@agentplat/inference-control 0.3.0-beta.2 → 0.3.0-beta.3

package/dist/role-realignment-portable-agent.js

@@ -0,0 +1,634 @@
+import { normalizeCheckpointTransferV1, normalizeRoleBindingV1, } from "@agentplat/runtime/adapter";
+import { digestTrustEligibilityDecisionV1, validateTrustEligibilityDecisionV1, } from "@agentplat/trust";
+import { assertRoleAlignmentStateV1, createRoleAlignmentPolicyRecordV1, createRoleAlignmentRoleAnchorV1, } from "./role-alignment.js";
+import { admitRoleCandidateV1, assertTrustedRoleDefinitionWithinAuthorityCeilingV1, assertRoleRealignmentStateV1, beginRoleRealignmentActivationV1, certifyRoleRealignmentSelectionV1, completeRoleRealignmentActivationV1, createRoleCandidateEvaluationV1, createRoleRealignmentPolicyRecordV1, createRoleRealignmentRequestV1, createRoleRealignmentStateV1, digestRoleRealignmentJsonV1, expireRoleRealignmentV1, recordRoleCandidateEvaluationV1, rebindRoleRealignmentSessionV1, selectRoleCandidateV1, validateTrustedRoleDefinitionV1, } from "./role-realignment.js";
+import { assertDigest, assertExactKeys, assertIdentifier, assertSafeInteger, deepFreeze, } from "./validation.js";
+export class RoleRealignmentStoreConflictErrorV1 extends Error {
+    name = "RoleRealignmentStoreConflictErrorV1";
+    constructor(message = "role realignment state revision conflict") {
+        super(message);
+    }
+}
+export class InMemoryRoleRealignmentStateStoreV1 {
+    states = new Map();
+    async load(sessionId) {
+        assertIdentifier(sessionId, "sessionId");
+        return this.states.get(sessionId);
+    }
+    async save(state, expectedRevision) {
+        const current = this.states.get(state.activeSessionId);
+        if ((expectedRevision === null && current !== undefined) ||
+            (expectedRevision !== null && current?.revision !== expectedRevision))
+            throw new RoleRealignmentStoreConflictErrorV1();
+        this.states.set(state.activeSessionId, state);
+    }
+    async rebind(input) {
+        const source = this.states.get(input.sourceSessionId);
+        if (source?.revision !== input.expectedSourceRevision ||
+            this.states.has(input.targetState.activeSessionId) ||
+            input.sourceSessionId === input.targetState.activeSessionId)
+            throw new RoleRealignmentStoreConflictErrorV1();
+        this.states.delete(input.sourceSessionId);
+        this.states.set(input.targetState.activeSessionId, input.targetState);
+    }
+}
+export function createRoleRealignmentPortableAgentV1(options) {
+    return new RoleRealignmentPortableAgent(options);
+}
+class RoleRealignmentPortableAgent {
+    binding;
+    options;
+    policy;
+    alignmentPolicy;
+    stateStore;
+    constructor(options) {
+        validatePortableOptions(options);
+        const policyRecord = createRoleRealignmentPolicyRecordV1(options.policy);
+        const alignmentPolicyRecord = createRoleAlignmentPolicyRecordV1(options.alignmentPolicy);
+        this.options = options;
+        this.policy = policyRecord.policy;
+        this.alignmentPolicy = alignmentPolicyRecord.policy;
+        this.stateStore =
+            options.stateStore ?? new InMemoryRoleRealignmentStateStoreV1();
+        this.binding = deepFreeze({
+            controllerId: options.controllerId,
+            controllerVersion: options.controllerVersion,
+            implementationId: options.implementationId,
+            policyId: policyRecord.policy.policyId,
+            policyVersion: policyRecord.policy.policyVersion,
+            policyDigest: policyRecord.policyDigest,
+            alignmentPolicyDigest: alignmentPolicyRecord.policyDigest,
+        });
+    }
+    async getState(sessionId) {
+        assertIdentifier(sessionId, "sessionId");
+        const state = await this.stateStore.load(sessionId);
+        if (!state)
+            return undefined;
+        assertRoleRealignmentStateV1(state, this.policy, {
+            controllerId: this.binding.controllerId,
+            controllerVersion: this.binding.controllerVersion,
+            implementationId: this.binding.implementationId,
+            activeSessionId: sessionId,
+        });
+        return state;
+    }
+    async run(input) {
+        validateRunInput(input);
+        let state = await this.getState(input.sessionId);
+        if (!state)
+            state = await this.start(input);
+        if (state.status === "expired" || state.status === "failed")
+            return state;
+        if (input.logicalTimeMs >= state.request.expiresAtLogicalMs) {
+            const expired = expireRoleRealignmentV1(state, {
+                expectedRevision: state.revision,
+                logicalTimeMs: input.logicalTimeMs,
+            }, this.policy);
+            await this.persistTransition(state, expired);
+            return expired.state;
+        }
+        if (state.status === "requested" || state.status === "collecting")
+            state = await this.discoverAndEvaluate(state, input);
+        if (state.status === "collecting") {
+            const selected = selectRoleCandidateV1(state, {
+                expectedRevision: state.revision,
+                selectionId: input.selectionId,
+                logicalTimeMs: input.logicalTimeMs,
+            }, this.policy);
+            await this.persistTransition(state, selected);
+            state = selected.state;
+        }
+        if (state.status === "selected") {
+            const certificate = await this.options.certification.certify({
+                state,
+                policy: this.policy,
+                logicalTimeMs: input.logicalTimeMs,
+                expiresAtLogicalMs: Math.min(state.request.expiresAtLogicalMs, input.logicalTimeMs + this.options.certificationTtlMs),
+                signal: input.signal,
+            });
+            if (!certificate)
+                return state;
+            const certified = certifyRoleRealignmentSelectionV1(state, {
+                expectedRevision: state.revision,
+                certificate,
+                logicalTimeMs: input.logicalTimeMs,
+            }, this.policy);
+            await this.persistTransition(state, certified);
+            state = certified.state;
+        }
+        if (state.status === "certified") {
+            const selection = state.selection;
+            if (!selection)
+                throw new TypeError("role_realignment_selection_required");
+            const selectedCandidate = state.candidates.find(({ candidateDigest }) => candidateDigest === selection.selectedCandidateDigest);
+            if (!selectedCandidate)
+                throw new TypeError("role_realignment_selected_candidate_missing");
+            const definition = await this.resolveCandidateDefinition(selectedCandidate, input.logicalTimeMs, state.request.authorityCeiling);
+            const activating = beginRoleRealignmentActivationV1(state, {
+                expectedRevision: state.revision,
+                activationId: input.activationId,
+                definition,
+                logicalTimeMs: input.logicalTimeMs,
+            }, this.policy);
+            await this.persistTransition(state, activating);
+            state = activating.state;
+        }
+        if (state.status === "activating")
+            state = await this.resumeActivation(state, input.logicalTimeMs);
+        return state;
+    }
+    async exportHandoff(input) {
+        const state = await this.requireState(input.sessionId);
+        const transfer = normalizeCheckpointTransferV1(input.checkpointTransfer, {
+            maximumStateBytes: this.policy.limits.maximumStateBytes,
+        });
+        assertSafeInteger(input.logicalTimeMs, "logicalTimeMs");
+        if (input.logicalTimeMs < state.lastLogicalTimeMs ||
+            transfer.sourceSessionId !== state.activeSessionId ||
+            transfer.sourceAgentId !== state.activeAgentId ||
+            transfer.objectiveId !== state.objectiveId ||
+            transfer.roleBindingId !==
+                (state.status === "activated"
+                    ? state.activation.roleBinding.roleBindingId
+                    : state.request.currentRoleBindingId))
+            throw new TypeError("role_realignment_handoff_binding_invalid");
+        const checkpointTransferDigest = digestRoleRealignmentJsonV1("handoff", transfer);
+        const body = {
+            schemaVersion: 1,
+            contentClass: "role_realignment_state",
+            controllerId: this.binding.controllerId,
+            controllerVersion: this.binding.controllerVersion,
+            implementationId: this.binding.implementationId,
+            policyDigest: this.binding.policyDigest,
+            sourceSessionId: state.activeSessionId,
+            sourceAgentId: state.activeAgentId,
+            sourceRoleAnchorDigest: state.activeRoleAnchorDigest,
+            checkpointTransferDigest,
+            sourceState: state,
+            exportedAtLogicalMs: input.logicalTimeMs,
+        };
+        return deepFreeze({
+            ...body,
+            handoffDigest: digestRoleRealignmentJsonV1("handoff", body),
+        });
+    }
+    async importHandoff(input) {
+        const transfer = normalizeCheckpointTransferV1(input.checkpointTransfer, {
+            maximumStateBytes: this.policy.limits.maximumStateBytes,
+        });
+        const handoff = this.validateHandoff(input.handoff, transfer);
+        for (const candidate of handoff.sourceState.candidates)
+            await this.resolveCandidateDefinition(candidate, input.logicalTimeMs, handoff.sourceState.request.authorityCeiling);
+        if (handoff.sourceState.activation)
+            await this.validateLocalDefinition(handoff.sourceState.activation.definition, input.logicalTimeMs, handoff.sourceState.request.authorityCeiling);
+        const target = input.targetAlignmentState;
+        assertRoleAlignmentStateV1(target, this.alignmentPolicy, {
+            sessionId: target.sessionId,
+        });
+        assertSafeInteger(input.logicalTimeMs, "logicalTimeMs");
+        if (input.logicalTimeMs < handoff.exportedAtLogicalMs ||
+            target.tenantId !== handoff.sourceState.tenantId ||
+            target.objectiveId !== handoff.sourceState.objectiveId ||
+            target.sessionId === handoff.sourceSessionId ||
+            transfer.sourceSessionId !== handoff.sourceSessionId)
+            throw new TypeError("role_realignment_handoff_binding_invalid");
+        const activated = handoff.sourceState.status === "activated";
+        const expectedRole = activated
+            ? handoff.sourceState.activation.roleBinding
+            : null;
+        if ((activated &&
+            (target.roleAnchor.roleBindingId !== expectedRole.roleBindingId ||
+                target.roleAnchor.roleRevision !== expectedRole.roleRevision)) ||
+            (!activated &&
+                (target.roleAnchor.roleBindingId !==
+                    handoff.sourceState.request.currentRoleBindingId ||
+                    target.roleAnchor.roleRevision !==
+                        handoff.sourceState.request.currentRoleRevision ||
+                    target.roleAnchor.roleContentDigest !==
+                        handoff.sourceState.request.currentRoleContentDigest)))
+            throw new TypeError("role_realignment_handoff_role_mismatch");
+        const rebound = rebindRoleRealignmentSessionV1(handoff.sourceState, {
+            expectedRevision: handoff.sourceState.revision,
+            targetSessionId: target.sessionId,
+            targetAgentId: target.agentId,
+            targetRoleAnchorDigest: target.roleAnchor.anchorDigest,
+            transferDigest: handoff.checkpointTransferDigest,
+            logicalTimeMs: input.logicalTimeMs,
+        }, this.policy);
+        await this.stateStore.rebind({
+            sourceSessionId: handoff.sourceSessionId,
+            targetState: rebound.state,
+            expectedSourceRevision: handoff.sourceState.revision,
+        });
+        await this.observe(rebound);
+        return rebound.state;
+    }
+    async start(input) {
+        const alignment = await this.options.alignment.getState(input.sessionId);
+        if (!alignment)
+            throw new TypeError("role_alignment_state_unavailable");
+        const request = createRoleRealignmentRequestV1({
+            requestId: input.requestId,
+            policy: this.policy,
+            alignmentPolicy: this.alignmentPolicy,
+            alignmentState: alignment,
+            authorityCeiling: input.authorityCeiling,
+            createdAtLogicalMs: input.logicalTimeMs,
+            expiresAtLogicalMs: input.logicalTimeMs + this.options.requestTtlMs,
+        });
+        const state = createRoleRealignmentStateV1({
+            controllerId: this.binding.controllerId,
+            controllerVersion: this.binding.controllerVersion,
+            implementationId: this.binding.implementationId,
+            policy: this.policy,
+            request,
+            createdAtLogicalMs: input.logicalTimeMs,
+        });
+        await this.stateStore.save(state, null);
+        await this.observe({ state, event: state.events[0] });
+        return state;
+    }
+    async discoverAndEvaluate(stateInput, input) {
+        let state = stateInput;
+        const proposalSets = await Promise.all(this.options.discovery.map(async (strategy) => ({
+            strategy,
+            proposals: await strategy.propose({
+                request: state.request,
+                logicalTimeMs: input.logicalTimeMs,
+                signal: input.signal,
+            }),
+        })));
+        const proposals = proposalSets
+            .flatMap(({ strategy, proposals: values }) => values.map((proposal) => ({ strategy, proposal })))
+            .sort((left, right) => compare(left.proposal.proposalDigest, right.proposal.proposalDigest));
+        for (const { strategy, proposal } of proposals) {
+            if (state.candidates.some((candidate) => candidate.proposal.proposalDigest === proposal.proposalDigest ||
+                candidate.proposal.definitionDigest === proposal.definitionDigest))
+                continue;
+            if (proposal.proposerId !== strategy.proposerId ||
+                proposal.proposerVersion !== strategy.proposerVersion ||
+                proposal.proposerBindingDigest !== strategy.proposerBindingDigest)
+                throw new TypeError("role_discovery_strategy_binding_mismatch");
+            const trustDigest = await this.eligibleSubjectDigest({
+                tenantId: state.tenantId,
+                subjectKind: "proposer",
+                subjectId: strategy.proposerId,
+                subjectBindingDigest: strategy.proposerBindingDigest,
+                requestDigest: state.request.requestDigest,
+                candidateDigest: null,
+                logicalTimeMs: input.logicalTimeMs,
+            });
+            if (!trustDigest)
+                continue;
+            const definition = await this.options.catalog.resolve({
+                definitionId: proposal.definitionId,
+                definitionRevision: proposal.definitionRevision,
+                definitionDigest: proposal.definitionDigest,
+                logicalTimeMs: input.logicalTimeMs,
+            });
+            if (!definition)
+                continue;
+            const admitted = admitRoleCandidateV1(state, {
+                expectedRevision: state.revision,
+                proposal,
+                proposerEligibilityDecisionDigest: trustDigest,
+                definition,
+                logicalTimeMs: input.logicalTimeMs,
+            }, this.policy);
+            await this.persistTransition(state, admitted);
+            state = admitted.state;
+        }
+        for (const candidate of state.candidates) {
+            const definition = await this.resolveCandidateDefinition(candidate, input.logicalTimeMs, state.request.authorityCeiling);
+            for (const evaluator of this.options.evaluators) {
+                if (state.evaluations.some((evaluation) => evaluation.candidateDigest === candidate.candidateDigest &&
+                    evaluation.evaluatorBindingDigest ===
+                        evaluator.evaluatorBindingDigest))
+                    continue;
+                const trustDigest = await this.eligibleSubjectDigest({
+                    tenantId: state.tenantId,
+                    subjectKind: "evaluator",
+                    subjectId: evaluator.evaluatorId,
+                    subjectBindingDigest: evaluator.evaluatorBindingDigest,
+                    requestDigest: state.request.requestDigest,
+                    candidateDigest: candidate.candidateDigest,
+                    logicalTimeMs: input.logicalTimeMs,
+                });
+                if (!trustDigest)
+                    continue;
+                const result = await evaluator.evaluate({
+                    request: state.request,
+                    candidate,
+                    definition,
+                    logicalTimeMs: input.logicalTimeMs,
+                    signal: input.signal,
+                });
+                const evaluation = createRoleCandidateEvaluationV1({
+                    evaluationId: `evaluation-${candidate.candidateDigest.slice(7, 23)}-${evaluator.evaluatorBindingDigest.slice(7, 23)}`,
+                    requestDigest: state.request.requestDigest,
+                    candidateDigest: candidate.candidateDigest,
+                    definitionDigest: candidate.proposal.definitionDigest,
+                    evaluatorId: evaluator.evaluatorId,
+                    evaluatorVersion: evaluator.evaluatorVersion,
+                    evaluatorBindingDigest: evaluator.evaluatorBindingDigest,
+                    eligibilityDecisionDigest: trustDigest,
+                    eligible: result.eligible,
+                    roleFitBps: result.roleFitBps,
+                    missionContributionBps: result.missionContributionBps,
+                    uncertaintyBps: result.uncertaintyBps,
+                    transitionRiskBps: result.transitionRiskBps,
+                    reasonCodes: result.reasonCodes,
+                    evidenceReferenceIds: result.evidenceReferenceIds,
+                    evaluatedAtLogicalMs: input.logicalTimeMs,
+                    expiresAtLogicalMs: Math.min(state.request.expiresAtLogicalMs, input.logicalTimeMs + this.options.evaluationTtlMs),
+                });
+                const recorded = recordRoleCandidateEvaluationV1(state, {
+                    expectedRevision: state.revision,
+                    evaluation,
+                    logicalTimeMs: input.logicalTimeMs,
+                }, this.policy);
+                await this.persistTransition(state, recorded);
+                state = recorded.state;
+            }
+        }
+        return state;
+    }
+    async resolveCandidateDefinition(candidate, logicalTimeMs, authorityCeiling) {
+        const definition = await this.options.catalog.resolve({
+            catalogId: candidate.catalogId,
+            definitionId: candidate.proposal.definitionId,
+            definitionRevision: candidate.proposal.definitionRevision,
+            definitionDigest: candidate.proposal.definitionDigest,
+            logicalTimeMs,
+        });
+        if (!definition)
+            throw new TypeError("trusted_role_definition_unavailable");
+        const validated = validateTrustedRoleDefinitionV1(definition, this.policy);
+        if (validated.catalogId !== candidate.catalogId ||
+            validated.definitionId !== candidate.proposal.definitionId ||
+            validated.definitionRevision !== candidate.proposal.definitionRevision ||
+            validated.definitionDigest !== candidate.proposal.definitionDigest)
+            throw new TypeError("trusted_role_definition_binding_mismatch");
+        assertTrustedRoleDefinitionWithinAuthorityCeilingV1(validated, authorityCeiling);
+        return validated;
+    }
+    async validateLocalDefinition(sourceDefinition, logicalTimeMs, authorityCeiling) {
+        const definition = validateTrustedRoleDefinitionV1(sourceDefinition, this.policy);
+        const local = await this.options.catalog.resolve({
+            catalogId: definition.catalogId,
+            definitionId: definition.definitionId,
+            definitionRevision: definition.definitionRevision,
+            definitionDigest: definition.definitionDigest,
+            logicalTimeMs,
+        });
+        if (!local)
+            throw new TypeError("trusted_role_definition_unavailable");
+        const validated = validateTrustedRoleDefinitionV1(local, this.policy);
+        if (validated.definitionDigest !== definition.definitionDigest)
+            throw new TypeError("trusted_role_definition_binding_mismatch");
+        assertTrustedRoleDefinitionWithinAuthorityCeilingV1(validated, authorityCeiling);
+        return validated;
+    }
+    async eligibleSubjectDigest(input) {
+        const raw = await this.options.trustEligibility.evaluate(input);
+        if (!raw)
+            return null;
+        let decision;
+        try {
+            decision = validateTrustEligibilityDecisionV1(raw);
+        }
+        catch {
+            return null;
+        }
+        if (decision.disposition !== "eligible" ||
+            decision.evaluatedAtLogicalMs > input.logicalTimeMs)
+            return null;
+        return `sha256:${digestTrustEligibilityDecisionV1(decision)}`;
+    }
+    async resumeActivation(state, logicalTimeMs) {
+        const activation = state.activation;
+        if (!activation)
+            throw new TypeError("role_realignment_activation_missing");
+        const targetRole = normalizeRoleBindingV1(activation.roleBinding);
+        let session = await this.options.runtime.getSession(state.activeSessionId);
+        if (!session)
+            throw new TypeError("portable_agent_session_unavailable");
+        assertRuntimeBinding(state, session);
+        if (!sameRole(session.role, targetRole)) {
+            if (session.role.roleBindingId !== state.request.currentRoleBindingId ||
+                session.role.roleRevision !== state.request.currentRoleRevision)
+                throw new TypeError("portable_agent_role_transition_conflict");
+            session = await this.options.runtime.updateRole(state.activeSessionId, targetRole, session.revision);
+        }
+        let alignment = await this.options.alignment.getState(state.activeSessionId);
+        if (!alignment)
+            throw new TypeError("role_alignment_state_unavailable");
+        const targetAnchor = roleAnchorFor(session, targetRole);
+        if (alignment.roleAnchor.anchorDigest !== targetAnchor.anchorDigest) {
+            alignment = await this.options.alignment.activateSessionRole({
+                sessionId: state.activeSessionId,
+                expectedRevision: alignment.revision,
+                tenantId: state.tenantId,
+                agentId: state.activeAgentId,
+                role: targetRole,
+                logicalTimeMs,
+            });
+        }
+        if (alignment.roleAnchor.anchorDigest !== targetAnchor.anchorDigest)
+            throw new TypeError("role_alignment_activation_mismatch");
+        const completed = completeRoleRealignmentActivationV1(state, {
+            expectedRevision: state.revision,
+            runtimeSessionRevision: session.revision,
+            alignmentStateRevision: alignment.revision,
+            alignmentRoleAnchorDigest: alignment.roleAnchor.anchorDigest,
+            logicalTimeMs,
+        }, this.policy);
+        await this.persistTransition(state, completed);
+        return completed.state;
+    }
+    async persistTransition(previous, transition) {
+        await this.stateStore.save(transition.state, previous.revision);
+        await this.observe(transition);
+    }
+    async observe(transition) {
+        if (!this.options.observer)
+            return;
+        try {
+            await this.options.observer.observe({
+                activeSessionId: transition.state.activeSessionId,
+                status: transition.state.status,
+                revision: transition.state.revision,
+                stateDigest: transition.state.stateDigest,
+                event: transition.event,
+            });
+        }
+        catch {
+            // Enforcement state is already durable; observation is non-authoritative.
+        }
+    }
+    validateHandoff(input, transfer) {
+        assertExactKeys(input, [
+            "schemaVersion",
+            "contentClass",
+            "controllerId",
+            "controllerVersion",
+            "implementationId",
+            "policyDigest",
+            "sourceSessionId",
+            "sourceAgentId",
+            "sourceRoleAnchorDigest",
+            "checkpointTransferDigest",
+            "sourceState",
+            "exportedAtLogicalMs",
+            "handoffDigest",
+        ], "role realignment handoff");
+        assertRoleRealignmentStateV1(input.sourceState, this.policy, {
+            controllerId: this.binding.controllerId,
+            controllerVersion: this.binding.controllerVersion,
+            implementationId: this.binding.implementationId,
+            activeSessionId: input.sourceSessionId,
+        });
+        const { handoffDigest, ...body } = input;
+        if (input.schemaVersion !== 1 ||
+            input.contentClass !== "role_realignment_state" ||
+            input.policyDigest !== this.binding.policyDigest ||
+            input.sourceAgentId !== input.sourceState.activeAgentId ||
+            input.sourceRoleAnchorDigest !==
+                input.sourceState.activeRoleAnchorDigest ||
+            input.checkpointTransferDigest !==
+                digestRoleRealignmentJsonV1("handoff", transfer) ||
+            transfer.sourceSessionId !== input.sourceSessionId ||
+            transfer.sourceAgentId !== input.sourceAgentId ||
+            transfer.objectiveId !== input.sourceState.objectiveId ||
+            digestRoleRealignmentJsonV1("handoff", body) !==
+                handoffDigest)
+            throw new TypeError("role_realignment_handoff_invalid");
+        return input;
+    }
+    async requireState(sessionId) {
+        const state = await this.getState(sessionId);
+        if (!state)
+            throw new TypeError("role_realignment_state_unavailable");
+        return state;
+    }
+}
+function validatePortableOptions(options) {
+    if (!options || typeof options !== "object")
+        throw new TypeError("role_realignment_options_required");
+    assertIdentifier(options.controllerId, "controllerId");
+    assertSafeInteger(options.controllerVersion, "controllerVersion", 1);
+    assertIdentifier(options.implementationId, "implementationId");
+    const policy = createRoleRealignmentPolicyRecordV1(options.policy).policy;
+    createRoleAlignmentPolicyRecordV1(options.alignmentPolicy);
+    if (!options.alignment ||
+        typeof options.alignment.getState !== "function" ||
+        typeof options.alignment.activateSessionRole !== "function" ||
+        !options.runtime ||
+        typeof options.runtime.getSession !== "function" ||
+        typeof options.runtime.updateRole !== "function" ||
+        !Array.isArray(options.discovery) ||
+        !options.discovery.length ||
+        options.discovery.length > policy.limits.maximumProposers ||
+        !Array.isArray(options.evaluators) ||
+        options.evaluators.length < policy.minimumIndependentEvaluations ||
+        options.evaluators.length > policy.limits.maximumEvaluationsPerCandidate ||
+        !options.catalog ||
+        typeof options.catalog.resolve !== "function" ||
+        !options.trustEligibility ||
+        typeof options.trustEligibility.evaluate !== "function" ||
+        !options.certification ||
+        typeof options.certification.certify !== "function")
+        throw new TypeError("role_realignment_port_invalid");
+    const proposerBindings = new Set();
+    for (const proposer of options.discovery) {
+        assertIdentifier(proposer.proposerId, "proposerId");
+        assertSafeInteger(proposer.proposerVersion, "proposerVersion", 1);
+        assertDigest(proposer.proposerBindingDigest, "proposerBindingDigest");
+        if (typeof proposer.propose !== "function" ||
+            proposerBindings.has(proposer.proposerBindingDigest))
+            throw new TypeError("role_discovery_strategy_invalid");
+        proposerBindings.add(proposer.proposerBindingDigest);
+    }
+    const evaluatorBindings = new Set();
+    for (const evaluator of options.evaluators) {
+        assertIdentifier(evaluator.evaluatorId, "evaluatorId");
+        assertSafeInteger(evaluator.evaluatorVersion, "evaluatorVersion", 1);
+        assertDigest(evaluator.evaluatorBindingDigest, "evaluatorBindingDigest");
+        if (typeof evaluator.evaluate !== "function" ||
+            evaluatorBindings.has(evaluator.evaluatorBindingDigest))
+            throw new TypeError("role_candidate_evaluator_invalid");
+        evaluatorBindings.add(evaluator.evaluatorBindingDigest);
+    }
+    for (const [label, value, maximum] of [
+        ["requestTtlMs", options.requestTtlMs, policy.limits.maximumRequestTtlMs],
+        [
+            "evaluationTtlMs",
+            options.evaluationTtlMs,
+            policy.limits.maximumEvaluationTtlMs,
+        ],
+        [
+            "certificationTtlMs",
+            options.certificationTtlMs,
+            policy.limits.maximumCertificationTtlMs,
+        ],
+    ]) {
+        assertSafeInteger(value, label, 1);
+        if (value > maximum)
+            throw new TypeError(`${label}_exceeds_policy`);
+    }
+    if (options.stateStore !== undefined &&
+        (typeof options.stateStore.load !== "function" ||
+            typeof options.stateStore.save !== "function" ||
+            typeof options.stateStore.rebind !== "function"))
+        throw new TypeError("role_realignment_state_store_invalid");
+    if (options.observer !== undefined &&
+        typeof options.observer.observe !== "function")
+        throw new TypeError("role_realignment_observer_invalid");
+}
+function validateRunInput(input) {
+    if (!input || typeof input !== "object")
+        throw new TypeError("role_realignment_run_input_required");
+    for (const [label, value] of [
+        ["sessionId", input.sessionId],
+        ["requestId", input.requestId],
+        ["selectionId", input.selectionId],
+        ["activationId", input.activationId],
+    ])
+        assertIdentifier(value, label);
+    assertSafeInteger(input.logicalTimeMs, "logicalTimeMs");
+}
+function roleAnchorFor(session, role) {
+    return createRoleAlignmentRoleAnchorV1({
+        tenantId: session.tenantId,
+        sessionId: session.sessionId,
+        agentId: session.agentId,
+        objectiveId: role.objectiveId,
+        roleBindingId: role.roleBindingId,
+        roleRevision: role.roleRevision,
+        predecessorRoleBindingId: role.predecessorRoleBindingId,
+        roleKey: role.roleKey,
+        roleContent: {
+            instructions: [...role.instructions],
+            constraints: role.constraints,
+            validFromLogicalMs: role.validFromLogicalMs,
+            validUntilLogicalMs: role.validUntilLogicalMs,
+        },
+    });
+}
+function assertRuntimeBinding(state, session) {
+    if (session.sessionId !== state.activeSessionId ||
+        session.tenantId !== state.tenantId ||
+        session.agentId !== state.activeAgentId ||
+        session.objectiveId !== state.objectiveId ||
+        (session.status !== "active" && session.status !== "paused"))
+        throw new TypeError("portable_agent_session_binding_mismatch");
+}
+function sameRole(left, right) {
+    return (digestRoleRealignmentJsonV1("role_binding", left) ===
+        digestRoleRealignmentJsonV1("role_binding", right));
+}
+function compare(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+//# sourceMappingURL=role-realignment-portable-agent.js.map