capdag 1.226.626 → 1.240.679

package/capdag.js

@@ -615,7 +615,7 @@ class CapUrn {
       }
     }
 
-    // Output direction: provider output must conform to requested output.
+    // Output direction: candidate output must conform to requested output.
     // `media:` on the pattern side is wildcard top and skips the check.
     if (this.outSpec !== 'media:' && this.outSpec !== '*') {
       const capOut = MediaUrn.fromString(this.outSpec);
@@ -851,7 +851,7 @@ class CapUrn {
   }
 
   /**
-   * Check if this provider can dispatch the given request.
+   * Check if this candidate can dispatch the given request.
    *
    * @param {CapUrn} request
    * @returns {boolean}
@@ -1338,7 +1338,7 @@ const MEDIA_EMBEDDING_VECTOR = 'media:embedding-vector;enc=utf-8;record';
 // and `file-type=txt` (binds the URN to the `.txt` extension).
 const MEDIA_IMAGE_DESCRIPTION = 'media:enc=utf-8;ext=txt;image-description;plain-text';
 // Media URN for finalised plain text — the canonical input/output of cap:save-as-txt.
-// Producers of user-facing prose (LLM text-generation, OCR's extracted text,
+// Producers of user-facing prose (LLM text-generation, OCR's digitized text,
 // summarisation) declare this URN as their `out` so the planner restricts the .txt
 // persistence path to those caps. See fabric/media/plain-text.toml.
 const MEDIA_PLAIN_TEXT = 'media:enc=utf-8;ext=txt;plain-text';
@@ -2481,6 +2481,46 @@ class CapArg {
     return stdinSource ? stdinSource.stdin : null;
   }
 
+  /**
+   * The media URN the runtime demuxes this arg's input stream by: its
+   * stdin source URN if it declares one, otherwise its declared slot
+   * media URN. A cap need not declare any stdin source at all — a
+   * producer-fed arg may be delivered by its declared URN — so this
+   * never assumes a stdin source exists.
+   * Mirrors Rust: CapArg::stream_urn()
+   * @returns {string} The stream media URN
+   */
+  streamUrn() {
+    const stdinSource = this.sources.find(s => s.stdin !== null);
+    return stdinSource ? stdinSource.stdin : this.media_urn;
+  }
+
+  /**
+   * Whether this arg is the cap's MAIN input relative to `inSpec` (the cap
+   * URN's `in=` value): it declares a stdin source whose URN is `in=`. The
+   * main input is always the value piped in on stdin (like a Unix command's
+   * stdin), so the main arg always declares a stdin source carrying `in=`.
+   * Its DECLARED slot URN may differ from that stdin URN (e.g. a `file-path`
+   * slot whose piped content is a `pdf-stream`) — the stdin URN, not the
+   * slot URN, is `in=`. The main input may ALSO be delivered by
+   * position/cli-flag, but stdin is the defining route. Compared by
+   * tagged-URN equivalence, never as strings.
+   * Mirrors Rust: CapArg::is_main_input(&in_spec)
+   * @param {MediaUrn|string} inSpec - The cap URN's in= spec (parsed if given as string)
+   * @returns {boolean} True if this arg is the cap's main input
+   */
+  isMainInput(inSpec) {
+    const spec = inSpec instanceof MediaUrn ? inSpec : MediaUrn.fromString(inSpec);
+    return this.sources.some(s => {
+      if (s.stdin === null) return false;
+      try {
+        return MediaUrn.fromString(s.stdin).isEquivalent(spec);
+      } catch (_) {
+        return false;
+      }
+    });
+  }
+
   /**
    * Check if this argument has a position source
    * @returns {boolean} True if has position source
@@ -2530,21 +2570,22 @@ class Cap {
    * @param {Object|null} metadataJson - Optional arbitrary metadata as JSON object
    * @param {string|null} documentation - Optional long-form markdown documentation. Rendered in capability info panels, the cap navigator, capdag-dot-com, and anywhere else a rich-text explanation of the cap is useful.
    */
-  constructor(urn, title, command, capDescription = null, metadata = {}, metadataJson = null, documentation = null) {
+  constructor(urn, title, aliases, capDescription = null, metadata = {}, metadataJson = null, documentation = null) {
     if (!(urn instanceof CapUrn)) {
       throw new Error('URN must be a CapUrn instance');
     }
     if (!title || typeof title !== 'string') {
       throw new Error('Title is required and must be a string');
     }
-    if (!command || typeof command !== 'string') {
-      throw new Error('Command is required and must be a string');
+    if (!Array.isArray(aliases) || aliases.length === 0) {
+      throw new Error('Aliases are required and must be a non-empty array');
     }
 
     this.urn = urn;
     this.version = 0;
     this.title = title;
-    this.command = command;
+    this.aliases = aliases;
+    this.is_abstract = false;
     this.cap_description = capDescription;
     this.documentation = documentation;
     this.metadata = metadata || {};
@@ -2752,7 +2793,8 @@ class Cap {
 
     return this.urn.equals(other.urn) &&
            this.title === other.title &&
-           this.command === other.command &&
+           JSON.stringify([...this.aliases].sort()) === JSON.stringify([...other.aliases].sort()) &&
+           this.is_abstract === other.is_abstract &&
            this.cap_description === other.cap_description &&
            this.documentation === other.documentation &&
            JSON.stringify(this.metadata) === JSON.stringify(other.metadata) &&
@@ -2772,7 +2814,7 @@ class Cap {
     const result = {
       urn: this.urn.toString(),
       title: this.title,
-      command: this.command,
+      aliases: this.aliases,
       cap_description: this.cap_description,
       metadata: this.metadata,
       args: this.args.map(a => a.toJSON()),
@@ -2783,6 +2825,10 @@ class Cap {
       result.version = this.version;
     }
 
+    if (this.is_abstract) {
+      result.abstract = true;
+    }
+
     // Long-form markdown documentation. Only emitted when set, to match
     // the Rust serializer which skips this field when None.
     if (typeof this.documentation === 'string' && this.documentation.length > 0) {
@@ -2821,7 +2867,11 @@ class Cap {
     const documentation = (typeof json.documentation === 'string' && json.documentation.length > 0)
       ? json.documentation
       : null;
-    const cap = new Cap(urn, json.title, json.command, json.cap_description, json.metadata, json.metadata_json, documentation);
+    if (!Array.isArray(json.aliases) || json.aliases.length === 0) {
+      throw new Error(`cap '${json.urn}' must declare at least one alias (the 'aliases' field is required and non-empty)`);
+    }
+    const cap = new Cap(urn, json.title, json.aliases, json.cap_description, json.metadata, json.metadata_json, documentation);
+    cap.is_abstract = json.abstract === true;
     cap.version = (typeof json.version === 'number' && json.version !== 0) ? json.version : 0;
     // Parse args (new format)
     if (json.args && Array.isArray(json.args)) {
@@ -2910,7 +2960,7 @@ class CapGroup {
 }
 
 /**
- * Unified cap-based manifest for components (providers and cartridges).
+ * Unified cap-based manifest for components (cartridges).
  *
  * `(registry_url, channel, name, version)` is the cartridge's full
  * identity — each (registry, channel) pair is an independent namespace.
@@ -3046,20 +3096,20 @@ class CapManifest {
 /**
  * Helper functions for creating capabilities
  */
-function createCap(urn, title, command) {
-  return new Cap(urn, title, command);
+function createCap(urn, title, aliases) {
+  return new Cap(urn, title, aliases);
 }
 
-function createCapWithDescription(urn, title, command, description) {
-  return new Cap(urn, title, command, description);
+function createCapWithDescription(urn, title, aliases, description) {
+  return new Cap(urn, title, aliases, description);
 }
 
-function createCapWithMetadata(urn, title, command, metadata) {
-  return new Cap(urn, title, command, null, metadata);
+function createCapWithMetadata(urn, title, aliases, metadata) {
+  return new Cap(urn, title, aliases, null, metadata);
 }
 
-function createCapWithDescriptionAndMetadata(urn, title, command, description, metadata) {
-  return new Cap(urn, title, command, description, metadata);
+function createCapWithDescriptionAndMetadata(urn, title, aliases, description, metadata) {
+  return new Cap(urn, title, aliases, description, metadata);
 }
 
 // ============================================================================
@@ -3747,9 +3797,9 @@ class CapValidator {
       });
     }
 
-    if (!cap.command || typeof cap.command !== 'string') {
+    if (!Array.isArray(cap.aliases) || cap.aliases.length === 0) {
       throw new ValidationError('InvalidCapSchema', capUrn, {
-        issue: 'Cap must have a valid command'
+        issue: 'Cap must have at least one alias'
       });
     }
 
@@ -4355,37 +4405,55 @@ class CartridgeCapGroup {
 // in synchronous contexts must await.
 
 const DEV_SLUG = "dev";
-const SLUG_HEX_LEN = 16;
 
 /**
- * Compute the on-disk slug for a registry URL.
+ * The authority (host[:port]) of a registry URL: after `://` up to the next
+ * `/`, `?`, or `#` (path/query/fragment discarded).
+ */
+function authorityOfRegistryUrl(url) {
+  const i = url.indexOf("://");
+  const afterScheme = i >= 0 ? url.slice(i + 3) : url;
+  const m = afterScheme.search(/[/?#]/);
+  return m >= 0 ? afterScheme.slice(0, m) : afterScheme;
+}
+
+/**
+ * Compute the on-disk slug for a registry URL. Mirrors
+ * capdag::cartridge_slug::slug_for byte-for-byte: `DEV_SLUG` for null/undefined,
+ * otherwise a path-safe transform of the URL's authority (host[:port]) —
+ * ASCII-lowercased, every character outside `[a-z0-9.-]` replaced by `-`.
+ * Depends ONLY on the authority; path/version/query/trailing-slash/host-case
+ * do not change it.
  *
- * @param {string|null|undefined} registryUrl - The registry URL, or
- *   null/undefined for dev installs.
- * @returns {Promise<string>} The slug — `DEV_SLUG` for null,
- *   otherwise the first 16 lowercase-hex characters of
- *   sha256(registryUrl).
+ * @param {string|null|undefined} registryUrl
+ * @returns {string}
  */
-async function slugForRegistryUrl(registryUrl) {
+function slugForRegistryUrlSync(registryUrl) {
   if (registryUrl === null || registryUrl === undefined) {
     return DEV_SLUG;
   }
-  const bytes = new TextEncoder().encode(registryUrl);
-  // Web Crypto exposes SHA-256 via crypto.subtle. Node 16+ exposes
-  // it through globalThis.crypto.subtle.
-  const digestBuffer = await crypto.subtle.digest("SHA-256", bytes);
-  const digestBytes = new Uint8Array(digestBuffer);
-  let hex = "";
-  for (const b of digestBytes) {
-    hex += b.toString(16).padStart(2, "0");
+  let out = "";
+  for (const ch of authorityOfRegistryUrl(registryUrl)) {
+    const lc = ch >= "A" && ch <= "Z" ? ch.toLowerCase() : ch;
+    out += (lc >= "a" && lc <= "z") || (lc >= "0" && lc <= "9") || lc === "." || lc === "-" ? lc : "-";
   }
-  return hex.slice(0, SLUG_HEX_LEN);
+  return out;
+}
+
+/**
+ * Async wrapper retained for callers that `await` the slug. The computation is
+ * synchronous (no hashing) — the authority transform needs no crypto.
+ * @returns {Promise<string>}
+ */
+async function slugForRegistryUrl(registryUrl) {
+  return slugForRegistryUrlSync(registryUrl);
 }
 
 function isRegistrySlug(s) {
   return typeof s === "string"
-      && s.length === SLUG_HEX_LEN
-      && /^[0-9a-f]+$/.test(s);
+      && s.length > 0
+      && s !== DEV_SLUG
+      && /^[a-z0-9.-]+$/.test(s);
 }
 
 // =============================================================================
@@ -4744,6 +4812,18 @@ class CartridgeRepoClient {
     if (data.schemaVersion !== '5.0') {
       throw new Error(`Cartridge registry from ${repoUrl} has schemaVersion '${data.schemaVersion}'; required: 5.0`);
     }
+    // Cartridge registry regime version. v0 was the pre-versioning legacy at
+    // the bare /manifest path; this speaks only v1 at /v1/manifest. A manifest
+    // from a different regime version is rejected, not reinterpreted.
+    if (data.registryVersion !== 1) {
+      throw new Error(`Cartridge registry from ${repoUrl} has registryVersion '${data.registryVersion}'; this build speaks v1`);
+    }
+    // A cartridge registry must declare the fabric its caps resolve against. The
+    // client cross-checks this equals its own fabric (so every registry it uses
+    // shares one fabric); here we require it is at least present.
+    if (typeof data.fabricRegistryUrl !== 'string' || data.fabricRegistryUrl.length === 0) {
+      throw new Error(`Cartridge registry from ${repoUrl}: missing required 'fabricRegistryUrl' (the fabric its caps resolve against)`);
+    }
     // Self-referential check: the manifest declares its own URL via
     // `registryUrl`. It must match the URL we just fetched from
     // byte-for-byte — a mismatch is a manifest-corruption signal
@@ -5021,6 +5101,12 @@ class CartridgeRepoServer {
     if (this.registry.schemaVersion !== '5.0') {
       throw new Error(`Unsupported registry schema version: ${this.registry.schemaVersion}. Required: 5.0`);
     }
+    if (this.registry.registryVersion !== 1) {
+      throw new Error(`Unsupported cartridge registry version: ${this.registry.registryVersion}. This build speaks v1.`);
+    }
+    if (typeof this.registry.fabricRegistryUrl !== 'string' || this.registry.fabricRegistryUrl.length === 0) {
+      throw new Error('Registry must declare a non-empty `fabricRegistryUrl` (the fabric its caps resolve against)');
+    }
     if (typeof this.registry.registryUrl !== 'string' || this.registry.registryUrl.length === 0) {
       throw new Error('Registry must have a non-empty top-level `registryUrl` field (self-referential URL)');
     }
@@ -5240,7 +5326,7 @@ const CartridgeAttachmentErrorKind = Object.freeze({
   QUARANTINED: 'quarantined',
   // On-disk install context disagrees with the cartridge.json the cartridge
   // declares — the slug folder doesn't match slug_for(registry_url), the
-  // channel folder doesn't match the manifest's channel, or a bundled-provider
+  // channel folder doesn't match the manifest's channel, or a bundled-cartridge
   // integrity proof failed. Structurally well-formed but cannot be trusted
   // because its placement on disk does not match what it claims to be.
   BAD_INSTALLATION: 'bad_installation',
@@ -5450,24 +5536,15 @@ class InstalledCartridgeRecord {
 /**
  * Synchronous on-disk slug for a registry URL. Mirrors
  * capdag::bifaci::cartridge_slug::slug_for byte-for-byte: `null`/`undefined`
- * (a dev cartridge) → the literal `DEV_SLUG`; otherwise the first
- * SLUG_HEX_LEN lowercase-hex characters of sha256(url bytes).
- *
- * The async `slugForRegistryUrl` above uses Web Crypto for browser parity;
- * discovery runs only under Node and needs a synchronous slug in tight
- * per-file loops, so this uses Node's synchronous `crypto.createHash`. Both
- * produce identical output.
+ * (a dev cartridge) → the literal `DEV_SLUG`; otherwise a path-safe transform
+ * of the URL's authority (host[:port]). Identical output to the async
+ * `slugForRegistryUrl` above — no hashing, so both are trivially in sync.
  *
  * @param {string|null|undefined} registryUrl
  * @returns {string}
  */
 function slugForSync(registryUrl) {
-  if (registryUrl === null || registryUrl === undefined) {
-    return DEV_SLUG;
-  }
-  const crypto = require('crypto');
-  const hex = crypto.createHash('sha256').update(registryUrl, 'utf8').digest('hex');
-  return hex.slice(0, SLUG_HEX_LEN);
+  return slugForRegistryUrlSync(registryUrl);
 }
 
 /**
@@ -5780,49 +5857,49 @@ function hashCartridgeDirectory(dir) {
 }
 
 // ---------------------------------------------------------------------------
-// Bundled-provider integrity (non-macOS).
+// Bundled-cartridge integrity (non-macOS).
 // ---------------------------------------------------------------------------
 //
-// Mirrors capdag::cartridge_discovery::verify_bundled_provider_hash and the
-// BUNDLED_PROVIDER_HASHES const codegen'd by build.rs. Under a plain build —
-// and in this mirror, which bundles no providers — the set is empty, so any
+// Mirrors capdag::cartridge_discovery::verify_bundled_cartridge_hash and the
+// BUNDLED_CARTRIDGE_HASHES const codegen'd by build.rs. Under a plain build —
+// and in this mirror, which bundles no cartridges — the set is empty, so any
 // `installed_from: bundle` cartridge has no baked hash and is rejected.
-const BUNDLED_PROVIDER_HASHES = Object.freeze([]); // [name, version, hash] triples
+const BUNDLED_CARTRIDGE_HASHES = Object.freeze([]); // [name, version, hash] triples
 
 /**
- * Look up the baked expected directory hash for a bundled provider, or null if
+ * Look up the baked expected directory hash for a bundled cartridge, or null if
  * (name, version) was not recorded at build time.
  * @returns {string|null}
  */
-function bundledProviderExpectedHash(name, version) {
-  for (const [n, v, h] of BUNDLED_PROVIDER_HASHES) {
+function bundledCartridgeExpectedHash(name, version) {
+  for (const [n, v, h] of BUNDLED_CARTRIDGE_HASHES) {
     if (n === name && v === version) return h;
   }
   return null;
 }
 
 /**
- * Verify a bundled provider's on-disk content against the hash baked into this
+ * Verify a bundled cartridge's on-disk content against the hash baked into this
  * build. Returns null on success, or an error-reason string. Mirrors
- * verify_bundled_provider_hash. Non-macOS only: macOS bundled-provider
+ * verify_bundled_cartridge_hash. Non-macOS only: macOS bundled-cartridge
  * integrity is the OS code-signature, so the engine there neither bakes nor
  * checks these hashes.
  *
  * @returns {string|null} null on OK, else the failure reason.
  */
-function verifyBundledProviderHash(name, version, versionDir) {
-  const expected = bundledProviderExpectedHash(name, version);
+function verifyBundledCartridgeHash(name, version, versionDir) {
+  const expected = bundledCartridgeExpectedHash(name, version);
   if (expected === null) {
-    return `no baked hash for bundled provider ${name} ${version} — this build did not record it (MFR_BUNDLED_PROVIDER_HASHES)`;
+    return `no baked hash for bundled cartridge ${name} ${version} — this build did not record it (MFR_BUNDLED_CARTRIDGE_HASHES)`;
   }
   let actual;
   try {
     actual = hashCartridgeDirectory(versionDir);
   } catch (e) {
-    return `failed to hash bundled provider directory: ${e.message}`;
+    return `failed to hash bundled cartridge directory: ${e.message}`;
   }
   if (actual === expected) return null;
-  return `content hash mismatch — baked ${expected}, on-disk ${actual}; the shipped provider differs from what this build was compiled to ship`;
+  return `content hash mismatch — baked ${expected}, on-disk ${actual}; the shipped cartridge differs from what this build was compiled to ship`;
 }
 
 /**
@@ -5838,14 +5915,21 @@ class DiscoveryIdentity {
    * @param {string|null} opts.registryUrl - Some(url) for release/nightly
    *   hosts, null for dev hosts.
    * @param {number} opts.fabricManifestVersion
+   * @param {number} opts.cartridgeRegistryVersion - The registry regime version
+   *   this host speaks; an on-disk PATH level ({slug}/v{N}/{channel}/…), pinned
+   *   like the channel so a v1 host never scans a v2 tree.
    */
-  constructor({ channel, registryUrl, fabricManifestVersion }) {
+  constructor({ channel, registryUrl, fabricManifestVersion, cartridgeRegistryVersion }) {
     if (channel !== CartridgeChannel.Release && channel !== CartridgeChannel.Nightly) {
       throw new Error(`DiscoveryIdentity: invalid channel '${channel}'`);
     }
+    if (!Number.isInteger(cartridgeRegistryVersion) || cartridgeRegistryVersion < 1) {
+      throw new Error(`DiscoveryIdentity: cartridgeRegistryVersion must be an integer >= 1, got '${cartridgeRegistryVersion}'`);
+    }
     this.channel = channel;
     this.registryUrl = registryUrl !== undefined ? registryUrl : null;
     this.fabricManifestVersion = fabricManifestVersion;
+    this.cartridgeRegistryVersion = cartridgeRegistryVersion;
   }
 
   /** This host's own baked-registry slug (`dev` when registryUrl is null). */
@@ -5876,7 +5960,7 @@ function unixSecondsNow() {
 }
 
 // Default protocol limits / version, mirroring capdag::bifaci::frame.
-const BIFACI_PROTOCOL_VERSION = 3;
+const BIFACI_PROTOCOL_VERSION = 4;
 const BIFACI_DEFAULT_MAX_FRAME = 3670016;
 const BIFACI_DEFAULT_MAX_CHUNK = 262144;
 const BIFACI_DEFAULT_MAX_REORDER_BUFFER = 64;
@@ -6011,6 +6095,7 @@ function encodeHelloFrame() {
       ['max_reorder_buffer', BIFACI_DEFAULT_MAX_REORDER_BUFFER],
       ['initial_credit', BIFACI_DEFAULT_INITIAL_CREDIT],
       ['version', BIFACI_PROTOCOL_VERSION],
+      ['handler_capacity', 0],
     ],
   };
   const frame = {
@@ -6110,8 +6195,27 @@ function probeCartridgeCapGroups(entryPath) {
         finish(new Error(`cartridge ${entryPath} HELLO failed: expected HELLO, got frame_type ${frameType}`));
         return;
       }
+      const version = decoded.get(BIFACI_KEY_VERSION);
+      if (version !== BIFACI_PROTOCOL_VERSION) {
+        finish(new Error(`cartridge ${entryPath} HELLO failed: protocol version ${version} does not match required version ${BIFACI_PROTOCOL_VERSION}`));
+        return;
+      }
       const meta = decoded.get(BIFACI_KEY_META);
-      const manifestVal = meta instanceof Map ? meta.get('manifest') : undefined;
+      if (!(meta instanceof Map)) {
+        finish(new Error(`cartridge ${entryPath} HELLO failed: HELLO meta must be a map`));
+        return;
+      }
+      const metaVersion = meta.get('version');
+      if (metaVersion !== BIFACI_PROTOCOL_VERSION) {
+        finish(new Error(`cartridge ${entryPath} HELLO failed: meta.version ${metaVersion} does not match required version ${BIFACI_PROTOCOL_VERSION}`));
+        return;
+      }
+      const handlerCapacity = meta.get('handler_capacity');
+      if (!Number.isSafeInteger(handlerCapacity) || handlerCapacity < 0) {
+        finish(new Error(`cartridge ${entryPath} HELLO failed: missing required non-negative handler_capacity`));
+        return;
+      }
+      const manifestVal = meta.get('manifest');
       if (!manifestVal || manifestVal.__bytes === undefined) {
         finish(new Error(`cartridge ${entryPath} HELLO failed: Cartridge HELLO missing required manifest`));
         return;
@@ -6175,7 +6279,9 @@ async function discoverCartridges(cartridgesRoot, identity) {
       continue;
     }
     const expectedSlug = slugEntry.name;
-    const scanRoot = path.join(slugDir, identity.channel);
+    // {slug}/v{cartridgeRegistryVersion}/{channel}/… — the registry regime
+    // version is a path level pinned to the host's version (like the channel).
+    const scanRoot = path.join(slugDir, `v${identity.cartridgeRegistryVersion}`, identity.channel);
     let scanStat;
     try { scanStat = fs.statSync(scanRoot); } catch (_e) { continue; }
     if (!scanStat.isDirectory()) continue;
@@ -6324,7 +6430,7 @@ async function scanChannelRoot(scanRoot, expectedSlug, identity, discovered) {
       continue;
     }
 
-    // Bundled-provider integrity. A cartridge marked installed_from=bundle is
+    // Bundled-cartridge integrity. A cartridge marked installed_from=bundle is
     // shipped INSIDE this build and has no upstream registry to verify against,
     // so it needs its own integrity proof. Platform-split: on macOS the OS
     // code-signature is the guard (baked-hash verification intentionally
@@ -6332,7 +6438,7 @@ async function scanChannelRoot(scanRoot, expectedSlug, identity, discovered) {
     // value, else BadInstallation.
     if (cj.installedFrom === CartridgeInstallSource.BUNDLE) {
       if (process.platform !== 'darwin') {
-        const reason = verifyBundledProviderHash(cj.name, cj.version, versionDir);
+        const reason = verifyBundledCartridgeHash(cj.name, cj.version, versionDir);
         if (reason !== null) {
           discovered.push(DiscoveredCartridge.incompatible({
             version_dir: versionDir,
@@ -6342,7 +6448,7 @@ async function scanChannelRoot(scanRoot, expectedSlug, identity, discovered) {
             version: cj.version,
             error: new CartridgeAttachmentError(
               CartridgeAttachmentErrorKind.BAD_INSTALLATION,
-              `bundled provider integrity check failed: ${reason}`,
+              `bundled cartridge integrity check failed: ${reason}`,
               detectedAt
             ),
           }));
@@ -7425,7 +7531,8 @@ class FabricRegistryEntry {
   constructor(data) {
     this.urn = data.urn;
     this.title = data.title || '';
-    this.command = data.command || '';
+    this.aliases = data.aliases || [];
+    this.isAbstract = data.abstract === true;
     this.description = data.cap_description || '';
     this.args = data.args || [];
     this.output = data.output || null;
@@ -7880,8 +7987,30 @@ class Manifest {
   }
 }
 
+// Unified configurable planner vocabulary (mirrors Rust plan_space.rs and the
+// PlanMachines/DiscoverConvergentTargets proto surface).
+const planner = require('./planner.js');
+
 // Export for CommonJS
 module.exports = {
+  // Planner plan-space vocabulary
+  PlanStateError: planner.PlanStateError,
+  ConvergencePresence: planner.ConvergencePresence,
+  ConvergenceLocation: planner.ConvergenceLocation,
+  ConvergenceMechanism: planner.ConvergenceMechanism,
+  ConvergenceArity: planner.ConvergenceArity,
+  DivergencePresence: planner.DivergencePresence,
+  DivergenceLocation: planner.DivergenceLocation,
+  RankPolicy: planner.RankPolicy,
+  PlanMode: planner.PlanMode,
+  PlanRequest: planner.PlanRequest,
+  parsePlanApex: planner.parsePlanApex,
+  parsePlanProfile: planner.parsePlanProfile,
+  parsePlanCost: planner.parsePlanCost,
+  parsePlanCandidate: planner.parsePlanCandidate,
+  parsePlanCandidates: planner.parsePlanCandidates,
+  parseConvergentTarget: planner.parseConvergentTarget,
+  parseConvergentTargets: planner.parseConvergentTargets,
   ALIAS_TARGET_CAP,
   ALIAS_TARGET_MEDIA,
   tokenIsUrn,
@@ -8079,15 +8208,15 @@ module.exports = {
   CartridgeJsonError,
   CartridgeJson,
   hashCartridgeDirectory,
-  BUNDLED_PROVIDER_HASHES,
-  verifyBundledProviderHash,
+  BUNDLED_CARTRIDGE_HASHES,
+  verifyBundledCartridgeHash,
   DiscoveryIdentity,
   DiscoveredCartridge,
   probeCartridgeCapGroups,
   discoverCartridges,
   // Registry slug
   DEV_SLUG,
-  SLUG_HEX_LEN,
+  slugForRegistryUrlSync,
   slugForRegistryUrl,
   isRegistrySlug,
   // Machine notation