@noopolis/daimon 0.1.1 → 0.2.0

package/dist/runtime/organizationRuntimeParsing.js

@@ -0,0 +1,370 @@
+import { GROK_BROKER_MODELS, GROK_BROKER_REASONING_EFFORTS } from "../contracts/grokWorkerContract.js";
+import { parseAttention } from "./attention.js";
+import { ORGANIZATION_RUNTIME_CODEX_REASONING_EFFORTS, ORGANIZATION_RUNTIME_CODEX_WORKSPACE_NO_NETWORK_POLICY, ORGANIZATION_RUNTIME_MAX_AGENTS, ORGANIZATION_RUNTIME_MAX_CONFIG_BYTES, ORGANIZATION_RUNTIME_MAX_INSTRUCTIONS_CODEPOINTS, ORGANIZATION_RUNTIME_MAX_STRING_BYTES, ORGANIZATION_RUNTIME_MAX_STRING_CODEPOINTS, ORGANIZATION_RUNTIME_MAX_WAKE_TEXT_BYTES, ORGANIZATION_RUNTIME_MAX_SCHEDULE_INTERVAL_MS, ORGANIZATION_RUNTIME_MAX_SCHEDULE_JITTER_SECONDS, ORGANIZATION_RUNTIME_V2_VERSION, ORGANIZATION_RUNTIME_VERSION } from "./organizationRuntime.js";
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const ENGINE_KINDS = new Set(["codex", "grok", "agy"]);
+const CRON_FIELD_BOUNDS = [[0, 59], [0, 23], [1, 31], [1, 12], [0, 7]];
+export function parseOrganizationRuntimeConfig(value) {
+    const root = object(snapshot(value, "config"), "config");
+    size(root);
+    exact(root, ["version", "host", "agents"], "config");
+    const version = string(root.version, "config.version");
+    if (version !== ORGANIZATION_RUNTIME_VERSION && version !== ORGANIZATION_RUNTIME_V2_VERSION)
+        throw new TypeError("config.version is not supported");
+    const hostValue = object(root.host, "config.host");
+    exact(hostValue, ["bindHost", "port", "controlTokenEnv"], "config.host");
+    const host = {
+        bindHost: nonEmpty(hostValue.bindHost, "config.host.bindHost"), port: port(hostValue.port, "config.host.port"), controlTokenEnv: envName(hostValue.controlTokenEnv, "config.host.controlTokenEnv")
+    };
+    const rawAgents = array(root.agents, "config.agents");
+    if (rawAgents.length === 0 || rawAgents.length > ORGANIZATION_RUNTIME_MAX_AGENTS)
+        throw new TypeError(`config.agents must contain between 1 and ${ORGANIZATION_RUNTIME_MAX_AGENTS} agents`);
+    const ids = new Set();
+    const agents = rawAgents.map((item, index) => {
+        const agent = parseAgent(item, `config.agents[${index}]`, version === ORGANIZATION_RUNTIME_V2_VERSION);
+        if (ids.has(agent.id))
+            throw new TypeError(`config.agents has duplicate id ${agent.id}`);
+        ids.add(agent.id);
+        return agent;
+    });
+    isolated(agents);
+    isolatedMemory(agents);
+    return { version: version, host, agents };
+}
+export function parseOrganizationRuntimeWakeRequest(value) {
+    const request = object(snapshot(value, "wake request"), "wake request");
+    exact(request, ["token", "agentId", "event"], "wake request");
+    const event = object(request.event, "wake request.event");
+    exact(event, ["version", "id", "kind", "text", "occurredAt"], "wake request.event");
+    if (string(event.version, "wake request.event.version") !== "noopolis.daimon.wake.v1")
+        throw new TypeError("wake request.event.version is not supported");
+    const kind = string(event.kind, "wake request.event.kind");
+    if (kind !== "manual" && kind !== "message" && kind !== "schedule" && kind !== "external")
+        throw new TypeError("wake request.event.kind is not supported");
+    const text = string(event.text, "wake request.event.text");
+    if (Buffer.byteLength(text, "utf8") > ORGANIZATION_RUNTIME_MAX_WAKE_TEXT_BYTES)
+        throw new TypeError("wake request.event.text exceeds the wake text limit");
+    return { token: request.token === undefined ? undefined : string(request.token, "wake request.token"), agentId: nonEmpty(request.agentId, "wake request.agentId"), event: { version: "noopolis.daimon.wake.v1", id: nonEmpty(event.id, "wake request.event.id"), kind, text, occurredAt: rfc3339(event.occurredAt) } };
+}
+export function validateOrganizationRuntimeConfig(value) {
+    try {
+        parseOrganizationRuntimeConfig(value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export const isOrganizationRuntimeConfig = validateOrganizationRuntimeConfig;
+function parseAgent(value, label, v2) {
+    const agent = object(value, label);
+    exactOptional(agent, v2 ? ["id", "name", "instructions", "workspacePath", "runtimeHomePath", "engine", "schedule"] : ["id", "name", "instructions", "workspacePath", "runtimeHomePath", "engine"], ["mcp", "moltnet", "memory", "attention"], label);
+    return {
+        id: nonEmpty(agent.id, `${label}.id`), name: nonEmpty(agent.name, `${label}.name`), instructions: nonEmpty(agent.instructions, `${label}.instructions`, ORGANIZATION_RUNTIME_MAX_INSTRUCTIONS_CODEPOINTS), workspacePath: absolute(agent.workspacePath, `${label}.workspacePath`), runtimeHomePath: absolute(agent.runtimeHomePath, `${label}.runtimeHomePath`), engine: engine(agent.engine, `${label}.engine`),
+        ...(agent.attention === undefined ? {} : { attention: parseAttention(agent.attention) }),
+        ...(v2 ? { schedule: schedule(agent.schedule, `${label}.schedule`) } : {}),
+        ...(agent.mcp === undefined ? {} : { mcp: mcpServers(agent.mcp, `${label}.mcp`) }),
+        ...(agent.moltnet === undefined ? {} : { moltnet: moltnet(agent.moltnet, `${label}.moltnet`) }),
+        ...(agent.memory === undefined ? {} : { memory: memory(agent.memory, `${label}.memory`) })
+    };
+}
+function mcpServers(value, label) {
+    const rows = array(value, label);
+    if (rows.length > 8)
+        throw new TypeError(`${label} exceeds server limit`);
+    const names = new Set();
+    return rows.map((value, index) => {
+        const item = object(value, `${label}[${index}]`);
+        exactOptional(item, ["name", "transport", "args", "env", "tools"], ["command", "url", "authSecretEnv"], `${label}[${index}]`);
+        const name = nonEmpty(item.name, `${label}[${index}].name`);
+        if (names.has(name))
+            throw new TypeError(`${label} has duplicate name`);
+        names.add(name);
+        const transport = string(item.transport, `${label}[${index}].transport`);
+        if (!["stdio", "sse", "streamable_http"].includes(transport))
+            throw new TypeError(`${label} transport is invalid`);
+        const args = array(item.args, `${label}[${index}].args`).map((entry) => string(entry, `${label}.args`));
+        if (args.length > 32)
+            throw new TypeError(`${label} args exceed limit`);
+        const envInput = object(item.env, `${label}[${index}].env`);
+        const env = Object.fromEntries(Object.entries(envInput).map(([key, entry]) => [envName(key, `${label}.env key`), string(entry, `${label}.env.${key}`)]));
+        const tools = array(item.tools, `${label}[${index}].tools`).map((entry) => nonEmpty(entry, `${label}.tools`));
+        if (tools.length === 0 || tools.length > 32 || new Set(tools).size !== tools.length)
+            throw new TypeError(`${label} tools are invalid`);
+        const command = item.command === undefined ? undefined : absolute(item.command, `${label}.command`);
+        const url = item.url === undefined ? undefined : nonEmpty(item.url, `${label}.url`);
+        if ((transport === "stdio") !== (command !== undefined) || (transport === "stdio") === (url !== undefined))
+            throw new TypeError(`${label} endpoint is invalid`);
+        if (url !== undefined) {
+            const parsed = new URL(url);
+            if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && ["127.0.0.1", "localhost"].includes(parsed.hostname)))
+                throw new TypeError(`${label}.url must be HTTPS or loopback HTTP`);
+        }
+        return { name, transport: transport, args, env, tools, ...(command ? { command } : {}), ...(url ? { url } : {}), ...(item.authSecretEnv === undefined ? {} : { authSecretEnv: envName(item.authSecretEnv, `${label}.authSecretEnv`) }) };
+    });
+}
+function moltnet(value, label) {
+    const item = object(value, label);
+    exact(item, ["cliPath", "configPath", "networks"], label);
+    const networks = array(item.networks, `${label}.networks`).map((value, index) => { const row = object(value, `${label}.networks[${index}]`); exact(row, ["id", "rooms", "dms"], `${label}.networks[${index}]`); return { id: nonEmpty(row.id, `${label}.id`), rooms: array(row.rooms, `${label}.rooms`).map((room) => nonEmpty(room, `${label}.room`)), dms: row.dms === true }; });
+    if (networks.length > 16 || new Set(networks.map((entry) => entry.id)).size !== networks.length)
+        throw new TypeError(`${label}.networks are invalid`);
+    return { cliPath: absolute(item.cliPath, `${label}.cliPath`), configPath: absolute(item.configPath, `${label}.configPath`), networks };
+}
+function memory(value, label) {
+    const item = object(value, label);
+    exactOptional(item, ["runtimeHomePath"], ["source", "tokenBudget"], label);
+    return {
+        runtimeHomePath: absolute(item.runtimeHomePath, `${label}.runtimeHomePath`),
+        ...(item.source === undefined ? {} : { source: nonEmpty(item.source, `${label}.source`) }),
+        ...(item.tokenBudget === undefined ? {} : { tokenBudget: tokenBudget(item.tokenBudget, `${label}.tokenBudget`) })
+    };
+}
+function tokenBudget(value, label) {
+    if (typeof value !== "number" || !Number.isInteger(value) || value < 1 || value > 1_000_000)
+        throw new TypeError(`${label} must be an integer between 1 and 1000000`);
+    return value;
+}
+function schedule(value, label) {
+    const input = object(value, label);
+    const kind = string(input.kind, `${label}.kind`);
+    if (kind === "disabled") {
+        exact(input, ["kind"], label);
+        return { kind };
+    }
+    if (kind === "every") {
+        exactOptional(input, ["kind", "interval_ms", "prompt"], ["jitter_seconds"], label);
+        if (typeof input.interval_ms !== "number" || !Number.isInteger(input.interval_ms) || input.interval_ms < 1 || input.interval_ms > ORGANIZATION_RUNTIME_MAX_SCHEDULE_INTERVAL_MS)
+            throw new TypeError(`${label}.interval_ms is outside its bound`);
+        return { kind, interval_ms: input.interval_ms, prompt: nonEmpty(input.prompt, `${label}.prompt`), ...jitterSeconds(input.jitter_seconds, label) };
+    }
+    if (kind === "cron") {
+        exactOptional(input, ["kind", "cron", "timezone", "prompt"], ["jitter_seconds"], label);
+        const cron = nonEmpty(input.cron, `${label}.cron`).trim().replace(/\s+/gu, " ");
+        if (!validCron(cron) || !cronCalendarPossible(cron))
+            throw new TypeError(`${label}.cron is invalid or impossible`);
+        const timezone = nonEmpty(input.timezone, `${label}.timezone`);
+        try {
+            new Intl.DateTimeFormat("en-US", { timeZone: timezone });
+        }
+        catch {
+            throw new TypeError(`${label}.timezone is not an IANA timezone`);
+        }
+        return { kind, cron, timezone, prompt: nonEmpty(input.prompt, `${label}.prompt`), ...jitterSeconds(input.jitter_seconds, label) };
+    }
+    throw new TypeError(`${label}.kind is not supported`);
+}
+function jitterSeconds(value, label) {
+    if (value === undefined)
+        return {};
+    if (typeof value !== "number" || !Number.isInteger(value) || value < 0 || value > ORGANIZATION_RUNTIME_MAX_SCHEDULE_JITTER_SECONDS)
+        throw new TypeError(`${label}.jitter_seconds is outside its bound`);
+    return { jitter_seconds: value };
+}
+function validCron(value) {
+    const fields = value.split(/\s+/u);
+    return fields.length === 5 && fields.every((field, index) => validCronField(field, CRON_FIELD_BOUNDS[index]));
+}
+function validCronField(field, [minimum, maximum]) {
+    return field.split(",").every((part) => {
+        const pieces = part.split("/");
+        const step = Number(pieces[1] ?? 1);
+        if (pieces.length > 2 || !pieces[0] || (pieces[1] !== undefined && !/^\d+$/u.test(pieces[1])) || !Number.isSafeInteger(step) || step < 1)
+            return false;
+        const range = pieces[0];
+        if (range === "*")
+            return true;
+        const bounds = range.split("-");
+        if (bounds.length > 2 || !bounds.every((bound) => /^\d+$/u.test(bound)))
+            return false;
+        const first = Number(bounds[0]);
+        const last = Number(bounds[1] ?? bounds[0]);
+        return first >= minimum && last <= maximum && first <= last;
+    });
+}
+function cronCalendarPossible(cron) {
+    const fields = cron.split(/\s+/u).map((field, index) => cronValues(field, CRON_FIELD_BOUNDS[index]));
+    for (let year = 2000; year < 2400; year += 1)
+        for (const month of fields[3]) {
+            const days = new Date(Date.UTC(year, month, 0)).getUTCDate();
+            for (const day of fields[2])
+                if (day <= days && fields[4].includes(new Date(Date.UTC(year, month - 1, day)).getUTCDay()))
+                    return true;
+        }
+    return false;
+}
+function cronValues(field, [minimum, maximum]) {
+    const result = new Set();
+    for (const part of field.split(",")) {
+        const [range, rawStep] = part.split("/");
+        const step = Number(rawStep ?? 1);
+        const bounds = range === "*" ? [minimum, maximum] : range.split("-").map(Number);
+        for (let value = bounds[0]; value <= (bounds[1] ?? bounds[0]); value += step)
+            result.add(value === 7 && maximum === 7 ? 0 : value);
+    }
+    return [...result];
+}
+function engine(value, label) {
+    const input = object(value, label);
+    const kind = string(input.kind, `${label}.kind`);
+    if (!ENGINE_KINDS.has(kind))
+        throw new TypeError(`${label}.kind is not a supported engine`);
+    // `codexSandbox` is codex-only; `model`/`reasoningEffort` are accepted for
+    // codex (open model name, Codex effort list) and for grok (closed broker
+    // lists, declared together or not at all). agy owns its own model selection.
+    const allowed = kind === "codex" ? ["kind", "model", "reasoningEffort", "codexSandbox"] : kind === "grok" ? ["kind", "model", "reasoningEffort"] : ["kind"];
+    const extras = Object.keys(input).filter((key) => !allowed.includes(key));
+    if (extras.length > 0) {
+        if (kind === "agy" && (extras.includes("model") || extras.includes("reasoningEffort") || extras.includes("codexSandbox"))) {
+            throw new TypeError(`${label}.model, ${label}.reasoningEffort, and ${label}.codexSandbox are codex-only for agy; its subscription auth, model selection, and sandbox policy are Daimon-owned`);
+        }
+        if (kind === "grok" && extras.includes("codexSandbox"))
+            throw new TypeError(`${label}.codexSandbox is codex-only; the Grok worker sandbox is Daimon-owned`);
+        throw new TypeError(`${label} must contain exactly ${allowed.join(", ")}`);
+    }
+    if (kind === "grok")
+        return grokEngine(input, label);
+    return {
+        kind: kind,
+        ...(input.model === undefined ? {} : { model: nonEmpty(input.model, `${label}.model`) }),
+        ...(input.reasoningEffort === undefined ? {} : { reasoningEffort: reasoningEffort(input.reasoningEffort, `${label}.reasoningEffort`) }),
+        ...(input.codexSandbox === undefined ? {} : { codexSandbox: codexSandbox(input.codexSandbox, `${label}.codexSandbox`) })
+    };
+}
+/**
+ * A Grok model is declared explicitly or not at all: both members from the
+ * closed broker lists, never one of them with the other inherited. Omitting
+ * both keeps a config parseable by pre-declaration producers; the brokered
+ * paths that need a model (`grokBrokerProjection.ts`, `service.json` v2)
+ * require it there instead of defaulting it here.
+ */
+function grokEngine(input, label) {
+    if ((input.model === undefined) !== (input.reasoningEffort === undefined))
+        throw new TypeError(`${label}.model and ${label}.reasoningEffort must be declared together for grok`);
+    if (input.model === undefined)
+        return { kind: "grok" };
+    const model = string(input.model, `${label}.model`), effort = string(input.reasoningEffort, `${label}.reasoningEffort`);
+    if (!GROK_BROKER_MODELS.includes(model))
+        throw new TypeError(`${label}.model must be one of ${GROK_BROKER_MODELS.join(", ")}`);
+    if (!GROK_BROKER_REASONING_EFFORTS.includes(effort))
+        throw new TypeError(`${label}.reasoningEffort must be one of ${GROK_BROKER_REASONING_EFFORTS.join(", ")}`);
+    return { kind: "grok", model, reasoningEffort: effort };
+}
+function codexSandbox(value, label) {
+    const input = object(value, label);
+    exact(input, ["mode", "networkAccess", "webSearch"], label);
+    if (input.mode !== ORGANIZATION_RUNTIME_CODEX_WORKSPACE_NO_NETWORK_POLICY.mode || input.networkAccess !== false || input.webSearch !== ORGANIZATION_RUNTIME_CODEX_WORKSPACE_NO_NETWORK_POLICY.webSearch) {
+        throw new TypeError(`${label} must be workspace-write with network disabled and web search disabled`);
+    }
+    return ORGANIZATION_RUNTIME_CODEX_WORKSPACE_NO_NETWORK_POLICY;
+}
+function reasoningEffort(value, label) {
+    const result = string(value, label);
+    if (!ORGANIZATION_RUNTIME_CODEX_REASONING_EFFORTS.includes(result)) {
+        throw new TypeError(`${label} must be one of ${ORGANIZATION_RUNTIME_CODEX_REASONING_EFFORTS.join(", ")}`);
+    }
+    return result;
+}
+function snapshot(value, label) {
+    if (value === null || typeof value === "string" || typeof value === "boolean")
+        return value;
+    if (typeof value === "number") {
+        if (!Number.isFinite(value))
+            throw new TypeError(`${label} must be JSON data`);
+        return value;
+    }
+    if (typeof value !== "object")
+        throw new TypeError(`${label} must be JSON data`);
+    if (Array.isArray(value)) {
+        const result = [];
+        for (const key of Reflect.ownKeys(value)) {
+            if (key === "length")
+                continue;
+            if (typeof key !== "string" || !/^(0|[1-9][0-9]*)$/.test(key))
+                throw new TypeError(`${label} must contain only indexed data properties`);
+            const descriptor = Object.getOwnPropertyDescriptor(value, key);
+            if (descriptor === undefined || !descriptor.enumerable || !("value" in descriptor))
+                throw new TypeError(`${label}[${String(key)}] must be an enumerable data property`);
+        }
+        for (let index = 0; index < value.length; index += 1) {
+            const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+            if (descriptor === undefined || !("value" in descriptor))
+                throw new TypeError(`${label}[${index}] must be a present record`);
+            result.push(snapshot(descriptor.value, `${label}[${index}]`));
+        }
+        return result;
+    }
+    if (Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null)
+        throw new TypeError(`${label} must be a plain own-properties object`);
+    const result = Object.create(null);
+    for (const key of Reflect.ownKeys(value)) {
+        if (typeof key !== "string")
+            throw new TypeError(`${label} must not contain symbol properties`);
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (descriptor === undefined || !descriptor.enumerable || !("value" in descriptor))
+            throw new TypeError(`${label}.${key} must be an enumerable data property`);
+        result[key] = snapshot(descriptor.value, `${label}.${key}`);
+    }
+    return result;
+}
+function object(value, label) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        throw new TypeError(`${label} must be an object`);
+    if (Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null)
+        throw new TypeError(`${label} must be a plain own-properties object`);
+    return value;
+}
+function array(value, label) { if (!Array.isArray(value))
+    throw new TypeError(`${label} must be an array`); return value; }
+function exact(value, expected, label) { const extras = Object.keys(value).filter((key) => !expected.includes(key)); const missing = expected.filter((key) => !Object.hasOwn(value, key)); if (extras.length || missing.length)
+    throw new TypeError(`${label} must contain exactly ${expected.join(", ")}`); }
+function exactOptional(value, required, optional, label) { const extras = Object.keys(value).filter((key) => !required.includes(key) && !optional.includes(key)); const missing = required.filter((key) => !Object.hasOwn(value, key)); if (extras.length || missing.length)
+    throw new TypeError(`${label} has invalid fields`); }
+function isolated(agents) { const paths = agents.flatMap((agent) => [{ agentId: agent.id, kind: "workspacePath", value: agent.workspacePath }, { agentId: agent.id, kind: "runtimeHomePath", value: agent.runtimeHomePath }]); for (let left = 0; left < paths.length; left += 1)
+    for (let right = left + 1; right < paths.length; right += 1) {
+        const first = paths[left];
+        const second = paths[right];
+        if (first.value === second.value || first.value.startsWith(`${second.value}/`) || second.value.startsWith(`${first.value}/`))
+            throw new TypeError(`agents ${first.agentId}.${first.kind} and ${second.agentId}.${second.kind} must not overlap`);
+    } }
+/**
+ * A declared bank may sit inside its own agent's runtime home, or be shared
+ * verbatim by another agent's declared bank; it must never reach into another
+ * agent's private roots, and it must never sit inside its own agent's
+ * model-writable workspace (the bash tool's cwd), which would let the sandboxed
+ * model tamper with its own ledger and bypass Mneme's policy layer entirely.
+ */
+function isolatedMemory(agents) {
+    for (const agent of agents) {
+        if (agent.memory === undefined)
+            continue;
+        const value = agent.memory.runtimeHomePath;
+        if (value === agent.workspacePath || value.startsWith(`${agent.workspacePath}/`) || agent.workspacePath.startsWith(`${value}/`))
+            throw new TypeError(`agent ${agent.id}.memory.runtimeHomePath and ${agent.id}.workspacePath must not overlap`);
+        for (const peer of agents) {
+            if (peer.id === agent.id)
+                continue;
+            for (const [kind, peerValue] of [["workspacePath", peer.workspacePath], ["runtimeHomePath", peer.runtimeHomePath]]) {
+                if (value === peerValue || value.startsWith(`${peerValue}/`) || peerValue.startsWith(`${value}/`))
+                    throw new TypeError(`agent ${agent.id}.memory.runtimeHomePath and ${peer.id}.${kind} must not overlap`);
+            }
+        }
+    }
+}
+function string(value, label, maxCodepoints = ORGANIZATION_RUNTIME_MAX_STRING_CODEPOINTS) { if (typeof value !== "string")
+    throw new TypeError(`${label} must be a string`); if (Buffer.byteLength(value, "utf8") > ORGANIZATION_RUNTIME_MAX_STRING_BYTES || Array.from(value).length > maxCodepoints)
+    throw new TypeError(`${label} exceeds the runtime string limit`); return value; }
+function nonEmpty(value, label, maxCodepoints) { const result = string(value, label, maxCodepoints); if (!result.trim())
+    throw new TypeError(`${label} must not be empty`); return result; }
+function absolute(value, label) { const result = nonEmpty(value, label); if (!path.posix.isAbsolute(result))
+    throw new TypeError(`${label} must be an absolute POSIX path`); const normalized = path.posix.normalize(result); if (normalized === "/")
+    throw new TypeError(`${label} must not overlap filesystem root`); return normalized.replace(/\/+$/, ""); }
+function envName(value, label) { const result = nonEmpty(value, label); if (!ENV_NAME.test(result))
+    throw new TypeError(`${label} must be a safe environment variable name`); return result; }
+function port(value, label) { if (typeof value !== "number" || !Number.isInteger(value) || value < 1 || value > 65_535)
+    throw new TypeError(`${label} must be an integer between 1 and 65535`); return value; }
+function size(value) { const serialized = JSON.stringify(value); if (serialized === undefined || Buffer.byteLength(serialized, "utf8") > ORGANIZATION_RUNTIME_MAX_CONFIG_BYTES)
+    throw new TypeError("config exceeds the runtime byte limit"); }
+function rfc3339(value) { const result = nonEmpty(value, "wake request.event.occurredAt"); if (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(result) || Number.isNaN(Date.parse(result)) || new Date(result).toISOString() !== result)
+    throw new TypeError("wake request.event.occurredAt must be an exact RFC3339 timestamp"); return result; }
+import path from "node:path";

package/dist/runtime/organizationRuntimeReadiness.d.ts

@@ -0,0 +1,12 @@
+import { type AgySubscriptionRealm } from "./agySubscriptionRealm.js";
+import type { OrganizationRuntimeConfig } from "./organizationRuntime.js";
+import { type OrganizationRuntimePathAuthority } from "./physicalReadiness.js";
+import { EngineBrokerControlClient } from "./engineBrokerControlClient.js";
+export type OrganizationRuntimeHostReadiness = Readonly<{
+    agyRealm?: AgySubscriptionRealm;
+    grokBroker?: EngineBrokerControlClient;
+    paths: OrganizationRuntimePathAuthority;
+    close(): Promise<void>;
+}>;
+export declare function prepareProductionReadiness(config: OrganizationRuntimeConfig): Promise<OrganizationRuntimeHostReadiness>;
+//# sourceMappingURL=organizationRuntimeReadiness.d.ts.map

package/dist/runtime/organizationRuntimeReadiness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizationRuntimeReadiness.d.ts","sourceRoot":"","sources":["../../src/runtime/organizationRuntimeReadiness.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EAAmC,KAAK,gCAAgC,EAAE,MAAM,wBAAwB,CAAC;AAEhH,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,MAAM,MAAM,gCAAgC,GAAG,QAAQ,CAAC;IACtD,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC,UAAU,CAAC,EAAE,yBAAyB,CAAC;IACvC,KAAK,EAAE,gCAAgC,CAAC;IACxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB,CAAC,CAAC;AAEH,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,gCAAgC,CAAC,CA8D3C"}

package/dist/runtime/organizationRuntimeReadiness.js

@@ -0,0 +1,59 @@
+import { startAgySubscriptionRealm } from "./agySubscriptionRealm.js";
+import { prepareEngineExecutable, verifyAgySubscriptionEnrollment } from "./engineReadiness.js";
+import { prepareOrganizationRuntimePaths } from "./physicalReadiness.js";
+import { materializePortableCredential } from "./portableCredentialMaterial.js";
+import { EngineBrokerControlClient } from "./engineBrokerControlClient.js";
+export async function prepareProductionReadiness(config) {
+    const paths = await prepareOrganizationRuntimePaths(config.agents);
+    let realm;
+    let grokBroker;
+    try {
+        for (const agent of config.agents) {
+            if (agent.engine.kind !== "codex")
+                continue;
+            const canonical = paths.forAgent(agent);
+            await canonical.verify();
+            await materializePortableCredential(agent, canonical.runtimeHomePath);
+            await canonical.verify();
+        }
+        const grokAgents = config.agents.filter((agent) => agent.engine.kind === "grok");
+        if (grokAgents.length > 0) {
+            grokBroker = new EngineBrokerControlClient();
+            await grokBroker.ready();
+        }
+        const agy = config.agents.find((agent) => agent.engine.kind === "agy");
+        if (agy !== undefined) {
+            realm = await startAgySubscriptionRealm();
+            const canonical = paths.forAgent(agy);
+            await canonical.verify();
+            const executable = await prepareEngineExecutable(agy.id, "agy");
+            await verifyAgySubscriptionEnrollment(agy.id, executable.executablePath, canonical.runtimeHomePath, realm.busAddress);
+            await executable.verify();
+            await canonical.verify();
+        }
+        let closed = false;
+        return {
+            ...(realm === undefined ? {} : { agyRealm: realm }),
+            ...(grokBroker === undefined ? {} : { grokBroker }),
+            paths,
+            async close() {
+                if (closed)
+                    return;
+                closed = true;
+                const results = await Promise.allSettled([realm?.close(), paths.close()].filter((value) => value !== undefined));
+                const failures = results.flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+                if (failures.length > 0) {
+                    throw new AggregateError(failures, "organization runtime readiness cleanup failed");
+                }
+            }
+        };
+    }
+    catch (error) {
+        const cleanup = await Promise.allSettled([realm?.close(), paths.close()].filter((value) => value !== undefined));
+        const failures = cleanup.flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+        if (failures.length > 0) {
+            throw new AggregateError([error, ...failures], "organization runtime readiness failed and cleanup was incomplete");
+        }
+        throw error;
+    }
+}

package/dist/runtime/physicalReadiness.d.ts

@@ -0,0 +1,47 @@
+import type { OrganizationRuntimeAgentConfig } from "./organizationRuntime.js";
+/**
+ * `private` is every engine's runtime home: 0700, nothing but the runtime user.
+ *
+ * `worker-traversable` is the brokered Grok shape, and only that shape: the
+ * agent's own sandboxed worker runs as another uid and must be able to *walk
+ * into* this home to read the setgid `tool-output/` spill directory the
+ * truncation notice sends it to (`GROK_ENGINE_BROKER.worker.home.organizationRuntimeHome`).
+ * Traverse-only means `0710`: no group read (the worker cannot list the home or
+ * see the acceptance store, telemetry, memory or credential names) and no group
+ * write. Anything wider — `0711`, `0750`, `0770`, any world bit — is refused,
+ * as is a group that is not a worker group. Daimon cannot tell *which* worker
+ * gid belongs to this agent; the per-slot mapping is the deployment's
+ * provisioning contract, re-checked by the slot preflight receipt's worker-uid
+ * canaries.
+ */
+type DirectoryShape = "safe" | "private" | "worker-traversable";
+/**
+ * Holds identities for caller-created roots. Daimon neither creates nor rolls
+ * back these directories: the deployer owns their lifecycle and contents.
+ */
+export type OrganizationRuntimePathAuthority = Readonly<{
+    forAgent(agent: OrganizationRuntimeAgentConfig): Readonly<{
+        workspacePath: string;
+        runtimeHomePath: string;
+        verify(): Promise<void>;
+    }>;
+    close(): Promise<void>;
+}>;
+export declare function prepareOrganizationRuntimePaths(agents: readonly OrganizationRuntimeAgentConfig[]): Promise<OrganizationRuntimePathAuthority>;
+/** Identity of the process Daimon runs as; a seam so every refusal is testable unprivileged. */
+export type RuntimeIdentity = Readonly<{
+    uid: number;
+    gid: number;
+    firstWorkerUid?: number;
+}>;
+type DirectoryEntry = Readonly<{
+    uid: number;
+    gid: number;
+    mode: number;
+    isDirectory(): boolean;
+    isSymbolicLink(): boolean;
+}>;
+/** Pure shape check for a caller-prepared runtime root. */
+export declare function assertRuntimeDirectory(entry: DirectoryEntry, label: string, shape: DirectoryShape, runtime: RuntimeIdentity): void;
+export {};
+//# sourceMappingURL=physicalReadiness.d.ts.map

package/dist/runtime/physicalReadiness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"physicalReadiness.d.ts","sourceRoot":"","sources":["../../src/runtime/physicalReadiness.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAG/E;;;;;;;;;;;;;;GAcG;AACH,KAAK,cAAc,GAAG,MAAM,GAAG,SAAS,GAAG,oBAAoB,CAAC;AAGhE;;;GAGG;AACH,MAAM,MAAM,gCAAgC,GAAG,QAAQ,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,8BAA8B,GAAG,QAAQ,CAAC;QACxD,aAAa,EAAE,MAAM,CAAC;QACtB,eAAe,EAAE,MAAM,CAAC;QACxB,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;KACzB,CAAC,CAAC;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB,CAAC,CAAC;AAOH,wBAAsB,+BAA+B,CACnD,MAAM,EAAE,SAAS,8BAA8B,EAAE,GAChD,OAAO,CAAC,gCAAgC,CAAC,CA8C3C;AA4CD,gGAAgG;AAChG,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAC9F,KAAK,cAAc,GAAG,QAAQ,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,IAAI,OAAO,CAAC;IAAC,cAAc,IAAI,OAAO,CAAA;CAAE,CAAC,CAAC;AAE9H,2DAA2D;AAC3D,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,eAAe,GAAG,IAAI,CAalI"}

package/dist/runtime/physicalReadiness.js

@@ -0,0 +1,142 @@
+import { constants } from "node:fs";
+import { lstat, open, realpath } from "node:fs/promises";
+import path from "node:path";
+import { GROK_ENGINE_BROKER } from "../contracts/runtimeContractManifest.js";
+/** Only a brokered Grok agent's home is worker-traversable; every other engine keeps 0700. */
+function runtimeHomeShape(agent) {
+    return agent.engine.kind === "grok" ? "worker-traversable" : "private";
+}
+export async function prepareOrganizationRuntimePaths(agents) {
+    const workspaces = new Map();
+    const homes = new Map();
+    try {
+        for (const agent of agents) {
+            workspaces.set(agent.id, await verifyDirectory(agent.workspacePath, "workspacePath", "safe"));
+            homes.set(agent.id, await verifyDirectory(agent.runtimeHomePath, "runtimeHomePath", runtimeHomeShape(agent)));
+        }
+        const roots = [...workspaces.values(), ...homes.values()];
+        for (let left = 0; left < roots.length; left += 1)
+            for (let right = left + 1; right < roots.length; right += 1) {
+                const first = roots[left];
+                const second = roots[right];
+                if (sameIdentity(first.identity, second.identity) || overlaps(first.real, second.real)) {
+                    throw new Error(`physical runtime paths overlap: ${first.configured} and ${second.configured}`);
+                }
+            }
+    }
+    catch (error) {
+        const closeError = await closeAll([...workspaces.values(), ...homes.values()]);
+        if (closeError !== undefined)
+            throw new AggregateError([error, closeError], "runtime path validation cleanup failed");
+        throw error;
+    }
+    let closed = false;
+    const verify = async (agent) => {
+        if (closed)
+            throw new Error("runtime path authority is closed");
+        const workspace = workspaces.get(agent.id);
+        const home = homes.get(agent.id);
+        if (workspace === undefined || home === undefined)
+            throw new Error(`no runtime path authority for ${agent.id}`);
+        await Promise.all([
+            verifyIdentity(workspace, "workspacePath", "safe"),
+            verifyIdentity(home, "runtimeHomePath", runtimeHomeShape(agent))
+        ]);
+    };
+    return {
+        forAgent(agent) {
+            const workspace = workspaces.get(agent.id);
+            const home = homes.get(agent.id);
+            if (workspace === undefined || home === undefined)
+                throw new Error(`no runtime path authority for ${agent.id}`);
+            return { workspacePath: workspace.real, runtimeHomePath: home.real, verify: () => verify(agent) };
+        },
+        async close() {
+            if (closed)
+                return;
+            const failure = await closeAll([...workspaces.values(), ...homes.values()]);
+            if (failure !== undefined)
+                throw failure;
+            closed = true;
+        }
+    };
+}
+async function verifyDirectory(configured, label, shape) {
+    await assertNoSymlinkComponents(configured);
+    const before = await lstat(configured);
+    assertDirectory(before, label, shape);
+    const fd = await open(configured, constants.O_RDONLY | directoryFlag() | noFollow());
+    try {
+        const opened = await fd.stat();
+        const real = await realpath(configured);
+        const after = await lstat(configured);
+        if (!sameIdentity(identity(before), identity(opened)) || !sameIdentity(identity(before), identity(after))) {
+            throw new Error(`${label} changed during validation`);
+        }
+        return { configured, real, fd, identity: identity(before), closed: false };
+    }
+    catch (error) {
+        await fd.close().catch(() => undefined);
+        throw error;
+    }
+}
+async function verifyIdentity(directory, label, shape) {
+    if (directory.closed)
+        throw new Error(`${label} authority is closed`);
+    await assertNoSymlinkComponents(directory.configured);
+    const entry = await lstat(directory.configured);
+    const opened = await directory.fd.stat();
+    if (!sameIdentity(identity(entry), directory.identity) || !sameIdentity(identity(opened), directory.identity)) {
+        throw new Error(`${label} changed after readiness validation`);
+    }
+    assertDirectory(entry, label, shape);
+    if (await realpath(directory.configured) !== directory.real)
+        throw new Error(`${label} changed after readiness validation`);
+}
+async function assertNoSymlinkComponents(target) {
+    const parsed = path.parse(target);
+    let current = parsed.root;
+    for (const part of path.relative(parsed.root, target).split(path.sep).filter(Boolean)) {
+        current = path.join(current, part);
+        // macOS exposes /var as a system compatibility symlink to /private/var.
+        // It is an OS-root alias, not a caller-controlled component.
+        if ((await lstat(current)).isSymbolicLink() && current !== "/var")
+            throw new Error(`path contains symlink: ${current}`);
+    }
+}
+/** Pure shape check for a caller-prepared runtime root. */
+export function assertRuntimeDirectory(entry, label, shape, runtime) {
+    if (!entry.isDirectory() || entry.isSymbolicLink())
+        throw new Error(`${label} must be an existing real directory`);
+    if (entry.uid !== runtime.uid)
+        throw new Error(`${label} must be owned by the runtime user`);
+    const permissions = Number(entry.mode) & 0o7777;
+    if (shape === "private" && permissions !== 0o700)
+        throw new Error(`${label} must have mode 0700`);
+    if (shape === "worker-traversable") {
+        const home = GROK_ENGINE_BROKER.worker.home.organizationRuntimeHome;
+        if (permissions !== home.mode)
+            throw new Error(`${label} must have mode 0710 for a brokered Grok agent`);
+        if (entry.gid < (runtime.firstWorkerUid ?? GROK_ENGINE_BROKER.identities.firstWorkerUid) || entry.gid === runtime.gid) {
+            throw new Error(`${label} must be group-owned by the agent's Grok worker group`);
+        }
+    }
+    if (shape === "safe" && (permissions & 0o022) !== 0)
+        throw new Error(`${label} must not grant group or other write access`);
+}
+function assertDirectory(entry, label, shape) {
+    assertRuntimeDirectory(entry, label, shape, { uid: process.getuid?.() ?? -1, gid: process.getgid?.() ?? -1 });
+}
+function identity(entry) { return { dev: entry.dev, ino: entry.ino, uid: entry.uid, mode: entry.mode & 0o7777 }; }
+function sameIdentity(left, right) { return left.dev === right.dev && left.ino === right.ino && left.uid === right.uid && left.mode === right.mode; }
+function overlaps(left, right) { return left === right || left.startsWith(`${right}${path.sep}`) || right.startsWith(`${left}${path.sep}`); }
+function noFollow() { return constants.O_NOFOLLOW ?? 0; }
+function directoryFlag() { return constants.O_DIRECTORY ?? 0; }
+async function closeAll(directories) {
+    const results = await Promise.allSettled(directories.filter((directory) => !directory.closed).map(async (directory) => {
+        await directory.fd.close();
+        directory.closed = true;
+    }));
+    const failures = results.flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+    return failures.length === 0 ? undefined : new AggregateError(failures, "runtime path authority cleanup failed");
+}

package/dist/runtime/portableCredentialAuth.d.ts

@@ -0,0 +1,6 @@
+export type PortableCredentialKind = "codex" | "grok";
+/** Validates only the bounded provider-native shape needed for refresh. */
+export declare function hasRefreshablePortableCredential(engine: PortableCredentialKind, bytes: Uint8Array): boolean;
+/** Returns only the provider-native bearer values for exact in-process redaction. */
+export declare function portableCredentialSecretValues(engine: PortableCredentialKind, bytes: Uint8Array): readonly string[];
+//# sourceMappingURL=portableCredentialAuth.d.ts.map