@uppercut-labs/agent-native 0.0.0-stage → 1.1.0

package/dist/core/registry.d.ts

@@ -0,0 +1,37 @@
+import type { CapabilityDefinition } from './contracts.js';
+import { type DiagnosticObservation } from './diagnostics.js';
+import type { ExecutionCaller } from './executor.js';
+export type RuntimeTarget = 'browser' | 'server' | 'local';
+export type ExecutionSignal = {
+    readonly aborted: boolean;
+};
+export type BindingExecutionContext = {
+    readonly capabilityId: string;
+    readonly runtime: RuntimeTarget;
+    /** The caller the executor authorized. Bindings use it to scope records to the caller. */
+    readonly caller: ExecutionCaller;
+    readonly signal?: ExecutionSignal;
+};
+export type CapabilityBindingOptions<Input, Output> = {
+    readonly id: string;
+    readonly targets: readonly RuntimeTarget[];
+    readonly execute: (input: Input, context: BindingExecutionContext) => Output | Promise<Output>;
+};
+export type CapabilityBinding = {
+    readonly id: string;
+    readonly capabilityId: string;
+    readonly targets: readonly RuntimeTarget[];
+};
+export type RegistryErrorKind = 'invalid-definition' | 'duplicate-definition' | 'invalid-binding';
+export declare class CapabilityRegistryError extends Error {
+    readonly kind: RegistryErrorKind;
+    readonly observation: DiagnosticObservation;
+    constructor(kind: RegistryErrorKind, message: string, checkId: string);
+}
+export type CapabilityRegistry = {
+    readonly definitions: readonly CapabilityDefinition<unknown, unknown>[];
+    readonly bindings: readonly CapabilityBinding[];
+};
+export declare function bindCapability<Input, Output>(definition: CapabilityDefinition<Input, Output>, options: CapabilityBindingOptions<Input, Output>): CapabilityBinding;
+export declare function createCapabilityRegistry(definitions: readonly CapabilityDefinition<unknown, unknown>[], bindings: readonly CapabilityBinding[]): CapabilityRegistry;
+//# sourceMappingURL=registry.d.ts.map

package/dist/core/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/core/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,OAAO,EAA+B,KAAK,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAE3F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE3D,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,0FAA0F;IAC1F,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,wBAAwB,CAAC,KAAK,EAAE,MAAM,IAAI;IACpD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;IAC3C,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAChG,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,oBAAoB,GAAG,sBAAsB,GAAG,iBAAiB,CAAC;AAElG,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,SAAgB,IAAI,EAAE,iBAAiB,CAAC;IACxC,SAAgB,WAAW,EAAE,qBAAqB,CAAC;IAEnD,YAAmB,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAK3E;CACF;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;IACxE,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACjD,CAAC;AAEF,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAC1C,UAAU,EAAE,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,EAC/C,OAAO,EAAE,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,GAC/C,iBAAiB,CA4BnB;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,SAAS,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAC9D,QAAQ,EAAE,SAAS,iBAAiB,EAAE,GACrC,kBAAkB,CAyDpB"}

package/dist/core/registry.js

@@ -0,0 +1,75 @@
+import { canonicalCapabilityId, isCapabilityDefinition } from './contracts.js';
+import { createDiagnosticObservation } from './diagnostics.js';
+import { getBindingRecord, setBindingRecord } from './binding-internal.js';
+export class CapabilityRegistryError extends Error {
+    kind;
+    observation;
+    constructor(kind, message, checkId) {
+        super(message);
+        this.name = 'CapabilityRegistryError';
+        this.kind = kind;
+        this.observation = createDiagnosticObservation({ checkId, status: 'failed' });
+    }
+}
+export function bindCapability(definition, options) {
+    const capabilityId = canonicalCapabilityId(definition.identity);
+    if (!/^[a-z0-9]+(?:[.-][a-z0-9]+)*$/.test(options.id)) {
+        throw new TypeError('binding id must be a lowercase slug');
+    }
+    if (options.targets.length === 0 ||
+        options.targets.some((target) => !['browser', 'server', 'local'].includes(target))) {
+        throw new TypeError('binding targets must name one or more supported runtimes');
+    }
+    const targets = Object.freeze([...new Set(options.targets)]);
+    const binding = Object.freeze({
+        id: options.id,
+        capabilityId,
+        targets,
+    });
+    setBindingRecord(binding, {
+        definition,
+        async handler(input, context) {
+            const parsed = input;
+            return await options.execute(parsed, context);
+        },
+    });
+    return binding;
+}
+export function createCapabilityRegistry(definitions, bindings) {
+    let definitionIds = new Set();
+    let definitionsById = new Map();
+    for (const candidate of definitions) {
+        if (!isCapabilityDefinition(candidate)) {
+            throw new CapabilityRegistryError('invalid-definition', 'registry definition must include valid identity, schemas, risk, and access metadata', 'UAN-002.invalid-definition');
+        }
+        const definition = candidate;
+        let id;
+        try {
+            id = canonicalCapabilityId(definition.identity);
+        }
+        catch {
+            throw new CapabilityRegistryError('invalid-definition', 'registry contains an invalid capability identity', 'UAN-002.invalid-definition');
+        }
+        if (definitionIds.has(id)) {
+            throw new CapabilityRegistryError('duplicate-definition', `registry contains duplicate identity ${id}`, 'UAN-002.duplicate-definition');
+        }
+        definitionIds.add(id);
+        definitionsById.set(id, definition);
+    }
+    let bindingIds = new Set();
+    for (const binding of bindings) {
+        const registeredDefinition = definitionsById.get(binding.capabilityId);
+        const boundDefinition = getBindingRecord(binding)?.definition;
+        if (registeredDefinition === undefined ||
+            boundDefinition !== registeredDefinition ||
+            bindingIds.has(binding.id)) {
+            throw new CapabilityRegistryError('invalid-binding', 'binding must target a registered definition and have a unique id', 'UAN-002.invalid-binding');
+        }
+        bindingIds.add(binding.id);
+    }
+    return Object.freeze({
+        definitions: Object.freeze([...definitions]),
+        bindings: Object.freeze([...bindings]),
+    });
+}
+//# sourceMappingURL=registry.js.map

package/dist/core/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/core/registry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,2BAA2B,EAA8B,MAAM,kBAAkB,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AA+B3E,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChC,IAAI,CAAoB;IACxB,WAAW,CAAwB;IAEnD,YAAmB,IAAuB,EAAE,OAAe,EAAE,OAAe;QAC1E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,WAAW,GAAG,2BAA2B,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChF,CAAC;CACF;AAOD,MAAM,UAAU,cAAc,CAC5B,UAA+C,EAC/C,OAAgD;IAEhD,MAAM,YAAY,GAAW,qBAAqB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACxE,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;IAC7D,CAAC;IACD,IACE,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAC5B,OAAO,CAAC,OAAO,CAAC,IAAI,CAClB,CAAC,MAAqB,EAAW,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACrF,EACD,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,0DAA0D,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,OAAO,GAA6B,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,OAAO,GAAsB,MAAM,CAAC,MAAM,CAAC;QAC/C,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,YAAY;QACZ,OAAO;KACR,CAAC,CAAC;IACH,gBAAgB,CAAC,OAAO,EAAE;QACxB,UAAU;QACV,KAAK,CAAC,OAAO,CAAC,KAAc,EAAE,OAAgC;YAC5D,MAAM,MAAM,GAAU,KAAc,CAAC;YACrC,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC;KACF,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,WAA8D,EAC9D,QAAsC;IAEtC,IAAI,aAAa,GAAgB,IAAI,GAAG,EAAE,CAAC;IAC3C,IAAI,eAAe,GAAwD,IAAI,GAAG,EAAE,CAAC;IACrF,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;QACpC,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,qFAAqF,EACrF,4BAA4B,CAC7B,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAA2C,SAAS,CAAC;QACrE,IAAI,EAAU,CAAC;QACf,IAAI,CAAC;YACH,EAAE,GAAG,qBAAqB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,uBAAuB,CAC/B,oBAAoB,EACpB,kDAAkD,EAClD,4BAA4B,CAC7B,CAAC;QACJ,CAAC;QACD,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,uBAAuB,CAC/B,sBAAsB,EACtB,wCAAwC,EAAE,EAAE,EAC5C,8BAA8B,CAC/B,CAAC;QACJ,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtB,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,UAAU,GAAgB,IAAI,GAAG,EAAE,CAAC;IACxC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,oBAAoB,GACxB,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC5C,MAAM,eAAe,GACnB,gBAAgB,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;QACxC,IACE,oBAAoB,KAAK,SAAS;YAClC,eAAe,KAAK,oBAAoB;YACxC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAC1B,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EACjB,kEAAkE,EAClE,yBAAyB,CAC1B,CAAC;QACJ,CAAC;QACD,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC;QAC5C,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC;KACvC,CAAC,CAAC;AACL,CAAC"}

package/dist/core/schema.d.ts

@@ -0,0 +1,9 @@
+export interface SchemaPort<Value> {
+    parse(input: unknown): Value;
+    toJSONSchema(): Readonly<Record<string, unknown>>;
+}
+export type JsonValue = null | string | number | boolean | readonly JsonValue[] | {
+    readonly [key: string]: JsonValue;
+};
+export declare function cloneJsonValue(value: unknown, label?: string, seen?: Set<object>): JsonValue;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/core/schema.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,UAAU,CAAC,KAAK;IAC/B,KAAK,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAAC;IAC7B,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACnD;AAED,MAAM,MAAM,SAAS,GACjB,IAAI,GACJ,MAAM,GACN,MAAM,GACN,OAAO,GACP,SAAS,SAAS,EAAE,GACpB;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAE1C,wBAAgB,cAAc,CAC5B,KAAK,EAAE,OAAO,EACd,KAAK,GAAE,MAAgB,EACvB,IAAI,GAAE,GAAG,CAAC,MAAM,CAAa,GAC5B,SAAS,CAgCX"}

package/dist/core/schema.js

@@ -0,0 +1,36 @@
+export function cloneJsonValue(value, label = 'value', seen = new Set()) {
+    if (value === null || typeof value === 'string' || typeof value === 'boolean')
+        return value;
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value))
+            throw new TypeError(`${label} contains a non-finite number`);
+        return value;
+    }
+    if (typeof value !== 'object') {
+        throw new TypeError(`${label} contains a value that cannot be represented as JSON`);
+    }
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null && !Array.isArray(value)) {
+        throw new TypeError(`${label} contains a non-JSON object`);
+    }
+    if (Reflect.ownKeys(value).some((key) => typeof key === 'symbol')) {
+        throw new TypeError(`${label} contains a symbol property`);
+    }
+    if (seen.has(value))
+        throw new TypeError(`${label} contains a circular reference`);
+    seen.add(value);
+    let result;
+    if (Array.isArray(value)) {
+        result = Object.freeze(value.map((item) => cloneJsonValue(item, label, seen)));
+    }
+    else {
+        let copy = Object.create(null);
+        for (const [key, item] of Object.entries(value)) {
+            copy[key] = cloneJsonValue(item, label, seen);
+        }
+        result = Object.freeze(copy);
+    }
+    seen.delete(value);
+    return result;
+}
+//# sourceMappingURL=schema.js.map

package/dist/core/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/core/schema.ts"],"names":[],"mappings":"AAaA,MAAM,UAAU,cAAc,CAC5B,KAAc,EACd,KAAK,GAAW,OAAO,EACvB,IAAI,GAAgB,IAAI,GAAG,EAAE;IAE7B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5F,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,+BAA+B,CAAC,CAAC;QAC1F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,sDAAsD,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,SAAS,GAAY,MAAM,CAAC,cAAc,CAAC,KAAK,CAAY,CAAC;IACnE,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAoB,EAAW,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,KAAK,gCAAgC,CAAC,CAAC;IACnF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,IAAI,MAAiB,CAAC;IACtB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,MAAM,CAAC,MAAM,CACpB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAa,EAAa,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAC3E,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,IAAI,GAA8B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/discovery.d.ts

@@ -0,0 +1,16 @@
+import { type CapabilityDefinition } from './core/contracts.js';
+export type CapabilitySurface = 'browser' | 'cli' | 'http' | 'mcp';
+export type CapabilitySurfaceExposure = Partial<Readonly<Record<CapabilitySurface, {
+    readonly destructive?: readonly string[];
+}>>>;
+export type DiscoveryDenialReason = 'authorization-unavailable' | 'authorization-denied' | 'surface-not-exposed';
+export type DiscoveryDecision = {
+    readonly visible: true;
+} | {
+    readonly visible: false;
+    readonly reason: DiscoveryDenialReason;
+};
+export type CapabilityDiscoveryAuthorizer = (definition: CapabilityDefinition<unknown, unknown>) => boolean | Promise<boolean>;
+export declare function isDestructiveCapabilityExposed(definition: CapabilityDefinition<unknown, unknown>, surface: CapabilitySurface, exposure?: CapabilitySurfaceExposure): boolean;
+export declare function evaluateCapabilityDiscovery(definition: CapabilityDefinition<unknown, unknown>, surface: CapabilitySurface, exposure?: CapabilitySurfaceExposure, authorize?: CapabilityDiscoveryAuthorizer): Promise<DiscoveryDecision>;
+//# sourceMappingURL=discovery.d.ts.map

package/dist/discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEvF,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;AAEnE,MAAM,MAAM,yBAAyB,GAAG,OAAO,CAC7C,QAAQ,CACN,MAAM,CACJ,iBAAiB,EACjB;IACE,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C,CACF,CACF,CACF,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAC7B,2BAA2B,GAC3B,sBAAsB,GACtB,qBAAqB,CAAC;AAE1B,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GAC1B;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;CAAE,CAAC;AAExE,MAAM,MAAM,6BAA6B,GAAG,CAC1C,UAAU,EAAE,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,KAC/C,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,EAClD,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,CAAC,EAAE,yBAAyB,GACnC,OAAO,CAKT;AAED,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,EAClD,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,CAAC,EAAE,yBAAyB,EACpC,SAAS,CAAC,EAAE,6BAA6B,GACxC,OAAO,CAAC,iBAAiB,CAAC,CAgB5B"}

package/dist/discovery.js

@@ -0,0 +1,23 @@
+import { canonicalCapabilityId } from './core/contracts.js';
+export function isDestructiveCapabilityExposed(definition, surface, exposure) {
+    return (definition.risk !== 'destructive' ||
+        exposure?.[surface]?.destructive?.includes(canonicalCapabilityId(definition.identity)) === true);
+}
+export async function evaluateCapabilityDiscovery(definition, surface, exposure, authorize) {
+    if (!isDestructiveCapabilityExposed(definition, surface, exposure)) {
+        return { visible: false, reason: 'surface-not-exposed' };
+    }
+    const publicRead = definition.risk === 'read' && definition.access.kind === 'public';
+    if (authorize === undefined) {
+        return publicRead ? { visible: true } : { visible: false, reason: 'authorization-unavailable' };
+    }
+    try {
+        if (await authorize(definition))
+            return { visible: true };
+    }
+    catch {
+        return { visible: false, reason: 'authorization-denied' };
+    }
+    return { visible: false, reason: 'authorization-denied' };
+}
+//# sourceMappingURL=discovery.js.map

package/dist/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../src/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAA6B,MAAM,qBAAqB,CAAC;AA4BvF,MAAM,UAAU,8BAA8B,CAC5C,UAAkD,EAClD,OAA0B,EAC1B,QAAoC;IAEpC,OAAO,CACL,UAAU,CAAC,IAAI,KAAK,aAAa;QACjC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,qBAAqB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,CAChG,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,UAAkD,EAClD,OAA0B,EAC1B,QAAoC,EACpC,SAAyC;IAEzC,IAAI,CAAC,8BAA8B,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAC3D,CAAC;IAED,MAAM,UAAU,GAAY,UAAU,CAAC,IAAI,KAAK,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC;IAC9F,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAClG,CAAC;IAED,IAAI,CAAC;QACH,IAAI,MAAM,SAAS,CAAC,UAAU,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;AAC5D,CAAC"}

package/dist/doctor.d.ts

@@ -0,0 +1,200 @@
+import { type DiagnosticStatus } from './core/diagnostics.js';
+import type { CapabilityRegistry } from './core/registry.js';
+import { type CapabilityDiscoveryAuthorizer, type CapabilitySurface, type CapabilitySurfaceExposure } from './discovery.js';
+export type DoctorEvidenceKind = 'configured' | 'generated' | 'reachable' | 'protocol' | 'behavior';
+export type DoctorEvidenceSource = 'unspecified' | 'fixture' | 'mock' | 'real-host';
+export type DoctorFindingStatus = DiagnosticStatus | 'skipped';
+export type DoctorFindingSeverity = 'info' | 'warning' | 'error';
+export type DoctorExitCode = 0 | 1 | 2 | 3;
+export declare const DOCTOR_REPORT_SCHEMA_VERSION = "uan.doctor-report/v1";
+export declare const DOCTOR_REPORT_JSON_SCHEMA: Readonly<{
+    $schema: "https://json-schema.org/draft/2020-12/schema";
+    type: "object";
+    properties: {
+        schemaVersion: {
+            const: string;
+        };
+        profile: {
+            type: string;
+            properties: {
+                id: {
+                    type: string;
+                    pattern: string;
+                };
+                selectedCheckIds: {
+                    type: string;
+                    minItems: number;
+                    uniqueItems: boolean;
+                    items: {
+                        readonly type: 'string';
+                        readonly pattern: '^UAN-[0-9]{3}\\.[a-z0-9-]+$';
+                    };
+                };
+                requiredCheckIds: {
+                    type: string;
+                    uniqueItems: boolean;
+                    items: {
+                        readonly type: 'string';
+                        readonly pattern: '^UAN-[0-9]{3}\\.[a-z0-9-]+$';
+                    };
+                };
+            };
+            required: string[];
+            additionalProperties: boolean;
+        };
+        findings: {
+            type: string;
+            items: {
+                type: string;
+                properties: {
+                    checkId: {
+                        readonly type: 'string';
+                        readonly pattern: '^UAN-[0-9]{3}\\.[a-z0-9-]+$';
+                    };
+                    target: {
+                        type: string;
+                        minLength: number;
+                    };
+                    status: {
+                        enum: string[];
+                    };
+                    severity: {
+                        enum: string[];
+                    };
+                    timestamp: {
+                        type: string;
+                        minLength: number;
+                    };
+                    required: {
+                        type: string;
+                    };
+                    evidence: {
+                        type: string;
+                        properties: {
+                            kind: {
+                                enum: string[];
+                            };
+                            source: {
+                                enum: string[];
+                            };
+                            location: {
+                                type: string;
+                                minLength: number;
+                            };
+                            references: {
+                                type: string;
+                                items: {
+                                    type: string;
+                                    pattern: string;
+                                };
+                            };
+                        };
+                        required: string[];
+                        additionalProperties: boolean;
+                    };
+                    explanation: {
+                        type: string;
+                        minLength: number;
+                    };
+                    nextAction: {
+                        type: string;
+                        minLength: number;
+                    };
+                };
+                required: string[];
+                additionalProperties: boolean;
+            };
+        };
+        exitCode: {
+            type: string;
+            enum: number[];
+        };
+    };
+    required: string[];
+    additionalProperties: false;
+}>;
+export type DoctorEvidence = {
+    readonly kind: DoctorEvidenceKind;
+    readonly source: DoctorEvidenceSource;
+    readonly location: string;
+    readonly references: readonly string[];
+};
+export type DoctorFinding = {
+    readonly checkId: string;
+    readonly target: string;
+    readonly status: DoctorFindingStatus;
+    readonly severity: DoctorFindingSeverity;
+    readonly timestamp: string;
+    readonly required: boolean;
+    readonly evidence: DoctorEvidence;
+    readonly explanation: string;
+    readonly nextAction: string;
+};
+export type DoctorCheckResult = {
+    readonly status: DoctorFindingStatus;
+    readonly evidenceRefs?: readonly string[];
+};
+export type DoctorCheck = {
+    readonly checkId: string;
+    readonly target: string;
+    readonly required: boolean;
+    readonly severity: DoctorFindingSeverity;
+    readonly evidence: {
+        readonly kind: DoctorEvidenceKind;
+        readonly source?: DoctorEvidenceSource;
+        readonly location: string;
+    };
+    readonly explanations: Readonly<Record<DoctorFindingStatus, string>>;
+    readonly nextAction: string;
+    readonly observe: () => DoctorCheckResult | Promise<DoctorCheckResult>;
+};
+export type DoctorReport = {
+    readonly schemaVersion: typeof DOCTOR_REPORT_SCHEMA_VERSION;
+    readonly profile: DoctorCheckProfile;
+    readonly findings: readonly DoctorFinding[];
+    readonly exitCode: Exclude<DoctorExitCode, 2>;
+};
+export type DoctorCheckProfile = {
+    readonly id: string;
+    readonly selectedCheckIds: readonly string[];
+    readonly requiredCheckIds: readonly string[];
+};
+export type DoctorRunOptions = {
+    readonly now?: () => Date;
+    readonly profile?: DoctorCheckProfile;
+};
+export type RegistryInspection = {
+    readonly definitions: readonly {
+        readonly id: string;
+        readonly description: string;
+        readonly risk: 'read' | 'write' | 'destructive';
+        readonly access: {
+            readonly kind: 'public';
+        } | {
+            readonly kind: 'protected';
+            readonly scopes: readonly string[];
+        };
+    }[];
+    readonly bindings: readonly {
+        readonly id: string;
+        readonly capabilityId: string;
+        readonly targets: readonly ('browser' | 'server' | 'local')[];
+    }[];
+};
+export type AuthorizedCapability = RegistryInspection['definitions'][number] & {
+    readonly bindingIds: readonly string[];
+};
+export type AuthorizedCapabilityListOptions = {
+    readonly surface: CapabilitySurface;
+    readonly exposure?: CapabilitySurfaceExposure;
+    readonly authorize?: CapabilityDiscoveryAuthorizer;
+};
+export declare class DoctorUsageError extends TypeError {
+    readonly exitCode: 2;
+    constructor(message: string);
+}
+export declare function doctorExitCode(findings: readonly DoctorFinding[]): Exclude<DoctorExitCode, 2>;
+export declare function runDoctor(checks: readonly DoctorCheck[], options?: DoctorRunOptions): Promise<DoctorReport>;
+export declare function inspectCapabilityRegistry(registry: CapabilityRegistry): RegistryInspection;
+export declare function listAuthorizedCapabilities(registry: CapabilityRegistry, options: AuthorizedCapabilityListOptions): Promise<readonly AuthorizedCapability[]>;
+//# sourceMappingURL=doctor.d.ts.map

package/dist/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AACA,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAqB,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EACL,KAAK,6BAA6B,EAClC,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAG/B,MAAM,gBAAgB,CAAC;AAExB,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG,WAAW,GAAG,WAAW,GAAG,UAAU,GAAG,UAAU,CAAC;AACpG,MAAM,MAAM,oBAAoB,GAAG,aAAa,GAAG,SAAS,GAAG,MAAM,GAAG,WAAW,CAAC;AACpF,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,GAAG,SAAS,CAAC;AAC/D,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;AACjE,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC3C,eAAO,MAAM,4BAA4B,yBAAyB,CAAC;AAOnE,eAAO,MAAM,yBAAyB;;;;;;;;YAMhC,IAAI;YACJ,UAAU;gBACR,EAAE;oBAAI,IAAI;oBAAY,OAAO;;gBAC7B,gBAAgB;oBAAI,IAAI;oBAAW,QAAQ;oBAAK,WAAW;oBAAQ,KAAK;uCAbxE,QAAQ;0CACL,6BAA6B;;;gBAahC,gBAAgB;oBAAI,IAAI;oBAAW,WAAW;oBAAQ,KAAK;;;;;;YAE7D,QAAQ;YACR,oBAAoB;;;YAGpB,IAAI;YACJ,KAAK;gBACH,IAAI;gBACJ,UAAU;oBACR,OAAO;;;;oBACP,MAAM;wBAAI,IAAI;wBAAY,SAAS;;oBACnC,MAAM;wBAAI,IAAI;;oBACd,QAAQ;wBAAI,IAAI;;oBAChB,SAAS;wBAAI,IAAI;wBAAY,SAAS;;oBACtC,QAAQ;wBAAI,IAAI;;oBAChB,QAAQ;wBACN,IAAI;wBACJ,UAAU;4BACR,IAAI;gCAAI,IAAI;;4BACZ,MAAM;gCAAI,IAAI;;4BACd,QAAQ;gCAAI,IAAI;gCAAY,SAAS;;4BACrC,UAAU;gCACR,IAAI;gCACJ,KAAK;oCAAI,IAAI;oCAAY,OAAO;;;;wBAGpC,QAAQ;wBACR,oBAAoB;;oBAEtB,WAAW;wBAAI,IAAI;wBAAY,SAAS;;oBACxC,UAAU;wBAAI,IAAI;wBAAY,SAAS;;;gBAEzC,QAAQ;gBAWR,oBAAoB;;;;YAGZ,IAAI;YAAa,IAAI;;;;;EAInC,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IACzC,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;QAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;QACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,CAAC;IACrE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACxE,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,aAAa,EAAE,OAAO,4BAA4B,CAAC;IAC5D,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9C,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC;CACvC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,WAAW,EAAE,SAAS;QAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,aAAa,CAAC;QAChD,QAAQ,CAAC,MAAM,EACX;YAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;SAAE,GAC3B;YAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;YAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;SAAE,CAAC;KACxE,EAAE,CAAC;IACJ,QAAQ,CAAC,QAAQ,EAAE,SAAS;QAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC;KAC/D,EAAE,CAAC;CACL,CAAC;AAKF,MAAM,MAAM,oBAAoB,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,GAAG;IAC7E,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG;IAC5C,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,yBAAyB,CAAC;IAC9C,QAAQ,CAAC,SAAS,CAAC,EAAE,6BAA6B,CAAC;CACpD,CAAC;AAEF,qBAAa,gBAAiB,SAAQ,SAAS;IAC7C,SAAgB,QAAQ,EAAG,CAAC,CAAU;IAEtC,YAAmB,OAAO,EAAE,MAAM,EAGjC;CACF;AA8ED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAW7F;AAkDD,wBAAsB,SAAS,CAC7B,MAAM,EAAE,SAAS,WAAW,EAAE,EAC9B,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,YAAY,CAAC,CAmCvB;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,kBAAkB,CA4B1F;AAED,wBAAsB,0BAA0B,CAC9C,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAmD1C"}