@ran-sh/dsh-crew 1.1.0 → 1.2.0-rc.4

package/src/provider-settings-store.mjs

@@ -11,14 +11,28 @@ const PROVIDER_ID = /^[A-Za-z0-9][A-Za-z0-9._-]*$/u;
 function sha256(value) { return createHash('sha256').update(value, 'utf8').digest('hex'); }
 function indentOf(line) { return (line.match(/^\s*/u) ?? [''])[0].length; }
 function nonBlank(line) { return line.trim() !== '' && !line.trimStart().startsWith('#'); }
+function nextContentLine(lines, start, end = lines.length) {
+  for (let index = start; index < end; index += 1) if (nonBlank(lines[index])) return index;
+  return -1;
+}
+function unquoteScalar(value) {
+  const input = typeof value === 'string' ? value.trim() : '';
+  if (!input) return null;
+  if (input.startsWith('"') && input.endsWith('"')) {
+    try { return JSON.parse(input); } catch { return null; }
+  }
+  if (input.startsWith("'") && input.endsWith("'")) return input.slice(1, -1).replace(/''/gu, "'");
+  return input;
+}
 function scalarField(lines, entry, field) {
-  const pattern = new RegExp(`^\\s+${field}:\\s*(.*?)\\s*$`);
+  const indent = Number.isInteger(entry?.fieldIndent) ? entry.fieldIndent : null;
+  const pattern = new RegExp(`^${indent === null ? '\\s+' : ` {${indent}}`}${field}:\\s*(.*?)\\s*$`);
   for (const line of lines.slice(entry.start, entry.end)) {
     const match = line.match(pattern);
     if (!match) continue;
-    const value = match[1].trim();
+    const value = (entry?.style === 'flow' ? match[1].replace(/,\s*$/u, '') : match[1]).trim();
     if (!value) return null;
-    return value.replace(/^(?:"([\s\S]*)"|'([\s\S]*)')$/u, '$1$2');
+    return unquoteScalar(value);
   }
   return null;
 }
@@ -51,6 +65,39 @@ function parseProviderMap(source) {
   }
   const providersLine = lines.findIndex((line, index) => index > llmStart && index < blockEnd && /^ {2}providers:\s*(?:\{\s*\})?\s*$/u.test(line));
   if (providersLine < 0) return { ok: false, code: 'PROVIDER_SETTINGS_SCHEMA_UNSUPPORTED' };
+  const flowOpenLine = nextContentLine(lines, providersLine + 1, blockEnd);
+  if (flowOpenLine >= 0 && /^ {4}\{\s*$/u.test(lines[flowOpenLine])) {
+    let flowCloseLine = -1;
+    const entries = [];
+    let index = flowOpenLine + 1;
+    while (index < blockEnd) {
+      index = nextContentLine(lines, index, blockEnd);
+      if (index < 0) break;
+      if (/^ {4}\}\s*$/u.test(lines[index])) { flowCloseLine = index; break; }
+      const match = lines[index].match(/^ {6}([A-Za-z0-9][A-Za-z0-9._-]*):\s*$/u);
+      if (!match) return { ok: false, code: 'PROVIDER_SETTINGS_SCHEMA_UNSUPPORTED' };
+      const objectOpen = nextContentLine(lines, index + 1, blockEnd);
+      if (objectOpen < 0 || !/^ {8}\{\s*$/u.test(lines[objectOpen])) return { ok: false, code: 'PROVIDER_SETTINGS_SCHEMA_UNSUPPORTED' };
+      let objectClose = -1;
+      for (let cursor = objectOpen + 1; cursor < blockEnd; cursor += 1) {
+        if (/^ {8}\},?\s*$/u.test(lines[cursor])) { objectClose = cursor; break; }
+      }
+      if (objectClose < 0) return { ok: false, code: 'PROVIDER_SETTINGS_SCHEMA_UNSUPPORTED' };
+      entries.push({ id: match[1], start: index, end: objectClose + 1, style: 'flow', fieldIndent: 10, objectOpen, objectClose });
+      index = objectClose + 1;
+    }
+    if (flowCloseLine < 0) return { ok: false, code: 'PROVIDER_SETTINGS_SCHEMA_UNSUPPORTED' };
+    for (let entryIndex = 0; entryIndex < entries.length - 1; entryIndex += 1) {
+      if (!/^ {8}\},\s*$/u.test(lines[entries[entryIndex].objectClose])) return { ok: false, code: 'PROVIDER_SETTINGS_SCHEMA_UNSUPPORTED' };
+    }
+    if (entries.some((entry) => !validFlowEntryStructure(lines, entry))) {
+      return { ok: false, code: 'PROVIDER_SETTINGS_SCHEMA_UNSUPPORTED' };
+    }
+    return {
+      ok: true, style: 'flow', lines, llmStart, blockEnd, providersLine,
+      providersBlockEnd: flowCloseLine + 1, flowOpenLine, flowCloseLine, entries,
+    };
+  }
   let providersBlockEnd = blockEnd;
   for (let index = providersLine + 1; index < blockEnd; index += 1) {
     if (nonBlank(lines[index]) && indentOf(lines[index]) <= 2) { providersBlockEnd = index; break; }
@@ -74,10 +121,235 @@ function parseProviderMap(source) {
       if (nonBlank(next) && indentOf(next) <= providerIndent) break;
       end += 1;
     }
-    entries.push({ id: match[1], start: index, end });
+    entries.push({ id: match[1], start: index, end, style: 'block', fieldIndent: 6 });
     index = end - 1;
   }
-  return { ok: true, lines, llmStart, blockEnd, providersLine, providersBlockEnd, entries };
+  return { ok: true, style: 'block', lines, llmStart, blockEnd, providersLine, providersBlockEnd, entries };
+}
+
+function splitFlowItems(source) {
+  const items = [];
+  let start = 0;
+  let braces = 0;
+  let brackets = 0;
+  let quote = null;
+  let escaped = false;
+  for (let index = 0; index < source.length; index += 1) {
+    const char = source[index];
+    if (quote) {
+      if (quote === '"' && escaped) { escaped = false; continue; }
+      if (quote === '"' && char === '\\') { escaped = true; continue; }
+      if (char === quote) quote = null;
+      continue;
+    }
+    if (char === '"' || char === "'") { quote = char; continue; }
+    if (char === '{') braces += 1;
+    else if (char === '}') braces -= 1;
+    else if (char === '[') brackets += 1;
+    else if (char === ']') brackets -= 1;
+    else if (char === ',' && braces === 0 && brackets === 0) {
+      items.push(source.slice(start, index).trim());
+      start = index + 1;
+    }
+    if (braces < 0 || brackets < 0) return null;
+  }
+  if (quote || braces !== 0 || brackets !== 0) return null;
+  const tail = source.slice(start).trim();
+  if (tail) items.push(tail);
+  return items;
+}
+
+function parseFlowObject(source, depth = 0) {
+  if (depth > 8) return null;
+  const input = source.trim().replace(/,\s*$/u, '');
+  if (!input.startsWith('{') || !input.endsWith('}')) return null;
+  const items = splitFlowItems(input.slice(1, -1));
+  if (!items) return null;
+  const fields = new Map();
+  for (const item of items) {
+    let splitAt = -1;
+    let quote = null;
+    let escaped = false;
+    for (let index = 0; index < item.length; index += 1) {
+      const char = item[index];
+      if (quote) {
+        if (quote === '"' && escaped) { escaped = false; continue; }
+        if (quote === '"' && char === '\\') { escaped = true; continue; }
+        if (char === quote) quote = null;
+      } else if (char === '"' || char === "'") quote = char;
+      else if (char === ':') { splitAt = index; break; }
+    }
+    if (splitAt < 1 || hasUnseparatedFlowMapping(item, splitAt)) return null;
+    const key = item.slice(0, splitAt).trim();
+    const value = item.slice(splitAt + 1).trim();
+    if (!/^[A-Za-z][A-Za-z0-9_-]*$/u.test(key) || !value || fields.has(key)) return null;
+    if (value.startsWith('{') && (!value.endsWith('}') || parseFlowObject(value, depth + 1) === null)) return null;
+    fields.set(key, value);
+  }
+  return fields;
+}
+
+function hasUnseparatedFlowMapping(item, firstColon) {
+  let braces = 0;
+  let brackets = 0;
+  let quote = null;
+  let escaped = false;
+  for (let index = firstColon + 1; index < item.length; index += 1) {
+    const char = item[index];
+    if (quote) {
+      if (quote === '"' && escaped) { escaped = false; continue; }
+      if (quote === '"' && char === '\\') { escaped = true; continue; }
+      if (char === quote) quote = null;
+      continue;
+    }
+    if (char === '"' || char === "'") { quote = char; continue; }
+    if (char === '{') braces += 1;
+    else if (char === '}') braces -= 1;
+    else if (char === '[') brackets += 1;
+    else if (char === ']') brackets -= 1;
+    else if (char === ':' && braces === 0 && brackets === 0 && /\s/u.test(item[index + 1] ?? '')) return true;
+    if (braces < 0 || brackets < 0) return true;
+  }
+  return quote !== null || braces !== 0 || brackets !== 0;
+}
+
+function validFlowEntryStructure(lines, entry) {
+  const fields = [];
+  let cursor = entry.objectOpen + 1;
+  while (cursor < entry.objectClose) {
+    cursor = nextContentLine(lines, cursor, entry.objectClose);
+    if (cursor < 0) break;
+    const line = lines[cursor];
+    if (indentOf(line) !== entry.fieldIndent) return false;
+    const field = line.match(/^\s+([A-Za-z][A-Za-z0-9_-]*):\s*(.*?)\s*$/u);
+    if (!field) return false;
+    let terminator = cursor;
+    if (!field[2]) {
+      const listOpen = nextContentLine(lines, cursor + 1, entry.objectClose);
+      if (listOpen < 0 || indentOf(lines[listOpen]) !== entry.fieldIndent + 2 || !/^\s*\[\s*$/u.test(lines[listOpen])) return false;
+      const items = [];
+      let listClose = -1;
+      for (let nested = listOpen + 1; nested < entry.objectClose; nested += 1) {
+        if (!nonBlank(lines[nested])) continue;
+        if (indentOf(lines[nested]) === entry.fieldIndent + 2 && /^\s*\]\s*,?\s*$/u.test(lines[nested])) {
+          listClose = nested;
+          break;
+        }
+        if (indentOf(lines[nested]) !== entry.fieldIndent + 4 || !parseFlowObject(lines[nested])) return false;
+        items.push(nested);
+      }
+      if (listClose < 0) return false;
+      for (let index = 0; index < items.length - 1; index += 1) if (!/,\s*$/u.test(lines[items[index]])) return false;
+      terminator = listClose;
+      cursor = listClose + 1;
+    } else {
+      cursor += 1;
+    }
+    fields.push({ terminator });
+  }
+  for (let index = 0; index < fields.length - 1; index += 1) {
+    if (!/,\s*$/u.test(lines[fields[index].terminator])) return false;
+  }
+  return true;
+}
+
+function parseFlowModel(source) {
+  const fields = parseFlowObject(source);
+  if (!fields) return null;
+  const allowed = new Set(['id', 'name', 'contextWindow', 'maxTokens', 'input', 'reasoningEfforts', 'compat']);
+  if ([...fields.keys()].some((key) => !allowed.has(key))) return null;
+  const id = unquoteScalar(fields.get('id'));
+  if (!id || id.length > 256 || /[\r\n]/u.test(id)) return null;
+  const model = { id };
+  if (fields.has('name')) {
+    const name = unquoteScalar(fields.get('name'));
+    if (!name || name.length > 256 || /[\r\n]/u.test(name)) return null;
+    model.name = name;
+  }
+  for (const [sourceKey, targetKey] of [['contextWindow', 'context_window'], ['maxTokens', 'max_tokens']]) {
+    if (!fields.has(sourceKey)) continue;
+    const value = Number(unquoteScalar(fields.get(sourceKey)));
+    if (!Number.isSafeInteger(value) || value <= 0) return null;
+    model[targetKey] = value;
+  }
+  if (fields.has('input')) {
+    const input = fields.get('input').trim();
+    if (!input.startsWith('[') || !input.endsWith(']')) return null;
+    const modalities = splitFlowItems(input.slice(1, -1));
+    if (!modalities) return null;
+    const normalized = modalities.map(unquoteScalar);
+    if (normalized.some((value) => !['text', 'image'].includes(value))) return null;
+    model.input = [...new Set(normalized)];
+  }
+  if (fields.has('reasoningEfforts')) {
+    const efforts = parseFlowObject(fields.get('reasoningEfforts'));
+    if (!efforts) return null;
+    const normalized = {};
+    for (const [key, raw] of efforts) {
+      const value = unquoteScalar(raw);
+      if (raw === 'null' || raw === '~') normalized[key] = null;
+      else if (!value || value.length > 256 || /[\r\n]/u.test(value)) return null;
+      else normalized[key] = value;
+    }
+    model.reasoning_efforts = normalized;
+  }
+  if (fields.has('compat')) {
+    if (fields.get('compat').trim() !== '{}') return null;
+    model.compat = {};
+  }
+  return model;
+}
+
+function readFlowMaterialization(parsed, entry, file) {
+  const directFields = new Set();
+  for (const line of parsed.lines.slice(entry.objectOpen + 1, entry.objectClose)) {
+    if (!nonBlank(line) || indentOf(line) !== entry.fieldIndent) continue;
+    const match = line.match(/^\s+([A-Za-z][A-Za-z0-9_-]*):/u);
+    if (!match || directFields.has(match[1])) return { ok: false, code: 'PROVIDER_MATERIALIZATION_UNSUPPORTED_FIELDS' };
+    directFields.add(match[1]);
+  }
+  const allowed = new Set(['displayName', 'apiKeyEnv', 'api', 'baseURL', 'models']);
+  if ([...directFields].some((field) => !allowed.has(field))) return { ok: false, code: 'PROVIDER_MATERIALIZATION_UNSUPPORTED_FIELDS' };
+  const rawDisplayName = scalarField(parsed.lines, entry, 'displayName');
+  const displayName = rawDisplayName && rawDisplayName.length <= 256 && !/[\r\n]/u.test(rawDisplayName) ? rawDisplayName : entry.id;
+  const rawCredentialRef = scalarField(parsed.lines, entry, 'apiKeyEnv');
+  const credential = classifyCredentialReference(rawCredentialRef, { kind: 'env' });
+  if (credential.redacted) return { ok: false, code: 'PROVIDER_CREDENTIAL_REFERENCE_UNSAFE' };
+  const api = scalarField(parsed.lines, entry, 'api');
+  if (api && (!/^[A-Za-z][A-Za-z0-9._-]{0,127}$/u.test(api) || /^(?:sk|pk|rk|token|secret)[_-]/iu.test(api))) return { ok: false, code: 'PROVIDER_API_SCHEMA_UNSUPPORTED' };
+  const rawBaseUrl = scalarField(parsed.lines, entry, 'baseURL');
+  const baseUrl = rawBaseUrl && rawBaseUrl.length <= 2048 && !/[\r\n]/u.test(rawBaseUrl) ? rawBaseUrl : null;
+  if (baseUrl) {
+    try {
+      const url = new URL(baseUrl);
+      if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash || !url.hostname) return { ok: false, code: 'PROVIDER_BASE_URL_UNSAFE' };
+    } catch { return { ok: false, code: 'PROVIDER_BASE_URL_UNSAFE' }; }
+  }
+  const models = [];
+  if (directFields.has('models')) {
+    const modelsLine = parsed.lines.findIndex((line, index) => index > entry.objectOpen && index < entry.objectClose && /^ {10}models:\s*$/u.test(line));
+    const listOpen = nextContentLine(parsed.lines, modelsLine + 1, entry.objectClose);
+    if (modelsLine < 0 || listOpen < 0 || !/^ {12}\[\s*$/u.test(parsed.lines[listOpen])) return { ok: false, code: 'PROVIDER_MODEL_SCHEMA_UNSUPPORTED' };
+    let listClose = -1;
+    for (let index = listOpen + 1; index < entry.objectClose; index += 1) {
+      if (/^ {12}\]\s*,?\s*$/u.test(parsed.lines[index])) { listClose = index; break; }
+      if (!nonBlank(parsed.lines[index])) continue;
+      if (indentOf(parsed.lines[index]) !== 14) return { ok: false, code: 'PROVIDER_MODEL_SCHEMA_UNSUPPORTED' };
+      const model = parseFlowModel(parsed.lines[index]);
+      if (!model || models.some((candidate) => candidate.id === model.id)) return { ok: false, code: 'PROVIDER_MODEL_SCHEMA_UNSUPPORTED' };
+      models.push(model);
+    }
+    if (listClose < 0) return { ok: false, code: 'PROVIDER_MODEL_SCHEMA_UNSUPPORTED' };
+  }
+  return {
+    ok: true,
+    provider: {
+      id: entry.id, display_name: displayName,
+      ...(credential.value ? { credential_ref: credential.value } : {}),
+      ...(api ? { api } : {}), ...(baseUrl ? { base_url: baseUrl } : {}),
+      models: models.slice(0, 256), source_file: file,
+    },
+  };
 }
 
 const SENSITIVE_CREDENTIAL_FIELD = /(?:api[_-]?key|access[_-]?token|refresh[_-]?token|(?:^|[_-])token(?:$|[_-])|secret|password|authorization|credential|private[_-]?key|client[_-]?secret|cookie|bearer|webhook)/iu;
@@ -142,6 +414,7 @@ export function readProviderSettingsMaterialization(source, { providerId, file =
   if (!parsed.ok) return { ok: false, code: parsed.code };
   const entry = parsed.entries.find((candidate) => candidate.id === providerId);
   if (!entry) return { ok: false, code: 'PROVIDER_NOT_FOUND' };
+  if (parsed.style === 'flow') return readFlowMaterialization(parsed, entry, file);
   const block = parsed.lines.slice(entry.start, entry.end).map((line) => `  ${line}`);
   const synthetic = ['- id: llm-pi-ai', '  config:', '    providers:', ...block, ''].join('\n');
   const result = readProviderMaterialization(synthetic, { providerId, file });
@@ -159,6 +432,47 @@ function yamlScalar(value, max = 2048) {
   return JSON.stringify(value.trim());
 }
 
+function flowModelLine(model) {
+  const fields = [`id: ${yamlScalar(model.id, 256)}`];
+  const name = yamlScalar(model.name, 256);
+  if (name) fields.push(`name: ${name}`);
+  if (Number.isSafeInteger(model.context_window) && model.context_window > 0) fields.push(`contextWindow: ${model.context_window}`);
+  if (Number.isSafeInteger(model.max_tokens) && model.max_tokens > 0) fields.push(`maxTokens: ${model.max_tokens}`);
+  if (Array.isArray(model.input) && model.input.every((value) => value === 'text' || value === 'image')) fields.push(`input: [${[...new Set(model.input)].join(', ')}]`);
+  if (model.reasoning_efforts && typeof model.reasoning_efforts === 'object' && !Array.isArray(model.reasoning_efforts)) {
+    const efforts = [];
+    for (const [key, value] of Object.entries(model.reasoning_efforts)) {
+      if (/^[A-Za-z][A-Za-z0-9_-]*$/u.test(key) && (value === null || yamlScalar(value, 256))) efforts.push(`${key}: ${value === null ? 'null' : yamlScalar(value, 256)}`);
+    }
+    if (efforts.length > 0) fields.push(`reasoningEfforts: { ${efforts.join(', ')} }`);
+  }
+  if (model.compat && typeof model.compat === 'object' && !Array.isArray(model.compat) && Object.keys(model.compat).length === 0) fields.push('compat: {}');
+  return `{ ${fields.join(', ')} }`;
+}
+
+function flowProviderLines(provider) {
+  const displayName = yamlScalar(provider.display_name ?? provider.id, 256);
+  if (!displayName) return null;
+  const credential = provider.credential_ref ? classifyCredentialReference(provider.credential_ref, { kind: 'env' }).value : null;
+  if (provider.credential_ref && !credential) return null;
+  const api = yamlScalar(provider.api, 128);
+  const baseUrl = yamlScalar(provider.base_url, 2048);
+  const models = Array.isArray(provider.models)
+    ? provider.models.filter((model) => model && typeof model.id === 'string' && yamlScalar(model.id, 256)).slice(0, 256)
+    : [];
+  const fields = [`          displayName: ${displayName}`];
+  if (api) fields.push(`          api: ${api}`);
+  if (baseUrl) fields.push(`          baseURL: ${baseUrl}`);
+  if (credential) fields.push(`          apiKeyEnv: ${yamlScalar(credential, 256)}`);
+  if (models.length === 0) {
+    return [`      ${provider.id}:`, '        {', ...fields.map((line, index) => `${line}${index < fields.length - 1 ? ',' : ''}`), '        }'];
+  }
+  const lines = [`      ${provider.id}:`, '        {', ...fields.map((line) => `${line},`), '          models:', '            ['];
+  for (let index = 0; index < models.length; index += 1) lines.push(`              ${flowModelLine(models[index])}${index < models.length - 1 ? ',' : ''}`);
+  lines.push('            ]', '        }');
+  return lines;
+}
+
 /**
  * Add one already-sanitized provider projection to the Harness user layer.
  * The operation is pure and revision-bound; callers perform the atomic write.
@@ -172,6 +486,17 @@ export function addProviderSettings(source, { provider, expectedRevision } = {})
   const parsed = parseProviderMap(source);
   if (!parsed.ok) return { ok: false, code: parsed.code, revision: currentRevision };
   if (parsed.entries.some((entry) => entry.id === provider.id)) return { ok: false, code: 'PROVIDER_SETTINGS_PROVIDER_EXISTS', revision: currentRevision };
+  if (parsed.style === 'flow') {
+    const providerLines = flowProviderLines(provider);
+    if (!providerLines) return { ok: false, code: 'PROVIDER_MATERIALIZATION_INVALID', revision: currentRevision };
+    const nextLines = [...parsed.lines];
+    const previous = parsed.entries.at(-1);
+    if (previous && !/,\s*$/u.test(nextLines[previous.objectClose])) nextLines[previous.objectClose] = `${nextLines[previous.objectClose]},`;
+    nextLines.splice(parsed.flowCloseLine, 0, ...providerLines);
+    const newline = source.includes('\r\n') ? '\r\n' : '\n';
+    const text = nextLines.join(newline);
+    return { ok: true, text, added: provider.id, revision: sha256(text) };
+  }
   const displayName = yamlScalar(provider.display_name ?? provider.id, 256);
   if (!displayName) return { ok: false, code: 'PROVIDER_MATERIALIZATION_INVALID', revision: currentRevision };
   const lines = [`    ${provider.id}:`, `      displayName: ${displayName}`];
@@ -256,6 +581,23 @@ export function mutateProviderSettings(source, {
   }
   const ranges = providerEntry ? [[providerEntry.start, providerEntry.end]] : [];
   const finalProvider = providerEntry && parsed.entries.length === 1;
+  if (removeProvider && parsed.style === 'flow' && finalProvider) {
+    const lines = [...parsed.lines];
+    lines.splice(parsed.providersLine, parsed.flowCloseLine - parsed.providersLine + 1, '  providers: {}');
+    if (defaultParsed) {
+      const removedBeforeProvider = parsed.providersLine <= defaultParsed.providerLine ? parsed.flowCloseLine - parsed.providersLine : 0;
+      const removedBeforeModel = parsed.providersLine <= defaultParsed.modelLine ? parsed.flowCloseLine - parsed.providersLine : 0;
+      lines[defaultParsed.providerLine - removedBeforeProvider] = `  provider: ${replacementDefault.trim()}`;
+      lines[defaultParsed.modelLine - removedBeforeModel] = `  model: ${replacementModel.trim()}`;
+    }
+    const newline = source.includes('\r\n') ? '\r\n' : '\n';
+    const text = lines.join(newline);
+    return {
+      ok: true, text, removed: [providerId], remaining: [],
+      ...(defaultParsed ? { previous_default: { provider: defaultParsed.provider, model: defaultParsed.model } } : {}),
+      revision: sha256(text),
+    };
+  }
   const nextLines = parsed.lines.map((line, index) => {
     if (ranges.some(([start, end]) => index >= start && index < end)) return null;
     if (finalProvider && index === parsed.providersLine) return '  providers: {}';

package/src/readiness-matrix.mjs

@@ -13,11 +13,11 @@ export const READINESS_REASON_CODES = Object.freeze({
   HUB_INCOMPATIBLE: 'HUB_INCOMPATIBLE',
   PROVIDER_CATALOG_RESOLVED: 'PROVIDER_CATALOG_RESOLVED',
   PROVIDER_CATALOG_UNAVAILABLE: 'PROVIDER_CATALOG_UNAVAILABLE',
-  PROVIDER_CATALOG_HEALTH_WARNING: 'PROVIDER_CATALOG_HEALTH_WARNING',
-  PROVIDER_CATALOG_NOT_REQUIRED: 'PROVIDER_CATALOG_NOT_REQUIRED',
-  PROVIDER_LIFECYCLE_CONSISTENT: 'PROVIDER_LIFECYCLE_CONSISTENT',
-  PROVIDER_LIFECYCLE_INCONSISTENT: 'PROVIDER_LIFECYCLE_INCONSISTENT',
-  PROVIDER_INVENTORY_UNAVAILABLE: 'PROVIDER_INVENTORY_UNAVAILABLE',
+  PROVIDER_CATALOG_HEALTH_WARNING: 'PROVIDER_CATALOG_HEALTH_WARNING',
+  PROVIDER_CATALOG_NOT_REQUIRED: 'PROVIDER_CATALOG_NOT_REQUIRED',
+  PROVIDER_LIFECYCLE_CONSISTENT: 'PROVIDER_LIFECYCLE_CONSISTENT',
+  PROVIDER_LIFECYCLE_INCONSISTENT: 'PROVIDER_LIFECYCLE_INCONSISTENT',
+  PROVIDER_INVENTORY_UNAVAILABLE: 'PROVIDER_INVENTORY_UNAVAILABLE',
   PROVIDER_MODE_UNKNOWN: 'PROVIDER_MODE_UNKNOWN',
   NO_CI_EVIDENCE: 'NO_CI_EVIDENCE',
   NO_EXECUTION_EVIDENCE: 'NO_EXECUTION_EVIDENCE',
@@ -29,16 +29,18 @@ const TARGET_ROWS = Object.freeze([
   ['linux_deterministic', 'ci'],
   ['windows_regressions', 'ci'],
   ['macos_smoke', 'ci'],
-  ['hub_compatibility', 'live-runtime'],
-  ['provider_catalog', 'live-runtime'],
-  ['model_execution', 'real-execution'],
-  ['worker_primary_callable', 'real-execution'],
-  ['worker_escalation_callable', 'real-execution'],
-  ['reviewer_primary_callable', 'real-execution'],
-  ['provider_lifecycle_consistent', 'live-runtime'],
-  ['deepseek_flash', 'real-execution'],
-  ['deepseek_pro', 'real-execution'],
-  ['reviewer_pipeline', 'real-execution'],
+  ['hub_compatibility', 'live-runtime'],
+  ['provider_catalog', 'live-runtime'],
+  ['provider_health', 'live-runtime'],
+  ['reviewer_health', 'live-runtime'],
+  ['model_execution', 'real-execution'],
+  ['worker_primary_callable', 'real-execution'],
+  ['worker_escalation_callable', 'real-execution'],
+  ['reviewer_primary_callable', 'real-execution'],
+  ['provider_lifecycle_consistent', 'live-runtime'],
+  ['deepseek_flash', 'real-execution'],
+  ['deepseek_pro', 'real-execution'],
+  ['reviewer_pipeline', 'real-execution'],
   ['cancellation_timeout_escalation', 'real-execution'],
   ['standalone_official', 'real-execution'],
 ]);
@@ -71,6 +73,9 @@ function normalizeEvidence(row, evidence) {
     ...(typeof evidence.evidence_ref === 'string' && evidence.evidence_ref.trim()
       ? { evidence_ref: evidence.evidence_ref.trim() }
       : {}),
+    ...(typeof evidence.detail_code === 'string' && /^[A-Z][A-Z0-9_]{0,127}$/u.test(evidence.detail_code)
+      ? { detail_code: evidence.detail_code }
+      : {}),
   };
 }
 

package/src/runtime-identity-contract.mjs

@@ -0,0 +1,34 @@
+// Browser-safe runtime identity primitives shared by the Hub, extension
+// contract and client.  Do not coerce missing values: an incomplete identity
+// is never evidence of the native 3210 Crew runtime.
+
+export const PRODUCTION_EXECUTION_PLANE = 'hub-3210';
+export const PRODUCTION_PROFILE = 'dsh-crew';
+export const PRODUCTION_LISTEN_PORT = 3210;
+
+function nonEmpty(value) {
+  return typeof value === 'string' && value.trim().length > 0;
+}
+
+export function isCompleteRuntimeIdentity(identity) {
+  return Boolean(identity && typeof identity === 'object'
+    && nonEmpty(identity.execution_plane)
+    && nonEmpty(identity.profile)
+    && Number.isInteger(identity.listen_port) && identity.listen_port > 0
+    && nonEmpty(identity.runtime_id));
+}
+
+export function sameCompleteRuntimeIdentity(left, right) {
+  return isCompleteRuntimeIdentity(left) && isCompleteRuntimeIdentity(right)
+    && left.execution_plane === right.execution_plane
+    && left.profile === right.profile
+    && left.listen_port === right.listen_port
+    && left.runtime_id === right.runtime_id;
+}
+
+export function isExactNativeCrewIdentity(identity) {
+  return isCompleteRuntimeIdentity(identity)
+    && identity.execution_plane === PRODUCTION_EXECUTION_PLANE
+    && identity.profile === PRODUCTION_PROFILE
+    && identity.listen_port === PRODUCTION_LISTEN_PORT;
+}

package/src/runtime-identity.mjs

@@ -17,16 +17,26 @@ import { randomUUID } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
+import {
+  PRODUCTION_EXECUTION_PLANE,
+  PRODUCTION_PROFILE,
+  PRODUCTION_LISTEN_PORT,
+} from './runtime-identity-contract.mjs';
+export {
+  PRODUCTION_EXECUTION_PLANE,
+  PRODUCTION_PROFILE,
+  PRODUCTION_LISTEN_PORT,
+  isCompleteRuntimeIdentity,
+  sameCompleteRuntimeIdentity,
+  isExactNativeCrewIdentity,
+} from './runtime-identity-contract.mjs';
 
 // Production Crew execution is intentionally bound to the isolated 3210 Hub.
 // These fields are public provenance only; no credential or session secret is
 // included in the identity contract.
-export const PRODUCTION_EXECUTION_PLANE = 'hub-3210';
-export const PRODUCTION_PROFILE = 'dsh-crew';
-export const PRODUCTION_LISTEN_PORT = 3210;
 const RUNTIME_ID = randomUUID();
 
-export const RUNTIME_VERSION = '1.1.0';
+export const RUNTIME_VERSION = '1.2.0-rc.4';
 export const HUB_PROTOCOL_VERSION = 1;
 
 export const HUB_CAPABILITIES = Object.freeze([