@agent-surface/compiler 0.18.0 → 0.19.1

package/dist/index.js

@@ -1,668 +1,16 @@
-// src/canonical.ts
-import { createHash } from "crypto";
-function normalize(value) {
-  if (Array.isArray(value)) return value.map(normalize);
-  if (typeof value !== "object" || value === null) return value;
-  return Object.fromEntries(
-    Object.entries(value).filter(([, entry]) => entry !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, entry]) => [key, normalize(entry)])
-  );
-}
-function canonicalJson(value, pretty = false) {
-  return `${JSON.stringify(normalize(value), null, pretty ? 2 : void 0)}
-`;
-}
-function sha256(value) {
-  return createHash("sha256").update(value).digest("hex");
-}
-function manifestPayload(manifest) {
-  const { hash: _hash, ...payload } = manifest;
-  return payload;
-}
-function computeManifestHash(manifest) {
-  return sha256(canonicalJson(manifestPayload(manifest)));
-}
-function canonicalManifestJson(manifest) {
-  return canonicalJson(manifest, true);
-}
-function verifyManifest(manifest) {
-  if (computeManifestHash(manifest) !== manifest.hash) {
-    throw new Error(`capability contract hash mismatch: ${manifest.hash}`);
-  }
-}
-
-// src/plugin.ts
-import { existsSync, readFileSync } from "fs";
-import { dirname, isAbsolute, join, relative as relative2, resolve as resolve2, sep } from "path";
 import {
-  DEFAULT_LIMITS,
-  parseCapabilityId,
-  validateJsonSchemaDocument
-} from "@agent-surface/core";
-
-// src/extract.ts
-import { posix, relative, resolve } from "path";
-import ts from "typescript";
-var CORE = "@agent-surface/core";
-var COMPONENT_MACRO = "defineAgentComponentContract";
-var PROCEDURE_MACRO = "defineAgentProcedureContract";
-var EXTERNAL_MACRO = "defineExternalAgentToolContract";
-var WRAPPERS = /* @__PURE__ */ new Set([
-  "observationContract",
-  "actionContract",
-  "fromJsonSchema",
-  "defineAgentComponentContract",
-  "defineAgentProcedureContract",
-  "defineExternalAgentToolContract"
-]);
-function sourceKind(id) {
-  if (/\.tsx(?:\?|$)/.test(id)) return ts.ScriptKind.TSX;
-  if (/\.jsx(?:\?|$)/.test(id)) return ts.ScriptKind.JSX;
-  if (/\.js(?:\?|$)/.test(id)) return ts.ScriptKind.JS;
-  return ts.ScriptKind.TS;
-}
-function unwrap(node) {
-  while (ts.isParenthesizedExpression(node) || ts.isAsExpression(node) || ts.isTypeAssertionExpression(node) || ts.isSatisfiesExpression(node) || ts.isNonNullExpression(node)) {
-    node = node.expression;
-  }
-  return node;
-}
-function propertyName(node) {
-  if (ts.isIdentifier(node) || ts.isStringLiteral(node) || ts.isNumericLiteral(node)) {
-    return node.text;
-  }
-  if (ts.isComputedPropertyName(node) && ts.isStringLiteral(unwrap(node.expression))) {
-    return unwrap(node.expression).text;
-  }
-  return void 0;
-}
-function calleeName(node) {
-  node = unwrap(node);
-  if (ts.isIdentifier(node)) return node.text;
-  if (ts.isPropertyAccessExpression(node)) return node.name.text;
-  if (ts.isElementAccessExpression(node) && node.argumentExpression && ts.isStringLiteral(unwrap(node.argumentExpression))) {
-    return unwrap(node.argumentExpression).text;
-  }
-  return void 0;
-}
-function normalizedOrigin(root, id) {
-  const clean = id.replace(/^\0/, "virtual:").split("?")[0];
-  if (clean.startsWith("virtual:")) return clean;
-  const path = clean.startsWith("/@fs/") ? clean.slice(4) : clean;
-  return posix.normalize(relative(root, resolve(path)).split("\\").join("/"));
-}
-var StaticEvaluator = class {
-  constructor(file) {
-    this.file = file;
-    const visit = (node) => {
-      if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.initializer) {
-        this.constants.set(node.name.text, node.initializer);
-      }
-      ts.forEachChild(node, visit);
-    };
-    visit(file);
-  }
-  file;
-  constants = /* @__PURE__ */ new Map();
-  active = /* @__PURE__ */ new Set();
-  evaluate(input, where) {
-    const node = unwrap(input);
-    if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) return node.text;
-    if (ts.isNumericLiteral(node)) return Number(node.text);
-    if (node.kind === ts.SyntaxKind.TrueKeyword) return true;
-    if (node.kind === ts.SyntaxKind.FalseKeyword) return false;
-    if (node.kind === ts.SyntaxKind.NullKeyword) return null;
-    if (ts.isPrefixUnaryExpression(node) && node.operator === ts.SyntaxKind.MinusToken) {
-      const value = this.evaluate(node.operand, where);
-      if (typeof value === "number") return -value;
-    }
-    if (ts.isArrayLiteralExpression(node)) {
-      return node.elements.map((entry, index) => {
-        if (ts.isSpreadElement(entry)) {
-          const spread = this.evaluate(entry.expression, `${where}[${index}]`);
-          if (!Array.isArray(spread)) throw this.failure(entry, `${where}: array spread is not static`);
-          return spread;
-        }
-        return this.evaluate(entry, `${where}[${index}]`);
-      }).flat();
-    }
-    if (ts.isObjectLiteralExpression(node)) {
-      const result = {};
-      for (const property of node.properties) {
-        if (ts.isSpreadAssignment(property)) {
-          const spread = this.evaluate(property.expression, `${where} spread`);
-          if (typeof spread !== "object" || spread === null || Array.isArray(spread)) {
-            throw this.failure(property, `${where}: object spread is not static`);
-          }
-          Object.assign(result, spread);
-          continue;
-        }
-        if (ts.isShorthandPropertyAssignment(property)) {
-          result[property.name.text] = this.evaluate(property.name, `${where}.${property.name.text}`);
-          continue;
-        }
-        if (!ts.isPropertyAssignment(property)) {
-          throw this.failure(property, `${where}: methods/accessors are runtime code`);
-        }
-        const name = propertyName(property.name);
-        if (name === void 0) throw this.failure(property.name, `${where}: computed key is not static`);
-        result[name] = this.evaluate(property.initializer, `${where}.${name}`);
-      }
-      return result;
-    }
-    if (ts.isIdentifier(node)) {
-      if (node.text === "undefined") throw this.failure(node, `${where}: undefined is not serializable`);
-      if (node.text === "emptyObjectSchema") {
-        return { type: "object", properties: {}, additionalProperties: false };
-      }
-      const value = this.constants.get(node.text);
-      if (!value) throw this.failure(node, `${where}: imported/dynamic value "${node.text}" is not static`);
-      if (this.active.has(node.text)) throw this.failure(node, `${where}: cyclic static value "${node.text}"`);
-      this.active.add(node.text);
-      try {
-        return this.evaluate(value, where);
-      } finally {
-        this.active.delete(node.text);
-      }
-    }
-    if (ts.isCallExpression(node)) {
-      const name = calleeName(node.expression);
-      if (name && WRAPPERS.has(name) && node.arguments[0]) {
-        return this.evaluate(node.arguments[0], where);
-      }
-      throw this.failure(node, `${where}: call "${name ?? "<computed>"}" is not a compiler macro`);
-    }
-    if (ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node)) {
-      const owner = this.evaluate(node.expression, where);
-      const name = ts.isPropertyAccessExpression(node) ? node.name.text : node.argumentExpression && ts.isStringLiteral(unwrap(node.argumentExpression)) ? unwrap(node.argumentExpression).text : void 0;
-      if (name !== void 0 && typeof owner === "object" && owner !== null && !Array.isArray(owner)) {
-        const value = owner[name];
-        if (value !== void 0) return value;
-      }
-    }
-    throw this.failure(node, `${where}: expression is dynamic or non-serializable`);
-  }
-  failure(node, message) {
-    const position = this.file.getLineAndCharacterOfPosition(node.getStart(this.file));
-    return new Error(`${this.file.fileName}:${position.line + 1}:${position.character + 1}: ${message}`);
-  }
-};
-function record(value, where) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    throw new Error(`${where} must be a static object`);
-  }
-  return value;
-}
-function string(value, where) {
-  if (typeof value !== "string" || value.length === 0) throw new Error(`${where} must be a string`);
-  return value;
-}
-function policies(value) {
-  if (value === void 0) return void 0;
-  if (!Array.isArray(value)) throw new Error("policies must be a static array");
-  return value.map((entry) => record(entry, "policy"));
-}
-function combine(inherited, local) {
-  const values = [...inherited ?? [], ...local ?? []];
-  if (values.length === 0) return void 0;
-  const unique = new Map(values.map((value) => [canonicalJson(value), value]));
-  return [...unique.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([, value]) => value);
-}
-function entryHash(entry) {
-  return sha256(canonicalJson(entry));
-}
-function declarationVariable(call) {
-  let node = call;
-  while (node.parent && (ts.isParenthesizedExpression(node.parent) || ts.isAsExpression(node.parent) || ts.isSatisfiesExpression(node.parent))) {
-    node = node.parent;
-  }
-  return node.parent && ts.isVariableDeclaration(node.parent) && ts.isIdentifier(node.parent.name) ? node.parent.name.text : void 0;
-}
-function isMacroCall(call, names, namespaces, aliases) {
-  const expression = unwrap(call.expression);
-  let imported;
-  if (ts.isIdentifier(expression)) imported = aliases.get(expression.text);
-  else if (ts.isPropertyAccessExpression(expression) && ts.isIdentifier(expression.expression)) {
-    if (namespaces.has(expression.expression.text)) imported = expression.name.text;
-  } else if (ts.isElementAccessExpression(expression) && ts.isIdentifier(expression.expression) && namespaces.has(expression.expression.text) && expression.argumentExpression && ts.isStringLiteral(unwrap(expression.argumentExpression))) {
-    imported = unwrap(expression.argumentExpression).text;
-  }
-  if (imported === COMPONENT_MACRO) return "component";
-  if (imported === PROCEDURE_MACRO) return "procedure";
-  if (imported === EXTERNAL_MACRO) return "external";
-  return void 0;
-}
-function extractModule(options) {
-  const file = ts.createSourceFile(options.id, options.code, ts.ScriptTarget.Latest, true, sourceKind(options.id));
-  const namespaces = /* @__PURE__ */ new Set();
-  const aliases = /* @__PURE__ */ new Map();
-  for (const statement of file.statements) {
-    if (!ts.isImportDeclaration(statement) || !ts.isStringLiteral(statement.moduleSpecifier)) continue;
-    if (statement.moduleSpecifier.text !== CORE || !statement.importClause) continue;
-    const bindings = statement.importClause.namedBindings;
-    if (bindings && ts.isNamespaceImport(bindings)) namespaces.add(bindings.name.text);
-    if (bindings && ts.isNamedImports(bindings)) {
-      for (const binding of bindings.elements) {
-        aliases.set(binding.name.text, binding.propertyName?.text ?? binding.name.text);
-      }
-    }
-  }
-  let changed = true;
-  while (changed) {
-    changed = false;
-    const visitAlias = (node) => {
-      if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && node.initializer) {
-        const init = unwrap(node.initializer);
-        let source;
-        if (ts.isIdentifier(init)) source = aliases.get(init.text);
-        else if (ts.isPropertyAccessExpression(init) && ts.isIdentifier(init.expression) && namespaces.has(init.expression.text)) {
-          source = init.name.text;
-        }
-        if (source && !aliases.has(node.name.text)) {
-          aliases.set(node.name.text, source);
-          changed = true;
-        }
-      }
-      ts.forEachChild(node, visitAlias);
-    };
-    visitAlias(file);
-  }
-  const macroNames = /* @__PURE__ */ new Set([COMPONENT_MACRO, PROCEDURE_MACRO, EXTERNAL_MACRO]);
-  if (![...aliases.values()].some((name) => macroNames.has(name)) && namespaces.size === 0) {
-    return { code: options.code, entries: [] };
-  }
-  const evaluator = new StaticEvaluator(file);
-  const entries = [];
-  const injections = [];
-  const origin = normalizedOrigin(options.root, options.id);
-  const visit = (node) => {
-    if (ts.isCallExpression(node)) {
-      const macro = isMacroCall(node, macroNames, namespaces, aliases);
-      if (macro) {
-        if (!node.arguments[0]) throw new Error(`${origin}: contract declaration needs an argument`);
-        const variable = declarationVariable(node);
-        if (!variable) throw new Error(`${origin}: contract declaration must initialize a named module constant`);
-        const declarationId = `${origin}#${variable}`;
-        const definition = record(evaluator.evaluate(node.arguments[0], declarationId), declarationId);
-        const emitted = [];
-        if (macro === "component") {
-          const type = string(definition.type, `${declarationId}.type`);
-          const inheritedPolicies = policies(definition.policies);
-          const inheritedTags = definition.tags;
-          const groups = [
-            ["observations", "observation", "read"],
-            ["actions", "action", void 0]
-          ];
-          for (const [groupName, kind, defaultEffect] of groups) {
-            const groupValue = definition[groupName];
-            if (groupValue === void 0) continue;
-            const group = record(groupValue, `${declarationId}.${groupName}`);
-            for (const [name, rawMember] of Object.entries(group)) {
-              const member = record(rawMember, `${declarationId}.${groupName}.${name}`);
-              const capabilityPolicies = combine(inheritedPolicies, policies(member.policies));
-              const capabilityTags = combine(inheritedTags, member.tags);
-              const base = {
-                declarationId,
-                capabilityId: `view:${type}.${name}`,
-                kind,
-                description: string(member.description, `${declarationId}.${name}.description`),
-                effect: string(member.effect ?? defaultEffect, `${declarationId}.${name}.effect`),
-                ...member.input ? { inputSchema: member.input } : {},
-                ...member.output ? { outputSchema: member.output } : {},
-                ...member.confirmation ? { confirmation: member.confirmation } : {},
-                ...capabilityPolicies ? { policies: capabilityPolicies } : {},
-                ...capabilityTags ? { tags: capabilityTags } : {},
-                origin
-              };
-              emitted.push({ ...base, contractHash: entryHash(base), targets: [options.target] });
-            }
-          }
-        } else {
-          const id = string(definition.id, `${declarationId}.id`);
-          const base = {
-            declarationId,
-            capabilityId: id,
-            kind: macro === "procedure" ? "procedure" : "external",
-            description: string(definition.description, `${declarationId}.description`),
-            effect: string(definition.effect, `${declarationId}.effect`),
-            ...definition.input ? { inputSchema: definition.input } : {},
-            ...definition.output ? { outputSchema: definition.output } : {},
-            ...definition.confirmation ? { confirmation: definition.confirmation } : {},
-            ...policies(definition.policies) ? { policies: policies(definition.policies) } : {},
-            ...definition.tags ? { tags: definition.tags } : {},
-            origin
-          };
-          emitted.push({ ...base, contractHash: entryHash(base), targets: [options.target] });
-        }
-        entries.push(...emitted);
-        if (node.arguments.length < 2) {
-          if (macro === "component") {
-            const capabilities = {};
-            for (const entry of emitted) {
-              capabilities[entry.capabilityId] = {
-                manifestHash: options.placeholder,
-                declarationId: entry.declarationId,
-                capabilityId: entry.capabilityId,
-                contractHash: entry.contractHash
-              };
-            }
-            const provenance = {
-              manifestHash: options.placeholder,
-              declarationId,
-              capabilities
-            };
-            injections.push({ position: node.arguments.end, text: `, ${JSON.stringify(provenance)}` });
-          } else {
-            const entry = emitted[0];
-            const token = {
-              manifestHash: options.placeholder,
-              declarationId,
-              capabilityId: entry.capabilityId,
-              contractHash: entry.contractHash
-            };
-            injections.push({ position: node.arguments.end, text: `, ${JSON.stringify(token)}` });
-          }
-        }
-      }
-    }
-    ts.forEachChild(node, visit);
-  };
-  visit(file);
-  let code = options.code;
-  for (const injection of injections.sort((a, b) => b.position - a.position)) {
-    code = `${code.slice(0, injection.position)}${injection.text}${code.slice(injection.position)}`;
-  }
-  return { code, entries };
-}
-
-// src/plugin.ts
-var COMPILER_VERSION = "0.17.0";
-var CONTRACT_FILE = "agent-surface.contract.json";
-var VIRTUAL_CONTRACT_ID = "virtual:agent-surface-contract";
-var RESOLVED_VIRTUAL_CONTRACT_ID = `\0${VIRTUAL_CONTRACT_ID}`;
-function mergeEntries(entries) {
-  const byKey = /* @__PURE__ */ new Map();
-  for (const entry of entries) {
-    const key = `${entry.declarationId}\0${entry.capabilityId}`;
-    const current = byKey.get(key);
-    if (!current) {
-      byKey.set(key, { ...entry, targets: [...entry.targets] });
-      continue;
-    }
-    if (current.contractHash !== entry.contractHash) {
-      throw new Error(`contract "${entry.declarationId}" / "${entry.capabilityId}" differs across build targets`);
-    }
-    current.targets = [.../* @__PURE__ */ new Set([...current.targets, ...entry.targets])].sort();
-  }
-  return [...byKey.values()].sort(
-    (a, b) => `${a.declarationId}\0${a.capabilityId}`.localeCompare(`${b.declarationId}\0${b.capabilityId}`)
-  );
-}
-function validateEntries(entries) {
-  for (const entry of entries) {
-    if (entry.kind !== "external" && !parseCapabilityId(entry.capabilityId)) {
-      throw new Error(`invalid compiled capability id "${entry.capabilityId}"`);
-    }
-    for (const [label, schema] of [["input", entry.inputSchema], ["output", entry.outputSchema]]) {
-      if (!schema) continue;
-      const result = validateJsonSchemaDocument(schema, DEFAULT_LIMITS);
-      if (!result.ok) {
-        throw new Error(`${entry.declarationId} ${label} schema: ${result.reason}`);
-      }
-    }
-  }
-}
-function nearestPackage(id) {
-  if (id.startsWith("\0") || !isAbsolute(id)) return void 0;
-  let dir = dirname(id.split("?")[0]);
-  while (dir !== dirname(dir)) {
-    const packagePath = join(dir, "package.json");
-    if (existsSync(packagePath)) {
-      const pkg = JSON.parse(readFileSync(packagePath, "utf8"));
-      if (!pkg.name) return void 0;
-      return {
-        name: pkg.name,
-        dir,
-        packagePath,
-        ...pkg.agentSurface?.contract ? { sidecar: resolve2(dir, pkg.agentSurface.contract) } : {}
-      };
-    }
-    dir = dirname(dir);
-  }
-  return void 0;
-}
-function isDependencyModule(id) {
-  return id.split("?")[0].includes(`${sep}node_modules${sep}`);
-}
-function readSidecar(path) {
-  const bytes = readFileSync(path);
-  const manifest = JSON.parse(bytes.toString("utf8"));
-  verifyManifest(manifest);
-  return { manifest, digest: sha256(bytes) };
-}
-function authorizeContributions(contributions, policy) {
-  const allow = new Map((policy?.allow ?? []).map((entry) => [entry.package, entry]));
-  const unauthorized = [];
-  const mismatched = [];
-  const attributions = [];
-  for (const contribution of contributions) {
-    const approved = allow.get(contribution.package);
-    if (!approved) {
-      unauthorized.push(
-        `  ${contribution.package} (${contribution.route}: ${contribution.source})
-    { "package": "${contribution.package}", "digest": "${contribution.contractDigest}" }`
-      );
-      continue;
-    }
-    if (approved.digest !== contribution.contractDigest) {
-      mismatched.push(
-        `  ${contribution.package}: approved ${approved.digest}, this build computed ${contribution.contractDigest}`
-      );
-      continue;
-    }
-    attributions.push({
-      package: contribution.package,
-      source: contribution.source,
-      route: contribution.route,
-      contractDigest: contribution.contractDigest,
-      authorization: { mode: "pinned", expectedDigest: approved.digest }
-    });
-  }
-  if (unauthorized.length > 0) {
-    throw new Error(
-      `unauthorized external capability contract(s). A dependency cannot contribute capabilities until the consumer approves it. Add to externalContracts.allow:
-${unauthorized.join("\n")}`
-    );
-  }
-  if (mismatched.length > 0) {
-    throw new Error(
-      `external capability contract digest mismatch. The dependency changed what it contributes; review the change before updating the approved digest:
-${mismatched.join("\n")}`
-    );
-  }
-  return attributions.sort((a, b) => a.package.localeCompare(b.package));
-}
-function agentSurface(options = {}) {
-  const target = options.target ?? "web-production";
-  const placeholder = `__AGENT_SURFACE_MANIFEST_HASH_${Math.random().toString(36).slice(2)}__`;
-  const manifestPlaceholder = `__AGENT_SURFACE_MANIFEST_${Math.random().toString(36).slice(2)}__`;
-  let root = process.cwd();
-  let entries = [];
-  let sourceEntries = /* @__PURE__ */ new Map();
-  let manifest;
-  return {
-    name: "agent-surface:compiler",
-    apply: "build",
-    enforce: "pre",
-    configResolved(config) {
-      root = config.root;
-    },
-    resolveId(id) {
-      return id === VIRTUAL_CONTRACT_ID ? RESOLVED_VIRTUAL_CONTRACT_ID : null;
-    },
-    load(id) {
-      if (id !== RESOLVED_VIRTUAL_CONTRACT_ID) return null;
-      return `import { createCapabilityAuthority } from "@agent-surface/core";
-const manifest = ${manifestPlaceholder};
-export { manifest };
-export default createCapabilityAuthority(manifest);`;
-    },
-    buildStart() {
-      entries = [];
-      sourceEntries = /* @__PURE__ */ new Map();
-      manifest = void 0;
-    },
-    transform(code, id) {
-      if (id.includes("/node_modules/@agent-surface/") || /\/packages\/(?:core|react|orpc|testing|webmcp|cli|compiler)\//.test(id)) {
-        return null;
-      }
-      if (/\buseAgentComponent\s*\(\s*\{/.test(code)) {
-        throw new Error(`${id}: inline useAgentComponent registration is unsupported; bind a compiled contract`);
-      }
-      if (/\b(?:useAgentAction|useAgentObservation)\s*\(/.test(code)) {
-        throw new Error(`${id}: granular runtime capability construction is unsupported by the compiled contract`);
-      }
-      if (/\bdefineAgentComponent\s*\(/.test(code) || /\bregistry\s*\.\s*register\s*\(\s*\{/.test(code)) {
-        throw new Error(`${id}: raw capability registration bypasses the compiled exposure ceiling`);
-      }
-      if (!code.includes("defineAgentComponentContract") && !code.includes("defineAgentProcedureContract") && !code.includes("defineExternalAgentToolContract")) {
-        return null;
-      }
-      const extracted = extractModule({ code, id, root, target, placeholder });
-      const owner = isDependencyModule(id) ? nearestPackage(id) : void 0;
-      if (owner) {
-        const existing = sourceEntries.get(owner.name) ?? [];
-        existing.push(...extracted.entries);
-        sourceEntries.set(owner.name, existing);
-      } else {
-        entries.push(...extracted.entries);
-      }
-      return extracted.code === code ? null : { code: extracted.code, map: null };
-    },
-    buildEnd(error) {
-      if (error) return;
-      const contributions = [];
-      const seenSidecars = /* @__PURE__ */ new Set();
-      for (const id of this.getModuleIds()) {
-        if (!isDependencyModule(id)) continue;
-        const owner = nearestPackage(id);
-        if (!owner?.sidecar || seenSidecars.has(owner.sidecar)) continue;
-        seenSidecars.add(owner.sidecar);
-        const { manifest: external, digest } = readSidecar(owner.sidecar);
-        contributions.push({
-          package: owner.name,
-          source: relative2(root, owner.sidecar).split(sep).join("/"),
-          route: "sidecar",
-          contractDigest: digest,
-          entries: external.capabilities
-        });
-      }
-      for (const allowed of options.externalContracts?.allow ?? []) {
-        if (!allowed.path) continue;
-        const path = isAbsolute(allowed.path) ? allowed.path : resolve2(root, allowed.path);
-        if (seenSidecars.has(path)) continue;
-        seenSidecars.add(path);
-        const owner = nearestPackage(path);
-        if (owner && owner.name !== allowed.package) {
-          throw new Error(
-            `external contract "${allowed.path}" belongs to "${owner.name}", not the approved "${allowed.package}"`
-          );
-        }
-        const { manifest: external, digest } = readSidecar(path);
-        contributions.push({
-          package: owner?.name ?? allowed.package,
-          source: allowed.path,
-          route: "sidecar",
-          contractDigest: digest,
-          entries: external.capabilities
-        });
-      }
-      for (const [name, extracted] of [...sourceEntries].sort(([a], [b]) => a.localeCompare(b))) {
-        if (extracted.length === 0) continue;
-        const sorted = mergeEntries(extracted);
-        contributions.push({
-          package: name,
-          source: sorted[0]?.origin ?? name,
-          route: "source",
-          contractDigest: sha256(canonicalJson(sorted)),
-          entries: sorted
-        });
-      }
-      const externalContracts = authorizeContributions(contributions, options.externalContracts);
-      const externalEntries = contributions.flatMap((contribution) => contribution.entries);
-      const capabilities = mergeEntries([...entries, ...externalEntries]);
-      validateEntries(capabilities);
-      const targets = [...new Set(capabilities.flatMap((entry) => entry.targets))].sort();
-      const payload = {
-        formatVersion: 5,
-        compilerVersion: COMPILER_VERSION,
-        targets,
-        capabilities,
-        externalContracts,
-        completeness: { status: "proven" }
-      };
-      manifest = { ...payload, hash: computeManifestHash(payload) };
-      options.onManifest?.(manifest);
-    },
-    renderChunk(code) {
-      if (!manifest || !code.includes(placeholder) && !code.includes(manifestPlaceholder)) return null;
-      return {
-        code: code.replaceAll(placeholder, manifest.hash).replaceAll(manifestPlaceholder, JSON.stringify(manifest)),
-        map: null
-      };
-    },
-    generateBundle() {
-      if (!manifest || options.emit === false) return;
-      this.emitFile({
-        type: "asset",
-        fileName: options.fileName ?? CONTRACT_FILE,
-        source: canonicalManifestJson(manifest)
-      });
-    }
-  };
-}
-
-// src/compile.ts
-import { resolve as resolve3 } from "path";
-import { build } from "vite";
-async function compileCapabilityContract(options = {}) {
-  let manifest;
-  const root = resolve3(options.root ?? process.cwd());
-  const result = await build({
-    ...options.vite ?? {},
-    root,
-    ...options.configFile ? { configFile: resolve3(root, options.configFile) } : {},
-    logLevel: options.vite?.logLevel ?? "silent",
-    build: {
-      ...options.vite?.build ?? {},
-      write: false
-    },
-    plugins: [
-      ...options.vite?.plugins ?? [],
-      agentSurface({
-        target: options.target,
-        emit: false,
-        ...options.externalContracts ? { externalContracts: options.externalContracts } : {},
-        onManifest: (value) => {
-          manifest = value;
-        }
-      })
-    ]
-  });
-  const outputs = Array.isArray(result) ? result : [result];
-  for (const output of outputs) {
-    if (!("output" in output)) continue;
-    const asset = output.output.find(
-      (entry) => entry.type === "asset" && entry.fileName === "agent-surface.contract.json"
-    );
-    if (asset?.type === "asset") {
-      const source = typeof asset.source === "string" ? asset.source : new TextDecoder().decode(asset.source);
-      manifest = JSON.parse(source);
-      break;
-    }
-  }
-  if (!manifest) throw new Error("compiler did not produce a capability contract");
-  return manifest;
-}
+  COMPILER_VERSION,
+  CONTRACT_FILE,
+  VIRTUAL_CONTRACT_ID,
+  agentSurface,
+  canonicalJson,
+  canonicalManifestJson,
+  compileCapabilityContract,
+  computeManifestHash,
+  manifestPayload,
+  sha256,
+  verifyManifest
+} from "./chunk-BNIUE5RA.js";
 export {
   COMPILER_VERSION,
   CONTRACT_FILE,