@finalai/agent-definition 0.1.0

package/dist/modules/compiler/assemble.mjs

@@ -0,0 +1,923 @@
+import {
+  agentManifestSchema,
+  BaseCapability,
+  bundleRef,
+  CredentialNodeKind,
+  credentialPolicySchema,
+  DynamicEvent,
+  findDynamicSlots,
+  formatProviderRef,
+  httpMcpServerBindingSchema,
+  InstructionRole,
+  jsonObjectSchema,
+  MANIFEST_VERSION,
+  McpServerBindingKind,
+  packageRef,
+  ProviderRefKind,
+  providerRefSchema,
+  SandboxAccess,
+  SandboxAttach,
+  ScheduleTarget,
+  skillBundleSchema,
+  ToolApproval,
+  toolDescriptorSchema,
+  TurnPolicy
+} from "@finalai/agent-provider";
+import { Cron } from "croner";
+import * as z from "zod";
+import { HookEventKeyKind, normalizeHookKey } from "../authoring/hooks.mjs";
+import { AUTHORED_SERVER_KEY, COMBINED_MCP_SERVERS_EXPORT, SlotKind } from "../runtime/layout.mjs";
+import { IssueSeverity } from "../runtime/lower.mjs";
+import {
+  diagnostic,
+  DiagnosticCode,
+  DiagnosticSeverity
+} from "./diagnostics.mjs";
+import { InstructionSourceKind, isModulePath } from "./discovery.mjs";
+import { preparationFiles } from "./files.mjs";
+import { firstParagraphLine, frontMatterString, parseFrontMatter } from "./frontmatter.mjs";
+const SEVERITY = {
+  [IssueSeverity.Error]: DiagnosticSeverity.Error,
+  [IssueSeverity.Warning]: DiagnosticSeverity.Warning,
+  [IssueSeverity.Note]: DiagnosticSeverity.Note
+};
+const isObject = (value) => jsonObjectSchema.safeParse(value).success;
+const DYNAMIC_EVENTS = new Set(Object.values(DynamicEvent));
+const toDynamicEvents = (events) => Object.values(DynamicEvent).filter((event) => events.includes(event));
+const capabilityOf = (name) => Object.values(BaseCapability).find((capability) => capability === name) ?? null;
+const apiKeySecretSchema = z.looseObject({
+  kind: z.literal(CredentialNodeKind.ApiKey),
+  secret: z.string().min(1)
+});
+const secretRefSchema = z.looseObject({ secretKey: z.string().min(1) });
+const configSecrets = (value) => {
+  if (Array.isArray(value)) return value.flatMap(configSecrets);
+  if (!isObject(value)) return [];
+  const node = apiKeySecretSchema.safeParse(value);
+  const ref = secretRefSchema.safeParse(value);
+  return [
+    ...node.success ? [node.data.secret] : [],
+    ...ref.success ? [ref.data.secretKey] : [],
+    ...Object.values(value).flatMap(configSecrets)
+  ];
+};
+const collectSecrets = (args) => {
+  const names = /* @__PURE__ */ new Set([...args.declared, ...args.reads]);
+  for (const name of configSecrets(args.config)) names.add(name);
+  if (Array.isArray(args.mcpServers)) {
+    for (const binding of args.mcpServers) {
+      if (binding.kind === McpServerBindingKind.Http && binding.auth != null && "secretKey" in binding.auth) {
+        names.add(binding.auth.secretKey);
+      }
+    }
+  }
+  return [...names].sort();
+};
+const SECRET_READ = /secrets\s*\.\s*get\(\s*(?:(['"`])([^'"`$\\]+)\1\s*\)|(?!\s*\)))/g;
+const secretReferences = (files) => Object.entries(files).filter(([path]) => isModulePath(path) || /\.[jt]sx$/.test(path)).flatMap(
+  ([path, source]) => [...source.matchAll(SECRET_READ)].map((match) => ({ path, name: match[2] ?? null }))
+);
+const assemble = (input) => {
+  const diagnostics = [];
+  const report = (severity, code, message, path = null) => {
+    diagnostics.push(diagnostic({ severity, code, message, path }));
+  };
+  const modules = {};
+  const runtimeExport = (name, path) => {
+    modules[name] = path;
+  };
+  const described = input.described?.modules ?? [];
+  for (const module of described) {
+    for (const issue of module.issues)
+      report(SEVERITY[issue.severity], DiagnosticCode.Module, issue.message, module.path);
+  }
+  const ofSlot = (slot) => described.filter((module) => module.slot === slot);
+  const withDefault = (slot) => ofSlot(slot).filter((module) => module.hasDefault && module.value != null);
+  const dynamicSlotFor = (dynamic, resolver, path, slotName) => {
+    for (const event of dynamic.events) {
+      if (!DYNAMIC_EVENTS.has(event)) {
+        report(
+          DiagnosticSeverity.Error,
+          DiagnosticCode.Module,
+          `${slotName} resolves on ${event}; dynamic slots support session.started and turn.started (the harness owns steps)`,
+          path
+        );
+      }
+    }
+    const events = toDynamicEvents(dynamic.events);
+    if (events.length === 0) {
+      report(
+        DiagnosticSeverity.Error,
+        DiagnosticCode.Module,
+        `${slotName} defineDynamic has no session.started or turn.started handler`,
+        path
+      );
+      return null;
+    }
+    runtimeExport(resolver, path);
+    const slot = { $dynamic: { resolver, events } };
+    if (dynamic.description != null) slot.$dynamic.description = dynamic.description;
+    if (dynamic.preview != null) slot.$dynamic.preview = dynamic.preview;
+    if (dynamic.description == null && dynamic.preview == null) {
+      report(
+        DiagnosticSeverity.Note,
+        DiagnosticCode.Module,
+        `${slotName} is resolved per session; give defineDynamic a description (and a preview) so Build can show what it resolves to`,
+        path
+      );
+    }
+    return slot;
+  };
+  const agentModule = ofSlot(SlotKind.Agent)[0] ?? null;
+  let agent = null;
+  if (agentModule != null) {
+    if (!agentModule.hasDefault) {
+      report(
+        DiagnosticSeverity.Error,
+        DiagnosticCode.Module,
+        "agent.ts must export defineAgent({ ... }) as its default export",
+        agentModule.path
+      );
+    } else if (agentModule.value?.type === "agent") agent = agentModule.value;
+  }
+  const agentPath = agentModule?.path ?? "agent.ts";
+  for (const name of input.described?.synthesized ?? []) {
+    if (name !== COMBINED_MCP_SERVERS_EXPORT) runtimeExport(name, agentPath);
+  }
+  let harnessRef = null;
+  let config = {};
+  if (agent?.harness == null) {
+    if (agentModule == null || agent != null) {
+      report(
+        DiagnosticSeverity.Error,
+        DiagnosticCode.Harness,
+        "agent.ts must name a harness, e.g. defineAgent({ harness: serverlessPi({ model }) })",
+        agentPath
+      );
+    }
+  } else {
+    const parsed = providerRefSchema.safeParse(agent.harness.harness);
+    if (parsed.success) harnessRef = parsed.data;
+    else
+      report(
+        DiagnosticSeverity.Error,
+        DiagnosticCode.Harness,
+        "agent.ts harness has an invalid provider reference",
+        agentPath
+      );
+    config = agent.harness.config;
+  }
+  if (harnessRef?.kind === "bundle") runtimeExport(harnessRef.export, agentPath);
+  const credentialPolicies = Object.values(jsonObjectSchema.safeParse(config).data ?? {}).filter(
+    (value) => credentialPolicySchema.safeParse(value).success
+  );
+  if (harnessRef != null && credentialPolicies.length !== 1) {
+    report(
+      DiagnosticSeverity.Error,
+      DiagnosticCode.Harness,
+      "Declare exactly one credential policy in the harness config; billing policy belongs to this definition.",
+      agentPath
+    );
+  }
+  const configObject = isObject(config) ? config : null;
+  if (configObject == null && !findDynamicSlots(config).some((slot) => slot.path === "")) {
+    report(
+      DiagnosticSeverity.Error,
+      DiagnosticCode.Harness,
+      "harness config must be an object",
+      agentPath
+    );
+  }
+  const instructionFragments = [];
+  const instructionSources = [];
+  const instructionModules = new Map(
+    ofSlot(SlotKind.Instructions).map((module) => [module.path, module])
+  );
+  for (const source of input.discovery.instructions) {
+    if (source.kind === InstructionSourceKind.Markdown) {
+      const content = input.files[source.path] ?? "";
+      if (content.trim().length === 0) {
+        report(
+          DiagnosticSeverity.Warning,
+          DiagnosticCode.Instructions,
+          `${source.path} is empty and was skipped`,
+          source.path
+        );
+        continue;
+      }
+      instructionFragments.push({ role: InstructionRole.System, content, source: source.path });
+      instructionSources.push(source.path);
+      continue;
+    }
+    const module = instructionModules.get(source.path);
+    if (module == null || module.value == null) continue;
+    if (module.value.type === "instructions") {
+      instructionFragments.push({
+        role: module.value.role,
+        content: module.value.content,
+        source: source.path
+      });
+      instructionSources.push(source.path);
+    } else if (module.value.type === "dynamic") {
+      const slot = dynamicSlotFor(module.value, module.base, source.path, source.path);
+      if (slot != null) {
+        instructionFragments.push(slot);
+        instructionSources.push(source.path);
+      }
+    }
+  }
+  const skills = [];
+  const skillSources = [];
+  const skillKeys = /* @__PURE__ */ new Set();
+  const addSkill = (key, skill, path) => {
+    if (skillKeys.has(key)) {
+      report(
+        DiagnosticSeverity.Error,
+        DiagnosticCode.Skills,
+        `skill ${key} is defined more than once`,
+        path
+      );
+      return;
+    }
+    skillKeys.add(key);
+    skills.push(skill);
+    skillSources.push(path);
+  };
+  for (const directory of input.discovery.skillDirectories) {
+    const skillPath = `${directory.directory}/SKILL.md`;
+    const text = input.files[skillPath] ?? "";
+    const front = parseFrontMatter(text);
+    if (front.error != null)
+      report(DiagnosticSeverity.Warning, DiagnosticCode.Skills, front.error, skillPath);
+    const description = frontMatterString(front.data, "description") ?? firstParagraphLine(front.body);
+    const files = [
+      { path: "SKILL.md", content: text },
+      ...directory.files.filter((file) => file !== skillPath).map((file) => ({
+        path: file.slice(directory.directory.length + 1),
+        content: input.files[file] ?? ""
+      }))
+    ];
+    const skill = { key: directory.key, files };
+    if (description != null) skill.description = description;
+    addSkill(directory.key, skill, skillPath);
+  }
+  for (const flat of input.discovery.skillMarkdown) {
+    const text = input.files[flat.path] ?? "";
+    const front = parseFrontMatter(text);
+    const description = frontMatterString(front.data, "description") ?? firstParagraphLine(front.body) ?? `Instructions for the ${flat.key} skill.`;
+    const content = text.startsWith("---\n") ? text : `---
+name: ${JSON.stringify(flat.key)}
+description: ${JSON.stringify(description)}
+---
+
+${text}`;
+    addSkill(
+      flat.key,
+      { key: flat.key, description, files: [{ path: "SKILL.md", content }] },
+      flat.path
+    );
+  }
+  for (const module of withDefault(SlotKind.Skill)) {
+    if (module.value?.type === "skill") {
+      const parsed = skillBundleSchema.safeParse(module.value.skill);
+      if (parsed.success) addSkill(module.key, parsed.data, module.path);
+    } else if (module.value?.type === "dynamic") {
+      const slot = dynamicSlotFor(module.value, module.base, module.path, module.path);
+      if (slot != null) addSkill(module.key, slot, module.path);
+    }
+  }
+  const directoryFields = { instructions: instructionSources, skills: skillSources };
+  if (configObject != null) {
+    if (instructionFragments.length > 0) {
+      if (configObject["instructions"] != null) {
+        report(
+          DiagnosticSeverity.Error,
+          DiagnosticCode.Conflict,
+          "harness config sets instructions and the directory has instruction files; keep one source",
+          agentPath
+        );
+      } else configObject["instructions"] = instructionFragments;
+    }
+    if (skills.length > 0) {
+      if (configObject["skills"] != null) {
+        report(
+          DiagnosticSeverity.Error,
+          DiagnosticCode.Conflict,
+          "harness config sets skills and the directory has skills/; keep one source",
+          agentPath
+        );
+      } else configObject["skills"] = skills;
+    }
+  } else if (instructionFragments.length > 0 || skills.length > 0) {
+    report(
+      DiagnosticSeverity.Error,
+      DiagnosticCode.Conflict,
+      "harness config is dynamic, so directory instructions and skills cannot be added to it",
+      agentPath
+    );
+  }
+  const toolPolicy = {};
+  const toolDescriptors = [];
+  const toolApprovals = {};
+  let anyDynamicServer = false;
+  let anyTurnStartedServer = false;
+  for (const module of ofSlot(SlotKind.Tool)) {
+    if (!module.hasDefault || module.value == null) continue;
+    if (module.value.type === "dynamic") {
+      anyDynamicServer = true;
+      anyTurnStartedServer ||= module.value.events.includes(DynamicEvent.TurnStarted);
+      runtimeExport(module.base, module.path);
+      continue;
+    }
+    if (module.value.type !== "tool") continue;
+    const parsed = toolDescriptorSchema.safeParse(module.value.descriptor);
+    if (!parsed.success) {
+      report(
+        DiagnosticSeverity.Error,
+        DiagnosticCode.Module,
+        `tool ${module.key} has an invalid descriptor`,
+        module.path
+      );
+      continue;
+    }
+    toolDescriptors.push(parsed.data);
+    const approval = module.value.approval === ToolApproval.Ask ? ToolApproval.Ask : ToolApproval.Allow;
+    toolApprovals[module.key] = approval;
+    if (approval === ToolApproval.Ask && parsed.data.inputApproval == null)
+      toolPolicy[`${AUTHORED_SERVER_KEY}/${module.key}`] = ToolApproval.Ask;
+    runtimeExport(module.base, module.path);
+  }
+  const connections = [];
+  const connectionKeys = /* @__PURE__ */ new Set();
+  for (const module of ofSlot(SlotKind.Connection)) {
+    if (!module.hasDefault || module.value == null) continue;
+    if (module.key === AUTHORED_SERVER_KEY) {
+      report(
+        DiagnosticSeverity.Error,
+        DiagnosticCode.Connections,
+        `connection name ${AUTHORED_SERVER_KEY} is reserved for authored tools`,
+        module.path
+      );
+      continue;
+    }
+    if (connectionKeys.has(module.key)) {
+      report(
+        DiagnosticSeverity.Error,
+        DiagnosticCode.Connections,
+        `connection ${module.key} is defined more than once`,
+        module.path
+      );
+      continue;
+    }
+    connectionKeys.add(module.key);
+    if (module.value.type === "dynamic") {
+      anyDynamicServer = true;
+      anyTurnStartedServer ||= module.value.events.includes(DynamicEvent.TurnStarted);
+      runtimeExport(module.base, module.path);
+      continue;
+    }
+    if (module.value.type !== "connection") continue;
+    const parsed = httpMcpServerBindingSchema.safeParse(module.value.binding);
+    if (!parsed.success) {
+      report(
+        DiagnosticSeverity.Error,
+        DiagnosticCode.Connections,
+        `connection ${module.key} is invalid: ${parsed.error.issues[0]?.message ?? "invalid"}`,
+        module.path
+      );
+      continue;
+    }
+    connections.push(parsed.data);
+    if (parsed.data.inputApprovals != null) runtimeExport(module.base, module.path);
+    for (const [tool, approval] of Object.entries(parsed.data.approvals ?? {})) {
+      if (approval === ToolApproval.Ask && !Object.hasOwn(parsed.data.inputApprovals ?? {}, tool))
+        toolPolicy[`${module.key}/${tool}`] = ToolApproval.Ask;
+    }
+  }
+  let mcpServers;
+  if (anyDynamicServer) {
+    mcpServers = {
+      $dynamic: {
+        resolver: COMBINED_MCP_SERVERS_EXPORT,
+        events: anyTurnStartedServer ? [DynamicEvent.SessionStarted, DynamicEvent.TurnStarted] : [DynamicEvent.SessionStarted],
+        description: "Authored tools and connections, including the dynamic ones, resolved when the session starts."
+      }
+    };
+    runtimeExport(COMBINED_MCP_SERVERS_EXPORT, "<synthesized>");
+  } else {
+    mcpServers = [
+      ...toolDescriptors.length === 0 ? [] : [
+        {
+          key: AUTHORED_SERVER_KEY,
+          kind: McpServerBindingKind.Worker,
+          tools: toolDescriptors,
+          approvals: toolApprovals
+        }
+      ],
+      ...connections
+    ];
+  }
+  for (const [key, policy] of Object.entries(agent?.toolPolicy ?? {})) {
+    toolPolicy[key] = policy === "ask" ? ToolApproval.Ask : ToolApproval.Allow;
+  }
+  const sandboxModule = ofSlot(SlotKind.Sandbox)[0];
+  const sandbox = sandboxModule?.value?.type === "sandbox" ? sandboxModule.value : null;
+  const sandboxPath = sandboxModule?.path ?? "sandbox.ts";
+  const sandboxes = {};
+  const sandboxOpeners = {};
+  const providerExportByName = new Map(
+    Object.entries(sandbox?.providers ?? {}).map(([exportName, name]) => [name, exportName])
+  );
+  const duplicateNames = /* @__PURE__ */ new Set();
+  for (const name of Object.values(sandbox?.providers ?? {})) {
+    if (duplicateNames.has(name))
+      report(
+        DiagnosticSeverity.Error,
+        DiagnosticCode.Sandbox,
+        `sandbox.ts exports multiple providers named ${name}; give each provider a distinct name`,
+        sandboxPath
+      );
+    duplicateNames.add(name);
+  }
+  const providerFor = (args) => {
+    if (args.ref != null) {
+      const parsed = providerRefSchema.safeParse(args.ref);
+      if (parsed.success) return parsed.data;
+    }
+    if (args.name != null) {
+      const exportName = providerExportByName.get(args.name);
+      if (exportName != null) {
+        runtimeExport(exportName, sandboxPath);
+        return bundleRef(exportName);
+      }
+      report(
+        DiagnosticSeverity.Error,
+        DiagnosticCode.Sandbox,
+        `sandbox target ${args.target} uses provider ${args.name}, which is neither installed nor exported from sandbox.ts`,
+        sandboxPath
+      );
+      return null;
+    }
+    report(
+      DiagnosticSeverity.Error,
+      DiagnosticCode.Sandbox,
+      `sandbox target ${args.target} is dynamic and its provider cannot be inferred; give defineDynamic a provider ({ provider: computer, events })`,
+      sandboxPath
+    );
+    return null;
+  };
+  const inferredProvider = (target) => {
+    if (providerExportByName.size > 0) return null;
+    const specifier = Object.hasOwn(input.installedSandboxProviders ?? {}, target) ? input.installedSandboxProviders?.[target] : void 0;
+    if (specifier != null) return { ref: packageRef(specifier), name: target };
+    const installed = /* @__PURE__ */ new Map();
+    for (const described2 of Object.values(sandbox?.targets ?? {})) {
+      const environment = described2.environment;
+      const parsed = providerRefSchema.safeParse(environment?.providerRef);
+      if (environment?.providerName == null || !parsed.success) continue;
+      if (parsed.data.kind !== ProviderRefKind.Package) continue;
+      installed.set(formatProviderRef(parsed.data), {
+        ref: environment.providerRef,
+        name: environment.providerName
+      });
+    }
+    return installed.size === 1 ? [...installed.values()][0] ?? null : null;
+  };
+  for (const [target, described2] of Object.entries(sandbox?.targets ?? {})) {
+    if (described2.environment != null) {
+      const environment = described2.environment;
+      const provider = providerFor({
+        ref: environment.providerRef,
+        name: environment.providerName,
+        target
+      });
+      if (provider == null) continue;
+      const open = environment.openOptions ?? void 0;
+      if (open != null && (!isObject(open) || Object.keys(open).some((key) => key !== "access" && key !== "attach"))) {
+        report(
+          DiagnosticSeverity.Error,
+          DiagnosticCode.Sandbox,
+          `sandbox target ${target} open options support only access and attach`,
+          sandboxPath
+        );
+        continue;
+      }
+      const access = isObject(open) ? open["access"] : void 0;
+      const attach = isObject(open) ? open["attach"] : void 0;
+      if (access != null && access !== SandboxAccess.Read && access !== SandboxAccess.Execute && access !== SandboxAccess.Write) {
+        report(
+          DiagnosticSeverity.Error,
+          DiagnosticCode.Sandbox,
+          `sandbox target ${target} has invalid access ${String(access)}`,
+          sandboxPath
+        );
+        continue;
+      }
+      if (attach != null && attach !== SandboxAttach.OnPrompt && attach !== SandboxAttach.Lazy) {
+        report(
+          DiagnosticSeverity.Error,
+          DiagnosticCode.Sandbox,
+          `sandbox target ${target} has invalid attach ${String(attach)}`,
+          sandboxPath
+        );
+        continue;
+      }
+      sandboxes[target] = {
+        provider,
+        environment: environment.options,
+        access: access === SandboxAccess.Read || access === SandboxAccess.Execute ? access : SandboxAccess.Write,
+        attach: attach === SandboxAttach.OnPrompt ? SandboxAttach.OnPrompt : SandboxAttach.Lazy
+      };
+    } else if (described2.dynamic != null) {
+      const hinted = described2.dynamic.provider;
+      const inferred = hinted == null ? inferredProvider(target) : null;
+      if (inferred != null) {
+        report(
+          DiagnosticSeverity.Note,
+          DiagnosticCode.Sandbox,
+          `sandbox target ${target} is dynamic; its provider is ${inferred.name}, and its resolver must return a ${inferred.name} environment`,
+          sandboxPath
+        );
+      }
+      const provider = providerFor({
+        ref: hinted?.ref ?? inferred?.ref ?? null,
+        name: hinted?.name ?? inferred?.name ?? null,
+        target
+      });
+      const slot = dynamicSlotFor(
+        described2.dynamic,
+        described2.exportName,
+        sandboxPath,
+        `sandbox target ${target}`
+      );
+      if (provider == null || slot == null) continue;
+      sandboxes[target] = {
+        provider,
+        environment: slot,
+        access: SandboxAccess.Write,
+        attach: SandboxAttach.Lazy
+      };
+    }
+  }
+  if (sandbox?.selector === true && sandbox.defaultTarget != null && sandboxes[sandbox.defaultTarget] != null) {
+    sandboxOpeners[sandbox.defaultTarget] = "sandbox";
+    runtimeExport("sandbox", sandboxPath);
+    report(
+      DiagnosticSeverity.Note,
+      DiagnosticCode.Sandbox,
+      `sandbox.ts default export opens target ${sandbox.defaultTarget} for each session`,
+      sandboxPath
+    );
+  }
+  const base = {};
+  if (agent?.tools != null) {
+    for (const [name, target] of Object.entries(agent.tools)) {
+      const capability = capabilityOf(name);
+      if (capability == null) {
+        report(
+          DiagnosticSeverity.Error,
+          DiagnosticCode.BaseTools,
+          `baseTools has unknown capability ${name}`,
+          agentPath
+        );
+        continue;
+      }
+      if (sandboxes[target] == null) {
+        report(
+          DiagnosticSeverity.Error,
+          DiagnosticCode.BaseTools,
+          `baseTools ${name} is bound to ${target}, which is not a sandbox target`,
+          agentPath
+        );
+        continue;
+      }
+      base[capability] = { target };
+    }
+  }
+  const host = [];
+  for (const name of agent?.hostTools ?? []) {
+    const capability = capabilityOf(name);
+    if (capability == null) {
+      report(
+        DiagnosticSeverity.Error,
+        DiagnosticCode.BaseTools,
+        `baseTools has unknown capability ${name}`,
+        agentPath
+      );
+      continue;
+    }
+    if (base[capability] != null) {
+      report(
+        DiagnosticSeverity.Error,
+        DiagnosticCode.BaseTools,
+        `baseTools ${name} is bound both to a sandbox target and to harnessHost`,
+        agentPath
+      );
+      continue;
+    }
+    host.push(capability);
+  }
+  const channels = [];
+  const channelKeys = /* @__PURE__ */ new Set();
+  const channelRoutes = {};
+  const addChannel = (binding, path) => {
+    if (channelKeys.has(binding.key)) {
+      report(
+        DiagnosticSeverity.Error,
+        DiagnosticCode.Channel,
+        `channel ${binding.key} is bound more than once`,
+        path
+      );
+      return;
+    }
+    channelKeys.add(binding.key);
+    channels.push(binding);
+  };
+  for (const module of withDefault(SlotKind.Channel)) {
+    if (module.value?.type !== "channel") continue;
+    const { value } = module;
+    if (value.disabled) continue;
+    if (value.turnPolicy != null && value.turnPolicy !== TurnPolicy.Steer && value.turnPolicy !== TurnPolicy.Queue) {
+      report(
+        DiagnosticSeverity.Error,
+        DiagnosticCode.Channel,
+        `channel ${module.key} turnPolicy must be steer or queue`,
+        module.path
+      );
+    }
+    for (const route of value.routes) {
+      if (!route.path.startsWith("/")) {
+        report(
+          DiagnosticSeverity.Error,
+          DiagnosticCode.Channel,
+          `channel ${module.key} route ${route.path} must start with /`,
+          module.path
+        );
+      }
+    }
+    const parsedConfig = jsonObjectSchema.safeParse(value.config);
+    const installed = value.installed == null ? null : providerRefSchema.safeParse(value.installed);
+    if (installed != null && !installed.success) {
+      report(
+        DiagnosticSeverity.Error,
+        DiagnosticCode.Channel,
+        `channel ${module.key} has an invalid installed reference`,
+        module.path
+      );
+      continue;
+    }
+    addChannel(
+      {
+        key: module.key,
+        channel: installed == null ? bundleRef(module.base) : installed.data,
+        config: parsedConfig.success ? parsedConfig.data : {},
+        source: "authored"
+      },
+      module.path
+    );
+    if (value.installed != null) continue;
+    runtimeExport(module.base, module.path);
+    channelRoutes[module.base] = value.routes.map((route) => ({
+      method: route.method,
+      path: route.path
+    }));
+  }
+  for (const [index, binding] of (agent?.channels ?? []).entries()) {
+    const ref = providerRefSchema.safeParse(binding.channel);
+    if (!ref.success) {
+      report(
+        DiagnosticSeverity.Error,
+        DiagnosticCode.Channel,
+        `agent.ts channels[${index}] has an invalid channel reference`,
+        agentPath
+      );
+      continue;
+    }
+    const config2 = jsonObjectSchema.safeParse(binding.config);
+    const key = binding.key ?? (ref.data.kind === "package" ? ref.data.specifier.split("/").at(-1) ?? ref.data.specifier : ref.data.export);
+    addChannel({ key, channel: ref.data, config: config2.success ? config2.data : {} }, agentPath);
+  }
+  const hooks = [];
+  for (const module of withDefault(SlotKind.Hook)) {
+    if (module.value?.type !== "hook") continue;
+    const events = [];
+    for (const key of module.value.keys) {
+      const normalized = normalizeHookKey(key);
+      switch (normalized.kind) {
+        case HookEventKeyKind.Unknown:
+          report(
+            DiagnosticSeverity.Error,
+            DiagnosticCode.Hook,
+            `hook ${module.key} subscribes to unknown event ${key}`,
+            module.path
+          );
+          break;
+        case HookEventKeyKind.Canonical:
+        case HookEventKeyKind.Wildcard:
+          events.push(...normalized.events);
+          break;
+      }
+    }
+    const unique = [...new Set(events)];
+    if (unique.length === 0) {
+      report(
+        DiagnosticSeverity.Warning,
+        DiagnosticCode.Hook,
+        `hook ${module.key} subscribes to no events and was left out`,
+        module.path
+      );
+      continue;
+    }
+    hooks.push({ slug: module.key, export: module.base, events: unique });
+    runtimeExport(module.base, module.path);
+  }
+  const schedules = [];
+  const addSchedule = (args) => {
+    const { key, path } = args;
+    if (args.cron == null) {
+      report(
+        DiagnosticSeverity.Error,
+        DiagnosticCode.Schedule,
+        `schedule ${key} needs a cron expression`,
+        path
+      );
+      return;
+    }
+    const timezone = args.timezone ?? "UTC";
+    try {
+      new Cron(args.cron, { timezone, paused: true }).nextRun();
+    } catch (cause) {
+      report(
+        DiagnosticSeverity.Error,
+        DiagnosticCode.Schedule,
+        `schedule ${key}: ${cause instanceof Error ? cause.message : String(cause)}`,
+        path
+      );
+      return;
+    }
+    const target = Object.values(ScheduleTarget).find(
+      (candidate) => candidate === (args.target ?? ScheduleTarget.OwnerDirect)
+    );
+    if (target == null) {
+      report(
+        DiagnosticSeverity.Error,
+        DiagnosticCode.Schedule,
+        `schedule ${key} target must be owner-direct or bound-conversation`,
+        path
+      );
+      return;
+    }
+    const prompt = args.prompt?.trim() ?? "";
+    if (prompt.length === 0) {
+      report(
+        DiagnosticSeverity.Error,
+        DiagnosticCode.Schedule,
+        `schedule ${key} needs a prompt`,
+        path
+      );
+      return;
+    }
+    schedules.push({ key, cron: args.cron, timezone, prompt, target });
+  };
+  for (const item of input.discovery.scheduleMarkdown) {
+    const front = parseFrontMatter(input.files[item.path] ?? "");
+    if (front.error != null)
+      report(DiagnosticSeverity.Error, DiagnosticCode.Schedule, front.error, item.path);
+    const field = (name) => frontMatterString(front.data, name);
+    addSchedule({
+      key: item.key,
+      path: item.path,
+      cron: field("cron"),
+      timezone: field("timezone"),
+      target: field("target"),
+      prompt: front.body
+    });
+  }
+  for (const module of withDefault(SlotKind.Schedule)) {
+    if (module.value?.type !== "schedule") continue;
+    addSchedule({
+      key: module.key,
+      path: module.path,
+      cron: module.value.cron,
+      timezone: module.value.timezone,
+      target: module.value.target,
+      prompt: module.value.markdown
+    });
+  }
+  const scheduleKeys = /* @__PURE__ */ new Set();
+  for (const schedule of schedules) {
+    if (scheduleKeys.has(schedule.key)) {
+      report(
+        DiagnosticSeverity.Error,
+        DiagnosticCode.Schedule,
+        `schedule ${schedule.key} is defined more than once`
+      );
+    }
+    scheduleKeys.add(schedule.key);
+  }
+  for (const rejected of input.discovery.rejected) {
+    report(DiagnosticSeverity.Error, DiagnosticCode.RejectedSlot, rejected.message, rejected.path);
+  }
+  for (const unsupported of input.discovery.unsupported) {
+    report(
+      DiagnosticSeverity.Warning,
+      DiagnosticCode.RejectedSlot,
+      unsupported.message,
+      unsupported.path
+    );
+  }
+  const references = secretReferences(input.files);
+  const secrets = collectSecrets({
+    declared: agent?.secrets ?? [],
+    config,
+    mcpServers: connections,
+    reads: references.flatMap((reference) => reference.name == null ? [] : [reference.name])
+  });
+  const computedReads = new Set(
+    references.flatMap((reference) => reference.name == null ? [reference.path] : [])
+  );
+  for (const path of computedReads) {
+    report(
+      DiagnosticSeverity.Note,
+      DiagnosticCode.Secrets,
+      `${path} reads a secret by a computed name; list it in defineAgent({ secrets: [...] }) or the read fails at run time`,
+      path
+    );
+  }
+  if (harnessRef == null) {
+    return { manifest: null, modules, sandboxOpeners, channelRoutes, directoryFields, diagnostics };
+  }
+  const draft = {
+    version: MANIFEST_VERSION,
+    identity: {
+      name: agent?.name ?? input.fallbackName,
+      description: agent?.description ?? null,
+      avatarUrl: agent?.avatarUrl ?? null
+    },
+    harness: { harness: harnessRef, config },
+    mcpServers,
+    sandboxes,
+    tools: host.length === 0 ? { base } : { base, host },
+    toolPolicy,
+    secrets,
+    channels,
+    channelSources: Object.fromEntries(
+      withDefault(SlotKind.Channel).flatMap(
+        (module) => module.value?.type === "channel" ? [
+          [
+            module.key,
+            { path: module.path, source: "authored", disabled: module.value.disabled }
+          ]
+        ] : []
+      )
+    ),
+    hooks,
+    schedules,
+    bundle: null
+  };
+  const resolvers = {};
+  for (const found of findDynamicSlots(draft)) {
+    resolvers[found.path] = {
+      export: found.slot.$dynamic.resolver,
+      events: found.slot.$dynamic.events
+    };
+  }
+  const hasSandboxes = Object.keys(sandboxes).length > 0;
+  if (Object.keys(modules).length > 0 || hasSandboxes) {
+    if (input.bundle == null) {
+      report(
+        DiagnosticSeverity.Error,
+        DiagnosticCode.Bundle,
+        "the definition needs a bundle but none was produced"
+      );
+    } else
+      draft.bundle = {
+        hash: input.bundle.hash,
+        resolvers,
+        hasPreparationFiles: Object.keys(preparationFiles(input.files)).length > 0
+      };
+  }
+  const validated = agentManifestSchema.safeParse(draft);
+  if (!validated.success) {
+    for (const issue of validated.error.issues) {
+      report(
+        DiagnosticSeverity.Error,
+        DiagnosticCode.Manifest,
+        `manifest ${issue.path.join(".")}: ${issue.message}`
+      );
+    }
+  }
+  const failed = diagnostics.some((item) => item.severity === DiagnosticSeverity.Error);
+  return {
+    manifest: failed || !validated.success ? null : validated.data,
+    modules,
+    sandboxOpeners,
+    channelRoutes,
+    directoryFields,
+    diagnostics
+  };
+};
+export {
+  assemble
+};
+//# sourceMappingURL=assemble.mjs.map