@tangle-network/agent-interface 0.36.0 → 0.38.0

package/dist/agent-improvement-source.d.ts

@@ -2,19 +2,77 @@ import { z } from "zod";
 import type { AgentCandidateJsonValue } from "./agent-candidate.js";
 /** Metadata key that binds a measured improvement to its exact external source. */
 export declare const AGENT_IMPROVEMENT_SOURCE_METADATA_KEY = "agentImprovementSource";
+/** License terms retained with an imported source. */
+export declare const agentSourceLicenseSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"spdx">;
+    expression: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"custom">;
+    name: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
+    reference: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
+    termsDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
+}, z.core.$strict>], "kind">;
+export type AgentSourceLicense = z.infer<typeof agentSourceLicenseSchema>;
+/**
+ * One content transition applied while importing a source.
+ *
+ * `identity` and `revision` pin the transformer. Input/output digests make the
+ * ordered chain auditable without embedding executable transformation code.
+ * `procedureDigest` pins the implementation and non-secret configuration used
+ * for that step.
+ */
+export declare const agentSourceTransformationSchema: z.ZodObject<{
+    kind: z.ZodEnum<{
+        normalization: "normalization";
+        transformation: "transformation";
+    }>;
+    identity: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
+    revision: z.ZodUnion<readonly [z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>, z.ZodNumber]>;
+    procedureDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
+    inputDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
+    outputDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
+}, z.core.$strict>;
+export type AgentSourceTransformation = z.infer<typeof agentSourceTransformationSchema>;
 /**
  * Stable reference for the state from which an improvement candidate was made.
  * `sourceIdentity` identifies the provider object; `sourceDigest` is the exact
- * measured source state; `sourceRevision` is an
+ * measured source state consumed by the candidate; `sourceRevision` is an
  * opaque provider version retained to make stale-source errors intelligible to
  * callers. A revision may be numeric or textual because providers use both
  * counters and immutable revision identifiers.
+ *
+ * Optional license, attribution, and notice fields preserve obligations when a
+ * public source becomes an improvement input. When transformations are
+ * present, their first input pins the fetched source bytes, every adjacent
+ * digest must join, and the final output must equal `sourceDigest`.
  */
 export declare const agentImprovementSourceSchema: z.ZodObject<{
     kind: z.ZodString;
-    sourceIdentity: z.ZodString;
+    sourceIdentity: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
     sourceDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
-    sourceRevision: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+    sourceRevision: z.ZodUnion<readonly [z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>, z.ZodNumber]>;
+    license: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"spdx">;
+        expression: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"custom">;
+        name: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
+        reference: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
+        termsDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
+    }, z.core.$strict>], "kind">>;
+    attribution: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    notices: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    transformations: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            normalization: "normalization";
+            transformation: "transformation";
+        }>;
+        identity: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
+        revision: z.ZodUnion<readonly [z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>, z.ZodNumber]>;
+        procedureDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
+        inputDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
+        outputDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
+    }, z.core.$strict>>>;
 }, z.core.$strict>;
 export type AgentImprovementSource = z.infer<typeof agentImprovementSourceSchema>;
 /** Attach one validated source reference to signed improvement metadata. */

package/dist/agent-improvement-source.js

@@ -1,26 +1,140 @@
+import parseSpdxExpression from "spdx-expression-parse";
 import { z } from "zod";
-import { sha256DigestSchema } from "./agent-candidate-schema-common.js";
+import { isWellFormedUnicode, looksLikeCredential, sha256DigestSchema, } from "./agent-candidate-schema-common.js";
 /** Metadata key that binds a measured improvement to its exact external source. */
 export const AGENT_IMPROVEMENT_SOURCE_METADATA_KEY = "agentImprovementSource";
+function publicSourceTextSchema(maxLength, label) {
+    return z
+        .string()
+        .max(maxLength)
+        .refine(isWellFormedUnicode, `${label} must be well-formed Unicode`)
+        .refine((value) => !looksLikeCredential(value), `${label} cannot carry credentials`);
+}
+const sourceIdentitySchema = publicSourceTextSchema(256, "source identity")
+    .transform((value) => value.trim())
+    .pipe(z.string().min(1, "source identity cannot be blank"));
+const sourceRevisionSchema = z.union([
+    publicSourceTextSchema(256, "source revision")
+        .transform((value) => value.trim())
+        .pipe(z.string().min(1, "source revision cannot be blank")),
+    z.number().int().nonnegative(),
+]);
+const sourceStatementSchema = publicSourceTextSchema(16_384, "source statement").refine((value) => value.trim().length > 0, "statement cannot be blank");
+const sourceStatementListSchema = z
+    .array(sourceStatementSchema)
+    .min(1)
+    .max(128)
+    .refine((values) => new Set(values).size === values.length, "statements must be unique");
+function containsCustomLicenseReference(expression) {
+    if ("license" in expression) {
+        return (expression.license.startsWith("LicenseRef-") ||
+            expression.license.includes(":LicenseRef-"));
+    }
+    return (containsCustomLicenseReference(expression.left) ||
+        containsCustomLicenseReference(expression.right));
+}
+/** License terms retained with an imported source. */
+export const agentSourceLicenseSchema = z.discriminatedUnion("kind", [
+    z
+        .object({
+        kind: z.literal("spdx"),
+        expression: z
+            .string()
+            .trim()
+            .min(1)
+            .max(1_024)
+            .refine((expression) => {
+            try {
+                return !containsCustomLicenseReference(parseSpdxExpression(expression));
+            }
+            catch {
+                return false;
+            }
+        }, "license expression must use standard SPDX identifiers; content-pin custom terms with kind=custom"),
+    })
+        .strict(),
+    z
+        .object({
+        kind: z.literal("custom"),
+        name: sourceIdentitySchema,
+        /** URL or repository-relative path from which the exact terms can be recovered. */
+        reference: publicSourceTextSchema(2_048, "license reference")
+            .transform((value) => value.trim())
+            .pipe(z.string().min(1, "license reference cannot be blank")),
+        /** Digest of the custom license text, not of its URL or file name. */
+        termsDigest: sha256DigestSchema,
+    })
+        .strict(),
+]);
+/**
+ * One content transition applied while importing a source.
+ *
+ * `identity` and `revision` pin the transformer. Input/output digests make the
+ * ordered chain auditable without embedding executable transformation code.
+ * `procedureDigest` pins the implementation and non-secret configuration used
+ * for that step.
+ */
+export const agentSourceTransformationSchema = z
+    .object({
+    kind: z.enum(["normalization", "transformation"]),
+    identity: sourceIdentitySchema,
+    revision: sourceRevisionSchema,
+    procedureDigest: sha256DigestSchema,
+    inputDigest: sha256DigestSchema,
+    outputDigest: sha256DigestSchema,
+})
+    .strict();
 /**
  * Stable reference for the state from which an improvement candidate was made.
  * `sourceIdentity` identifies the provider object; `sourceDigest` is the exact
- * measured source state; `sourceRevision` is an
+ * measured source state consumed by the candidate; `sourceRevision` is an
  * opaque provider version retained to make stale-source errors intelligible to
  * callers. A revision may be numeric or textual because providers use both
  * counters and immutable revision identifiers.
+ *
+ * Optional license, attribution, and notice fields preserve obligations when a
+ * public source becomes an improvement input. When transformations are
+ * present, their first input pins the fetched source bytes, every adjacent
+ * digest must join, and the final output must equal `sourceDigest`.
  */
 export const agentImprovementSourceSchema = z
     .object({
     kind: z.string().trim().min(1).max(100).regex(/^[a-z][a-z0-9-]*$/),
-    sourceIdentity: z.string().trim().min(1).max(256),
+    sourceIdentity: sourceIdentitySchema,
     sourceDigest: sha256DigestSchema,
-    sourceRevision: z.union([
-        z.string().trim().min(1).max(256),
-        z.number().int().nonnegative(),
-    ]),
+    sourceRevision: sourceRevisionSchema,
+    license: agentSourceLicenseSchema.optional(),
+    attribution: sourceStatementListSchema.optional(),
+    notices: sourceStatementListSchema.optional(),
+    transformations: z
+        .array(agentSourceTransformationSchema)
+        .min(1)
+        .max(128)
+        .optional(),
 })
-    .strict();
+    .strict()
+    .superRefine((source, ctx) => {
+    const transformations = source.transformations;
+    if (transformations === undefined)
+        return;
+    for (let index = 1; index < transformations.length; index++) {
+        if (transformations[index]?.inputDigest !==
+            transformations[index - 1]?.outputDigest) {
+            ctx.addIssue({
+                code: "custom",
+                path: ["transformations", index, "inputDigest"],
+                message: "transformation input must equal the previous output",
+            });
+        }
+    }
+    if (transformations.at(-1)?.outputDigest !== source.sourceDigest) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["sourceDigest"],
+            message: "source digest must equal the final transformation output",
+        });
+    }
+});
 /** Attach one validated source reference to signed improvement metadata. */
 export function agentImprovementSourceMetadata(source) {
     return {

package/dist/agent-profile-activation.d.ts

@@ -0,0 +1,41 @@
+import { z } from "zod";
+import type { Sha256Digest } from "./agent-candidate.js";
+/** One exact native file applied before an agent process starts. */
+export interface AgentProfileActivationFileEvidence {
+    path: string;
+    mode: number;
+    content: string;
+}
+/**
+ * Shared evidence carried by every exact profile activation.
+ *
+ * The plan type remains owned by the producer because ordinary agent runs and
+ * sealed benchmark runs have different plan contracts. The applied file bytes
+ * and activation identity are shared so those producers cannot invent
+ * competing activation evidence.
+ */
+export interface AgentProfileActivationEvidence<TProfilePlan = unknown> {
+    profilePlan: TProfilePlan;
+    files: AgentProfileActivationFileEvidence[];
+    digest: Sha256Digest;
+}
+/** Runtime validator for one exact native profile file. */
+export declare const agentProfileActivationFileEvidenceSchema: z.ZodObject<{
+    path: z.ZodString;
+    mode: z.ZodNumber;
+    content: z.ZodString;
+}, z.core.$strict>;
+/**
+ * Compose the shared activation evidence with a producer-owned exact plan.
+ * Candidate materialization uses this factory and adds its stronger plan/file
+ * consistency checks around the resulting schema.
+ */
+export declare function createAgentProfileActivationEvidenceSchema<TProfilePlan>(profilePlanSchema: z.ZodType<TProfilePlan>): z.ZodObject<{
+    profilePlan: z.ZodType<TProfilePlan, unknown, z.core.$ZodTypeInternals<TProfilePlan, unknown>>;
+    files: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        mode: z.ZodNumber;
+        content: z.ZodString;
+    }, z.core.$strict>>;
+    digest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
+}, z.core.$strict>;

package/dist/agent-profile-activation.js

@@ -0,0 +1,24 @@
+import { z } from "zod";
+import { isSafeRelativePath, isWellFormedUnicode, sha256DigestSchema, } from "./agent-candidate-schema-common.js";
+/** Runtime validator for one exact native profile file. */
+export const agentProfileActivationFileEvidenceSchema = z.strictObject({
+    path: z
+        .string()
+        .refine((value) => isSafeRelativePath(value, false), "profile activation file must use a canonical relative path"),
+    mode: z.number().int().min(0).max(0o777),
+    content: z
+        .string()
+        .refine(isWellFormedUnicode, "profile activation content must be valid Unicode"),
+});
+/**
+ * Compose the shared activation evidence with a producer-owned exact plan.
+ * Candidate materialization uses this factory and adds its stronger plan/file
+ * consistency checks around the resulting schema.
+ */
+export function createAgentProfileActivationEvidenceSchema(profilePlanSchema) {
+    return z.strictObject({
+        profilePlan: profilePlanSchema,
+        files: z.array(agentProfileActivationFileEvidenceSchema),
+        digest: sha256DigestSchema,
+    });
+}

package/dist/agent-profile-improvement-schema.d.ts

@@ -195,9 +195,31 @@ export declare const agentProfileImprovementExperimentSchema: z.ZodObject<{
     digestAlgorithm: z.ZodLiteral<"rfc8785-sha256">;
     source: z.ZodObject<{
         kind: z.ZodString;
-        sourceIdentity: z.ZodString;
+        sourceIdentity: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
         sourceDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
-        sourceRevision: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+        sourceRevision: z.ZodUnion<readonly [z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>, z.ZodNumber]>;
+        license: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"spdx">;
+            expression: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"custom">;
+            name: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
+            reference: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
+            termsDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
+        }, z.core.$strict>], "kind">>;
+        attribution: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        notices: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        transformations: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            kind: z.ZodEnum<{
+                normalization: "normalization";
+                transformation: "transformation";
+            }>;
+            identity: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
+            revision: z.ZodUnion<readonly [z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>, z.ZodNumber]>;
+            procedureDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
+            inputDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
+            outputDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
+        }, z.core.$strict>>>;
     }, z.core.$strict>;
     executionRef: z.ZodObject<{
         identity: z.ZodString;
@@ -702,9 +724,31 @@ export declare const agentProfileImprovementMeasuredComparisonSchema: z.ZodObjec
         digestAlgorithm: z.ZodLiteral<"rfc8785-sha256">;
         source: z.ZodObject<{
             kind: z.ZodString;
-            sourceIdentity: z.ZodString;
+            sourceIdentity: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
             sourceDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
-            sourceRevision: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+            sourceRevision: z.ZodUnion<readonly [z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>, z.ZodNumber]>;
+            license: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"spdx">;
+                expression: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"custom">;
+                name: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
+                reference: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
+                termsDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
+            }, z.core.$strict>], "kind">>;
+            attribution: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            notices: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            transformations: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                kind: z.ZodEnum<{
+                    normalization: "normalization";
+                    transformation: "transformation";
+                }>;
+                identity: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
+                revision: z.ZodUnion<readonly [z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>, z.ZodNumber]>;
+                procedureDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
+                inputDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
+                outputDigest: z.ZodType<`sha256:${string}`, unknown, z.core.$ZodTypeInternals<`sha256:${string}`, unknown>>;
+            }, z.core.$strict>>>;
         }, z.core.$strict>;
         executionRef: z.ZodObject<{
             identity: z.ZodString;

package/dist/agent-profile-materialization.d.ts

@@ -0,0 +1,34 @@
+import type { AgentProfile } from "./agent-profile.js";
+/**
+ * The 29 canonical AgentProfile leaves that can affect one execution.
+ *
+ * Compound parents such as `model`, `prompt`, and `resources` are deliberately
+ * absent. A producer must report the exact requested leaf instead of claiming
+ * a parent while silently dropping one of its children.
+ */
+export declare const AGENT_PROFILE_MATERIALIZATION_AXES: readonly ["name", "description", "version", "tags", "systemPrompt", "instructions", "modelDefault", "modelSmall", "modelProvider", "modelReasoningEffort", "modelMetadata", "harness", "permissions", "tools", "mcp", "connections", "subagents", "files", "resourceTools", "skills", "resourceAgents", "commands", "resourceInstructions", "resourceFailOnError", "hooks", "modes", "confidential", "metadata", "extensions"];
+/** One exact leaf of the public AgentProfile contract. */
+export type AgentProfileMaterializationAxis = (typeof AGENT_PROFILE_MATERIALIZATION_AXES)[number];
+/** Compatibility name used by runtimes that distinguish canonical axes. */
+export type CanonicalAgentProfileMaterializationAxis = AgentProfileMaterializationAxis;
+/** One requested profile leaf and its canonical RFC 6901 JSON Pointer. */
+export interface AgentProfileMaterializationRequest {
+    axis: AgentProfileMaterializationAxis;
+    path: string;
+}
+/**
+ * Return every canonical profile leaf that contains a meaningful request.
+ * Every explicit value is a request, including empty strings, empty
+ * collections, `null`, `false`, and `0`. Only an absent/undefined leaf is
+ * omitted.
+ */
+export declare function profileMaterializationAxes(profile: AgentProfile): readonly AgentProfileMaterializationAxis[];
+/**
+ * Expand requested axes into exact JSON Pointer paths.
+ *
+ * Compound maps and arrays produce one row per explicit scalar leaf. An empty
+ * compound value produces its axis-root path. This prevents an executor from
+ * acknowledging one tool, server, resource, or instruction while claiming the
+ * whole axis, without losing an explicit request to clear that axis.
+ */
+export declare function profileMaterializationRequests(profile: AgentProfile): readonly AgentProfileMaterializationRequest[];

package/dist/agent-profile-materialization.js

@@ -0,0 +1,243 @@
+/**
+ * The 29 canonical AgentProfile leaves that can affect one execution.
+ *
+ * Compound parents such as `model`, `prompt`, and `resources` are deliberately
+ * absent. A producer must report the exact requested leaf instead of claiming
+ * a parent while silently dropping one of its children.
+ */
+export const AGENT_PROFILE_MATERIALIZATION_AXES = [
+    "name",
+    "description",
+    "version",
+    "tags",
+    "systemPrompt",
+    "instructions",
+    "modelDefault",
+    "modelSmall",
+    "modelProvider",
+    "modelReasoningEffort",
+    "modelMetadata",
+    "harness",
+    "permissions",
+    "tools",
+    "mcp",
+    "connections",
+    "subagents",
+    "files",
+    "resourceTools",
+    "skills",
+    "resourceAgents",
+    "commands",
+    "resourceInstructions",
+    "resourceFailOnError",
+    "hooks",
+    "modes",
+    "confidential",
+    "metadata",
+    "extensions",
+];
+const profileProperties = [
+    "prompt",
+    "model",
+    "harness",
+    "permissions",
+    "tools",
+    "mcp",
+    "connections",
+    "subagents",
+    "resources",
+    "hooks",
+    "modes",
+    "confidential",
+    "metadata",
+    "extensions",
+];
+const profilePropertiesAreExhaustive = true;
+void profilePropertiesAreExhaustive;
+const AXIS_DESCRIPTORS = [
+    { axis: "name", rootPath: "/name", value: (profile) => profile.name },
+    {
+        axis: "description",
+        rootPath: "/description",
+        value: (profile) => profile.description,
+    },
+    { axis: "version", rootPath: "/version", value: (profile) => profile.version },
+    { axis: "tags", rootPath: "/tags", value: (profile) => profile.tags },
+    {
+        axis: "systemPrompt",
+        rootPath: "/prompt/systemPrompt",
+        value: (profile) => profile.prompt?.systemPrompt,
+    },
+    {
+        axis: "instructions",
+        rootPath: "/prompt/instructions",
+        value: (profile) => profile.prompt?.instructions,
+    },
+    {
+        axis: "modelDefault",
+        rootPath: "/model/default",
+        value: (profile) => profile.model?.default,
+    },
+    {
+        axis: "modelSmall",
+        rootPath: "/model/small",
+        value: (profile) => profile.model?.small,
+    },
+    {
+        axis: "modelProvider",
+        rootPath: "/model/provider",
+        value: (profile) => profile.model?.provider,
+    },
+    {
+        axis: "modelReasoningEffort",
+        rootPath: "/model/reasoningEffort",
+        value: (profile) => profile.model?.reasoningEffort,
+    },
+    {
+        axis: "modelMetadata",
+        rootPath: "/model/metadata",
+        value: (profile) => profile.model?.metadata,
+    },
+    { axis: "harness", rootPath: "/harness", value: (profile) => profile.harness },
+    {
+        axis: "permissions",
+        rootPath: "/permissions",
+        value: (profile) => profile.permissions,
+    },
+    { axis: "tools", rootPath: "/tools", value: (profile) => profile.tools },
+    { axis: "mcp", rootPath: "/mcp", value: (profile) => profile.mcp },
+    {
+        axis: "connections",
+        rootPath: "/connections",
+        value: (profile) => profile.connections,
+    },
+    {
+        axis: "subagents",
+        rootPath: "/subagents",
+        value: (profile) => profile.subagents,
+    },
+    {
+        axis: "files",
+        rootPath: "/resources/files",
+        value: (profile) => profile.resources?.files,
+    },
+    {
+        axis: "resourceTools",
+        rootPath: "/resources/tools",
+        value: (profile) => profile.resources?.tools,
+    },
+    {
+        axis: "skills",
+        rootPath: "/resources/skills",
+        value: (profile) => profile.resources?.skills,
+    },
+    {
+        axis: "resourceAgents",
+        rootPath: "/resources/agents",
+        value: (profile) => profile.resources?.agents,
+    },
+    {
+        axis: "commands",
+        rootPath: "/resources/commands",
+        value: (profile) => profile.resources?.commands,
+    },
+    {
+        axis: "resourceInstructions",
+        rootPath: "/resources/instructions",
+        value: (profile) => profile.resources?.instructions,
+    },
+    {
+        axis: "resourceFailOnError",
+        rootPath: "/resources/failOnError",
+        value: (profile) => profile.resources?.failOnError,
+    },
+    { axis: "hooks", rootPath: "/hooks", value: (profile) => profile.hooks },
+    { axis: "modes", rootPath: "/modes", value: (profile) => profile.modes },
+    {
+        axis: "confidential",
+        rootPath: "/confidential",
+        value: (profile) => profile.confidential,
+    },
+    {
+        axis: "metadata",
+        rootPath: "/metadata",
+        value: (profile) => profile.metadata,
+    },
+    {
+        axis: "extensions",
+        rootPath: "/extensions",
+        value: (profile) => profile.extensions,
+    },
+];
+const axisDescriptorsAreExhaustive = true;
+void axisDescriptorsAreExhaustive;
+/**
+ * Return every canonical profile leaf that contains a meaningful request.
+ * Every explicit value is a request, including empty strings, empty
+ * collections, `null`, `false`, and `0`. Only an absent/undefined leaf is
+ * omitted.
+ */
+export function profileMaterializationAxes(profile) {
+    const axes = [];
+    for (const descriptor of AXIS_DESCRIPTORS) {
+        if (descriptor.value(profile) !== undefined) {
+            axes.push(descriptor.axis);
+        }
+    }
+    return axes;
+}
+/**
+ * Expand requested axes into exact JSON Pointer paths.
+ *
+ * Compound maps and arrays produce one row per explicit scalar leaf. An empty
+ * compound value produces its axis-root path. This prevents an executor from
+ * acknowledging one tool, server, resource, or instruction while claiming the
+ * whole axis, without losing an explicit request to clear that axis.
+ */
+export function profileMaterializationRequests(profile) {
+    const requests = [];
+    for (const descriptor of AXIS_DESCRIPTORS) {
+        const paths = materializationValuePaths(descriptor.value(profile), descriptor.rootPath);
+        for (const path of paths) {
+            requests.push({ axis: descriptor.axis, path });
+        }
+    }
+    return requests;
+}
+function materializationValuePaths(root, rootPath) {
+    const paths = [];
+    visitMaterializationValue(root, rootPath, [], paths);
+    return paths;
+}
+function visitMaterializationValue(value, path, ancestors, paths) {
+    if (value === undefined)
+        return false;
+    if (value === null || typeof value !== "object") {
+        paths.push(path);
+        return true;
+    }
+    if (ancestors.includes(value)) {
+        paths.push(path);
+        return true;
+    }
+    const nextAncestors = [...ancestors, value];
+    const entries = Array.isArray(value)
+        ? Array.from({ length: value.length }, (_, index) => [
+            String(index),
+            Object.prototype.hasOwnProperty.call(value, index)
+                ? value[index]
+                : undefined,
+        ])
+        : Object.entries(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0);
+    let childRequested = false;
+    for (const [key, child] of entries) {
+        childRequested =
+            visitMaterializationValue(child, `${path}/${escapeJsonPointerSegment(key)}`, nextAncestors, paths) || childRequested;
+    }
+    if (!childRequested)
+        paths.push(path);
+    return true;
+}
+function escapeJsonPointerSegment(value) {
+    return value.replace(/~/g, "~0").replace(/\//g, "~1");
+}