@agent-surface/compiler 0.18.0 → 0.19.1

package/dist/chunk-BNIUE5RA.js

@@ -0,0 +1,746 @@
+// src/compile.ts
+import { resolve as resolve3 } from "path";
+import { build } from "vite";
+
+// src/plugin.ts
+import { existsSync, readFileSync } from "fs";
+import { dirname, isAbsolute, join, relative as relative2, resolve as resolve2, sep } from "path";
+import {
+  DEFAULT_LIMITS,
+  parseCapabilityId,
+  validateJsonSchemaDocument
+} from "@agent-surface/core";
+
+// src/canonical.ts
+import { createHash } from "crypto";
+function normalize(value) {
+  if (Array.isArray(value)) return value.map(normalize);
+  if (typeof value !== "object" || value === null) return value;
+  return Object.fromEntries(
+    Object.entries(value).filter(([, entry]) => entry !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, entry]) => [key, normalize(entry)])
+  );
+}
+function canonicalJson(value, pretty = false) {
+  return `${JSON.stringify(normalize(value), null, pretty ? 2 : void 0)}
+`;
+}
+function sha256(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+function manifestPayload(manifest) {
+  const { hash: _hash, ...payload } = manifest;
+  return payload;
+}
+function computeManifestHash(manifest) {
+  return sha256(canonicalJson(manifestPayload(manifest)));
+}
+function canonicalManifestJson(manifest) {
+  return canonicalJson(manifest, true);
+}
+function verifyManifest(manifest) {
+  if (computeManifestHash(manifest) !== manifest.hash) {
+    throw new Error(`capability contract hash mismatch: ${manifest.hash}`);
+  }
+}
+
+// src/extract.ts
+import { posix, relative, resolve } from "path";
+import ts from "typescript";
+var CORE = "@agent-surface/core";
+var COMPONENT_MACRO = "defineAgentComponentContract";
+var PROCEDURE_MACRO = "defineAgentProcedureContract";
+var EXTERNAL_MACRO = "defineExternalAgentToolContract";
+var WRAPPERS = /* @__PURE__ */ new Set([
+  "observationContract",
+  "actionContract",
+  "fromJsonSchema",
+  "defineAgentComponentContract",
+  "defineAgentProcedureContract",
+  "defineExternalAgentToolContract"
+]);
+function sourceKind(id) {
+  if (/\.tsx(?:\?|$)/.test(id)) return ts.ScriptKind.TSX;
+  if (/\.jsx(?:\?|$)/.test(id)) return ts.ScriptKind.JSX;
+  if (/\.js(?:\?|$)/.test(id)) return ts.ScriptKind.JS;
+  return ts.ScriptKind.TS;
+}
+function unwrap(node) {
+  while (ts.isParenthesizedExpression(node) || ts.isAsExpression(node) || ts.isTypeAssertionExpression(node) || ts.isSatisfiesExpression(node) || ts.isNonNullExpression(node)) {
+    node = node.expression;
+  }
+  return node;
+}
+function propertyName(node) {
+  if (ts.isIdentifier(node) || ts.isStringLiteral(node) || ts.isNumericLiteral(node)) {
+    return node.text;
+  }
+  if (ts.isComputedPropertyName(node) && ts.isStringLiteral(unwrap(node.expression))) {
+    return unwrap(node.expression).text;
+  }
+  return void 0;
+}
+function calleeName(node) {
+  node = unwrap(node);
+  if (ts.isIdentifier(node)) return node.text;
+  if (ts.isPropertyAccessExpression(node)) return node.name.text;
+  if (ts.isElementAccessExpression(node) && node.argumentExpression && ts.isStringLiteral(unwrap(node.argumentExpression))) {
+    return unwrap(node.argumentExpression).text;
+  }
+  return void 0;
+}
+function normalizedOrigin(root, id) {
+  const clean = id.replace(/^\0/, "virtual:").split("?")[0];
+  if (clean.startsWith("virtual:")) return clean;
+  const path = clean.startsWith("/@fs/") ? clean.slice(4) : clean;
+  return posix.normalize(relative(root, resolve(path)).split("\\").join("/"));
+}
+var StaticEvaluator = class {
+  constructor(file) {
+    this.file = file;
+    const visit = (node) => {
+      if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.initializer) {
+        this.constants.set(node.name.text, node.initializer);
+      }
+      ts.forEachChild(node, visit);
+    };
+    visit(file);
+  }
+  file;
+  constants = /* @__PURE__ */ new Map();
+  active = /* @__PURE__ */ new Set();
+  evaluate(input, where) {
+    const node = unwrap(input);
+    if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) return node.text;
+    if (ts.isNumericLiteral(node)) return Number(node.text);
+    if (node.kind === ts.SyntaxKind.TrueKeyword) return true;
+    if (node.kind === ts.SyntaxKind.FalseKeyword) return false;
+    if (node.kind === ts.SyntaxKind.NullKeyword) return null;
+    if (ts.isPrefixUnaryExpression(node) && node.operator === ts.SyntaxKind.MinusToken) {
+      const value = this.evaluate(node.operand, where);
+      if (typeof value === "number") return -value;
+    }
+    if (ts.isArrayLiteralExpression(node)) {
+      return node.elements.map((entry, index) => {
+        if (ts.isSpreadElement(entry)) {
+          const spread = this.evaluate(entry.expression, `${where}[${index}]`);
+          if (!Array.isArray(spread)) throw this.failure(entry, `${where}: array spread is not static`);
+          return spread;
+        }
+        return this.evaluate(entry, `${where}[${index}]`);
+      }).flat();
+    }
+    if (ts.isObjectLiteralExpression(node)) {
+      const result = {};
+      for (const property of node.properties) {
+        if (ts.isSpreadAssignment(property)) {
+          const spread = this.evaluate(property.expression, `${where} spread`);
+          if (typeof spread !== "object" || spread === null || Array.isArray(spread)) {
+            throw this.failure(property, `${where}: object spread is not static`);
+          }
+          Object.assign(result, spread);
+          continue;
+        }
+        if (ts.isShorthandPropertyAssignment(property)) {
+          result[property.name.text] = this.evaluate(property.name, `${where}.${property.name.text}`);
+          continue;
+        }
+        if (!ts.isPropertyAssignment(property)) {
+          throw this.failure(property, `${where}: methods/accessors are runtime code`);
+        }
+        const name = propertyName(property.name);
+        if (name === void 0) throw this.failure(property.name, `${where}: computed key is not static`);
+        result[name] = this.evaluate(property.initializer, `${where}.${name}`);
+      }
+      return result;
+    }
+    if (ts.isIdentifier(node)) {
+      if (node.text === "undefined") throw this.failure(node, `${where}: undefined is not serializable`);
+      if (node.text === "emptyObjectSchema") {
+        return { type: "object", properties: {}, additionalProperties: false };
+      }
+      const value = this.constants.get(node.text);
+      if (!value) throw this.failure(node, `${where}: imported/dynamic value "${node.text}" is not static`);
+      if (this.active.has(node.text)) throw this.failure(node, `${where}: cyclic static value "${node.text}"`);
+      this.active.add(node.text);
+      try {
+        return this.evaluate(value, where);
+      } finally {
+        this.active.delete(node.text);
+      }
+    }
+    if (ts.isCallExpression(node)) {
+      const name = calleeName(node.expression);
+      if (name && WRAPPERS.has(name) && node.arguments[0]) {
+        return this.evaluate(node.arguments[0], where);
+      }
+      throw this.failure(node, `${where}: call "${name ?? "<computed>"}" is not a compiler macro`);
+    }
+    if (ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) {
+      const owner = this.evaluate(node.expression, where);
+      const name = ts.isPropertyAccessExpression(node) ? node.name.text : node.argumentExpression && ts.isStringLiteral(unwrap(node.argumentExpression)) ? unwrap(node.argumentExpression).text : void 0;
+      if (name !== void 0 && typeof owner === "object" && owner !== null && !Array.isArray(owner)) {
+        const value = owner[name];
+        if (value !== void 0) return value;
+      }
+    }
+    throw this.failure(node, `${where}: expression is dynamic or non-serializable`);
+  }
+  failure(node, message) {
+    const position = this.file.getLineAndCharacterOfPosition(node.getStart(this.file));
+    return new Error(`${this.file.fileName}:${position.line + 1}:${position.character + 1}: ${message}`);
+  }
+};
+function record(value, where) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new Error(`${where} must be a static object`);
+  }
+  return value;
+}
+function string(value, where) {
+  if (typeof value !== "string" || value.length === 0) throw new Error(`${where} must be a string`);
+  return value;
+}
+function policies(value) {
+  if (value === void 0) return void 0;
+  if (!Array.isArray(value)) throw new Error("policies must be a static array");
+  return value.map((entry) => record(entry, "policy"));
+}
+function combine(inherited, local) {
+  const values = [...inherited ?? [], ...local ?? []];
+  if (values.length === 0) return void 0;
+  const unique = new Map(values.map((value) => [canonicalJson(value), value]));
+  return [...unique.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([, value]) => value);
+}
+function entryHash(entry) {
+  return sha256(canonicalJson(entry));
+}
+function declarationVariable(call) {
+  let node = call;
+  while (node.parent && (ts.isParenthesizedExpression(node.parent) || ts.isAsExpression(node.parent) || ts.isSatisfiesExpression(node.parent))) {
+    node = node.parent;
+  }
+  return node.parent && ts.isVariableDeclaration(node.parent) && ts.isIdentifier(node.parent.name) ? node.parent.name.text : void 0;
+}
+function isMacroCall(call, names, namespaces, aliases) {
+  const expression = unwrap(call.expression);
+  let imported;
+  if (ts.isIdentifier(expression)) imported = aliases.get(expression.text);
+  else if (ts.isPropertyAccessExpression(expression) && ts.isIdentifier(expression.expression)) {
+    if (namespaces.has(expression.expression.text)) imported = expression.name.text;
+  } else if (ts.isElementAccessExpression(expression) && ts.isIdentifier(expression.expression) && namespaces.has(expression.expression.text) && expression.argumentExpression && ts.isStringLiteral(unwrap(expression.argumentExpression))) {
+    imported = unwrap(expression.argumentExpression).text;
+  }
+  if (imported === COMPONENT_MACRO) return "component";
+  if (imported === PROCEDURE_MACRO) return "procedure";
+  if (imported === EXTERNAL_MACRO) return "external";
+  return void 0;
+}
+function extractModule(options) {
+  const file = ts.createSourceFile(options.id, options.code, ts.ScriptTarget.Latest, true, sourceKind(options.id));
+  const namespaces = /* @__PURE__ */ new Set();
+  const aliases = /* @__PURE__ */ new Map();
+  for (const statement of file.statements) {
+    if (!ts.isImportDeclaration(statement) || !ts.isStringLiteral(statement.moduleSpecifier)) continue;
+    if (statement.moduleSpecifier.text !== CORE || !statement.importClause) continue;
+    const bindings = statement.importClause.namedBindings;
+    if (bindings && ts.isNamespaceImport(bindings)) namespaces.add(bindings.name.text);
+    if (bindings && ts.isNamedImports(bindings)) {
+      for (const binding of bindings.elements) {
+        aliases.set(binding.name.text, binding.propertyName?.text ?? binding.name.text);
+      }
+    }
+  }
+  let changed = true;
+  while (changed) {
+    changed = false;
+    const visitAlias = (node) => {
+      if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.initializer) {
+        const init = unwrap(node.initializer);
+        let source;
+        if (ts.isIdentifier(init)) source = aliases.get(init.text);
+        else if (ts.isPropertyAccessExpression(init) && ts.isIdentifier(init.expression) && namespaces.has(init.expression.text)) {
+          source = init.name.text;
+        }
+        if (source && !aliases.has(node.name.text)) {
+          aliases.set(node.name.text, source);
+          changed = true;
+        }
+      }
+      ts.forEachChild(node, visitAlias);
+    };
+    visitAlias(file);
+  }
+  const macroNames = /* @__PURE__ */ new Set([COMPONENT_MACRO, PROCEDURE_MACRO, EXTERNAL_MACRO]);
+  if (![...aliases.values()].some((name) => macroNames.has(name)) && namespaces.size === 0) {
+    return { code: options.code, entries: [] };
+  }
+  const evaluator = new StaticEvaluator(file);
+  const entries = [];
+  const injections = [];
+  const origin = normalizedOrigin(options.root, options.id);
+  const visit = (node) => {
+    if (ts.isCallExpression(node)) {
+      const macro = isMacroCall(node, macroNames, namespaces, aliases);
+      if (macro) {
+        if (!node.arguments[0]) throw new Error(`${origin}: contract declaration needs an argument`);
+        const variable = declarationVariable(node);
+        if (!variable) throw new Error(`${origin}: contract declaration must initialize a named module constant`);
+        const declarationId = `${origin}#${variable}`;
+        const definition = record(evaluator.evaluate(node.arguments[0], declarationId), declarationId);
+        const emitted = [];
+        if (macro === "component") {
+          const type = string(definition.type, `${declarationId}.type`);
+          const inheritedPolicies = policies(definition.policies);
+          const inheritedTags = definition.tags;
+          const groups = [
+            ["observations", "observation", "read"],
+            ["actions", "action", void 0]
+          ];
+          for (const [groupName, kind, defaultEffect] of groups) {
+            const groupValue = definition[groupName];
+            if (groupValue === void 0) continue;
+            const group = record(groupValue, `${declarationId}.${groupName}`);
+            for (const [name, rawMember] of Object.entries(group)) {
+              const member = record(rawMember, `${declarationId}.${groupName}.${name}`);
+              const capabilityPolicies = combine(inheritedPolicies, policies(member.policies));
+              const capabilityTags = combine(inheritedTags, member.tags);
+              const base = {
+                declarationId,
+                capabilityId: `view:${type}.${name}`,
+                kind,
+                description: string(member.description, `${declarationId}.${name}.description`),
+                effect: string(member.effect ?? defaultEffect, `${declarationId}.${name}.effect`),
+                ...member.input ? { inputSchema: member.input } : {},
+                ...member.output ? { outputSchema: member.output } : {},
+                ...member.confirmation ? { confirmation: member.confirmation } : {},
+                ...capabilityPolicies ? { policies: capabilityPolicies } : {},
+                ...capabilityTags ? { tags: capabilityTags } : {},
+                origin
+              };
+              emitted.push({ ...base, contractHash: entryHash(base), targets: [options.target] });
+            }
+          }
+        } else {
+          const id = string(definition.id, `${declarationId}.id`);
+          const base = {
+            declarationId,
+            capabilityId: id,
+            kind: macro === "procedure" ? "procedure" : "external",
+            description: string(definition.description, `${declarationId}.description`),
+            effect: string(definition.effect, `${declarationId}.effect`),
+            ...definition.input ? { inputSchema: definition.input } : {},
+            ...definition.output ? { outputSchema: definition.output } : {},
+            ...definition.confirmation ? { confirmation: definition.confirmation } : {},
+            ...policies(definition.policies) ? { policies: policies(definition.policies) } : {},
+            ...definition.tags ? { tags: definition.tags } : {},
+            origin
+          };
+          emitted.push({ ...base, contractHash: entryHash(base), targets: [options.target] });
+        }
+        entries.push(...emitted);
+        if (node.arguments.length < 2) {
+          if (macro === "component") {
+            const capabilities = {};
+            for (const entry of emitted) {
+              capabilities[entry.capabilityId] = {
+                manifestHash: options.placeholder,
+                declarationId: entry.declarationId,
+                capabilityId: entry.capabilityId,
+                contractHash: entry.contractHash
+              };
+            }
+            const provenance = {
+              manifestHash: options.placeholder,
+              declarationId,
+              capabilities
+            };
+            injections.push({ position: node.arguments.end, text: `, ${JSON.stringify(provenance)}` });
+          } else {
+            const entry = emitted[0];
+            const token = {
+              manifestHash: options.placeholder,
+              declarationId,
+              capabilityId: entry.capabilityId,
+              contractHash: entry.contractHash
+            };
+            injections.push({ position: node.arguments.end, text: `, ${JSON.stringify(token)}` });
+          }
+        }
+      }
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(file);
+  let code = options.code;
+  for (const injection of injections.sort((a, b) => b.position - a.position)) {
+    code = `${code.slice(0, injection.position)}${injection.text}${code.slice(injection.position)}`;
+  }
+  return { code, entries };
+}
+
+// src/plugin.ts
+var COMPILER_VERSION = "0.17.0";
+var CONTRACT_FILE = "agent-surface.contract.json";
+var VIRTUAL_CONTRACT_ID = "virtual:agent-surface-contract";
+var RESOLVED_VIRTUAL_CONTRACT_ID = `\0${VIRTUAL_CONTRACT_ID}`;
+function mergeEntries(entries) {
+  const byKey = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    const key = `${entry.declarationId}\0${entry.capabilityId}`;
+    const current = byKey.get(key);
+    if (!current) {
+      byKey.set(key, { ...entry, targets: [...entry.targets] });
+      continue;
+    }
+    if (current.contractHash !== entry.contractHash) {
+      throw new Error(`contract "${entry.declarationId}" / "${entry.capabilityId}" differs across build targets`);
+    }
+    current.targets = [.../* @__PURE__ */ new Set([...current.targets, ...entry.targets])].sort();
+  }
+  return [...byKey.values()].sort(
+    (a, b) => `${a.declarationId}\0${a.capabilityId}`.localeCompare(`${b.declarationId}\0${b.capabilityId}`)
+  );
+}
+function validateEntries(entries) {
+  for (const entry of entries) {
+    if (entry.kind !== "external" && !parseCapabilityId(entry.capabilityId)) {
+      throw new Error(`invalid compiled capability id "${entry.capabilityId}"`);
+    }
+    for (const [label, schema] of [["input", entry.inputSchema], ["output", entry.outputSchema]]) {
+      if (!schema) continue;
+      const result = validateJsonSchemaDocument(schema, DEFAULT_LIMITS);
+      if (!result.ok) {
+        throw new Error(`${entry.declarationId} ${label} schema: ${result.reason}`);
+      }
+    }
+  }
+}
+function nearestPackage(id) {
+  if (id.startsWith("\0") || !isAbsolute(id)) return void 0;
+  let dir = dirname(id.split("?")[0]);
+  while (dir !== dirname(dir)) {
+    const packagePath = join(dir, "package.json");
+    if (existsSync(packagePath)) {
+      const pkg = JSON.parse(readFileSync(packagePath, "utf8"));
+      if (!pkg.name) return void 0;
+      return {
+        name: pkg.name,
+        dir,
+        packagePath,
+        ...pkg.agentSurface?.contract ? { sidecar: resolve2(dir, pkg.agentSurface.contract) } : {}
+      };
+    }
+    dir = dirname(dir);
+  }
+  return void 0;
+}
+function isDependencyModule(id) {
+  return id.split("?")[0].includes(`${sep}node_modules${sep}`);
+}
+function readSidecar(path) {
+  const bytes = readFileSync(path);
+  const manifest = JSON.parse(bytes.toString("utf8"));
+  verifyManifest(manifest);
+  return { manifest, digest: sha256(bytes) };
+}
+function authorizeContributions(contributions, policy) {
+  const allow = new Map((policy?.allow ?? []).map((entry) => [entry.package, entry]));
+  const unauthorized = [];
+  const mismatched = [];
+  const attributions = [];
+  for (const contribution of contributions) {
+    const approved = allow.get(contribution.package);
+    if (!approved) {
+      unauthorized.push(
+        `  ${contribution.package} (${contribution.route}: ${contribution.source})
+    { "package": "${contribution.package}", "digest": "${contribution.contractDigest}" }`
+      );
+      continue;
+    }
+    if (approved.digest !== contribution.contractDigest) {
+      mismatched.push(
+        `  ${contribution.package}: approved ${approved.digest}, this build computed ${contribution.contractDigest}`
+      );
+      continue;
+    }
+    attributions.push({
+      package: contribution.package,
+      source: contribution.source,
+      route: contribution.route,
+      contractDigest: contribution.contractDigest,
+      authorization: { mode: "pinned", expectedDigest: approved.digest }
+    });
+  }
+  if (unauthorized.length > 0) {
+    throw new Error(
+      `unauthorized external capability contract(s). A dependency cannot contribute capabilities until the consumer approves it. Add to externalContracts.allow:
+${unauthorized.join("\n")}`
+    );
+  }
+  if (mismatched.length > 0) {
+    throw new Error(
+      `external capability contract digest mismatch. The dependency changed what it contributes; review the change before updating the approved digest:
+${mismatched.join("\n")}`
+    );
+  }
+  return attributions.sort((a, b) => a.package.localeCompare(b.package));
+}
+var serveManifests = /* @__PURE__ */ new Map();
+function compileServeManifest(options) {
+  const key = `${options.root}\0${options.target}`;
+  const cached = serveManifests.get(key);
+  if (cached) return cached;
+  const pending = import("./compile-RPDITMVH.js").then(
+    ({ compileCapabilityContract: compileCapabilityContract2 }) => compileCapabilityContract2({
+      root: options.root,
+      target: options.target,
+      ...options.externalContracts ? { externalContracts: options.externalContracts } : {},
+      vite: {
+        ...options.configFile === false ? { configFile: false } : {},
+        ...options.alias ? { resolve: { alias: options.alias } } : {}
+      }
+    })
+  );
+  serveManifests.set(key, pending);
+  void pending.catch(() => serveManifests.delete(key));
+  return pending;
+}
+function agentSurface(options = {}) {
+  const target = options.target ?? "web-production";
+  const placeholder = `__AGENT_SURFACE_MANIFEST_HASH_${Math.random().toString(36).slice(2)}__`;
+  const manifestPlaceholder = `__AGENT_SURFACE_MANIFEST_${Math.random().toString(36).slice(2)}__`;
+  let root = process.cwd();
+  let entries = [];
+  let sourceEntries = /* @__PURE__ */ new Map();
+  let manifest;
+  let serve = false;
+  let serveAlias;
+  let serveConfigFile;
+  const servedManifest = () => {
+    if (!manifest) throw new Error("agent-surface: contract not compiled for this dev/test run");
+    return manifest;
+  };
+  const manifestHashToken = () => serve ? servedManifest().hash : placeholder;
+  return {
+    name: "agent-surface:compiler",
+    enforce: "pre",
+    configResolved(config) {
+      root = config.root;
+      serve = config.command === "serve";
+      serveAlias = config.resolve?.alias;
+      serveConfigFile = config.configFile === void 0 ? false : config.configFile;
+    },
+    resolveId(id) {
+      return id === VIRTUAL_CONTRACT_ID ? RESOLVED_VIRTUAL_CONTRACT_ID : null;
+    },
+    load(id) {
+      if (id !== RESOLVED_VIRTUAL_CONTRACT_ID) return null;
+      const inlined = serve ? JSON.stringify(servedManifest()) : manifestPlaceholder;
+      return `import { createCapabilityAuthority } from "@agent-surface/core";
+const manifest = ${inlined};
+export { manifest };
+export default createCapabilityAuthority(manifest);`;
+    },
+    async buildStart() {
+      entries = [];
+      sourceEntries = /* @__PURE__ */ new Map();
+      manifest = void 0;
+      if (!serve) return;
+      manifest = await compileServeManifest({
+        root,
+        target,
+        alias: serveAlias,
+        configFile: serveConfigFile,
+        ...options.externalContracts ? { externalContracts: options.externalContracts } : {}
+      });
+    },
+    transform(code, id) {
+      if (id.includes("/node_modules/@agent-surface/") || /\/packages\/(?:core|react|orpc|testing|webmcp|cli|compiler)\//.test(id) || // Vite's optimized-dependency chunks, which exist only under serve.
+      // They are bundled OUTPUT — several dependencies concatenated, this
+      // package among them — so the guards below would read our own
+      // `registry.register({` back out of a vendor chunk and refuse to serve
+      // the app. A dependency's real contracts are picked up from its actual
+      // module, via the sidecar and source routes, not from optimizer output.
+      id.includes("/node_modules/.vite/")) {
+        return null;
+      }
+      if (/\buseAgentComponent\s*\(\s*\{/.test(code)) {
+        throw new Error(`${id}: inline useAgentComponent registration is unsupported; bind a compiled contract`);
+      }
+      if (/\b(?:useAgentAction|useAgentObservation)\s*\(/.test(code)) {
+        throw new Error(`${id}: granular runtime capability construction is unsupported by the compiled contract`);
+      }
+      if (/\bdefineAgentComponent\s*\(/.test(code) || /\bregistry\s*\.\s*register\s*\(\s*\{/.test(code)) {
+        throw new Error(`${id}: raw capability registration bypasses the compiled exposure ceiling`);
+      }
+      if (!code.includes("defineAgentComponentContract") && !code.includes("defineAgentProcedureContract") && !code.includes("defineExternalAgentToolContract")) {
+        return null;
+      }
+      const extracted = extractModule({ code, id, root, target, placeholder: manifestHashToken() });
+      const owner = isDependencyModule(id) ? nearestPackage(id) : void 0;
+      if (owner) {
+        const existing = sourceEntries.get(owner.name) ?? [];
+        existing.push(...extracted.entries);
+        sourceEntries.set(owner.name, existing);
+      } else {
+        entries.push(...extracted.entries);
+      }
+      return extracted.code === code ? null : { code: extracted.code, map: null };
+    },
+    buildEnd(error) {
+      if (error || serve) return;
+      const contributions = [];
+      const seenSidecars = /* @__PURE__ */ new Set();
+      for (const id of this.getModuleIds()) {
+        if (!isDependencyModule(id)) continue;
+        const owner = nearestPackage(id);
+        if (!owner?.sidecar || seenSidecars.has(owner.sidecar)) continue;
+        seenSidecars.add(owner.sidecar);
+        const { manifest: external, digest } = readSidecar(owner.sidecar);
+        contributions.push({
+          package: owner.name,
+          source: relative2(root, owner.sidecar).split(sep).join("/"),
+          route: "sidecar",
+          contractDigest: digest,
+          entries: external.capabilities
+        });
+      }
+      for (const allowed of options.externalContracts?.allow ?? []) {
+        if (!allowed.path) continue;
+        const path = isAbsolute(allowed.path) ? allowed.path : resolve2(root, allowed.path);
+        if (seenSidecars.has(path)) continue;
+        seenSidecars.add(path);
+        const owner = nearestPackage(path);
+        if (owner && owner.name !== allowed.package) {
+          throw new Error(
+            `external contract "${allowed.path}" belongs to "${owner.name}", not the approved "${allowed.package}"`
+          );
+        }
+        const { manifest: external, digest } = readSidecar(path);
+        contributions.push({
+          package: owner?.name ?? allowed.package,
+          source: allowed.path,
+          route: "sidecar",
+          contractDigest: digest,
+          entries: external.capabilities
+        });
+      }
+      for (const [name, extracted] of [...sourceEntries].sort(([a], [b]) => a.localeCompare(b))) {
+        if (extracted.length === 0) continue;
+        const sorted = mergeEntries(extracted);
+        contributions.push({
+          package: name,
+          source: sorted[0]?.origin ?? name,
+          route: "source",
+          contractDigest: sha256(canonicalJson(sorted)),
+          entries: sorted
+        });
+      }
+      const externalContracts = authorizeContributions(contributions, options.externalContracts);
+      const externalEntries = contributions.flatMap((contribution) => contribution.entries);
+      const capabilities = mergeEntries([...entries, ...externalEntries]);
+      validateEntries(capabilities);
+      const targets = [...new Set(capabilities.flatMap((entry) => entry.targets))].sort();
+      const payload = {
+        formatVersion: 5,
+        compilerVersion: COMPILER_VERSION,
+        targets,
+        capabilities,
+        externalContracts,
+        completeness: { status: "proven" }
+      };
+      manifest = { ...payload, hash: computeManifestHash(payload) };
+      options.onManifest?.(manifest);
+    },
+    renderChunk(code) {
+      if (!manifest || !code.includes(placeholder) && !code.includes(manifestPlaceholder)) return null;
+      return {
+        code: code.replaceAll(placeholder, manifest.hash).replaceAll(manifestPlaceholder, JSON.stringify(manifest)),
+        map: null
+      };
+    },
+    generateBundle() {
+      if (!manifest || options.emit === false) return;
+      this.emitFile({
+        type: "asset",
+        fileName: options.fileName ?? CONTRACT_FILE,
+        source: canonicalManifestJson(manifest)
+      });
+    },
+    async handleHotUpdate(ctx) {
+      if (!serve) return;
+      const code = await ctx.read();
+      if (!code.includes("defineAgentComponentContract") && !code.includes("defineAgentProcedureContract") && !code.includes("defineExternalAgentToolContract")) {
+        return;
+      }
+      serveManifests.delete(`${root}\0${target}`);
+      manifest = await compileServeManifest({
+        root,
+        target,
+        alias: serveAlias,
+        configFile: serveConfigFile,
+        ...options.externalContracts ? { externalContracts: options.externalContracts } : {}
+      });
+      const virtual = ctx.server.moduleGraph.getModuleById(RESOLVED_VIRTUAL_CONTRACT_ID);
+      if (virtual) ctx.server.moduleGraph.invalidateModule(virtual);
+      ctx.server.ws.send({ type: "full-reload" });
+      return [];
+    }
+  };
+}
+
+// src/compile.ts
+async function compileCapabilityContract(options = {}) {
+  let manifest;
+  const root = resolve3(options.root ?? process.cwd());
+  const result = await build({
+    ...options.vite ?? {},
+    root,
+    ...options.configFile ? { configFile: resolve3(root, options.configFile) } : {},
+    logLevel: options.vite?.logLevel ?? "silent",
+    build: {
+      ...options.vite?.build ?? {},
+      write: false
+    },
+    plugins: [
+      ...options.vite?.plugins ?? [],
+      agentSurface({
+        target: options.target,
+        emit: false,
+        ...options.externalContracts ? { externalContracts: options.externalContracts } : {},
+        onManifest: (value) => {
+          manifest = value;
+        }
+      })
+    ]
+  });
+  const outputs = Array.isArray(result) ? result : [result];
+  for (const output of outputs) {
+    if (!("output" in output)) continue;
+    const asset = output.output.find(
+      (entry) => entry.type === "asset" && entry.fileName === "agent-surface.contract.json"
+    );
+    if (asset?.type === "asset") {
+      const source = typeof asset.source === "string" ? asset.source : new TextDecoder().decode(asset.source);
+      manifest = JSON.parse(source);
+      break;
+    }
+  }
+  if (!manifest) throw new Error("compiler did not produce a capability contract");
+  return manifest;
+}
+
+export {
+  canonicalJson,
+  sha256,
+  manifestPayload,
+  computeManifestHash,
+  canonicalManifestJson,
+  verifyManifest,
+  compileCapabilityContract,
+  COMPILER_VERSION,
+  CONTRACT_FILE,
+  VIRTUAL_CONTRACT_ID,
+  agentSurface
+};
+//# sourceMappingURL=chunk-BNIUE5RA.js.map