@lssm/lib.contracts-spec 17.3.2

package/dist/agent/task-tree.d.ts

@@ -0,0 +1,44 @@
+import type { SharedTask } from '../shared-entities/task.js';
+import { type TaskValidationResult } from '../shared-entities/task-validators.js';
+/**
+ * Agent task-tree node.
+ *
+ * Extends {@link SharedTask} to make the tree invariant explicit:
+ * `parent` identifies the single parent node. Absence of `parent` marks a
+ * root task. `dependsOn` MUST remain `undefined` in this context — use
+ * {@link validateAgentTaskTree} to enforce this at runtime.
+ */
+export interface AgentTask extends SharedTask {
+    /** Tree invariant: at most one parent task ID. Absence = root. */
+    parent?: string;
+}
+/**
+ * Validate a flat list of {@link AgentTask} records for tree-context use.
+ *
+ * Delegates to {@link validateAgentTask} from `shared-entities/task-validators`
+ * for each task, which rejects any task with `dependsOn` set (A9 invariant).
+ * Returns the first failure found, or `{ valid: true }` when all tasks pass.
+ *
+ * @param tasks - Flat array of agent task records to validate.
+ */
+export declare function validateAgentTaskTree(tasks: AgentTask[]): TaskValidationResult;
+export declare const agentTaskTreeGoalDoc: {
+    id: string;
+    title: string;
+    summary: string;
+    kind: "goal";
+    visibility: "public";
+    route: string;
+    tags: string[];
+    body: string;
+};
+export declare const agentTaskTreeUsageDoc: {
+    id: string;
+    title: string;
+    summary: string;
+    kind: "usage";
+    visibility: "public";
+    route: string;
+    tags: string[];
+    body: string;
+};

package/dist/agent/task-tree.js

@@ -0,0 +1,22 @@
+import{validateAgentTask as s}from"../shared-entities/task-validators.js";export function validateAgentTaskTree(t){for(const a of t){const e=s(a);if(!e.valid)return e}return{valid:!0}}export const agentTaskTreeGoalDoc={id:"docs.tech.agent.task-tree.goal",title:"AgentTask \u2014 goal",summary:"Tree-topology specialisation of SharedTask for the agent runtime.",kind:"goal",visibility:"public",route:"/docs/tech/agent/task-tree/goal",tags:["agent","task-tree","a9"],body:"# AgentTask\n\n`AgentTask` is the agent-context specialisation of `SharedTask` (A9 invariant).\nEach node carries at most one `parent` reference, forming a strict tree topology.\n`dependsOn` is prohibited at runtime \u2014 use `validateAgentTaskTree()` to enforce this.\n\n## Tree invariant\n\n- Exactly one root per tree (`parent` is `undefined`).\n- Every non-root task references one existing task as its parent.\n- `dependsOn` is reserved for workflow DAG context and MUST NOT be set here."};export const agentTaskTreeUsageDoc={id:"docs.tech.agent.task-tree.usage",title:"AgentTask \u2014 usage",summary:"How to build and validate an agent task tree.",kind:"usage",visibility:"public",route:"/docs/tech/agent/task-tree/usage",tags:["agent","task-tree"],body:`# Using AgentTask
+
+## Build a tree
+
+\`\`\`ts
+import type { AgentTask } from '@lssm/lib.contracts-spec/agent';
+
+const tasks: AgentTask[] = [
+  { id: 'root', label: 'Root task' },
+  { id: 'child-a', label: 'Child A', parent: 'root' },
+  { id: 'child-b', label: 'Child B', parent: 'root' },
+];
+\`\`\`
+
+## Validate before running
+
+\`\`\`ts
+import { validateAgentTaskTree } from '@lssm/lib.contracts-spec/agent';
+
+const result = validateAgentTaskTree(tasks);
+if (!result.valid) throw new Error(result.error);
+\`\`\``};

package/dist/agent/views/agentRuns.dataView.d.ts

@@ -0,0 +1,94 @@
+export declare const AgentRunsDataViewDocBlock: {
+    id: string;
+    title: string;
+    summary: string;
+    kind: "reference";
+    visibility: "public";
+    route: string;
+    tags: string[];
+    body: string;
+};
+export declare const AgentRunsDataView: {
+    readonly meta: {
+        readonly key: "agent.run.index";
+        readonly title: "Agent Runs";
+        readonly version: "1.0.0";
+        readonly description: "List background agent runs and their status.";
+        readonly domain: "agent";
+        readonly owners: string[];
+        readonly tags: [...string[], "run", "index"];
+        readonly stability: "beta";
+        readonly entity: "agent_run";
+        readonly docId: [import("../../docs").DocId];
+    };
+    readonly source: {
+        primary: {
+            key: string;
+            version: string;
+        };
+    };
+    readonly view: {
+        readonly kind: "list";
+        readonly fields: [{
+            readonly key: "runId";
+            readonly label: "field.runId.label";
+            readonly dataPath: "runId";
+        }, {
+            readonly key: "agentKey";
+            readonly label: "field.agentKey.label";
+            readonly dataPath: "agentKey";
+        }, {
+            readonly key: "status";
+            readonly label: "field.status.label";
+            readonly dataPath: "status";
+        }, {
+            readonly key: "submittedAt";
+            readonly label: "field.submittedAt.label";
+            readonly dataPath: "submittedAt";
+        }, {
+            readonly key: "startedAt";
+            readonly label: "field.startedAt.label";
+            readonly dataPath: "startedAt";
+        }, {
+            readonly key: "completedAt";
+            readonly label: "field.completedAt.label";
+            readonly dataPath: "completedAt";
+        }, {
+            readonly key: "contextSnapshotId";
+            readonly label: "field.contextSnapshotId.label";
+            readonly dataPath: "contextSnapshotId";
+        }];
+        readonly primaryField: "runId";
+        readonly secondaryFields: ["agentKey", "status"];
+        readonly filters: [{
+            readonly key: "runId";
+            readonly label: "filter.runId.label";
+            readonly field: "runId";
+            readonly type: "search";
+        }, {
+            readonly key: "status";
+            readonly label: "filter.status.label";
+            readonly field: "status";
+            readonly type: "search";
+        }];
+    };
+    readonly policy: {
+        flags: [];
+        pii: [];
+    };
+} & {
+    meta: {
+        readonly key: "agent.run.index";
+        readonly title: "Agent Runs";
+        readonly version: "1.0.0";
+        readonly description: "List background agent runs and their status.";
+        readonly domain: "agent";
+        readonly owners: string[];
+        readonly tags: [...string[], "run", "index"];
+        readonly stability: "beta";
+        readonly entity: "agent_run";
+        readonly docId: [import("../../docs").DocId];
+    } & {
+        translationKey: "agent.run.index.i18n";
+    };
+};

package/dist/agent/views/agentRuns.dataView.js

@@ -0,0 +1,4 @@
+import{defineDataView as l}from"../../data-views/index.js";import{docId as n}from"../../docs/registry.js";import{defineTranslation as i}from"../../translations/index.js";import{AGENT_DOMAIN as t,AGENT_OWNERS as a,AGENT_STABILITY as s,AGENT_TAGS as d}from"../constants.js";import{AgentStatusQuery as e}from"../queries/agentStatus.query.js";const r=i({meta:{key:"agent.run.index.i18n",version:"1.0.0",domain:t,owners:a},locale:"en",messages:{"field.runId.label":{value:"Run"},"field.agentKey.label":{value:"Agent"},"field.status.label":{value:"Status"},"field.submittedAt.label":{value:"Submitted"},"field.startedAt.label":{value:"Started"},"field.completedAt.label":{value:"Completed"},"field.contextSnapshotId.label":{value:"Context Snapshot"},"filter.runId.label":{value:"Run ID"},"filter.status.label":{value:"Status"}}});export const AgentRunsDataViewDocBlock={id:"docs.tech.agent.run.index",title:"Agent run index view",summary:"Data view for listing agent runs.",kind:"reference",visibility:"public",route:"/docs/tech/agent/run/index",tags:["agent","data-view"],body:`# agent.run.index
+
+List view over agent runs and their status.
+`};export const AgentRunsDataView=l(r,{meta:{key:"agent.run.index",title:"Agent Runs",version:"1.0.0",description:"List background agent runs and their status.",domain:t,owners:a,tags:[...d,"run","index"],stability:s,entity:"agent_run",docId:[n("docs.tech.agent.run.index")]},source:{primary:{key:e.meta.key,version:e.meta.version}},view:{kind:"list",fields:[{key:"runId",label:"field.runId.label",dataPath:"runId"},{key:"agentKey",label:"field.agentKey.label",dataPath:"agentKey"},{key:"status",label:"field.status.label",dataPath:"status"},{key:"submittedAt",label:"field.submittedAt.label",dataPath:"submittedAt"},{key:"startedAt",label:"field.startedAt.label",dataPath:"startedAt"},{key:"completedAt",label:"field.completedAt.label",dataPath:"completedAt"},{key:"contextSnapshotId",label:"field.contextSnapshotId.label",dataPath:"contextSnapshotId"}],primaryField:"runId",secondaryFields:["agentKey","status"],filters:[{key:"runId",label:"filter.runId.label",field:"runId",type:"search"},{key:"status",label:"filter.status.label",field:"status",type:"search"}]},policy:{flags:[],pii:[]}});

package/dist/agent/views/index.d.ts

@@ -0,0 +1 @@
+export * from './agentRuns.dataView.js';

package/dist/agent/views/index.js

@@ -0,0 +1 @@
+export*from"./agentRuns.dataView.js";

package/dist/agent-platform/baseline-suites.d.ts

@@ -0,0 +1,17 @@
+export declare const AGENT_PLATFORM_BASELINE_REQUIRED_SUITES: readonly [{
+    readonly suiteId: 'agent-platform.governance-security:v1';
+    readonly capabilityRef: 'agent.platform.governance-security';
+}, {
+    readonly suiteId: 'agent-platform.supply-chain-security:v1';
+    readonly capabilityRef: 'agent.platform.supply-chain-security';
+}, {
+    readonly suiteId: 'agent-platform.observability-export:v1';
+    readonly capabilityRef: 'agent.platform.observability-export';
+}, {
+    readonly suiteId: 'agent-platform.load-resilience:v1';
+    readonly capabilityRef: 'agent.platform.load-resilience';
+}, {
+    readonly suiteId: 'agent-platform.clean-consumer-release:v1';
+    readonly capabilityRef: 'agent.platform.clean-consumer-release';
+}];
+export declare const AGENT_PLATFORM_BASELINE_REQUIRED_SUITE_IDS: ("agent-platform.clean-consumer-release:v1" | "agent-platform.governance-security:v1" | "agent-platform.load-resilience:v1" | "agent-platform.observability-export:v1" | "agent-platform.supply-chain-security:v1")[];

package/dist/agent-platform/baseline-suites.js

@@ -0,0 +1 @@
+export const AGENT_PLATFORM_BASELINE_REQUIRED_SUITES=[{suiteId:"agent-platform.governance-security:v1",capabilityRef:"agent.platform.governance-security"},{suiteId:"agent-platform.supply-chain-security:v1",capabilityRef:"agent.platform.supply-chain-security"},{suiteId:"agent-platform.observability-export:v1",capabilityRef:"agent.platform.observability-export"},{suiteId:"agent-platform.load-resilience:v1",capabilityRef:"agent.platform.load-resilience"},{suiteId:"agent-platform.clean-consumer-release:v1",capabilityRef:"agent.platform.clean-consumer-release"}];export const AGENT_PLATFORM_BASELINE_REQUIRED_SUITE_IDS=AGENT_PLATFORM_BASELINE_REQUIRED_SUITES.map(({suiteId:e})=>e);

package/dist/agent-platform/digest.d.ts

@@ -0,0 +1 @@
+export declare function agentPlatformContractDigest(value: unknown): `sha256:${string}`;

package/dist/agent-platform/digest.js

@@ -0,0 +1 @@
+import{sha256Hex as o}from"@lssm/lib.crypto-utils";export function agentPlatformContractDigest(n){return`sha256:${o(i(n))}`}function i(n){if(Array.isArray(n))return`[${n.map((e)=>i(e)).join(",")}]`;if(n&&typeof n==="object")return`{${Object.entries(n).filter(([,r])=>r!==void 0).sort(([r],[t])=>r.localeCompare(t)).map(([r,t])=>`${JSON.stringify(r)}:${i(t)}`).join(",")}}`;return JSON.stringify(n)??"null"}

package/dist/agent-platform/index.d.ts

@@ -0,0 +1,5 @@
+export * from './baseline-suites.js';
+export * from './digest.js';
+export * from './types.js';
+export * from './validation.js';
+export * from './validation-v2.js';

package/dist/agent-platform/index.js

@@ -0,0 +1 @@
+export*from"./baseline-suites.js";export*from"./digest.js";export*from"./types.js";export*from"./validation.js";export*from"./validation-v2.js";

package/dist/agent-platform/types.d.ts

@@ -0,0 +1,149 @@
+export declare const AGENT_PLATFORM_PLAN_VERSION: '1';
+export declare const AGENT_PLATFORM_PLAN_V2_VERSION: '2';
+export type AgentPlatformDeploymentTopologyKindV2 = 'hybrid' | 'multi-region-active-active' | 'multi-region-active-passive' | 'self-hosted-cluster' | 'single-region';
+export interface AgentPlatformPinnedRef {
+    id: string;
+    version: string;
+    digest: string;
+}
+/**
+ * Binds one application component to a pinned provider profile without making
+ * deployment platforms, managed services, and isolation substrates peers.
+ * The referenced integration package remains authoritative for its profile.
+ */
+export interface AgentPlatformComponentBindingV1 {
+    componentKind: string;
+    providerProfileRef: AgentPlatformPinnedRef;
+    runtimeTargetRef?: string;
+    adapterRef?: string;
+    configRef?: string;
+    evidenceRefs: string[];
+}
+export interface AgentPlatformEnterpriseControlsV1 {
+    dataGovernance: {
+        retentionPolicyRef: string;
+        deletionPolicyRef: string;
+        exportPolicyRef: string;
+        residencyPolicyRef: string;
+        encryptionPolicyRef: string;
+        backupPolicyRef: string;
+        rpoSeconds: number;
+        rtoSeconds: number;
+    };
+    identity: {
+        sso: 'not_required' | 'optional' | 'required';
+        scim: 'not_required' | 'optional' | 'required';
+        rbacPolicyRef: string;
+        breakGlassPolicyRef: string;
+    };
+    observability: {
+        auditSinkRef: string;
+        traceSinkRef: string;
+        metricsSinkRef: string;
+        costSinkRef: string;
+        budgetPolicyRef: string;
+        defaultContentCapture: 'deny' | 'redacted';
+    };
+}
+/**
+ * A provider-neutral composition envelope. Agent, workspace environment, and
+ * infrastructure operations contracts remain authoritative through refs.
+ */
+export interface AgentPlatformPlanV1 {
+    id: string;
+    version: typeof AGENT_PLATFORM_PLAN_VERSION;
+    agentRef: string;
+    environmentProfileRef: string;
+    infraOpsSpecRef: string;
+    componentBindings: AgentPlatformComponentBindingV1[];
+    requiredSuiteIds: string[];
+    requirementRefs: string[];
+    policyRefs: string[];
+    enterpriseControls?: AgentPlatformEnterpriseControlsV1;
+}
+export interface AgentPlatformDeploymentInstanceV2 {
+    instanceRef: string;
+    componentKind: string;
+    providerProfileRef: string;
+    deploymentAdapterRef: string;
+    runtimeTargetRef?: string;
+    replicaCount?: number;
+    regionRefs: string[];
+    trustBoundaryRefs: string[];
+    evidenceRefs: string[];
+}
+export interface AgentPlatformDeploymentTopologyV2 {
+    topologyRef: string;
+    topologyKind: AgentPlatformDeploymentTopologyKindV2;
+    controlPlaneRef: string;
+    dataPlaneRef: string;
+    regionRefs: string[];
+    trustBoundaryRefs: string[];
+    instances: AgentPlatformDeploymentInstanceV2[];
+    evidenceRefs: string[];
+}
+export interface AgentPlatformPlanV2 extends Omit<AgentPlatformPlanV1, 'version'> {
+    version: typeof AGENT_PLATFORM_PLAN_V2_VERSION;
+    deploymentTopology: AgentPlatformDeploymentTopologyV2;
+}
+export interface AgentPlatformSuiteReportRefV1 {
+    suiteId: string;
+    suiteVersion: string;
+    targetRef: string;
+    reportRef: string;
+    status: 'pass' | 'fail' | 'not_applicable';
+    required: boolean;
+}
+export interface AgentPlatformDeclaredLossV1 {
+    capabilityRef: string;
+    reason: string;
+    acceptanceRef?: string;
+}
+export interface AgentPlatformDeploymentAttestationV2 {
+    attestationRef: string;
+    subjectRef: string;
+    attestorRef: string;
+    attestationKind: 'consumer-evidence' | 'local-harness';
+    attestedAt: string;
+    evidenceRefs: string[];
+    limitations: string[];
+}
+export interface AgentPlatformProviderDeploymentCertificationV2 {
+    componentKind: string;
+    providerProfileRef: string;
+    deploymentAdapterRef: string;
+    status: 'blocked' | 'candidate' | 'eligible';
+    reasonRefs: string[];
+    evidenceRefs: string[];
+}
+export interface AgentPlatformEligibilitySummaryV2 {
+    status: 'blocked' | 'candidate' | 'eligible';
+    reasonRefs: string[];
+    missingRequirementRefs: string[];
+}
+/**
+ * Aggregates domain-owned qualification suites. Required suites may never pass
+ * through `not_applicable`, and unclassified capabilities fail certification.
+ */
+export interface AgentPlatformCertificationReportV1 {
+    planDigest: string;
+    profileDigests: string[];
+    sourceRevision: string;
+    environmentFingerprint: string;
+    suiteReports: AgentPlatformSuiteReportRefV1[];
+    declaredLosses: AgentPlatformDeclaredLossV1[];
+    requiredCapabilityFailures: string[];
+    unclassifiedCapabilities: string[];
+    overall: 'pass' | 'fail';
+    generatedAt: string;
+    evidenceRefs: string[];
+}
+export interface AgentPlatformCertificationReportV2 extends Omit<AgentPlatformCertificationReportV1, 'overall'> {
+    deploymentTopologyDigest: string;
+    attestations: AgentPlatformDeploymentAttestationV2[];
+    deploymentCertifications: AgentPlatformProviderDeploymentCertificationV2[];
+    eligibility: AgentPlatformEligibilitySummaryV2;
+    overall: 'pass' | 'fail';
+}
+export type AgentPlatformPlan = AgentPlatformPlanV1 | AgentPlatformPlanV2;
+export type AgentPlatformCertificationReport = AgentPlatformCertificationReportV1 | AgentPlatformCertificationReportV2;

package/dist/agent-platform/types.js

@@ -0,0 +1 @@
+export const AGENT_PLATFORM_PLAN_VERSION="1";export const AGENT_PLATFORM_PLAN_V2_VERSION="2";

package/dist/agent-platform/validation-v2.d.ts

@@ -0,0 +1,40 @@
+import { z } from 'zod';
+import type { AgentPlatformCertificationReportV2, AgentPlatformPlanV2 } from './types.js';
+import { type AgentPlatformCertificationEvaluation, type AgentPlatformCertificationInput } from './validation.js';
+export declare const agentPlatformDeploymentTopologyV2Schema: z.ZodObject<{
+    topologyRef: z.ZodString;
+    topologyKind: z.ZodEnum<{
+        hybrid: "hybrid";
+        "multi-region-active-active": "multi-region-active-active";
+        "multi-region-active-passive": "multi-region-active-passive";
+        "self-hosted-cluster": "self-hosted-cluster";
+        "single-region": "single-region";
+    }>;
+    controlPlaneRef: z.ZodString;
+    dataPlaneRef: z.ZodString;
+    regionRefs: z.ZodArray<z.ZodString>;
+    trustBoundaryRefs: z.ZodArray<z.ZodString>;
+    instances: z.ZodArray<z.ZodObject<{
+        instanceRef: z.ZodString;
+        componentKind: z.ZodString;
+        providerProfileRef: z.ZodString;
+        deploymentAdapterRef: z.ZodString;
+        runtimeTargetRef: z.ZodOptional<z.ZodString>;
+        replicaCount: z.ZodOptional<z.ZodNumber>;
+        regionRefs: z.ZodArray<z.ZodString>;
+        trustBoundaryRefs: z.ZodArray<z.ZodString>;
+        evidenceRefs: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    evidenceRefs: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export declare const agentPlatformPlanV2Schema: z.ZodType<AgentPlatformPlanV2>;
+export declare const agentPlatformCertificationReportV2Schema: z.ZodType<AgentPlatformCertificationReportV2>;
+export interface AgentPlatformCertificationInputV2 extends Omit<AgentPlatformCertificationInput, 'overall'> {
+    deploymentTopologyDigest: string;
+    attestations: AgentPlatformCertificationReportV2['attestations'];
+    deploymentCertifications: AgentPlatformCertificationReportV2['deploymentCertifications'];
+    eligibility: AgentPlatformCertificationReportV2['eligibility'];
+}
+export declare function certifyAgentPlatformV2(planInput: AgentPlatformPlanV2, reportInput: AgentPlatformCertificationInputV2): AgentPlatformCertificationEvaluation & {
+    report: AgentPlatformCertificationReportV2;
+};

package/dist/agent-platform/validation-v2.js

@@ -0,0 +1 @@
+import{z as e}from"zod";import{agentPlatformContractDigest as p}from"./digest.js";import{agentPlatformComponentBindingV1Schema as g,agentPlatformDeclaredLossV1Schema as y,agentPlatformEnterpriseControlsV1Schema as u,agentPlatformSuiteReportRefV1Schema as R,certifyAgentPlatform as P}from"./validation.js";const s=e.string().regex(/^sha256:[a-f0-9]{64}$/);const t=e.string().min(1);const b=e.object({instanceRef:t,componentKind:t,providerProfileRef:t,deploymentAdapterRef:t,runtimeTargetRef:t.optional(),replicaCount:e.number().int().positive().optional(),regionRefs:e.array(t).min(1),trustBoundaryRefs:e.array(t).min(1),evidenceRefs:e.array(t).min(1)});export const agentPlatformDeploymentTopologyV2Schema=e.object({topologyRef:t,topologyKind:e.enum(["single-region","multi-region-active-passive","multi-region-active-active","self-hosted-cluster","hybrid"]),controlPlaneRef:t,dataPlaneRef:t,regionRefs:e.array(t).min(1),trustBoundaryRefs:e.array(t).min(1),instances:e.array(b).min(1),evidenceRefs:e.array(t).min(1)});export const agentPlatformPlanV2Schema=e.object({id:e.string().min(1),version:e.literal("2"),agentRef:t,environmentProfileRef:t,infraOpsSpecRef:t,componentBindings:e.array(g).min(1),requiredSuiteIds:e.array(t).min(1),requirementRefs:e.array(t).min(1),policyRefs:e.array(t).min(1),enterpriseControls:u.optional(),deploymentTopology:agentPlatformDeploymentTopologyV2Schema});const C=e.object({attestationRef:t,subjectRef:t,attestorRef:t,attestationKind:e.enum(["consumer-evidence","local-harness"]),attestedAt:e.string().datetime(),evidenceRefs:e.array(t).min(1),limitations:e.array(t)});const v=e.object({componentKind:t,providerProfileRef:t,deploymentAdapterRef:t,status:e.enum(["blocked","candidate","eligible"]),reasonRefs:e.array(t),evidenceRefs:e.array(t).min(1)});const l={planDigest:s,profileDigests:e.array(s).min(1),sourceRevision:e.string().min(7),environmentFingerprint:s,deploymentTopologyDigest:s,suiteReports:e.array(R).min(1),declaredLosses:e.array(y),requiredCapabilityFailures:e.array(t),unclassifiedCapabilities:e.array(t),attestations:e.array(C).min(1),deploymentCertifications:e.array(v).min(1),eligibility:e.object({status:e.enum(["blocked","candidate","eligible"]),reasonRefs:e.array(t),missingRequirementRefs:e.array(t)}),generatedAt:e.string().datetime(),evidenceRefs:e.array(t).min(1),overall:e.enum(["pass","fail"])};export const agentPlatformCertificationReportV2Schema=e.object(l);export function certifyAgentPlatformV2(c,d){const i=agentPlatformPlanV2Schema.parse(c),n=e.object({...l,overall:l.overall.optional()}).parse(d),m={id:i.id,version:"1",agentRef:i.agentRef,environmentProfileRef:i.environmentProfileRef,infraOpsSpecRef:i.infraOpsSpecRef,componentBindings:i.componentBindings,requiredSuiteIds:i.requiredSuiteIds,requirementRefs:i.requirementRefs,policyRefs:i.policyRefs,enterpriseControls:i.enterpriseControls},r=[...P(m,{...n,planDigest:p(m)}).issues];if(n.deploymentTopologyDigest!==p(i.deploymentTopology))r.push({code:"plan_digest_mismatch",message:"Certification report is bound to another deployment topology.",ref:n.deploymentTopologyDigest});for(const f of i.componentBindings){const o=f.componentKind;if(!n.attestations.some((a)=>a.subjectRef===o))r.push({code:"required_suite_not_passed",message:`Selected component ${o} has no deployment attestation.`,ref:o});if(!n.deploymentCertifications.some((a)=>a.componentKind===o))r.push({code:"required_suite_not_passed",message:`Selected component ${o} has no deployment certification.`,ref:o});if(!i.deploymentTopology.instances.some((a)=>a.componentKind===o&&a.providerProfileRef===f.providerProfileRef.id))r.push({code:"required_capability_failure",message:`Deployment topology is missing ${o}.`,ref:o})}if(n.eligibility.status==="blocked")r.push({code:"required_capability_failure",message:"Deployment eligibility is blocked.",ref:n.eligibility.reasonRefs[0]});return{report:{...n,overall:r.length===0?"pass":"fail"},issues:r}}

package/dist/agent-platform/validation.d.ts

@@ -0,0 +1,86 @@
+import { z } from 'zod';
+import type { AgentPlatformCertificationReportV1, AgentPlatformPlanV1 } from './types.js';
+export declare const agentPlatformPinnedRefSchema: z.ZodObject<{
+    id: z.ZodString;
+    version: z.ZodString;
+    digest: z.ZodString;
+}, z.core.$strip>;
+export declare const agentPlatformComponentBindingV1Schema: z.ZodObject<{
+    componentKind: z.ZodString;
+    providerProfileRef: z.ZodObject<{
+        id: z.ZodString;
+        version: z.ZodString;
+        digest: z.ZodString;
+    }, z.core.$strip>;
+    runtimeTargetRef: z.ZodOptional<z.ZodString>;
+    adapterRef: z.ZodOptional<z.ZodString>;
+    configRef: z.ZodOptional<z.ZodString>;
+    evidenceRefs: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export declare const agentPlatformEnterpriseControlsV1Schema: z.ZodObject<{
+    dataGovernance: z.ZodObject<{
+        retentionPolicyRef: z.ZodString;
+        deletionPolicyRef: z.ZodString;
+        exportPolicyRef: z.ZodString;
+        residencyPolicyRef: z.ZodString;
+        encryptionPolicyRef: z.ZodString;
+        backupPolicyRef: z.ZodString;
+        rpoSeconds: z.ZodNumber;
+        rtoSeconds: z.ZodNumber;
+    }, z.core.$strip>;
+    identity: z.ZodObject<{
+        sso: z.ZodEnum<{
+            not_required: "not_required";
+            optional: "optional";
+            required: "required";
+        }>;
+        scim: z.ZodEnum<{
+            not_required: "not_required";
+            optional: "optional";
+            required: "required";
+        }>;
+        rbacPolicyRef: z.ZodString;
+        breakGlassPolicyRef: z.ZodString;
+    }, z.core.$strip>;
+    observability: z.ZodObject<{
+        auditSinkRef: z.ZodString;
+        traceSinkRef: z.ZodString;
+        metricsSinkRef: z.ZodString;
+        costSinkRef: z.ZodString;
+        budgetPolicyRef: z.ZodString;
+        defaultContentCapture: z.ZodEnum<{
+            deny: "deny";
+            redacted: "redacted";
+        }>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export declare const agentPlatformPlanV1Schema: z.ZodType<AgentPlatformPlanV1>;
+export declare const agentPlatformSuiteReportRefV1Schema: z.ZodObject<{
+    suiteId: z.ZodString;
+    suiteVersion: z.ZodString;
+    targetRef: z.ZodString;
+    reportRef: z.ZodString;
+    status: z.ZodEnum<{
+        fail: "fail";
+        not_applicable: "not_applicable";
+        pass: "pass";
+    }>;
+    required: z.ZodBoolean;
+}, z.core.$strip>;
+export declare const agentPlatformDeclaredLossV1Schema: z.ZodObject<{
+    capabilityRef: z.ZodString;
+    reason: z.ZodString;
+    acceptanceRef: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const agentPlatformCertificationReportV1Schema: z.ZodType<AgentPlatformCertificationReportV1>;
+export interface AgentPlatformCertificationIssue {
+    code: 'failed_suite' | 'missing_profile_digest' | 'missing_enterprise_controls' | 'plan_digest_mismatch' | 'required_capability_failure' | 'required_suite_not_passed' | 'unaccepted_loss' | 'unclassified_capability';
+    message: string;
+    ref?: string;
+}
+export type AgentPlatformCertificationInput = Omit<AgentPlatformCertificationReportV1, 'overall'>;
+export interface AgentPlatformCertificationEvaluation {
+    report: AgentPlatformCertificationReportV1;
+    issues: AgentPlatformCertificationIssue[];
+}
+export declare function certifyAgentPlatform(planInput: AgentPlatformPlanV1, reportInput: AgentPlatformCertificationInput): AgentPlatformCertificationEvaluation;

package/dist/agent-platform/validation.js

@@ -0,0 +1 @@
+import{z as e}from"zod";import{AGENT_PLATFORM_BASELINE_REQUIRED_SUITE_IDS as R}from"./baseline-suites.js";import{agentPlatformContractDigest as P}from"./digest.js";const p=e.string().regex(/^sha256:[a-f0-9]{64}$/);const t=e.string().min(1);export const agentPlatformPinnedRefSchema=e.object({id:e.string().min(1),version:e.string().min(1),digest:p});export const agentPlatformComponentBindingV1Schema=e.object({componentKind:e.string().min(1),providerProfileRef:agentPlatformPinnedRefSchema,runtimeTargetRef:t.optional(),adapterRef:t.optional(),configRef:t.optional(),evidenceRefs:e.array(t).min(1)});export const agentPlatformEnterpriseControlsV1Schema=e.object({dataGovernance:e.object({retentionPolicyRef:t,deletionPolicyRef:t,exportPolicyRef:t,residencyPolicyRef:t,encryptionPolicyRef:t,backupPolicyRef:t,rpoSeconds:e.number().int().nonnegative(),rtoSeconds:e.number().int().nonnegative()}),identity:e.object({sso:e.enum(["not_required","optional","required"]),scim:e.enum(["not_required","optional","required"]),rbacPolicyRef:t,breakGlassPolicyRef:t}),observability:e.object({auditSinkRef:t,traceSinkRef:t,metricsSinkRef:t,costSinkRef:t,budgetPolicyRef:t,defaultContentCapture:e.enum(["deny","redacted"])})});const y=e.array(t).min(1).max(100).superRefine((n,c)=>{if(new Set(n).size!==n.length)c.addIssue({code:"custom",message:"Agent platform required suite IDs must be unique."});for(const s of R)if(!n.includes(s))c.addIssue({code:"custom",message:`Agent platform plan is missing mandatory baseline suite ${s}.`})});export const agentPlatformPlanV1Schema=e.object({id:e.string().min(1),version:e.literal("1"),agentRef:t,environmentProfileRef:t,infraOpsSpecRef:t,componentBindings:e.array(agentPlatformComponentBindingV1Schema).min(1),requiredSuiteIds:y,requirementRefs:e.array(t).min(1),policyRefs:e.array(t).min(1),enterpriseControls:agentPlatformEnterpriseControlsV1Schema.optional()});export const agentPlatformSuiteReportRefV1Schema=e.object({suiteId:e.string().min(1),suiteVersion:e.string().min(1),targetRef:t,reportRef:t,status:e.enum(["pass","fail","not_applicable"]),required:e.boolean()});export const agentPlatformDeclaredLossV1Schema=e.object({capabilityRef:t,reason:e.string().min(1),acceptanceRef:t.optional()});const d={planDigest:p,profileDigests:e.array(p).min(1),sourceRevision:e.string().min(7),environmentFingerprint:p,suiteReports:e.array(agentPlatformSuiteReportRefV1Schema).min(1),declaredLosses:e.array(agentPlatformDeclaredLossV1Schema),requiredCapabilityFailures:e.array(t),unclassifiedCapabilities:e.array(t),generatedAt:e.string().datetime(),evidenceRefs:e.array(t).min(1)};export const agentPlatformCertificationReportV1Schema=e.object({...d,overall:e.enum(["pass","fail"])});export function certifyAgentPlatform(n,c){const s=agentPlatformPlanV1Schema.parse(n),o=e.object(d).parse(c),r=[],m=new Set(o.profileDigests);if(o.planDigest!==P(s))r.push({code:"plan_digest_mismatch",message:"Certification report is bound to another platform plan.",ref:o.planDigest});if(!s.enterpriseControls)r.push({code:"missing_enterprise_controls",message:"Production certification requires explicit enterprise control inputs.",ref:s.id});for(const i of s.componentBindings){const a=i.providerProfileRef.digest;if(!m.has(a))r.push({code:"missing_profile_digest",message:`Certification is missing provider profile digest ${a}.`,ref:i.providerProfileRef.id})}for(const i of o.suiteReports)if(i.required&&i.status!=="pass")r.push({code:"required_suite_not_passed",message:`Required suite ${i.suiteId} did not pass.`,ref:i.reportRef});else if(i.status==="fail")r.push({code:"failed_suite",message:`Suite ${i.suiteId} failed.`,ref:i.reportRef});for(const i of s.requiredSuiteIds){const a=o.suiteReports.filter(({suiteId:f})=>f===i),u=a.some(({required:f,status:l})=>f&&l==="pass"),g=a.some(({required:f,status:l})=>f&&l!=="pass");if(!u&&!g)r.push({code:"required_suite_not_passed",message:`Required plan suite ${i} has no passing required report.`,ref:i})}for(const i of o.declaredLosses)if(!i.acceptanceRef)r.push({code:"unaccepted_loss",message:`Declared loss ${i.capabilityRef} has no acceptance ref.`,ref:i.capabilityRef});for(const i of o.requiredCapabilityFailures)r.push({code:"required_capability_failure",message:`Required capability ${i} failed.`,ref:i});for(const i of o.unclassifiedCapabilities)r.push({code:"unclassified_capability",message:`Capability ${i} is not classified.`,ref:i});return{report:{...o,overall:r.length===0?"pass":"fail"},issues:r}}

package/dist/agent-step-observability/index.d.ts

@@ -0,0 +1,2 @@
+export * from './types.js';
+export * from './validation.js';

package/dist/agent-step-observability/index.js

@@ -0,0 +1 @@
+export*from"./types.js";export*from"./validation.js";

package/dist/agent-step-observability/types.d.ts

@@ -0,0 +1,130 @@
+export type AgentStepEvidenceKind = 'source_message' | 'retrieval_context' | 'tool_receipt' | 'policy_decision' | 'eval_result' | 'human_feedback' | 'redaction_decision' | 'replay_bundle' | 'rollback_version';
+export type AgentStepConfidenceLevel = 'blocked' | 'low' | 'medium' | 'high' | 'verified';
+export type AgentStepVariableScope = 'step' | 'workflow' | 'tenant' | 'domain';
+export type AgentStepVariableKind = 'prompt' | 'threshold' | 'tool_choice' | 'model_route' | 'retrieval_filter' | 'policy_rule' | 'skill_version';
+export type AgentStepRiskLevel = 'low' | 'medium' | 'high' | 'critical';
+export type AgentStepReviewStatus = 'not_required' | 'needs_review' | 'changes_requested' | 'approved' | 'rejected' | 'superseded';
+export type AgentStepImprovementStatus = 'draft' | 'testing' | 'needs_approval' | 'approved' | 'promoted' | 'rejected' | 'rolled_back';
+export interface AgentStepEvidencePointer {
+    id: string;
+    kind: AgentStepEvidenceKind;
+    ref: string;
+    sourcePackage: string;
+    timestamp: string;
+    redactionStatus: 'none' | 'redacted' | 'restricted';
+    artifactHash?: string;
+    ontologyRef?: string;
+}
+export interface AgentStepReviewEntry {
+    state: AgentStepReviewStatus;
+    at: string;
+    reviewerRef?: string;
+    reason?: string;
+    correctionRefs?: string[];
+    queueRef?: string;
+}
+export interface AgentStepReviewState {
+    current: AgentStepReviewStatus;
+    history: AgentStepReviewEntry[];
+}
+export interface AgentStepReplayBundleRef {
+    id: string;
+    uri: string;
+    artifactHash: string;
+    createdAt: string;
+    requiredEvidenceRefs: string[];
+    inputFixtureRefs: string[];
+    variableVersionRefs: string[];
+    evaluatorRefs: string[];
+    rollbackVersionRefs: string[];
+}
+export interface AgentStepTweakableVariable {
+    id: string;
+    scope: AgentStepVariableScope;
+    kind: AgentStepVariableKind;
+    currentValueRef: string;
+    allowedValuesRef?: string;
+    owner: string;
+    riskLevel: AgentStepRiskLevel;
+    requiresApproval: boolean;
+    effectiveFrom: string;
+    rollbackRef: string;
+}
+export interface AgentStepSpec {
+    id: string;
+    version: string;
+    purpose: string;
+    inputKinds: string[];
+    outputArtifactKind: string;
+    agentRef: string;
+    promptRef?: string;
+    skillRef?: string;
+    toolRefs?: string[];
+    policyRefs: string[];
+    requiredEvidenceKinds: AgentStepEvidenceKind[];
+    reviewPolicyRef: string;
+    redactionPolicyRef: string;
+}
+export interface AgentStepArtifact {
+    id: string;
+    stepSpecRef: string;
+    runRef: string;
+    attempt: number;
+    artifactKind: string;
+    payloadRef: string;
+    summary: string;
+    createdAt: string;
+    producerRef: string;
+    evidencePointers: AgentStepEvidencePointer[];
+    confidence: AgentStepConfidenceLevel;
+    confidenceScore?: number;
+    reviewState: AgentStepReviewState;
+    variableInfluences: string[];
+    replayBundleRef?: string;
+    supersedes?: string;
+    supersededBy?: string;
+    redactionStatus: 'none' | 'redacted' | 'restricted';
+}
+export interface AgentStepArtifactDiff {
+    id: string;
+    beforeArtifactRef: string;
+    afterArtifactRef: string;
+    changedVariableRefs: string[];
+    confidenceChanged: boolean;
+    evidenceChanged: boolean;
+    reviewStateChanged: boolean;
+    replayBundleRef: string;
+}
+export interface AgentStepImprovementProposal {
+    id: string;
+    sourceEvidenceRefs: string[];
+    affectedStepRefs: string[];
+    affectedWorkflowRefs: string[];
+    affectedVariableRefs: string[];
+    proposedChangeKind: 'prompt' | 'threshold' | 'tool_choice' | 'model_route' | 'retrieval_filter' | 'policy_rule' | 'skill_version' | 'public_contract' | 'runtime_policy' | 'model_checkpoint' | 'vendor_export';
+    hypothesis: string;
+    riskClassification: AgentStepRiskLevel;
+    requiredApproval: boolean;
+    evalReplayPlanRef: string;
+    promotionCriteriaRefs: string[];
+    rollbackEvidenceRefs: string[];
+    versionRefs: string[];
+    promotionEvidenceRefs: string[];
+    replayBundleRefs: string[];
+    status: AgentStepImprovementStatus;
+    autoApply: boolean;
+    policyAllowsAutoApply: boolean;
+    testsPassed: boolean;
+}
+export interface AgentStepValidationIssue {
+    path: (string | number)[];
+    message: string;
+}
+export type AgentStepValidationResult<T> = {
+    valid: true;
+    value: T;
+    issues: [];
+} | {
+    valid: false;
+    issues: AgentStepValidationIssue[];
+};