@tangle-network/agent-interface 5.9.0 → 5.10.0

package/README.md

@@ -424,3 +424,5 @@ must validate source ownership and active generation bindings for its own runtim
 before admitting a knowledge tool. A profile copied to another owner does not
 confer access. Hosts unable to resolve the saved pins must fail closed rather than
 inline JSON into instructions, substitute a newer generation or silently omit them.
+
+Profile collection admission uses the shared [contract limits](src/contract-limits.ts) before parsing elements or encoding record keys. Training receipts and knowledge references retain their own typed limits in [the profile schema](src/profile-schema.ts). Opaque metadata is admitted and detached by value as bounded portable data; accessors are refused and cross-key object identity is not preserved. Snapshot validation precedes the final detached copy, preserving explicit undefined fields, canonical hashes and nested isolation. The generic serialized-JSON byte bound is not a whole-profile transport limit.

package/dist/agent-profile-canonical.d.ts

@@ -1,4 +1,10 @@
 import type { AgentCandidateJsonValue } from "./agent-candidate.js";
+type ProfilePath = readonly (string | number)[];
+/** Why a value cannot be AgentProfile JSON, with the path of the offending entry. */
+export declare class AgentProfileValueError extends Error {
+    readonly path: ProfilePath;
+    constructor(path: ProfilePath, reason: string);
+}
 /**
  * Normalize profile-shaped data into the canonical JSON domain used for public
  * profile identity. Undefined object entries are omitted; unsupported values,
@@ -8,5 +14,13 @@ import type { AgentCandidateJsonValue } from "./agent-candidate.js";
  * profile-level operations that own validation, identity, or diff semantics.
  */
 export declare function canonicalAgentProfileValue(value: unknown): AgentCandidateJsonValue | undefined;
+/**
+ * Throw the path-specific reason a value refused by the bounded admission walker is
+ * not profile JSON. Reads no accessor and throws at the contract node and depth
+ * bounds, so hostile input stays cheap; returns only when the refusal was a bound
+ * this walker does not model, such as string or entry length.
+ */
+export declare function assertAgentProfileValue(value: unknown, path: ProfilePath): void;
 /** Canonical serialization after applying AgentProfile normalization rules. */
 export declare function canonicalAgentProfileJson(value: unknown): string | undefined;
+export {};

package/dist/agent-profile-canonical.js

@@ -1,4 +1,14 @@
 import { canonicalCandidateJson, isWellFormedUnicode, } from "./agent-candidate-schema-common.js";
+import { CONTRACT_MAX_JSON_DEPTH, CONTRACT_MAX_JSON_NODES } from "./contract-limits.js";
+/** Why a value cannot be AgentProfile JSON, with the path of the offending entry. */
+export class AgentProfileValueError extends Error {
+    path;
+    constructor(path, reason) {
+        super(`AgentProfile ${renderPath(path)} ${reason}`);
+        this.path = path;
+        this.name = "AgentProfileValueError";
+    }
+}
 /**
  * Normalize profile-shaped data into the canonical JSON domain used for public
  * profile identity. Undefined object entries are omitted; unsupported values,
@@ -10,66 +20,57 @@ import { canonicalCandidateJson, isWellFormedUnicode, } from "./agent-candidate-
 export function canonicalAgentProfileValue(value) {
     return normalizeAgentProfileValue(value, [], new Set());
 }
+/**
+ * Throw the path-specific reason a value refused by the bounded admission walker is
+ * not profile JSON. Reads no accessor and throws at the contract node and depth
+ * bounds, so hostile input stays cheap; returns only when the refusal was a bound
+ * this walker does not model, such as string or entry length.
+ */
+export function assertAgentProfileValue(value, path) {
+    normalizeAgentProfileValue(value, path, new Set(), { nodes: CONTRACT_MAX_JSON_NODES, base: path.length });
+}
 /** Canonical serialization after applying AgentProfile normalization rules. */
 export function canonicalAgentProfileJson(value) {
     const normalized = canonicalAgentProfileValue(value);
-    return normalized === undefined
-        ? undefined
-        : canonicalCandidateJson(normalized);
+    return normalized === undefined ? undefined : canonicalCandidateJson(normalized);
 }
-function normalizeAgentProfileValue(value, path, ancestors) {
-    if (value === undefined)
-        return undefined;
-    if (value === null ||
-        typeof value === "boolean" ||
-        typeof value === "string") {
-        return value;
-    }
-    if (typeof value === "number") {
-        if (!Number.isFinite(value)) {
-            throw new Error(`AgentProfile ${renderPath(path)} must be finite`);
-        }
+function normalizeAgentProfileValue(value, path, ancestors, bounds) {
+    const refuse = (reason, at = path) => { throw new AgentProfileValueError(at, reason); };
+    if (bounds && --bounds.nodes < 0)
+        refuse("exceeds the contract node bound");
+    if (value === undefined || value === null || typeof value === "boolean" || typeof value === "string")
         return value;
-    }
-    if (typeof value !== "object") {
-        throw new Error(`AgentProfile ${renderPath(path)} is not JSON serializable`);
-    }
-    if (ancestors.has(value)) {
-        throw new Error(`AgentProfile ${renderPath(path)} must be acyclic`);
-    }
+    if (typeof value === "number")
+        return Number.isFinite(value) ? value : refuse("must be finite");
+    if (typeof value !== "object")
+        return refuse("is not JSON serializable");
+    if (ancestors.has(value))
+        refuse("must be acyclic");
     const prototype = Object.getPrototypeOf(value);
-    if (!Array.isArray(value) &&
-        prototype !== Object.prototype &&
-        prototype !== null) {
-        throw new Error(`AgentProfile ${renderPath(path)} must be a plain JSON object`);
-    }
+    if (!Array.isArray(value) && prototype !== Object.prototype && prototype !== null)
+        refuse("must be a plain JSON object");
+    if (bounds && path.length - bounds.base >= CONTRACT_MAX_JSON_DEPTH)
+        refuse("exceeds the contract depth");
     const nextAncestors = new Set(ancestors).add(value);
-    if (Array.isArray(value)) {
-        return Array.from({ length: value.length }, (_, index) => {
-            if (!Object.prototype.hasOwnProperty.call(value, index)) {
-                throw new Error(`AgentProfile ${renderPath([...path, index])} cannot be a sparse array hole`);
-            }
-            const entry = value[index];
-            const normalized = normalizeAgentProfileValue(entry, [...path, index], nextAncestors);
-            if (normalized === undefined) {
-                throw new Error(`AgentProfile ${renderPath([...path, index])} cannot be undefined`);
-            }
-            return normalized;
-        });
-    }
+    // Entries are read through own data descriptors so refusing a value never runs an accessor.
+    const entry = (key) => {
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (!descriptor)
+            return refuse("cannot be a sparse array hole", [...path, key]);
+        if (!("value" in descriptor))
+            return refuse("must be a data property", [...path, key]);
+        const normalized = normalizeAgentProfileValue(descriptor.value, [...path, key], nextAncestors, bounds);
+        return normalized === undefined && typeof key === "number" ? refuse("cannot be undefined", [...path, key]) : normalized;
+    };
+    if (Array.isArray(value))
+        return Array.from({ length: value.length }, (_, index) => entry(index));
     const material = Object.create(null);
-    for (const [key, entry] of Object.entries(value)) {
-        if (!isWellFormedUnicode(key)) {
-            throw new Error(`AgentProfile ${renderPath(path)} has a record key that is not valid Unicode`);
-        }
-        const normalized = normalizeAgentProfileValue(entry, [...path, key], nextAncestors);
+    for (const key of Object.keys(value)) {
+        if (!isWellFormedUnicode(key))
+            refuse("has a record key that is not valid Unicode");
+        const normalized = entry(key);
         if (normalized !== undefined) {
-            Object.defineProperty(material, key, {
-                value: normalized,
-                enumerable: true,
-                configurable: true,
-                writable: true,
-            });
+            Object.defineProperty(material, key, { value: normalized, enumerable: true, configurable: true, writable: true });
         }
     }
     return material;

package/dist/agent-profile-snapshot.js

@@ -9,7 +9,7 @@ import { agentProfileSchema } from "./profile-schema.js";
  * existing canonical profile JSON domain fail instead of becoming mutable state.
  */
 export function snapshotAgentProfile(value) {
-    const parsed = agentProfileSchema.parse(structuredClone(value));
+    const parsed = structuredClone(agentProfileSchema.parse(value));
     canonicalAgentProfileValue(parsed);
     return deepFreeze(parsed);
 }

package/dist/contract-limits.d.ts

@@ -12,23 +12,16 @@ export declare const CONTRACT_MAX_JSON_NODES = 8192;
 export declare const boundedStringSchema: z.ZodString;
 export declare const confidentialAttestationQuoteSchema: z.ZodString;
 export declare const boundedIdentifierSchema: z.ZodString;
-/**
- * Validate JSON without asking Zod to recursively copy an attacker-sized
- * value. This is intentionally iterative so depth and collection limits are
- * checked before canonical serialization.
- */
+/** Admit ordinary JSON before recursive parsing, copying or hashing. */
 export declare function isBoundedJsonValue(value: unknown): boolean;
-/**
- * Validate provider event and terminal content. Unlike ordinary metadata,
- * content may contain a single large transcript or tool result. It remains
- * finite, plain JSON with the normal structural limits, and its complete JSON
- * representation is capped exactly by UTF-8 bytes.
- */
+/** Event content permits large strings within the exact serialized UTF-8 budget. */
 export declare function isBoundedEventContentJson(value: unknown, { omitUndefinedObjectFields }?: {
     omitUndefinedObjectFields?: boolean;
 }): boolean;
-/** Validate digest input while matching JSON's omission of undefined object fields. */
-export declare function isBoundedJsonMaterial(value: unknown): boolean;
+/** Digest material omits undefined object fields; portable profile values require data properties. */
+export declare function isBoundedJsonMaterial(value: unknown, { dataPropertiesOnly }?: {
+    dataPropertiesOnly?: boolean;
+}): boolean;
 export declare const boundedJsonSchema: z.ZodCustom<unknown, unknown>;
 export declare const boundedJsonRecordSchema: z.ZodCustom<Record<string, unknown>, Record<string, unknown>>;
 /** One provider event payload or terminal response, bounded as serialized UTF-8 JSON. */

package/dist/contract-limits.js

@@ -17,72 +17,9 @@ export const boundedIdentifierSchema = boundedStringSchema
     .min(1)
     .max(CONTRACT_MAX_IDENTIFIER_LENGTH)
     .refine((value) => value.trim() === value, "identifier cannot have outer whitespace");
-/**
- * Validate JSON without asking Zod to recursively copy an attacker-sized
- * value. This is intentionally iterative so depth and collection limits are
- * checked before canonical serialization.
- */
+/** Admit ordinary JSON before recursive parsing, copying or hashing. */
 export function isBoundedJsonValue(value) {
-    const pending = [{ value, depth: 0 }];
-    const ancestors = new Set();
-    let nodes = 0;
-    while (pending.length > 0) {
-        const item = pending.pop();
-        if (!item)
-            continue;
-        nodes += 1;
-        if (nodes > CONTRACT_MAX_JSON_NODES)
-            return false;
-        const current = item.value;
-        if (item.leave) {
-            ancestors.delete(current);
-            continue;
-        }
-        if (current === undefined)
-            return false;
-        if (current === null || typeof current === "boolean")
-            continue;
-        if (typeof current === "string") {
-            if (current.length > CONTRACT_MAX_STRING_LENGTH)
-                return false;
-            continue;
-        }
-        if (typeof current === "number") {
-            if (!Number.isFinite(current))
-                return false;
-            continue;
-        }
-        if (typeof current !== "object" || item.depth >= CONTRACT_MAX_JSON_DEPTH) {
-            return false;
-        }
-        if (ancestors.has(current))
-            return false;
-        ancestors.add(current);
-        pending.push({ value: current, depth: item.depth, leave: true });
-        if (Array.isArray(current)) {
-            if (current.length > CONTRACT_MAX_ARRAY_LENGTH)
-                return false;
-            for (const entry of current) {
-                pending.push({ value: entry, depth: item.depth + 1 });
-            }
-            continue;
-        }
-        const prototype = Object.getPrototypeOf(current);
-        if (prototype !== Object.prototype && prototype !== null)
-            return false;
-        const keys = Object.keys(current);
-        if (keys.length > CONTRACT_MAX_MAP_ENTRIES)
-            return false;
-        for (const key of keys) {
-            if (key.length > CONTRACT_MAX_IDENTIFIER_LENGTH)
-                return false;
-            pending.push({
-                value: current[key],
-                depth: item.depth + 1,
-            });
-        }
-    }
-    return true;
+    return boundedJson(value);
 }
 /** Exact serialized JSON UTF-8 byte count for one string scalar. */
 function serializedJsonStringBytes(value) {
@@ -122,187 +59,104 @@ function serializedJsonStringBytes(value) {
     }
     return bytes;
 }
-/**
- * Validate provider event and terminal content. Unlike ordinary metadata,
- * content may contain a single large transcript or tool result. It remains
- * finite, plain JSON with the normal structural limits, and its complete JSON
- * representation is capped exactly by UTF-8 bytes.
- */
+/** Event content permits large strings within the exact serialized UTF-8 budget. */
 export function isBoundedEventContentJson(value, { omitUndefinedObjectFields = false } = {}) {
+    return boundedJson(value, { content: true, omitUndefinedObjectFields });
+}
+/** Digest material omits undefined object fields; portable profile values require data properties. */
+export function isBoundedJsonMaterial(value, { dataPropertiesOnly = false } = {}) {
+    return boundedJson(value, { material: true, omitUndefinedObjectFields: true, dataPropertiesOnly });
+}
+/** One iterative walker owns structural admission; typed domains keep their own schema limits. */
+function boundedJson(value, options = {}) {
     const pending = [
         { value, depth: 0 },
     ];
     const ancestors = new Set();
     let nodes = 0;
     let bytes = 0;
-    const addBytes = (additional) => {
-        bytes += additional;
-        return bytes <= CONTRACT_MAX_JSON_BYTES;
-    };
-    while (pending.length > 0) {
+    const addBytes = (count) => !options.content || (bytes += count) <= CONTRACT_MAX_JSON_BYTES;
+    while (pending.length) {
         const item = pending.pop();
-        if (!item)
-            continue;
         const current = item.value;
-        if (current === undefined && item.omitUndefined === true)
-            continue;
-        nodes += 1;
-        if (nodes > CONTRACT_MAX_JSON_NODES)
+        if ((!item.leave || !options.material) && ++nodes > CONTRACT_MAX_JSON_NODES)
             return false;
+        if (current === undefined && item.omitUndefined)
+            continue;
         if (item.leave) {
             ancestors.delete(current);
             continue;
         }
-        if (current === null) {
-            if (!addBytes(4))
-                return false;
-            continue;
-        }
-        if (typeof current === "boolean") {
-            if (!addBytes(current ? 4 : 5))
+        if (current === null || typeof current === "boolean") {
+            if (!addBytes(current === null ? 4 : current ? 4 : 5))
                 return false;
             continue;
         }
         if (typeof current === "string") {
-            if (!addBytes(serializedJsonStringBytes(current)))
+            if (options.content ? !addBytes(serializedJsonStringBytes(current)) : current.length > CONTRACT_MAX_STRING_LENGTH)
                 return false;
             continue;
         }
         if (typeof current === "number") {
-            if (!Number.isFinite(current))
-                return false;
-            if (!addBytes(JSON.stringify(current).length))
+            if (!Number.isFinite(current) || !addBytes(JSON.stringify(current).length))
                 return false;
             continue;
         }
-        if (typeof current !== "object" || item.depth >= CONTRACT_MAX_JSON_DEPTH) {
-            return false;
-        }
-        if (ancestors.has(current))
+        if (typeof current !== "object" || item.depth >= CONTRACT_MAX_JSON_DEPTH || ancestors.has(current))
             return false;
         ancestors.add(current);
         pending.push({ value: current, depth: item.depth, leave: true });
-        if (Array.isArray(current)) {
-            if (current.length > CONTRACT_MAX_ARRAY_LENGTH)
-                return false;
-            if (!addBytes(2 + Math.max(current.length - 1, 0)))
-                return false;
-            const prototype = Object.getPrototypeOf(current);
-            if (prototype !== Array.prototype && prototype !== null)
-                return false;
-            const keys = Reflect.ownKeys(current);
-            const entryKeys = keys.filter((key) => key !== "length");
-            if (entryKeys.length !== current.length)
-                return false;
-            if (entryKeys.some((key) => {
-                if (typeof key !== "string" || !/^(?:0|[1-9][0-9]*)$/u.test(key))
-                    return true;
-                const index = Number(key);
-                return !Number.isSafeInteger(index) || index < 0 || index >= current.length || index >= 4_294_967_295;
-            })) {
+        const array = Array.isArray(current);
+        if (array && current.length > CONTRACT_MAX_ARRAY_LENGTH)
+            return false;
+        const prototype = Object.getPrototypeOf(current);
+        if ((!array && prototype !== Object.prototype && prototype !== null) ||
+            (array && options.content && prototype !== Array.prototype && prototype !== null))
+            return false;
+        if (options.content || options.dataPropertiesOnly) {
+            const keys = Reflect.ownKeys(current).filter((key) => !array || key !== "length");
+            if (array ? keys.length !== current.length : keys.length > CONTRACT_MAX_MAP_ENTRIES)
                 return false;
-            }
-            for (const key of entryKeys) {
+            let entries = 0;
+            for (const key of keys) {
+                if (typeof key !== "string" || (!array && key.length > CONTRACT_MAX_IDENTIFIER_LENGTH))
+                    return false;
+                if (array && (!/^(?:0|[1-9][0-9]*)$/u.test(key) || Number(key) >= current.length || Number(key) >= 4_294_967_295))
+                    return false;
                 const descriptor = Object.getOwnPropertyDescriptor(current, key);
-                if (descriptor === undefined || !descriptor.enumerable || !("value" in descriptor))
+                if (!descriptor?.enumerable || !("value" in descriptor))
+                    return false;
+                if (!array && descriptor.value === undefined && options.omitUndefinedObjectFields) {
+                    if (++nodes > CONTRACT_MAX_JSON_NODES)
+                        return false;
+                    continue;
+                }
+                if (++entries > (array ? CONTRACT_MAX_ARRAY_LENGTH : CONTRACT_MAX_MAP_ENTRIES))
+                    return false;
+                if (!array && !addBytes(serializedJsonStringBytes(key) + 1))
                     return false;
                 pending.push({ value: descriptor.value, depth: item.depth + 1 });
             }
-            continue;
-        }
-        const prototype = Object.getPrototypeOf(current);
-        if (prototype !== Object.prototype && prototype !== null)
-            return false;
-        const entries = [];
-        for (const key of Reflect.ownKeys(current)) {
-            if (typeof key !== "string" || key.length > CONTRACT_MAX_IDENTIFIER_LENGTH)
-                return false;
-            const descriptor = Object.getOwnPropertyDescriptor(current, key);
-            if (descriptor === undefined || !descriptor.enumerable || !("value" in descriptor))
-                return false;
-            if (descriptor.value === undefined && omitUndefinedObjectFields)
-                continue;
-            entries.push([key, descriptor]);
-            if (entries.length > CONTRACT_MAX_MAP_ENTRIES)
+            if (!addBytes(2 + Math.max(entries - 1, 0)))
                 return false;
         }
-        if (!addBytes(2 + Math.max(entries.length - 1, 0)))
-            return false;
-        for (const [key, descriptor] of entries) {
-            if (!addBytes(serializedJsonStringBytes(key) + 1))
-                return false;
-            pending.push({
-                value: descriptor.value,
-                depth: item.depth + 1,
-                omitUndefined: omitUndefinedObjectFields,
-            });
-        }
-    }
-    return true;
-}
-/** Validate digest input while matching JSON's omission of undefined object fields. */
-export function isBoundedJsonMaterial(value) {
-    const pending = [{ value, depth: 0 }];
-    const ancestors = new Set();
-    let nodes = 0;
-    while (pending.length > 0) {
-        const item = pending.pop();
-        if (!item)
-            continue;
-        if (item.leave) {
-            ancestors.delete(item.value);
-            continue;
-        }
-        if (item.value === undefined) {
-            if (item.omitUndefined === true)
-                continue;
-            return false;
-        }
-        nodes += 1;
-        if (nodes > CONTRACT_MAX_JSON_NODES)
-            return false;
-        const current = item.value;
-        if (current === null || typeof current === "boolean")
-            continue;
-        if (typeof current === "string") {
-            if (current.length > CONTRACT_MAX_STRING_LENGTH)
-                return false;
-            continue;
-        }
-        if (typeof current === "number") {
-            if (!Number.isFinite(current))
-                return false;
-            continue;
-        }
-        if (typeof current !== "object" || item.depth >= CONTRACT_MAX_JSON_DEPTH) {
-            return false;
-        }
-        if (ancestors.has(current))
-            return false;
-        ancestors.add(current);
-        pending.push({ value: current, depth: item.depth, leave: true });
-        if (Array.isArray(current)) {
-            if (current.length > CONTRACT_MAX_ARRAY_LENGTH)
-                return false;
-            for (const entry of current) {
+        else if (array) {
+            for (const entry of current)
                 pending.push({ value: entry, depth: item.depth + 1 });
-            }
-            continue;
         }
-        const prototype = Object.getPrototypeOf(current);
-        if (prototype !== Object.prototype && prototype !== null)
-            return false;
-        const keys = Object.keys(current);
-        if (keys.length > CONTRACT_MAX_MAP_ENTRIES)
-            return false;
-        for (const key of keys) {
-            if (key.length > CONTRACT_MAX_IDENTIFIER_LENGTH)
+        else {
+            const keys = Object.keys(current);
+            if (keys.length > CONTRACT_MAX_MAP_ENTRIES)
                 return false;
-            pending.push({
-                value: current[key],
-                depth: item.depth + 1,
-                omitUndefined: true,
-            });
+            for (const key of keys) {
+                if (key.length > CONTRACT_MAX_IDENTIFIER_LENGTH)
+                    return false;
+                pending.push({
+                    value: current[key],
+                    depth: item.depth + 1,
+                    omitUndefined: options.omitUndefinedObjectFields,
+                });
+            }
         }
     }
     return true;

package/dist/own-property-record.d.ts

@@ -6,4 +6,7 @@ import { z } from "zod";
  * sees it, then restore the exact UTF-16 key with defineProperty so all string
  * keys allowed by `Record<string, ...>` remain data rather than object syntax.
  */
-export declare function ownPropertyRecordSchema<ValueSchema extends z.ZodType>(valueSchema: ValueSchema): z.ZodType<Record<string, z.output<ValueSchema>>>;
+export declare function ownPropertyRecordSchema<ValueSchema extends z.ZodType>(valueSchema: ValueSchema, { maxEntries, prepareValue }?: {
+    maxEntries?: number;
+    prepareValue?: (key: string, value: unknown) => unknown;
+}): z.ZodType<Record<string, z.output<ValueSchema>>>;

package/dist/own-property-record.js

@@ -1,5 +1,7 @@
 import { z } from "zod";
+import { CONTRACT_MAX_IDENTIFIER_LENGTH, CONTRACT_MAX_MAP_ENTRIES } from "./contract-limits.js";
 import { isWellFormedUnicode } from "./agent-candidate-schema-common.js";
+import { AgentProfileValueError } from "./agent-profile-canonical.js";
 /**
  * Zod records currently assign parsed values onto an ordinary object. The
  * special own key `__proto__` therefore invokes the legacy prototype setter
@@ -7,8 +9,48 @@ import { isWellFormedUnicode } from "./agent-candidate-schema-common.js";
  * sees it, then restore the exact UTF-16 key with defineProperty so all string
  * keys allowed by `Record<string, ...>` remain data rather than object syntax.
  */
-export function ownPropertyRecordSchema(valueSchema) {
-    return z.preprocess(encodeOwnRecordKeys, z.record(z
+export function ownPropertyRecordSchema(valueSchema, { maxEntries = CONTRACT_MAX_MAP_ENTRIES, prepareValue } = {}) {
+    return z.preprocess((value, context) => {
+        if (value === null || typeof value !== "object" || Array.isArray(value))
+            return value;
+        const prototype = Object.getPrototypeOf(value);
+        if (prototype !== Object.prototype && prototype !== null)
+            return [];
+        let entries = 0;
+        for (const key in value) {
+            if (!Object.hasOwn(value, key))
+                continue;
+            if (++entries > maxEntries || key.length > CONTRACT_MAX_IDENTIFIER_LENGTH) {
+                context.addIssue({ code: "custom", message: "record exceeds the contract bounds" });
+                return z.NEVER;
+            }
+        }
+        const encoded = Object.create(null);
+        for (const key of Object.keys(value)) {
+            const descriptor = Object.getOwnPropertyDescriptor(value, key);
+            if (!descriptor || !("value" in descriptor)) {
+                context.addIssue({ code: "custom", message: "record entries must be data properties" });
+                return z.NEVER;
+            }
+            let entry;
+            try {
+                entry = prepareValue ? prepareValue(key, descriptor.value) : descriptor.value;
+            }
+            catch (error) {
+                // Only a profile-value refusal is a validation issue; any other throw is a defect.
+                if (!(error instanceof AgentProfileValueError))
+                    throw error;
+                context.addIssue({ code: "custom", path: [...error.path], message: error.message });
+                return z.NEVER;
+            }
+            if (entry === z.NEVER) {
+                context.addIssue({ code: "custom", message: "record value exceeds the contract bounds or is not portable JSON" });
+                return z.NEVER;
+            }
+            encoded[encodeRecordKey(key)] = entry;
+        }
+        return encoded;
+    }, z.record(z
         .string()
         .regex(/^u(?:[0-9a-f]{4})*$/, "record keys must contain valid Unicode"), valueSchema).transform((record) => {
         const restored = {};
@@ -23,19 +65,6 @@ export function ownPropertyRecordSchema(valueSchema) {
         return restored;
     }));
 }
-function encodeOwnRecordKeys(value) {
-    if (value === null || typeof value !== "object" || Array.isArray(value)) {
-        return value;
-    }
-    const prototype = Object.getPrototypeOf(value);
-    if (prototype !== Object.prototype && prototype !== null)
-        return [];
-    const encoded = Object.create(null);
-    for (const [key, entry] of Object.entries(value)) {
-        encoded[encodeRecordKey(key)] = entry;
-    }
-    return encoded;
-}
 function encodeRecordKey(value) {
     let encoded = isWellFormedUnicode(value) ? "u" : "i";
     for (let index = 0; index < value.length; index += 1) {

package/dist/profile-schema.js

@@ -1,5 +1,6 @@
 import { agentCandidateSecretRefSchema } from "./agent-candidate-schema-common.js";
 import { z } from "zod";
+import { CONTRACT_MAX_ARRAY_LENGTH, isBoundedJsonMaterial } from "./contract-limits.js";
 import { ownPropertyRecordSchema } from "./own-property-record.js";
 import { ProxySecretsSchema } from "./proxy-secrets.js";
 import { agentProfileKnowledgeRefsSchema } from "./profile-knowledge.js";
@@ -7,9 +8,24 @@ export { agentProfileKnowledgeRefSchema, agentProfileKnowledgeRefsSchema, } from
 import { REASONING_EFFORTS, TRAINED_MODEL_PREFIX, trainedModelIdForArtifact, } from "./agent-profile.js";
 import { canonicalCandidateDigest, sha256DigestSchema, environmentNameSchema, headerNameSchema, isSafeExecutable, isSafeRelativePath, isWellFormedUnicode, looksLikeCredential, } from "./agent-candidate-schema-common.js";
 import { harnessTypeSchema } from "./harness.js";
-import { canonicalAgentProfileJson } from "./agent-profile-canonical.js";
+import { AgentProfileValueError, assertAgentProfileValue, canonicalAgentProfileJson } from "./agent-profile-canonical.js";
 import { harnessHonorsEffort, harnessHonorsModel, harnessModelSupport, harnessReasoningEfforts, harnessSystemPromptIntents, resolveModelProvider, } from "./harness-capabilities.js";
 import { SANDBOX_SIZE_PRESET_NAMES, } from "./sandbox-size.js";
+const profileOpaqueValueSchema = z.unknown().transform((value, context) => {
+    if (value === undefined || isBoundedJsonMaterial(value, { dataPropertiesOnly: true }))
+        return structuredClone(value);
+    try {
+        assertAgentProfileValue(value, []);
+    }
+    catch (error) {
+        if (!(error instanceof AgentProfileValueError))
+            throw error;
+        context.addIssue({ code: "custom", path: [...error.path], message: error.message });
+        return z.NEVER;
+    }
+    context.addIssue({ code: "custom", message: "profile metadata exceeds contract bounds or is not portable JSON" });
+    return z.NEVER;
+});
 export const agentProfilePermissionValueSchema = z.enum([
     "allow",
     "deny",
@@ -41,11 +57,11 @@ export const agentProfileFileMountSchema = z.strictObject({
 });
 export const agentProfileResourcesSchema = z.strictObject({
     knowledge: agentProfileKnowledgeRefsSchema.optional(),
-    files: z.array(agentProfileFileMountSchema).optional(),
-    tools: z.array(agentProfileResourceRefSchema).optional(),
-    skills: z.array(agentProfileResourceRefSchema).optional(),
-    agents: z.array(agentProfileResourceRefSchema).optional(),
-    commands: z.array(agentProfileResourceRefSchema).optional(),
+    files: z.array(agentProfileFileMountSchema).max(CONTRACT_MAX_ARRAY_LENGTH).optional(),
+    tools: z.array(agentProfileResourceRefSchema).max(CONTRACT_MAX_ARRAY_LENGTH).optional(),
+    skills: z.array(agentProfileResourceRefSchema).max(CONTRACT_MAX_ARRAY_LENGTH).optional(),
+    agents: z.array(agentProfileResourceRefSchema).max(CONTRACT_MAX_ARRAY_LENGTH).optional(),
+    commands: z.array(agentProfileResourceRefSchema).max(CONTRACT_MAX_ARRAY_LENGTH).optional(),
     instructions: z
         .union([z.string(), agentProfileResourceRefSchema])
         .optional(),
@@ -88,7 +104,7 @@ export const agentProfileModelHintsBaseSchema = z.strictObject({
     maxVisibleOutputTokens: z.number().int().positive().optional(),
     maxReasoningTokens: z.number().int().positive().optional(),
     maxTotalOutputTokens: z.number().int().positive().optional(),
-    metadata: ownPropertyRecordSchema(z.unknown()).optional(),
+    metadata: ownPropertyRecordSchema(profileOpaqueValueSchema).optional(),
 });
 export const agentProfileModelHintsSchema = agentProfileModelHintsBaseSchema.superRefine(enforceModelTokenBounds);
 /** Ordered account selection policy, without credentials or ambient model defaults. */
@@ -113,7 +129,7 @@ export const agentProfileSeatSchema = z.strictObject({
 export const agentProfilePromptSchema = z.strictObject({
     systemPrompt: z.string().optional(),
     appendSystemPrompt: z.string().optional(),
-    instructions: z.array(z.string()).optional(),
+    instructions: z.array(z.string()).max(CONTRACT_MAX_ARRAY_LENGTH).optional(),
 });
 const controlCharacterPattern = /[\u0000-\u001f\u007f]/;
 const secretCapableNamePattern = /(?:^|[_-])(?:api[_-]?key|access[_-]?key|private[_-]?key|token|secret|password|credentials?|authorization|cookie|database[_-]?url|dsn|pat)(?:[_-]|$)/i;
@@ -166,7 +182,7 @@ export const agentSubagentProfileSchema = z.strictObject({
     tools: ownPropertyRecordSchema(z.boolean()).optional(),
     permissions: ownPropertyRecordSchema(agentProfilePermissionSchema).optional(),
     maxSteps: z.number().optional(),
-    metadata: ownPropertyRecordSchema(z.unknown()).optional(),
+    metadata: ownPropertyRecordSchema(profileOpaqueValueSchema).optional(),
 });
 export const agentProfileHookCommandSchema = z.strictObject({
     command: z.string(),
@@ -181,7 +197,7 @@ export const agentProfileModeSchema = z.strictObject({
     prompt: z.string().optional(),
     tools: ownPropertyRecordSchema(z.boolean()).optional(),
     permissions: ownPropertyRecordSchema(agentProfilePermissionSchema).optional(),
-    metadata: ownPropertyRecordSchema(z.unknown()).optional(),
+    metadata: ownPropertyRecordSchema(profileOpaqueValueSchema).optional(),
 });
 export const agentProfileConfidentialSchema = z.strictObject({
     tee: z.string().optional(),
@@ -204,7 +220,7 @@ const remoteMcpUrlSchema = nonBlankMcpValueSchema.refine((value) => {
 const agentProfileLocalMcpServerSchema = z.strictObject({
     transport: z.literal("stdio").optional(),
     command: nonBlankMcpValueSchema.refine(isSafeExecutable, "local MCP command must be a canonical public executable"),
-    args: z.array(agentProfileConfigValueSchema).optional(),
+    args: z.array(agentProfileConfigValueSchema).max(CONTRACT_MAX_ARRAY_LENGTH).optional(),
     env: agentProfileEnvironmentSchema.optional(),
     cwd: z
         .string()
@@ -213,7 +229,7 @@ const agentProfileLocalMcpServerSchema = z.strictObject({
     url: z.undefined().optional(),
     headers: z.undefined().optional(),
     enabled: z.literal(true).optional(),
-    metadata: ownPropertyRecordSchema(z.unknown()).optional(),
+    metadata: ownPropertyRecordSchema(profileOpaqueValueSchema).optional(),
 });
 const agentProfileRemoteMcpServerSchema = z.strictObject({
     transport: z.enum(["sse", "http"]).optional(),
@@ -224,7 +240,7 @@ const agentProfileRemoteMcpServerSchema = z.strictObject({
     url: remoteMcpUrlSchema,
     headers: agentProfileHeaderSchema.optional(),
     enabled: z.literal(true).optional(),
-    metadata: ownPropertyRecordSchema(z.unknown()).optional(),
+    metadata: ownPropertyRecordSchema(profileOpaqueValueSchema).optional(),
 });
 const agentProfileDisabledMcpServerSchema = z.strictObject({
     enabled: z.literal(false),
@@ -235,7 +251,7 @@ const agentProfileDisabledMcpServerSchema = z.strictObject({
     cwd: z.undefined().optional(),
     url: z.undefined().optional(),
     headers: z.undefined().optional(),
-    metadata: ownPropertyRecordSchema(z.unknown()).optional(),
+    metadata: ownPropertyRecordSchema(profileOpaqueValueSchema).optional(),
 });
 export const agentProfileMcpServerSchema = z.union([
     agentProfileLocalMcpServerSchema,
@@ -244,10 +260,10 @@ export const agentProfileMcpServerSchema = z.union([
 ]);
 export const agentProfileConnectionSchema = z.strictObject({
     connectionId: z.string().min(1),
-    capabilities: z.array(z.string().min(1)).min(1),
+    capabilities: z.array(z.string().min(1)).max(CONTRACT_MAX_ARRAY_LENGTH).min(1),
     alias: z.string().min(1).optional(),
 });
-const removeListSchema = z.union([z.literal(true), z.array(z.string().min(1))]);
+const removeListSchema = z.union([z.literal(true), z.array(z.string().min(1)).max(CONTRACT_MAX_ARRAY_LENGTH)]);
 export const agentProfilePromptRemovalSchema = z.strictObject({
     systemPrompt: z.literal(true).optional(),
     appendSystemPrompt: z.literal(true).optional(),
@@ -311,10 +327,7 @@ export const agentTrainingDatasetIdentitySchema = z.strictObject({
         context.addIssue({ code: "custom", path: ["taskSetDigest"], message: "training task inventory digest mismatch" });
     }
 });
-export const agentTrainingParametersSchema = ownPropertyRecordSchema(z.union([z.string().max(2_048).pipe(publicProfileConfigStringSchema), z.number().finite(), z.boolean(), z.null()])).superRefine((parameters, context) => {
-    if (Object.keys(parameters).length > 100) {
-        context.addIssue({ code: "custom", message: "at most 100 public training parameters are allowed" });
-    }
+export const agentTrainingParametersSchema = ownPropertyRecordSchema(z.union([z.string().max(2_048).pipe(publicProfileConfigStringSchema), z.number().finite(), z.boolean(), z.null()]), { maxEntries: 100 }).superRefine((parameters, context) => {
     for (const name of Object.keys(parameters)) {
         if (!trainingIdentitySchema.safeParse(name).success || isCredentialBearingProfileConfigName(name)) {
             context.addIssue({ code: "custom", path: [name], message: "training parameter name must be public and non-credential" });
@@ -359,13 +372,25 @@ export const agentProfileTrainingSchema = z.strictObject({
         }
     }
 });
-export const agentProfileMetadataSchema = ownPropertyRecordSchema(z.unknown()).superRefine((metadata, context) => {
+export const agentProfileMetadataSchema = ownPropertyRecordSchema(z.unknown(), {
+    prepareValue: (key, value) => {
+        if (key === "training")
+            return value;
+        if (value === undefined || isBoundedJsonMaterial(value, { dataPropertiesOnly: true }))
+            return structuredClone(value);
+        assertAgentProfileValue(value, [key]);
+        return z.NEVER;
+    },
+}).superRefine((metadata, context) => {
     if (!Object.hasOwn(metadata, "training"))
         return;
     const result = agentProfileTrainingSchema.safeParse(metadata.training);
-    if (!result.success) {
+    if (result.success)
+        metadata.training = result.data;
+    else {
+        delete metadata.training;
         for (const issue of result.error.issues) {
-            context.addIssue({ code: "custom", path: ["training", ...issue.path], message: issue.message });
+            context.addIssue({ code: "custom", path: ["training", ...issue.path], message: issue.message, continue: false });
         }
     }
 });
@@ -379,23 +404,23 @@ export const agentProfileSchema = z
     name: z.string().optional(),
     description: z.string().optional(),
     version: z.string().optional(),
-    tags: z.array(z.string()).optional(),
+    tags: z.array(z.string()).max(CONTRACT_MAX_ARRAY_LENGTH).optional(),
     prompt: agentProfilePromptSchema.optional(),
     model: agentProfileModelHintsSchema.optional(),
     harness: harnessTypeSchema.optional(),
-    seats: z.array(agentProfileSeatSchema).nonempty().optional(),
+    seats: z.array(agentProfileSeatSchema).max(CONTRACT_MAX_ARRAY_LENGTH).nonempty().optional(),
     proxySecrets: ProxySecretsSchema.optional(),
     permissions: ownPropertyRecordSchema(agentProfilePermissionSchema).optional(),
     tools: ownPropertyRecordSchema(z.boolean()).optional(),
     mcp: ownPropertyRecordSchema(agentProfileMcpServerSchema).optional(),
-    connections: z.array(agentProfileConnectionSchema).optional(),
+    connections: z.array(agentProfileConnectionSchema).max(CONTRACT_MAX_ARRAY_LENGTH).optional(),
     subagents: ownPropertyRecordSchema(agentSubagentProfileSchema).optional(),
     resources: agentProfileResourcesSchema.optional(),
-    hooks: ownPropertyRecordSchema(z.array(agentProfileHookCommandSchema)).optional(),
+    hooks: ownPropertyRecordSchema(z.array(agentProfileHookCommandSchema).max(CONTRACT_MAX_ARRAY_LENGTH)).optional(),
     modes: ownPropertyRecordSchema(agentProfileModeSchema).optional(),
     confidential: agentProfileConfidentialSchema.optional(),
     metadata: agentProfileMetadataSchema.optional(),
-    extensions: ownPropertyRecordSchema(z.union([ownPropertyRecordSchema(z.unknown()), z.undefined()])).optional(),
+    extensions: ownPropertyRecordSchema(z.union([ownPropertyRecordSchema(profileOpaqueValueSchema), z.undefined()])).optional(),
 })
     .superRefine((profile, context) => {
     validateNestedRecordKeys(profile, context, [], new Set());
@@ -533,13 +558,13 @@ export const agentProfileDiffSchema = z.strictObject({
             "optimizer",
             "compound",
         ]),
-        artifacts: z.array(z.string().min(1)).optional(),
-        notes: z.array(z.string()).optional(),
+        artifacts: z.array(z.string().min(1)).max(CONTRACT_MAX_ARRAY_LENGTH).optional(),
+        notes: z.array(z.string()).max(CONTRACT_MAX_ARRAY_LENGTH).optional(),
     })
         .optional(),
     set: agentProfileSchema.optional(),
     remove: agentProfileDiffRemovalSchema.optional(),
-    metadata: ownPropertyRecordSchema(z.unknown()).optional(),
+    metadata: ownPropertyRecordSchema(profileOpaqueValueSchema).optional(),
 });
 const _agentProfileSchemaMatchesInterface = true;
 void _agentProfileSchemaMatchesInterface;

package/dist/proxy-secrets.js

@@ -57,9 +57,8 @@ export const ProxySecretsSchema = z.array(ProxySecretBindingSchema).max(CONTRACT
  * Strings select an API-verified parent sandbox; null explicitly selects independent issuance.
  * When present, every destination in the final effective selection must have exactly one key.
  */
-export const ProxySecretParentsSchema = ownPropertyRecordSchema(boundedIdentifierSchema.nullable())
-    .refine((parents) => Object.keys(parents).length <= CONTRACT_MAX_ARRAY_LENGTH &&
-    Object.keys(parents).every((name) => envNameSchema.safeParse(name).success), "invalid parent selection keys");
+export const ProxySecretParentsSchema = ownPropertyRecordSchema(boundedIdentifierSchema.nullable(), { maxEntries: CONTRACT_MAX_ARRAY_LENGTH })
+    .refine((parents) => Object.keys(parents).every((name) => envNameSchema.safeParse(name).success), "invalid parent selection keys");
 /** Shape and totality only; the API verifies issuer authority and durable immutable pins. */
 export function isProxySecretParentsTotal(bindings, parents) {
     const selection = ProxySecretsSchema.safeParse(bindings);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-interface",
-  "version": "5.9.0",
+  "version": "5.10.0",
   "type": "module",
   "sideEffects": false,
   "license": "MIT",