@tangle-network/agent-interface 0.22.0 → 0.23.0

package/dist/agent-candidate-execution-plan-schema.d.ts

@@ -1,4 +1,10 @@
 import { z } from "zod";
+export declare const agentCandidateModelAccessNetworkSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    mode: z.ZodLiteral<"disabled">;
+}, z.core.$strict>, z.ZodObject<{
+    mode: z.ZodLiteral<"gateway-only">;
+    domains: z.ZodArray<z.ZodString>;
+}, z.core.$strict>], "mode">;
 export declare const agentCandidateResolvedModelSchema: z.ZodObject<{
     requested: z.ZodString;
     provider: z.ZodString;
@@ -359,6 +365,12 @@ export declare const agentCandidateExecutionPlanMaterialSchema: z.ZodObject<{
         access: z.ZodObject<{
             kind: z.ZodLiteral<"evaluator-mediated">;
             grantDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
+            network: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                mode: z.ZodLiteral<"disabled">;
+            }, z.core.$strict>, z.ZodObject<{
+                mode: z.ZodLiteral<"gateway-only">;
+                domains: z.ZodArray<z.ZodString>;
+            }, z.core.$strict>], "mode">;
         }, z.core.$strict>;
         routes: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
             kind: z.ZodLiteral<"primary">;
@@ -684,6 +696,12 @@ export declare const agentCandidateExecutionPlanEvidenceSchema: z.ZodObject<{
             access: {
                 kind: "evaluator-mediated";
                 grantDigest: `sha256:${string}`;
+                network: {
+                    mode: "disabled";
+                } | {
+                    mode: "gateway-only";
+                    domains: string[];
+                };
             };
             routes: ({
                 kind: "primary";
@@ -989,6 +1007,12 @@ export declare const agentCandidateExecutionPlanEvidenceSchema: z.ZodObject<{
             access: {
                 kind: "evaluator-mediated";
                 grantDigest: `sha256:${string}`;
+                network: {
+                    mode: "disabled";
+                } | {
+                    mode: "gateway-only";
+                    domains: string[];
+                };
             };
             routes: ({
                 kind: "primary";

package/dist/agent-candidate-execution-plan-schema.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { agentCandidateCapturedArtifactSchema, agentCandidateWorkspaceSnapshotEvidenceSchema, } from "./agent-candidate-artifact-schema.js";
 import { agentCandidateContainerSchema, agentCandidateInstructionDeliverySchema, agentCandidateWorkingDirectorySchema, } from "./agent-candidate-code-schema.js";
-import { addDuplicateIssues, agentCandidateConfigValueSchema, environmentConfigSchema, gitObjectSchema, isCanonicalJsonValue, isSafeExecutable, isSafeRelativePath, sameGitObjectFormat, sha256DigestSchema, } from "./agent-candidate-schema-common.js";
+import { addDuplicateIssues, agentCandidateConfigValueSchema, environmentConfigSchema, gitObjectSchema, isCanonicalJsonValue, isObviouslyPrivateHostname, isSafeExecutable, isSafeRelativePath, sameGitObjectFormat, sha256DigestSchema, } from "./agent-candidate-schema-common.js";
 import { harnessTypeSchema } from "./harness.js";
 const reasoningEffortSchema = z.enum([
     "none",
@@ -21,6 +21,34 @@ function isCanonicalAbsolutePath(value) {
 function pathsOverlap(left, right) {
     return left === right || left.startsWith(`${right}/`) || right.startsWith(`${left}/`);
 }
+function isExactPublicGatewayDomain(value) {
+    if (value.length > 253 ||
+        value !== value.toLowerCase() ||
+        value.endsWith(".") ||
+        value.includes(":") ||
+        isObviouslyPrivateHostname(value)) {
+        return false;
+    }
+    const labels = value.split(".");
+    return (labels.length >= 2 &&
+        labels.every((label) => label.length >= 1 &&
+            label.length <= 63 &&
+            /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(label)) &&
+        /[a-z]/.test(labels.at(-1) ?? ""));
+}
+export const agentCandidateModelAccessNetworkSchema = z.discriminatedUnion("mode", [
+    z.object({ mode: z.literal("disabled") }).strict(),
+    z
+        .object({
+        mode: z.literal("gateway-only"),
+        domains: z
+            .array(z
+            .string()
+            .refine(isExactPublicGatewayDomain, "model gateway must be an exact lowercase public DNS name"))
+            .min(1),
+    })
+        .strict(),
+]);
 export const agentCandidateResolvedModelSchema = z
     .object({
     requested: z.string().min(1),
@@ -195,6 +223,7 @@ export const agentCandidateExecutionPlanMaterialSchema = z
             .object({
             kind: z.literal("evaluator-mediated"),
             grantDigest: sha256DigestSchema,
+            network: agentCandidateModelAccessNetworkSchema,
         })
             .strict(),
         routes: z
@@ -300,6 +329,33 @@ export const agentCandidateExecutionPlanMaterialSchema = z
             });
         }
     }
+    const modelNetwork = material.model.access.network;
+    if (material.limits.maxModelCalls === 0 && modelNetwork.mode !== "disabled") {
+        ctx.addIssue({
+            code: "custom",
+            path: ["model", "access", "network"],
+            message: "zero-call plans cannot expose a model gateway",
+        });
+    }
+    if (material.limits.maxModelCalls > 0 && modelNetwork.mode !== "gateway-only") {
+        ctx.addIssue({
+            code: "custom",
+            path: ["model", "access", "network"],
+            message: "model-calling plans require one frozen gateway allowlist",
+        });
+    }
+    if (modelNetwork.mode === "gateway-only") {
+        addDuplicateIssues(modelNetwork.domains, ["model", "access", "network", "domains"], ctx);
+        for (let index = 1; index < modelNetwork.domains.length; index++) {
+            if ((modelNetwork.domains[index - 1] ?? "") >= (modelNetwork.domains[index] ?? "")) {
+                ctx.addIssue({
+                    code: "custom",
+                    path: ["model", "access", "network", "domains", index],
+                    message: "model gateway domains must be lexicographically sorted",
+                });
+            }
+        }
+    }
     const activeCode = material.codeKind !== "disabled";
     if (activeCode !== (material.candidateWorkspace !== undefined)) {
         ctx.addIssue({

package/dist/agent-candidate-receipt-schema.d.ts

@@ -319,6 +319,12 @@ export declare const agentCandidateMaterializationReceiptSchema: z.ZodObject<{
                 access: {
                     kind: "evaluator-mediated";
                     grantDigest: `sha256:${string}`;
+                    network: {
+                        mode: "disabled";
+                    } | {
+                        mode: "gateway-only";
+                        domains: string[];
+                    };
                 };
                 routes: ({
                     kind: "primary";
@@ -624,6 +630,12 @@ export declare const agentCandidateMaterializationReceiptSchema: z.ZodObject<{
                 access: {
                     kind: "evaluator-mediated";
                     grantDigest: `sha256:${string}`;
+                    network: {
+                        mode: "disabled";
+                    } | {
+                        mode: "gateway-only";
+                        domains: string[];
+                    };
                 };
                 routes: ({
                     kind: "primary";

package/dist/agent-candidate.d.ts

@@ -352,6 +352,13 @@ export interface AgentCandidateProfileApplication {
     targetWorkspace: AgentCandidateWorkingDirectory["workspace"];
     mountPaths: string[];
 }
+/** Evaluator-owned network exception for the one frozen model gateway. */
+export type AgentCandidateModelAccessNetwork = {
+    mode: "disabled";
+} | {
+    mode: "gateway-only";
+    domains: string[];
+};
 /**
  * Canonical, digest-free per-task execution identity document.
  *
@@ -405,6 +412,7 @@ export interface AgentCandidateExecutionPlanMaterialV1 {
         access: {
             kind: "evaluator-mediated";
             grantDigest: Sha256Digest;
+            network: AgentCandidateModelAccessNetwork;
         };
         routes: Array<{
             kind: "primary";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-interface",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "type": "module",
   "license": "MIT",
   "main": "./dist/index.js",