collab Message | `@mindpal/protocol/collab-message` | 多智能体协作协议：5层消息类型、共识投票、能力发现、辩论 |
+| Device Handshake | `@mindpal/protocol/device-handshake` | 设备握手安全协议：ECDH密钥交换类型、安全策略、会话状态 |
+| Audit Event | `@mindpal/protocol/audit-event` | 审计事件标准：事件输入接口、错误分类、摘要生成 |
+| State Machine | `@mindpal/protocol/state-machine` | 统一运行时状态机：Step/Run/Collab/Agent 状态转换表 |
+| Errors | `@mindpal/protocol/errors` | 标准错误码集合：RPC错误码、协议错误码、审计错误分类 |
+
+## 使用示例
+
+```typescript
+// 统一入口导入
+import { createRpcRequest, SKILL_RPC_METHODS, transitionStep } from "@mindpal/protocol";
+
+// 创建 Skill RPC 请求
+const req = createRpcRequest("req-1", SKILL_RPC_METHODS.EXECUTE, {
+  requestId: "r1",
+  input: { text: "hello" },
+  inputDigest: { sha256_8: "abc12345", bytes: 5 },
+});
+
+// 状态转换
+const newStatus = transitionStep("pending", "running"); // "running"
+
+// 子模块独立导入
+import { validateManifest } from "@mindpal/protocol/skill-manifest";
+import type { CollabMessageEnvelope } from "@mindpal/protocol/collab-message";
+
+const result = validateManifest({
+  identity: { name: "example.skill", version: "1.0.0" },
+  entry: "index.js",
+});
+console.log(result.valid); // true
+```
+
+## 许可证
+
+MIT

package/dist/audit-event.d.ts

@@ -0,0 +1,113 @@
+/**
+ * 审计事件协议类型定义
+ *
+ * 定义审计系统的标准类型、接口和纯工具函数。
+ * 不包含任何数据库操作或 Node.js 运行时依赖。
+ */
+import { type RegistryEntry } from './registry.js';
+/** 最小化查询接口，pg.Pool / pg.PoolClient 均满足 */
+export interface AuditQueryable {
+    query(sql: string, params?: unknown[]): Promise<{
+        rows: any[];
+        rowCount: number | null;
+    }>;
+}
+/** 可获取事务客户端的连接池接口（pg.Pool 满足） */
+export interface AuditPoolLike extends AuditQueryable {
+    connect(): Promise<AuditClientLike>;
+}
+/** 事务客户端接口（pg.PoolClient 满足） */
+export interface AuditClientLike extends AuditQueryable {
+    release(): void;
+}
+/** 统一审计事件输入，API 与 Worker 共用（简单外部接口） */
+export interface AuditEventInput {
+    tenantId: string;
+    action: string;
+    resourceType: string;
+    resourceId?: string;
+    subject: string;
+    outcome: "success" | "failure" | "denied";
+    details?: Record<string, unknown>;
+    traceId?: string;
+    timestamp?: string;
+}
+/** 审计写入器抽象（可由 API / Worker 各自实现） */
+export interface AuditWriter {
+    write(event: AuditEventInput): Promise<void>;
+    writeBatch(events: AuditEventInput[]): Promise<void>;
+}
+/** 详细审计事件输入，包含所有可选字段（API / Worker 内部使用） */
+export type DetailedAuditEventInput = {
+    subjectId?: string;
+    tenantId?: string;
+    spaceId?: string;
+    resourceType: string;
+    action: string;
+    toolRef?: string;
+    workflowRef?: string;
+    policyDecision?: unknown;
+    inputDigest?: unknown;
+    outputDigest?: unknown;
+    idempotencyKey?: string;
+    result: "success" | "denied" | "error";
+    traceId: string;
+    requestId?: string;
+    runId?: string;
+    stepId?: string;
+    policySnapshotRef?: string;
+    errorCategory?: string;
+    latencyMs?: number;
+    outboxId?: string;
+    timestamp?: string;
+    /** P3-3: 人类可读的自然语言摘要 */
+    humanSummary?: string;
+};
+export declare const AUDIT_ERROR_CATEGORIES: readonly ["policy_violation", "validation_error", "rate_limited", "upstream_error", "internal_error"];
+export type AuditErrorCategory = (typeof AUDIT_ERROR_CATEGORIES)[number];
+export declare const BUILTIN_ERROR_CATEGORY_ALIASES: RegistryEntry<string>[];
+export declare const errorCategoryAliasRegistry: import("./registry.js").TypeRegistry<string>;
+export declare function normalizeAuditErrorCategory(input: unknown): AuditErrorCategory | null;
+export declare const BUILTIN_HIGH_RISK_ACTIONS: RegistryEntry[];
+export declare const highRiskActionRegistry: import("./registry.js").TypeRegistry<unknown>;
+/** @deprecated 使用 highRiskActionRegistry 替代 */
+export declare const HIGH_RISK_AUDIT_ACTIONS: Set<string>;
+/** 检查操作是否为高风险 */
+export declare function isHighRiskAction(resourceType: string, action: string): boolean;
+export declare function isHighRiskAuditAction(params: {
+    resourceType?: string | null;
+    action?: string | null;
+}): boolean;
+export declare class AuditContractError extends Error {
+    errorCode: string;
+    httpStatus: number;
+    details?: unknown;
+    constructor(params: {
+        errorCode: string;
+        message: string;
+        httpStatus?: number;
+        details?: unknown;
+    });
+}
+/**
+ * P3-3: 自动生成 humanSummary
+ * 当调用方未提供时，根据审计事件属性自动生成可读摘要
+ */
+export declare function generateHumanSummary(e: DetailedAuditEventInput): string;
+export declare function withPolicySnapshotRef(policyDecision: unknown, policySnapshotRef: string | null): {} | null;
+export interface InsertAuditEventOptions {
+    /**
+     * 跳过哈希链写入（即使 tenantId 存在）。
+     * 适用于 Worker SIEM 等场景，不需要事务性哈希链。
+     */
+    skipHashChain?: boolean;
+}
+/** 设备端审计证据引用（截图、录屏等工件） */
+export interface AuditEvidenceRef {
+    artifactId: string;
+    storageRef: string;
+    hash: string;
+    mimeType?: string;
+    sizeBytes?: number;
+}
+//# sourceMappingURL=audit-event.d.ts.map

package/dist/audit-event.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-event.d.ts","sourceRoot":"","sources":["../src/audit-event.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAgC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAIjF,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CAC3F;AAED,iCAAiC;AACjC,MAAM,WAAW,aAAc,SAAQ,cAAc;IACnD,OAAO,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;CACrC;AAED,gCAAgC;AAChC,MAAM,WAAW,eAAgB,SAAQ,cAAc;IACrD,OAAO,IAAI,IAAI,CAAC;CACjB;AAID,uCAAuC;AACvC,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,oCAAoC;AACpC,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,UAAU,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAID,2CAA2C;AAC3C,MAAM,MAAM,uBAAuB,GAAG;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wBAAwB;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAIF,eAAO,MAAM,sBAAsB,uGAMzB,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAMzE,eAAO,MAAM,8BAA8B,EAAE,aAAa,CAAC,MAAM,CAAC,EASjE,CAAC;AAEF,eAAO,MAAM,0BAA0B,8CAAyD,CAAC;AAEjG,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,GAAG,IAAI,CASrF;AAID,eAAO,MAAM,yBAAyB,EAAE,aAAa,EAMpD,CAAC;AAEF,eAAO,MAAM,sBAAsB,+CAA4C,CAAC;AAEhF,+CAA+C;AAC/C,eAAO,MAAM,uBAAuB,aAA4D,CAAC;AAEjG,iBAAiB;AACjB,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAE9E;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,OAAO,CAK/G;AAID,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;gBAEN,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE;CAOnG;AAID;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,uBAAuB,GAAG,MAAM,CAWvE;AAID,wBAAgB,qBAAqB,CAAC,cAAc,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,GAAG,IAAI,aAS9F;AAID,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAID,0BAA0B;AAC1B,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}

package/dist/audit-event.js

@@ -0,0 +1,117 @@
+"use strict";
+/**
+ * 审计事件协议类型定义
+ *
+ * 定义审计系统的标准类型、接口和纯工具函数。
+ * 不包含任何数据库操作或 Node.js 运行时依赖。
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuditContractError = exports.HIGH_RISK_AUDIT_ACTIONS = exports.highRiskActionRegistry = exports.BUILTIN_HIGH_RISK_ACTIONS = exports.errorCategoryAliasRegistry = exports.BUILTIN_ERROR_CATEGORY_ALIASES = exports.AUDIT_ERROR_CATEGORIES = void 0;
+exports.normalizeAuditErrorCategory = normalizeAuditErrorCategory;
+exports.isHighRiskAction = isHighRiskAction;
+exports.isHighRiskAuditAction = isHighRiskAuditAction;
+exports.generateHumanSummary = generateHumanSummary;
+exports.withPolicySnapshotRef = withPolicySnapshotRef;
+const registry_js_1 = require("./registry.js");
+// ─── 审计错误分类 ──────────────────────────────────────────
+exports.AUDIT_ERROR_CATEGORIES = [
+    "policy_violation",
+    "validation_error",
+    "rate_limited",
+    "upstream_error",
+    "internal_error",
+];
+const AUDIT_ERROR_CATEGORY_SET = new Set(exports.AUDIT_ERROR_CATEGORIES);
+// ─── 错误分类别名注册表 ──────────────────────────────────────────
+exports.BUILTIN_ERROR_CATEGORY_ALIASES = [
+    (0, registry_js_1.builtInEntry)('internal', 'audit.error_alias', 'internal_error'),
+    (0, registry_js_1.builtInEntry)('upstream', 'audit.error_alias', 'upstream_error'),
+    (0, registry_js_1.builtInEntry)('invalid_input', 'audit.error_alias', 'validation_error'),
+    (0, registry_js_1.builtInEntry)('bad_request', 'audit.error_alias', 'validation_error'),
+    (0, registry_js_1.builtInEntry)('throttled', 'audit.error_alias', 'rate_limited'),
+    (0, registry_js_1.builtInEntry)('rate_limit', 'audit.error_alias', 'rate_limited'),
+    (0, registry_js_1.builtInEntry)('policy', 'audit.error_alias', 'policy_violation'),
+    (0, registry_js_1.builtInEntry)('validation', 'audit.error_alias', 'validation_error'),
+];
+exports.errorCategoryAliasRegistry = (0, registry_js_1.createRegistry)(exports.BUILTIN_ERROR_CATEGORY_ALIASES);
+function normalizeAuditErrorCategory(input) {
+    const raw = String(input ?? "").trim().toLowerCase();
+    if (!raw)
+        return null;
+    if (AUDIT_ERROR_CATEGORY_SET.has(raw))
+        return raw;
+    const aliasEntry = exports.errorCategoryAliasRegistry.get(raw);
+    if (aliasEntry?.value && AUDIT_ERROR_CATEGORY_SET.has(aliasEntry.value)) {
+        return aliasEntry.value;
+    }
+    return "internal_error";
+}
+// ─── 高风险审计动作 ──────────────────────────────────────────
+exports.BUILTIN_HIGH_RISK_ACTIONS = [
+    (0, registry_js_1.builtInEntry)('audit:siem.destination.write', 'audit.high_risk'),
+    (0, registry_js_1.builtInEntry)('audit:siem.destination.test', 'audit.high_risk'),
+    (0, registry_js_1.builtInEntry)('audit:siem.destination.backfill', 'audit.high_risk'),
+    (0, registry_js_1.builtInEntry)('audit:siem.dlq.clear', 'audit.high_risk'),
+    (0, registry_js_1.builtInEntry)('audit:siem.dlq.requeue', 'audit.high_risk'),
+];
+exports.highRiskActionRegistry = (0, registry_js_1.createRegistry)(exports.BUILTIN_HIGH_RISK_ACTIONS);
+/** @deprecated 使用 highRiskActionRegistry 替代 */
+exports.HIGH_RISK_AUDIT_ACTIONS = new Set(exports.BUILTIN_HIGH_RISK_ACTIONS.map(e => e.id));
+/** 检查操作是否为高风险 */
+function isHighRiskAction(resourceType, action) {
+    return exports.highRiskActionRegistry.has(`${resourceType}.${action}`) || exports.highRiskActionRegistry.has(action);
+}
+function isHighRiskAuditAction(params) {
+    const resourceType = String(params.resourceType ?? "").trim();
+    const action = String(params.action ?? "").trim();
+    if (!resourceType || !action)
+        return false;
+    return exports.highRiskActionRegistry.has(`${resourceType}:${action}`);
+}
+// ─── 审计契约错误 ──────────────────────────────────────────
+class AuditContractError extends Error {
+    errorCode;
+    httpStatus;
+    details;
+    constructor(params) {
+        super(params.message);
+        this.name = "AuditContractError";
+        this.errorCode = params.errorCode;
+        this.httpStatus = params.httpStatus ?? 409;
+        this.details = params.details;
+    }
+}
+exports.AuditContractError = AuditContractError;
+// ─── humanSummary 自动生成 ──────────────────────────────────
+/**
+ * P3-3: 自动生成 humanSummary
+ * 当调用方未提供时，根据审计事件属性自动生成可读摘要
+ */
+function generateHumanSummary(e) {
+    const parts = [];
+    const subject = e.subjectId ? `用户 ${e.subjectId.slice(0, 8)}` : "系统";
+    const resultText = e.result === "success" ? "成功" : e.result === "denied" ? "被拒绝" : "失败";
+    parts.push(`${subject}对 ${e.resourceType} 执行 ${e.action} 操作，结果: ${resultText}`);
+    if (e.toolRef)
+        parts.push(`工具: ${e.toolRef}`);
+    if (e.latencyMs)
+        parts.push(`耗时: ${e.latencyMs}ms`);
+    if (e.errorCategory)
+        parts.push(`错误类型: ${e.errorCategory}`);
+    return parts.join(" | ");
+}
+// ─── policySnapshotRef 合并 ──────────────────────────────────
+function withPolicySnapshotRef(policyDecision, policySnapshotRef) {
+    if (!policySnapshotRef)
+        return policyDecision ?? null;
+    if (policyDecision && typeof policyDecision === "object" && !Array.isArray(policyDecision)) {
+        const base = policyDecision;
+        if (typeof base.policySnapshotRef === "string" && base.policySnapshotRef.trim())
+            return base;
+        if (typeof base.snapshotRef === "string" && base.snapshotRef.trim())
+            return { ...base, policySnapshotRef: base.snapshotRef };
+        return { ...base, policySnapshotRef };
+    }
+    return { policySnapshotRef };
+}
+//# sourceMappingURL=audit-event.js.map

package/dist/audit-event.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-event.js","sourceRoot":"","sources":["../src/audit-event.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAoGH,kEASC;AAkBD,4CAEC;AAED,sDAKC;AAwBD,oDAWC;AAID,sDASC;AAtLD,+CAAiF;AAqEjF,wDAAwD;AAE3C,QAAA,sBAAsB,GAAG;IACpC,kBAAkB;IAClB,kBAAkB;IAClB,cAAc;IACd,gBAAgB;IAChB,gBAAgB;CACR,CAAC;AAIX,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAS,8BAAsB,CAAC,CAAC;AAEzE,2DAA2D;AAE9C,QAAA,8BAA8B,GAA4B;IACrE,IAAA,0BAAY,EAAC,UAAU,EAAE,mBAAmB,EAAE,gBAAgB,CAAC;IAC/D,IAAA,0BAAY,EAAC,UAAU,EAAE,mBAAmB,EAAE,gBAAgB,CAAC;IAC/D,IAAA,0BAAY,EAAC,eAAe,EAAE,mBAAmB,EAAE,kBAAkB,CAAC;IACtE,IAAA,0BAAY,EAAC,aAAa,EAAE,mBAAmB,EAAE,kBAAkB,CAAC;IACpE,IAAA,0BAAY,EAAC,WAAW,EAAE,mBAAmB,EAAE,cAAc,CAAC;IAC9D,IAAA,0BAAY,EAAC,YAAY,EAAE,mBAAmB,EAAE,cAAc,CAAC;IAC/D,IAAA,0BAAY,EAAC,QAAQ,EAAE,mBAAmB,EAAE,kBAAkB,CAAC;IAC/D,IAAA,0BAAY,EAAC,YAAY,EAAE,mBAAmB,EAAE,kBAAkB,CAAC;CACpE,CAAC;AAEW,QAAA,0BAA0B,GAAG,IAAA,4BAAc,EAAS,sCAA8B,CAAC,CAAC;AAEjG,SAAgB,2BAA2B,CAAC,KAAc;IACxD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,GAAyB,CAAC;IACxE,MAAM,UAAU,GAAG,kCAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,UAAU,EAAE,KAAK,IAAI,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,UAAU,CAAC,KAA2B,CAAC;IAChD,CAAC;IACD,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,yDAAyD;AAE5C,QAAA,yBAAyB,GAAoB;IACxD,IAAA,0BAAY,EAAC,8BAA8B,EAAE,iBAAiB,CAAC;IAC/D,IAAA,0BAAY,EAAC,6BAA6B,EAAE,iBAAiB,CAAC;IAC9D,IAAA,0BAAY,EAAC,iCAAiC,EAAE,iBAAiB,CAAC;IAClE,IAAA,0BAAY,EAAC,sBAAsB,EAAE,iBAAiB,CAAC;IACvD,IAAA,0BAAY,EAAC,wBAAwB,EAAE,iBAAiB,CAAC;CAC1D,CAAC;AAEW,QAAA,sBAAsB,GAAG,IAAA,4BAAc,EAAC,iCAAyB,CAAC,CAAC;AAEhF,+CAA+C;AAClC,QAAA,uBAAuB,GAAG,IAAI,GAAG,CAAS,iCAAyB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEjG,iBAAiB;AACjB,SAAgB,gBAAgB,CAAC,YAAoB,EAAE,MAAc;IACnE,OAAO,8BAAsB,CAAC,GAAG,CAAC,GAAG,YAAY,IAAI,MAAM,EAAE,CAAC,IAAI,8BAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACvG,CAAC;AAED,SAAgB,qBAAqB,CAAC,MAAgE;IACpG,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,8BAAsB,CAAC,GAAG,CAAC,GAAG,YAAY,IAAI,MAAM,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,wDAAwD;AAExD,MAAa,kBAAmB,SAAQ,KAAK;IAC3C,SAAS,CAAS;IAClB,UAAU,CAAS;IACnB,OAAO,CAAW;IAElB,YAAY,MAAsF;QAChG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC;QAC3C,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAChC,CAAC;CACF;AAZD,gDAYC;AAED,2DAA2D;AAE3D;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,CAA0B;IAC7D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAExF,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,KAAK,CAAC,CAAC,YAAY,OAAO,CAAC,CAAC,MAAM,WAAW,UAAU,EAAE,CAAC,CAAC;IAChF,IAAI,CAAC,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,CAAC,aAAa;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;IAE5D,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,8DAA8D;AAE9D,SAAgB,qBAAqB,CAAC,cAAuB,EAAE,iBAAgC;IAC7F,IAAI,CAAC,iBAAiB;QAAE,OAAO,cAAc,IAAI,IAAI,CAAC;IACtD,IAAI,cAAc,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC3F,MAAM,IAAI,GAAG,cAAyC,CAAC;QACvD,IAAI,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QAC7F,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE;YAAE,OAAO,EAAE,GAAG,IAAI,EAAE,iBAAiB,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7H,OAAO,EAAE,GAAG,IAAI,EAAE,iBAAiB,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAC/B,CAAC"}

package/dist/device-handshake.d.ts

@@ -0,0 +1,81 @@
+/**
+ * deviceHandshakeSecurity — 设备握手安全协议类型定义
+ *
+ * 为设备代理 ↔ 服务端提供 V2 安全增强握手的协议层类型：
+ * - 安全策略类型（元数据驱动）
+ * - 握手安全扩展类型
+ * - 会话类型
+ * - 安全消息包装类型
+ *
+ * 注意：加密/签名/解密等运行时函数依赖 Node.js crypto 模块，
+ * 不包含在协议层中。请使用 @mindpal/shared/deviceHandshakeSecurity 获取完整实现。
+ */
+import { type RegistryEntry } from './registry.js';
+/** authLevel 注册表 */
+export type AuthLevel = string;
+export declare const BUILTIN_AUTH_LEVELS: RegistryEntry[];
+export declare const authLevelRegistry: import("./registry.js").TypeRegistry<unknown>;
+/** 服务端下发的安全策略（元数据驱动，类似 multimodalPolicy） */
+export interface DeviceSecurityPolicy {
+    format: "deviceSecurity.v1";
+    authLevel: string;
+    requireNonce: boolean;
+    sessionTtlMs: number;
+    keyRotationIntervalMs: number;
+    replayWindowSize: number;
+}
+export declare const DEFAULT_SECURITY_POLICY: DeviceSecurityPolicy;
+/** 设备端握手安全扩展（附加在现有 handshake 上） */
+export interface HandshakeSecurityExt {
+    nonce: string;
+    timestamp: number;
+    ephemeralPubKey?: string;
+    deviceCert?: string;
+    hmac: string;
+}
+/** 服务端 ACK 安全扩展 */
+export interface HandshakeAckSecurityExt {
+    sessionId: string;
+    serverNonce: string;
+    serverEphemeralPubKey?: string;
+    securityPolicy: DeviceSecurityPolicy;
+    tokenRefreshAt?: number;
+    hmac: string;
+}
+/**
+ * 设备会话状态接口（协议层定义）。
+ *
+ * 注意：运行时实现中 sessionKey/hmacKey 为 Buffer，replayWindow 为 Set<number>。
+ * 协议层使用宽松类型以保持零 Node.js 依赖。
+ */
+export interface DeviceSessionState {
+    sessionId: string;
+    deviceId: string;
+    tenantId: string;
+    authLevel: string;
+    sessionKey: unknown;
+    hmacKey: unknown;
+    messageCounter: number;
+    replayWindow: Set<number>;
+    createdAt: number;
+    expiresAt: number;
+}
+export interface SecureDeviceMessage {
+    type: "secure.message";
+    sessionId: string;
+    seq: number;
+    ts: number;
+    enc: string;
+    iv: string;
+    tag: string;
+    hmac: string;
+}
+export interface SecurityPolicyProfile {
+    name: string;
+    policy: DeviceSecurityPolicy;
+    description?: string;
+    appliesTo?: string[];
+}
+export declare const BUILTIN_SECURITY_PROFILES: RegistryEntry<SecurityPolicyProfile>[];
+export declare const securityProfileRegistry: import("./registry.js").TypeRegistry<SecurityPolicyProfile>;
+//# sourceMappingURL=device-handshake.d.ts.map

package/dist/device-handshake.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-handshake.d.ts","sourceRoot":"","sources":["../src/device-handshake.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAgC,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAIjF,oBAAoB;AACpB,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC;AAE/B,eAAO,MAAM,mBAAmB,EAAE,aAAa,EAI9C,CAAC;AAEF,eAAO,MAAM,iBAAiB,+CAAsC,CAAC;AAErE,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,mBAAmB,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,OAAO,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,eAAO,MAAM,uBAAuB,EAAE,oBAOrC,CAAC;AAIF,mCAAmC;AACnC,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,mBAAmB;AACnB,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,oBAAoB,CAAC;IACrC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;CACd;AAID;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,gBAAgB,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAID,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,oBAAoB,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,eAAO,MAAM,yBAAyB,EAAE,aAAa,CAAC,qBAAqB,CAAC,EAM3E,CAAC;AAEF,eAAO,MAAM,uBAAuB,6DAAmE,CAAC"}

package/dist/device-handshake.js

@@ -0,0 +1,39 @@
+"use strict";
+/**
+ * deviceHandshakeSecurity — 设备握手安全协议类型定义
+ *
+ * 为设备代理 ↔ 服务端提供 V2 安全增强握手的协议层类型：
+ * - 安全策略类型（元数据驱动）
+ * - 握手安全扩展类型
+ * - 会话类型
+ * - 安全消息包装类型
+ *
+ * 注意：加密/签名/解密等运行时函数依赖 Node.js crypto 模块，
+ * 不包含在协议层中。请使用 @mindpal/shared/deviceHandshakeSecurity 获取完整实现。
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.securityProfileRegistry = exports.BUILTIN_SECURITY_PROFILES = exports.DEFAULT_SECURITY_POLICY = exports.authLevelRegistry = exports.BUILTIN_AUTH_LEVELS = void 0;
+const registry_js_1 = require("./registry.js");
+exports.BUILTIN_AUTH_LEVELS = [
+    (0, registry_js_1.builtInEntry)('token', 'device.auth'),
+    (0, registry_js_1.builtInEntry)('token+ecdh', 'device.auth'),
+    (0, registry_js_1.builtInEntry)('cert+ecdh', 'device.auth'),
+];
+exports.authLevelRegistry = (0, registry_js_1.createRegistry)(exports.BUILTIN_AUTH_LEVELS);
+exports.DEFAULT_SECURITY_POLICY = {
+    format: "deviceSecurity.v1",
+    authLevel: "token+ecdh",
+    requireNonce: true,
+    sessionTtlMs: 3_600_000, // 1 小时
+    keyRotationIntervalMs: 1_800_000, // 30 分钟
+    replayWindowSize: 256,
+};
+exports.BUILTIN_SECURITY_PROFILES = [
+    (0, registry_js_1.builtInEntry)('default', 'device.security_profile', {
+        name: 'default',
+        policy: exports.DEFAULT_SECURITY_POLICY,
+        description: 'Default security policy for general devices',
+    }),
+];
+exports.securityProfileRegistry = (0, registry_js_1.createRegistry)(exports.BUILTIN_SECURITY_PROFILES);
+//# sourceMappingURL=device-handshake.js.map

package/dist/device-handshake.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-handshake.js","sourceRoot":"","sources":["../src/device-handshake.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAEH,+CAAiF;AAOpE,QAAA,mBAAmB,GAAoB;IAClD,IAAA,0BAAY,EAAC,OAAO,EAAE,aAAa,CAAC;IACpC,IAAA,0BAAY,EAAC,YAAY,EAAE,aAAa,CAAC;IACzC,IAAA,0BAAY,EAAC,WAAW,EAAE,aAAa,CAAC;CACzC,CAAC;AAEW,QAAA,iBAAiB,GAAG,IAAA,4BAAc,EAAC,2BAAmB,CAAC,CAAC;AAYxD,QAAA,uBAAuB,GAAyB;IAC3D,MAAM,EAAE,mBAAmB;IAC3B,SAAS,EAAE,YAAY;IACvB,YAAY,EAAE,IAAI;IAClB,YAAY,EAAE,SAAS,EAAW,OAAO;IACzC,qBAAqB,EAAE,SAAS,EAAG,QAAQ;IAC3C,gBAAgB,EAAE,GAAG;CACtB,CAAC;AAkEW,QAAA,yBAAyB,GAA2C;IAC/E,IAAA,0BAAY,EAAC,SAAS,EAAE,yBAAyB,EAAE;QACjD,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,+BAAuB;QAC/B,WAAW,EAAE,6CAA6C;KAC3D,CAAC;CACH,CAAC;AAEW,QAAA,uBAAuB,GAAG,IAAA,4BAAc,EAAwB,iCAAyB,CAAC,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,57 @@
+/**
+ * 标准错误码集合
+ *
+ * 整合 Skill RPC 错误码和通用协议错误码，
+ * 提供统一的错误分类和错误码命名空间。
+ */
+import { SKILL_RPC_ERRORS } from "./skill-rpc";
+/**
+ * 跨层错误映射表 —— 将运行时错误分类统一映射到 HTTP 状态码和服务错误码。
+ * 键为 ErrorCategory / RPC 错误标识，值为 HTTP 响应信息。
+ */
+export declare const ERROR_LAYER_MAP: Record<string, {
+    httpStatus: number;
+    serviceCode: string;
+}>;
+export { SKILL_RPC_ERRORS } from "./skill-rpc";
+export { AUDIT_ERROR_CATEGORIES } from "./audit-event";
+export type { AuditErrorCategory } from "./audit-event";
+export declare const PROTOCOL_ERRORS: {
+    /** 协议版本不兼容 */
+    readonly VERSION_MISMATCH: "PROTOCOL_VERSION_MISMATCH";
+    /** 消息格式无效 */
+    readonly INVALID_MESSAGE: "PROTOCOL_INVALID_MESSAGE";
+    /** 握手失败 */
+    readonly HANDSHAKE_FAILED: "PROTOCOL_HANDSHAKE_FAILED";
+    /** 会话过期 */
+    readonly SESSION_EXPIRED: "PROTOCOL_SESSION_EXPIRED";
+    /** 重放攻击检测 */
+    readonly REPLAY_DETECTED: "PROTOCOL_REPLAY_DETECTED";
+    /** 签名验证失败 */
+    readonly SIGNATURE_INVALID: "PROTOCOL_SIGNATURE_INVALID";
+    /** 状态转换违规 */
+    readonly TRANSITION_VIOLATION: "PROTOCOL_TRANSITION_VIOLATION";
+    /** 共识未达成 */
+    readonly CONSENSUS_NOT_REACHED: "PROTOCOL_CONSENSUS_NOT_REACHED";
+    /** Manifest 校验失败 */
+    readonly MANIFEST_INVALID: "PROTOCOL_MANIFEST_INVALID";
+};
+export type ProtocolErrorCode = (typeof PROTOCOL_ERRORS)[keyof typeof PROTOCOL_ERRORS];
+/** Skill RPC 错误码类型 */
+export type SkillRpcErrorCode = (typeof SKILL_RPC_ERRORS)[keyof typeof SKILL_RPC_ERRORS];
+/** 根据运行时错误分类查询 HTTP 状态码 */
+export declare function getHttpStatusForError(category: string): number;
+/** 根据运行时错误分类查询服务错误码 */
+export declare function getServiceCodeForError(category: string): string;
+/** JSON-RPC 2.0 标准错误码范围 */
+export declare const JSONRPC_ERROR_RANGE: {
+    /** 标准错误码下限 */
+    readonly STANDARD_MIN: -32700;
+    /** 标准错误码上限 */
+    readonly STANDARD_MAX: -32600;
+    /** 服务器端保留范围下限 */
+    readonly SERVER_MIN: -32099;
+    /** 服务器端保留范围上限 */
+    readonly SERVER_MAX: -32000;
+};
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAO/C;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAuBvF,CAAC;AAMF,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAM/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,YAAY,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAMxD,eAAO,MAAM,eAAe;IAC1B,cAAc;;IAEd,aAAa;;IAEb,WAAW;;IAEX,WAAW;;IAEX,aAAa;;IAEb,aAAa;;IAEb,aAAa;;IAEb,YAAY;;IAEZ,oBAAoB;;CAEZ,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC;AAEvF,sBAAsB;AACtB,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,OAAO,gBAAgB,CAAC,CAAC;AAEzF,2BAA2B;AAC3B,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,uBAAuB;AACvB,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE/D;AAMD,2BAA2B;AAC3B,eAAO,MAAM,mBAAmB;IAC9B,cAAc;;IAEd,cAAc;;IAEd,iBAAiB;;IAEjB,iBAAiB;;CAET,CAAC"}

package/dist/errors.js

@@ -0,0 +1,98 @@
+"use strict";
+/**
+ * 标准错误码集合
+ *
+ * 整合 Skill RPC 错误码和通用协议错误码，
+ * 提供统一的错误分类和错误码命名空间。
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JSONRPC_ERROR_RANGE = exports.PROTOCOL_ERRORS = exports.AUDIT_ERROR_CATEGORIES = exports.SKILL_RPC_ERRORS = exports.ERROR_LAYER_MAP = void 0;
+exports.getHttpStatusForError = getHttpStatusForError;
+exports.getServiceCodeForError = getServiceCodeForError;
+/* ================================================================== */
+/*  跨层错误映射表                                                      */
+/* ================================================================== */
+/**
+ * 跨层错误映射表 —— 将运行时错误分类统一映射到 HTTP 状态码和服务错误码。
+ * 键为 ErrorCategory / RPC 错误标识，值为 HTTP 响应信息。
+ */
+exports.ERROR_LAYER_MAP = {
+    // ── 来自 @mindpal/shared errorCategory.ts ──
+    governance_denied: { httpStatus: 403, serviceCode: "GOVERNANCE_DENIED" },
+    governance_unavailable: { httpStatus: 503, serviceCode: "GOVERNANCE_UNAVAILABLE" },
+    input_validation_failed: { httpStatus: 400, serviceCode: "INPUT_VALIDATION_FAILED" },
+    tool_unavailable: { httpStatus: 503, serviceCode: "TOOL_UNAVAILABLE" },
+    step_timeout: { httpStatus: 504, serviceCode: "STEP_TIMEOUT" },
+    tool_execution_failed: { httpStatus: 502, serviceCode: "TOOL_EXECUTION_FAILED" },
+    interrupted: { httpStatus: 499, serviceCode: "INTERRUPTED" },
+    deadletter: { httpStatus: 500, serviceCode: "DEADLETTER" },
+    collab_error: { httpStatus: 502, serviceCode: "COLLAB_ERROR" },
+    // ── 来自 @mindpal/shared serviceError.ts ──
+    auth_failed: { httpStatus: 401, serviceCode: "AUTH_FAILED" },
+    policy_violation: { httpStatus: 403, serviceCode: "POLICY_VIOLATION" },
+    resource_exhausted: { httpStatus: 429, serviceCode: "RESOURCE_EXHAUSTED" },
+    invalid_request: { httpStatus: 400, serviceCode: "INVALID_REQUEST" },
+    not_found: { httpStatus: 404, serviceCode: "NOT_FOUND" },
+    internal: { httpStatus: 500, serviceCode: "INTERNAL" },
+    timeout: { httpStatus: 504, serviceCode: "TIMEOUT" },
+    // ── RPC 级错误 ──
+    tool_timeout: { httpStatus: 504, serviceCode: "TOOL_TIMEOUT" },
+    tool_not_found: { httpStatus: 404, serviceCode: "TOOL_NOT_FOUND" },
+    budget_exceeded: { httpStatus: 429, serviceCode: "BUDGET_EXCEEDED" },
+};
+/* ================================================================== */
+/*  Re-export Skill RPC Errors                                         */
+/* ================================================================== */
+var skill_rpc_1 = require("./skill-rpc");
+Object.defineProperty(exports, "SKILL_RPC_ERRORS", { enumerable: true, get: function () { return skill_rpc_1.SKILL_RPC_ERRORS; } });
+/* ================================================================== */
+/*  Re-export Audit Error Categories                                   */
+/* ================================================================== */
+var audit_event_1 = require("./audit-event");
+Object.defineProperty(exports, "AUDIT_ERROR_CATEGORIES", { enumerable: true, get: function () { return audit_event_1.AUDIT_ERROR_CATEGORIES; } });
+/* ================================================================== */
+/*  通用协议错误码                                                      */
+/* ================================================================== */
+exports.PROTOCOL_ERRORS = {
+    /** 协议版本不兼容 */
+    VERSION_MISMATCH: "PROTOCOL_VERSION_MISMATCH",
+    /** 消息格式无效 */
+    INVALID_MESSAGE: "PROTOCOL_INVALID_MESSAGE",
+    /** 握手失败 */
+    HANDSHAKE_FAILED: "PROTOCOL_HANDSHAKE_FAILED",
+    /** 会话过期 */
+    SESSION_EXPIRED: "PROTOCOL_SESSION_EXPIRED",
+    /** 重放攻击检测 */
+    REPLAY_DETECTED: "PROTOCOL_REPLAY_DETECTED",
+    /** 签名验证失败 */
+    SIGNATURE_INVALID: "PROTOCOL_SIGNATURE_INVALID",
+    /** 状态转换违规 */
+    TRANSITION_VIOLATION: "PROTOCOL_TRANSITION_VIOLATION",
+    /** 共识未达成 */
+    CONSENSUS_NOT_REACHED: "PROTOCOL_CONSENSUS_NOT_REACHED",
+    /** Manifest 校验失败 */
+    MANIFEST_INVALID: "PROTOCOL_MANIFEST_INVALID",
+};
+/** 根据运行时错误分类查询 HTTP 状态码 */
+function getHttpStatusForError(category) {
+    return exports.ERROR_LAYER_MAP[category]?.httpStatus ?? 500;
+}
+/** 根据运行时错误分类查询服务错误码 */
+function getServiceCodeForError(category) {
+    return exports.ERROR_LAYER_MAP[category]?.serviceCode ?? "INTERNAL";
+}
+/* ================================================================== */
+/*  错误码范围常量                                                      */
+/* ================================================================== */
+/** JSON-RPC 2.0 标准错误码范围 */
+exports.JSONRPC_ERROR_RANGE = {
+    /** 标准错误码下限 */
+    STANDARD_MIN: -32700,
+    /** 标准错误码上限 */
+    STANDARD_MAX: -32600,
+    /** 服务器端保留范围下限 */
+    SERVER_MIN: -32099,
+    /** 服务器端保留范围上限 */
+    SERVER_MAX: -32000,
+};
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAkFH,sDAEC;AAGD,wDAEC;AApFD,wEAAwE;AACxE,mEAAmE;AACnE,wEAAwE;AAExE;;;GAGG;AACU,QAAA,eAAe,GAAgE;IAC1F,4CAA4C;IAC5C,iBAAiB,EAAU,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,mBAAmB,EAAE;IAChF,sBAAsB,EAAK,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE;IACrF,uBAAuB,EAAI,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,yBAAyB,EAAE;IACtF,gBAAgB,EAAW,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,kBAAkB,EAAE;IAC/E,YAAY,EAAe,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE;IAC3E,qBAAqB,EAAM,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,uBAAuB,EAAE;IACpF,WAAW,EAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,aAAa,EAAE;IAC1E,UAAU,EAAiB,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE;IACzE,YAAY,EAAe,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE;IAC3E,2CAA2C;IAC3C,WAAW,EAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,aAAa,EAAE;IAC1E,gBAAgB,EAAW,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,kBAAkB,EAAE;IAC/E,kBAAkB,EAAS,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE;IACjF,eAAe,EAAY,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,iBAAiB,EAAE;IAC9E,SAAS,EAAkB,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE;IACxE,QAAQ,EAAmB,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE;IACvE,OAAO,EAAoB,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE;IACtE,gBAAgB;IAChB,YAAY,EAAe,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE;IAC3E,cAAc,EAAa,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,gBAAgB,EAAE;IAC7E,eAAe,EAAY,EAAE,UAAU,EAAE,GAAG,EAAE,WAAW,EAAE,iBAAiB,EAAE;CAC/E,CAAC;AAEF,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE,yCAA+C;AAAtC,6GAAA,gBAAgB,OAAA;AAEzB,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE,6CAAuD;AAA9C,qHAAA,sBAAsB,OAAA;AAG/B,wEAAwE;AACxE,mEAAmE;AACnE,wEAAwE;AAE3D,QAAA,eAAe,GAAG;IAC7B,cAAc;IACd,gBAAgB,EAAE,2BAA2B;IAC7C,aAAa;IACb,eAAe,EAAE,0BAA0B;IAC3C,WAAW;IACX,gBAAgB,EAAE,2BAA2B;IAC7C,WAAW;IACX,eAAe,EAAE,0BAA0B;IAC3C,aAAa;IACb,eAAe,EAAE,0BAA0B;IAC3C,aAAa;IACb,iBAAiB,EAAE,4BAA4B;IAC/C,aAAa;IACb,oBAAoB,EAAE,+BAA+B;IACrD,YAAY;IACZ,qBAAqB,EAAE,gCAAgC;IACvD,oBAAoB;IACpB,gBAAgB,EAAE,2BAA2B;CACrC,CAAC;AAOX,2BAA2B;AAC3B,SAAgB,qBAAqB,CAAC,QAAgB;IACpD,OAAO,uBAAe,CAAC,QAAQ,CAAC,EAAE,UAAU,IAAI,GAAG,CAAC;AACtD,CAAC;AAED,uBAAuB;AACvB,SAAgB,sBAAsB,CAAC,QAAgB;IACrD,OAAO,uBAAe,CAAC,QAAQ,CAAC,EAAE,WAAW,IAAI,UAAU,CAAC;AAC9D,CAAC;AAED,wEAAwE;AACxE,mEAAmE;AACnE,wEAAwE;AAExE,2BAA2B;AACd,QAAA,mBAAmB,GAAG;IACjC,cAAc;IACd,YAAY,EAAE,CAAC,KAAK;IACpB,cAAc;IACd,YAAY,EAAE,CAAC,KAAK;IACpB,iBAAiB;IACjB,UAAU,EAAE,CAAC,KAAK;IAClB,iBAAiB;IACjB,UAAU,EAAE,CAAC,KAAK;CACV,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * @mindpal/protocol — MindPal Agent OS 协议层标准定义
+ *
+ * 统一 re-export 所有协议模块，提供单一入口点。
+ */
+export { createRegistry, builtInEntry, registryIds, } from "./registry";
+export type { RegistryEntry, TypeRegistry, ValidationResult, } from "./registry";
+export { SKILL_RPC_VERSION, SKILL_RPC_JSONRPC, DEVICE_PROTOCOL_VERSION, MIN_SUPPORTED_PROTOCOL_VERSION, PROTOCOL_VERSIONS, JSONRPC_STANDARD_ERRORS, BUILTIN_CUSTOM_ERRORS, skillErrorCodeRegistry, SKILL_RPC_ERRORS, SKILL_RPC_METHODS, BUILTIN_DEVICE_MODALITIES, modalityRegistry, BUILTIN_SKILL_RUNTIMES, runtimeRegistry, BUILTIN_SENSITIVITY_PROFILES, sensitivityProfileRegistry, isVersionCompatible, negotiateVersion, createRpcRequest, createRpcSuccess, createRpcError, createRpcNotification, serializeRpcMessage, parseRpcMessage, isRpcRequest, isRpcNotification, isRpcResponse, isRpcError, getRpcParseFailures, } from "./skill-rpc";
+export type { ProtocolVersion, ProtocolHandshake, ProtocolHandshakeAck, DeviceModality, DeviceMultimodalCapabilities, DeviceMultimodalPolicy, DeviceAttachment, DeviceMultimodalQuery, SkillRuntime, SensitivityProfile, SkillRpcRequest, SkillRpcSuccess, SkillRpcError, SkillRpcNotification, SkillRpcResponse, SkillRpcMessage, SkillModelConfig, SkillInitializeParams, SkillInitializeResult, SkillExecuteParams, SkillExecuteResult, SkillHeartbeatParams, SkillHeartbeatResult, SkillProgressNotification, SkillLogNotification, } from "./skill-rpc";
+export { validateManifest, BUILTIN_SKILL_LAYERS, skillLayerRegistry, } from "./skill-manifest";
+export type { SkillLayer, SkillToolDeclaration, ExtractionHint, BuiltinSkillManifest, ExternalSkillManifest, ManifestValidationResult, InferenceMode, ModelCapabilityTier, SkillModelRequirements, ThroughputMode, SkillPerformanceSLA, AcceleratorType, SkillComputeRequirements, } from "./skill-manifest";
+export { toolNameFromRef, isToolAllowedForPolicy, } from "./toolPolicy";
+export { DEFAULT_SECURITY_POLICY, BUILTIN_AUTH_LEVELS, authLevelRegistry, BUILTIN_SECURITY_PROFILES, securityProfileRegistry, } from "./device-handshake";
+export type { DeviceSecurityPolicy, HandshakeSecurityExt, HandshakeAckSecurityExt, DeviceSessionState, SecureDeviceMessage, } from "./device-handshake";
+export { AUDIT_ERROR_CATEGORIES, HIGH_RISK_AUDIT_ACTIONS, AuditContractError, normalizeAuditErrorCategory, isHighRiskAuditAction, generateHumanSummary, withPolicySnapshotRef, BUILTIN_ERROR_CATEGORY_ALIASES, errorCategoryAliasRegistry, BUILTIN_HIGH_RISK_ACTIONS, highRiskActionRegistry, } from "./audit-event";
+export type { AuditQueryable, AuditPoolLike, AuditClientLike, AuditEventInput, AuditWriter, DetailedAuditEventInput, AuditErrorCategory, InsertAuditEventOptions, AuditEvidenceRef, } from "./audit-event";
+export { STEP_STATUSES, STEP_TERMINAL, STEP_BLOCKING, STEP_STREAMING, STEP_TRANSITIONS, RUN_STATUSES, RUN_TERMINAL, RUN_TRANSITIONS, COLLAB_PHASES, COLLAB_TERMINAL, COLLAB_TRANSITIONS, AGENT_PHASES, AGENT_TRANSITIONS, AGENT_TERMINAL, transitionStep, transitionRun, transitionCollab, transitionAgent, tryTransitionStep, tryTransitionRun, tryTransitionCollab, tryTransitionAgent, isAgentTerminal, normalizeStepStatus, normalizeRunStatus, normalizeCollabPhase, checkStateInvariant, mapOrchestrationToAgent, mapAgentToOrchestration, } from "./state-machine";
+export type { StepStatus, RunStatus, CollabPhase, AgentPhase, TransitionViolation, TransitionResult, StateInvariantViolation, } from "./state-machine";
+export { PROTOCOL_ERRORS, JSONRPC_ERROR_RANGE, ERROR_LAYER_MAP, getHttpStatusForError, getServiceCodeForError, } from "./errors";
+export type { ProtocolErrorCode, SkillRpcErrorCode, } from "./errors";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,cAAc,EACd,YAAY,EACZ,WAAW,GACZ,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,aAAa,EACb,YAAY,EACZ,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,8BAA8B,EAC9B,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,yBAAyB,EACzB,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,EACf,4BAA4B,EAC5B,0BAA0B,EAC1B,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACrB,mBAAmB,EACnB,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,cAAc,EACd,4BAA4B,EAC5B,sBAAsB,EACtB,gBAAgB,EAChB,qBAAqB,EACrB,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAE1B,YAAY,EACV,UAAU,EACV,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,aAAa,EACb,mBAAmB,EACnB,sBAAsB,EACtB,cAAc,EACd,mBAAmB,EACnB,eAAe,EACf,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,eAAe,EACf,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EACV,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,EAClB,2BAA2B,EAC3B,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,8BAA8B,EAC9B,0BAA0B,EAC1B,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,eAAe,CAAC;AAEvB,YAAY,EACV,cAAc,EACd,aAAa,EACb,eAAe,EACf,eAAe,EACf,WAAW,EACX,uBAAuB,EACvB,kBAAkB,EAClB,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,aAAa,EACb,aAAa,EACb,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AAEzB,YAAY,EACV,UAAU,EACV,SAAS,EACT,WAAW,EACX,UAAU,EACV,mBAAmB,EACnB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,UAAU,CAAC;AAElB,YAAY,EACV,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,UAAU,CAAC"}