@agentdocumentformat/cli 0.7.2

package/dist/chunks/chunk-WFQUVXML.mjs

@@ -0,0 +1,295 @@
+import { createRequire as __adfCreateRequire } from 'node:module';
+import { fileURLToPath as __adfFileURLToPath } from 'node:url';
+import { dirname as __adfDirname } from 'node:path';
+const require = __adfCreateRequire(import.meta.url);
+const __filename = __adfFileURLToPath(import.meta.url);
+const __dirname = __adfDirname(__filename);
+
+// src/shared/types/adf-v02.types.ts
+var AGENT_STATES = ["active", "idle", "hibernate", "suspended", "off"], RESERVED_AGENT_PATH_SEGMENTS = ["inbox", "card", "health"], MESSAGING_MODES = ["proactive", "respond_only", "listen_only"];
+var SETTABLE_STATES = ["idle", "hibernate", "off"], UPDATABLE_STATES = ["active", "idle", "hibernate", "off"];
+var RECOVERY_DEFAULTS = {
+  auto_retry: !0,
+  max_attempts: 5,
+  base_delay_ms: 15e3,
+  max_delay_ms: 3e5
+};
+var CODE_EXECUTION_DEFAULTS = {
+  model_invoke: !0,
+  sys_lambda: !0,
+  task_resolve: !0,
+  loop_inject: !0,
+  identity_status: !0,
+  get_identity: !0,
+  set_identity: !0,
+  emit_event: !0,
+  attestation_list: !0,
+  attestation_add: !0,
+  attestation_issue: !0,
+  network: !1,
+  // Signing certs about other agents is a deliberate trust act — authorized
+  // code only, unless the owner overrides restricted_methods explicitly.
+  restricted_methods: ["attestation_issue"]
+}, COMPUTE_DEFAULTS = {
+  enabled: !1
+};
+var START_IN_STATES = ["active", "idle", "hibernate"], DEFAULT_NEW_LOOP_TOOLS = ["loop_send", "loop_list", "sys_set_state"], LOOP_PROHIBITED_TOOLS = ["sys_update_config", "loop_manage", "sys_create_adf"];
+var META_PROTECTION_LEVELS = ["none", "readonly", "increment"], FILE_PROTECTION_LEVELS = ["read_only", "no_delete", "none"];
+var DEFAULT_TOOLS = [
+  { name: "fs_read", enabled: !0, visible: !0 },
+  { name: "fs_write", enabled: !0, visible: !0 },
+  { name: "fs_list", enabled: !0, visible: !0 },
+  { name: "fs_delete", enabled: !1, visible: !1 },
+  { name: "msg_send", enabled: !0, visible: !0 },
+  { name: "agent_discover", enabled: !0, visible: !0 },
+  { name: "msg_list", enabled: !0, visible: !0 },
+  { name: "msg_read", enabled: !0, visible: !0 },
+  { name: "msg_update", enabled: !0, visible: !0 },
+  // Code-path capability: callable as adf.chat_info from sandbox code without
+  // occupying a slot in the LLM tool schema. Flip visible to expose it.
+  { name: "chat_info", enabled: !0, visible: !1 },
+  { name: "sys_code", enabled: !0, visible: !0 },
+  { name: "sys_lambda", enabled: !0, visible: !0 },
+  // Timers default on: the base prompt treats them as core behavior
+  // (Initiate, Reflection, the hot path) — shipping them disabled forced a
+  // fresh agent through the escalation ladder just to follow its own charter.
+  { name: "sys_set_timer", enabled: !0, visible: !0 },
+  { name: "sys_list_timers", enabled: !0, visible: !0 },
+  { name: "sys_delete_timer", enabled: !0, visible: !0 },
+  { name: "sys_get_config", enabled: !0, visible: !0 },
+  { name: "sys_update_config", enabled: !0, visible: !0, restricted: !0 },
+  { name: "sys_create_adf", enabled: !1, visible: !1, restricted: !0 },
+  { name: "db_query", enabled: !0, visible: !0 },
+  { name: "db_execute", enabled: !1, visible: !1 },
+  { name: "loop_compact", enabled: !1, visible: !1 },
+  { name: "loop_clear", enabled: !1, visible: !1 },
+  // Inter-loop signalling. Ordinary, visible, owner-toggled tools like any
+  // other (no-secrets): the config declares them, the Tools UI shows them, and
+  // an owner may turn them off. On by default and registered into main's
+  // registry whenever enabled — like ws_connections/stream_bindings, they are
+  // simply present and return sensibly when there is nothing to act on
+  // (loop_list shows just `main`; loop_send errors on any target). No
+  // gate on loop count: that special-cased two tools for a byte-identical
+  // prompt that default-on loop_manage already voids.
+  { name: "loop_send", enabled: !0, visible: !0 },
+  { name: "loop_list", enabled: !0, visible: !0 },
+  // Main-only: creates/updates/tears down this agent's own inner loops.
+  // On and ungated by default, because a loop is a strict ATTENUATION of
+  // authority main already holds: deriveLoopConfig intersects the loop's
+  // allow-list with the host's enabled tools, drops every `restricted` name,
+  // and clamps code_execution — so loop_manage cannot expand the agent's
+  // capability surface, only subdivide it. Creating a loop is therefore not an
+  // escalation, and an approval gate would buy no authority the agent did not
+  // already have. Still main-only (LOOP_PROHIBITED_TOOLS keeps it off every
+  // loop) and still the owner's to re-gate with `restricted: true`. It honours
+  // `locked_fields` (a locked `loops` path refuses) and delete archives the
+  // stream and preserves locked timers, so it is recoverable.
+  { name: "loop_manage", enabled: !0, visible: !0 },
+  { name: "msg_delete", enabled: !1, visible: !1 },
+  { name: "say", enabled: !0, visible: !0 },
+  { name: "ask", enabled: !0, visible: !0 },
+  { name: "sys_set_state", enabled: !0, visible: !0 },
+  { name: "sys_get_meta", enabled: !0, visible: !0 },
+  { name: "sys_set_meta", enabled: !0, visible: !0 },
+  { name: "sys_delete_meta", enabled: !0, visible: !0 },
+  { name: "sys_fetch", enabled: !0, visible: !0 },
+  { name: "adf_shell", enabled: !1, visible: !1 },
+  { name: "ws_connect", enabled: !1, visible: !1 },
+  { name: "ws_disconnect", enabled: !1, visible: !1 },
+  { name: "ws_connections", enabled: !1, visible: !1 },
+  { name: "ws_send", enabled: !1, visible: !1 },
+  { name: "stream_bind", enabled: !1, visible: !1 },
+  { name: "stream_unbind", enabled: !1, visible: !1 },
+  { name: "stream_bindings", enabled: !1, visible: !1 },
+  { name: "fs_transfer", enabled: !1, visible: !1 },
+  { name: "compute_exec", enabled: !1, visible: !1, restricted: !0 },
+  { name: "mcp_install", enabled: !1, visible: !1 },
+  { name: "mcp_restart", enabled: !1, visible: !1 },
+  { name: "mcp_uninstall", enabled: !1, visible: !1 }
+], AUDIT_DEFAULTS = {
+  // Loop audit is on by default: compaction is the one routine operation that
+  // destroys history irreversibly, and an agent that reflects on its own past
+  // (see the self-observation skill) needs that record to exist before it
+  // thinks to ask for it. The snapshots are brotli-compressed, so the cost is
+  // small relative to losing the transcript outright.
+  loop: !0,
+  inbox: !1,
+  outbox: !1,
+  files: !1
+}, DYNAMIC_INSTRUCTIONS_DEFAULTS = {
+  inbox_hints: !0,
+  context_warning: !0,
+  idle_reminder: !0,
+  mesh_updates: !0
+}, LOGGING_DEFAULTS = {
+  default_level: "info",
+  rules: [],
+  max_rows: 1e4
+}, MCP_DEFAULTS = {
+  servers: []
+};
+var AGENT_DEFAULTS = {
+  adf_version: "0.2",
+  state: "active",
+  autonomous: !1,
+  autostart: !1,
+  model: {
+    provider: "",
+    model_id: "",
+    temperature: 0.7,
+    max_tokens: 4096,
+    vision: !1
+  },
+  context: {
+    audit: { ...AUDIT_DEFAULTS },
+    dynamic_instructions: { ...DYNAMIC_INSTRUCTIONS_DEFAULTS }
+  },
+  triggers: {
+    on_inbox: {
+      enabled: !0,
+      // No interval_ms → fires immediately on each inbox event (no throttle).
+      targets: [{ scope: "agent" }]
+    },
+    on_outbox: { enabled: !1, targets: [] },
+    on_file_change: {
+      enabled: !0,
+      targets: [{ scope: "agent", filter: { watch: "README.*" }, debounce_ms: 2e3 }]
+    },
+    on_chat: {
+      enabled: !0,
+      targets: [{ scope: "agent" }]
+    },
+    on_timer: {
+      enabled: !0,
+      targets: [{ scope: "system" }, { scope: "agent" }]
+    },
+    on_tool_call: { enabled: !1, targets: [] },
+    on_task_create: { enabled: !1, targets: [] },
+    on_task_complete: { enabled: !0, targets: [{ scope: "agent" }] },
+    on_logs: { enabled: !1, targets: [] },
+    on_llm_call: { enabled: !1, targets: [] },
+    on_startup: { enabled: !1, targets: [] }
+  },
+  security: {
+    allow_unsigned: !0,
+    // Signed by default: D1 guarantees every agent has keys, so the old
+    // "signing would reject keyless agents" reason for level 0 is gone.
+    // Unsigned inbound is still accepted (allow_unsigned) for mixed fleets.
+    level: 1
+  },
+  limits: {
+    execution_timeout_ms: 6e4,
+    max_file_read_tokens: 3e4,
+    max_file_write_bytes: 5e6,
+    max_tool_result_tokens: 16e3,
+    max_tool_result_preview_chars: 5e3,
+    max_active_turns: null,
+    max_image_size_bytes: 5242880,
+    max_audio_size_bytes: 10485760,
+    max_video_size_bytes: 20971520
+  },
+  recovery: { ...RECOVERY_DEFAULTS },
+  messaging: {
+    receive: !0,
+    mode: "proactive",
+    visibility: "localhost",
+    inbox_mode: !0
+  },
+  audit: { ...AUDIT_DEFAULTS },
+  code_execution: { ...CODE_EXECUTION_DEFAULTS },
+  compute: { ...COMPUTE_DEFAULTS },
+  logging: { ...LOGGING_DEFAULTS },
+  mcp: { ...MCP_DEFAULTS },
+  adapters: {},
+  serving: {
+    shared: { enabled: !1, patterns: [] },
+    public: { enabled: !1 },
+    api: []
+  },
+  ws_connections: [],
+  // A new agent starts with only its main loop; inner loops are added deliberately.
+  loops: [],
+  stream_bind: {},
+  stream_bindings: [],
+  providers: [],
+  // Dangerous capability toggles (security.allow_local_fetch, stream_bind) are
+  // NOT locked here — they are locked in CODE via DEFAULT_LOCKED_PATHS in
+  // sys-update-config.tool.ts, uniformly for every agent (existing and new),
+  // so the protection can't be lost via per-agent data (no migration risk) or
+  // an owner editing this default's locked_fields on a new agent expecting an
+  // unlock. Keeping them here too would be redundant and misleading. This
+  // array stays available for agent- or template-specific locks unrelated to
+  // that fixed set.
+  locked_fields: [],
+  card: { endpoints: {} }
+};
+function getDefaultDocumentContent(name) {
+  let now = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
+  return `# ${name}
+
+Created: ${now}
+Status: New agent, self-configuring.
+`;
+}
+var DEFAULT_MIND_CONTENT = `# Mind
+
+My index, loaded every turn. Keep it small; details live in pages under \`mind/\`.
+
+## Always
+
+<!-- One line per rule: what my principal wants and why. Corrections and preferences go here, since only this section loads every turn. Also who my principal is and my current focus. -->
+
+## Pages
+
+<!-- One line per page: - [title](adf-file://mind/slug.md) \u2014 one-line hook -->
+`, DEFAULT_MIND_LOG_CONTENT = `# Mind Log
+
+<!-- Newest first: prepend new entries at the top; never rewrite or delete existing entries. Entry format: ## [YYYY-MM-DD] ingest|update|lint | title -->
+`, DEFAULT_SOUL_CONTENT = `# Soul
+
+This is the default voice, shared by every new agent. Keep it and I sound like all of them. The soul-creation skill in the first-party catalog has ten starting voices and a process for adopting or building one.
+
+## Voice
+
+- I answer first. Reasons come after, if they're needed.
+- Short sentences. Short replies to humans.
+- If my principal is wrong or about to waste hours, I say so and propose the fix.
+- "I don't know" is an acceptable answer. When I break something I say what broke, what I changed, and what's still unknown.
+
+## Taboos
+
+- No "Great question", "I'd be happy to", or opening apologies.
+- No summaries that restate what was just said.
+- No offers tacked onto the end of a reply.
+
+## Exemplars
+
+- "Done. The cron runs at 8am Monday; first run is tomorrow."
+- "No, that won't work. The API caps at 100 rows. I'll page through it instead, about 20 minutes."
+- "I broke the deploy at 14:10 and rolled it back at 14:12. A missing env var. Fixed."
+
+## Origin
+
+<!-- Where I came from, who I work for, what I'm becoming. Fill in as it happens. -->
+`;
+
+export {
+  AGENT_STATES,
+  RESERVED_AGENT_PATH_SEGMENTS,
+  MESSAGING_MODES,
+  SETTABLE_STATES,
+  UPDATABLE_STATES,
+  RECOVERY_DEFAULTS,
+  CODE_EXECUTION_DEFAULTS,
+  START_IN_STATES,
+  DEFAULT_NEW_LOOP_TOOLS,
+  LOOP_PROHIBITED_TOOLS,
+  META_PROTECTION_LEVELS,
+  FILE_PROTECTION_LEVELS,
+  DEFAULT_TOOLS,
+  AGENT_DEFAULTS,
+  getDefaultDocumentContent,
+  DEFAULT_MIND_CONTENT,
+  DEFAULT_MIND_LOG_CONTENT,
+  DEFAULT_SOUL_CONTENT
+};