@snaptrude/plugin-core 0.0.0-bimsvg-20260928124803

package/src/errors/codes.ts

@@ -0,0 +1,136 @@
+/**
+ * The closed error-code registry — the single source of truth for every error
+ * that crosses the plugin wire (host → worker) or is minted client-side.
+ *
+ * APPEND-ONLY: codes are a published contract; never rename or remove one.
+ * Handle-resolution failures deliberately collapse to ONE code
+ * (`HANDLE_INVALID`) so error responses cannot be used as an existence /
+ * ownership oracle (PLUGIN_HANDLE_MIGRATION_HLD §6). `HANDLE_KIND_MISMATCH`
+ * stays distinct because the kind is information the caller already holds.
+ */
+export const PLUGIN_ERROR_CODES = [
+  "VALIDATION",
+  "INVALID_RPC_FORMAT",
+  "METHOD_NOT_FOUND",
+  "METHOD_NOT_PERMITTED",
+  "HANDLE_INVALID",
+  "HANDLE_KIND_MISMATCH",
+  "RESOURCE_QUOTA_EXCEEDED",
+  "RATE_LIMITED",
+  "PRECONDITION_FAILED",
+  "OPERATION_FAILED",
+  "TIMEOUT",
+  "CALL_TIMEOUT",
+  "TRANSPORT_LOST",
+  "PLUGIN_NOT_READY",
+  "PLUGIN_TERMINATED",
+  "RESULT_NOT_SERIALIZABLE",
+  "RESULT_TOO_LARGE",
+  "BATCH_PARTIAL",
+  "STORY_UPDATE_FAILED",
+  "STORY_HEIGHT_REJECTED",
+  "NO_ACTIVE_STRUCTURE",
+  "NO_ELIGIBLE_ELEMENTS",
+  "PROPOSAL_SWITCH_BLOCKED",
+  "INTERNAL",
+  "UNKNOWN",
+] as const
+
+export type PluginErrorCode = (typeof PLUGIN_ERROR_CODES)[number]
+
+/**
+ * A known code, or a string outside the union — a plugin built against an
+ * older SDK may receive codes a newer host appended. Keeps autocomplete for
+ * known codes while staying open on the wire (forward compatibility).
+ */
+export type WirePluginErrorCode = PluginErrorCode | (string & {})
+
+export type PluginErrorCategory =
+  | "validation"
+  | "not_found"
+  | "permission"
+  | "handle"
+  | "quota"
+  | "timeout"
+  | "transport"
+  | "lifecycle"
+  | "execution"
+  | "internal"
+
+/**
+ * Client-side metadata for a code. NOT carried on the wire — every field is a
+ * pure function of the code, and this table ships inside plugin-core, so both
+ * endpoints derive it locally.
+ */
+export interface CodeMeta {
+  /** Family of the code; picks the `PluginError` sugar subclass. */
+  category: PluginErrorCategory
+  /** Fallback `hint` when the throw site provides none. */
+  hintTemplate?: string
+}
+
+export const CODE_META: Record<PluginErrorCode, CodeMeta> = {
+  VALIDATION: {
+    category: "validation",
+    hintTemplate: "Check details.issues for the failing argument.",
+  },
+  INVALID_RPC_FORMAT: { category: "validation" },
+  METHOD_NOT_FOUND: {
+    category: "not_found",
+    hintTemplate: "Check details.didYouMean for a close match.",
+  },
+  METHOD_NOT_PERMITTED: { category: "permission" },
+  HANDLE_INVALID: {
+    category: "handle",
+    hintTemplate: "Re-query the entity; do not cache handles across undo/reload.",
+  },
+  HANDLE_KIND_MISMATCH: { category: "handle" },
+  RESOURCE_QUOTA_EXCEEDED: {
+    category: "quota",
+    hintTemplate: "Release unused handles (core.handles.release) or use scopes.",
+  },
+  RATE_LIMITED: {
+    category: "quota",
+    hintTemplate: "Wait details.retryAfterMs before retrying.",
+  },
+  PRECONDITION_FAILED: { category: "execution" },
+  OPERATION_FAILED: { category: "execution" },
+  TIMEOUT: { category: "timeout" },
+  CALL_TIMEOUT: { category: "timeout" },
+  TRANSPORT_LOST: { category: "transport" },
+  PLUGIN_NOT_READY: { category: "lifecycle" },
+  PLUGIN_TERMINATED: { category: "lifecycle" },
+  RESULT_NOT_SERIALIZABLE: { category: "execution" },
+  RESULT_TOO_LARGE: { category: "execution" },
+  BATCH_PARTIAL: { category: "execution" },
+  STORY_UPDATE_FAILED: {
+    category: "execution",
+    hintTemplate: "The storey update could not be applied; re-read the storey and retry.",
+  },
+  STORY_HEIGHT_REJECTED: {
+    category: "execution",
+    hintTemplate: "The requested height was out of range; pick a value within the storey's limits.",
+  },
+  NO_ACTIVE_STRUCTURE: {
+    category: "execution",
+    hintTemplate: "Activate a structure before running this operation.",
+  },
+  NO_ELIGIBLE_ELEMENTS: {
+    category: "execution",
+    hintTemplate: "The storey has no elements eligible for this operation.",
+  },
+  PROPOSAL_SWITCH_BLOCKED: {
+    category: "execution",
+    hintTemplate: "Wait for the in-canvas agent run to finish, then retry.",
+  },
+  INTERNAL: {
+    category: "internal",
+    hintTemplate: "Host-side fault. Report with errorId.",
+  },
+  UNKNOWN: { category: "internal" },
+}
+
+/** Narrow an arbitrary string to a member of the closed code union. */
+export function isPluginErrorCode(value: string): value is PluginErrorCode {
+  return (PLUGIN_ERROR_CODES as readonly string[]).includes(value)
+}

package/src/errors/envelope.ts

@@ -0,0 +1,75 @@
+import type { WirePluginErrorCode } from "./codes"
+
+/**
+ * Structured error payload carried on the `{success: false}` branch of the RPC
+ * wire result, next to the legacy `error: string` field (additive — old
+ * clients ignore it, old hosts never set it).
+ *
+ * Errors cross the worker boundary as THIS plain object, never as a thrown
+ * class: Comlink's throw transfer strips subclasses and custom fields and
+ * leaks host stacks. plugin-client reconstructs a typed `PluginError` from it
+ * (`fromEnvelope`).
+ */
+export const ERROR_ENVELOPE_VERSION = 1 as const
+
+export interface ErrorEnvelope {
+  envelopeVersion: typeof ERROR_ENVELOPE_VERSION
+  code: WirePluginErrorCode
+  /**
+   * Human-readable failure description. For INTERNAL/UNKNOWN this is a GENERIC
+   * message — the real message and stack stay host-side, logged under
+   * `errorId` (the worker is untrusted; internals must not leak).
+   */
+  message: string
+  /**
+   * Per-occurrence id. For INTERNAL the host logs the real message and stack
+   * under this id (the sanitized message would otherwise be an undebuggable
+   * dead end). Other codes carry the id only to identify the occurrence in
+   * bug reports — the host does not log them. Client-minted ids carry a `c-`
+   * prefix.
+   */
+  errorId: string
+  /** Structured, JSON-safe, code-specific data (issues / retryAfterMs / didYouMean / handles…). */
+  details?: Record<string, unknown>
+  /**
+   * Wire id of the single primary offending handle, when the failure is
+   * handle-scoped. Multiple offenders go in `details.handles: string[]`.
+   * May echo ONLY ids the caller itself supplied (anti-oracle rule).
+   */
+  handle?: string
+  /** Dotted method path of the failed call (e.g. "design.boolean.union"). */
+  methodPath?: string
+  /** Machine-actionable fix suggestion (written for LLM plugin authors). */
+  hint?: string
+}
+
+/**
+ * Structural guard for a wire value claiming to be an `ErrorEnvelope`.
+ *
+ * Checks shape only — deliberately does NOT reject codes outside the known
+ * union, so envelopes from a newer host still pass (forward compatibility).
+ */
+export function isErrorEnvelope(value: unknown): value is ErrorEnvelope {
+  if (typeof value !== "object" || value === null) return false
+  const record = value as Record<string, unknown>
+  return (
+    record.envelopeVersion === ERROR_ENVELOPE_VERSION &&
+    typeof record.code === "string" &&
+    typeof record.message === "string" &&
+    typeof record.errorId === "string"
+  )
+}
+
+let idCounter = 0
+
+/**
+ * Mint a per-occurrence error id. Uses `crypto.randomUUID` when available
+ * (browser main thread and workers both have it); falls back to a
+ * counter+random suffix — uniqueness within a session is all that is needed.
+ */
+export function newErrorId(prefix = ""): string {
+  const cryptoApi = (globalThis as { crypto?: { randomUUID?: () => string } }).crypto
+  if (cryptoApi?.randomUUID) return `${prefix}${cryptoApi.randomUUID()}`
+  idCounter += 1
+  return `${prefix}${Date.now().toString(36)}-${idCounter}-${Math.random().toString(36).slice(2, 10)}`
+}

package/src/errors/index.ts

@@ -0,0 +1,21 @@
+export { PLUGIN_ERROR_CODES, CODE_META, isPluginErrorCode } from "./codes"
+export type { PluginErrorCode, WirePluginErrorCode, PluginErrorCategory, CodeMeta } from "./codes"
+
+export { ERROR_ENVELOPE_VERSION, isErrorEnvelope, newErrorId } from "./envelope"
+export type { ErrorEnvelope } from "./envelope"
+
+export {
+  PluginError,
+  PluginValidationError,
+  PluginNotFoundError,
+  PluginPermissionError,
+  PluginHandleError,
+  PluginQuotaError,
+  PluginTimeoutError,
+  PluginTransportError,
+  PluginLifecycleError,
+  PluginExecutionError,
+  PluginInternalError,
+  fromEnvelope,
+  makeClientEnvelope,
+} from "./plugin-error"

package/src/errors/plugin-error.ts

@@ -0,0 +1,134 @@
+import { CODE_META, isPluginErrorCode } from "./codes"
+import type { PluginErrorCategory, PluginErrorCode, WirePluginErrorCode } from "./codes"
+import { ERROR_ENVELOPE_VERSION, newErrorId } from "./envelope"
+import type { ErrorEnvelope } from "./envelope"
+
+/**
+ * Cross-copy brand: a plugin bundle may contain its OWN copy of this module,
+ * in which case `instanceof` fails across the two class identities.
+ * `Symbol.for` resolves to the same symbol in every copy within a realm, so
+ * `PluginError.is()` keeps working. Canonical check = `.is()` + `code`.
+ */
+const BRAND = Symbol.for("snaptrude.pluginError")
+
+interface Branded {
+  [BRAND]?: boolean
+}
+
+/**
+ * Typed error every failed plugin API call rejects with.
+ *
+ * Rehydrated client-side from the wire `ErrorEnvelope` (`fromEnvelope`) — the
+ * class itself never crosses the worker boundary. Branch on the stable string
+ * `code`; use `PluginError.is()` rather than `instanceof` (a bundled duplicate
+ * SDK copy breaks `instanceof`, never the brand).
+ *
+ * @example
+ * ```ts
+ * try {
+ *   await snaptrude.design.boolean.union(handles)
+ * } catch (e) {
+ *   if (PluginError.is(e) && e.code === "RATE_LIMITED") {
+ *     await sleep(e.details?.retryAfterMs as number)
+ *   } else {
+ *     throw e
+ *   }
+ * }
+ * ```
+ */
+export class PluginError extends Error {
+  readonly code: WirePluginErrorCode
+  readonly errorId: string
+  readonly details?: Record<string, unknown>
+  readonly handle?: string
+  readonly methodPath?: string
+  readonly hint?: string
+
+  constructor(envelope: ErrorEnvelope) {
+    super(envelope.message)
+    this.name = new.target.name
+    this.code = envelope.code
+    this.errorId = envelope.errorId
+    this.details = envelope.details
+    this.handle = envelope.handle
+    this.methodPath = envelope.methodPath
+    this.hint = envelope.hint ?? hintFor(envelope.code)
+    ;(this as Branded)[BRAND] = true
+  }
+
+  /** Canonical check — survives bundled duplicate SDK copies where `instanceof` fails. */
+  static is(value: unknown): value is PluginError {
+    return (
+      typeof value === "object" &&
+      value !== null &&
+      (value as Branded)[BRAND] === true
+    )
+  }
+
+  /** Derived (not wire-carried) family of the code; unknown codes map to "internal". */
+  get category(): PluginErrorCategory {
+    return isPluginErrorCode(this.code) ? CODE_META[this.code].category : "internal"
+  }
+}
+
+// Category sugar — same brand, so `PluginError.is()` matches all of them.
+// Convenience for single-SDK-copy plugins; docs teach `.is()` + `code`.
+export class PluginValidationError extends PluginError {}
+export class PluginNotFoundError extends PluginError {}
+export class PluginPermissionError extends PluginError {}
+export class PluginHandleError extends PluginError {}
+export class PluginQuotaError extends PluginError {}
+export class PluginTimeoutError extends PluginError {}
+export class PluginTransportError extends PluginError {}
+export class PluginLifecycleError extends PluginError {}
+export class PluginExecutionError extends PluginError {}
+export class PluginInternalError extends PluginError {}
+
+type PluginErrorConstructor = new (envelope: ErrorEnvelope) => PluginError
+
+const CATEGORY_CLASS: Record<PluginErrorCategory, PluginErrorConstructor> = {
+  validation: PluginValidationError,
+  not_found: PluginNotFoundError,
+  permission: PluginPermissionError,
+  handle: PluginHandleError,
+  quota: PluginQuotaError,
+  timeout: PluginTimeoutError,
+  transport: PluginTransportError,
+  lifecycle: PluginLifecycleError,
+  execution: PluginExecutionError,
+  internal: PluginInternalError,
+}
+
+function hintFor(code: WirePluginErrorCode): string | undefined {
+  return isPluginErrorCode(code) ? CODE_META[code].hintTemplate : undefined
+}
+
+/**
+ * Rehydrate a wire envelope into the typed error the plugin catches.
+ * A code outside the known union (newer host) constructs the base
+ * `PluginError` with the code preserved verbatim.
+ */
+export function fromEnvelope(envelope: ErrorEnvelope): PluginError {
+  if (!isPluginErrorCode(envelope.code)) return new PluginError(envelope)
+  const ErrorClass = CATEGORY_CLASS[CODE_META[envelope.code].category]
+  return new ErrorClass(envelope)
+}
+
+/**
+ * Build an envelope for a CLIENT-detected failure (transport rejection,
+ * legacy host without `errorInfo`). Host-originated envelopes are built by
+ * the host's `toErrorEnvelope` mapper, never by this.
+ */
+export function makeClientEnvelope(
+  code: PluginErrorCode,
+  message: string,
+  extra?: Partial<Pick<ErrorEnvelope, "details" | "handle" | "methodPath" | "hint">>
+): ErrorEnvelope {
+  return {
+    envelopeVersion: ERROR_ENVELOPE_VERSION,
+    code,
+    message,
+    errorId: newErrorId("c-"),
+    ...extra,
+  }
+}

package/src/handles.ts

@@ -0,0 +1,282 @@
+import * as z from "zod"
+import type { ArenaKind } from "./api/core/handles"
+
+// Runtime polyfill: engines without explicit-resource-management would otherwise
+// evaluate the class's computed [Symbol.asyncDispose] key as undefined and
+// silently create a property literally named "undefined".
+;(Symbol as { asyncDispose?: symbol }).asyncDispose ??= Symbol.for("Symbol.asyncDispose")
+
+/**
+ * An opaque, kind-tagged reference to a host-side object that crosses the RPC
+ * boundary by IDENTITY rather than by value. See `PLUGIN_API_EXPOSURE_HLD.md` §9.
+ *
+ * A handle is a small CLASS instance wrapping the wire id. The phantom
+ * `__handle` brand makes a `Handle<"profile">` incompatible with a
+ * `Handle<"vec3">` at compile time. On the wire the id string is all that
+ * travels: the client SDK unwraps `Handle` arguments to `.id` before the RPC
+ * call, and the host tags returned handles as `{ __h: "<id>" }` (via
+ * {@linkcode Handle.toJSON}) for the client to re-wrap.
+ *
+ * Plugin-side lifecycle: the client SDK interns one live instance per id and
+ * registers it with a FinalizationRegistry — dropping every reference to a
+ * handle eventually releases its host registry entry. Deterministic release is
+ * still preferred: `core.handles.release/releaseAll` or scopes.
+ *
+ * Crossing non-RPC boundaries (UI postMessage, persistence, logging):
+ * send {@linkcode Handle.id} — structured clone strips the class prototype.
+ */
+export class Handle<K extends string> {
+  /** Phantom brand — keeps `Handle<"vec3">` ≠ `Handle<"mass">` at compile time. */
+  declare readonly __handle: K
+
+  constructor(readonly id: string) {}
+
+  /** Wire tag — the host's result serialization (JSON round-trip) calls this. */
+  toJSON(): { __h: string } {
+    return { __h: this.id }
+  }
+
+  /** Template-string / logging form stays the bare id. */
+  toString(): string {
+    return this.id
+  }
+
+  /** Identity comparison by id — safe across re-wraps. */
+  equals(other: Handle<string>): boolean {
+    return this.id === other.id
+  }
+
+  /**
+   * Explicit-resource-management hook (`await using`). A no-op here; the
+   * plugin-client runtime installs the real enqueue-release behavior on the
+   * interned instance.
+   */
+  async [Symbol.asyncDispose](): Promise<void> {}
+}
+
+/** Union of all releasable (arena-backed) handle kinds. */
+export type AnyArenaHandle = Handle<ArenaKind>
+
+/**
+ * A scene-entity handle. Backed by the host `Component.id` and resolved live via
+ * the host scene index (StructureCollection) — never stored in the resource
+ * registry. Stable across undo/redo and persistable across sessions (§9.2).
+ * Entity handles remain raw branded STRINGS (not {@linkcode Handle} instances):
+ * they have no arena entry, no lifecycle, and are equality-matched against
+ * plain ids embedded in result records.
+ */
+export type EntityId<K extends string = string> = string & { readonly __handle: K }
+
+/** Resource handle: a host-resident, session-ephemeral geometry object (§9.2). */
+export type ProfileHandle = Handle<"profile">
+
+/** Resource handle: a host-resident contour (outer profile + hole profiles). */
+export type ContourHandle = Handle<"contour">
+
+/** Entity-handle example: a Mass / space scene object (Component.id). */
+export type MassHandle = EntityId<"mass">
+
+/**
+ * A scene BIM entity (wall, space, slab, floor, …). Backed by `Component.id` and
+ * resolved live via the host scene index (StructureCollection) — never stored in
+ * the resource registry. Stable across undo/redo and persistable (§9.2). This is
+ * the canonical return handle for every `design.create.*` creator. The token is
+ * the raw `Component.id` — NO `"component_"` prefix, so it round-trips with the
+ * ids the host already hands out.
+ */
+export type ComponentHandle = EntityId<"component">
+
+/**
+ * A material handle. Like {@linkcode ComponentHandle}/`CommentHandle` this is an
+ * arena-free **entity-style** handle: the token IS the material's stable engine
+ * name (`Material.name`/`.id`), resolved live via `scene.getMaterialByName`
+ * host-side — no registry arena, no quota, no dispose, stable across undo/redo.
+ * Project-scoped, not a scene entity.
+ */
+export type MaterialHandle = EntityId<"material">
+
+/**
+ * A placed **scene underlay** — an imported reference plane the user traces over:
+ * an image `FloorPlan`, a `PDF` overlay, or a `CAD` sketch. Entity-style: the token
+ * IS the raw `Component.id` (`fp_…` / a pdf id / `cad_…`). Resolved live host-side
+ * via the import-order layer walk (`collectStoreyImportItems`) — NOT via
+ * `ComponentUtility.FindComponentById`, which does not index underlays. No arena, no
+ * quota, stable across undo/redo. Returned by `core.io.import.{image,pdf,cadJson}`
+ * and consumed by every `core.io.underlay.*` method.
+ */
+export type UnderlayHandle = EntityId<"underlay">
+
+/**
+ * The project's **site terrain** — a Mapbox-derived topography mesh. Entity-style
+ * and a project **singleton** (one terrain per project): the token is the terrain
+ * `Component.id` (`terrain-…`), resolved live via `TerrainOperations.getTerrain()`
+ * (absent from the level component collections, so NOT `FindComponentById`).
+ * Returned by `core.io.import.terrain`.
+ */
+export type TerrainHandle = EntityId<"terrain">
+
+/**
+ * A **dimension line** — one measurement annotation left behind by the Measuring
+ * Tape tool (NOT a width/height/depth property; see `design.dimensions`).
+ * Entity-style: the token IS the raw engine dimension id (`dim_…`), resolved live
+ * host-side from the dimension-line registry (`getDimensionLineMap()`) — not via
+ * `ComponentUtility.FindComponentById`, which does not index dimension lines (a
+ * dimension line is not a Component). No arena, no quota, stable across
+ * undo/redo and across reloads (the record persists with the project). Returned
+ * by `design.dimensions.create` and consumed by every other
+ * `design.dimensions.*` method.
+ */
+export type DimensionHandle = EntityId<"dimension">
+
+/**
+ * A handle to an **asynchronous import job** (today: a DWG → Forge conversion, which
+ * can take minutes). Returned immediately by `core.io.import.dwg`; poll it via
+ * `core.io.job.*` (`getStatus` / `isComplete` / `getResult` / `getError`). The token
+ * is the engine's import request id; job state lives in a host-side registry.
+ */
+export type ImportJobHandle = EntityId<"importJob">
+
+// ── Value-kind handles (all-handle model, §11) ──────────────────────────────
+// Under the all-handle decision every structured type is a handle. The only
+// non-handles crossing the boundary are JS primitives (number/string/boolean)
+// and enums — the irreducible construction/read leaves. Value handles are
+// immutable; math/geom operate on them via host RPC (no in-worker compute).
+export type Vec3Handle = Handle<"vec3">
+export type QuatHandle = Handle<"quat">
+export type LineHandle = Handle<"line">
+export type ArcHandle = Handle<"arc">
+/** A curve is a line or an arc — its handle is one of those kinds. */
+export type CurveHandle = LineHandle | ArcHandle
+/**
+ * A circle value handle. A circle is a CLOSED curve — it deliberately does NOT
+ * join {@linkcode CurveHandle} (it has no stable start/end and would break the
+ * shared curve read contract), so it carries its own kind and its own
+ * `core.geom.query.circle` namespace (mirroring `query.arc`).
+ */
+export type CircleHandle = Handle<"circle">
+
+// ── BREP topology handles (geometry-kernel resource family, §2A.2.1) ─────────
+// Session-ephemeral, identity-deduped RESOURCE handles for the boundary-
+// representation topology graph. Read-only via `core.geom.query.{brep,face,edge,
+// halfedge,vertex}`; they go stale on undo/redo/re-topologize. Obtain a brep via
+// `design.query.geometry.getBrep`; every other topology handle is minted by
+// walking from a brep/face/edge/vertex handle already resolved off that brep.
+export type BrepHandle = Handle<"brep">
+export type FaceHandle = Handle<"face">
+export type EdgeHandle = Handle<"edge">
+/** Half-edge kind token is all-lowercase `"halfedge"` per §6.1 (no camelCase namespaces). */
+export type HalfEdgeHandle = Handle<"halfedge">
+export type VertexHandle = Handle<"vertex">
+
+/**
+ * Bare primitive records — how value-handle reads return their components
+ * (§11.4). Curves have **no** by-value record: a curve crosses the boundary as a
+ * {@linkcode CurveHandle} (line/arc), and its coordinates are read via the
+ * `core.geom.query.curve` API. There is no `CurveData` under the all-handle model.
+ */
+export type Vec3Components = { x: number; y: number; z: number }
+export type QuatComponents = { x: number; y: number; z: number; w: number }
+/** Axis-aligned bounding box, read as two primitive corner records. */
+export type BBoxComponents = { min: Vec3Components; max: Vec3Components }
+
+/**
+ * Build a Zod schema validating a handle of the given `kind` at the trust
+ * boundary and emitting a {@linkcode Handle} instance for impl code. Inbound
+ * forms accepted:
+ *  - the bare id string (the wire form — the client unwraps args to ids)
+ *  - a live `Handle` instance (host-internal re-parse, direct host callers)
+ *  - `{ __h: string }` (the tagged result form, echoed back as an arg)
+ *  - `{ id: string }` (a Handle stripped by structured clone at the UI boundary)
+ * Shape checking stays prefix-only; existence, kind, and ownership are enforced
+ * host-side by the HandleRegistry (§9.7) — no existence oracle.
+ */
+export const handleSchema = <K extends string>(kind: K) =>
+  z
+    .preprocess(
+      (v) => {
+        if (typeof v === "string") return v
+        if (v instanceof Handle) return v.id
+        if (v && typeof v === "object") {
+          const o = v as Record<string, unknown>
+          if (typeof o.__h === "string") return o.__h
+          if (typeof o.id === "string") return o.id
+        }
+        return v
+      },
+      z.string().regex(new RegExp(`^${kind}_[A-Za-z0-9_-]+$`), `expected a "${kind}" handle`)
+    )
+    .transform((s) => new Handle<K>(s))
+
+export const ProfileHandle = handleSchema("profile")
+export const ContourHandle = handleSchema("contour")
+
+/**
+ * Entity handles are raw `Component.id` strings (no `"<kind>_"` prefix) — validated
+ * only as a non-empty string, resolved live via the scene index host-side.
+ */
+export const ComponentHandle = z
+  .string()
+  .min(1)
+  .transform((s) => s as ComponentHandle)
+
+/**
+ * Material handles are the raw `Material.name` string (entity-style, no `"<kind>_"`
+ * prefix) — validated only as non-empty, resolved live via `scene.getMaterialByName`.
+ */
+export const MaterialHandle = z
+  .string()
+  .min(1)
+  .transform((s) => s as MaterialHandle)
+
+/**
+ * {@linkcode UnderlayHandle} / {@linkcode TerrainHandle} / {@linkcode ImportJobHandle}
+ * are entity-style handles — raw host ids, validated only as a non-empty string
+ * (no `"<kind>_"` prefix), resolved live host-side (existence enforced there).
+ */
+export const UnderlayHandle = z
+  .string()
+  .min(1)
+  .transform((s) => s as UnderlayHandle)
+export const TerrainHandle = z
+  .string()
+  .min(1)
+  .transform((s) => s as TerrainHandle)
+export const ImportJobHandle = z
+  .string()
+  .min(1)
+  .transform((s) => s as ImportJobHandle)
+
+/**
+ * {@linkcode DimensionHandle} is an entity-style handle — the raw `dim_…` engine
+ * id, validated only as a non-empty string (no `"<kind>_"` prefix enforcement),
+ * resolved live host-side against the dimension-line registry (existence
+ * enforced there, as `HANDLE_INVALID`).
+ */
+export const DimensionHandle = z
+  .string()
+  .min(1)
+  .transform((s) => s as DimensionHandle)
+
+// Value-kind handle schemas (all-handle model, §11).
+export const Vec3Handle = handleSchema("vec3")
+export const QuatHandle = handleSchema("quat")
+export const LineHandle = handleSchema("line")
+export const ArcHandle = handleSchema("arc")
+export const CurveHandle = z.union([LineHandle, ArcHandle])
+export const CircleHandle = handleSchema("circle")
+
+// BREP topology handle schemas (§2A.2.1). Prefix-shape validation only; existence,
+// kind, and ownership are enforced host-side by the HandleRegistry topology arena.
+export const BrepHandle = handleSchema("brep")
+export const FaceHandle = handleSchema("face")
+export const EdgeHandle = handleSchema("edge")
+export const HalfEdgeHandle = handleSchema("halfedge")
+export const VertexHandle = handleSchema("vertex")
+export const Vec3Components = z.object({ x: z.number(), y: z.number(), z: z.number() })
+export const QuatComponents = z.object({
+  x: z.number(),
+  y: z.number(),
+  z: z.number(),
+  w: z.number(),
+})
+export const BBoxComponents = z.object({ min: Vec3Components, max: Vec3Components })