@tangle-network/agent-interface 0.35.0 → 0.37.0

package/dist/agent-candidate.d.ts

@@ -1,6 +1,7 @@
 import type { AgentProfile, AgentProfileFileMount, AgentProfileHookCommand, AgentProfileMode, AgentProfileModelHints, AgentProfileResources, AgentSubagentProfile, ReasoningEffort } from "./agent-profile.js";
 import type { HarnessType } from "./harness.js";
-import type { AgentProfileImprovementMeasuredComparison } from "./agent-profile-improvement.js";
+import type { AgentProfileImprovementExecutionRef, AgentProfileImprovementMeasuredComparison } from "./agent-profile-improvement.js";
+import type { AgentImprovementSource } from "./agent-improvement-source.js";
 /** Full SHA-256 digest with an explicit algorithm prefix. */
 export type Sha256Digest = `sha256:${string}`;
 /** RFC 8785 JSON Canonicalization Scheme followed by SHA-256. */
@@ -55,6 +56,8 @@ export interface AgentCandidateInlineResource {
     content: string;
     sha256: Sha256Digest;
     byteLength: number;
+    /** Optional immutable origin, license obligations, and import history. */
+    source?: AgentImprovementSource;
 }
 /** GitHub content pinned to a full Git object id and expected content digest. */
 export interface AgentCandidateGitHubResource {
@@ -65,6 +68,8 @@ export interface AgentCandidateGitHubResource {
     name?: string;
     sha256: Sha256Digest;
     byteLength: number;
+    /** Optional immutable origin, license obligations, and import history. */
+    source?: AgentImprovementSource;
 }
 export type AgentCandidateResourceRef = AgentCandidateInlineResource | AgentCandidateGitHubResource;
 export interface AgentCandidateFileMount extends Omit<AgentProfileFileMount, "resource"> {
@@ -235,6 +240,33 @@ export type AgentCandidateMemoryPolicy = {
     scope: "task";
     seed?: AgentCandidateArtifactRef;
 };
+/** Whether a settled cost came from provider billing or a reproducible estimate. */
+export type AgentCandidateCostProvenance = "observed" | "estimated";
+/** One known dollar amount carried with its source. */
+export interface AgentImprovementCost {
+    usd: number;
+    provenance: AgentCandidateCostProvenance;
+}
+/** Complete accounting for a measured improvement proposal. */
+export interface AgentImprovementEvaluationAccounting {
+    generationsExplored: number;
+    /** Trace analysis and candidate search before held-out execution. */
+    preparation: {
+        wallDurationMs: number;
+        cost: AgentImprovementCost;
+    };
+    /** Held-out baseline/candidate execution. Work time sums parallel calls. */
+    measurement: {
+        wallDurationMs: number;
+        workDurationMs: number;
+        cost: AgentImprovementCost;
+    };
+    /** Wall time is preparation plus held-out measurement. */
+    total: {
+        wallDurationMs: number;
+        cost: AgentImprovementCost;
+    };
+}
 /** Lossless evaluator-owned usage totals for one candidate execution. */
 export interface AgentCandidateFixedSpend {
     inputTokens: number;
@@ -244,6 +276,7 @@ export interface AgentCandidateFixedSpend {
     modelCalls: number;
     /** Integer billionths of one US dollar. */
     costUsdNanos: number;
+    costProvenance: AgentCandidateCostProvenance;
 }
 /** Evidence and ancestry that produced the immutable candidate. */
 export interface AgentCandidateLineage {
@@ -350,13 +383,14 @@ export type AgentCandidateEffectiveMemory = {
     beforeState: AgentCandidateWorkspaceSnapshotEvidence;
     seedDigest?: Sha256Digest;
 };
-/** The exact evaluator-owned limits applied to every candidate arm. */
+/** The exact evaluator-owned limits applied to every complete candidate arm. */
 export interface AgentCandidateExecutionLimits {
     timeoutMs: number;
     maxSteps: number;
     maxModelCalls: number;
     maxInputTokens: number;
     maxOutputTokens: number;
+    /** Total agent plus grading spend for one complete arm. */
     maxCostUsd: number;
 }
 /** Counted attempt identity and the only retry class allowed by the evaluator. */
@@ -765,15 +799,7 @@ export interface AgentImprovementMeasuredComparisonBase<TExperiment, TMeasuremen
         candidateContentHash: string;
     };
     diff: string;
-    evaluation: {
-        generationsExplored: number;
-        searchDurationMs: number;
-        executionDurationMs: number;
-        durationMs: number;
-        searchCostUsd: number;
-        executionCostUsd: number;
-        totalCostUsd: number;
-    };
+    evaluation: AgentImprovementEvaluationAccounting;
     metadata?: {
         [key: string]: AgentCandidateJsonValue;
     };
@@ -822,6 +848,8 @@ export interface AgentImprovementActivation {
     experimentDigest: Sha256Digest;
     /** Exact proposed state, whether it is a sealed bundle or a normal profile. */
     candidateDigest: Sha256Digest;
+    /** Required when a target uses `agent-profile`; the schema enforces this condition. */
+    executionRef?: AgentProfileImprovementExecutionRef;
     intent: AgentImprovementActivationIntent;
     targets: [AgentImprovementActivationTarget, ...AgentImprovementActivationTarget[]];
     fundingOwner: string;
@@ -895,6 +923,7 @@ export interface AgentCandidateModelSettlementCall {
     cachedInputTokens: number;
     reasoningTokens: number;
     costUsdNanos: number;
+    costProvenance: AgentCandidateCostProvenance;
 }
 /** Canonical model-access ledger after the evaluator has revoked access. */
 export interface AgentCandidateModelSettlementMaterial {

package/dist/agent-execution-limits.d.ts

@@ -16,6 +16,10 @@ export declare const agentExecutionLimitObservationSchema: z.ZodObject<{
         reasoningTokens: z.ZodNumber;
         modelCalls: z.ZodNumber;
         costUsdNanos: z.ZodNumber;
+        costProvenance: z.ZodEnum<{
+            observed: "observed";
+            estimated: "estimated";
+        }>;
     }, z.core.$strict>;
 }, z.core.$strict>;
 export interface RefineAgentExecutionWithinLimitsOptions {

package/dist/agent-improvement-measurement-schema.d.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import type { AgentCandidateEvaluationPolicy, AgentCandidateJsonValue, AgentImprovementMeasuredComparisonBase } from "./agent-candidate.js";
+import type { AgentCandidateCostProvenance, AgentCandidateEvaluationPolicy, AgentCandidateJsonValue, AgentImprovementMeasuredComparisonBase } from "./agent-candidate.js";
 export declare const canonicalJsonSchema: z.ZodCustom<AgentCandidateJsonValue, AgentCandidateJsonValue>;
 export declare const canonicalJsonObjectSchema: z.ZodRecord<z.ZodString, z.ZodCustom<AgentCandidateJsonValue, AgentCandidateJsonValue>>;
 export declare const agentCandidateEvaluationPolicySchema: z.ZodObject<{
@@ -12,6 +12,13 @@ export declare const agentCandidateEvaluationPolicySchema: z.ZodObject<{
     criticalDimensions: z.ZodArray<z.ZodString>;
     regressionTolerance: z.ZodNumber;
 }, z.core.$strict>;
+export declare const agentImprovementCostSchema: z.ZodObject<{
+    usd: z.ZodNumber;
+    provenance: z.ZodEnum<{
+        observed: "observed";
+        estimated: "estimated";
+    }>;
+}, z.core.$strict>;
 export declare const measuredComparisonCommonShape: {
     overall: z.ZodObject<{
         direction: z.ZodLiteral<"higher-is-better">;
@@ -157,12 +164,37 @@ export declare const measuredComparisonCommonShape: {
     diff: z.ZodString;
     evaluation: z.ZodObject<{
         generationsExplored: z.ZodNumber;
-        searchDurationMs: z.ZodNumber;
-        executionDurationMs: z.ZodNumber;
-        durationMs: z.ZodNumber;
-        searchCostUsd: z.ZodNumber;
-        executionCostUsd: z.ZodNumber;
-        totalCostUsd: z.ZodNumber;
+        preparation: z.ZodObject<{
+            wallDurationMs: z.ZodNumber;
+            cost: z.ZodObject<{
+                usd: z.ZodNumber;
+                provenance: z.ZodEnum<{
+                    observed: "observed";
+                    estimated: "estimated";
+                }>;
+            }, z.core.$strict>;
+        }, z.core.$strict>;
+        measurement: z.ZodObject<{
+            wallDurationMs: z.ZodNumber;
+            workDurationMs: z.ZodNumber;
+            cost: z.ZodObject<{
+                usd: z.ZodNumber;
+                provenance: z.ZodEnum<{
+                    observed: "observed";
+                    estimated: "estimated";
+                }>;
+            }, z.core.$strict>;
+        }, z.core.$strict>;
+        total: z.ZodObject<{
+            wallDurationMs: z.ZodNumber;
+            cost: z.ZodObject<{
+                usd: z.ZodNumber;
+                provenance: z.ZodEnum<{
+                    observed: "observed";
+                    estimated: "estimated";
+                }>;
+            }, z.core.$strict>;
+        }, z.core.$strict>;
     }, z.core.$strict>;
     metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodCustom<AgentCandidateJsonValue, AgentCandidateJsonValue>>>;
 };
@@ -184,6 +216,7 @@ export declare function refineMeasuredComparisonSummary<TReceipt>(comparison: Me
     score(receipt: TReceipt): number;
     dimension(receipt: TReceipt, name: string): number | undefined;
     cost(receipt: TReceipt): number;
+    costProvenance(receipt: TReceipt): AgentCandidateCostProvenance;
     latency(receipt: TReceipt): number;
 }, ctx: z.RefinementCtx): void;
 export declare function refineEstimate(estimate: {

package/dist/agent-improvement-measurement-schema.js

@@ -95,6 +95,36 @@ export const agentCandidateEvaluationPolicySchema = z
         });
     }
 });
+export const agentImprovementCostSchema = z
+    .object({
+    usd: z.number().finite().nonnegative(),
+    provenance: z.enum(["observed", "estimated"]),
+})
+    .strict();
+const agentImprovementEvaluationSchema = z
+    .object({
+    generationsExplored: z.number().int().nonnegative(),
+    preparation: z
+        .object({
+        wallDurationMs: z.number().finite().nonnegative(),
+        cost: agentImprovementCostSchema,
+    })
+        .strict(),
+    measurement: z
+        .object({
+        wallDurationMs: z.number().finite().nonnegative(),
+        workDurationMs: z.number().finite().nonnegative(),
+        cost: agentImprovementCostSchema,
+    })
+        .strict(),
+    total: z
+        .object({
+        wallDurationMs: z.number().finite().nonnegative(),
+        cost: agentImprovementCostSchema,
+    })
+        .strict(),
+})
+    .strict();
 export const measuredComparisonCommonShape = {
     overall: z
         .object({
@@ -148,17 +178,7 @@ export const measuredComparisonCommonShape = {
     })
         .strict(),
     diff: z.string(),
-    evaluation: z
-        .object({
-        generationsExplored: z.number().int().nonnegative(),
-        searchDurationMs: z.number().finite().nonnegative(),
-        executionDurationMs: z.number().finite().nonnegative(),
-        durationMs: z.number().finite().nonnegative(),
-        searchCostUsd: z.number().finite().nonnegative(),
-        executionCostUsd: z.number().finite().nonnegative(),
-        totalCostUsd: z.number().finite().nonnegative(),
-    })
-        .strict(),
+    evaluation: agentImprovementEvaluationSchema,
     metadata: canonicalJsonObjectSchema.optional(),
 };
 /** Keep receipt identity reuse rules identical across measured source formats. */
@@ -181,12 +201,18 @@ export function createMeasuredComparisonIdentityRegistry(options) {
 }
 export function refineMeasuredComparisonSummary(comparison, policy, expectedN, measurements, values, ctx) {
     refineEstimate(comparison.overall, ["overall"], ctx);
-    if (!numbersApproximatelyEqual(comparison.evaluation.durationMs, comparison.evaluation.searchDurationMs + comparison.evaluation.executionDurationMs) ||
-        !numbersApproximatelyEqual(comparison.evaluation.totalCostUsd, comparison.evaluation.searchCostUsd + comparison.evaluation.executionCostUsd)) {
+    const totalCostProvenance = comparison.evaluation.preparation.cost.provenance === "observed" &&
+        comparison.evaluation.measurement.cost.provenance === "observed"
+        ? "observed"
+        : "estimated";
+    if (!numbersApproximatelyEqual(comparison.evaluation.total.wallDurationMs, comparison.evaluation.preparation.wallDurationMs +
+        comparison.evaluation.measurement.wallDurationMs) ||
+        !numbersApproximatelyEqual(comparison.evaluation.total.cost.usd, comparison.evaluation.preparation.cost.usd + comparison.evaluation.measurement.cost.usd) ||
+        comparison.evaluation.total.cost.provenance !== totalCostProvenance) {
         ctx.addIssue({
             code: "custom",
             path: ["evaluation"],
-            message: "evaluation totals must equal their search and execution components",
+            message: "evaluation totals must equal preparation and measurement accounting",
         });
     }
     if (comparison.overall.n !== expectedN) {
@@ -265,6 +291,21 @@ export function refineMeasuredComparisonSummary(comparison, policy, expectedN, m
             latencyCount += 1;
         }
     }
+    const measurementCostUsd = measurements.reduce((sum, measurement) => sum + values.cost(measurement.baseline) + values.cost(measurement.candidate), 0);
+    const measurementWorkDurationMs = measurements.reduce((sum, measurement) => sum + values.latency(measurement.baseline) + values.latency(measurement.candidate), 0);
+    const measurementCostProvenance = measurements.every((measurement) => values.costProvenance(measurement.baseline) === "observed" &&
+        values.costProvenance(measurement.candidate) === "observed")
+        ? "observed"
+        : "estimated";
+    if (!numbersApproximatelyEqual(comparison.evaluation.measurement.cost.usd, measurementCostUsd) ||
+        comparison.evaluation.measurement.cost.provenance !== measurementCostProvenance ||
+        !numbersApproximatelyEqual(comparison.evaluation.measurement.workDurationMs, measurementWorkDurationMs)) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["evaluation", "measurement"],
+            message: "measurement accounting must equal the complete signed receipts",
+        });
+    }
     if (costCount !== 1 || latencyCount !== 1) {
         ctx.addIssue({
             code: "custom",

package/dist/agent-improvement-source.d.ts

@@ -2,19 +2,77 @@ import { z } from "zod";
 import type { AgentCandidateJsonValue } from "./agent-candidate.js";
 /** Metadata key that binds a measured improvement to its exact external source. */
 export declare const AGENT_IMPROVEMENT_SOURCE_METADATA_KEY = "agentImprovementSource";
+/** License terms retained with an imported source. */
+export declare const agentSourceLicenseSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"spdx">;
+    expression: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"custom">;
+    name: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
+    reference: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
+    termsDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
+}, z.core.$strict>], "kind">;
+export type AgentSourceLicense = z.infer<typeof agentSourceLicenseSchema>;
+/**
+ * One content transition applied while importing a source.
+ *
+ * `identity` and `revision` pin the transformer. Input/output digests make the
+ * ordered chain auditable without embedding executable transformation code.
+ * `procedureDigest` pins the implementation and non-secret configuration used
+ * for that step.
+ */
+export declare const agentSourceTransformationSchema: z.ZodObject<{
+    kind: z.ZodEnum<{
+        normalization: "normalization";
+        transformation: "transformation";
+    }>;
+    identity: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
+    revision: z.ZodUnion<readonly [z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>, z.ZodNumber]>;
+    procedureDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
+    inputDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
+    outputDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
+}, z.core.$strict>;
+export type AgentSourceTransformation = z.infer<typeof agentSourceTransformationSchema>;
 /**
  * Stable reference for the state from which an improvement candidate was made.
  * `sourceIdentity` identifies the provider object; `sourceDigest` is the exact
- * measured source state; `sourceRevision` is an
+ * measured source state consumed by the candidate; `sourceRevision` is an
  * opaque provider version retained to make stale-source errors intelligible to
  * callers. A revision may be numeric or textual because providers use both
  * counters and immutable revision identifiers.
+ *
+ * Optional license, attribution, and notice fields preserve obligations when a
+ * public source becomes an improvement input. When transformations are
+ * present, their first input pins the fetched source bytes, every adjacent
+ * digest must join, and the final output must equal `sourceDigest`.
  */
 export declare const agentImprovementSourceSchema: z.ZodObject<{
     kind: z.ZodString;
-    sourceIdentity: z.ZodString;
+    sourceIdentity: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
     sourceDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
-    sourceRevision: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+    sourceRevision: z.ZodUnion<readonly [z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>, z.ZodNumber]>;
+    license: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"spdx">;
+        expression: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"custom">;
+        name: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
+        reference: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
+        termsDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
+    }, z.core.$strict>], "kind">>;
+    attribution: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    notices: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    transformations: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            normalization: "normalization";
+            transformation: "transformation";
+        }>;
+        identity: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
+        revision: z.ZodUnion<readonly [z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>, z.ZodNumber]>;
+        procedureDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
+        inputDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
+        outputDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
+    }, z.core.$strict>>>;
 }, z.core.$strict>;
 export type AgentImprovementSource = z.infer<typeof agentImprovementSourceSchema>;
 /** Attach one validated source reference to signed improvement metadata. */

package/dist/agent-improvement-source.js

@@ -1,26 +1,140 @@
+import parseSpdxExpression from "spdx-expression-parse";
 import { z } from "zod";
-import { sha256DigestSchema } from "./agent-candidate-schema-common.js";
+import { isWellFormedUnicode, looksLikeCredential, sha256DigestSchema, } from "./agent-candidate-schema-common.js";
 /** Metadata key that binds a measured improvement to its exact external source. */
 export const AGENT_IMPROVEMENT_SOURCE_METADATA_KEY = "agentImprovementSource";
+function publicSourceTextSchema(maxLength, label) {
+    return z
+        .string()
+        .max(maxLength)
+        .refine(isWellFormedUnicode, `${label} must be well-formed Unicode`)
+        .refine((value) => !looksLikeCredential(value), `${label} cannot carry credentials`);
+}
+const sourceIdentitySchema = publicSourceTextSchema(256, "source identity")
+    .transform((value) => value.trim())
+    .pipe(z.string().min(1, "source identity cannot be blank"));
+const sourceRevisionSchema = z.union([
+    publicSourceTextSchema(256, "source revision")
+        .transform((value) => value.trim())
+        .pipe(z.string().min(1, "source revision cannot be blank")),
+    z.number().int().nonnegative(),
+]);
+const sourceStatementSchema = publicSourceTextSchema(16_384, "source statement").refine((value) => value.trim().length > 0, "statement cannot be blank");
+const sourceStatementListSchema = z
+    .array(sourceStatementSchema)
+    .min(1)
+    .max(128)
+    .refine((values) => new Set(values).size === values.length, "statements must be unique");
+function containsCustomLicenseReference(expression) {
+    if ("license" in expression) {
+        return (expression.license.startsWith("LicenseRef-") ||
+            expression.license.includes(":LicenseRef-"));
+    }
+    return (containsCustomLicenseReference(expression.left) ||
+        containsCustomLicenseReference(expression.right));
+}
+/** License terms retained with an imported source. */
+export const agentSourceLicenseSchema = z.discriminatedUnion("kind", [
+    z
+        .object({
+        kind: z.literal("spdx"),
+        expression: z
+            .string()
+            .trim()
+            .min(1)
+            .max(1_024)
+            .refine((expression) => {
+            try {
+                return !containsCustomLicenseReference(parseSpdxExpression(expression));
+            }
+            catch {
+                return false;
+            }
+        }, "license expression must use standard SPDX identifiers; content-pin custom terms with kind=custom"),
+    })
+        .strict(),
+    z
+        .object({
+        kind: z.literal("custom"),
+        name: sourceIdentitySchema,
+        /** URL or repository-relative path from which the exact terms can be recovered. */
+        reference: publicSourceTextSchema(2_048, "license reference")
+            .transform((value) => value.trim())
+            .pipe(z.string().min(1, "license reference cannot be blank")),
+        /** Digest of the custom license text, not of its URL or file name. */
+        termsDigest: sha256DigestSchema,
+    })
+        .strict(),
+]);
+/**
+ * One content transition applied while importing a source.
+ *
+ * `identity` and `revision` pin the transformer. Input/output digests make the
+ * ordered chain auditable without embedding executable transformation code.
+ * `procedureDigest` pins the implementation and non-secret configuration used
+ * for that step.
+ */
+export const agentSourceTransformationSchema = z
+    .object({
+    kind: z.enum(["normalization", "transformation"]),
+    identity: sourceIdentitySchema,
+    revision: sourceRevisionSchema,
+    procedureDigest: sha256DigestSchema,
+    inputDigest: sha256DigestSchema,
+    outputDigest: sha256DigestSchema,
+})
+    .strict();
 /**
  * Stable reference for the state from which an improvement candidate was made.
  * `sourceIdentity` identifies the provider object; `sourceDigest` is the exact
- * measured source state; `sourceRevision` is an
+ * measured source state consumed by the candidate; `sourceRevision` is an
  * opaque provider version retained to make stale-source errors intelligible to
  * callers. A revision may be numeric or textual because providers use both
  * counters and immutable revision identifiers.
+ *
+ * Optional license, attribution, and notice fields preserve obligations when a
+ * public source becomes an improvement input. When transformations are
+ * present, their first input pins the fetched source bytes, every adjacent
+ * digest must join, and the final output must equal `sourceDigest`.
  */
 export const agentImprovementSourceSchema = z
     .object({
     kind: z.string().trim().min(1).max(100).regex(/^[a-z][a-z0-9-]*$/),
-    sourceIdentity: z.string().trim().min(1).max(256),
+    sourceIdentity: sourceIdentitySchema,
     sourceDigest: sha256DigestSchema,
-    sourceRevision: z.union([
-        z.string().trim().min(1).max(256),
-        z.number().int().nonnegative(),
-    ]),
+    sourceRevision: sourceRevisionSchema,
+    license: agentSourceLicenseSchema.optional(),
+    attribution: sourceStatementListSchema.optional(),
+    notices: sourceStatementListSchema.optional(),
+    transformations: z
+        .array(agentSourceTransformationSchema)
+        .min(1)
+        .max(128)
+        .optional(),
 })
-    .strict();
+    .strict()
+    .superRefine((source, ctx) => {
+    const transformations = source.transformations;
+    if (transformations === undefined)
+        return;
+    for (let index = 1; index < transformations.length; index++) {
+        if (transformations[index]?.inputDigest !==
+            transformations[index - 1]?.outputDigest) {
+            ctx.addIssue({
+                code: "custom",
+                path: ["transformations", index, "inputDigest"],
+                message: "transformation input must equal the previous output",
+            });
+        }
+    }
+    if (transformations.at(-1)?.outputDigest !== source.sourceDigest) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["sourceDigest"],
+            message: "source digest must equal the final transformation output",
+        });
+    }
+});
 /** Attach one validated source reference to signed improvement metadata. */
 export function agentImprovementSourceMetadata(source) {
     return {