@passioncode-ai/fabric-agent-adapter 0.44.0 → 0.44.2

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-interop.mjs

@@ -11,51 +11,37 @@ import path from 'node:path';
 import { ServiceError, atomicWrite, ensurePrivateDir, nowIso } from './fabric-service.mjs';
 import { jcs } from './fabric-delegation.mjs';
 
-export const PROTOCOL = 'fabric-interop/0.1';
-export const EXTENSION_KEY = 'https://fabric.passioncode.ai/agent-contract/extensions/interop/0.1';
-export const MCP_REVISION = '2026-07-28';
-export const TERMINAL = ['completed', 'failed', 'cancelled'];
-export const CONTRACT_VERSION = '0.1.0';
-const OUTCOMES = ['succeeded', 'partial', 'failed', 'cancelled', 'blocked'];
-const ENVELOPE_REQUIRED = ['id', 'contractVersion', 'outcome', 'done', 'proof', 'scope', 'notVerified', 'artifacts', 'createdAt', 'producer', 'output', 'usage'];
-// The job handle inline, as a job tool's outputSchema carries it (contract interop-job-handle.schema.json).
-export const JOB_HANDLE_SCHEMA = {
-  type: 'object', required: ['job'], additionalProperties: false,
-  properties: { job: { type: 'object', required: ['id', 'status'], additionalProperties: false,
-    properties: { id: { type: 'string', minLength: 1, maxLength: 128, pattern: '^[A-Za-z0-9._:-]+$' }, status: { const: 'working' } } } },
-};
-
-const TRACEPARENT = /^([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/;
-const JOB_ID = /^[A-Za-z0-9._:-]{1,128}$/;
-const KEY = /^[A-Za-z0-9_.-]{1,64}$/;
-const SECRET_WORDS = /pass(word|phrase)|secret|api[\s_-]?key|access[\s_-]?key|private[\s_-]?key|(access|auth|bearer|refresh|session)[\s_-]?token|^token$|credential/i;
-const USAGE_KEYS = ['inputTokens', 'outputTokens', 'cacheReadTokens', 'cacheWriteTokens', 'costUsd', 'wallMs'];
-
-export class InteropError extends ServiceError {}
-export class UnknownJob extends InteropError {
-  constructor(jobId) { super(`unknown-job: no job ${jobId} here.`); this.jobId = jobId; }
-}
-
-// --- C3.4 trace context ---------------------------------------------------------------
-export function parseTraceparent(value) {
-  const m = typeof value === 'string' ? TRACEPARENT.exec(value) : null;
-  if (!m) return null;
-  const [, version, traceId, spanId, flags] = m;
-  if (version === 'ff' || /^0+$/.test(traceId) || /^0+$/.test(spanId)) return null;
-  return { version, traceId, spanId, flags };
-}
-
-const spanIdNew = () => { for (;;) { const v = crypto.randomBytes(8).toString('hex'); if (!/^0+$/.test(v)) return v; } };
-
-export function childTraceparent(parent) {
-  const p = parseTraceparent(parent);
-  return `00-${p ? p.traceId : crypto.randomBytes(16).toString('hex')}-${spanIdNew()}-${p ? p.flags : '01'}`;
-}
-
-export const traceIds = (traceparent) => {
-  const p = parseTraceparent(traceparent);
-  return p ? { traceId: p.traceId, spanId: p.spanId } : {};
-};
+export {
+  PROTOCOL,
+  EXTENSION_KEY,
+  MCP_REVISION,
+  TERMINAL,
+  CONTRACT_VERSION,
+  JOB_HANDLE_SCHEMA,
+  InteropError,
+  UnknownJob,
+  parseTraceparent,
+  childTraceparent,
+  traceIds,
+  QUOTA_EXHAUSTED,
+  OUTCOME_UNKNOWN,
+  LIMIT_REACHED,
+  INTEROP_NULL_USAGE,
+  PROTOCOLS_READ,
+  utcTime,
+  quotaDataOk,
+  readJobPause,
+  jobCallerAction,
+  intentIdempotencyKey,
+  readsNullUsage,
+  requestMeta,
+  usageFindings,
+  usageToward,
+  jobLimitRules,
+  pauseMessage,
+  repeatedKeyDecision,
+} from './fabric-interop-rules.mjs';
+import { PROTOCOL, EXTENSION_KEY, MCP_REVISION, TERMINAL, CONTRACT_VERSION, JOB_HANDLE_SCHEMA, InteropError, UnknownJob, parseTraceparent, childTraceparent, traceIds, QUOTA_EXHAUSTED, OUTCOME_UNKNOWN, LIMIT_REACHED, INTEROP_NULL_USAGE, PROTOCOLS_READ, utcTime, quotaDataOk, readJobPause, jobCallerAction, intentIdempotencyKey, readsNullUsage, requestMeta, usageFindings, usageToward, jobLimitRules, pauseMessage, repeatedKeyDecision, OUTCOMES, ENVELOPE_REQUIRED, JOB_ID, KEY, SECRET_WORDS } from './fabric-interop-rules.mjs'; // the rule layer (FAA-92)
 
 // --- C3.1 capabilities as tools ----------------------------------------------------------
 export function expectedAnnotations(effect, idempotency) {
@@ -95,22 +81,6 @@ export const unknownJobResult = (jobId, traceparent) =>
   toolResult({ error: { code: 'unknown-job', message: `No job ${jobId} here.` } }, { isError: true, traceparent });
 
 // --- C3.2 the result envelope --------------------------------------------------------------
-function checkUsage(usage, nulls = false) {
-  if (!usage || typeof usage !== 'object') throw new InteropError('usage must be an object.');
-  for (const key of ['inputTokens', 'outputTokens', 'wallMs']) if (!(key in usage)) throw new InteropError(`usage.${key} is required.`);
-  for (const [key, value] of Object.entries(usage)) {
-    if (nulls && key === 'partial') {
-      if (typeof value !== 'boolean') throw new InteropError('usage.partial must be a boolean.');
-      continue;
-    }
-    if (!USAGE_KEYS.includes(key)) throw new InteropError(`usage.${key} is not a usage field.`);
-    if (nulls && value === null) continue;
-    const ok = typeof value === 'number' && value >= 0 && (key === 'costUsd' || Number.isInteger(value));
-    if (!ok) throw new InteropError(`usage.${key} must be a non-negative ${key === 'costUsd' ? 'number' : 'integer'}.`);
-  }
-  if (nulls && usageFindings(usage, '').length) throw new InteropError('usage.partial is false while a number is null: an unknown number makes the usage partial (FAC-SEM-119).');
-  return { ...usage };
-}
 
 // The full result envelope (contract result.schema.json, DEC-0017): the shape a synchronous call returns.
 export function resultEnvelope({ outcome, done, proof, scope, notVerified, output, usage, producer, artifacts = [], traceparent, id, createdAt, requestMeta }) {
@@ -129,199 +99,6 @@ export function resultEnvelope({ outcome, done, proof, scope, notVerified, outpu
   return envelope;
 }
 
-// --- C3.2 limits and uncertain effects (DEC-0087) ------------------------------------------
-// #region job-limits-kit-node, docs: plugins/fabric-agent-adapter/skills/building-fabric-services/references/interop.md#limits-and-uncertain-effects
-// The contract's src/job-limits.ts, answer for answer (test/fixtures/contract/job-limit-vectors.json), the twin of
-// fabric_interop.py. Every function here answers and never throws on malformed input.
-
-export const QUOTA_EXHAUSTED = 'quota-exhausted';
-export const OUTCOME_UNKNOWN = 'outcome-unknown';
-export const LIMIT_REACHED = 'limit-reached';
-export const INTEROP_NULL_USAGE = 'fabric-interop/0.2';
-/** The revisions this kit reads, named in a request's `_meta.protocols` (DEC-0067, DEC-0087). */
-export const PROTOCOLS_READ = Object.freeze(['fabric-interop/0.1', INTEROP_NULL_USAGE]);
-const JOB_STATUSES = ['working', 'input_required', 'completed', 'failed', 'cancelled'];
-const UTC_INSTANT = /^([0-9]{4})-([0-9]{2})-([0-9]{2})T([0-9]{2}):([0-9]{2}):([0-5][0-9])(?:\.([0-9]{1,3}))?Z$/;
-const PAUSE = /^quota-exhausted(?: until ([^ \t\n\r]+?))?(?:: ([ \t\n\r]*[^ \t\n\r][\s\S]*))?$/;
-const ERROR_CODE = /^[a-z][a-z0-9-]{1,63}$/;
-const MAX_STATUS_MESSAGE = 500;
-const MAX_ERROR_MESSAGE = 2000;
-const codePoints = (value) => [...value].length;
-import { isString } from './fabric-jsvalue.mjs'; // the core's (FAA-65)
-import { isObject } from './fabric-jsvalue.mjs'; // the core's (FAA-65)
-const own = (value, key) => (isObject(value) && Object.hasOwn(value, key) ? value[key] : undefined);
-
-/** A UTC instant as milliseconds, or NaN: the pattern and a day that exists, as the contract's strictTime reads it. */
-export function utcTime(value) {
-  const m = isString(value) ? UTC_INSTANT.exec(value) : null;
-  if (!m) return Number.NaN;
-  const [year, month, day, hour, minute, second] = m.slice(1, 7).map(Number);
-  const date = new Date(0);
-  date.setUTCFullYear(year, month - 1, day);
-  if (date.getUTCMonth() !== month - 1 || date.getUTCDate() !== day || hour > 23 || minute > 59) return Number.NaN;
-  date.setUTCHours(hour, minute, second, Number((m[7] ?? '').padEnd(3, '0')));
-  return date.getTime();
-}
-
-export function quotaDataOk(data) {
-  const retryable = own(data, 'retryable');
-  if (!isObject(data) || typeof retryable !== 'boolean') return false;
-  if (Object.keys(data).some((name) => name !== 'retryable' && name !== 'resetsAt')) return false;
-  if (!Object.hasOwn(data, 'resetsAt')) return true;
-  return retryable && Number.isFinite(utcTime(own(data, 'resetsAt')));
-}
-
-function jobOf(answer) {
-  const job = own(answer, 'job');
-  const id = own(job, 'id');
-  if (!isObject(job) || !isString(id) || id.length === 0 || !JOB_STATUSES.includes(own(job, 'status'))) return undefined;
-  return job;
-}
-
-export function readJobPause(answer) {
-  const job = jobOf(answer);
-  const message = own(job, 'statusMessage');
-  if (!job || own(job, 'status') !== 'working' || !isString(message) || !message.startsWith(QUOTA_EXHAUSTED)) return { paused: false };
-  const match = PAUSE.exec(message);
-  if (!match || codePoints(message) > MAX_STATUS_MESSAGE) return { paused: false, malformed: true };
-  const until = match[1];
-  if (until === undefined) return { paused: true };
-  return Number.isFinite(utcTime(until)) ? { paused: true, resetsAt: until } : { paused: false, malformed: true };
-}
-
-/** What a caller does with one fabric.job.get or fabric.job.cancel answer at `now`; never "submit anew". */
-export function jobCallerAction(answer, now) {
-  const at = utcTime(now);
-  const job = jobOf(answer);
-  if (!Number.isFinite(at) || !job) return { action: 'invalid' };
-  const status = own(job, 'status');
-  if (status === 'working') {
-    const pause = readJobPause(answer);
-    if ('malformed' in pause) return { action: 'invalid' };
-    if (!pause.paused) return { action: 'poll' };
-    if (pause.resetsAt === undefined) return { action: 'wait' };
-    return utcTime(pause.resetsAt) > at ? { action: 'wait', notBefore: pause.resetsAt } : { action: 'poll' };
-  }
-  if (status === 'input_required') return { action: 'answer' };
-  if (status === 'completed') return { action: 'done' };
-  if (status === 'cancelled') return { action: 'cancelled' };
-  const error = own(job, 'error');
-  const code = own(error, 'code');
-  const message = own(error, 'message');
-  const codeOk = (isString(code) && ERROR_CODE.test(code)) || Number.isInteger(code);
-  const shapeOk = isObject(error) && Object.keys(error).every((name) => name === 'code' || name === 'message' || name === 'data');
-  if (!shapeOk || !codeOk || !isString(message) || message.length === 0 || codePoints(message) > MAX_ERROR_MESSAGE) return { action: 'invalid' };
-  if (code === OUTCOME_UNKNOWN) return { action: 'reconcile' };
-  if (code === LIMIT_REACHED) return { action: 'person' };
-  if (code !== QUOTA_EXHAUSTED) return { action: 'failed' };
-  const data = own(error, 'data');
-  if (!quotaDataOk(data)) return { action: 'invalid' };
-  if (!data.retryable) return { action: 'person' };
-  return data.resetsAt !== undefined && utcTime(data.resetsAt) > at ? { action: 'resend', notBefore: data.resetsAt } : { action: 'resend' };
-}
-
-/** The idempotency key of an intent {agentId, capability, input, request?}: a UUID of version 8 over its RFC 8785 form. */
-export function intentIdempotencyKey(intent) {
-  const names = ['agentId', 'capability', 'input', 'request'];
-  if (!isObject(intent) || Object.keys(intent).some((name) => !names.includes(name))) return undefined;
-  const [agentId, capability, input, request] = names.map((name) => own(intent, name));
-  if (!isString(agentId) || agentId.length === 0 || !isString(capability) || capability.length === 0 || !isObject(input)) return undefined;
-  if (Object.hasOwn(intent, 'request') && (!isString(request) || request.length === 0 || codePoints(request) > 256)) return undefined;
-  let form;
-  try {
-    form = jcs(Object.hasOwn(intent, 'request') ? { agentId, capability, input, request } : { agentId, capability, input });
-  } catch {
-    return undefined;
-  }
-  const bytes = crypto.createHash('sha256').update(form, 'utf8').digest().subarray(0, 16);
-  bytes[6] = (bytes[6] & 0x0f) | 0x80;
-  bytes[8] = (bytes[8] & 0x3f) | 0x80;
-  const hex = bytes.toString('hex');
-  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
-}
-
-export function readsNullUsage(requestMeta) {
-  const protocols = own(requestMeta, 'protocols');
-  return Array.isArray(protocols) && protocols.includes(INTEROP_NULL_USAGE);
-}
-
-/** A request's `_meta` from this kit as a caller: its trace, and the interop revisions it reads (DEC-0087). */
-export function requestMeta(traceparent) {
-  const meta = { protocols: [...PROTOCOLS_READ] };
-  if (parseTraceparent(traceparent)) meta.traceparent = traceparent;
-  return meta;
-}
-
-/** FAC-SEM-119 on a usage: partial false asserts every number known, so it stands beside no null. */
-export function usageFindings(usage, at) {
-  if (!isObject(usage) || usage.partial !== false) return [];
-  const unknown = USAGE_KEYS.filter((name) => Object.hasOwn(usage, name) && usage[name] === null);
-  if (unknown.length === 0) return [];
-  return [{ code: 'FAC-SEM-119', instancePath: `${at}/partial`, message: `partial is false while ${unknown.join(', ')} is null: an unknown number makes the usage partial` }];
-}
-
-/** The usage a provider writes toward a caller: null and partial toward a 0.2 reader, the measured lower bound otherwise. */
-export function usageToward(usage, meta) {
-  if (readsNullUsage(meta)) {
-    const checked = checkUsage(usage, true);
-    if (USAGE_KEYS.some((name) => checked[name] === null) && !('partial' in checked)) checked.partial = true;
-    return checked;
-  }
-  if (!isObject(usage)) throw new InteropError('usage must be an object.');
-  return checkUsage(Object.fromEntries(Object.entries(usage).filter(([key]) => key !== 'partial').map(([key, value]) => [key, value === null ? 0 : value])));
-}
-
-function jobFindings(value) {
-  const findings = [];
-  if ('malformed' in readJobPause(value)) {
-    findings.push({ code: 'FAC-SEM-119', instancePath: '/job/statusMessage', message: "a working job's message that starts quota-exhausted reads `quota-exhausted`, `quota-exhausted until <UTC instant>`, then optionally `: <text>`, at most 500 characters" });
-  }
-  const error = own(own(value, 'job'), 'error');
-  const data = own(error, 'data');
-  if (own(error, 'code') === QUOTA_EXHAUSTED && isString(own(data, 'resetsAt')) && !Number.isFinite(utcTime(own(data, 'resetsAt')))) {
-    findings.push({ code: 'FAC-SEM-119', instancePath: '/job/error/data/resetsAt', message: 'resetsAt is a UTC instant on a day that exists' });
-  }
-  findings.push(...usageFindings(own(own(own(value, 'job'), 'result'), 'usage'), '/job/result/usage'));
-  return findings;
-}
-
-const sameJson = (a, b) => JSON.stringify(a) === JSON.stringify(b);
-
-/** FAC-SEM-119 (kinds interop-job, usage and result) and FAC-SEM-120 (kind job-caller); undefined for another kind. */
-export function jobLimitRules(kind, value) {
-  if (kind === 'interop-job') return jobFindings(value);
-  if (kind === 'usage') return usageFindings(value, '');
-  if (kind === 'result') return usageFindings(own(value, 'usage'), '/usage');
-  if (kind === 'job-caller') {
-    const expected = jobCallerAction(own(value, 'answer'), own(value, 'now'));
-    return sameJson(own(value, 'action'), expected) ? [] : [{ code: 'FAC-SEM-120', instancePath: '/action', message: `the caller answers ${JSON.stringify(expected)} as jobCallerAction does` }];
-  }
-  return undefined;
-}
-
-/** A paused job's statusMessage in the pause grammar; throws InteropError for one a reader would call malformed. */
-export function pauseMessage({ resetsAt, text } = {}) {
-  const message = `${QUOTA_EXHAUSTED}${resetsAt === undefined ? '' : ` until ${resetsAt}`}${text === undefined ? '' : `: ${text}`}`;
-  if ('malformed' in readJobPause({ job: { id: 'x', status: 'working', statusMessage: message } })) {
-    throw new InteropError('A pause reads quota-exhausted [until <UTC instant, Z, at most 3 fraction digits>][: <text>], at most 500 characters.');
-  }
-  return message;
-}
-
-/** The provider's answer to a repeated key: 'run' (the intent runs again, once) or 'same' (answer with that job). */
-export function repeatedKeyDecision(job, now, { limitHolds, approvalGranted = false } = {}) {
-  if (!isObject(job) || job.status !== 'failed') return 'same';
-  const error = own(job, 'error');
-  const code = own(error, 'code');
-  if (code === LIMIT_REACHED) return approvalGranted === true ? 'run' : 'same';
-  if (code !== QUOTA_EXHAUSTED) return 'same';
-  if (limitHolds !== undefined && limitHolds !== null) return limitHolds === false ? 'run' : 'same';
-  const data = own(error, 'data');
-  const at = utcTime(now);
-  if (!quotaDataOk(data) || !data.retryable || !Number.isFinite(at)) return 'same';
-  return data.resetsAt === undefined || utcTime(data.resetsAt) <= at ? 'run' : 'same';
-}
-// #endregion job-limits-kit-node
 
 // --- C3.3 awaiting a choice ------------------------------------------------------------------
 export function formRequest(message, properties, required) {

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-package-schema.mjs

@@ -0,0 +1,100 @@
+// fabric-package/1, the schema reading: the package schema bundled from the contract at the pin, read by a JSON
+// Schema 2020-12 subset with JavaScript's patterns, lengths in code points and the formats the contract uses.
+// fabric-package.mjs checks, packs, signs and verifies on it and re-exports schemaProblems. Part of the Node service
+// kit (FAA-92, split from fabric-package.mjs; layer L2); the twin of fabric_package_schema.py. Node 20+, no dependency.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { isString, jsonEqual } from './fabric-jsvalue.mjs'; // the core's (FAA-65)
+
+export const SCHEMA_FILE = path.join(path.dirname(fileURLToPath(import.meta.url)), 'fabric-package.schema.json');
+
+// --- the schema (bundled from the contract at the pin) ---------------------------------------------------------------
+
+export let schemaCache;
+export const schema = () => (schemaCache ??= JSON.parse(fs.readFileSync(SCHEMA_FILE, 'utf8')));
+
+
+export const typeOf = (v) => (v === null ? 'null' : Array.isArray(v) ? 'array' : typeof v === 'number' ? (Number.isInteger(v) ? 'integer' : 'number') : typeof v);
+export const DATE_TIME = /^([0-9]{4})-([0-9]{2})-([0-9]{2})[Tt]([0-9]{2}):([0-9]{2}):([0-9]{2})(\.[0-9]+)?([Zz]|[+-]([0-9]{2}):([0-9]{2}))$/;
+export const MONTH_DAYS = [0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+export const leap = (year) => year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+
+export function formatOk(format, value) {
+  if (!isString(value)) return true;
+  if (format === 'date-time') {
+    const m = DATE_TIME.exec(value);
+    if (!m) return false;
+    const [y, mo, d, h, mi, s] = m.slice(1, 7).map(Number);
+    // The proleptic calendar the contract's ajv-formats checks: year 0000 exists and is a leap year (0000-02-29 holds).
+    // Counted here, not with Date.UTC, which reads years 0 to 99 as 1900 to 1999.
+    if (mo < 1 || mo > 12 || d < 1 || d > (mo === 2 && leap(y) ? 29 : MONTH_DAYS[mo]) || h > 23 || mi > 59 || s > 59) return false;
+    return m[8] === 'Z' || m[8] === 'z' || (Number(m[9]) < 24 && Number(m[10]) < 60);
+  }
+  if (format === 'uri') return /^[A-Za-z][A-Za-z0-9+.-]*:\S*$/.test(value);
+  return true;
+}
+
+export const pointer = (token) => String(token).replace(/~/g, '~0').replace(/\//g, '~1');
+export const codePoints = (s) => [...s].length; // JSON Schema counts code points, not UTF-16 units
+
+export function validate(node, value, at, out) {
+  if (node === true) return;
+  if (node === false) { out.push({ instancePath: at, message: 'is not allowed here' }); return; }
+  if (node.$ref) {
+    const target = node.$ref.replace(/^#\//, '').split('/').reduce((n, t) => n[t.replace(/~1/g, '/').replace(/~0/g, '~')], schema());
+    validate(target, value, at, out);
+  }
+  const kind = typeOf(value);
+  if (node.type !== undefined) {
+    const allowed = Array.isArray(node.type) ? node.type : [node.type];
+    if (!(allowed.includes(kind) || (kind === 'integer' && allowed.includes('number')))) { out.push({ instancePath: at, message: `must be ${allowed.join(' or ')}` }); return; }
+  }
+  if ('const' in node && !jsonEqual(node.const, value)) out.push({ instancePath: at, message: `must be ${JSON.stringify(node.const)}` });
+  if (node.enum && !node.enum.some((item) => jsonEqual(item, value))) out.push({ instancePath: at, message: `must be one of ${node.enum.map((i) => JSON.stringify(i)).join(', ')}` });
+  if (kind === 'string') {
+    const length = codePoints(value);
+    if (length < (node.minLength ?? 0)) out.push({ instancePath: at, message: `is shorter than ${node.minLength}` });
+    if (node.maxLength !== undefined && length > node.maxLength) out.push({ instancePath: at, message: `is longer than ${node.maxLength}` });
+    if (node.pattern !== undefined && !new RegExp(node.pattern, 'u').test(value)) out.push({ instancePath: at, message: `does not match ${node.pattern}` });
+    if (node.format !== undefined && !formatOk(node.format, value)) out.push({ instancePath: at, message: `is not a ${node.format}` });
+  }
+  if ((kind === 'integer' || kind === 'number') && node.minimum !== undefined && value < node.minimum) out.push({ instancePath: at, message: `is below ${node.minimum}` });
+  if (kind === 'array') {
+    if (value.length < (node.minItems ?? 0)) out.push({ instancePath: at, message: `has fewer than ${node.minItems} items` });
+    if (node.maxItems !== undefined && value.length > node.maxItems) out.push({ instancePath: at, message: `has more than ${node.maxItems} items` });
+    if (node.uniqueItems && value.some((item, i) => value.slice(0, i).some((other) => jsonEqual(item, other)))) out.push({ instancePath: at, message: 'has duplicate items' });
+    if (node.items !== undefined) value.forEach((item, i) => validate(node.items, item, `${at}/${i}`, out));
+    if (node.contains !== undefined) {
+      const matches = value.filter((item) => problemsOf(node.contains, item).length === 0).length;
+      if (matches < (node.minContains ?? 1)) out.push({ instancePath: at, message: `has fewer than ${node.minContains ?? 1} matching items` });
+      if (node.maxContains !== undefined && matches > node.maxContains) out.push({ instancePath: at, message: `has more than ${node.maxContains} matching items` });
+    }
+  }
+  if (kind === 'object') {
+    for (const name of node.required ?? []) if (!Object.hasOwn(value, name)) out.push({ instancePath: at, message: `must have ${name}` });
+    const properties = node.properties ?? {};
+    for (const [name, member] of Object.entries(value)) {
+      const where = `${at}/${pointer(name)}`;
+      if (Object.hasOwn(properties, name)) validate(properties[name], member, where, out);
+      else if (node.additionalProperties === false) out.push({ instancePath: where, message: 'is not a member of this object' });
+      else if (node.additionalProperties !== undefined) validate(node.additionalProperties, member, where, out);
+      if (node.propertyNames !== undefined) validate(node.propertyNames, name, where, out);
+    }
+  }
+  for (const sub of node.allOf ?? []) validate(sub, value, at, out);
+  if (node.not !== undefined && problemsOf(node.not, value).length === 0) out.push({ instancePath: at, message: 'must not match' });
+  if (node.if !== undefined) {
+    const branch = problemsOf(node.if, value).length === 0 ? node.then : node.else;
+    if (branch !== undefined) validate(branch, value, at, out);
+  }
+}
+
+export function problemsOf(node, value) {
+  const out = [];
+  validate(node, value, '', out);
+  return out;
+}
+
+/** Where the package breaks fabric-package.schema.json (the contract's, bundled at the pin). */
+export const schemaProblems = (pkg) => problemsOf(schema(), pkg);

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-package.mjs

@@ -24,7 +24,6 @@ export const PLUGIN_MANIFEST = '.claude-plugin/plugin.json';
 export const SIGNATURE_STATEMENT = 'fabric-package-signature/1';
 /** DEC-0051: ES256 joins when Fabric records its decision D2; until then a verifier refuses it as unknown-algorithm. */
 export const PACKAGE_ALGORITHMS = Object.freeze(['EdDSA']);
-const SCHEMA_FILE = path.join(path.dirname(fileURLToPath(import.meta.url)), 'fabric-package.schema.json');
 // What pack refuses to list: version-control and cache litter, and files that are credentials by their name.
 const JUNK = /^(\.git|__pycache__|\.DS_Store|.*\.pyc)$/;
 const SECRET_FILE = /^(\.env(\..+)?|.*\.(pem|key|p12|pfx|jks|keystore)|id_(rsa|dsa|ecdsa|ed25519)|\.(npmrc|netrc|pypirc))$/;
@@ -125,95 +124,9 @@ export function readSigningKey(file, kid) {
   return { seed, kid };
 }
 
-// --- the schema (bundled from the contract at the pin) ---------------------------------------------------------------
+export { schemaProblems } from './fabric-package-schema.mjs'; // the schema reading (FAA-92)
+import { pointer, schema, schemaProblems } from './fabric-package-schema.mjs';
 
-let schemaCache;
-const schema = () => (schemaCache ??= JSON.parse(fs.readFileSync(SCHEMA_FILE, 'utf8')));
-
-
-const typeOf = (v) => (v === null ? 'null' : Array.isArray(v) ? 'array' : typeof v === 'number' ? (Number.isInteger(v) ? 'integer' : 'number') : typeof v);
-const DATE_TIME = /^([0-9]{4})-([0-9]{2})-([0-9]{2})[Tt]([0-9]{2}):([0-9]{2}):([0-9]{2})(\.[0-9]+)?([Zz]|[+-]([0-9]{2}):([0-9]{2}))$/;
-const MONTH_DAYS = [0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
-const leap = (year) => year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
-
-function formatOk(format, value) {
-  if (!isString(value)) return true;
-  if (format === 'date-time') {
-    const m = DATE_TIME.exec(value);
-    if (!m) return false;
-    const [y, mo, d, h, mi, s] = m.slice(1, 7).map(Number);
-    // The proleptic calendar the contract's ajv-formats checks: year 0000 exists and is a leap year (0000-02-29 holds).
-    // Counted here, not with Date.UTC, which reads years 0 to 99 as 1900 to 1999.
-    if (mo < 1 || mo > 12 || d < 1 || d > (mo === 2 && leap(y) ? 29 : MONTH_DAYS[mo]) || h > 23 || mi > 59 || s > 59) return false;
-    return m[8] === 'Z' || m[8] === 'z' || (Number(m[9]) < 24 && Number(m[10]) < 60);
-  }
-  if (format === 'uri') return /^[A-Za-z][A-Za-z0-9+.-]*:\S*$/.test(value);
-  return true;
-}
-
-const pointer = (token) => String(token).replace(/~/g, '~0').replace(/\//g, '~1');
-const codePoints = (s) => [...s].length; // JSON Schema counts code points, not UTF-16 units
-
-function validate(node, value, at, out) {
-  if (node === true) return;
-  if (node === false) { out.push({ instancePath: at, message: 'is not allowed here' }); return; }
-  if (node.$ref) {
-    const target = node.$ref.replace(/^#\//, '').split('/').reduce((n, t) => n[t.replace(/~1/g, '/').replace(/~0/g, '~')], schema());
-    validate(target, value, at, out);
-  }
-  const kind = typeOf(value);
-  if (node.type !== undefined) {
-    const allowed = Array.isArray(node.type) ? node.type : [node.type];
-    if (!(allowed.includes(kind) || (kind === 'integer' && allowed.includes('number')))) { out.push({ instancePath: at, message: `must be ${allowed.join(' or ')}` }); return; }
-  }
-  if ('const' in node && !jsonEqual(node.const, value)) out.push({ instancePath: at, message: `must be ${JSON.stringify(node.const)}` });
-  if (node.enum && !node.enum.some((item) => jsonEqual(item, value))) out.push({ instancePath: at, message: `must be one of ${node.enum.map((i) => JSON.stringify(i)).join(', ')}` });
-  if (kind === 'string') {
-    const length = codePoints(value);
-    if (length < (node.minLength ?? 0)) out.push({ instancePath: at, message: `is shorter than ${node.minLength}` });
-    if (node.maxLength !== undefined && length > node.maxLength) out.push({ instancePath: at, message: `is longer than ${node.maxLength}` });
-    if (node.pattern !== undefined && !new RegExp(node.pattern, 'u').test(value)) out.push({ instancePath: at, message: `does not match ${node.pattern}` });
-    if (node.format !== undefined && !formatOk(node.format, value)) out.push({ instancePath: at, message: `is not a ${node.format}` });
-  }
-  if ((kind === 'integer' || kind === 'number') && node.minimum !== undefined && value < node.minimum) out.push({ instancePath: at, message: `is below ${node.minimum}` });
-  if (kind === 'array') {
-    if (value.length < (node.minItems ?? 0)) out.push({ instancePath: at, message: `has fewer than ${node.minItems} items` });
-    if (node.maxItems !== undefined && value.length > node.maxItems) out.push({ instancePath: at, message: `has more than ${node.maxItems} items` });
-    if (node.uniqueItems && value.some((item, i) => value.slice(0, i).some((other) => jsonEqual(item, other)))) out.push({ instancePath: at, message: 'has duplicate items' });
-    if (node.items !== undefined) value.forEach((item, i) => validate(node.items, item, `${at}/${i}`, out));
-    if (node.contains !== undefined) {
-      const matches = value.filter((item) => problemsOf(node.contains, item).length === 0).length;
-      if (matches < (node.minContains ?? 1)) out.push({ instancePath: at, message: `has fewer than ${node.minContains ?? 1} matching items` });
-      if (node.maxContains !== undefined && matches > node.maxContains) out.push({ instancePath: at, message: `has more than ${node.maxContains} matching items` });
-    }
-  }
-  if (kind === 'object') {
-    for (const name of node.required ?? []) if (!Object.hasOwn(value, name)) out.push({ instancePath: at, message: `must have ${name}` });
-    const properties = node.properties ?? {};
-    for (const [name, member] of Object.entries(value)) {
-      const where = `${at}/${pointer(name)}`;
-      if (Object.hasOwn(properties, name)) validate(properties[name], member, where, out);
-      else if (node.additionalProperties === false) out.push({ instancePath: where, message: 'is not a member of this object' });
-      else if (node.additionalProperties !== undefined) validate(node.additionalProperties, member, where, out);
-      if (node.propertyNames !== undefined) validate(node.propertyNames, name, where, out);
-    }
-  }
-  for (const sub of node.allOf ?? []) validate(sub, value, at, out);
-  if (node.not !== undefined && problemsOf(node.not, value).length === 0) out.push({ instancePath: at, message: 'must not match' });
-  if (node.if !== undefined) {
-    const branch = problemsOf(node.if, value).length === 0 ? node.then : node.else;
-    if (branch !== undefined) validate(branch, value, at, out);
-  }
-}
-
-function problemsOf(node, value) {
-  const out = [];
-  validate(node, value, '', out);
-  return out;
-}
-
-/** Where the package breaks fabric-package.schema.json (the contract's, bundled at the pin). */
-export const schemaProblems = (pkg) => problemsOf(schema(), pkg);
 
 // --- the contract's rules (FAC-SEM-064…066, FAC-SEM-102), ported line for line from src/package-rules.ts --------------
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-paths.mjs

@@ -1,5 +1,5 @@
 // Where a service's things live (fabric-service/0.1): the services directory, its data, config, logs and run dirs per OS, private dirs, atomic writes.
-// Part of the Node service kit (FAA-65, layer L3); the twin of fabric_paths.py. Node 20+, no dependency.
+// Part of the Node service kit (FAA-65, layer L1); the twin of fabric_paths.py. Node 20+, no dependency.
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
@@ -51,19 +51,21 @@ export function atomicWrite(file, data, mode = 0o600) {
   const tmp = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${crypto.randomBytes(4).toString('hex')}`);
   const fd = fs.openSync(tmp, 'wx', mode);
   try {
-    // On Windows the file's ACL is its privacy (DEC-0032): set explicitly and protected — before the bytes go in —
-    // so it does not depend on what the folder hands down. A rename keeps it.
-    if (process.platform === 'win32') windowsProtect(tmp, { folder: false });
-    fs.writeSync(fd, data);
-    fs.fsyncSync(fd);
-  } finally {
-    fs.closeSync(fd);
-  }
-  try {
+    try {
+      // On Windows the file's ACL is its privacy (DEC-0032): set explicitly and protected — before the bytes go in —
+      // so it does not depend on what the folder hands down. A rename keeps it.
+      if (process.platform === 'win32') windowsProtect(tmp, { folder: false });
+      fs.writeSync(fd, data);
+      fs.fsyncSync(fd);
+    } finally {
+      fs.closeSync(fd);
+    }
     if (process.platform !== 'win32') fs.chmodSync(tmp, mode);
     fs.renameSync(tmp, file);
   } catch (error) {
-    fs.rmSync(tmp, { force: true });
+    // Whatever failed, no half-written file is left beside the real one, and a failed cleanup never replaces the
+    // error that caused it (FAA-85).
+    try { fs.rmSync(tmp, { force: true }); } catch { /* the original error is the one to report */ }
     throw error;
   }
 }

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-platform.mjs

@@ -1,5 +1,5 @@
 // Windows, where the kit needs it (DEC-0032): reading a file's ACL to refuse a token file others can read.
-// Part of the Node service kit (FAA-65, layer L3); the twin of fabric_platform.py. Node 20+, no dependency.
+// Part of the Node service kit (FAA-65, layer L1); the twin of fabric_platform.py. Node 20+, no dependency.
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_base.py

@@ -1,4 +1,4 @@
-"""What every module of the service kit shares (FAA-65, layer L3): the protocol name, ServiceError, the
+"""What every module of the service kit shares (FAA-65, layer L1): the protocol name, ServiceError, the
 platform, ids and now_iso. Standard library only."""
 from __future__ import annotations
 

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_delegation.py

@@ -21,10 +21,8 @@ import http.client
 import ipaddress
 import json
 import math
-import os
 from pathlib import Path
 import re
-import secrets
 import threading
 import time
 from typing import Any, Callable, Dict, List, Mapping, Optional, Tuple
@@ -46,6 +44,7 @@ from fabric_jsvalue import (  # noqa: E402 - the core (FAA-65)
     MISSING as _MISSING,
     jcs,
 )
+from fabric_paths import atomic_write as _atomic_write  # noqa: E402 - the kit's private writer (FAA-85)
 
 REFUSAL_CODES = (
     "unauthenticated", "token-expired", "wrong-audience", "scope-not-granted", "effect-above-ceiling", "no-grant",
@@ -484,7 +483,7 @@ class JtiStoreError(RuntimeError):
 
 
 class FileJtiStore:
-    """Consumed approval ids in a 0600 JSON file, so a second use is refused across a restart (DL-18). One
+    """Consumed approval ids in an owner-only JSON file, so a second use is refused across a restart (DL-18). One
     service instance writes it (the kit's instance lock keeps other processes out); threads are serialised."""
 
     _locks: Dict[str, threading.Lock] = {}
@@ -511,14 +510,9 @@ class FileJtiStore:
             if jti in seen:
                 return False
             seen[jti] = expires_at
-            self.path.parent.mkdir(parents=True, exist_ok=True)
-            temp = self.path.with_name(".%s.%s.tmp" % (self.path.name, secrets.token_hex(4)))
-            fd = os.open(str(temp), os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
-            with os.fdopen(fd, "w") as handle:
-                json.dump(seen, handle)
-                handle.flush()
-                os.fsync(handle.fileno())
-            os.replace(str(temp), str(self.path))
+            # The kit's private writer: owner-only (0600; on Windows a protected ACL before the bytes, DEC-0032),
+            # fsynced, renamed into place, and no temporary file left when it fails (FAA-85).
+            _atomic_write(self.path, json.dumps(seen).encode("utf-8"))
             return True