@hachej/boring-agent 0.1.90 → 0.1.92

package/docs/ACCESSIBILITY.md

@@ -37,9 +37,8 @@ This runs in CI automatically through the existing `pnpm e2e` job.
 
 ## Known Gaps
 
-1. Storybook a11y pipeline is not present yet.
-   There is no `.storybook` config, no `@storybook/addon-a11y`, and no
-   story-level axe scan.
+1. A registered agent-component UI-review spec is not present yet, so there is
+   no fixture-level axe scan for agent primitives.
 2. Current automated axe gate targets the shipped chat surface only.
    Workspace pane-level a11y checks (file tree, editor panes, dock tabs) are
    outside this package and need dedicated coverage in `@hachej/boring-workspace`.
@@ -47,7 +46,7 @@ This runs in CI automatically through the existing `pnpm e2e` job.
 
 ## Next Increment
 
-1. Stand up Storybook for `@hachej/boring-agent` primitives.
-2. Enable addon-a11y and add story-level CI checks.
+1. Register deterministic agent-primitive checkpoints in `tools/ui-review`.
+2. Add fixture-level axe hard gates to that registered spec.
 3. Extend browser axe checks to `workspace-playground` once pane a11y owners
    land stable selectors/landmarks.

package/docs/API.md

@@ -58,6 +58,9 @@ The Node runtime. Key exports:
   `createVercelProvisioningAdapter`.
 - HTTP/CSP: `applyCspHeaders`; `fileRoutes` for mounting file routes alone.
 - Harness: `createResourceSettingsManager` and the Pi harness option types.
+- Declarative authoring: `compileAgentDirectory()` and
+  `materializeAgentDirectory()`; see [AUTHORING](./AUTHORING.md). The materialized
+  value contains no tools, plugin selectors, paths, or runtime handles.
 - `createLogger`.
 
 ### Trusted workspace agent dispatch

package/docs/AUTHORING.md

@@ -0,0 +1,68 @@
+# Declarative agent authoring
+
+An authored agent directory describes identity, safe display metadata, and
+instructions. It does not select executable behavior.
+
+```text
+my-agent/
+├── agent.json
+└── instructions.md
+```
+
+```json
+{
+  "schemaVersion": 1,
+  "definitionId": "claims-assistant",
+  "version": "2026.07.20",
+  "label": "Claims assistant",
+  "description": "Helps process insurance claims.",
+  "instructionsRef": "instructions.md"
+}
+```
+
+`label` and `description` are optional. Labels are limited to 128 characters;
+descriptions are limited to 1,024 characters. Both must be trimmed, valid
+Unicode without control or bidi-spoofing characters.
+
+The loader:
+
+- reads only `agent.json` and `instructions.md`;
+- requires regular, non-symlink files contained in the directory;
+- limits the manifest to 64 KiB and instructions to 256 KiB before decoding;
+- requires valid UTF-8 and non-whitespace instructions;
+- returns a frozen `AuthoredAgentSourceV1` from
+  `materializeAgentDirectory()` containing only identity, metadata, and
+  instructions.
+
+## Executable behavior belongs to trusted host policy
+
+Tools, capabilities, skills, MCP servers, packages, models, credentials,
+plugins, runtime modes, and Workspace roots are configured by trusted host and
+plugin code. Authored JSON cannot enable them.
+
+Legacy manifests may still contain these keys while being cleaned up:
+
+- `capabilityRequirements`
+- `toolRefs`
+- `skillRefs`
+- `mcpServerRefs`
+
+Absent or empty arrays are accepted and stripped. A non-empty array fails with
+`AUTHORED_AGENT_REFERENCE_UNSUPPORTED`; move the requested behavior to trusted
+host/plugin configuration.
+
+The removed server contracts are `AuthoredAgentToolCatalog`,
+`MaterializeAgentDirectoryInput.toolCatalog`, and the materialized `tools` and
+`declaredToolRefs` fields. This correction removes no HTTP or product endpoint.
+
+## Validation
+
+```bash
+boring-ui agent validate ./my-agent
+boring-ui agent validate ./my-agent --json
+```
+
+Success reports only identity, optional metadata, and instruction byte length.
+It never reports or resolves a tool catalog. Errors are field-specific and
+redacted; unexpected failures return `INTERNAL_ERROR` without local paths or
+secret-like source values.

package/docs/ERROR_CODES.md

@@ -39,6 +39,9 @@ All API failures must use the response envelope:
 | `AGENT_RUNTIME_NOT_READY` | Selected workspace runtime dependencies (`runtime-dependencies` or `runtime:<name>`, e.g. `runtime:python`/`runtime:node`) are still preparing | 503 | retry | warn | stable (public API) |
 | `AGENT_BINDING_DISPOSED` | A caller retained an agent binding after its host retired it | 410 | resolve a fresh binding | warn | stable (trusted API) |
 | `AGENT_CONTROL_RECEIPT_INVALID` | The existing agent runtime returned a malformed interrupt/stop receipt through the trusted dispatcher | 500 | report-bug | error | stable (trusted API) |
+| `AGENT_FLEET_PLUGIN_UNKNOWN` | Agent fleet configuration references a plugin that the app did not load | 500 | fix app configuration | error | stable (trusted API) |
+| `AGENT_FLEET_CONFIG_BINDING_UNKNOWN` | Agent fleet configuration passes a plugin config key outside its declared Agent config contract | 500 | fix app configuration | error | stable (trusted API) |
+| `AGENT_FLEET_MODEL_POLICY_UNCOMPILED` | Agent fleet configuration declares a model policy that the app fleet compiler did not resolve | 500 | configure app fleet compiler | error | stable (trusted API) |
 | `RUNTIME_PROVISIONING_FAILED` | Agent runtime dependency provisioning failed before Level 3 runtime dependencies became ready | 503 | retry/report | error | stable (public API) |
 | `RUNTIME_PROVISIONING_LOCKED` | Agent runtime provisioning is locked by another reconciler | 423 | retry | warn | stable (public API) |
 | `BWRAP_UNAVAILABLE` | `bwrap` binary not found | 500 | report-bug | error | stable (public API) |
@@ -47,6 +50,28 @@ All API failures must use the response envelope:
 | `SANDBOX_NOT_READY` | Remote sandbox cold start / provisioning | 503 | retry | warn | stable (public API) |
 | `SANDBOX_EXPIRED` | Remote sandbox TTL elapsed | 410 | retry | warn | stable (public API) |
 | `VERCEL_API_ERROR` | Generic upstream Vercel SDK/API failure | 502 | retry | error | stable (public API) |
+| `REMOTE_WORKER_CONFIG_INVALID` | Static remote-worker fleet configuration is invalid or incomplete | 500 | report-bug | error | stable (trusted API) |
+| `REMOTE_WORKER_PROTOCOL_MISMATCH` | Worker protocol or provider-contract version differs from the configured V1 cohort | 502 | operator-fix | error | stable (trusted API) |
+| `REMOTE_WORKER_UNAUTHENTICATED` | Worker rejected the per-box capability or authenticated receipt | 401 | operator-fix | warn | stable (trusted API) |
+| `REMOTE_WORKER_UNAVAILABLE` | The statically owning worker cannot serve the request; no fallback is attempted | 503 | retry | warn | stable (public API) |
+| `REMOTE_WORKER_UNQUALIFIED` | Worker qualification or artifact facts do not match static placement config | 503 | operator-fix | error | stable (trusted API) |
+| `REMOTE_WORKER_REQUEST_INVALID` | A strict remote-worker request schema rejected the request | 400 | report-bug | warn | stable (trusted API) |
+| `REMOTE_WORKER_RESPONSE_INVALID` | A strict remote-worker response schema rejected the worker response | 502 | operator-fix | error | stable (trusted API) |
+| `REMOTE_WORKER_CAPABILITY_EXPIRED` | A short-lived worker capability expired or exceeded its maximum lifetime | 401 | retry | warn | stable (trusted API) |
+| `REMOTE_WORKER_AUTHORIZED_WORKSPACE_REQUIRED` | Remote provider creation lacked an authenticated workspace identity | 403 | report-bug | warn | stable (trusted API) |
+| `REMOTE_WORKER_BINDING_RECEIPT_INVALID` | Create returned an unauthenticated or mismatched sandbox/workspace binding receipt | 502 | operator-fix | error | stable (trusted API) |
+| `REMOTE_WORKER_SANDBOX_WORKSPACE_MISMATCH` | Authorized workspace capability does not match the immutable sandbox lease binding | 404 | report-security | warn | stable (trusted API) |
+| `REMOTE_WORKER_SANDBOX_NOT_FOUND` | Addressed remote sandbox lease does not exist | 404 | reacquire | warn | stable (trusted API) |
+| `REMOTE_WORKER_SANDBOX_EXPIRED` | Addressed remote sandbox lease has expired | 410 | reacquire | warn | stable (trusted API) |
+| `REMOTE_WORKER_SANDBOX_DISPOSED` | Addressed remote sandbox lease was already disposed | 410 | reacquire | warn | stable (trusted API) |
+| `REMOTE_WORKER_CREATE_CONCURRENCY_EXHAUSTED` | Worker create concurrency is exhausted | 429 | retry | warn | stable (trusted API) |
+| `REMOTE_WORKER_EXEC_CONCURRENCY_EXHAUSTED` | Worker execution concurrency is exhausted | 429 | retry | warn | stable (trusted API) |
+| `REMOTE_WORKER_IDEMPOTENCY_CONFLICT` | Reused lease/invocation id has a different request digest | 409 | report-bug | warn | stable (trusted API) |
+| `REMOTE_WORKER_EXEC_IN_PROGRESS` | Duplicate invocation is still executing | 409 | retry | warn | stable (trusted API) |
+| `REMOTE_WORKER_SECRET_INVOCATION_NOT_REPLAYABLE` | Completed secret-bearing invocation cannot replay cached output | 409 | start-new-request | warn | stable (trusted API) |
+| `REMOTE_WORKER_OUTCOME_UNKNOWN` | Worker loss left an effectful invocation outcome unknown; no automatic replay is safe | 502 | inspect-before-retry | error | stable (public API) |
+| `REMOTE_WORKER_INCOMPLETE_CLEANUP` | Provider could not prove remote lease teardown after bounded retries | 502 | operator-fix | error | stable (trusted API) |
+| `REMOTE_WORKER_DOCKER_COMMAND_FAILED` | Worker runtime command failed without exposing infrastructure stderr | 502 | operator-fix | error | stable (trusted API) |
 | `REMOTE_WORKER_TIMEOUT` | Remote worker request exceeded its client-side timeout before a response arrived | 504 | retry | warn | stable (public API) |
 | `REMOTE_WORKER_STREAM_CLOSED` | Remote worker filesystem event stream closed unexpectedly | 502 | retry | warn | stable (public API) |
 | `CIRCUIT_OPEN` | Circuit breaker open; request fast-failed | 503 | retry | warn | stable (public API) |
@@ -64,12 +89,8 @@ All API failures must use the response envelope:
 | `TOOL_EXECUTION_ERROR` | Tool threw or returned execution failure | 500 | report-bug | error | stable (public API) |
 | `AUTHORED_AGENT_ID_INVALID` | Authored agent materialization received an agent type id outside the product-safe grammar | 400 | user-fix | warn | stable (trusted API) |
 | `AUTHORED_AGENT_TYPE_MISMATCH` | Trusted host expected one authored agent type but the directory declares another | 409 | user-fix | warn | stable (trusted API) |
-| `AUTHORED_AGENT_CATALOG_REQUIRED` | Authored tool refs are present before a trusted server catalog resolver is available | 400 | user-fix | warn | stable (trusted API) |
-| `AUTHORED_AGENT_CATALOG_INVALID` | Trusted authored-tool catalog failed while resolving a declared tool reference | 500 | report-bug | error | stable (trusted API) |
-| `AUTHORED_AGENT_REFERENCE_UNKNOWN` | Authored agent materialization could not resolve a declared trusted reference | 400 | user-fix | warn | stable (trusted API) |
-| `AUTHORED_AGENT_REFERENCE_UNSUPPORTED` | Authored agent materialization received non-empty reference families unsupported by v1 | 400 | user-fix | warn | stable (trusted API) |
-| `AUTHORED_AGENT_TOOL_INVALID` | Trusted authored-tool catalog resolution produced a tool that fails authored-tool validation | 500 | report-bug | error | stable (trusted API) |
-| `AUTHORED_AGENT_TOOL_COLLISION` | Trusted authored-tool resolution produced duplicate or colliding tool names | 409 | user-fix | warn | stable (trusted API) |
+| `AUTHORED_AGENT_REFERENCE_UNSUPPORTED` | Authored source contains a non-empty legacy capability/tool/skill/MCP selector; move behavior to trusted host plugins | 400 | user-fix | warn | stable migration error |
+| `AUTHORED_AGENT_TOOL_COLLISION` | Normal trusted tool composition produced duplicate or colliding tool names | 409 | user-fix | warn | stable (trusted API) |
 | `MCP_AGENT_ARTIFACT_INVALID` | Managed MCP delivery artifact is path-shaped, non-Markdown, binary, malformed UTF-8, or otherwise invalid | 400 | user-fix | warn | stable (public API) |
 | `MCP_AGENT_ARTIFACT_TOO_LARGE` | Managed MCP final text, inline Markdown artifact, or serialized result exceeds the delivery v0 byte cap | 413 | user-fix | warn | stable (public API) |
 | `MCP_AGENT_ARTIFACT_UNAVAILABLE` | Managed MCP artifact is missing, unreadable through the authorized workspace, or changed during read | 409 | retry | warn | stable (public API) |

package/docs/README.md

@@ -67,6 +67,7 @@ the agent ↔ workspace boundary is in
 **Surfaces & integration**
 
 - [API](./API.md) — the four entry points and what each exports.
+- [AUTHORING](./AUTHORING.md) — declarative agent directories, bounds, validation, and legacy catalog migration.
 - [STYLING](./STYLING.md) — CSS-variable theming contract and public selectors.
 - [UI-SHADCN](./UI-SHADCN.md) — `ChatPanel` styling model and tool-renderer overrides.
 - [tools](./tools.md) — built-in tools, package-added tools, and how to add custom tools.

package/docs/runtime.md

@@ -204,11 +204,11 @@ modes, the adapter maps that host path into the public runtime namespace
 
 ### Production storage roots in `vercel-sandbox` mode
 
-In a Fly-hosted app using `BORING_AGENT_MODE=vercel-sandbox`, there are two
+In a hosted app using `BORING_AGENT_MODE=vercel-sandbox`, there are two
 filesystems with different jobs:
 
 ```txt
-Fly app container / mounted volume:
+App container / mounted volume:
   /data/workspaces/<workspaceId>   host/control-plane workspace anchor
   /data/pi-sessions/<workspaceId>  durable chat transcript storage
 
@@ -225,7 +225,7 @@ Those belong to the sandbox runtime root, `/workspace`.
 
 Production chat history also must not use the container root filesystem. Set
 `BORING_AGENT_SESSION_ROOT` to a mounted-volume path such as `/data/pi-sessions`
-so Pi wrapper/native transcripts survive Fly deploys and restarts. Core-hosted
+so Pi wrapper/native transcripts survive host deploys and restarts. Core-hosted
 apps that run `vercel-sandbox` with `BORING_AGENT_WORKSPACE_ROOT=/data/workspaces`
 default this to the sibling `/data/pi-sessions` path when the env var is absent.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hachej/boring-agent",
-  "version": "0.1.90",
+  "version": "0.1.92",
   "type": "module",
   "license": "MIT",
   "description": "Pane-embeddable coding agent. Ships direct/local/vercel-sandbox execution modes behind one interface.",
@@ -32,6 +32,11 @@
       "import": "./dist/server/pi-session-readability.js",
       "default": "./dist/server/pi-session-readability.js"
     },
+    "./server/agent-host/testing/gatewayConformance": {
+      "types": "./dist/server/agent-host/testing/gatewayConformance.d.ts",
+      "import": "./dist/server/agent-host/testing/gatewayConformance.js",
+      "default": "./dist/server/agent-host/testing/gatewayConformance.js"
+    },
     "./server/worker": {
       "types": "./dist/server/worker/index.d.ts",
       "import": "./dist/server/worker/index.js",
@@ -71,27 +76,27 @@
     "@streamdown/math": "^1.0.2",
     "@streamdown/mermaid": "^1.0.2",
     "@tanstack/react-query": "^5.101.1",
-    "ai": "^7.0.9",
+    "ai": "^7.0.31",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
     "diff": "^9.0.0",
     "fastify": "^5.9.0",
-    "lucide-react": "^1.21.0",
+    "lucide-react": "^1.25.0",
     "motion": "^12.42.0",
-    "nanoid": "^5.1.16",
+    "nanoid": "^6.0.0",
     "shiki": "^4.3.0",
     "streamdown": "^2.5.0",
     "tailwind-merge": "^3.5.0",
     "use-stick-to-bottom": "^1.1.6",
     "yaml": "^2.9.0",
     "zod": "^3.25.76",
-    "@hachej/boring-bash": "0.1.90",
-    "@hachej/boring-ui-kit": "0.1.90",
-    "@hachej/boring-sandbox": "0.1.90"
+    "@hachej/boring-bash": "0.1.92",
+    "@hachej/boring-sandbox": "0.1.92",
+    "@hachej/boring-ui-kit": "0.1.92"
   },
   "devDependencies": {
-    "@vercel/sandbox": "2.3.0",
+    "@vercel/sandbox": "2.7.1",
     "@antithesishq/bombadil": "0.6.1",
     "@opentelemetry/api": "^1.9.1",
     "@tailwindcss/postcss": "^4.3.1",
@@ -100,20 +105,21 @@
     "@types/react-dom": "^19.1.3",
     "@vitejs/plugin-react": "^4.7.0",
     "ajv": "^8.20.0",
-    "esbuild": "^0.25.12",
-    "postcss": "^8.5.15",
+    "esbuild": "^0.28.1",
+    "postcss": "^8.5.19",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
     "tsup": "^8.4.0",
-    "tsx": "^4.22.4",
+    "tsx": "^4.23.1",
     "typescript": "^6.0.3",
-    "vite": "^8.1.2",
+    "vite": "^8.1.5",
     "vitest": "^4.1.9"
   },
   "peerDependencies": {
     "react": "^18.0.0 || ^19.0.0",
     "react-dom": "^18.0.0 || ^19.0.0",
-    "tailwindcss": ">=3.4.0 || >=4.0.0"
+    "tailwindcss": ">=3.4.0 || >=4.0.0",
+    "vitest": "^4.1.9"
   },
   "peerDependenciesMeta": {
     "react": {
@@ -124,6 +130,9 @@
     },
     "tailwindcss": {
       "optional": true
+    },
+    "vitest": {
+      "optional": true
     }
   },
   "scripts": {

package/dist/chunk-CFQQXJKK.js

@@ -1,385 +0,0 @@
-import {
-  AgentDefinitionErrorCode,
-  AgentDeploymentErrorCode,
-  ErrorCode
-} from "./chunk-4PKGVPJA.js";
-
-// src/shared/agent-definition.ts
-import { z as z2 } from "zod";
-
-// src/shared/digest.ts
-function toHex(bytes) {
-  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
-}
-async function digestBytes(bytes) {
-  const hash = await globalThis.crypto.subtle.digest("SHA-256", new Uint8Array(bytes));
-  return `sha256:${toHex(new Uint8Array(hash))}`;
-}
-async function sha256(value) {
-  return digestBytes(new TextEncoder().encode(value));
-}
-async function sha256Bytes(bytes) {
-  return digestBytes(bytes);
-}
-function canonicalStringify(value) {
-  if (value === null || typeof value !== "object") {
-    const encoded = JSON.stringify(value);
-    if (encoded === void 0) throw new TypeError("Cannot canonicalize undefined");
-    return encoded;
-  }
-  if (Array.isArray(value)) return `[${value.map(canonicalStringify).join(",")}]`;
-  const record = value;
-  return `{${Object.keys(record).filter((key) => record[key] !== void 0).sort().map((key) => `${JSON.stringify(key)}:${canonicalStringify(record[key])}`).join(",")}}`;
-}
-
-// src/shared/schema-issue.ts
-import { z } from "zod";
-function formatPath(path) {
-  if (path.length === 0) return "<root>";
-  return path.reduce(
-    (result, part) => typeof part === "number" ? `${result}[${part}]` : result.length === 0 ? String(part) : `${result}.${String(part)}`,
-    ""
-  );
-}
-function mapZodIssues(issues, invalidCode, unsupportedCode) {
-  return issues.flatMap((issue) => {
-    if (issue.code === z.ZodIssueCode.unrecognized_keys) {
-      const parent = formatPath(issue.path);
-      return [...issue.keys].sort().map((key) => ({
-        code: unsupportedCode,
-        field: parent === "<root>" ? key : `${parent}.${key}`,
-        message: `${key} is not supported by schema version 1`
-      }));
-    }
-    const field = formatPath(issue.path);
-    return [{
-      code: invalidCode,
-      field,
-      message: field === "<root>" ? issue.message : `${field} ${issue.message}`
-    }];
-  });
-}
-var SchemaValidationError = class extends Error {
-  code = ErrorCode.enum.CONFIG_INVALID;
-  field;
-  validationCode;
-  constructor(issue) {
-    super(issue.message);
-    this.field = issue.field;
-    this.validationCode = issue.code;
-  }
-};
-
-// src/shared/agent-definition.ts
-var SHA256_DIGEST_RE = /^sha256:[a-f0-9]{64}$/;
-function hasWellFormedUnicode(value) {
-  for (let index = 0; index < value.length; index += 1) {
-    const code = value.charCodeAt(index);
-    if (code >= 55296 && code <= 56319) {
-      if (index + 1 >= value.length) return false;
-      const next = value.charCodeAt(index + 1);
-      if (next < 56320 || next > 57343) return false;
-      index += 1;
-    } else if (code >= 56320 && code <= 57343) {
-      return false;
-    }
-  }
-  return true;
-}
-function isOpaqueRef(value) {
-  return hasWellFormedUnicode(value) && value.trim() === value && !/[\0-\x1f\x7f]/.test(value);
-}
-function isSafeAssetPath(value) {
-  const segments = value.split("/");
-  return hasWellFormedUnicode(value) && value.normalize("NFC") === value && !/[\0-\x1f\x7f]/.test(value) && !value.includes("\\") && !value.startsWith("/") && !/^[A-Za-z]:[\\/]/.test(value) && !value.startsWith("./") && segments.every((segment) => segment !== "" && segment !== "." && segment !== "..");
-}
-var OpaqueRefSchema = z2.string().min(1, "must be a non-empty reference").max(256, "must be at most 256 characters").refine(isOpaqueRef, "must be a non-empty reference");
-var ReferenceArraySchema = z2.array(OpaqueRefSchema).superRefine((refs, ctx) => {
-  const seen = /* @__PURE__ */ new Set();
-  refs.forEach((ref, index) => {
-    if (seen.has(ref)) {
-      ctx.addIssue({
-        code: z2.ZodIssueCode.custom,
-        path: [index],
-        message: "must not contain duplicate references"
-      });
-    }
-    seen.add(ref);
-  });
-});
-var SafeAssetPathSchema = z2.string().min(1).refine(isSafeAssetPath, "must be a safe relative asset path");
-var Sha256DigestSchema = z2.string().regex(SHA256_DIGEST_RE, "must be a lowercase sha256 digest").transform((value) => value);
-var AgentDefinitionSchema = z2.object({
-  schemaVersion: z2.literal(1),
-  definitionId: OpaqueRefSchema,
-  version: OpaqueRefSchema,
-  label: z2.string().refine(hasWellFormedUnicode, "must contain well-formed Unicode").optional(),
-  instructionsRef: SafeAssetPathSchema,
-  capabilityRequirements: ReferenceArraySchema.optional(),
-  toolRefs: ReferenceArraySchema.optional(),
-  skillRefs: ReferenceArraySchema.optional(),
-  mcpServerRefs: ReferenceArraySchema.optional()
-}).strict();
-var AgentDefinitionReferenceSchema = z2.object({
-  definitionId: OpaqueRefSchema,
-  version: OpaqueRefSchema,
-  digest: Sha256DigestSchema
-}).strict();
-var AgentDeploymentSchema = z2.object({
-  deploymentId: OpaqueRefSchema,
-  version: OpaqueRefSchema,
-  agentId: OpaqueRefSchema,
-  definition: AgentDefinitionReferenceSchema
-}).strict();
-var AgentDefinitionDigestAssetSchema = z2.object({
-  path: SafeAssetPathSchema,
-  digest: Sha256DigestSchema,
-  content: z2.string().refine(hasWellFormedUnicode, "must contain well-formed Unicode")
-}).strict();
-function validateAgentDefinition(raw) {
-  const result = AgentDefinitionSchema.safeParse(raw);
-  if (!result.success) {
-    return {
-      valid: false,
-      issues: mapZodIssues(
-        result.error.issues,
-        AgentDefinitionErrorCode.enum.AGENT_DEFINITION_INVALID,
-        AgentDefinitionErrorCode.enum.AGENT_DEFINITION_UNSUPPORTED_FIELD
-      )
-    };
-  }
-  return { valid: true, value: result.data };
-}
-function validateAgentDeployment(raw) {
-  const result = AgentDeploymentSchema.safeParse(raw);
-  if (!result.success) {
-    return {
-      valid: false,
-      issues: mapZodIssues(
-        result.error.issues,
-        AgentDeploymentErrorCode.enum.AGENT_DEPLOYMENT_INVALID,
-        AgentDeploymentErrorCode.enum.AGENT_DEPLOYMENT_UNSUPPORTED_FIELD
-      )
-    };
-  }
-  return { valid: true, value: result.data };
-}
-async function createAgentAssetDigest(content) {
-  if (!hasWellFormedUnicode(content)) {
-    throw new AgentDefinitionValidationError({
-      code: AgentDefinitionErrorCode.enum.AGENT_DEFINITION_INVALID,
-      field: "content",
-      message: "content must contain well-formed Unicode"
-    });
-  }
-  return sha256(content);
-}
-var AgentDefinitionValidationError = class extends SchemaValidationError {
-  constructor(issue) {
-    super(issue);
-    this.name = "AgentDefinitionValidationError";
-  }
-};
-var AgentDeploymentValidationError = class extends SchemaValidationError {
-  constructor(issue) {
-    super(issue);
-    this.name = "AgentDeploymentValidationError";
-  }
-};
-async function validatedDefinitionAssets(definition, assets) {
-  if (!Array.isArray(assets)) {
-    throw new AgentDefinitionValidationError({
-      code: AgentDefinitionErrorCode.enum.AGENT_DEFINITION_INVALID,
-      field: "assets",
-      message: "assets must be an array"
-    });
-  }
-  const canonicalAssets = [];
-  for (const [index, input] of assets.entries()) {
-    const result = AgentDefinitionDigestAssetSchema.safeParse(input);
-    if (!result.success) {
-      const issue = mapZodIssues(
-        result.error.issues,
-        AgentDefinitionErrorCode.enum.AGENT_DEFINITION_INVALID,
-        AgentDefinitionErrorCode.enum.AGENT_DEFINITION_UNSUPPORTED_FIELD
-      )[0];
-      throw new AgentDefinitionValidationError({
-        ...issue,
-        field: `assets[${index}].${issue.field}`
-      });
-    }
-    if (await createAgentAssetDigest(result.data.content) !== result.data.digest) {
-      throw new AgentDefinitionValidationError({
-        code: AgentDefinitionErrorCode.enum.AGENT_DEFINITION_INVALID,
-        field: "assets.digest",
-        message: `asset digest does not match UTF-8 content: ${result.data.path}`
-      });
-    }
-    canonicalAssets.push(result.data);
-  }
-  canonicalAssets.sort(
-    (left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0
-  );
-  for (let index = 1; index < canonicalAssets.length; index += 1) {
-    if (canonicalAssets[index - 1].path === canonicalAssets[index].path) {
-      throw new AgentDefinitionValidationError({
-        code: AgentDefinitionErrorCode.enum.AGENT_DEFINITION_INVALID,
-        field: "assets.path",
-        message: `duplicate asset path: ${canonicalAssets[index].path}`
-      });
-    }
-  }
-  if (!canonicalAssets.some((asset) => asset.path === definition.instructionsRef)) {
-    throw new AgentDefinitionValidationError({
-      code: AgentDefinitionErrorCode.enum.AGENT_DEFINITION_INVALID,
-      field: "instructionsRef",
-      message: "instructionsRef must name an included verified asset"
-    });
-  }
-  return canonicalAssets;
-}
-async function createAgentDefinitionDigest(input) {
-  const validated = validateAgentDefinition(input.definition);
-  if (!validated.valid) throw new AgentDefinitionValidationError(validated.issues[0]);
-  const assets = await validatedDefinitionAssets(validated.value, input.assets);
-  return sha256(canonicalStringify({ definition: validated.value, assets }));
-}
-async function createAgentDeploymentDigest(deployment) {
-  const validated = validateAgentDeployment(deployment);
-  if (!validated.valid) throw new AgentDeploymentValidationError(validated.issues[0]);
-  return sha256(canonicalStringify(validated.value));
-}
-
-// src/shared/validateTool.ts
-function validateTool(tool) {
-  if (typeof tool !== "object" || tool === null) return null;
-  const t = tool;
-  if (typeof t.name !== "string" || t.name.length === 0) return null;
-  if (typeof t.description !== "string") return null;
-  if (typeof t.parameters !== "object" || t.parameters === null) return null;
-  if (typeof t.execute !== "function") return null;
-  return t;
-}
-
-// src/shared/share-entry.ts
-import { z as z3 } from "zod";
-var nonEmptyString = z3.string().min(1);
-function isOpaqueLocatorId(value) {
-  return value.trim() === value && !/[\0-\x1f\x7f]/.test(value) && !value.includes("/") && !value.includes("\\") && !value.includes(":") && value !== "." && value !== "..";
-}
-var OpaqueShareLocatorIdSchema = z3.string().min(1, "must be a non-empty opaque id").max(256, "must be at most 256 characters").refine(isOpaqueLocatorId, "must be an opaque platform-owned id (no path separators, no scheme, no traversal)");
-function mintShareEntryId() {
-  return globalThis.crypto.randomUUID();
-}
-var ShareEntryProvenanceSchema = z3.object({
-  producerPrincipalRef: nonEmptyString,
-  createdAt: nonEmptyString
-}).strict();
-var ShareEntryV1Schema = z3.object({
-  schemaVersion: z3.literal(1),
-  id: OpaqueShareLocatorIdSchema,
-  workspaceId: OpaqueShareLocatorIdSchema,
-  path: nonEmptyString,
-  provenance: ShareEntryProvenanceSchema
-}).strict();
-var ShareEntryErrorCode = z3.enum(["AR1_SHARE_NOT_FOUND", "AR1_SHARE_TOMBSTONED"]);
-var ShareEntryValidationCode = z3.enum(["SHARE_ENTRY_INPUT_INVALID"]);
-var ShareEntryValidationError = class extends Error {
-  code = ErrorCode.enum.CONFIG_INVALID;
-  field;
-  constructor(issue) {
-    super(issue.message);
-    this.name = "ShareEntryValidationError";
-    this.field = issue.field;
-  }
-};
-function assertValidCreateInput(raw) {
-  const result = CreateShareEntryInputSchema.safeParse(raw);
-  if (result.success) return;
-  const issue = result.error.issues[0];
-  const field = formatPath(issue.path);
-  throw new ShareEntryValidationError({
-    code: ShareEntryValidationCode.enum.SHARE_ENTRY_INPUT_INVALID,
-    field,
-    message: field === "<root>" ? issue.message : `${field} ${issue.message}`
-  });
-}
-var CreateShareEntryInputSchema = z3.object({
-  workspaceId: OpaqueShareLocatorIdSchema,
-  path: nonEmptyString,
-  provenance: z3.object({
-    producerPrincipalRef: nonEmptyString,
-    createdAt: nonEmptyString.optional()
-  }).strict()
-}).strict();
-var InMemoryShareEntryStore = class {
-  entries = /* @__PURE__ */ new Map();
-  async create(input) {
-    assertValidCreateInput(input);
-    const entry = {
-      schemaVersion: 1,
-      id: mintShareEntryId(),
-      workspaceId: input.workspaceId,
-      path: input.path,
-      provenance: {
-        producerPrincipalRef: input.provenance.producerPrincipalRef,
-        createdAt: input.provenance.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
-      }
-    };
-    this.entries.set(entry.id, entry);
-    return entry;
-  }
-  async get(id) {
-    return this.entries.get(id) ?? null;
-  }
-  async delete(id) {
-    this.entries.delete(id);
-  }
-  async list(workspaceId) {
-    return Array.from(this.entries.values()).filter((entry) => entry.workspaceId === workspaceId);
-  }
-};
-async function resolveShareEntry(store, id, workspace) {
-  const entry = await store.get(id);
-  if (!entry) {
-    return { status: "not_found", code: ShareEntryErrorCode.enum.AR1_SHARE_NOT_FOUND };
-  }
-  try {
-    await workspace.stat(entry.path);
-  } catch {
-    return {
-      status: "tombstoned",
-      code: ShareEntryErrorCode.enum.AR1_SHARE_TOMBSTONED,
-      tombstone: {
-        id: entry.id,
-        workspaceId: entry.workspaceId,
-        provenance: entry.provenance
-      }
-    };
-  }
-  return { status: "ok", entry };
-}
-
-export {
-  sha256Bytes,
-  canonicalStringify,
-  formatPath,
-  SchemaValidationError,
-  OpaqueRefSchema,
-  Sha256DigestSchema,
-  validateAgentDefinition,
-  validateAgentDeployment,
-  createAgentAssetDigest,
-  AgentDefinitionValidationError,
-  AgentDeploymentValidationError,
-  createAgentDefinitionDigest,
-  createAgentDeploymentDigest,
-  validateTool,
-  OpaqueShareLocatorIdSchema,
-  ShareEntryProvenanceSchema,
-  ShareEntryV1Schema,
-  ShareEntryErrorCode,
-  ShareEntryValidationError,
-  InMemoryShareEntryStore,
-  resolveShareEntry
-};