@unbrained/pm-cli 2026.8.12 → 2026.8.14

package/dist/core/extensions/loader.js

@@ -4,7 +4,7 @@
  * Implements extension runtime contracts and governance for Loader.
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3d5208e5-0ea5-54a5-82a8-50294b4a0655")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="2b8750c3-7b19-5240-8179-f83830af1b77")}catch(e){}}();
 import fs from "node:fs/promises";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
@@ -23,15 +23,12 @@ import { asRegistrationRecord, assertOptionalBooleanField, assertOptionalFlagDef
 import { describeExtensionLongFlagFailure, findExtensionFlagTokenFailure, } from "./flag-definition-validation.js";
 import { compareComparableVersions, evaluatePmMaxVersionBound, evaluatePmMinVersionBound, parseComparableVersion, } from "./version-compat.js";
 import { createRelationshipKindRegistry, } from "../../sdk/relationships.js";
-// Cohesive helper groups now live in sibling modules. They are imported for the
-// discovery/activation code that stays here and re-exported below so existing
-// import sites (sdk/index.ts, commands/extension.ts, health.ts, tests, …) keep
-// importing everything from "./loader.js" unchanged.
 import { normalizeNames, isKnownExtensionCapability, collectUnknownExtensionCapabilities, normalizeManifestCapabilities, formatUnknownExtensionCapabilityWarning, formatLegacyExtensionCapabilityAliasWarning, } from "./extension-capability-aliases.js";
 import { normalizeExtensionPolicy, serializeExtensionPolicy, hydrateExtensionPolicy, normalizePolicySandboxProfile, evaluateExtensionPolicyForExtension, evaluateExtensionPolicyForCapability, evaluateExtensionPolicyForRegistration, } from "./extension-policy.js";
 import { createEmptyExtensionHookRegistry, createEmptyExtensionCommandRegistry, createEmptyExtensionParserRegistry, createEmptyExtensionPreflightRegistry, createEmptyExtensionServiceRegistry, createEmptyExtensionRendererRegistry, createEmptyExtensionRegistrationRegistry, } from "./extension-registries.js";
 import { normalizeCommandName, cloneContextSnapshot, } from "./extension-runtime-helpers.js";
 import { normalizeExtensionContributionInventory } from "./contribution-inventory.js";
+import { attachRuntimeDefinition, assertHookHandler, assertNonEmptyRegistrationString, assertRegistrationFunction, cloneRuntimeRegistrationValue, createRegistrationValidationError, extractRegistrationValidationTrace, isExtensionServiceName, isOutputRendererFormat, normalizeRegistrationRecord, normalizeRegistrationRecordList, normalizeRuntimeRegistrationRecord, normalizeRegistrationName, sanitizeRegistrationValue, toRegistrationCommandPath, validateAssuranceMeasurementProviderDefinition, } from "./registration-values.js";
 import { buildReadyExtensionCandidate, } from "./extension-candidate.js";
 export { parseUnknownExtensionCapabilityWarning, parseLegacyExtensionCapabilityAliasWarning, } from "./extension-capability-aliases.js";
 export { createEmptyExtensionHookRegistry, createEmptyExtensionCommandRegistry, createEmptyExtensionParserRegistry, createEmptyExtensionPreflightRegistry, createEmptyExtensionServiceRegistry, createEmptyExtensionRendererRegistry, createEmptyExtensionRegistrationRegistry, } from "./extension-registries.js";
@@ -41,7 +38,6 @@ export * from "./extension-types.js";
 /** Fallback extension priority used when callers do not provide an override. */
 export const DEFAULT_EXTENSION_PRIORITY = 100;
 let currentPmCliVersionPromise = null;
-/* Types now in extension-types.ts - re-exported via `export * from "./extension-types.js"` above */
 const DEFAULT_EXTENSION_POLICY = Object.freeze(createDefaultExtensionGovernancePolicy());
 let extensionReloadEpoch = 0;
 /** Implements next extension reload token for the public runtime surface of this module. */
@@ -945,115 +941,6 @@ async function runExtensionDeactivateWithTimeout(deactivate, timeoutMs) {
         clearTimeout(timeoutHandle);
     }
 }
-function isOutputRendererFormat(value) {
-    return value === "toon" || value === "json";
-}
-function isExtensionServiceName(value) {
-    return KNOWN_EXTENSION_SERVICE_NAMES.includes(value);
-}
-function assertHookHandler(hookName, hook) {
-    if (typeof hook !== "function") {
-        throw new TypeError(`api.hooks.${hookName} requires a function handler`);
-    }
-}
-function assertNonEmptyString(name, value) {
-    if (typeof value !== "string" || value.trim().length === 0) {
-        throw new TypeError(`${name} requires a non-empty string`);
-    }
-    return value.trim();
-}
-function assertFunctionHandler(name, value) {
-    if (typeof value !== "function") {
-        throw new TypeError(`${name} requires a function handler`);
-    }
-}
-function normalizeRegistrationName(name) {
-    return name
-        .trim()
-        .toLowerCase()
-        .split(/\s+/)
-        .filter((part) => part.length > 0)
-        .join(" ");
-}
-function toRegistrationCommandPath(name, action) {
-    return normalizeCommandName(`${name} ${action}`);
-}
-function sanitizeRegistrationValue(value) {
-    if (value === null) {
-        return null;
-    }
-    if (Array.isArray(value)) {
-        return value.map((entry) => sanitizeRegistrationValue(entry));
-    }
-    if (typeof value === "function") {
-        return "[Function]";
-    }
-    if (typeof value === "bigint") {
-        return value.toString();
-    }
-    if (typeof value === "symbol") {
-        return value.toString();
-    }
-    if (typeof value === "object") {
-        const record = value;
-        const normalized = {};
-        const keys = Object.keys(record).sort((left, right) => left.localeCompare(right));
-        for (const key of keys) {
-            normalized[key] = sanitizeRegistrationValue(record[key]);
-        }
-        return normalized;
-    }
-    return value;
-}
-function cloneRuntimeRegistrationValue(value) {
-    if (Array.isArray(value)) {
-        return value.map((entry) => cloneRuntimeRegistrationValue(entry));
-    }
-    if (typeof value === "object" && value !== null) {
-        const record = value;
-        const cloned = {};
-        for (const key of Object.keys(record).sort((left, right) => left.localeCompare(right))) {
-            cloned[key] = cloneRuntimeRegistrationValue(record[key]);
-        }
-        return cloned;
-    }
-    return value;
-}
-const EXTENSION_REGISTRATION_TRACE_SYMBOL = Symbol("extension_registration_trace");
-function createRegistrationValidationError(message, trace) {
-    const error = new TypeError(message);
-    Object.defineProperty(error, EXTENSION_REGISTRATION_TRACE_SYMBOL, {
-        value: trace,
-        enumerable: false,
-        configurable: false,
-        writable: false,
-    });
-    return error;
-}
-function extractRegistrationValidationTrace(error) {
-    if (!(error instanceof Error)) {
-        return undefined;
-    }
-    return error[EXTENSION_REGISTRATION_TRACE_SYMBOL];
-}
-function normalizeRegistrationRecord(name, value) {
-    if (typeof value !== "object" || value === null || Array.isArray(value)) {
-        throw new TypeError(`${name} requires an object definition`);
-    }
-    return sanitizeRegistrationValue(value);
-}
-function normalizeRuntimeRegistrationRecord(name, value) {
-    if (typeof value !== "object" || value === null || Array.isArray(value)) {
-        throw new TypeError(`${name} requires an object definition`);
-    }
-    return cloneRuntimeRegistrationValue(value);
-}
-function normalizeRegistrationRecordList(name, value) {
-    if (!Array.isArray(value)) {
-        throw new TypeError(`${name} requires an array of object definitions`);
-    }
-    return value.map((entry) => normalizeRegistrationRecord(name, entry));
-}
 const FLAG_DEFINITION_KEYS = new Set([
     "default",
     "description",
@@ -1108,7 +995,7 @@ function normalizeCommandDefinitionArguments(value) {
     const normalized = [];
     for (const [index, entry] of value.entries()) {
         const record = asRegistrationRecord(`registerCommand definition.arguments[${index}]`, entry);
-        const name = assertNonEmptyString(`registerCommand definition.arguments[${index}].name`, record.name);
+        const name = assertNonEmptyRegistrationString(`registerCommand definition.arguments[${index}].name`, record.name);
         assertOptionalBooleanField(`registerCommand definition.arguments[${index}].required`, record.required);
         assertOptionalBooleanField(`registerCommand definition.arguments[${index}].variadic`, record.variadic);
         assertOptionalStringField(`registerCommand definition.arguments[${index}].description`, record.description);
@@ -1218,8 +1105,8 @@ function validateItemFieldDefinitions(fields) {
     }
     for (const [index, raw] of fields.entries()) {
         const record = asRegistrationRecord(`registerItemFields fields[${index}]`, raw);
-        assertNonEmptyString(`registerItemFields fields[${index}].name`, record.name);
-        const fieldType = assertNonEmptyString(`registerItemFields fields[${index}].type`, record.type);
+        assertNonEmptyRegistrationString(`registerItemFields fields[${index}].name`, record.name);
+        const fieldType = assertNonEmptyRegistrationString(`registerItemFields fields[${index}].type`, record.type);
         if (normalizeItemFieldType(fieldType) === null) {
             const suggestion = suggestKnownItemFieldType(fieldType);
             const hint = suggestion ? ` Did you mean "${suggestion}"?` : "";
@@ -1241,8 +1128,8 @@ function validateItemTypeCommandOptionPolicies(typeIndex, value) {
     for (const [policyIndex, rawPolicy] of value.entries()) {
         const at = `${label}[${policyIndex}]`;
         const policy = asRegistrationRecord(at, rawPolicy);
-        assertNonEmptyString(`${at}.command`, policy.command);
-        assertNonEmptyString(`${at}.option`, policy.option);
+        assertNonEmptyRegistrationString(`${at}.command`, policy.command);
+        assertNonEmptyRegistrationString(`${at}.option`, policy.option);
         assertOptionalBooleanField(`${at}.enabled`, policy.enabled);
         assertOptionalBooleanField(`${at}.required`, policy.required);
         assertOptionalBooleanField(`${at}.visible`, policy.visible);
@@ -1260,7 +1147,7 @@ function validateItemTypeOptions(typeIndex, value) {
     for (const [optionIndex, rawOption] of value.entries()) {
         const at = `${label}[${optionIndex}]`;
         const option = asRegistrationRecord(at, rawOption);
-        assertNonEmptyString(`${at}.key`, option.key);
+        assertNonEmptyRegistrationString(`${at}.key`, option.key);
         assertOptionalStringArrayField(`${at}.values`, option.values);
         assertOptionalBooleanField(`${at}.required`, option.required);
         assertOptionalStringArrayField(`${at}.aliases`, option.aliases);
@@ -1273,7 +1160,7 @@ function validateItemTypeDefinitions(types) {
     for (const [typeIndex, raw] of types.entries()) {
         const at = `registerItemTypes types[${typeIndex}]`;
         const record = asRegistrationRecord(at, raw);
-        assertNonEmptyString(`${at}.name`, record.name);
+        assertNonEmptyRegistrationString(`${at}.name`, record.name);
         assertOptionalStringField(`${at}.folder`, record.folder);
         assertOptionalStringArrayField(`${at}.aliases`, record.aliases);
         assertOptionalStringArrayField(`${at}.required_create_fields`, record.required_create_fields);
@@ -1351,8 +1238,8 @@ const PROJECT_PROFILE_ENTRY_VALIDATORS = {
 };
 function validateProjectProfileDefinition(profile) {
     const record = asRegistrationRecord("registerProfile profile", profile);
-    assertNonEmptyString("registerProfile profile.name", record.name);
-    assertNonEmptyString("registerProfile profile.title", record.title);
+    assertNonEmptyRegistrationString("registerProfile profile.name", record.name);
+    assertNonEmptyRegistrationString("registerProfile profile.title", record.title);
     if (record.summary !== undefined && typeof record.summary !== "string") {
         throw new TypeError("registerProfile profile.summary must be a string when provided");
     }
@@ -1398,15 +1285,6 @@ function applyProjectProfileDefaults(profile) {
     }
     return profile;
 }
-function attachRuntimeDefinition(entry, runtimeDefinition) {
-    Object.defineProperty(entry, "runtime_definition", {
-        value: runtimeDefinition,
-        enumerable: false,
-        writable: false,
-        configurable: false,
-    });
-    return entry;
-}
 function getDeclaredExtensionCapabilities(extension) {
     if (!Array.isArray(extension.capabilities)) {
         return null;
@@ -1515,6 +1393,8 @@ class ExtensionApiRegistrar {
         this.registerSearchProvider = this.registerSearchProvider.bind(this);
         this.registerVectorStoreAdapter =
             this.registerVectorStoreAdapter.bind(this);
+        this.registerAssuranceMeasurementProvider =
+            this.registerAssuranceMeasurementProvider.bind(this);
         this.hooks = {
             beforeCommand: (hook) => this.registerBeforeCommand(hook),
             beforeMutation: (hook) => this.registerBeforeMutation(hook),
@@ -1662,8 +1542,8 @@ class ExtensionApiRegistrar {
         if (!this.allowRegistration("parser.override", "registerParser", "parser")) {
             return;
         }
-        const normalizedCommand = normalizeCommandName(assertNonEmptyString("registerParser command", command));
-        assertFunctionHandler("registerParser override", override);
+        const normalizedCommand = normalizeCommandName(assertNonEmptyRegistrationString("registerParser command", command));
+        assertRegistrationFunction("registerParser override", override);
         this.#parserRegistry.overrides.push({
             layer: this.#loadedExtension.layer,
             name: this.#loadedExtension.name,
@@ -1692,7 +1572,7 @@ class ExtensionApiRegistrar {
         if (!this.allowRegistration("services.override", "registerService", "services", { service: normalizedService })) {
             return;
         }
-        assertFunctionHandler("registerService override", override);
+        assertRegistrationFunction("registerService override", override);
         this.#serviceRegistry.overrides.push({
             layer: this.#loadedExtension.layer,
             name: this.#loadedExtension.name,
@@ -1740,7 +1620,7 @@ class ExtensionApiRegistrar {
         if (!this.allowRegistration("schema.flags", "registerFlags", "schema")) {
             return;
         }
-        const normalizedTargetCommand = normalizeCommandName(assertNonEmptyString("registerFlags targetCommand", targetCommand));
+        const normalizedTargetCommand = normalizeCommandName(assertNonEmptyRegistrationString("registerFlags targetCommand", targetCommand));
         validateFlagDefinitions(flags);
         const normalizedFlags = normalizeFlagDefinitions("registerFlags flags", flags);
         if (normalizedFlags.length === 0) {
@@ -1909,8 +1789,8 @@ class ExtensionApiRegistrar {
         if (!this.allowRegistration("importers.importer", "registerImporter", "importers")) {
             return;
         }
-        const normalizedName = normalizeRegistrationName(assertNonEmptyString("registerImporter name", name));
-        assertFunctionHandler("registerImporter importer", importer);
+        const normalizedName = normalizeRegistrationName(assertNonEmptyRegistrationString("registerImporter name", name));
+        assertRegistrationFunction("registerImporter importer", importer);
         const commandPath = toRegistrationCommandPath(normalizedName, "import");
         // Validate and register optional command metadata before mutating the registry
         // so an invalid options object leaves no partial importer registration.
@@ -1944,8 +1824,8 @@ class ExtensionApiRegistrar {
         if (!this.allowRegistration("importers.exporter", "registerExporter", "importers")) {
             return;
         }
-        const normalizedName = normalizeRegistrationName(assertNonEmptyString("registerExporter name", name));
-        assertFunctionHandler("registerExporter exporter", exporter);
+        const normalizedName = normalizeRegistrationName(assertNonEmptyRegistrationString("registerExporter name", name));
+        assertRegistrationFunction("registerExporter exporter", exporter);
         const commandPath = toRegistrationCommandPath(normalizedName, "export");
         // Validate and register optional command metadata before mutating the registry
         // so an invalid options object leaves no partial exporter registration.
@@ -1998,6 +1878,24 @@ class ExtensionApiRegistrar {
             definition: normalizeRegistrationRecord("registerVectorStoreAdapter adapter", adapter),
         }, runtimeDefinition));
     }
+    registerAssuranceMeasurementProvider(provider) {
+        assertExtensionCapability(this.#loadedExtension, "services", "registerAssuranceMeasurementProvider");
+        if (!this.allowRegistration("services.assuranceprovider", "registerAssuranceMeasurementProvider", "services")) {
+            return;
+        }
+        validateAssuranceMeasurementProviderDefinition(provider);
+        if (provider.network &&
+            this.#loadedExtension.permissions?.network !== true) {
+            throw new TypeError("registerAssuranceMeasurementProvider network provider requires permissions.network=true");
+        }
+        const runtimeDefinition = normalizeRuntimeRegistrationRecord("registerAssuranceMeasurementProvider provider", provider);
+        this.#registrationRegistry.assurance_providers.push(attachRuntimeDefinition({
+            layer: this.#loadedExtension.layer,
+            name: this.#loadedExtension.name,
+            network_permission: this.#loadedExtension.permissions?.network === true,
+            definition: normalizeRegistrationRecord("registerAssuranceMeasurementProvider provider", provider),
+        }, runtimeDefinition));
+    }
     registerBeforeCommand(hook) {
         assertExtensionCapability(this.#loadedExtension, "hooks", "api.hooks.beforeCommand");
         if (!this.allowRegistration("hooks.beforecommand", "api.hooks.beforeCommand", "hooks"))
@@ -2089,6 +1987,9 @@ function getRegistrationCounts(registrations) {
         exporters: registrations.exporters.length,
         search_providers: registrations.search_providers.length,
         vector_store_adapters: registrations.vector_store_adapters.length,
+        ...((registrations.assurance_providers?.length ?? 0) > 0
+            ? { assurance_providers: registrations.assurance_providers.length }
+            : {}),
     };
 }
 function collectCommandCollisionWarnings(commands) {
@@ -2144,7 +2045,9 @@ function collectRendererCollisionWarnings(renderers) {
         }
         const winner = bucket[bucket.length - 1];
         for (const displaced of bucket.slice(0, -1)) {
-            if (winner.commands?.length && displaced.commands?.length && !displaced.commands.some((command) => winner.commands?.includes(command))) {
+            if (winner.commands?.length &&
+                displaced.commands?.length &&
+                !displaced.commands.some((command) => winner.commands?.includes(command))) {
                 continue;
             }
             warnings.push(`extension_renderer_collision:${format}:${winner.layer}:${winner.name}:${displaced.layer}:${displaced.name}`);
@@ -2217,7 +2120,13 @@ export async function activateExtensions(loadResult) {
         }
         const failedBeforeActivation = failed.length;
         const rollbackPartialActivation = captureExtensionActivationRollback({
-            hooks, commands, parsers, preflight, services, renderers, registrations,
+            hooks,
+            commands,
+            parsers,
+            preflight,
+            services,
+            renderers,
+            registrations,
         });
         try {
             await activatable.activate(createExtensionApi(extension, hooks, commands, parsers, preflight, services, renderers, registrations, warnings, failed, policy));
@@ -2312,4 +2221,4 @@ export const _testOnlyLoader = {
     },
 };
 //# sourceMappingURL=loader.js.map
-//# debugId=3d5208e5-0ea5-54a5-82a8-50294b4a0655
+//# debugId=2b8750c3-7b19-5240-8179-f83830af1b77

package/dist/core/extensions/registration-values.d.ts

@@ -0,0 +1,43 @@
+/**
+ * @module core/extensions/registration-values
+ *
+ * Preserves executable extension registrations while producing deterministic,
+ * serializable public inventory snapshots and validates assurance providers.
+ */
+import { type AssuranceMeasurementProviderDefinition, type ExtensionActivationFailureTrace, type ExtensionServiceName, type OutputRendererFormat } from "./extension-types.js";
+/** Narrow a string to a renderer format accepted by the extension host. */
+export declare function isOutputRendererFormat(value: string): value is OutputRendererFormat;
+/** Narrow a string to a service name accepted by the extension host. */
+export declare function isExtensionServiceName(value: string): value is ExtensionServiceName;
+/** Require a callable lifecycle hook before registry mutation. */
+export declare function assertHookHandler(hookName: string, hook: unknown): void;
+/** Create a validation error carrying a hidden structured activation trace. */
+export declare function createRegistrationValidationError(message: string, trace: ExtensionActivationFailureTrace): TypeError;
+/** Recover a hidden structured activation trace from a validation error. */
+export declare function extractRegistrationValidationTrace(error: unknown): ExtensionActivationFailureTrace | undefined;
+/** Recursively project an arbitrary registration value into serializable data. */
+export declare function sanitizeRegistrationValue(value: unknown): unknown;
+/** Recursively clone registration containers while preserving function identities. */
+export declare function cloneRuntimeRegistrationValue(value: unknown): unknown;
+/** Create a deterministic serializable registration snapshot with functions redacted. */
+export declare function normalizeRegistrationRecord(name: string, value: unknown): Record<string, unknown>;
+/** Clone a registration record without stripping executable function values. */
+export declare function normalizeRuntimeRegistrationRecord(name: string, value: unknown): Record<string, unknown>;
+/** Normalize every object in an array into deterministic serializable snapshots. */
+export declare function normalizeRegistrationRecordList<T extends object>(name: string, value: readonly T[]): T[];
+/** Normalize an untyped array crossing a JavaScript or JSON boundary. */
+export declare function normalizeRegistrationRecordList(name: string, value: unknown): Array<Record<string, unknown>>;
+/** Require a trimmed non-empty string at an extension authoring boundary. */
+export declare function assertNonEmptyRegistrationString(name: string, value: unknown): string;
+/** Require an executable handler at an extension authoring boundary. */
+export declare function assertRegistrationFunction(name: string, value: unknown): void;
+/** Canonicalize a user-facing registration name for stable routing. */
+export declare function normalizeRegistrationName(name: string): string;
+/** Build the canonical command path synthesized for an importer or exporter. */
+export declare function toRegistrationCommandPath(name: string, action: "import" | "export"): string;
+/** Attach an executable definition as hidden immutable runtime-only state. */
+export declare function attachRuntimeDefinition<TEntry extends {
+    definition: Record<string, unknown>;
+}>(entry: TEntry, runtimeDefinition: Record<string, unknown>): TEntry;
+/** Validate the closed provider schema before any activation registry mutation. */
+export declare function validateAssuranceMeasurementProviderDefinition(provider: unknown): asserts provider is AssuranceMeasurementProviderDefinition;

package/dist/core/extensions/registration-values.js

@@ -0,0 +1,210 @@
+/**
+ * @module core/extensions/registration-values
+ *
+ * Preserves executable extension registrations while producing deterministic,
+ * serializable public inventory snapshots and validates assurance providers.
+ */
+
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="7316b9ef-38e1-5ee0-9107-da15ec7804d4")}catch(e){}}();
+import { KNOWN_EXTENSION_SERVICE_NAMES, } from "./extension-types.js";
+import { asRegistrationRecord, assertOptionalBooleanField, assertOptionalStringField, } from "./registration-validation.js";
+import { normalizeCommandName } from "./extension-runtime-helpers.js";
+/** Narrow a string to a renderer format accepted by the extension host. */
+export function isOutputRendererFormat(value) {
+    return value === "toon" || value === "json";
+}
+/** Narrow a string to a service name accepted by the extension host. */
+export function isExtensionServiceName(value) {
+    return KNOWN_EXTENSION_SERVICE_NAMES.includes(value);
+}
+/** Require a callable lifecycle hook before registry mutation. */
+export function assertHookHandler(hookName, hook) {
+    if (typeof hook !== "function") {
+        throw new TypeError(`api.hooks.${hookName} requires a function handler`);
+    }
+}
+const EXTENSION_REGISTRATION_TRACE_SYMBOL = Symbol("extension_registration_trace");
+/** Create a validation error carrying a hidden structured activation trace. */
+export function createRegistrationValidationError(message, trace) {
+    const error = new TypeError(message);
+    Object.defineProperty(error, EXTENSION_REGISTRATION_TRACE_SYMBOL, {
+        value: trace,
+        enumerable: false,
+        configurable: false,
+        writable: false,
+    });
+    return error;
+}
+/** Recover a hidden structured activation trace from a validation error. */
+export function extractRegistrationValidationTrace(error) {
+    return error instanceof Error
+        ? error[EXTENSION_REGISTRATION_TRACE_SYMBOL]
+        : undefined;
+}
+/** Recursively project an arbitrary registration value into serializable data. */
+export function sanitizeRegistrationValue(value) {
+    if (value === null)
+        return null;
+    if (Array.isArray(value)) {
+        return value.map((entry) => sanitizeRegistrationValue(entry));
+    }
+    if (typeof value === "function")
+        return "[Function]";
+    if (typeof value === "bigint" || typeof value === "symbol") {
+        return value.toString();
+    }
+    if (typeof value === "object") {
+        const record = value;
+        const normalized = {};
+        for (const key of Object.keys(record).sort((left, right) => left.localeCompare(right))) {
+            normalized[key] = sanitizeRegistrationValue(record[key]);
+        }
+        return normalized;
+    }
+    return value;
+}
+/** Recursively clone registration containers while preserving function identities. */
+export function cloneRuntimeRegistrationValue(value) {
+    if (Array.isArray(value)) {
+        return value.map((entry) => cloneRuntimeRegistrationValue(entry));
+    }
+    if (typeof value === "object" && value !== null) {
+        const record = value;
+        const cloned = {};
+        for (const key of Object.keys(record).sort((left, right) => left.localeCompare(right))) {
+            cloned[key] = cloneRuntimeRegistrationValue(record[key]);
+        }
+        return cloned;
+    }
+    return value;
+}
+/** Create a deterministic serializable registration snapshot with functions redacted. */
+export function normalizeRegistrationRecord(name, value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new TypeError(`${name} requires an object definition`);
+    }
+    return sanitizeRegistrationValue(value);
+}
+/** Clone a registration record without stripping executable function values. */
+export function normalizeRuntimeRegistrationRecord(name, value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new TypeError(`${name} requires an object definition`);
+    }
+    return cloneRuntimeRegistrationValue(value);
+}
+/** Implement the typed and untyped registration-array normalization overloads. */
+export function normalizeRegistrationRecordList(name, value) {
+    if (!Array.isArray(value)) {
+        throw new TypeError(`${name} requires an array of object definitions`);
+    }
+    return value.map((entry) => normalizeRegistrationRecord(name, entry));
+}
+/** Require a trimmed non-empty string at an extension authoring boundary. */
+export function assertNonEmptyRegistrationString(name, value) {
+    if (typeof value !== "string" || value.trim().length === 0) {
+        throw new TypeError(`${name} requires a non-empty string`);
+    }
+    return value.trim();
+}
+/** Require an executable handler at an extension authoring boundary. */
+export function assertRegistrationFunction(name, value) {
+    if (typeof value !== "function") {
+        throw new TypeError(`${name} requires a function handler`);
+    }
+}
+/** Canonicalize a user-facing registration name for stable routing. */
+export function normalizeRegistrationName(name) {
+    return name
+        .trim()
+        .toLowerCase()
+        .split(/\s+/)
+        .filter((part) => part.length > 0)
+        .join(" ");
+}
+/** Build the canonical command path synthesized for an importer or exporter. */
+export function toRegistrationCommandPath(name, action) {
+    return normalizeCommandName(`${name} ${action}`);
+}
+/** Attach an executable definition as hidden immutable runtime-only state. */
+export function attachRuntimeDefinition(entry, runtimeDefinition) {
+    Object.defineProperty(entry, "runtime_definition", {
+        value: runtimeDefinition,
+        enumerable: false,
+        writable: false,
+        configurable: false,
+    });
+    return entry;
+}
+const ASSURANCE_PROVIDER_COST_CLASSES = new Set(["low", "medium", "high"]);
+const ASSURANCE_PROVIDER_VALUE_TYPES = new Set(["number", "string_set"]);
+const ASSURANCE_PROVIDER_PARAMETER_TYPES = new Set([
+    "string",
+    "number",
+    "boolean",
+]);
+function nonEmptyString(label, value) {
+    if (typeof value !== "string" || value.trim().length === 0) {
+        throw new TypeError(`${label} requires a non-empty string`);
+    }
+    return value.trim();
+}
+function validateAssuranceProviderKey(providerId, key, definition) {
+    const label = `registerAssuranceMeasurementProvider provider.keys.${key}`;
+    const record = asRegistrationRecord(label, definition);
+    if (!ASSURANCE_PROVIDER_VALUE_TYPES.has(String(record.value_type))) {
+        throw new TypeError(`${label}.value_type must be number or string_set`);
+    }
+    assertOptionalStringField(`${label}.description`, record.description);
+    if (record.parameters === undefined)
+        return;
+    const parameters = asRegistrationRecord(`${label}.parameters`, record.parameters);
+    for (const [parameter, rawDefinition] of Object.entries(parameters)) {
+        const parameterLabel = `${label}.parameters.${parameter}`;
+        nonEmptyString(`${parameterLabel}.name`, parameter);
+        const parameterDefinition = asRegistrationRecord(parameterLabel, rawDefinition);
+        if (!ASSURANCE_PROVIDER_PARAMETER_TYPES.has(String(parameterDefinition.type))) {
+            throw new TypeError(`${parameterLabel}.type must be string, number, or boolean`);
+        }
+        assertOptionalBooleanField(`${parameterLabel}.required`, parameterDefinition.required);
+        assertOptionalStringField(`${parameterLabel}.description`, parameterDefinition.description);
+    }
+    if (Object.keys(parameters).length > 50) {
+        throw new TypeError(`assurance provider ${providerId} key ${key} exceeds 50 parameters`);
+    }
+}
+/** Validate the closed provider schema before any activation registry mutation. */
+export function validateAssuranceMeasurementProviderDefinition(provider) {
+    const record = asRegistrationRecord("registerAssuranceMeasurementProvider provider", provider);
+    const id = nonEmptyString("registerAssuranceMeasurementProvider provider.id", record.id);
+    if (!/^[a-z0-9][a-z0-9-]*$/u.test(id)) {
+        throw new TypeError("registerAssuranceMeasurementProvider provider.id must be a stable lowercase id");
+    }
+    if (!ASSURANCE_PROVIDER_COST_CLASSES.has(String(record.cost_class))) {
+        throw new TypeError("registerAssuranceMeasurementProvider provider.cost_class must be low, medium, or high");
+    }
+    if (typeof record.network !== "boolean") {
+        throw new TypeError("registerAssuranceMeasurementProvider provider.network must be boolean");
+    }
+    const keys = asRegistrationRecord("registerAssuranceMeasurementProvider provider.keys", record.keys);
+    if (Object.keys(keys).length === 0) {
+        throw new TypeError("registerAssuranceMeasurementProvider provider.keys requires at least one key");
+    }
+    for (const [key, definition] of Object.entries(keys)) {
+        if (!/^[a-z0-9][a-z0-9-]*$/u.test(key)) {
+            throw new TypeError(`registerAssuranceMeasurementProvider provider key ${key} must be a stable lowercase id`);
+        }
+        validateAssuranceProviderKey(id, key, definition);
+    }
+    if (record.timeout_ms !== undefined &&
+        (typeof record.timeout_ms !== "number" ||
+            !Number.isInteger(record.timeout_ms) ||
+            record.timeout_ms < 1 ||
+            record.timeout_ms > 300_000)) {
+        throw new TypeError("registerAssuranceMeasurementProvider provider.timeout_ms must be an integer from 1 through 300000");
+    }
+    if (typeof record.resolve !== "function") {
+        throw new TypeError("registerAssuranceMeasurementProvider provider.resolve requires a function handler");
+    }
+}
+//# sourceMappingURL=registration-values.js.map
+//# debugId=7316b9ef-38e1-5ee0-9107-da15ec7804d4

package/dist/core/extensions/runtime-registrations.d.ts

@@ -3,7 +3,9 @@
  *
  * Implements extension runtime contracts and governance for Runtime Registrations.
  */
-import type { ExtensionRegistrationRegistry, RegisteredExtensionSchemaMigrationDefinition, RegisteredExtensionSearchProvider, RegisteredExtensionVectorStoreAdapter, SchemaFieldDefinition } from "./loader.js";
+import type { ExtensionRegistrationRegistry, RegisteredExtensionSchemaMigrationDefinition, RegisteredExtensionSearchProvider, RegisteredExtensionVectorStoreAdapter, RegisteredExtensionAssuranceMeasurementProvider, SchemaFieldDefinition } from "./loader.js";
+/** Resolve the last-activated assurance provider with the requested stable id. */
+export declare function resolveRegisteredAssuranceMeasurementProvider(registrations: ExtensionRegistrationRegistry | null, providerId: string | undefined): RegisteredExtensionAssuranceMeasurementProvider | null;
 /** Implements collect registered item fields for the public runtime surface of this module. */
 export declare function collectRegisteredItemFields(registrations: ExtensionRegistrationRegistry | null): SchemaFieldDefinition[];
 /** Implements resolve registered search provider for the public runtime surface of this module. */

package/dist/core/extensions/runtime-registrations.js

@@ -1,5 +1,5 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="4507a449-1c20-5684-9ed8-e72c9bc694c1")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="ab276268-7a98-5f97-b3f5-300dfd1b5ed5")}catch(e){}}();
 function normalizeRegistrationName(value) {
     if (typeof value !== "string") {
         return null;
@@ -7,6 +7,16 @@ function normalizeRegistrationName(value) {
     const normalized = value.trim().toLowerCase();
     return normalized.length > 0 ? normalized : null;
 }
+/** Resolve the last-activated assurance provider with the requested stable id. */
+export function resolveRegisteredAssuranceMeasurementProvider(registrations, providerId) {
+    const normalizedId = normalizeRegistrationName(providerId);
+    if (!registrations || !normalizedId)
+        return null;
+    return ([...(registrations.assurance_providers ?? [])]
+        .reverse()
+        .find((registration) => normalizeRegistrationName(registration.definition.id) ===
+        normalizedId) ?? null);
+}
 /** Implements collect registered item fields for the public runtime surface of this module. */
 export function collectRegisteredItemFields(registrations) {
     if (!registrations) {
@@ -55,4 +65,4 @@ export function getMigrationRuntimeDefinition(migration) {
     return migration.runtime_definition ?? migration.definition;
 }
 //# sourceMappingURL=runtime-registrations.js.map
-//# debugId=4507a449-1c20-5684-9ed8-e72c9bc694c1
+//# debugId=ab276268-7a98-5f97-b3f5-300dfd1b5ed5

package/dist/core/fs/fs-utils.d.ts

@@ -12,6 +12,8 @@ export declare function pathExists(targetPath: string): Promise<boolean>;
  * runtime fault instead of reaching the caller's own root validation.
  */
 export declare function isFileAbsentError(error: unknown): boolean;
+/** Report an exact missing-entry race while preserving ENOTDIR as structural corruption. */
+export declare function isFileMissingError(error: unknown): boolean;
 /** Implements read file if exists for the public runtime surface of this module. */
 export declare function readFileIfExists(targetPath: string): Promise<string | null>;
 /** Implements write file atomic for the public runtime surface of this module. */