@rivus/agent 0.13.2 → 0.14.1

package/dist/pi-tool-proxy.d.ts

@@ -1,197 +0,0 @@
-import { s as AgentLoopInput } from "./agent-loop.js";
-import { c as MemoryScope, t as AgentMemoryAuthority } from "./agent-memory.js";
-import { O as RivusToolGrantSet, _ as RivusPluginCatalog, h as RivusHostToolDescriptor, j as RivusToolRisk, x as RivusResolvedToolDescriptor } from "./rivus-plugin.js";
-import { ToolDefinition } from "@earendil-works/pi-coding-agent";
-
-//#region src/domain/recovery-action.d.ts
-interface RecoveryAction {
-  readonly actorId: string;
-  readonly at: string;
-  readonly note: string;
-}
-declare class InvalidRecoveryAction extends Error {
-  readonly name = "InvalidRecoveryAction";
-}
-declare function createRecoveryAction(input: RecoveryAction): RecoveryAction;
-//#endregion
-//#region src/application/delegation/tool-operation-ledger.d.ts
-interface ToolOperationBinding {
-  readonly agentId: string;
-  readonly inputDigest: string;
-  readonly instanceId: string;
-  readonly sourceMessageId: string;
-  readonly toolId: string;
-  readonly toolVersion: string;
-}
-type ToolOperationState = {
-  readonly status: "pending";
-} | {
-  readonly result: unknown;
-  readonly status: "completed";
-} | {
-  readonly reason: string;
-  readonly status: "reconciliation-required";
-} | {
-  readonly status: "aborted";
-};
-interface ToolOperationRecord {
-  readonly binding: ToolOperationBinding;
-  readonly operationId: string;
-  readonly reconciliation?: ToolOperationReconciliation;
-  readonly revision: number;
-  readonly state: ToolOperationState;
-}
-interface ToolOperationReconciliation extends RecoveryAction {
-  readonly outcome: "applied" | "not-applied";
-}
-type ToolOperationReconciliationOutcome = {
-  readonly result: unknown;
-  readonly status: "applied";
-} | {
-  readonly status: "not-applied";
-};
-type ToolOperationBeginResult = {
-  readonly status: "acquired";
-} | {
-  readonly result: unknown;
-  readonly status: "completed";
-} | {
-  readonly status: "blocked";
-  readonly reason: string;
-};
-type ToolOperationInspectResult = {
-  readonly status: "missing";
-} | {
-  readonly result: unknown;
-  readonly status: "completed";
-} | {
-  readonly status: "blocked";
-  readonly reason: string;
-};
-interface ToolOperationLedger {
-  abort(operationId: string, binding: ToolOperationBinding): Promise<void>;
-  begin(operationId: string, binding: ToolOperationBinding): Promise<ToolOperationBeginResult>;
-  complete(operationId: string, binding: ToolOperationBinding, result: unknown): Promise<void>;
-  inspect(operationId: string, binding: ToolOperationBinding): Promise<ToolOperationInspectResult>;
-  reconciliationRequired(): ReadonlyArray<ToolOperationRecord>;
-  reconcile(input: {
-    readonly action: RecoveryAction;
-    readonly expectedRevision: number;
-    readonly operationId: string;
-    readonly outcome: ToolOperationReconciliationOutcome;
-  }): Promise<ToolOperationRecord>;
-  requireReconciliation(operationId: string, binding: ToolOperationBinding, reason: string): Promise<void>;
-  unresolvedForSource(sourceMessageId: string): ReadonlyArray<ToolOperationRecord>;
-}
-declare function createToolOperationLedger(options?: {
-  readonly initial?: ReadonlyArray<ToolOperationRecord>;
-  readonly persist?: (record: ToolOperationRecord) => Promise<void>;
-}): ToolOperationLedger;
-//#endregion
-//#region src/application/delegation/tool-authority.d.ts
-interface InvocationAuthorityRef {
-  readonly id: string;
-}
-interface InvocationAuthority {
-  readonly agentId: string;
-  readonly allowedActorOpenIds?: ReadonlyArray<string>;
-  readonly conversationId?: string;
-  readonly endpointId?: string;
-  readonly instanceId: string;
-  readonly memory?: AgentMemoryAuthority;
-  readonly runId: string;
-  readonly sessionKey: string;
-  readonly sourceMessageId: string;
-  readonly tenantKey: string;
-  readonly toolGrantSet: RivusToolGrantSet;
-}
-declare class InvalidInvocationAuthority extends Error {
-  readonly name = "InvalidInvocationAuthority";
-}
-declare function createInvocationAuthority(authority: InvocationAuthority): InvocationAuthorityRef;
-//#endregion
-//#region src/application/delegation/tool-broker.d.ts
-interface AuthorizationPolicyState {
-  readonly epoch: number;
-  readonly revokedToolIds: ReadonlyArray<string>;
-}
-interface AuthorizationPolicyProvider {
-  current(): Promise<AuthorizationPolicyState>;
-}
-interface ToolApprovalRequest {
-  readonly approvalId: string;
-  readonly agentId: string;
-  readonly instanceId: string;
-  readonly inputDigest: string;
-  readonly operationId: string;
-  readonly runId: string;
-  readonly sessionKey: string;
-  readonly tenantKey: string;
-  readonly callId: string;
-  readonly toolId: string;
-  readonly toolVersion: string;
-  readonly risk: RivusToolRisk;
-}
-interface ToolApprovalService {
-  consume(request: ToolApprovalRequest): Promise<boolean>;
-}
-interface ToolBrokerOptions {
-  readonly approvals: ToolApprovalService;
-  readonly catalog: RivusPluginCatalog;
-  readonly hostTools?: ReadonlyArray<RivusHostToolDescriptor>;
-  readonly policy: AuthorizationPolicyProvider;
-  readonly operations?: ToolOperationLedger;
-}
-interface ToolExecutionRequest {
-  readonly authority: InvocationAuthorityRef;
-  readonly callId: string;
-  readonly toolId: string;
-  readonly version: string;
-  readonly input: unknown;
-  readonly operationId?: string;
-  readonly approvalId?: string;
-}
-interface ToolBroker {
-  execute(request: ToolExecutionRequest): Promise<unknown>;
-}
-declare class ToolInvocationDenied extends Error {
-  readonly name = "ToolInvocationDenied";
-}
-declare function createToolBroker(options: ToolBrokerOptions): ToolBroker;
-//#endregion
-//#region src/infrastructure/pi/pi-tool-proxy.d.ts
-interface PiToolApprovalRequest {
-  readonly agentId: string;
-  readonly allowedActorOpenIds: ReadonlyArray<string>;
-  readonly approvalId: string;
-  readonly callId: string;
-  readonly endpointId: string;
-  readonly inputDigest: string;
-  readonly instanceId: string;
-  readonly operationId: string;
-  readonly risk: RivusToolRisk;
-  readonly runId: string;
-  readonly sessionKey: string;
-  readonly signal?: AbortSignal;
-  readonly sourceMessageId: string;
-  readonly tenantKey: string;
-  readonly toolId: string;
-  readonly toolVersion: string;
-}
-interface PiToolApprovalGateway {
-  requestApproval(request: PiToolApprovalRequest): Promise<void>;
-}
-interface PiToolProxyOptions {
-  readonly agentId: string;
-  readonly approvals: PiToolApprovalGateway;
-  readonly broker: ToolBroker;
-  readonly getActiveInput: () => AgentLoopInput | undefined;
-  readonly instanceId: string;
-  readonly memoryScopes?: ReadonlyArray<MemoryScope>;
-  readonly toolGrantSet: RivusToolGrantSet;
-  readonly tools: ReadonlyArray<RivusResolvedToolDescriptor>;
-}
-declare function createPiToolProxyDefinitions(options: PiToolProxyOptions): ToolDefinition[];
-declare function createPiToolNameResolver(tools: ReadonlyArray<Pick<RivusResolvedToolDescriptor, "id">>): (toolName: string) => string;
-//#endregion
-export { createRecoveryAction as A, ToolOperationReconciliation as C, createToolOperationLedger as D, ToolOperationState as E, InvalidRecoveryAction as O, ToolOperationLedger as S, ToolOperationRecord as T, InvocationAuthorityRef as _, createPiToolProxyDefinitions as a, ToolOperationBinding as b, ToolApprovalRequest as c, ToolBrokerOptions as d, ToolExecutionRequest as f, InvocationAuthority as g, InvalidInvocationAuthority as h, createPiToolNameResolver as i, RecoveryAction as k, ToolApprovalService as l, createToolBroker as m, PiToolApprovalRequest as n, AuthorizationPolicyProvider as o, ToolInvocationDenied as p, PiToolProxyOptions as r, AuthorizationPolicyState as s, PiToolApprovalGateway as t, ToolBroker as u, createInvocationAuthority as v, ToolOperationReconciliationOutcome as w, ToolOperationInspectResult as x, ToolOperationBeginResult as y };

package/dist/rivus-plugin-registry.js

@@ -1,215 +0,0 @@
-import { c as InvalidRivusPlugin, o as createRivusMemoryToolContract, r as RIVUS_MEMORY_TOOL_PLUGIN_ID, t as MEMORY_SCOPES } from "./agent-memory.js";
-import { u as extendBackgroundSessionDefinition } from "./background-session-authority.js";
-import { createHash } from "node:crypto";
-//#region src/application/plugin/deep-freeze.ts
-function deepFreeze(value) {
-	if (value !== null && typeof value === "object" && !Object.isFrozen(value)) {
-		Object.freeze(value);
-		for (const child of Object.values(value)) deepFreeze(child);
-	}
-	return value;
-}
-//#endregion
-//#region src/application/plugin/rivus-plugin-registry.ts
-function createRivusPluginCatalog() {
-	const plugins = /* @__PURE__ */ new Map();
-	const profiles = /* @__PURE__ */ new Map();
-	const tools = /* @__PURE__ */ new Map();
-	const skills = /* @__PURE__ */ new Map();
-	const automations = /* @__PURE__ */ new Map();
-	return {
-		registerPlugin: (plugin) => {
-			validateManifest(plugin.manifest);
-			rejectDuplicate(plugins, plugin.manifest.id, "plugin");
-			const pendingProfiles = [];
-			const pendingTools = [];
-			const pendingSkills = [];
-			const pendingAutomations = [];
-			const pendingIds = /* @__PURE__ */ new Set();
-			const register = (kind, definition, catalog, destination, namespaced) => {
-				validateIdentifier(definition.id, kind);
-				if (namespaced && !definition.id.startsWith(`${plugin.manifest.id}/`)) throw new InvalidRivusPlugin(`${kind} id ${definition.id} must use plugin namespace ${plugin.manifest.id}/`);
-				const key = `${kind}:${definition.id}`;
-				if (pendingIds.has(key) || catalog.has(definition.id)) throw new InvalidRivusPlugin(`duplicate ${kind} id: ${definition.id}`);
-				pendingIds.add(key);
-				destination.push(deepFreeze({
-					...definition,
-					pluginId: plugin.manifest.id
-				}));
-			};
-			plugin.register({
-				registerAgentProfile: (profile) => register("profile", profile, profiles, pendingProfiles, false),
-				registerAutomation: (automation) => register("automation", automation, automations, pendingAutomations, true),
-				registerSkill: (skill) => register("skill", skill, skills, pendingSkills, true),
-				registerTool: (tool) => register("tool", tool, tools, pendingTools, true)
-			});
-			const availableToolIds = /* @__PURE__ */ new Set([...tools.keys(), ...pendingTools.map(({ id }) => id)]);
-			const availableSkillIds = /* @__PURE__ */ new Set([...skills.keys(), ...pendingSkills.map(({ id }) => id)]);
-			const availableProfileIds = /* @__PURE__ */ new Set([...profiles.keys(), ...pendingProfiles.map(({ id }) => id)]);
-			for (const profile of pendingProfiles) {
-				validateMemoryScopes(profile.memory.scopes, `profile ${profile.id}`);
-				validateReferences(profile.tools.allow, availableToolIds, `profile ${profile.id}`, "tool");
-				validateReferences(profile.skills.allow, availableSkillIds, `profile ${profile.id}`, "skill");
-			}
-			for (const automation of pendingAutomations) {
-				if (!availableProfileIds.has(automation.profileId)) throw new InvalidRivusPlugin(`automation ${automation.id} references unknown profile: ${automation.profileId}`);
-				validateReferences(automation.requestedToolIds, availableToolIds, `automation ${automation.id}`, "tool");
-				validateReferences(automation.requestedSkillIds, availableSkillIds, `automation ${automation.id}`, "skill");
-			}
-			plugins.set(plugin.manifest.id, deepFreeze({ ...plugin.manifest }));
-			for (const profile of pendingProfiles) profiles.set(profile.id, profile);
-			for (const tool of pendingTools) tools.set(tool.id, tool);
-			for (const skill of pendingSkills) skills.set(skill.id, skill);
-			for (const automation of pendingAutomations) automations.set(automation.id, automation);
-		},
-		snapshot: () => deepFreeze({
-			automations: [...automations.values()],
-			plugins: [...plugins.values()],
-			profiles: [...profiles.values()],
-			skills: [...skills.values()],
-			tools: [...tools.values()]
-		})
-	};
-}
-function resolveRivusAgentDefinition(catalog, deployment, options = {}) {
-	const snapshot = catalog.snapshot();
-	const plugin = snapshot.plugins.find((candidate) => candidate.id === deployment.pluginId);
-	if (!plugin) throw new InvalidRivusPlugin(`unknown deployment plugin: ${deployment.pluginId}`);
-	const profile = snapshot.profiles.find((candidate) => candidate.id === deployment.profileId && candidate.pluginId === deployment.pluginId);
-	if (!profile) throw new InvalidRivusPlugin(`unknown profile ${deployment.profileId} for plugin ${deployment.pluginId}`);
-	const requestedTools = uniqueExactIds(deployment.tools.allow, "deployment tool allowlist");
-	const catalogTools = new Map(snapshot.tools.map((tool) => [tool.id, tool]));
-	for (const id of requestedTools) if (!catalogTools.has(id)) throw new InvalidRivusPlugin(`unknown deployment tool: ${id}`);
-	const profileToolIds = uniqueExactIds(profile.tools.allow, "profile tool allowlist");
-	for (const id of profileToolIds) if (!catalogTools.has(id)) throw new InvalidRivusPlugin(`profile ${profile.id} references unknown tool: ${id}`);
-	const toolIds = profileToolIds.filter((id) => requestedTools.includes(id)).sort();
-	const profileMemoryScopes = validateMemoryScopes(profile.memory.scopes, `profile ${profile.id}`);
-	const requestedMemoryScopes = validateMemoryScopes(deployment.memory?.scopes ?? [], `deployment ${deployment.agentId}`);
-	const memoryScopes = profileMemoryScopes.filter((scope) => requestedMemoryScopes.includes(scope));
-	const memoryTool = deployment.memory?.tool === true;
-	if (memoryTool && memoryScopes.length === 0) throw new InvalidRivusPlugin(`deployment ${deployment.agentId} Memory Tool requires at least one granted scope`);
-	const memoryToolContract = createRivusMemoryToolContract(memoryScopes);
-	const resolvedToolIds = [...toolIds, ...memoryTool ? [memoryToolContract.id] : []].sort();
-	const tools = resolvedToolIds.map((id) => id === memoryToolContract.id ? {
-		...memoryToolContract,
-		pluginId: RIVUS_MEMORY_TOOL_PLUGIN_ID
-	} : toResolvedTool(catalogTools.get(id)));
-	const requestedSkills = uniqueExactIds(deployment.skills.allow, "deployment skill allowlist");
-	const catalogSkills = new Map(snapshot.skills.map((skill) => [skill.id, skill]));
-	for (const id of requestedSkills) if (!catalogSkills.has(id)) throw new InvalidRivusPlugin(`unknown deployment skill: ${id}`);
-	const skillIds = uniqueExactIds(profile.skills.allow, "profile skill allowlist").filter((id) => requestedSkills.includes(id)).sort();
-	const skills = skillIds.map((id) => {
-		const skill = catalogSkills.get(id);
-		if (!skill) throw new InvalidRivusPlugin(`profile ${profile.id} references unknown skill: ${id}`);
-		return skill;
-	});
-	const profileRevision = digest({
-		memory: {
-			scopes: memoryScopes,
-			tool: memoryTool
-		},
-		model: profile.model,
-		plugin,
-		profileId: profile.id,
-		skills: skills.map(({ content, digest: skillDigest, id, pluginId, title, version }) => ({
-			content,
-			digest: skillDigest,
-			id,
-			pluginId,
-			title,
-			version
-		})),
-		systemPrompt: profile.systemPrompt,
-		tools
-	});
-	const toolGrantSet = deepFreeze({
-		revision: digest({
-			profileRevision,
-			toolIds: resolvedToolIds
-		}),
-		toolIds: resolvedToolIds
-	});
-	const skillGrantSet = deepFreeze({
-		revision: digest({
-			profileRevision,
-			skillIds
-		}),
-		skillIds
-	});
-	const definition = deepFreeze({
-		agentId: deployment.agentId,
-		endpointIds: [...deployment.endpointIds],
-		memory: {
-			scopes: memoryScopes,
-			tool: memoryTool
-		},
-		model: profile.model,
-		pluginId: deployment.pluginId,
-		profileId: deployment.profileId,
-		...deployment.projectSpaceId ? { projectSpaceId: deployment.projectSpaceId } : {},
-		profileRevision,
-		skillGrantSet,
-		skills,
-		systemPrompt: profile.systemPrompt,
-		toolGrantSet,
-		tools
-	});
-	if (options.backgroundSessions === true) return extendBackgroundSessionDefinition(definition);
-	return definition;
-}
-function validateMemoryScopes(scopes, owner) {
-	const result = /* @__PURE__ */ new Set();
-	for (const scope of scopes) {
-		if (!MEMORY_SCOPES.includes(scope)) throw new InvalidRivusPlugin(`${owner} references unsupported Memory scope: ${String(scope)}`);
-		if (result.has(scope)) throw new InvalidRivusPlugin(`${owner} contains duplicate Memory scope: ${scope}`);
-		result.add(scope);
-	}
-	return [...result];
-}
-function validateManifest(manifest) {
-	validateIdentifier(manifest.id, "plugin");
-	if (manifest.apiVersion !== "1") throw new InvalidRivusPlugin(`unsupported plugin API version ${manifest.apiVersion}; expected 1`);
-	if (manifest.version.trim() === "") throw new InvalidRivusPlugin("plugin version must not be empty");
-}
-function validateIdentifier(id, kind) {
-	if (!/^[a-z0-9][a-z0-9._/-]*$/.test(id) || id.includes("*") || id.includes("//")) throw new InvalidRivusPlugin(`invalid ${kind} id: ${id}`);
-}
-function rejectDuplicate(map, id, kind) {
-	if (map.has(id)) throw new InvalidRivusPlugin(`duplicate ${kind} id: ${id}`);
-}
-function uniqueExactIds(ids, label) {
-	const result = /* @__PURE__ */ new Set();
-	for (const id of ids) {
-		if (id.includes("*")) throw new InvalidRivusPlugin(`${label} does not support wildcard id: ${id}`);
-		validateIdentifier(id, label);
-		if (result.has(id)) throw new InvalidRivusPlugin(`duplicate id in ${label}: ${id}`);
-		result.add(id);
-	}
-	return [...result];
-}
-function validateReferences(ids, available, owner, kind) {
-	for (const id of uniqueExactIds(ids, `${owner} ${kind} references`)) if (!available.has(id)) throw new InvalidRivusPlugin(`${owner} references unknown ${kind}: ${id}`);
-}
-function toResolvedTool(tool) {
-	const { createExecutor: _createExecutor, description, digest: toolDigest, id, idempotency, inputSchema, pluginId, risk, version } = tool;
-	return deepFreeze({
-		description,
-		digest: toolDigest,
-		id,
-		idempotency,
-		inputSchema,
-		pluginId,
-		risk,
-		version
-	});
-}
-function digest(value) {
-	return `sha256:${createHash("sha256").update(stableJson(value)).digest("hex")}`;
-}
-function stableJson(value) {
-	if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
-	if (value !== null && typeof value === "object") return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, child]) => `${JSON.stringify(key)}:${stableJson(child)}`).join(",")}}`;
-	return JSON.stringify(value);
-}
-//#endregion
-export { resolveRivusAgentDefinition as n, deepFreeze as r, createRivusPluginCatalog as t };

package/dist/tool-input-digest.js

@@ -1,128 +0,0 @@
-import { s as restrictMemoryScopesForAudience } from "./agent-memory.js";
-import { createHash, randomUUID } from "node:crypto";
-import { Unsafe } from "typebox";
-//#region src/infrastructure/pi/pi-skill-tool.ts
-const PI_SKILL_READER_TOOL_NAME = "rivus_read_skill";
-function createPiSkillRuntime(skills) {
-	if (skills.length === 0) return Object.freeze({ prompt: "" });
-	const skillsById = new Map(skills.map((skill) => [skill.id, skill]));
-	const prompt = [
-		"Granted Skills are versioned instructions loaded on demand.",
-		`Before following a Skill, call ${PI_SKILL_READER_TOOL_NAME} with its exact ID and follow the returned content.`,
-		"Granted Skill catalog:",
-		...skills.map((skill) => `- ${skill.id} | ${skill.title} | v${skill.version} | ${skill.digest}`)
-	].join("\n");
-	const tool = {
-		description: "Read the full versioned instructions for one Skill granted to this Agent Runtime.",
-		execute: async (_callId, input) => {
-			const skillId = readSkillId(input);
-			const skill = skillsById.get(skillId);
-			if (!skill) throw new Error(`Skill is not granted: ${skillId}`);
-			const details = {
-				contentLength: skill.content.length,
-				digest: skill.digest,
-				skillId: skill.id,
-				title: skill.title,
-				version: skill.version
-			};
-			return {
-				content: [{
-					text: skill.content,
-					type: "text"
-				}],
-				details
-			};
-		},
-		executionMode: "sequential",
-		label: "Read granted Skill",
-		name: PI_SKILL_READER_TOOL_NAME,
-		parameters: Unsafe({
-			additionalProperties: false,
-			properties: { skillId: {
-				description: "Exact Skill ID from the granted Skill catalog.",
-				type: "string"
-			} },
-			required: ["skillId"],
-			type: "object"
-		}),
-		promptSnippet: `${PI_SKILL_READER_TOOL_NAME}: read one granted Skill by exact ID`
-	};
-	return Object.freeze({
-		prompt,
-		tool
-	});
-}
-function readSkillId(input) {
-	if (input === null || typeof input !== "object" || Array.isArray(input) || typeof input.skillId !== "string") throw new Error("Skill reader input requires a string skillId");
-	return input.skillId;
-}
-//#endregion
-//#region src/application/delegation/tool-authority.ts
-const authorities = /* @__PURE__ */ new WeakMap();
-var InvalidInvocationAuthority = class extends Error {
-	name = "InvalidInvocationAuthority";
-};
-function createInvocationAuthority(authority) {
-	if (!authority.sourceMessageId.trim()) throw new InvalidInvocationAuthority("invocation authority requires a trusted source message id");
-	if (authority.endpointId !== void 0 && !authority.endpointId.trim()) throw new InvalidInvocationAuthority("invocation authority requires a trusted endpoint id");
-	const reference = Object.freeze({ id: `authority:${randomUUID()}` });
-	const memory = authority.memory ? Object.freeze({
-		...authority.memory,
-		scopes: Object.freeze(restrictMemoryScopesForAudience(authority.memory.scopes, authority.memory.audience))
-	}) : void 0;
-	authorities.set(reference, Object.freeze({
-		...authority,
-		...authority.allowedActorOpenIds ? { allowedActorOpenIds: Object.freeze([...authority.allowedActorOpenIds]) } : {},
-		...memory ? { memory } : {}
-	}));
-	return reference;
-}
-function resolveInvocationAuthority(reference) {
-	const authority = authorities.get(reference);
-	if (!authority) throw new InvalidInvocationAuthority("invocation authority was not issued by this host");
-	return authority;
-}
-//#endregion
-//#region src/application/delegation/tool-input-digest.ts
-var InvalidStableJson = class extends Error {
-	name = "InvalidStableJson";
-};
-var InvalidToolInput = class extends InvalidStableJson {
-	name = "InvalidToolInput";
-};
-function createToolInputDigest(input) {
-	let canonical;
-	try {
-		canonical = normalizeStableJson(input);
-	} catch (error) {
-		if (error instanceof InvalidStableJson) throw new InvalidToolInput(error.message);
-		throw error;
-	}
-	return `sha256:${createHash("sha256").update(JSON.stringify(canonical)).digest("hex")}`;
-}
-function normalizeStableJson(value) {
-	return canonicalize(value, /* @__PURE__ */ new Set());
-}
-function canonicalize(value, ancestors) {
-	if (value === null || typeof value === "string" || typeof value === "boolean") return value;
-	if (typeof value === "number") {
-		if (!Number.isFinite(value)) throw new InvalidStableJson("stable JSON numbers must be finite");
-		return Object.is(value, -0) ? 0 : value;
-	}
-	if (typeof value !== "object") throw new InvalidStableJson("value must contain only stable JSON values");
-	if (ancestors.has(value)) throw new InvalidStableJson("stable JSON must not contain cycles");
-	ancestors.add(value);
-	try {
-		if (Array.isArray(value)) return Array.from({ length: value.length }, (_, index) => {
-			if (!Object.hasOwn(value, index)) throw new InvalidStableJson("stable JSON arrays must not contain holes");
-			return canonicalize(value[index], ancestors);
-		});
-		const prototype = Object.getPrototypeOf(value);
-		if (prototype !== Object.prototype && prototype !== null) throw new InvalidStableJson("stable JSON objects must be plain objects");
-		return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, entry]) => [key, canonicalize(entry, ancestors)]));
-	} finally {
-		ancestors.delete(value);
-	}
-}
-//#endregion
-export { InvalidInvocationAuthority as a, PI_SKILL_READER_TOOL_NAME as c, normalizeStableJson as i, createPiSkillRuntime as l, InvalidToolInput as n, createInvocationAuthority as o, createToolInputDigest as r, resolveInvocationAuthority as s, InvalidStableJson as t };