@nklisch/pi-enhanced 0.1.0

package/node_modules/@nklisch/pi-plugins/dist/domain/compatibility-policy.js

@@ -0,0 +1,913 @@
+import { z } from "zod";
+import { RuntimeRequirementStatusRegistry, } from "./compatibility.js";
+import { ErrorCodeRegistry, ErrorCodeSchema } from "./error-contract.js";
+import { HookConditionFieldRegistry, HookConditionOperatorDefinitionRegistry, HookConditionOperatorRegistry, HookRuntimeEventDefinitionRegistry, incompatibleHookEvents, ordinaryHookEvents, subagentHookEvents, } from "./hook-runtime-contract.js";
+/**
+ * Runtime facts are deliberately separate from component verdicts.  This
+ * registry is the only vocabulary a capability adapter may report.
+ */
+export const RuntimeCapabilityRegistry = {
+    skillToolRestrictions: {
+        id: "pi.skill.allowed-tools",
+        description: "Pi preserves skill tool restrictions",
+        rank: 10,
+    },
+    commandHooks: {
+        id: "pi.hooks.command",
+        description: "Pi command-hook adapter is available",
+        rank: 20,
+    },
+    bash: {
+        id: "platform.shell.bash",
+        description: "Bash is available",
+        rank: 30,
+    },
+    powershell: {
+        id: "platform.shell.powershell",
+        description: "PowerShell is available on Windows",
+        rank: 40,
+    },
+    subagentInterception: {
+        id: "pi.subagents.lifecycle-interception",
+        description: "Subagent pre-start and pre-stop interception is available",
+        rank: 50,
+    },
+    mcpRuntime: {
+        id: "pi.mcp.runtime",
+        description: "Plugin-scoped MCP runtime is available",
+        rank: 60,
+    },
+    mcpTransportStdio: {
+        id: "pi.mcp.transport.stdio",
+        description: "MCP standard-I/O transport is available",
+        rank: 65,
+    },
+    mcpTransportStreamableHttp: {
+        id: "pi.mcp.transport.streamable-http",
+        description: "MCP Streamable HTTP transport is available",
+        rank: 66,
+    },
+    mcpOAuthAuthorizationCode: {
+        id: "pi.mcp.oauth.authorization-code",
+        description: "MCP authorization-code OAuth is available",
+        rank: 70,
+    },
+    mcpOAuthClientCredentials: {
+        id: "pi.mcp.oauth.client-credentials",
+        description: "MCP client-credentials OAuth is available",
+        rank: 80,
+    },
+    mcpToolApproval: {
+        id: "pi.mcp.tool-approval",
+        description: "MCP tool approval policy is available",
+        rank: 90,
+    },
+    mcpSampling: {
+        id: "pi.mcp.sampling",
+        description: "MCP sampling is available",
+        rank: 100,
+    },
+    mcpElicitationForm: {
+        id: "pi.mcp.elicitation.form",
+        description: "Interactive form elicitation is available",
+        rank: 110,
+    },
+    mcpElicitationUrl: {
+        id: "pi.mcp.elicitation.url",
+        description: "Interactive URL elicitation is available",
+        rank: 120,
+    },
+    mcpResources: {
+        id: "pi.mcp.resources",
+        description: "MCP resource access is available",
+        rank: 125,
+    },
+};
+const runtimeCapabilityIds = Object.values(RuntimeCapabilityRegistry).map((entry) => entry.id);
+export const RuntimeCapabilityIdSchema = z.enum(runtimeCapabilityIds);
+const runtimeCapabilityStatuses = Object.values(RuntimeRequirementStatusRegistry).map((entry) => entry.tag);
+export const RuntimeCapabilityAvailabilitySchema = z
+    .object({
+    status: z.enum(runtimeCapabilityStatuses),
+    explanation: z.string().min(1),
+})
+    .strict()
+    .readonly();
+/** A complete immutable fact snapshot supplied by the application boundary. */
+export const RuntimeCapabilitySnapshotSchema = z
+    .object({
+    capabilities: z.record(RuntimeCapabilityIdSchema, RuntimeCapabilityAvailabilitySchema),
+    capturedBy: z.string().min(1),
+})
+    .strict()
+    .readonly()
+    .superRefine((snapshot, context) => {
+    const entries = Object.keys(snapshot.capabilities);
+    const expected = new Set(runtimeCapabilityIds);
+    for (const id of runtimeCapabilityIds) {
+        if (!Object.prototype.hasOwnProperty.call(snapshot.capabilities, id)) {
+            context.addIssue({
+                code: "custom",
+                path: ["capabilities", id],
+                message: `capability snapshot is missing registry capability ${id}`,
+            });
+        }
+    }
+    for (const id of entries) {
+        if (!expected.has(id)) {
+            context.addIssue({
+                code: "custom",
+                path: ["capabilities", id],
+                message: `capability snapshot contains unknown registry capability ${id}`,
+            });
+        }
+    }
+});
+const supportedRule = (rule) => rule;
+const capability = (id) => id;
+const noRequirements = [];
+const skillRules = {
+    core: supportedRule({
+        id: "skill.core",
+        surface: "skill",
+        disposition: "supported",
+        requirementCapabilityIds: noRequirements,
+        message: "Agent Skill name and description are supported",
+        rank: 10,
+    }),
+    presentation: supportedRule({
+        id: "skill.presentation",
+        surface: "skill",
+        disposition: "metadata-only",
+        requirementCapabilityIds: noRequirements,
+        message: "Skill presentation metadata is retained as metadata only",
+        rank: 20,
+    }),
+    disableModelInvocation: supportedRule({
+        id: "skill.disable-model-invocation",
+        surface: "skill",
+        disposition: "supported",
+        requirementCapabilityIds: noRequirements,
+        message: "Skill invocation visibility is representable by Pi",
+        rank: 30,
+    }),
+    codexPresentation: supportedRule({
+        id: "skill.codex-presentation",
+        surface: "skill",
+        disposition: "metadata-only",
+        requirementCapabilityIds: noRequirements,
+        message: "Codex skill presentation metadata is retained as metadata only",
+        rank: 40,
+    }),
+    codexInvocationPolicy: supportedRule({
+        id: "skill.codex-invocation-policy",
+        surface: "skill",
+        disposition: "supported",
+        requirementCapabilityIds: noRequirements,
+        message: "The Codex implicit-invocation policy is representable by Pi",
+        rank: 50,
+    }),
+    allowedTools: supportedRule({
+        id: "skill.allowed-tools",
+        surface: "skill",
+        disposition: "supported",
+        requirementCapabilityIds: [capability(RuntimeCapabilityRegistry.skillToolRestrictions.id)],
+        message: "Pi preserves the skill allowed-tools restriction",
+        rank: 60,
+    }),
+    scopedHooks: supportedRule({
+        id: "skill.scoped-hooks",
+        surface: "skill",
+        disposition: "metadata-only",
+        requirementCapabilityIds: noRequirements,
+        message: "Skill-scoped hooks have no faithful Pi activation boundary; the skill activates without them",
+        rank: 70,
+    }),
+    unknownFrontmatter: supportedRule({
+        id: "skill.unknown-frontmatter",
+        surface: "skill",
+        disposition: "metadata-only",
+        requirementCapabilityIds: noRequirements,
+        message: "Unknown skill frontmatter is retained as metadata only",
+        rank: 80,
+    }),
+    presentationKeys: ["description", "license", "compatibility", "metadata"],
+    invocationPolicyKeys: [
+        "allow_implicit_invocation",
+        "allowImplicitInvocation",
+        "implicit_invocation",
+        "implicitInvocation",
+        "default_mode",
+        "defaultMode",
+        "policy",
+    ],
+    invocationPolicyValues: ["always", "never", "manual", "implicit", "explicit"],
+    metadataPrefixes: ["agent-skills", "codex.agents"],
+};
+const hookHandlerRules = {
+    command: supportedRule({
+        id: "hook.command",
+        surface: "hook",
+        disposition: "supported",
+        requirementCapabilityIds: [capability(RuntimeCapabilityRegistry.commandHooks.id)],
+        message: "Command hook execution is available through Pi",
+        rank: 10,
+    }),
+    statusMessage: supportedRule({
+        id: "hook.status-message",
+        surface: "hook",
+        disposition: "metadata-only",
+        requirementCapabilityIds: noRequirements,
+        message: "Hook status text affects presentation only",
+        rank: 20,
+    }),
+    shellBash: supportedRule({
+        id: "hook.shell.bash",
+        surface: "hook",
+        disposition: "supported",
+        requirementCapabilityIds: [capability(RuntimeCapabilityRegistry.bash.id)],
+        message: "The hook requires the Bash shell",
+        rank: 30,
+    }),
+    shellPowershell: supportedRule({
+        id: "hook.shell.powershell",
+        surface: "hook",
+        disposition: "supported",
+        requirementCapabilityIds: [capability(RuntimeCapabilityRegistry.powershell.id)],
+        message: "The hook requires the PowerShell shell",
+        rank: 40,
+    }),
+    ifRule: supportedRule({
+        id: "hook.if-rule",
+        surface: "hook",
+        disposition: "supported",
+        requirementCapabilityIds: noRequirements,
+        message: "The hook condition uses Pi's representable condition grammar",
+        rank: 50,
+    }),
+    async: supportedRule({
+        id: "hook.async",
+        surface: "hook",
+        disposition: "metadata-only",
+        requirementCapabilityIds: noRequirements,
+        message: "Asynchronous hook ordering cannot be preserved by Pi; the hook is retained but not activated",
+        rank: 60,
+    }),
+    unsupportedHandler: supportedRule({
+        id: "hook.handler.unsupported",
+        surface: "hook",
+        disposition: "metadata-only",
+        requirementCapabilityIds: noRequirements,
+        message: "The hook handler type is not a supported command handler; the hook is retained but not activated",
+        rank: 70,
+    }),
+    unknownEvent: supportedRule({
+        id: "hook.event.default-deny",
+        surface: "hook",
+        disposition: "metadata-only",
+        requirementCapabilityIds: noRequirements,
+        message: "Unknown hook events are retained but not activated",
+        rank: 80,
+    }),
+    incompatibleEvent: supportedRule({
+        id: "hook.event.incompatible",
+        surface: "hook",
+        disposition: "metadata-only",
+        requirementCapabilityIds: noRequirements,
+        message: "The hook event has no faithful Pi lifecycle boundary; the hook is retained but not activated",
+        rank: 90,
+    }),
+    supportedEvent: supportedRule({
+        id: "hook.event.supported",
+        surface: "hook",
+        disposition: "supported",
+        requirementCapabilityIds: noRequirements,
+        message: "The hook event maps to a Pi lifecycle boundary",
+        rank: 100,
+    }),
+    subagentEvent: supportedRule({
+        id: "hook.event.subagent",
+        surface: "hook",
+        disposition: "supported",
+        requirementCapabilityIds: [capability(RuntimeCapabilityRegistry.subagentInterception.id)],
+        message: "The subagent hook requires lifecycle interception",
+        rank: 110,
+    }),
+};
+const hookMetadataKeys = {
+    prefixes: ["handler", "group", "claude.hook", "codex.hook"],
+    statusMessage: ["statusMessage", "status_message", "statusText"],
+    shell: ["shell"],
+    async: ["async", "asyncRewake"],
+    ifRule: ["if", "conditions"],
+};
+const hookEvents = {
+    supported: ordinaryHookEvents,
+    subagent: subagentHookEvents,
+    incompatible: incompatibleHookEvents,
+    rules: hookHandlerRules,
+    metadata: hookMetadataKeys,
+    conditionFields: HookConditionFieldRegistry,
+    conditionOperators: HookConditionOperatorRegistry,
+    conditionOperatorDefinitions: HookConditionOperatorDefinitionRegistry,
+    conditionPredicateKeys: ["field", "operator", "value"],
+    conditionWrapperKeys: ["if"],
+    definitions: HookRuntimeEventDefinitionRegistry,
+};
+const mcpRules = {
+    transportStdio: supportedRule({
+        id: "mcp.transport.stdio",
+        surface: "mcp-server",
+        disposition: "supported",
+        requirementCapabilityIds: [
+            capability(RuntimeCapabilityRegistry.mcpRuntime.id),
+            capability(RuntimeCapabilityRegistry.mcpTransportStdio.id),
+        ],
+        message: "MCP standard-I/O transport is supported",
+        rank: 10,
+    }),
+    transportStreamableHttp: supportedRule({
+        id: "mcp.transport.streamable-http",
+        surface: "mcp-server",
+        disposition: "supported",
+        requirementCapabilityIds: [
+            capability(RuntimeCapabilityRegistry.mcpRuntime.id),
+            capability(RuntimeCapabilityRegistry.mcpTransportStreamableHttp.id),
+        ],
+        message: "MCP Streamable HTTP transport is supported",
+        rank: 20,
+    }),
+    transportSecurity: supportedRule({
+        id: "mcp.transport.security",
+        surface: "mcp-server",
+        disposition: "incompatible",
+        requirementCapabilityIds: noRequirements,
+        diagnosticCode: ErrorCodeRegistry.unsupportedDeclaration,
+        message: "MCP credentials require HTTPS; plaintext HTTP is limited to exact unauthenticated loopback consent",
+        rank: 25,
+    }),
+    transportSse: supportedRule({
+        id: "mcp.transport.sse",
+        surface: "mcp-server",
+        disposition: "metadata-only",
+        requirementCapabilityIds: noRequirements,
+        message: "Legacy MCP SSE transport has no faithful runtime capability; the server is retained but not activated",
+        rank: 30,
+    }),
+    transportWebsocket: supportedRule({
+        id: "mcp.transport.websocket",
+        surface: "mcp-server",
+        disposition: "metadata-only",
+        requirementCapabilityIds: noRequirements,
+        message: "MCP WebSocket transport is not supported; the server is retained but not activated",
+        rank: 40,
+    }),
+    oauthAuthorizationCode: supportedRule({
+        id: "mcp.oauth.authorization-code",
+        surface: "mcp-server",
+        disposition: "supported",
+        requirementCapabilityIds: [
+            capability(RuntimeCapabilityRegistry.mcpRuntime.id),
+            capability(RuntimeCapabilityRegistry.mcpOAuthAuthorizationCode.id),
+        ],
+        message: "MCP authorization-code OAuth is supported by the selected runtime",
+        rank: 50,
+    }),
+    oauthClientCredentials: supportedRule({
+        id: "mcp.oauth.client-credentials",
+        surface: "mcp-server",
+        disposition: "supported",
+        requirementCapabilityIds: [
+            capability(RuntimeCapabilityRegistry.mcpRuntime.id),
+            capability(RuntimeCapabilityRegistry.mcpOAuthClientCredentials.id),
+        ],
+        message: "MCP client-credentials OAuth is supported by the selected runtime",
+        rank: 60,
+    }),
+    featuresCore: supportedRule({
+        id: "mcp.features.core",
+        surface: "mcp-server",
+        disposition: "supported",
+        requirementCapabilityIds: [capability(RuntimeCapabilityRegistry.mcpRuntime.id)],
+        message: "MCP core configuration features are supported",
+        rank: 70,
+    }),
+    featureResources: supportedRule({
+        id: "mcp.feature.resources",
+        surface: "mcp-server",
+        disposition: "supported",
+        requirementCapabilityIds: [capability(RuntimeCapabilityRegistry.mcpResources.id)],
+        message: "MCP resource access is supported by the selected runtime",
+        rank: 75,
+    }),
+    featureToolApproval: supportedRule({
+        id: "mcp.feature.tool-approval",
+        surface: "mcp-server",
+        disposition: "supported",
+        requirementCapabilityIds: [capability(RuntimeCapabilityRegistry.mcpToolApproval.id)],
+        message: "MCP tool approval policy is supported by the selected runtime",
+        rank: 80,
+    }),
+    featureSampling: supportedRule({
+        id: "mcp.feature.sampling",
+        surface: "mcp-server",
+        disposition: "supported",
+        requirementCapabilityIds: [capability(RuntimeCapabilityRegistry.mcpSampling.id)],
+        message: "MCP sampling is supported by the selected runtime",
+        rank: 90,
+    }),
+    featureElicitationForm: supportedRule({
+        id: "mcp.feature.elicitation-form",
+        surface: "mcp-server",
+        disposition: "supported",
+        requirementCapabilityIds: [capability(RuntimeCapabilityRegistry.mcpElicitationForm.id)],
+        message: "MCP form elicitation is supported by the selected runtime",
+        rank: 100,
+    }),
+    featureElicitationUrl: supportedRule({
+        id: "mcp.feature.elicitation-url",
+        surface: "mcp-server",
+        disposition: "supported",
+        requirementCapabilityIds: [capability(RuntimeCapabilityRegistry.mcpElicitationUrl.id)],
+        message: "MCP URL elicitation is supported by the selected runtime",
+        rank: 110,
+    }),
+    headersHelper: supportedRule({
+        id: "mcp.headers-helper",
+        surface: "mcp-server",
+        disposition: "metadata-only",
+        requirementCapabilityIds: noRequirements,
+        message: "Dynamic MCP header helpers have no faithful runtime capability; the server is retained but not activated",
+        rank: 120,
+    }),
+    channels: supportedRule({
+        id: "mcp.channels",
+        surface: "mcp-server",
+        disposition: "metadata-only",
+        requirementCapabilityIds: noRequirements,
+        message: "Claude MCP channels are not a supported Pi runtime surface; the declaration is retained as metadata only",
+        rank: 130,
+    }),
+    defaultDeny: supportedRule({
+        id: "mcp.default-deny",
+        surface: "mcp-server",
+        disposition: "metadata-only",
+        requirementCapabilityIds: noRequirements,
+        message: "Unknown MCP transport, authentication, feature, or key is retained but not activated",
+        rank: 140,
+    }),
+};
+/** Keys understood by the opaque MCP policy boundary. */
+const mcpOAuthFlowDefinitions = {
+    authorizationCode: {
+        aliases: ["authorization-code", "authorization_code", "authorizationCode"],
+        ruleId: mcpRules.oauthAuthorizationCode.id,
+    },
+    clientCredentials: {
+        aliases: ["client-credentials", "client_credentials", "clientCredentials"],
+        ruleId: mcpRules.oauthClientCredentials.id,
+    },
+};
+const mcpFeaturePayloadDefinitions = {
+    toolApproval: {
+        fieldGroup: "toolApproval",
+        shape: "boolean-flags",
+        ruleId: mcpRules.featureToolApproval.id,
+    },
+    sampling: {
+        fieldGroup: "sampling",
+        shape: "boolean-flags",
+        ruleId: mcpRules.featureSampling.id,
+    },
+    elicitation: {
+        fieldGroup: "elicitation",
+        shape: "elicitation-flags",
+        ruleId: mcpRules.featureElicitationForm.id,
+    },
+};
+/**
+ * One table describes the accepted MCP authentication selector vocabulary.
+ * The evaluator uses this table to classify modes before validating their
+ * payload, so a declaration cannot become OAuth merely because the first
+ * recognizable flow field happened to appear before a bearer selector.
+ */
+const mcpAuthSelectorDefinitions = {
+    modeKeys: ["type", "mode"],
+    modes: {
+        none: { aliases: ["none"] },
+        bearer: { aliases: ["bearer", "bearer-env"] },
+        oauth: { aliases: ["oauth"] },
+    },
+    oauthFlowKeys: ["grantType", "grant_type", "flow"],
+    oauthBooleanFlowKeys: [
+        "authorizationCode",
+        "authorization_code",
+        "clientCredentials",
+        "client_credentials",
+    ],
+    bearerEnvironmentKeys: ["env"],
+    oauthParameterKeys: [
+        "clientId",
+        "client_id",
+        "redirectUri",
+        "redirect_uri",
+    ],
+};
+const mcpAuthKeys = [
+    ...mcpAuthSelectorDefinitions.modeKeys,
+    ...mcpAuthSelectorDefinitions.bearerEnvironmentKeys,
+    ...mcpAuthSelectorDefinitions.oauthParameterKeys,
+    ...mcpAuthSelectorDefinitions.oauthFlowKeys,
+    ...mcpAuthSelectorDefinitions.oauthBooleanFlowKeys,
+];
+const allMcpTransports = ["stdio", "streamable-http", "sse", "websocket"];
+const remoteMcpTransports = ["streamable-http", "sse", "websocket"];
+/**
+ * This is the sole MCP field vocabulary. Recognition, transport coherence,
+ * aliases, output targets, and collision behavior all derive from these rows.
+ */
+const mcpFieldGroups = {
+    transport: {
+        target: "transport",
+        aliases: ["transport", "type"],
+        unit: "transport",
+        collision: "canonical-equality",
+        transports: allMcpTransports,
+    },
+    command: {
+        target: "launch.command",
+        aliases: ["command"],
+        unit: "non-empty-string",
+        collision: "exact-equality",
+        transports: ["stdio"],
+    },
+    arguments: {
+        target: "launch.arguments",
+        aliases: ["args"],
+        unit: "string-array",
+        collision: "exact-equality",
+        transports: ["stdio"],
+    },
+    environment: {
+        target: "launch.environment",
+        aliases: ["env"],
+        unit: "string-record",
+        collision: "exact-equality",
+        transports: ["stdio"],
+    },
+    workingDirectory: {
+        target: "launch.workingDirectory",
+        aliases: ["cwd", "workingDirectory"],
+        unit: "string",
+        collision: "exact-equality",
+        transports: ["stdio"],
+    },
+    url: {
+        target: "launch.url",
+        aliases: ["url"],
+        unit: "transport-url",
+        collision: "exact-equality",
+        transports: remoteMcpTransports,
+    },
+    headers: {
+        target: "launch.headers",
+        aliases: ["headers", "features.headers"],
+        unit: "headers",
+        collision: "exact-equality",
+        transports: remoteMcpTransports,
+    },
+    authentication: {
+        target: "options.auth",
+        aliases: ["auth", "oauth", "authentication", "bearerTokenEnv", "features.oauth"],
+        externalBearerAlias: "bearerTokenEnv",
+        unit: "authentication-mode",
+        collision: "coherent-single-mode",
+        transports: remoteMcpTransports,
+    },
+    startupTimeout: {
+        target: "options.startupTimeoutMs",
+        aliases: ["startupTimeout", "timeoutMs"],
+        unit: "milliseconds",
+        collision: "exact-equality",
+        transports: allMcpTransports,
+    },
+    toolTimeout: {
+        target: "options.toolTimeoutMs",
+        aliases: ["toolTimeout", "timeout"],
+        unit: "milliseconds",
+        collision: "exact-equality",
+        transports: allMcpTransports,
+    },
+    tools: {
+        target: "options.tools",
+        aliases: ["tools"],
+        unit: "direct-tools-or-map",
+        collision: "exact-equality",
+        transports: allMcpTransports,
+    },
+    allowedTools: {
+        target: "options.allowedTools",
+        aliases: ["allowTools", "allowedTools", "tools.allow"],
+        unit: "exact-string-set",
+        collision: "set-equality",
+        transports: allMcpTransports,
+    },
+    deniedTools: {
+        target: "options.deniedTools",
+        aliases: ["denyTools", "disabledTools", "tools.deny"],
+        unit: "exact-string-set",
+        collision: "set-equality",
+        transports: allMcpTransports,
+    },
+    instructions: {
+        target: "options.instructions",
+        aliases: ["instructions"],
+        unit: "string",
+        collision: "exact-equality",
+        transports: allMcpTransports,
+    },
+    resources: {
+        target: "options.resources",
+        aliases: ["resources"],
+        unit: "resources",
+        collision: "exact-equality",
+        transports: allMcpTransports,
+    },
+    toolApproval: {
+        target: "options.toolApproval",
+        aliases: ["toolApproval", "tool_approval", "features.toolApproval", "features.tool_approval"],
+        unit: "boolean-flags",
+        collision: "reject-duplicates",
+        transports: allMcpTransports,
+    },
+    sampling: {
+        target: "options.sampling",
+        aliases: ["sampling", "features.sampling"],
+        unit: "boolean-flags",
+        collision: "reject-duplicates",
+        transports: allMcpTransports,
+    },
+    elicitation: {
+        target: "options.elicitation",
+        aliases: ["elicitation", "features.elicitation"],
+        unit: "elicitation-flags",
+        collision: "reject-duplicates",
+        transports: allMcpTransports,
+    },
+    headersHelper: {
+        target: "unsupported.headersHelper",
+        aliases: ["headersHelper"],
+        unit: "unsupported",
+        collision: "reject-duplicates",
+        transports: remoteMcpTransports,
+    },
+    channels: {
+        target: "unsupported.channels",
+        aliases: ["channels"],
+        unit: "unsupported",
+        collision: "reject-duplicates",
+        transports: remoteMcpTransports,
+    },
+};
+const mcpKeyDefinitions = {
+    transport: "transport",
+    transportValues: allMcpTransports,
+    typeValues: ["stdio", "streamable-http", "http", "sse", "websocket"],
+    transportAliases: { http: "streamable-http" },
+    fieldGroups: mcpFieldGroups,
+    type: "type",
+    command: "command",
+    args: "args",
+    env: "env",
+    cwd: "cwd",
+    workingDirectory: "workingDirectory",
+    url: "url",
+    headers: "headers",
+    bearerTokenEnv: "bearerTokenEnv",
+    auth: "auth",
+    oauth: "oauth",
+    authentication: "authentication",
+    timeout: "timeout",
+    startupTimeout: "startupTimeout",
+    toolTimeout: "toolTimeout",
+    timeoutMs: "timeoutMs",
+    allowTools: "allowTools",
+    allowedTools: "allowedTools",
+    denyTools: "denyTools",
+    disabledTools: "disabledTools",
+    tools: "tools",
+    instructions: "instructions",
+    resources: "resources",
+    toolApproval: "toolApproval",
+    tool_approval: "tool_approval",
+    sampling: "sampling",
+    elicitation: "elicitation",
+    features: "features",
+    featureValues: ["tool-approval", "sampling", "elicitation-form", "elicitation-url"],
+    featurePayloadDefinitions: mcpFeaturePayloadDefinitions,
+    oauthGrantTypes: Object.values(mcpOAuthFlowDefinitions).flatMap((definition) => definition.aliases),
+    oauthFlowDefinitions: mcpOAuthFlowDefinitions,
+    authSelectorDefinitions: mcpAuthSelectorDefinitions,
+    authKeys: mcpAuthKeys,
+    booleanFeatureKeys: ["enabled", "required"],
+    elicitationFeatureKeys: ["form", "url"],
+    headerEnvironmentKeys: ["env"],
+    headersHelper: "headersHelper",
+    channels: "channels",
+};
+const foreignRules = {
+    defaultDeny: supportedRule({
+        id: "foreign.default-deny",
+        surface: "foreign",
+        disposition: "metadata-only",
+        requirementCapabilityIds: noRequirements,
+        message: "Foreign runtime components are retained as metadata only and are never executed",
+        rank: 10,
+    }),
+    piExtension: supportedRule({
+        id: "foreign.pi-extension",
+        surface: "foreign",
+        disposition: "metadata-only",
+        requirementCapabilityIds: noRequirements,
+        message: "This plugin ships a Pi extension (tools/commands). This host doesn't run plugin extensions, so those won't register — install the plugin pi-natively to use them",
+        rank: 10,
+    }),
+};
+const reportRules = {
+    verdictRegistry: supportedRule({
+        id: "verdict.registry",
+        surface: "report",
+        disposition: "supported",
+        requirementCapabilityIds: noRequirements,
+        message: "Compatibility reports use exactly the supported verdict vocabulary",
+        rank: 10,
+    }),
+    requirementSeparateStatus: supportedRule({
+        id: "requirement.separate-status",
+        surface: "report",
+        disposition: "supported",
+        requirementCapabilityIds: noRequirements,
+        message: "Runtime requirement availability is separate from component verdicts",
+        rank: 20,
+    }),
+    metadataOnly: supportedRule({
+        id: "verdict.metadata-only",
+        surface: "report",
+        disposition: "metadata-only",
+        requirementCapabilityIds: noRequirements,
+        message: "Presentation-only metadata does not block activation",
+        rank: 30,
+    }),
+    incompatible: supportedRule({
+        id: "verdict.incompatible",
+        surface: "report",
+        disposition: "incompatible",
+        requirementCapabilityIds: noRequirements,
+        diagnosticCode: ErrorCodeRegistry.unsupportedDeclaration,
+        message: "An incompatible component blocks complete-plugin activation",
+        rank: 40,
+    }),
+    knownPresentation: supportedRule({
+        id: "metadata.known-presentation",
+        surface: "report",
+        disposition: "metadata-only",
+        requirementCapabilityIds: noRequirements,
+        message: "Known plugin presentation metadata is retained without runtime meaning",
+        rank: 50,
+    }),
+};
+const configurationRules = {
+    descriptor: supportedRule({
+        id: "configuration.descriptor",
+        surface: "configuration",
+        disposition: "metadata-only",
+        requirementCapabilityIds: noRequirements,
+        message: "Configuration descriptors are advisory input for downstream lifecycle services",
+        rank: 10,
+    }),
+    requiredInput: supportedRule({
+        id: "configuration.required-input",
+        surface: "configuration",
+        disposition: "metadata-only",
+        requirementCapabilityIds: noRequirements,
+        message: "Configuration input is required downstream before activation",
+        rank: 20,
+    }),
+    sensitive: supportedRule({
+        id: "configuration.sensitive",
+        surface: "configuration",
+        disposition: "metadata-only",
+        requirementCapabilityIds: noRequirements,
+        message: "Sensitive configuration must be supplied through the secret boundary",
+        rank: 30,
+    }),
+};
+const marketplaceRules = {
+    availabilityAvailable: supportedRule({
+        id: "marketplace.availability.available",
+        surface: "marketplace",
+        disposition: "metadata-only",
+        requirementCapabilityIds: noRequirements,
+        message: "Marketplace availability is advisory context; lifecycle policy decides installability",
+        rank: 10,
+    }),
+    availabilityInstalledByDefault: supportedRule({
+        id: "marketplace.availability.installed-by-default",
+        surface: "marketplace",
+        disposition: "metadata-only",
+        requirementCapabilityIds: noRequirements,
+        message: "Marketplace installed-by-default policy is advisory context",
+        rank: 20,
+    }),
+    availabilityNotAvailable: supportedRule({
+        id: "marketplace.availability.not-available",
+        surface: "marketplace",
+        disposition: "metadata-only",
+        requirementCapabilityIds: noRequirements,
+        message: "Marketplace not-available policy is advisory context; it does not alter compatibility",
+        rank: 30,
+    }),
+    policy: supportedRule({
+        id: "marketplace.policy",
+        surface: "marketplace",
+        disposition: "metadata-only",
+        requirementCapabilityIds: noRequirements,
+        message: "Marketplace authentication and installation policy is lifecycle context",
+        rank: 40,
+    }),
+};
+/**
+ * All compatibility knowledge is data in this registry.  Evaluator dispatch,
+ * capability references, diagnostic messages, and contract tables consume the
+ * sections below instead of keeping switch-local semantic lists.
+ */
+export const CompatibilityPolicyRegistry = {
+    skills: skillRules,
+    hookHandlers: hookHandlerRules,
+    hookEvents,
+    mcp: {
+        ...mcpRules,
+        keys: mcpKeyDefinitions,
+    },
+    foreign: foreignRules,
+    configuration: configurationRules,
+    marketplace: marketplaceRules,
+    report: reportRules,
+    metadata: {
+        knownPluginPresentationKeys: [
+            "owner",
+            "description",
+            "category",
+            "tags",
+            "interface",
+            "visibility",
+        ],
+    },
+};
+/** Stable flattened view for data-driven contract tests and tooling. */
+function onlyRules(values) {
+    return values.filter((value) => typeof value === "object" && value !== null && !Array.isArray(value) &&
+        "id" in value && "surface" in value && "disposition" in value);
+}
+export const CompatibilityPolicyRuleRegistry = Object.freeze(Object.fromEntries([
+    ...onlyRules(Object.values(skillRules)),
+    ...onlyRules(Object.values(hookHandlerRules)),
+    ...onlyRules(Object.values(mcpRules)),
+    ...onlyRules(Object.values(foreignRules)),
+    ...onlyRules(Object.values(configurationRules)),
+    ...onlyRules(Object.values(marketplaceRules)),
+    ...onlyRules(Object.values(reportRules)),
+].map((rule) => [rule.id, rule])));
+export const CompatibilityPolicyRuleSchema = z
+    .object({
+    id: z.string().min(1),
+    surface: z.enum(["skill", "hook", "mcp-server", "foreign", "configuration", "marketplace", "report"]),
+    disposition: z.enum(["supported", "metadata-only", "incompatible"]),
+    requirementCapabilityIds: z.array(RuntimeCapabilityIdSchema).readonly(),
+    diagnosticCode: ErrorCodeSchema.optional(),
+    message: z.string().min(1),
+    rank: z.number().int().nonnegative(),
+})
+    .strict()
+    .readonly();
+export const CompatibilityPolicyRulesSchema = z
+    .record(z.string().min(1), CompatibilityPolicyRuleSchema)
+    .readonly();
+export const RuntimeCapabilityRegistrySchema = z
+    .record(z.string().min(1), z.object({
+    id: RuntimeCapabilityIdSchema,
+    description: z.string().min(1),
+    rank: z.number().int().nonnegative(),
+}).strict().readonly())
+    .readonly();
+export const HookEventSchema = z.enum([
+    ...CompatibilityPolicyRegistry.hookEvents.supported,
+    ...CompatibilityPolicyRegistry.hookEvents.subagent,
+    ...CompatibilityPolicyRegistry.hookEvents.incompatible,
+]);
+export const MCPTransportSchema = z.enum(CompatibilityPolicyRegistry.mcp.keys.transportValues);
+export const MCPFeatureSchema = z.enum(CompatibilityPolicyRegistry.mcp.keys.featureValues);
+// Keep these aliases discoverable for callers that use the domain vocabulary.
+export const RuntimeCapabilityStatusRegistry = RuntimeRequirementStatusRegistry;
+export const RuntimeCapabilityStatusSchema = z.enum(runtimeCapabilityStatuses);
+//# sourceMappingURL=compatibility-policy.js.map