ws-spec-kit 0.1.0-beta.0

package/dist/registry/connectors/runtime.js

@@ -0,0 +1,127 @@
+import { constants, accessSync, realpathSync } from "node:fs";
+import path from "node:path";
+import { readGithubIssue } from "../../adapters/connectors/github-cli.js";
+import { readGitlabIssue } from "../../adapters/connectors/gitlab-cli.js";
+import { readFeishuDocument } from "../../adapters/connectors/lark-cli.js";
+function configuredPath(value) {
+    return value !== undefined && path.isAbsolute(value) && !value.includes("\0") ? value : undefined;
+}
+function locateExecutable(name) {
+    const directories = (process.env.PATH ?? "").split(path.delimiter).filter((entry) => path.isAbsolute(entry));
+    for (const directory of directories) {
+        const candidate = path.join(directory, name);
+        try {
+            accessSync(candidate, process.platform === "win32" ? constants.F_OK : constants.X_OK);
+            return realpathSync(candidate);
+        }
+        catch { }
+    }
+    return path.join(directories[0] ?? path.parse(process.cwd()).root, name);
+}
+export function createDefaultBuiltinConnectorRuntime(home) {
+    const environment = (specific) => ({
+        ...(configuredPath(home) === undefined ? {} : { HOME: configuredPath(home) }),
+        ...(configuredPath(process.env.XDG_CONFIG_HOME) === undefined ? {} : { XDG_CONFIG_HOME: configuredPath(process.env.XDG_CONFIG_HOME) }),
+        specific: configuredPath(specific),
+    });
+    const github = environment(process.env.GH_CONFIG_DIR);
+    const gitlab = environment(process.env.GLAB_CONFIG_DIR);
+    const feishu = environment(process.env.LARK_CONFIG_DIR);
+    return {
+        executables: {
+            git: locateExecutable("git"),
+            gh: locateExecutable("gh"),
+            glab: locateExecutable("glab"),
+            "lark-cli": locateExecutable("lark-cli"),
+        },
+        environments: {
+            github: { HOME: github.HOME, XDG_CONFIG_HOME: github.XDG_CONFIG_HOME, ...(github.specific === undefined ? {} : { GH_CONFIG_DIR: github.specific }) },
+            gitlab: { HOME: gitlab.HOME, XDG_CONFIG_HOME: gitlab.XDG_CONFIG_HOME, ...(gitlab.specific === undefined ? {} : { GLAB_CONFIG_DIR: gitlab.specific }) },
+            feishu: { HOME: feishu.HOME, XDG_CONFIG_HOME: feishu.XDG_CONFIG_HOME, ...(feishu.specific === undefined ? {} : { LARK_CONFIG_DIR: feishu.specific }) },
+        },
+        larkIdentity: "user",
+    };
+}
+export class ConnectorRuntimeError extends Error {
+    code;
+    constructor(code, message) {
+        super(`${code}: ${message}`);
+        this.code = code;
+        this.name = "ConnectorRuntimeError";
+    }
+}
+function invalid(message) {
+    throw new ConnectorRuntimeError("WSSPEC_SOURCE_INVALID", message);
+}
+function sourceUrl(source) {
+    if (source.url !== undefined && source.url !== source.id)
+        invalid("外部来源 id 与 url 必须引用同一规范目标。 ");
+    let parsed;
+    try {
+        parsed = new URL(source.id);
+    }
+    catch {
+        return invalid("外部来源 id 必须是规范 HTTPS URL。 ");
+    }
+    if (parsed.protocol !== "https:" || parsed.username !== "" || parsed.password !== ""
+        || parsed.port !== "" || parsed.search !== "" || parsed.hash !== "") {
+        return invalid("外部来源必须是不含认证信息、查询或片段的规范 HTTPS URL。 ");
+    }
+    return parsed;
+}
+function githubTarget(source) {
+    const url = sourceUrl(source);
+    const parts = url.pathname.split("/").filter(Boolean);
+    if (parts.length !== 4 || parts[2] !== "issues" || !/^[1-9][0-9]*$/u.test(parts[3])) {
+        return invalid("GitHub Issue 来源 URL 不符合 /owner/repo/issues/number。 ");
+    }
+    return { host: url.hostname, owner: parts[0], repo: parts[1], number: Number(parts[3]) };
+}
+function gitlabTarget(source) {
+    const url = sourceUrl(source);
+    const parts = url.pathname.split("/").filter(Boolean);
+    const marker = parts.lastIndexOf("-");
+    if (marker < 1 || parts[marker + 1] !== "issues" || marker + 3 !== parts.length
+        || !/^[1-9][0-9]*$/u.test(parts[marker + 2])) {
+        return invalid("GitLab Issue 来源 URL 不符合 /project/-/issues/iid。 ");
+    }
+    return { host: url.hostname, projectPath: parts.slice(0, marker).join("/"), iid: Number(parts[marker + 2]) };
+}
+export async function captureBuiltinConnectorSource(source, runtime) {
+    if (source.provider === "github" || source.provider === "github-cli") {
+        return readGithubIssue({
+            executable: runtime.executables.gh,
+            target: githubTarget(source),
+            ...(runtime.environments?.github === undefined ? {} : { environment: runtime.environments.github }),
+        });
+    }
+    if (source.provider === "gitlab" || source.provider === "gitlab-cli") {
+        return readGitlabIssue({
+            executable: runtime.executables.glab,
+            target: gitlabTarget(source),
+            ...(runtime.environments?.gitlab === undefined ? {} : { environment: runtime.environments.gitlab }),
+        });
+    }
+    if (source.provider === "feishu" || source.provider === "lark-cli") {
+        return readFeishuDocument({
+            executable: runtime.executables["lark-cli"],
+            document: sourceUrl(source).toString(),
+            identity: runtime.larkIdentity ?? "user",
+            ...(runtime.environments?.feishu === undefined ? {} : { environment: runtime.environments.feishu }),
+        });
+    }
+    throw new ConnectorRuntimeError("WSSPEC_CONNECTOR_PROVIDER_NOT_FOUND", `找不到需求来源 Provider ${source.provider}。`);
+}
+export async function normalizeBuiltinKnowledgeTarget(target, runtime) {
+    if (target.provider !== "feishu") {
+        throw new ConnectorRuntimeError("WSSPEC_CONNECTOR_PROVIDER_NOT_FOUND", `找不到 Knowledge 目标 Provider ${target.provider}。`);
+    }
+    const document = await readFeishuDocument({
+        executable: runtime.executables["lark-cli"],
+        document: target.document,
+        identity: runtime.larkIdentity ?? "user",
+        ...(runtime.environments?.feishu === undefined ? {} : { environment: runtime.environments.feishu }),
+    });
+    return { provider: "feishu", stableId: document.stableId, canonicalUrl: document.canonicalUrl };
+}
+//# sourceMappingURL=runtime.js.map

package/dist/registry/connectors/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../src/registry/connectors/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAoB3E,SAAS,cAAc,CAAC,KAAyB;IAC/C,OAAO,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACpG,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAwC;IAChE,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7G,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACtF,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,oCAAoC,CAAC,IAAY;IAC/D,MAAM,WAAW,GAAG,CAAC,QAA4B,EAAE,EAAE,CAAC,CAAC;QACrD,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QACtI,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC;KACnC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACxD,OAAO;QACL,WAAW,EAAE;YACX,GAAG,EAAE,gBAAgB,CAAC,KAAK,CAAC;YAC5B,EAAE,EAAE,gBAAgB,CAAC,IAAI,CAAC;YAC1B,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC;YAC9B,UAAU,EAAE,gBAAgB,CAAC,UAAU,CAAC;SACzC;QACD,YAAY,EAAE;YACZ,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE;YACpJ,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE;YACtJ,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE;SACvJ;QACD,YAAY,EAAE,MAAM;KACrB,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACzB;IAArB,YAAqB,IAAwB,EAAE,OAAe;QAC5D,KAAK,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QADV,SAAI,GAAJ,IAAI,CAAoB;QAE3C,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAiBD,SAAS,OAAO,CAAC,OAAe;IAC9B,MAAM,IAAI,qBAAqB,CAAC,uBAAuB,EAAE,OAAO,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,SAAS,CAAC,MAA0D;IAC3E,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,EAAE;QAAE,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAChG,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;IACpC,MAAM,CAAC;QAAC,OAAO,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAAC,CAAC;IACtD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE;WAC/E,MAAM,CAAC,IAAI,KAAK,EAAE,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE,EAAE,CAAC;QACtE,OAAO,OAAO,CAAC,oCAAoC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,MAA0D;IAC9E,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;QACrF,OAAO,OAAO,CAAC,qDAAqD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED,SAAS,YAAY,CAAC,MAA0D;IAC9E,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,QAAQ,IAAI,MAAM,GAAG,CAAC,KAAK,KAAK,CAAC,MAAM;WAC1E,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,EAAE,CAAC;QAChD,OAAO,OAAO,CAAC,iDAAiD,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,MAA0D,EAC1D,OAAgC;IAEhC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QACrE,OAAO,eAAe,CAAC;YACrB,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE;YAClC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC;YAC5B,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;SACpG,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QACrE,OAAO,eAAe,CAAC;YACrB,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,IAAI;YACpC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC;YAC5B,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;SACpG,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnE,OAAO,kBAAkB,CAAC;YACxB,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC;YAC3C,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;YACtC,QAAQ,EAAE,OAAO,CAAC,YAAY,IAAI,MAAM;YACxC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;SACpG,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,qBAAqB,CAAC,qCAAqC,EAAE,oBAAoB,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;AACjH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,MAAmC,EACnC,OAAgC;IAEhC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,qBAAqB,CAAC,qCAAqC,EAAE,6BAA6B,MAAM,CAAC,QAAkB,GAAG,CAAC,CAAC;IACpI,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC;QACxC,UAAU,EAAE,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC;QAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,OAAO,CAAC,YAAY,IAAI,MAAM;QACxC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;KACpG,CAAC,CAAC;IACH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAa,EAAE,CAAC;AACnG,CAAC"}

package/dist/registry/connectors/secret-detector.d.ts

@@ -0,0 +1,19 @@
+export declare function credentialLikeKey(value: string): boolean;
+export declare function credentialLikeValue(value: string): boolean;
+export declare function credentialLikeField(value: string): boolean;
+export type DecodedCredentialSurfaceResult = Readonly<{
+    ok: true;
+    value: string;
+}> | Readonly<{
+    ok: false;
+    reason: "credential" | "decode-limit" | "invalid-encoding" | "too-large";
+}>;
+export declare function inspectDecodedCredentialSurface(surface: string, options?: Readonly<{
+    detectCredentialKeys?: boolean;
+    maximumBytes?: number;
+    maximumDecodeRounds?: number;
+}>): DecodedCredentialSurfaceResult;
+export declare function inspectDecodedCredentialText(text: string, options: Readonly<{
+    maximumBytes: number;
+    maximumDecodeRounds?: number;
+}>): DecodedCredentialSurfaceResult;

package/dist/registry/connectors/secret-detector.js

@@ -0,0 +1,85 @@
+const tokenFamily = /(?:github_pat_[A-Za-z0-9_]{16,}|gh[pousr]_[A-Za-z0-9]{16,}|glpat-[A-Za-z0-9_-]{12,}|xox[a-z]-[A-Za-z0-9-]{8,}|xapp-[A-Za-z0-9-]{8,}|xoxe(?:\.xox[a-z])?-[A-Za-z0-9-]{8,})/iu;
+const credentialHeader = /\b(?:authorization|cookie|set-cookie)\s*[:=]\s*\S/iu;
+const authorizationScheme = /\b(?:bearer|basic)\s+[A-Za-z0-9+/=._~-]{4,}/iu;
+const labelledSecret = /\b(?:api[-_ ]?key|client[-_ ]?secret|credential|password|private[-_ ]?key|refresh[-_ ]?token|session(?:id)?|secret|token)\s*[:=]\s*\S/iu;
+const larkTokenCandidate = /(?:^|[^A-Za-z0-9])([tua]-[A-Za-z0-9_-]{24,})(?=$|[^A-Za-z0-9])/gu;
+const invalidPercentEscape = /%(?![A-Fa-f0-9]{2})/u;
+const defaultMaximumSurfaceBytes = 8_192;
+const defaultMaximumDecodeRounds = 4;
+function shannonEntropy(value) {
+    const frequencies = new Map();
+    for (const character of value)
+        frequencies.set(character, (frequencies.get(character) ?? 0) + 1);
+    return [...frequencies.values()].reduce((entropy, count) => {
+        const probability = count / value.length;
+        return entropy - probability * Math.log2(probability);
+    }, 0);
+}
+function larkAccessToken(value) {
+    for (const match of value.matchAll(larkTokenCandidate)) {
+        const token = match[1];
+        if (shannonEntropy(token.slice(2)) >= 3)
+            return true;
+    }
+    return false;
+}
+export function credentialLikeKey(value) {
+    const normalized = value.replace(/[^A-Za-z0-9]/gu, "").toLowerCase();
+    return ["authorization", "basic", "bearer", "cookie", "setcookie", "credential", "password", "privatekey", "session", "sessionid", "secret"].includes(normalized)
+        || normalized.endsWith("token")
+        || normalized.endsWith("password")
+        || normalized.endsWith("secret")
+        || normalized.endsWith("apikey")
+        || normalized.endsWith("privatekey");
+}
+export function credentialLikeValue(value) {
+    return tokenFamily.test(value)
+        || larkAccessToken(value)
+        || credentialHeader.test(value)
+        || authorizationScheme.test(value)
+        || labelledSecret.test(value);
+}
+export function credentialLikeField(value) {
+    return credentialLikeKey(value) || credentialLikeValue(value);
+}
+export function inspectDecodedCredentialSurface(surface, options = {}) {
+    const maximumBytes = options.maximumBytes ?? defaultMaximumSurfaceBytes;
+    const maximumDecodeRounds = options.maximumDecodeRounds ?? defaultMaximumDecodeRounds;
+    const detector = options.detectCredentialKeys === true ? credentialLikeField : credentialLikeValue;
+    let current = surface;
+    for (let round = 0; round <= maximumDecodeRounds; round += 1) {
+        if (Buffer.byteLength(current, "utf8") > maximumBytes)
+            return { ok: false, reason: "too-large" };
+        if (detector(current))
+            return { ok: false, reason: "credential" };
+        if (!current.includes("%"))
+            return { ok: true, value: current };
+        if (invalidPercentEscape.test(current))
+            return { ok: false, reason: "invalid-encoding" };
+        if (round === maximumDecodeRounds)
+            return { ok: false, reason: "decode-limit" };
+        try {
+            current = decodeURIComponent(current);
+        }
+        catch {
+            return { ok: false, reason: "invalid-encoding" };
+        }
+    }
+    return { ok: false, reason: "decode-limit" };
+}
+export function inspectDecodedCredentialText(text, options) {
+    const inspect = (surface) => inspectDecodedCredentialSurface(surface, {
+        maximumBytes: options.maximumBytes,
+        ...(options.maximumDecodeRounds === undefined ? {} : { maximumDecodeRounds: options.maximumDecodeRounds }),
+    });
+    const complete = inspect(text);
+    if (!complete.ok)
+        return complete;
+    for (const line of text.split(/\r\n?|\n/gu)) {
+        const inspected = inspect(line);
+        if (!inspected.ok)
+            return inspected;
+    }
+    return { ok: true, value: text };
+}
+//# sourceMappingURL=secret-detector.js.map

package/dist/registry/connectors/secret-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-detector.js","sourceRoot":"","sources":["../../../src/registry/connectors/secret-detector.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,GAAG,6KAA6K,CAAC;AAClM,MAAM,gBAAgB,GAAG,qDAAqD,CAAC;AAC/E,MAAM,mBAAmB,GAAG,+CAA+C,CAAC;AAC5E,MAAM,cAAc,GAAG,yIAAyI,CAAC;AACjK,MAAM,kBAAkB,GAAG,kEAAkE,CAAC;AAC9F,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AACpD,MAAM,0BAA0B,GAAG,KAAK,CAAC;AACzC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAErC,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC9C,KAAK,MAAM,SAAS,IAAI,KAAK;QAAE,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjG,OAAO,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;QACzD,MAAM,WAAW,GAAG,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC;QACzC,OAAO,OAAO,GAAG,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxD,CAAC,EAAE,CAAC,CAAC,CAAC;AACR,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACxB,IAAI,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,OAAO,CAAC,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;WAC5J,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;WAC5B,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;WAC/B,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;WAC7B,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;WAC7B,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;WACzB,eAAe,CAAC,KAAK,CAAC;WACtB,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;WAC5B,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;WAC/B,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,OAAO,iBAAiB,CAAC,KAAK,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAMD,MAAM,UAAU,+BAA+B,CAC7C,OAAe,EACf,UAA6G,EAAE;IAE/G,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,0BAA0B,CAAC;IACxE,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,0BAA0B,CAAC;IACtF,MAAM,QAAQ,GAAG,OAAO,CAAC,oBAAoB,KAAK,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,mBAAmB,CAAC;IACnG,IAAI,OAAO,GAAG,OAAO,CAAC;IACtB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,mBAAmB,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC7D,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,YAAY;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACjG,IAAI,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QAClE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAChE,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACzF,IAAI,KAAK,KAAK,mBAAmB;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAChF,IAAI,CAAC;YACH,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACnD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,IAAY,EACZ,OAAyE;IAEzE,MAAM,OAAO,GAAG,CAAC,OAAe,EAAkC,EAAE,CAAC,+BAA+B,CAAC,OAAO,EAAE;QAC5G,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,GAAG,CAAC,OAAO,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC;KAC3G,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;IACtC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACnC,CAAC"}

package/dist/registry/connectors/semver.d.ts

@@ -0,0 +1,8 @@
+export interface SemVer {
+    source: string;
+    core: readonly [bigint, bigint, bigint];
+    prerelease: readonly string[];
+}
+export declare function parseSemVer(value: string): SemVer | undefined;
+export declare function extractSemVer(value: string): SemVer | undefined;
+export declare function compareSemVer(left: SemVer, right: SemVer): number;

package/dist/registry/connectors/semver.js

@@ -0,0 +1,57 @@
+const exactSemVer = /^([0-9]+)\.([0-9]+)\.([0-9]+)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/u;
+const semverCandidate = /(?:^|[^0-9A-Za-z-])([0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)(?![0-9A-Za-z.+-])/gu;
+function hasLeadingZero(value) {
+    return value.length > 1 && value.startsWith("0");
+}
+export function parseSemVer(value) {
+    const match = exactSemVer.exec(value);
+    if (match === null)
+        return undefined;
+    const coreParts = [match[1], match[2], match[3]];
+    if (coreParts.some(hasLeadingZero))
+        return undefined;
+    const prerelease = match[4] === undefined ? [] : match[4].split(".");
+    if (prerelease.some((part) => /^\d+$/u.test(part) && hasLeadingZero(part)))
+        return undefined;
+    return { source: value, core: coreParts.map((part) => BigInt(part)), prerelease };
+}
+export function extractSemVer(value) {
+    for (const match of value.matchAll(semverCandidate)) {
+        const parsed = parseSemVer(match[1]);
+        if (parsed !== undefined)
+            return parsed;
+    }
+    return undefined;
+}
+function compareIdentifier(left, right) {
+    const leftNumeric = /^\d+$/u.test(left);
+    const rightNumeric = /^\d+$/u.test(right);
+    if (leftNumeric && rightNumeric) {
+        const leftValue = BigInt(left);
+        const rightValue = BigInt(right);
+        return leftValue < rightValue ? -1 : leftValue > rightValue ? 1 : 0;
+    }
+    if (leftNumeric !== rightNumeric)
+        return leftNumeric ? -1 : 1;
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+export function compareSemVer(left, right) {
+    for (let index = 0; index < 3; index += 1) {
+        if (left.core[index] !== right.core[index])
+            return left.core[index] < right.core[index] ? -1 : 1;
+    }
+    if (left.prerelease.length === 0 || right.prerelease.length === 0) {
+        return left.prerelease.length === right.prerelease.length ? 0 : left.prerelease.length === 0 ? 1 : -1;
+    }
+    for (let index = 0; index < Math.max(left.prerelease.length, right.prerelease.length); index += 1) {
+        const leftPart = left.prerelease[index];
+        const rightPart = right.prerelease[index];
+        if (leftPart === undefined || rightPart === undefined)
+            return leftPart === undefined ? -1 : 1;
+        const compared = compareIdentifier(leftPart, rightPart);
+        if (compared !== 0)
+            return compared;
+    }
+    return 0;
+}
+//# sourceMappingURL=semver.js.map

package/dist/registry/connectors/semver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semver.js","sourceRoot":"","sources":["../../../src/registry/connectors/semver.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,GAAG,oHAAoH,CAAC;AACzI,MAAM,eAAe,GAAG,0GAA0G,CAAC;AAEnI,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,KAAK,CAAC,CAAC,CAAE,CAAU,CAAC;IAC7D,IAAI,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrE,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7F,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAA8B,EAAE,UAAU,EAAE,CAAC;AACjH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAAa;IACpD,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,WAAW,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,WAAW,KAAK,YAAY;QAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,KAAa;IACvD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAE,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAE;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAE,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxG,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAClG,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9F,MAAM,QAAQ,GAAG,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;IACtC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/registry/connectors/types.d.ts

@@ -0,0 +1,45 @@
+export type ConnectorSecurityClass = "external-read" | "external-write" | "local-write";
+export type ConnectorExecutable = "git" | "gh" | "glab" | "lark-cli";
+export type ConnectorEnvironmentKey = "HOME" | "XDG_CONFIG_HOME" | "GH_CONFIG_DIR" | "GLAB_CONFIG_DIR" | "LARK_CONFIG_DIR";
+export type DoctorVersionParser = {
+    kind: "text-semver";
+};
+export type DoctorAuthUnavailableReasonCode = "WSSPEC_CONNECTOR_AUTH_PROBE_UNAVAILABLE";
+export interface DoctorVersionProbe {
+    kind: "version";
+    argv: readonly string[];
+    parser: DoctorVersionParser;
+}
+export type DoctorAuthProbe = {
+    kind: "none";
+} | {
+    kind: "unavailable";
+    reasonCode: DoctorAuthUnavailableReasonCode;
+} | {
+    kind: "auth";
+    argv: readonly string[];
+    parser: {
+        kind: "exit-code";
+    };
+    outcomes: {
+        authenticated: readonly number[];
+        unauthenticated: readonly number[];
+    };
+};
+export interface ConnectorManifest {
+    id: string;
+    capabilities: string[];
+    securityClass: ConnectorSecurityClass;
+    executable: ConnectorExecutable;
+    minimumVersion: string;
+    argvTemplates: readonly (readonly string[])[];
+    doctor: {
+        version: DoctorVersionProbe;
+        auth: DoctorAuthProbe;
+    };
+    envPolicy: {
+        allow: readonly ConnectorEnvironmentKey[];
+    };
+    timeoutMs: number;
+    maxStdoutBytes: number;
+}

package/dist/registry/connectors/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/registry/connectors/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/registry/connectors/types.ts"],"names":[],"mappings":""}

package/dist/registry/executors/registry.d.ts

@@ -0,0 +1,15 @@
+import type { CompiledStep } from "../../domain/workflow.js";
+import type { StepExecutor } from "./types.js";
+export declare class ExecutorRegistryError extends Error {
+    readonly code: `WSSPEC_${string}`;
+    constructor(code: `WSSPEC_${string}`, message: string);
+}
+export declare function executorId(step: Pick<CompiledStep, "uses" | "action">): string;
+export declare class ExecutorRegistry {
+    #private;
+    register(value: StepExecutor): this;
+    require(id: string): StepExecutor;
+    assertStep(step: Pick<CompiledStep, "uses" | "action" | "securityClass">): StepExecutor;
+}
+export declare function createDefaultExecutorRegistry(): ExecutorRegistry;
+export type { StepExecutor } from "./types.js";

package/dist/registry/executors/registry.js

@@ -0,0 +1,68 @@
+export class ExecutorRegistryError extends Error {
+    code;
+    constructor(code, message) {
+        super(`${code}: ${message}`);
+        this.code = code;
+        this.name = "ExecutorRegistryError";
+    }
+}
+export function executorId(step) {
+    return step.action === undefined ? step.uses : `${step.uses}/${step.action}`;
+}
+function workPackage(runtime, stepId) {
+    const value = runtime.contexts[stepId];
+    if (value?.workPackage === undefined) {
+        throw new ExecutorRegistryError("WSSPEC_EXECUTOR_CONTEXT_INVALID", `Step ${stepId} 缺少原子 Acquire 创建的 Work Package。`);
+    }
+    return value.workPackage;
+}
+function executor(id, securityClass) {
+    return {
+        id,
+        securityClass,
+        async acquire(step, runtime) {
+            return { action: "execute", workPackage: workPackage(runtime, step.id) };
+        },
+        async validate(_step, result) {
+            return result.status === "failed"
+                ? { status: "failed", artifacts: result.artifacts, failureCode: "WSSPEC_STEP_FAILED" }
+                : { status: "completed", artifacts: result.artifacts };
+        },
+    };
+}
+export class ExecutorRegistry {
+    #executors = new Map();
+    register(value) {
+        if (this.#executors.has(value.id)) {
+            throw new ExecutorRegistryError("WSSPEC_EXECUTOR_DUPLICATE", `Executor ${value.id} 已注册。`);
+        }
+        this.#executors.set(value.id, value);
+        return this;
+    }
+    require(id) {
+        const value = this.#executors.get(id);
+        if (value === undefined)
+            throw new ExecutorRegistryError("WSSPEC_EXECUTOR_NOT_FOUND", `找不到 Executor ${id}。`);
+        return value;
+    }
+    assertStep(step) {
+        const value = this.require(executorId(step));
+        if (value.securityClass !== step.securityClass) {
+            throw new ExecutorRegistryError("WSSPEC_EXECUTOR_SECURITY_MISMATCH", `Executor ${value.id} 的安全类别与编译结果不一致。`);
+        }
+        return value;
+    }
+}
+export function createDefaultExecutorRegistry() {
+    return new ExecutorRegistry()
+        .register(executor("agent.execute", "agent"))
+        .register(executor("connector.execute/requirement.capture", "external-read"))
+        .register(executor("connector.execute/git.commit", "local-write"))
+        .register(executor("connector.execute/issue.update", "external-write"))
+        .register(executor("connector.execute/knowledge.publish", "external-write"))
+        .register(executor("connector.execute/issue.close", "external-write"))
+        .register(executor("command.execute/quality.test", "local-write"))
+        .register(executor("control.loop", "control"))
+        .register(executor("control.close", "control"));
+}
+//# sourceMappingURL=registry.js.map

package/dist/registry/executors/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/registry/executors/registry.ts"],"names":[],"mappings":"AAMA,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACzB;IAArB,YAAqB,IAAwB,EAAE,OAAe;QAC5D,KAAK,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QADV,SAAI,GAAJ,IAAI,CAAoB;QAE3C,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,MAAM,UAAU,UAAU,CAAC,IAA2C;IACpE,OAAO,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,WAAW,CAAC,OAA0B,EAAE,MAAc;IAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8C,CAAC;IACpF,IAAI,KAAK,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,IAAI,qBAAqB,CAAC,iCAAiC,EAAE,QAAQ,MAAM,iCAAiC,CAAC,CAAC;IACtH,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,CAAC;AAC3B,CAAC;AAED,SAAS,QAAQ,CAAC,EAAU,EAAE,aAA4B;IACxD,OAAO;QACL,EAAE;QACF,aAAa;QACb,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO;YACzB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3E,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM;YAC1B,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;gBAC/B,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,oBAAoB,EAAE;gBACtF,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QAC3D,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,gBAAgB;IAClB,UAAU,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEtD,QAAQ,CAAC,KAAmB;QAC1B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,qBAAqB,CAAC,2BAA2B,EAAE,YAAY,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CAAC,EAAU;QAChB,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,qBAAqB,CAAC,2BAA2B,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;QAC7G,OAAO,KAAK,CAAC;IACf,CAAC;IAED,UAAU,CAAC,IAA6D;QACtE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YAC/C,MAAM,IAAI,qBAAqB,CAAC,mCAAmC,EAAE,YAAY,KAAK,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAC9G,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,MAAM,UAAU,6BAA6B;IAC3C,OAAO,IAAI,gBAAgB,EAAE;SAC1B,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;SAC5C,QAAQ,CAAC,QAAQ,CAAC,uCAAuC,EAAE,eAAe,CAAC,CAAC;SAC5E,QAAQ,CAAC,QAAQ,CAAC,8BAA8B,EAAE,aAAa,CAAC,CAAC;SACjE,QAAQ,CAAC,QAAQ,CAAC,gCAAgC,EAAE,gBAAgB,CAAC,CAAC;SACtE,QAAQ,CAAC,QAAQ,CAAC,qCAAqC,EAAE,gBAAgB,CAAC,CAAC;SAC3E,QAAQ,CAAC,QAAQ,CAAC,+BAA+B,EAAE,gBAAgB,CAAC,CAAC;SACrE,QAAQ,CAAC,QAAQ,CAAC,8BAA8B,EAAE,aAAa,CAAC,CAAC;SACjE,QAAQ,CAAC,QAAQ,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;SAC7C,QAAQ,CAAC,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC,CAAC;AACpD,CAAC"}

package/dist/registry/executors/types.d.ts

@@ -0,0 +1,19 @@
+import type { CompiledStep, SecurityClass } from "../../domain/workflow.js";
+import type { AgentAction, StepFailureCode, SubmitResult } from "../../protocol/application.js";
+import type { ArtifactReference } from "../../protocol/work-package.js";
+import type { RuntimeProjection } from "../../storage/control-plane.js";
+export type ValidatedStepResult = {
+    status: "completed";
+    artifacts: ArtifactReference[];
+    failureCode?: never;
+} | {
+    status: "failed";
+    artifacts: ArtifactReference[];
+    failureCode: StepFailureCode;
+};
+export interface StepExecutor {
+    id: string;
+    securityClass: SecurityClass;
+    acquire(step: CompiledStep, runtime: RuntimeProjection): Promise<AgentAction>;
+    validate(step: CompiledStep, result: SubmitResult, runtime: RuntimeProjection): Promise<ValidatedStepResult>;
+}

package/dist/registry/executors/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/registry/executors/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/registry/executors/types.ts"],"names":[],"mappings":""}

package/dist/registry/skills/lock.d.ts

@@ -0,0 +1,3 @@
+import type { ResolvedSkill, SkillLock } from "./types.js";
+export declare function parseSkillLock(value: unknown): SkillLock;
+export declare function createSkillLock(resolved: ResolvedSkill | readonly ResolvedSkill[]): SkillLock;