@orion-agents/orion-code 0.1.9 → 0.2.0

package/dist/runtime/subagent-thread-runtime.js

@@ -0,0 +1,876 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SubagentThreadRuntimeError = exports.SubagentThreadRuntimeV1 = exports.SubagentThreadTreeScopeV1 = exports.SUBAGENT_THREAD_RUNTIME_VERSION = void 0;
+exports.intersectSubagentAuthorityV1 = intersectSubagentAuthorityV1;
+exports.createSubagentThreadReceiptV1 = createSubagentThreadReceiptV1;
+exports.assertSubagentThreadReceiptV1 = assertSubagentThreadReceiptV1;
+const path_1 = require("path");
+const stop_decision_1 = require("../framework/stop-decision");
+const canonical_1 = require("./protocol/canonical");
+const runtime_protocol_v1_1 = require("./protocol/runtime-protocol-v1");
+const step_snapshot_1 = require("./step-snapshot");
+const thread_event_store_1 = require("./thread-event-store");
+const thread_runtime_1 = require("./thread-runtime");
+const turn_commit_1 = require("./turn-commit");
+exports.SUBAGENT_THREAD_RUNTIME_VERSION = 1;
+/** Root-tree owner for concurrency, provider/tool budgets and cancellation. */
+class SubagentThreadTreeScopeV1 {
+    constructor(limits, parentSignal) {
+        this.controller = new AbortController();
+        this.waiters = [];
+        this.active = 0;
+        this.modelUsed = 0;
+        this.modelReserved = 0;
+        this.toolUsed = 0;
+        this.toolReserved = 0;
+        this.limits = {
+            maxConcurrent: positiveInteger(limits.maxConcurrent, 'maxConcurrent'),
+            maxQueued: nonNegativeInteger(limits.maxQueued ?? limits.maxConcurrent * 4, 'maxQueued'),
+            maxModelRequests: positiveInteger(limits.maxModelRequests, 'maxModelRequests'),
+            maxToolCalls: nonNegativeInteger(limits.maxToolCalls, 'maxToolCalls'),
+        };
+        this.signal = this.controller.signal;
+        this.detachParentAbort = forwardAbort(parentSignal, this.controller);
+    }
+    async acquire(signal) {
+        this.assertOpen();
+        throwIfAborted(signal);
+        if (this.active < this.limits.maxConcurrent) {
+            this.active += 1;
+            return this.releaseHandle();
+        }
+        if (this.waiters.length >= this.limits.maxQueued) {
+            throw new SubagentThreadRuntimeError('ORION_SUBAGENT_TREE_OVERLOADED', `Subagent tree queue is full (${this.limits.maxQueued}).`);
+        }
+        return new Promise((resolveWaiter, rejectWaiter) => {
+            const waiter = {
+                signal,
+                resolve: resolveWaiter,
+                reject: rejectWaiter,
+                onAbort: () => {
+                    const index = this.waiters.indexOf(waiter);
+                    if (index >= 0)
+                        this.waiters.splice(index, 1);
+                    rejectWaiter(abortError(signal));
+                },
+            };
+            signal.addEventListener('abort', waiter.onAbort, { once: true });
+            this.waiters.push(waiter);
+        });
+    }
+    reserveBudget(ownerId, request) {
+        this.assertOpen();
+        const limits = validateBudgetRequest(request);
+        if (this.modelUsed + this.modelReserved + limits.maxModelRequests >
+            this.limits.maxModelRequests ||
+            this.toolUsed + this.toolReserved + limits.maxToolCalls > this.limits.maxToolCalls) {
+            throw new SubagentThreadRuntimeError('ORION_SUBAGENT_TREE_BUDGET_EXCEEDED', 'The root-tree model/tool budget cannot satisfy this child reservation.');
+        }
+        this.modelReserved += limits.maxModelRequests;
+        this.toolReserved += limits.maxToolCalls;
+        return new SubagentThreadBudgetLeaseV1(this, ownerId, limits);
+    }
+    /** Charge work already performed by the root loop against the same tree budget. */
+    recordRootUsage(usage) {
+        this.assertOpen();
+        const modelRequests = nonNegativeInteger(usage.modelRequests, 'root modelRequests');
+        const toolCalls = nonNegativeInteger(usage.toolCalls, 'root toolCalls');
+        if (this.modelUsed + this.modelReserved + modelRequests > this.limits.maxModelRequests ||
+            this.toolUsed + this.toolReserved + toolCalls > this.limits.maxToolCalls) {
+            throw new SubagentThreadRuntimeError('ORION_SUBAGENT_TREE_BUDGET_EXCEEDED', 'Root usage exceeds the remaining shared subagent-tree budget.');
+        }
+        this.modelUsed += modelRequests;
+        this.toolUsed += toolCalls;
+        return this.snapshot();
+    }
+    snapshot() {
+        return deepFreeze({
+            version: exports.SUBAGENT_THREAD_RUNTIME_VERSION,
+            active: this.active,
+            queued: this.waiters.length,
+            maxConcurrent: this.limits.maxConcurrent,
+            maxQueued: this.limits.maxQueued,
+            modelRequests: {
+                used: this.modelUsed,
+                reserved: this.modelReserved,
+                limit: this.limits.maxModelRequests,
+            },
+            toolCalls: {
+                used: this.toolUsed,
+                reserved: this.toolReserved,
+                limit: this.limits.maxToolCalls,
+            },
+            closed: this.signal.aborted,
+        });
+    }
+    close(reason = 'subagent thread tree closed') {
+        if (!this.signal.aborted)
+            this.controller.abort(reason);
+        this.detachParentAbort();
+        for (const waiter of this.waiters.splice(0)) {
+            waiter.signal.removeEventListener('abort', waiter.onAbort);
+            waiter.reject(abortError(this.signal));
+        }
+    }
+    consume(lease, resource, count) {
+        this.assertOpen();
+        const amount = positiveInteger(count, `${resource} budget charge`);
+        if (resource === 'model') {
+            if (lease.modelRequests + amount > lease.limits.maxModelRequests) {
+                throw lease.fail(childBudgetError(lease.ownerId, 'model requests', lease.limits.maxModelRequests));
+            }
+            lease.modelRequests += amount;
+            this.modelReserved -= amount;
+            this.modelUsed += amount;
+        }
+        else {
+            if (lease.toolCalls + amount > lease.limits.maxToolCalls) {
+                throw lease.fail(childBudgetError(lease.ownerId, 'tool calls', lease.limits.maxToolCalls));
+            }
+            lease.toolCalls += amount;
+            this.toolReserved -= amount;
+            this.toolUsed += amount;
+        }
+        return lease.snapshot();
+    }
+    releaseBudget(lease) {
+        this.modelReserved -= lease.limits.maxModelRequests - lease.modelRequests;
+        this.toolReserved -= lease.limits.maxToolCalls - lease.toolCalls;
+    }
+    assertOpen() {
+        if (this.signal.aborted)
+            throw abortError(this.signal);
+    }
+    releaseHandle() {
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            this.active -= 1;
+            this.promote();
+        };
+    }
+    promote() {
+        while (this.active < this.limits.maxConcurrent && this.waiters.length > 0) {
+            const waiter = this.waiters.shift();
+            waiter.signal.removeEventListener('abort', waiter.onAbort);
+            if (waiter.signal.aborted) {
+                waiter.reject(abortError(waiter.signal));
+                continue;
+            }
+            this.active += 1;
+            waiter.resolve(this.releaseHandle());
+        }
+    }
+}
+exports.SubagentThreadTreeScopeV1 = SubagentThreadTreeScopeV1;
+class SubagentThreadBudgetLeaseV1 {
+    constructor(tree, ownerId, limits) {
+        this.tree = tree;
+        this.ownerId = ownerId;
+        this.limits = limits;
+        this.modelRequests = 0;
+        this.toolCalls = 0;
+        this.released = false;
+    }
+    consumeModelRequests(count = 1) {
+        this.assertOpen();
+        return this.tree.consume(this, 'model', count);
+    }
+    consumeToolCalls(count = 1) {
+        this.assertOpen();
+        return this.tree.consume(this, 'tool', count);
+    }
+    snapshot() {
+        return Object.freeze({ modelRequests: this.modelRequests, toolCalls: this.toolCalls });
+    }
+    release() {
+        if (this.released)
+            return;
+        this.released = true;
+        this.tree.releaseBudget(this);
+    }
+    fail(error) {
+        this.failure ?? (this.failure = error);
+        return this.failure;
+    }
+    assertOpen() {
+        if (this.released) {
+            throw new SubagentThreadRuntimeError('ORION_SUBAGENT_TREE_CLOSED', `Budget lease ${this.ownerId} is closed.`);
+        }
+    }
+}
+/** Durable child-Thread orchestration; it never returns the child's transcript. */
+class SubagentThreadRuntimeV1 {
+    constructor(options) {
+        this.options = validateOptions(options);
+    }
+    async run(request) {
+        const objective = request.objective.trim();
+        if (!objective || Buffer.byteLength(objective, 'utf8') > this.options.maxObjectiveBytes) {
+            throw new SubagentThreadRuntimeError('ORION_SUBAGENT_INVALID_REQUEST', `Child objective must be non-empty and at most ${this.options.maxObjectiveBytes} bytes.`);
+        }
+        throwIfAborted(this.options.tree.signal);
+        throwIfAborted(request.abortSignal);
+        const parent = await flushAndCaptureParent(request.parent);
+        throwIfAborted(this.options.tree.signal);
+        throwIfAborted(request.abortSignal);
+        const rolePolicy = this.options.rolePolicies[request.role];
+        if (!rolePolicy) {
+            throw new SubagentThreadRuntimeError('ORION_SUBAGENT_ROLE_DENIED', `Subagent role ${request.role} has no configured authority policy.`);
+        }
+        const authority = intersectSubagentAuthorityV1(request.parentAuthority, rolePolicy);
+        const childThreadId = this.options.threadIdFactory();
+        if (!(0, runtime_protocol_v1_1.isRuntimeId)(childThreadId) || childThreadId === parent.threadId) {
+            throw new SubagentThreadRuntimeError('ORION_SUBAGENT_INVALID_REQUEST', 'Child Thread ID factory must return a UUID distinct from the parent Thread.');
+        }
+        const linked = linkAbortSignals([this.options.tree.signal, request.abortSignal]);
+        let releaseConcurrency;
+        let budget;
+        let runtime;
+        try {
+            releaseConcurrency = await this.options.tree.acquire(linked.signal);
+            throwIfAborted(linked.signal);
+            budget = this.options.tree.reserveBudget(childThreadId, request.budget ?? this.options.defaultBudget);
+            const evidence = new BoundedEvidenceCollectorV1(this.options.maxEvidenceItems, this.options.maxEvidenceBytes);
+            const store = new thread_event_store_1.ThreadEventStore(this.options.childStoreRootDir, childThreadId, this.options.eventStoreOptions);
+            const runner = await this.options.createAgentLoop({
+                role: request.role,
+                objective,
+                childThreadId,
+                childStore: store,
+                parent,
+                authority,
+                budget,
+                evidence,
+                abortSignal: linked.signal,
+            });
+            const captured = new CapturingTurnRunnerV1(runner, linked.signal);
+            runtime = new thread_runtime_1.ThreadRuntimeV1({
+                store,
+                runner: captured,
+                projectPath: authority.projectRoot,
+                requireTurnCommit: true,
+            });
+            store.appendDurable({
+                payload: {
+                    type: 'thread.forked',
+                    data: {
+                        sourceThreadId: parent.threadId,
+                        sourceSeq: parent.capabilityReceiptSeq,
+                    },
+                },
+            });
+            const admission = runtime.dispatch({
+                type: 'turn.start',
+                data: { input: objective, mode: request.mode ?? 'build' },
+            });
+            if (admission.status !== 'started') {
+                throw new SubagentThreadRuntimeError('ORION_SUBAGENT_CHILD_START_FAILED', `Child Thread start was ${admission.status}.`);
+            }
+            const onAbort = () => {
+                runtime?.dispatch({
+                    type: 'turn.interrupt',
+                    data: { reason: abortMessage(linked.signal) },
+                });
+            };
+            linked.signal.addEventListener('abort', onAbort, { once: true });
+            if (linked.signal.aborted)
+                onAbort();
+            try {
+                await runtime.waitForIdle();
+            }
+            finally {
+                linked.signal.removeEventListener('abort', onAbort);
+            }
+            const projection = store.loadProjection();
+            const turn = projection.turns[admission.turnId];
+            if (budget.failure)
+                throw budget.failure;
+            if (!turn || turn.status === 'active' || !turn.commit) {
+                throw new SubagentThreadRuntimeError('ORION_SUBAGENT_CHILD_COMMIT_MISSING', 'Child AgentLoop did not durably publish a terminal TurnCommitV1.');
+            }
+            const childCommit = (0, turn_commit_1.parseTurnCommitV1)(turn.commit.receipt);
+            assertIndependentStepSnapshots(parent.stepSnapshotDigest, childCommit, turn.status);
+            const usage = budget.snapshot();
+            const stopDecision = childStopDecision(childCommit, turn.status, usage, budget.limits, parent);
+            const summary = boundedChildSummary(projection, admission.turnId, childCommit, this.options.maxSummaryBytes);
+            const evidenceItems = boundedEvidence(evidence.snapshot(), childCommit, this.options.maxEvidenceItems, this.options.maxEvidenceBytes);
+            const receipt = createSubagentThreadReceiptV1({
+                receiptId: (0, runtime_protocol_v1_1.createRuntimeId)(),
+                parent,
+                childThreadId,
+                childTurnId: admission.turnId,
+                childCursor: projection.cursor,
+                childProjectionDigest: projection.digest,
+                childCommit,
+                role: request.role,
+                authority,
+                usage,
+                turnTerminal: turn.status,
+                stopDecision,
+                summary,
+                evidence: evidenceItems,
+                createdAt: this.options.clock(),
+            });
+            try {
+                await this.options.onReceipt?.(receipt);
+            }
+            catch (error) {
+                throw new SubagentThreadRuntimeError('ORION_SUBAGENT_RECEIPT_WRITE_FAILED', `Subagent receipt sink failed: ${errorMessage(error)}`);
+            }
+            return deepFreeze({
+                version: exports.SUBAGENT_THREAD_RUNTIME_VERSION,
+                parentThreadId: parent.threadId,
+                parentTurnId: parent.turnId,
+                childThreadId,
+                childTurnId: admission.turnId,
+                role: request.role,
+                authority,
+                status: stopDecision.status,
+                turnTerminal: turn.status,
+                summary,
+                evidence: evidenceItems,
+                usage,
+                stopDecision,
+                receipt,
+            });
+        }
+        finally {
+            runtime?.close('subagent child finished');
+            budget?.release();
+            releaseConcurrency?.();
+            linked.dispose();
+        }
+    }
+}
+exports.SubagentThreadRuntimeV1 = SubagentThreadRuntimeV1;
+class CapturingTurnRunnerV1 {
+    constructor(runner, treeSignal) {
+        this.runner = runner;
+        this.treeSignal = treeSignal;
+    }
+    async run(context) {
+        const linked = linkAbortSignals([context.abortSignal, this.treeSignal]);
+        try {
+            return await this.runner.run({ ...context, abortSignal: linked.signal });
+        }
+        finally {
+            linked.dispose();
+        }
+    }
+}
+class BoundedEvidenceCollectorV1 {
+    constructor(maxItems, maxBytes) {
+        this.maxItems = maxItems;
+        this.maxBytes = maxBytes;
+        this.items = [];
+    }
+    record(evidence) {
+        if (this.items.length >= this.maxItems)
+            return false;
+        const source = truncateUtf8(evidence.source.trim(), this.maxBytes);
+        const detail = truncateUtf8(evidence.detail.trim(), this.maxBytes);
+        const reference = evidence.reference
+            ? truncateUtf8(evidence.reference.trim(), this.maxBytes)
+            : undefined;
+        if (!source || !detail)
+            return false;
+        this.items.push(deepFreeze({
+            kind: evidence.kind,
+            source,
+            detail,
+            ...(reference ? { reference } : {}),
+        }));
+        return true;
+    }
+    snapshot() {
+        return deepFreeze(this.items.map(item => ({ ...item })));
+    }
+}
+function intersectSubagentAuthorityV1(parent, rolePolicy) {
+    assertAuthority(parent, 'parent');
+    assertAuthority(rolePolicy, 'role');
+    const projectRoot = intersectProjectRoots(parent.projectRoot, rolePolicy.projectRoot);
+    const confirmation = moreRestrictive(parent.confirmation, rolePolicy.confirmation, [
+        'allow',
+        'ask',
+        'deny',
+    ]);
+    const filesystem = moreRestrictive(parent.filesystem, rolePolicy.filesystem, [
+        'full',
+        'workspace',
+    ]);
+    const network = moreRestrictive(parent.network, rolePolicy.network, [
+        'write',
+        'read',
+        'deny',
+    ]);
+    return (0, step_snapshot_1.createAuthoritySnapshotV1)({
+        authorityId: `subagent:${(0, canonical_1.digestRuntimeValue)({ parent: parent.digest, role: rolePolicy.digest })}`,
+        projectRoot,
+        confirmation,
+        filesystem,
+        network,
+    });
+}
+function createSubagentThreadReceiptV1(input) {
+    const content = {
+        version: exports.SUBAGENT_THREAD_RUNTIME_VERSION,
+        receiptId: input.receiptId,
+        parentThreadId: input.parent.threadId,
+        parentTurnId: input.parent.turnId,
+        parentStepId: input.parent.stepId,
+        parentRequestId: input.parent.requestId,
+        parentStepSnapshotSeq: input.parent.stepSnapshotSeq,
+        parentCapabilityReceiptSeq: input.parent.capabilityReceiptSeq,
+        parentStepSnapshotDigest: input.parent.stepSnapshotDigest,
+        parentCapabilityReceiptDigest: input.parent.capabilityReceiptDigest,
+        parentProjectionCursor: input.parent.projectionCursor,
+        parentProjectionDigest: input.parent.projectionDigest,
+        childThreadId: input.childThreadId,
+        childTurnId: input.childTurnId,
+        childCursor: input.childCursor,
+        childProjectionDigest: input.childProjectionDigest,
+        childCommitDigest: input.childCommit.digest,
+        childStepSnapshotDigests: [...input.childCommit.stepSnapshotDigests],
+        role: input.role,
+        authorityDigest: input.authority.digest,
+        usage: { ...input.usage },
+        turnTerminal: input.turnTerminal,
+        stopDecisionDigest: (0, canonical_1.digestRuntimeValue)(input.stopDecision),
+        resultDigest: (0, canonical_1.digestRuntimeValue)({
+            status: input.stopDecision.status,
+            turnTerminal: input.turnTerminal,
+            summary: input.summary,
+        }),
+        evidenceDigest: (0, canonical_1.digestRuntimeValue)(input.evidence),
+        createdAt: input.createdAt,
+    };
+    return deepFreeze({ ...content, digest: (0, canonical_1.digestRuntimeValue)(content) });
+}
+function assertSubagentThreadReceiptV1(receipt) {
+    const { digest, ...content } = receipt;
+    if (receipt.version !== exports.SUBAGENT_THREAD_RUNTIME_VERSION ||
+        !(0, runtime_protocol_v1_1.isRuntimeId)(receipt.receiptId) ||
+        !(0, runtime_protocol_v1_1.isRuntimeId)(receipt.parentThreadId) ||
+        !(0, runtime_protocol_v1_1.isRuntimeId)(receipt.parentTurnId) ||
+        !(0, runtime_protocol_v1_1.isRuntimeId)(receipt.parentStepId) ||
+        !(0, runtime_protocol_v1_1.isRuntimeId)(receipt.parentRequestId) ||
+        !(0, runtime_protocol_v1_1.isRuntimeId)(receipt.childThreadId) ||
+        !(0, runtime_protocol_v1_1.isRuntimeId)(receipt.childTurnId) ||
+        !Number.isSafeInteger(receipt.parentStepSnapshotSeq) ||
+        receipt.parentStepSnapshotSeq < 1 ||
+        receipt.parentCapabilityReceiptSeq !== receipt.parentStepSnapshotSeq + 1 ||
+        !Number.isSafeInteger(receipt.parentProjectionCursor) ||
+        receipt.parentCapabilityReceiptSeq > receipt.parentProjectionCursor ||
+        !receipt.parentStepSnapshotDigest.trim() ||
+        !receipt.parentCapabilityReceiptDigest.trim() ||
+        (0, canonical_1.digestRuntimeValue)(content) !== digest) {
+        throw new SubagentThreadRuntimeError('ORION_SUBAGENT_RECEIPT_INVALID', 'Subagent Thread receipt failed identity or digest validation.');
+    }
+}
+class SubagentThreadRuntimeError extends Error {
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'SubagentThreadRuntimeError';
+    }
+}
+exports.SubagentThreadRuntimeError = SubagentThreadRuntimeError;
+async function flushAndCaptureParent(input) {
+    assertParentForkRequest(input);
+    try {
+        await input.flush();
+    }
+    catch (error) {
+        throw new SubagentThreadRuntimeError('ORION_SUBAGENT_PARENT_FLUSH_FAILED', `Parent step receipt flush failed: ${errorMessage(error)}`);
+    }
+    const events = replayAllEvents(input.store);
+    const projection = input.store.loadProjection();
+    const turn = projection.turns[input.turnId];
+    if (!turn ||
+        turn.status !== 'active' ||
+        projection.activeTurnId !== input.turnId ||
+        turn.commit) {
+        throw new SubagentThreadRuntimeError('ORION_SUBAGENT_PARENT_NOT_ACTIVE', `Parent turn ${input.turnId} must remain active at the child fork boundary.`);
+    }
+    const replayCursor = events.at(-1)?.seq ?? 0;
+    if (projection.cursor !== replayCursor || input.store.getCursor() !== projection.cursor) {
+        throw new SubagentThreadRuntimeError('ORION_SUBAGENT_PARENT_DRIFT', 'Parent durable projection changed while capturing the child fork boundary.');
+    }
+    const snapshots = events.filter(event => event.payload.type === 'step.snapshot' &&
+        (event.stepId === input.stepId || event.payload.data.snapshotId === input.stepId));
+    const capabilities = events.filter(event => event.payload.type === 'capability.receipt' &&
+        (event.stepId === input.stepId || event.payload.data.receiptId === input.requestId));
+    if (snapshots.length !== 1 || capabilities.length !== 1) {
+        throw new SubagentThreadRuntimeError('ORION_SUBAGENT_PARENT_STEP_NOT_DURABLE', `Parent step ${input.stepId} does not have exactly one durable StepSnapshot/CapabilityReceipt pair.`);
+    }
+    const snapshotEvent = snapshots[0];
+    const capabilityEvent = capabilities[0];
+    if (snapshotEvent.payload.type !== 'step.snapshot' ||
+        capabilityEvent.payload.type !== 'capability.receipt' ||
+        snapshotEvent.seq + 1 !== capabilityEvent.seq ||
+        snapshotEvent.threadId !== input.threadId ||
+        capabilityEvent.threadId !== input.threadId ||
+        snapshotEvent.turnId !== input.turnId ||
+        capabilityEvent.turnId !== input.turnId ||
+        snapshotEvent.stepId !== input.stepId ||
+        capabilityEvent.stepId !== input.stepId ||
+        snapshotEvent.payload.data.snapshotId !== input.stepId ||
+        capabilityEvent.payload.data.receiptId !== input.requestId ||
+        snapshotEvent.payload.data.digest !== input.stepSnapshotDigest ||
+        capabilityEvent.payload.data.digest !== input.capabilityReceiptDigest) {
+        throw new SubagentThreadRuntimeError('ORION_SUBAGENT_PARENT_DRIFT', 'Parent StepSnapshot/CapabilityReceipt envelope differs from the requested fork anchor.');
+    }
+    const laterStep = events.find(event => event.payload.type === 'step.snapshot' &&
+        event.turnId === input.turnId &&
+        event.seq > capabilityEvent.seq);
+    if (laterStep) {
+        throw new SubagentThreadRuntimeError('ORION_SUBAGENT_PARENT_DRIFT', `Parent advanced beyond step ${input.stepId} before the child fork boundary.`);
+    }
+    assertParentReceiptChain(input, snapshotEvent, capabilityEvent);
+    return deepFreeze({
+        threadId: input.threadId,
+        turnId: input.turnId,
+        stepId: input.stepId,
+        requestId: input.requestId,
+        stepSnapshotSeq: snapshotEvent.seq,
+        capabilityReceiptSeq: capabilityEvent.seq,
+        stepSnapshotDigest: input.stepSnapshotDigest,
+        capabilityReceiptDigest: input.capabilityReceiptDigest,
+        projectionCursor: projection.cursor,
+        projectionDigest: projection.digest,
+    });
+}
+function assertParentForkRequest(input) {
+    if (!input?.store ||
+        !(0, runtime_protocol_v1_1.isRuntimeId)(input.threadId) ||
+        !(0, runtime_protocol_v1_1.isRuntimeId)(input.turnId) ||
+        !(0, runtime_protocol_v1_1.isRuntimeId)(input.stepId) ||
+        !(0, runtime_protocol_v1_1.isRuntimeId)(input.requestId) ||
+        input.store.threadId !== input.threadId ||
+        !input.stepSnapshotDigest.trim() ||
+        !input.capabilityReceiptDigest.trim() ||
+        typeof input.flush !== 'function') {
+        throw new SubagentThreadRuntimeError('ORION_SUBAGENT_INVALID_REQUEST', 'Parent fork requires matching thread/turn/step/request identities and both receipt digests.');
+    }
+}
+function assertParentReceiptChain(input, snapshotEvent, capabilityEvent) {
+    if (snapshotEvent.payload.type !== 'step.snapshot' ||
+        capabilityEvent.payload.type !== 'capability.receipt') {
+        parentDrift('Parent fork events are not a StepSnapshot/CapabilityReceipt pair.');
+    }
+    const persistedSnapshot = parseReceiptObject(snapshotEvent.payload.data.receipt, 'StepSnapshot');
+    const capabilityReceipt = parseReceiptObject(capabilityEvent.payload.data.receipt, 'CapabilityReceipt');
+    const stepReceipt = persistedSnapshot.stepReceipt;
+    if (!isRecord(stepReceipt))
+        parentDrift('Parent StepSnapshot is missing its step receipt.');
+    assertReceiptDigest(persistedSnapshot, 'Parent StepSnapshot receipt');
+    assertReceiptDigest(stepReceipt, 'Parent CapabilityStep receipt');
+    assertReceiptDigest(capabilityReceipt, 'Parent Capability receipt');
+    if (persistedSnapshot.version !== 1 ||
+        persistedSnapshot.snapshotId !== input.stepId ||
+        persistedSnapshot.threadId !== input.threadId ||
+        persistedSnapshot.turnId !== input.turnId ||
+        persistedSnapshot.stepId !== input.stepId ||
+        persistedSnapshot.snapshotDigest !== input.stepSnapshotDigest ||
+        persistedSnapshot.capabilityReceiptDigest !== input.capabilityReceiptDigest ||
+        stepReceipt.version !== 1 ||
+        stepReceipt.threadId !== input.threadId ||
+        stepReceipt.turnId !== input.turnId ||
+        stepReceipt.stepId !== input.stepId ||
+        stepReceipt.snapshotDigest !== input.stepSnapshotDigest ||
+        stepReceipt.capabilityReceiptDigest !== input.capabilityReceiptDigest ||
+        capabilityReceipt.version !== 1 ||
+        capabilityReceipt.requestId !== input.requestId ||
+        capabilityReceipt.threadId !== input.threadId ||
+        capabilityReceipt.turnId !== input.turnId ||
+        capabilityReceipt.stepId !== input.stepId ||
+        capabilityReceipt.digest !== input.capabilityReceiptDigest) {
+        parentDrift('Parent step receipt identity or digest chain is inconsistent.');
+    }
+}
+function assertReceiptDigest(value, label) {
+    const record = value;
+    const digest = record.digest;
+    if (typeof digest !== 'string')
+        parentDrift(`${label} has no digest.`);
+    const content = { ...record };
+    delete content.digest;
+    if ((0, canonical_1.digestRuntimeValue)(content) !== digest)
+        parentDrift(`${label} digest is invalid.`);
+}
+function parseReceiptObject(serialized, label) {
+    let value;
+    try {
+        value = JSON.parse(serialized);
+    }
+    catch {
+        parentDrift(`${label} is not valid JSON.`);
+    }
+    if (!isRecord(value))
+        parentDrift(`${label} is not an object.`);
+    return value;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function parentDrift(message) {
+    throw new SubagentThreadRuntimeError('ORION_SUBAGENT_PARENT_DRIFT', message);
+}
+function replayAllEvents(store) {
+    const events = [];
+    let cursor = 0;
+    while (true) {
+        const page = store.replay(cursor);
+        events.push(...page.events);
+        if (!page.hasMore)
+            return events;
+        if (page.nextCursor <= cursor)
+            parentDrift('Parent event replay cursor did not advance.');
+        cursor = page.nextCursor;
+    }
+}
+function validateOptions(options) {
+    if (!options.childStoreRootDir.trim()) {
+        throw new SubagentThreadRuntimeError('ORION_SUBAGENT_INVALID_REQUEST', 'childStoreRootDir is required.');
+    }
+    const childStoreRootDir = (0, path_1.resolve)(options.childStoreRootDir);
+    return {
+        childStoreRootDir,
+        tree: options.tree,
+        rolePolicies: options.rolePolicies,
+        createAgentLoop: options.createAgentLoop,
+        eventStoreOptions: options.eventStoreOptions,
+        defaultBudget: validateBudgetRequest(options.defaultBudget ?? { maxModelRequests: 6, maxToolCalls: 24 }),
+        maxObjectiveBytes: positiveInteger(options.maxObjectiveBytes ?? 64 * 1024, 'maxObjectiveBytes'),
+        maxSummaryBytes: positiveInteger(options.maxSummaryBytes ?? 16 * 1024, 'maxSummaryBytes'),
+        maxEvidenceItems: positiveInteger(options.maxEvidenceItems ?? 32, 'maxEvidenceItems'),
+        maxEvidenceBytes: positiveInteger(options.maxEvidenceBytes ?? 2 * 1024, 'maxEvidenceBytes'),
+        threadIdFactory: options.threadIdFactory ?? runtime_protocol_v1_1.createRuntimeId,
+        clock: options.clock ?? Date.now,
+        onReceipt: options.onReceipt,
+    };
+}
+function validateBudgetRequest(input) {
+    return Object.freeze({
+        maxModelRequests: positiveInteger(input.maxModelRequests, 'child maxModelRequests'),
+        maxToolCalls: nonNegativeInteger(input.maxToolCalls, 'child maxToolCalls'),
+    });
+}
+function assertAuthority(authority, label) {
+    const { digest, ...content } = authority;
+    if (!authority.authorityId.trim() ||
+        !authority.projectRoot.trim() ||
+        !['allow', 'ask', 'deny'].includes(authority.confirmation) ||
+        !['workspace', 'full'].includes(authority.filesystem) ||
+        !['deny', 'read', 'write'].includes(authority.network) ||
+        (0, canonical_1.digestRuntimeValue)(content) !== digest) {
+        throw new SubagentThreadRuntimeError('ORION_SUBAGENT_AUTHORITY_INVALID', `${label} AuthoritySnapshotV1 failed integrity validation.`);
+    }
+}
+function intersectProjectRoots(parentRoot, roleRoot) {
+    const parent = (0, path_1.resolve)(parentRoot);
+    const role = (0, path_1.resolve)(roleRoot);
+    if (isWithin(parent, role))
+        return role;
+    if (isWithin(role, parent))
+        return parent;
+    throw new SubagentThreadRuntimeError('ORION_SUBAGENT_AUTHORITY_INVALID', 'Parent and role project roots do not overlap.');
+}
+function isWithin(root, candidate) {
+    const path = (0, path_1.relative)(root, candidate);
+    return path === '' || (path !== '..' && !path.startsWith(`..${path_1.sep}`) && !(0, path_1.isAbsolute)(path));
+}
+function moreRestrictive(left, right, order) {
+    return order[Math.max(order.indexOf(left), order.indexOf(right))];
+}
+function assertIndependentStepSnapshots(parentStepSnapshotDigest, child, terminal) {
+    if (terminal === 'completed' && child.stepSnapshotDigests.length === 0) {
+        throw new SubagentThreadRuntimeError('ORION_SUBAGENT_CHILD_SNAPSHOT_INVALID', 'A completed child AgentLoop must persist an independent StepSnapshotV1.');
+    }
+    if (child.stepSnapshotDigests.includes(parentStepSnapshotDigest)) {
+        throw new SubagentThreadRuntimeError('ORION_SUBAGENT_CHILD_SNAPSHOT_INVALID', 'Child StepSnapshotV1 aliases a parent snapshot digest.');
+    }
+}
+function childStopDecision(commit, terminal, usage, limits, parent) {
+    const parsed = parseStopDecision(commit);
+    const status = terminal === 'interrupted' ? 'cancelled' : terminal === 'failed' ? 'failed' : 'completed';
+    const base = parsed ??
+        (0, stop_decision_1.createStopDecision)({
+            scope: 'subagent',
+            status,
+            disposition: status === 'completed' ? 'finish_scope' : 'resume_allowed',
+            reason: {
+                code: `subagent_${status}`,
+                message: status === 'completed'
+                    ? 'Child Thread completed its assigned scope.'
+                    : `Child Thread ended with ${status}.`,
+            },
+            evidence: [],
+            nextActions: status === 'completed'
+                ? [{ kind: 'inspect', label: 'Inspect and reconcile child evidence.' }]
+                : [{ kind: 'retry', label: 'Retry only after inspecting the child receipt.' }],
+            resources: {},
+        });
+    return (0, stop_decision_1.createStopDecision)({
+        ...base,
+        scope: 'subagent',
+        evidence: [
+            ...base.evidence,
+            {
+                kind: 'runtime',
+                source: 'subagent-thread-runtime',
+                detail: `Forked from durable parent step ${parent.stepId} (${parent.capabilityReceiptDigest}).`,
+            },
+        ],
+        resources: {
+            ...base.resources,
+            llmRequests: { used: usage.modelRequests, limit: limits.maxModelRequests },
+            toolCalls: { used: usage.toolCalls, limit: limits.maxToolCalls },
+        },
+    });
+}
+function parseStopDecision(commit) {
+    if (!commit.stopDecision)
+        return undefined;
+    let value;
+    try {
+        value = JSON.parse(commit.stopDecision);
+    }
+    catch {
+        throw childResultError('Child TurnCommit stopDecision is not JSON.');
+    }
+    if (value.schemaVersion !== 1 ||
+        !['completed', 'stopped', 'blocked', 'cancelled', 'failed'].includes(value.status) ||
+        !['finish_scope', 'pause_scope', 'resume_allowed'].includes(value.disposition) ||
+        !value.reason ||
+        !Array.isArray(value.evidence) ||
+        !Array.isArray(value.nextActions) ||
+        !value.resources ||
+        (0, canonical_1.digestRuntimeValue)(value) !== commit.stopDecisionDigest) {
+        throw childResultError('Child TurnCommit stopDecision failed schema or digest validation.');
+    }
+    return value;
+}
+function boundedChildSummary(projection, turnId, commit, maxBytes) {
+    const turn = projection.turns[turnId];
+    const assistant = turn?.itemIds
+        .map(itemId => projection.items[itemId])
+        .filter(item => item.kind === 'message' && item.role === 'assistant' && item.content)
+        .at(-1)?.content;
+    const fallback = commit.outcome ||
+        commit.error ||
+        commit.reason ||
+        `Child Thread ended with ${commit.terminal}.`;
+    return truncateUtf8((assistant || fallback).trim(), maxBytes);
+}
+function boundedEvidence(collected, commit, maxItems, maxBytes) {
+    const items = collected.slice(0, maxItems).map(item => ({ ...item }));
+    if (items.length === 0) {
+        items.push({
+            kind: 'runtime',
+            source: 'subagent-thread-runtime',
+            detail: truncateUtf8('Child completed without separately reported task evidence.', maxBytes),
+            reference: truncateUtf8(commit.digest, maxBytes),
+        });
+    }
+    return deepFreeze(items);
+}
+function linkAbortSignals(signals) {
+    const controller = new AbortController();
+    const listeners = [];
+    for (const signal of signals) {
+        if (!signal)
+            continue;
+        const listener = () => {
+            if (!controller.signal.aborted)
+                controller.abort(signal.reason);
+        };
+        if (signal.aborted)
+            listener();
+        else {
+            signal.addEventListener('abort', listener, { once: true });
+            listeners.push({ signal, listener });
+        }
+    }
+    return {
+        signal: controller.signal,
+        dispose: () => {
+            for (const entry of listeners) {
+                entry.signal.removeEventListener('abort', entry.listener);
+            }
+        },
+    };
+}
+function forwardAbort(signal, target) {
+    if (!signal)
+        return () => undefined;
+    const listener = () => {
+        if (!target.signal.aborted)
+            target.abort(signal.reason);
+    };
+    if (signal.aborted)
+        listener();
+    else
+        signal.addEventListener('abort', listener, { once: true });
+    return () => signal.removeEventListener('abort', listener);
+}
+function throwIfAborted(signal) {
+    if (signal?.aborted)
+        throw abortError(signal);
+}
+function abortError(signal) {
+    return new SubagentThreadRuntimeError('ORION_SUBAGENT_ABORTED', abortMessage(signal));
+}
+function abortMessage(signal) {
+    return signal.reason instanceof Error
+        ? signal.reason.message
+        : String(signal.reason || 'Subagent Thread was aborted.');
+}
+function childBudgetError(ownerId, resource, limit) {
+    return new SubagentThreadRuntimeError('ORION_SUBAGENT_TREE_BUDGET_EXCEEDED', `Child ${ownerId} exceeded its ${resource} reservation (${limit}).`);
+}
+function childResultError(message) {
+    return new SubagentThreadRuntimeError('ORION_SUBAGENT_CHILD_RESULT_INVALID', message);
+}
+function truncateUtf8(value, maxBytes) {
+    if (Buffer.byteLength(value, 'utf8') <= maxBytes)
+        return value;
+    let result = '';
+    let bytes = 0;
+    for (const character of value) {
+        const next = Buffer.byteLength(character, 'utf8');
+        if (bytes + next > maxBytes)
+            break;
+        result += character;
+        bytes += next;
+    }
+    return result;
+}
+function positiveInteger(value, name) {
+    if (!Number.isSafeInteger(value) || value <= 0) {
+        throw new SubagentThreadRuntimeError('ORION_SUBAGENT_INVALID_REQUEST', `${name} must be a positive safe integer.`);
+    }
+    return value;
+}
+function nonNegativeInteger(value, name) {
+    if (!Number.isSafeInteger(value) || value < 0) {
+        throw new SubagentThreadRuntimeError('ORION_SUBAGENT_INVALID_REQUEST', `${name} must be a non-negative safe integer.`);
+    }
+    return value;
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function deepFreeze(value) {
+    if (typeof value !== 'object' || value === null || Object.isFrozen(value))
+        return value;
+    Object.freeze(value);
+    for (const child of Object.values(value))
+        deepFreeze(child);
+    return value;
+}
+//# sourceMappingURL=subagent-thread-runtime.js.map