@treeseed/sdk 0.12.62 → 0.13.0-rc.10

package/dist/standards/mcp/compare.d.ts

@@ -0,0 +1,2 @@
+import type { McpCompatibilityComparison, McpContractModel } from './contracts.js';
+export declare function compareMcp(baseline: McpContractModel, candidate: McpContractModel): McpCompatibilityComparison;

package/dist/standards/mcp/compare.js

@@ -0,0 +1,38 @@
+const rank = { unchanged: 0, compatible_addition: 1, breaking: 2 };
+function same(left, right) {
+  return JSON.stringify(left) === JSON.stringify(right);
+}
+function compareMcp(baseline, candidate) {
+  const findings = [];
+  const add = (code, path, message, classification) => findings.push({ code, path, message, classification });
+  if (baseline.protocolVersion !== candidate.protocolVersion) add("mcp_protocol_changed", "protocolVersion", "The MCP protocol version changed.", "breaking");
+  for (const [name, tool] of Object.entries(baseline.tools)) {
+    const next = candidate.tools[name];
+    if (!next) {
+      add("mcp_tool_removed", `tools.${name}`, "An MCP tool was removed.", "breaking");
+      continue;
+    }
+    if (!same(tool.inputSchema, next.inputSchema)) add("mcp_tool_input_changed", `tools.${name}.inputSchema`, "Tool input changed.", "breaking");
+    if (!same(tool.outputSchema, next.outputSchema)) add("mcp_tool_output_changed", `tools.${name}.outputSchema`, "Tool output changed.", "breaking");
+    if (next.requiredScopes.some((scope) => !tool.requiredScopes.includes(scope))) add("mcp_tool_scope_escalated", `tools.${name}.requiredScopes`, "Tool scope requirements increased.", "breaking");
+    if (tool.riskClass !== next.riskClass) add("mcp_tool_risk_changed", `tools.${name}.riskClass`, "Tool risk classification changed.", "breaking");
+  }
+  for (const name of Object.keys(candidate.tools).filter((name2) => !(name2 in baseline.tools))) add("mcp_tool_added", `tools.${name}`, "An MCP tool was added.", "compatible_addition");
+  for (const [uri, resource] of Object.entries(baseline.resources)) {
+    const next = candidate.resources[uri];
+    if (!next) add("mcp_resource_removed", `resources.${uri}`, "An MCP resource was removed.", "breaking");
+    else if (!same(resource, next)) add("mcp_resource_changed", `resources.${uri}`, "An MCP resource contract changed.", "breaking");
+  }
+  for (const uri of Object.keys(candidate.resources).filter((uri2) => !(uri2 in baseline.resources))) add("mcp_resource_added", `resources.${uri}`, "An MCP resource was added.", "compatible_addition");
+  for (const [name, prompt] of Object.entries(baseline.prompts)) {
+    const next = candidate.prompts[name];
+    if (!next) add("mcp_prompt_removed", `prompts.${name}`, "An MCP prompt was removed.", "breaking");
+    else if (!same(prompt, next)) add("mcp_prompt_changed", `prompts.${name}`, "An MCP prompt contract changed.", "breaking");
+  }
+  for (const name of Object.keys(candidate.prompts).filter((name2) => !(name2 in baseline.prompts))) add("mcp_prompt_added", `prompts.${name}`, "An MCP prompt was added.", "compatible_addition");
+  findings.sort((left, right) => `${left.path}:${left.code}`.localeCompare(`${right.path}:${right.code}`));
+  return { classification: findings.reduce((value, finding) => rank[finding.classification] > rank[value] ? finding.classification : value, "unchanged"), findings };
+}
+export {
+  compareMcp
+};

package/dist/standards/mcp/contracts.d.ts

@@ -0,0 +1,34 @@
+import type { CompatibilityClassification } from '../contracts.js';
+import type { OAuthScope } from '../../operator-contracts/control-plane-operation.js';
+export interface McpNormalizedTool {
+    inputSchema: unknown;
+    outputSchema: unknown;
+    requiredScopes: OAuthScope[];
+    riskClass: string;
+}
+export interface McpNormalizedResource {
+    uriTemplate: string;
+    operationId: string;
+    subscribable: boolean;
+}
+export interface McpNormalizedPrompt {
+    argumentSchema: unknown;
+    requiredScopes: OAuthScope[];
+}
+export interface McpContractModel {
+    schemaVersion: 1;
+    protocolVersion: string;
+    tools: Record<string, McpNormalizedTool>;
+    resources: Record<string, McpNormalizedResource>;
+    prompts: Record<string, McpNormalizedPrompt>;
+}
+export interface McpCompatibilityFinding {
+    code: string;
+    path: string;
+    message: string;
+    classification: CompatibilityClassification;
+}
+export interface McpCompatibilityComparison {
+    classification: CompatibilityClassification;
+    findings: McpCompatibilityFinding[];
+}

package/dist/standards/mcp/index.d.ts

@@ -0,0 +1,3 @@
+export * from './contracts.js';
+export * from './normalize.js';
+export * from './compare.js';

package/dist/standards/mcp/index.js

@@ -0,0 +1,3 @@
+export * from "./contracts.js";
+export * from "./normalize.js";
+export * from "./compare.js";

package/dist/standards/mcp/normalize.d.ts

@@ -0,0 +1,4 @@
+import type { McpCatalog } from '../../operator-contracts/mcp.js';
+import type { ControlPlaneOperationDescriptor } from '../../operator-contracts/control-plane-operation.js';
+import type { McpContractModel } from './contracts.js';
+export declare function normalizeMcpCatalog(catalog: McpCatalog, operations: readonly ControlPlaneOperationDescriptor[], schemas: Readonly<Record<string, unknown>>): McpContractModel;

package/dist/standards/mcp/normalize.js

@@ -0,0 +1,30 @@
+import { canonicalizeStandardsValue } from "../canonicalize.js";
+function normalizeMcpCatalog(catalog, operations, schemas) {
+  const operationById = new Map(operations.map((operation) => [operation.operationId, operation]));
+  return {
+    schemaVersion: 1,
+    protocolVersion: catalog.protocolVersion,
+    tools: Object.fromEntries([...catalog.tools].sort((left, right) => left.name.localeCompare(right.name)).map((tool) => {
+      const operation = operationById.get(tool.operationId);
+      if (!operation) throw new Error(`MCP tool ${tool.name} references unknown operation ${tool.operationId}.`);
+      return [tool.name, {
+        inputSchema: canonicalizeStandardsValue(schemas[tool.inputSchemaId] ?? {}),
+        outputSchema: canonicalizeStandardsValue(schemas[tool.outputSchemaId] ?? {}),
+        requiredScopes: [...operation.oauthScopes].sort(),
+        riskClass: operation.riskClass
+      }];
+    })),
+    resources: Object.fromEntries([...catalog.resources].sort((left, right) => left.uriTemplate.localeCompare(right.uriTemplate)).map((resource) => [resource.uriTemplate, {
+      uriTemplate: resource.uriTemplate,
+      operationId: resource.operationId,
+      subscribable: resource.subscribable
+    }])),
+    prompts: Object.fromEntries([...catalog.prompts].sort((left, right) => left.name.localeCompare(right.name)).map((prompt) => [prompt.name, {
+      argumentSchema: canonicalizeStandardsValue(schemas[prompt.argumentSchemaId] ?? {}),
+      requiredScopes: [...prompt.requiredScopes].sort()
+    }]))
+  };
+}
+export {
+  normalizeMcpCatalog
+};

package/dist/standards/openapi/compare.d.ts

@@ -0,0 +1,2 @@
+import type { OpenApiCompatibilityComparison, OpenApiContractModel } from './contracts.js';
+export declare function compareOpenApi(baseline: OpenApiContractModel, candidate: OpenApiContractModel): OpenApiCompatibilityComparison;

package/dist/standards/openapi/compare.js

@@ -0,0 +1,112 @@
+const rank = { unchanged: 0, compatible_addition: 1, breaking: 2 };
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function add(findings, code, path, message, classification) {
+  findings.push({ code, path, message, classification });
+}
+function same(left, right) {
+  return JSON.stringify(left) === JSON.stringify(right);
+}
+function schemaFrom(value) {
+  const input = value ?? void 0;
+  if (!isRecord(input)) return void 0;
+  if (isRecord(input.schema)) return input.schema;
+  const content = isRecord(input.content) ? input.content : void 0;
+  const json = content && isRecord(content["application/json"]) ? content["application/json"] : void 0;
+  return json && isRecord(json.schema) ? json.schema : void 0;
+}
+function compareSchema(baseline, candidate, path, direction, findings) {
+  if (baseline === void 0 && candidate !== void 0) {
+    add(findings, "openapi_schema_added", path, "A schema was added.", direction === "input" ? "breaking" : "compatible_addition");
+    return;
+  }
+  if (baseline !== void 0 && candidate === void 0) {
+    add(findings, "openapi_schema_removed", path, "A schema was removed.", direction === "output" ? "breaking" : "compatible_addition");
+    return;
+  }
+  if (!isRecord(baseline) || !isRecord(candidate)) {
+    if (baseline !== void 0 && candidate !== void 0 && !same(baseline, candidate)) add(findings, "openapi_schema_changed", path, "A schema changed.", "breaking");
+    return;
+  }
+  const previousEnum = Array.isArray(baseline.enum) ? baseline.enum : [];
+  const nextEnum = Array.isArray(candidate.enum) ? candidate.enum : [];
+  if (previousEnum.length || nextEnum.length) {
+    const removed = previousEnum.some((entry) => !nextEnum.some((next) => same(entry, next)));
+    const added = nextEnum.some((entry) => !previousEnum.some((previous) => same(entry, previous)));
+    if (removed && direction === "input" || added && direction === "output") add(findings, "openapi_enum_contract_broken", path, "Accepted input narrowed or possible output widened.", "breaking");
+    else if (removed || added) add(findings, "openapi_enum_changed", path, "An enum changed compatibly for this direction.", "compatible_addition");
+  }
+  const previousProperties = isRecord(baseline.properties) ? baseline.properties : {};
+  const nextProperties = isRecord(candidate.properties) ? candidate.properties : {};
+  const nextRequired = new Set(Array.isArray(candidate.required) ? candidate.required.filter((entry) => typeof entry === "string") : []);
+  const previousRequired = new Set(Array.isArray(baseline.required) ? baseline.required.filter((entry) => typeof entry === "string") : []);
+  for (const name of Object.keys(previousProperties)) {
+    if (!(name in nextProperties)) add(findings, "openapi_property_removed", `${path}.properties.${name}`, "A schema property was removed.", "breaking");
+    else compareSchema(previousProperties[name], nextProperties[name], `${path}.properties.${name}`, direction, findings);
+  }
+  for (const name of Object.keys(nextProperties).filter((entry) => !(entry in previousProperties))) {
+    add(
+      findings,
+      "openapi_property_added",
+      `${path}.properties.${name}`,
+      "A schema property was added.",
+      direction === "input" && nextRequired.has(name) ? "breaking" : "compatible_addition"
+    );
+  }
+  for (const name of nextRequired) if (!previousRequired.has(name)) {
+    add(
+      findings,
+      direction === "input" ? "openapi_required_input_added" : "openapi_required_output_added",
+      `${path}.required.${name}`,
+      "A required property was added.",
+      direction === "input" ? "breaking" : "compatible_addition"
+    );
+  }
+  for (const name of previousRequired) if (!nextRequired.has(name)) {
+    add(
+      findings,
+      direction === "input" ? "openapi_required_input_removed" : "openapi_required_output_removed",
+      `${path}.required.${name}`,
+      "A required property was removed.",
+      direction === "output" ? "breaking" : "compatible_addition"
+    );
+  }
+  compareSchema(baseline.items, candidate.items, `${path}.items`, direction, findings);
+  const structuralKeys = /* @__PURE__ */ new Set(["enum", "items", "properties", "required"]);
+  const previousConstraints = Object.fromEntries(Object.entries(baseline).filter(([key]) => !structuralKeys.has(key)));
+  const nextConstraints = Object.fromEntries(Object.entries(candidate).filter(([key]) => !structuralKeys.has(key)));
+  if (!same(previousConstraints, nextConstraints)) {
+    add(findings, "openapi_schema_constraint_changed", path, "A schema type, format, composition, or constraint changed.", "breaking");
+  }
+}
+function compareOperation(path, baseline, candidate, findings) {
+  if (!same(baseline.security, candidate.security)) add(findings, "openapi_security_changed", `${path}.security`, "Operation security changed.", "breaking");
+  if (!same(baseline.parameters, candidate.parameters)) add(findings, "openapi_parameters_changed", `${path}.parameters`, "Operation parameters changed.", "breaking");
+  compareSchema(schemaFrom(baseline.requestBody), schemaFrom(candidate.requestBody), `${path}.requestBody`, "input", findings);
+  const statuses = /* @__PURE__ */ new Set([...Object.keys(baseline.responses), ...Object.keys(candidate.responses)]);
+  for (const status of statuses) {
+    if (!(status in baseline.responses) || !(status in candidate.responses)) {
+      add(findings, "openapi_response_status_changed", `${path}.responses.${status}`, "A response status was added or removed.", "breaking");
+      continue;
+    }
+    compareSchema(schemaFrom(baseline.responses[status]), schemaFrom(candidate.responses[status]), `${path}.responses.${status}`, "output", findings);
+  }
+}
+function compareOpenApi(baseline, candidate) {
+  const findings = [];
+  for (const [path, operation] of Object.entries(baseline.operations)) {
+    const next = candidate.operations[path];
+    if (!next) add(findings, "openapi_operation_removed", path, "An operation was removed.", "breaking");
+    else compareOperation(path, operation, next, findings);
+  }
+  for (const path of Object.keys(candidate.operations).filter((entry) => !(entry in baseline.operations))) {
+    add(findings, "openapi_operation_added", path, "An operation was added.", "compatible_addition");
+  }
+  findings.sort((left, right) => `${left.path}:${left.code}`.localeCompare(`${right.path}:${right.code}`));
+  const classification = findings.reduce((current, entry) => rank[entry.classification] > rank[current] ? entry.classification : current, "unchanged");
+  return { classification, findings };
+}
+export {
+  compareOpenApi
+};

package/dist/standards/openapi/contracts.d.ts

@@ -0,0 +1,24 @@
+import type { CanonicalJsonValue } from '../canonicalize.js';
+import type { CompatibilityClassification } from '../contracts.js';
+export interface OpenApiOperationModel {
+    operationId: string | null;
+    security: CanonicalJsonValue;
+    parameters: CanonicalJsonValue[];
+    requestBody: CanonicalJsonValue | null;
+    responses: Record<string, CanonicalJsonValue>;
+}
+export interface OpenApiContractModel {
+    schemaVersion: 1;
+    openapi: string;
+    operations: Record<string, OpenApiOperationModel>;
+}
+export interface OpenApiCompatibilityFinding {
+    code: string;
+    path: string;
+    message: string;
+    classification: CompatibilityClassification;
+}
+export interface OpenApiCompatibilityComparison {
+    classification: CompatibilityClassification;
+    findings: OpenApiCompatibilityFinding[];
+}

package/dist/standards/openapi/index.d.ts

@@ -0,0 +1,3 @@
+export * from './compare.js';
+export * from './contracts.js';
+export * from './normalize.js';

package/dist/standards/openapi/index.js

@@ -0,0 +1,3 @@
+export * from "./compare.js";
+export * from "./contracts.js";
+export * from "./normalize.js";

package/dist/standards/openapi/normalize.d.ts

@@ -0,0 +1,2 @@
+import type { OpenApiContractModel } from './contracts.js';
+export declare function normalizeOpenApi(documentValue: unknown): OpenApiContractModel;

package/dist/standards/openapi/normalize.js

@@ -0,0 +1,57 @@
+import { canonicalizeStandardsValue } from "../canonicalize.js";
+import { StandardsError } from "../errors.js";
+const httpMethods = /* @__PURE__ */ new Set(["delete", "get", "head", "options", "patch", "post", "put", "trace"]);
+const unorderedArrays = /* @__PURE__ */ new Set(["enum", "required", "tags"]);
+function record(value, path) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new StandardsError("standards_invalid_contract", "Expected an OpenAPI object.", path);
+  }
+  return value;
+}
+function pointer(document, reference) {
+  if (!reference.startsWith("#/")) throw new StandardsError("standards_invalid_contract", "External OpenAPI references are not supported.", "$ref");
+  return reference.slice(2).split("/").map((part) => part.replaceAll("~1", "/").replaceAll("~0", "~")).reduce((current, part) => record(current, reference)[part], document);
+}
+function normalizeValue(value, document, references, key = "") {
+  if (Array.isArray(value)) {
+    const entries = value.map((entry) => normalizeValue(entry, document, references));
+    return unorderedArrays.has(key) ? entries.sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right))) : entries;
+  }
+  if (!value || typeof value !== "object") return canonicalizeStandardsValue(value);
+  const input = value;
+  if (typeof input.$ref === "string") {
+    if (references.has(input.$ref)) return { $ref: input.$ref };
+    const nextReferences = new Set(references).add(input.$ref);
+    return normalizeValue(pointer(document, input.$ref), document, nextReferences);
+  }
+  return Object.fromEntries(Object.keys(input).filter((entry) => !["description", "externalDocs", "summary"].includes(entry)).sort().map((entry) => [entry, normalizeValue(input[entry], document, references, entry)]));
+}
+function operation(value, document) {
+  const input = record(value, "operation");
+  const responses = record(input.responses ?? {}, "operation.responses");
+  return {
+    operationId: typeof input.operationId === "string" ? input.operationId : null,
+    security: normalizeValue(input.security ?? document.security ?? [], document, /* @__PURE__ */ new Set(), "security"),
+    parameters: (Array.isArray(input.parameters) ? input.parameters : []).map((entry) => normalizeValue(entry, document, /* @__PURE__ */ new Set())).sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right))),
+    requestBody: input.requestBody ? normalizeValue(input.requestBody, document, /* @__PURE__ */ new Set()) : null,
+    responses: Object.fromEntries(Object.keys(responses).sort().map((status) => [status, normalizeValue(responses[status], document, /* @__PURE__ */ new Set())]))
+  };
+}
+function normalizeOpenApi(documentValue) {
+  const document = record(documentValue, "$");
+  if (typeof document.openapi !== "string" || !/^3\./u.test(document.openapi)) {
+    throw new StandardsError("standards_invalid_contract", "OpenAPI version 3 is required.", "openapi");
+  }
+  const paths = record(document.paths ?? {}, "paths");
+  const operations = {};
+  for (const path of Object.keys(paths).sort()) {
+    const pathItem = record(paths[path], `paths.${path}`);
+    for (const method of Object.keys(pathItem).filter((entry) => httpMethods.has(entry.toLowerCase())).sort()) {
+      operations[`${method.toUpperCase()} ${path}`] = operation(pathItem[method], document);
+    }
+  }
+  return { schemaVersion: 1, openapi: document.openapi, operations };
+}
+export {
+  normalizeOpenApi
+};

package/dist/standards/package-manifest.d.ts

@@ -0,0 +1,37 @@
+import type { StandardsContractFamily } from './contracts.js';
+export interface StandardsManifestContract {
+    id: string;
+    family: StandardsContractFamily;
+    version: string;
+    semanticRange: string;
+    source: string;
+    artifact: string;
+    verifier: string;
+}
+export interface StandardsPackageManifest {
+    schemaVersion: 1;
+    workflow: {
+        enabled: boolean;
+    };
+    acceptedBaseline: StandardsAcceptedBaseline | null;
+    produced: StandardsManifestContract[];
+    consumed: StandardsManifestContract[];
+    guarantees: string[];
+    deprecations: string[];
+    runtimes: string[];
+    rollbackOperations: string[];
+}
+export interface StandardsAcceptedBaseline {
+    packageName: string;
+    packageVersion: string;
+    sourceCommit: string;
+    npmIntegrity: string;
+    artifactDigest: string;
+    openApiSourceDigest: string;
+}
+export interface StandardsManifestInspection {
+    manifest: StandardsPackageManifest | null;
+    errors: string[];
+}
+export declare function parseStandardsPackageManifest(value: unknown): StandardsPackageManifest;
+export declare function inspectStandardsPackageManifest(value: unknown): StandardsManifestInspection;

package/dist/standards/package-manifest.js

@@ -0,0 +1,89 @@
+import { StandardsError } from "./errors.js";
+const families = /* @__PURE__ */ new Set(["typescript", "openapi", "json-schema", "behavioral"]);
+const safePath = /^(?!\/)(?!.*(?:^|\/)\.\.(?:\/|$))(?!.*\\)[\w@./-]+$/u;
+const semanticVersion = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u;
+const semanticRange = /^(?:[~^]|>=?|<=?)?\d+\.\d+\.\d+(?:-[0-9A-Za-z.*-]+)?(?:\s+(?:[~^]|>=?|<=?)?\d+\.\d+\.\d+(?:-[0-9A-Za-z.*-]+)?)?$|^\*$/u;
+const sha256 = /^sha256:[a-f0-9]{64}$/u;
+function record(value, path) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new StandardsError("standards_invalid_contract", "Expected an object.", path);
+  return value;
+}
+function string(value, path) {
+  if (typeof value !== "string" || !value.trim()) throw new StandardsError("standards_invalid_contract", "Expected a non-empty string.", path);
+  return value.trim();
+}
+function strings(value, path) {
+  if (!Array.isArray(value)) throw new StandardsError("standards_invalid_contract", "Expected a string array.", path);
+  const entries = value.map((entry, index) => string(entry, `${path}[${index}]`));
+  if (new Set(entries).size !== entries.length) throw new StandardsError("standards_duplicate_identity", "Duplicate array value.", path);
+  return entries.sort();
+}
+function contract(value, path) {
+  const input = record(value, path);
+  const family = string(input.family, `${path}.family`);
+  if (!families.has(family)) throw new StandardsError("standards_invalid_contract", `Unsupported contract family: ${family}.`, `${path}.family`);
+  const version = string(input.version, `${path}.version`);
+  if (!semanticVersion.test(version)) throw new StandardsError("standards_invalid_semantic_version", "Contract version must be semantic.", `${path}.version`);
+  const range = string(input.semanticRange, `${path}.semanticRange`);
+  if (!semanticRange.test(range)) throw new StandardsError("standards_invalid_semantic_version", "Contract semanticRange is invalid.", `${path}.semanticRange`);
+  const paths = ["source", "artifact", "verifier"];
+  const normalizedPaths = Object.fromEntries(paths.map((key) => {
+    const entry = string(input[key], `${path}.${key}`);
+    if (!safePath.test(entry)) throw new StandardsError("standards_invalid_contract", `${key} must be a safe repository-relative path.`, `${path}.${key}`);
+    return [key, entry];
+  }));
+  return { id: string(input.id, `${path}.id`), family, version, semanticRange: range, ...normalizedPaths };
+}
+function contracts(value, path) {
+  if (!Array.isArray(value)) throw new StandardsError("standards_invalid_contract", "Expected a contract array.", path);
+  const entries = value.map((entry, index) => contract(entry, `${path}[${index}]`));
+  const ids = entries.map((entry) => entry.id);
+  if (new Set(ids).size !== ids.length) throw new StandardsError("standards_duplicate_identity", "Duplicate contract id.", path);
+  return entries.sort((left, right) => left.id.localeCompare(right.id));
+}
+function parseStandardsPackageManifest(value) {
+  const input = record(value, "standards");
+  if (input.schemaVersion !== 1) throw new StandardsError("standards_invalid_contract", "standards.schemaVersion must be 1.", "standards.schemaVersion");
+  const workflow = record(input.workflow, "standards.workflow");
+  if (typeof workflow.enabled !== "boolean") throw new StandardsError("standards_invalid_contract", "workflow.enabled must be boolean.", "standards.workflow.enabled");
+  const baselineInput = input.acceptedBaseline === void 0 ? null : record(input.acceptedBaseline, "standards.acceptedBaseline");
+  const acceptedBaseline = baselineInput ? {
+    packageName: string(baselineInput.packageName, "standards.acceptedBaseline.packageName"),
+    packageVersion: string(baselineInput.packageVersion, "standards.acceptedBaseline.packageVersion"),
+    sourceCommit: string(baselineInput.sourceCommit, "standards.acceptedBaseline.sourceCommit"),
+    npmIntegrity: string(baselineInput.npmIntegrity, "standards.acceptedBaseline.npmIntegrity"),
+    artifactDigest: string(baselineInput.artifactDigest, "standards.acceptedBaseline.artifactDigest"),
+    openApiSourceDigest: string(baselineInput.openApiSourceDigest, "standards.acceptedBaseline.openApiSourceDigest")
+  } : null;
+  if (acceptedBaseline) {
+    if (!semanticVersion.test(acceptedBaseline.packageVersion)) throw new StandardsError("standards_invalid_semantic_version", "Accepted baseline version must be semantic.", "standards.acceptedBaseline.packageVersion");
+    if (!/^[a-f0-9]{40}$/u.test(acceptedBaseline.sourceCommit)) throw new StandardsError("standards_invalid_contract", "Accepted baseline source commit must be a full Git SHA.", "standards.acceptedBaseline.sourceCommit");
+    if (!acceptedBaseline.npmIntegrity.startsWith("sha512-")) throw new StandardsError("standards_invalid_contract", "Accepted baseline npm integrity must be SHA-512 SRI.", "standards.acceptedBaseline.npmIntegrity");
+    if (!sha256.test(acceptedBaseline.artifactDigest) || !sha256.test(acceptedBaseline.openApiSourceDigest)) {
+      throw new StandardsError("standards_invalid_contract", "Accepted baseline artifact digests must be SHA-256.", "standards.acceptedBaseline");
+    }
+  }
+  if (workflow.enabled === true && !acceptedBaseline) throw new StandardsError("standards_invalid_contract", "Enabled standards workflow requires an accepted baseline.", "standards.acceptedBaseline");
+  return {
+    schemaVersion: 1,
+    workflow: { enabled: workflow.enabled },
+    acceptedBaseline,
+    produced: contracts(input.produced ?? [], "standards.produced"),
+    consumed: contracts(input.consumed ?? [], "standards.consumed"),
+    guarantees: strings(input.guarantees ?? [], "standards.guarantees"),
+    deprecations: strings(input.deprecations ?? [], "standards.deprecations"),
+    runtimes: strings(input.runtimes ?? [], "standards.runtimes"),
+    rollbackOperations: strings(input.rollbackOperations ?? [], "standards.rollbackOperations")
+  };
+}
+function inspectStandardsPackageManifest(value) {
+  try {
+    return { manifest: parseStandardsPackageManifest(value), errors: [] };
+  } catch (error) {
+    return { manifest: null, errors: [error instanceof Error ? error.message : String(error)] };
+  }
+}
+export {
+  inspectStandardsPackageManifest,
+  parseStandardsPackageManifest
+};

package/dist/standards/portfolio-entry.d.ts

@@ -0,0 +1,12 @@
+import type { StandardsDigest } from './contracts.js';
+export interface StandardsPortfolioEntry {
+    schemaVersion: 1;
+    packageName: string;
+    acceptedVersion: string;
+    acceptedSourceCommit: string;
+    packageDigest: StandardsDigest;
+    contractBundleDigest: StandardsDigest;
+    compositionIds: string[];
+    rollbackOperations: string[];
+}
+export declare function createStandardsPortfolioEntry(input: Omit<StandardsPortfolioEntry, 'schemaVersion'>): StandardsPortfolioEntry;

package/dist/standards/portfolio-entry.js

@@ -0,0 +1,11 @@
+function createStandardsPortfolioEntry(input) {
+  return {
+    ...input,
+    schemaVersion: 1,
+    compositionIds: [...new Set(input.compositionIds)].sort(),
+    rollbackOperations: [...new Set(input.rollbackOperations)].sort()
+  };
+}
+export {
+  createStandardsPortfolioEntry
+};

package/dist/standards/typescript/compare.d.ts

@@ -0,0 +1,2 @@
+import type { TypeScriptApiComparison, TypeScriptApiModel } from './contracts.js';
+export declare function compareTypeScriptApi(baseline: TypeScriptApiModel, candidate: TypeScriptApiModel): TypeScriptApiComparison;

package/dist/standards/typescript/compare.js

@@ -0,0 +1,88 @@
+const rank = { unchanged: 0, compatible_addition: 1, breaking: 2 };
+function publicSymbolPath(specifier, symbolName) {
+  return specifier === "." ? `.${symbolName}` : `${specifier}.${symbolName}`;
+}
+function finding(findings, value, classification) {
+  findings.push({ ...value, classification });
+}
+function compareSymbol(path, baseline, candidate, findings) {
+  if (baseline.kind !== candidate.kind) {
+    finding(findings, { code: "typescript_symbol_kind_changed", path, message: `${baseline.kind} changed to ${candidate.kind}.` }, "breaking");
+    return;
+  }
+  if (!baseline.deprecated && candidate.deprecated) {
+    finding(findings, { code: "typescript_symbol_deprecated", path, message: "A deprecation marker was added." }, "compatible_addition");
+  }
+  if (JSON.stringify(baseline.heritage) !== JSON.stringify(candidate.heritage)) {
+    finding(findings, { code: "typescript_heritage_changed", path, message: "A public extends or implements contract changed." }, "breaking");
+  }
+  if (baseline.definition !== candidate.definition || baseline.returnType !== candidate.returnType) {
+    finding(findings, { code: "typescript_symbol_type_changed", path, message: "The public type or return type changed." }, "breaking");
+  }
+  if (baseline.kind === "function") {
+    const previous = new Set(baseline.signatures);
+    const next = new Set(candidate.signatures);
+    for (const signature of previous) if (!next.has(signature)) {
+      finding(findings, { code: "typescript_overload_removed", path: `${path}.overloads`, message: `A callable overload was removed: ${signature}.` }, "breaking");
+    }
+    for (const signature of next) if (!previous.has(signature)) {
+      finding(findings, { code: "typescript_overload_added", path: `${path}.overloads`, message: `A callable overload was added: ${signature}.` }, "compatible_addition");
+    }
+  }
+  const candidateMembers = new Map(candidate.members.map((entry) => [entry.name, entry]));
+  for (const member of baseline.members) {
+    const next = candidateMembers.get(member.name);
+    if (!next) finding(findings, { code: "typescript_member_removed", path: `${path}.${member.name}`, message: "A public member was removed." }, "breaking");
+    else if (member.type !== next.type || member.optional !== next.optional || member.readonly !== next.readonly) {
+      finding(findings, { code: "typescript_member_changed", path: `${path}.${member.name}`, message: "A public member contract changed." }, "breaking");
+    } else if (!member.deprecated && next.deprecated) {
+      finding(findings, { code: "typescript_member_deprecated", path: `${path}.${member.name}`, message: "A member deprecation marker was added." }, "compatible_addition");
+    }
+  }
+  const baselineMembers = new Set(baseline.members.map((entry) => entry.name));
+  for (const member of candidate.members.filter((entry) => !baselineMembers.has(entry.name))) {
+    finding(findings, { code: "typescript_member_added", path: `${path}.${member.name}`, message: "A public member was added." }, member.optional ? "compatible_addition" : "breaking");
+  }
+  const baselineParameters = baseline.parameters;
+  const candidateParameters = candidate.parameters;
+  for (let index = 0; index < Math.max(baselineParameters.length, candidateParameters.length); index += 1) {
+    const previous = baselineParameters[index];
+    const next = candidateParameters[index];
+    if (!previous && next) finding(findings, { code: "typescript_parameter_added", path: `${path}.parameters[${index}]`, message: "A parameter was added." }, next.optional ? "compatible_addition" : "breaking");
+    else if (previous && !next) finding(findings, { code: "typescript_parameter_removed", path: `${path}.parameters[${index}]`, message: "A parameter was removed." }, "breaking");
+    else if (previous && next && (previous.type !== next.type || previous.optional !== next.optional || previous.rest !== next.rest)) {
+      finding(findings, { code: "typescript_parameter_changed", path: `${path}.parameters[${index}]`, message: "A parameter contract changed." }, "breaking");
+    }
+  }
+}
+function compareTypeScriptApi(baseline, candidate) {
+  const findings = [];
+  const candidateEntrypoints = new Map(candidate.entrypoints.map((entry) => [entry.specifier, entry]));
+  for (const entrypoint of baseline.entrypoints) {
+    const nextEntrypoint = candidateEntrypoints.get(entrypoint.specifier);
+    if (!nextEntrypoint) {
+      finding(findings, { code: "typescript_entrypoint_removed", path: entrypoint.specifier, message: "A public entrypoint was removed." }, "breaking");
+      continue;
+    }
+    const nextSymbols = new Map(nextEntrypoint.symbols.map((entry) => [entry.name, entry]));
+    for (const previous of entrypoint.symbols) {
+      const next = nextSymbols.get(previous.name);
+      if (!next) finding(findings, { code: "typescript_symbol_removed", path: publicSymbolPath(entrypoint.specifier, previous.name), message: "A public symbol was removed." }, "breaking");
+      else compareSymbol(publicSymbolPath(entrypoint.specifier, previous.name), previous, next, findings);
+    }
+    const previousNames = new Set(entrypoint.symbols.map((entry) => entry.name));
+    for (const next of nextEntrypoint.symbols.filter((entry) => !previousNames.has(entry.name))) {
+      finding(findings, { code: "typescript_symbol_added", path: publicSymbolPath(entrypoint.specifier, next.name), message: "A public symbol was added." }, "compatible_addition");
+    }
+  }
+  const baselineEntrypoints = new Set(baseline.entrypoints.map((entry) => entry.specifier));
+  for (const entrypoint of candidate.entrypoints.filter((entry) => !baselineEntrypoints.has(entry.specifier))) {
+    finding(findings, { code: "typescript_entrypoint_added", path: entrypoint.specifier, message: "A public entrypoint was added." }, "compatible_addition");
+  }
+  findings.sort((left, right) => `${left.path}:${left.code}`.localeCompare(`${right.path}:${right.code}`));
+  const classification = findings.reduce((current, entry) => rank[entry.classification] > rank[current] ? entry.classification : current, "unchanged");
+  return { classification, findings };
+}
+export {
+  compareTypeScriptApi
+};

package/dist/standards/typescript/contracts.d.ts

@@ -0,0 +1,44 @@
+import type { CompatibilityClassification } from '../contracts.js';
+export interface TypeScriptApiMember {
+    name: string;
+    type: string;
+    optional: boolean;
+    readonly: boolean;
+    deprecated: boolean;
+}
+export interface TypeScriptApiParameter {
+    name: string;
+    type: string;
+    optional: boolean;
+    rest: boolean;
+}
+export interface TypeScriptApiSymbol {
+    name: string;
+    kind: 'class' | 'enum' | 'function' | 'interface' | 'type' | 'variable';
+    deprecated: boolean;
+    heritage: string[];
+    members: TypeScriptApiMember[];
+    parameters: TypeScriptApiParameter[];
+    returnType: string | null;
+    signatures: string[];
+    definition: string | null;
+}
+export interface TypeScriptApiEntrypoint {
+    specifier: string;
+    declarationPath: string;
+    symbols: TypeScriptApiSymbol[];
+}
+export interface TypeScriptApiModel {
+    schemaVersion: 1;
+    entrypoints: TypeScriptApiEntrypoint[];
+}
+export interface TypeScriptApiFinding {
+    code: string;
+    path: string;
+    message: string;
+    classification: CompatibilityClassification;
+}
+export interface TypeScriptApiComparison {
+    classification: CompatibilityClassification;
+    findings: TypeScriptApiFinding[];
+}