@tangle-network/agent-profile-materialize 1.1.7 → 1.1.8

package/dist/profile-bundle-key.d.ts

@@ -1,69 +0,0 @@
-import type { AgentProfileFileMount } from "@tangle-network/agent-interface";
-export declare const PROFILE_BUNDLE_SCHEMA = "agent-profile-bundle/v1";
-export declare const PROFILE_BUNDLE_MAX_FILES = 512;
-export declare const PROFILE_BUNDLE_MAX_BYTES: number;
-export declare const PROFILE_BUNDLE_MAX_FILE_BYTES: number;
-export declare const PROFILE_BUNDLE_DEFAULT_MAX_BYTES: number;
-export interface ProfileBundleFileEntry {
-    /** Logical workspace-relative mount path, exactly as declared on the profile. */
-    mountPath: string;
-    /** SHA-256 of the content bytes as lowercase hex, WITHOUT the `sha256:` prefix. */
-    sha256: string;
-    /** Full file mode (0o644 default, 0o755 for executable mounts). */
-    mode: number;
-}
-export interface ProfileBundleManifest {
-    schema: string;
-    /** Raw bundle key (e.g. `sha256:<hex>`); also recoverable from the filename. */
-    bundle: string;
-    createdAt: string;
-    sizeBytes: number;
-    files: Array<ProfileBundleFileEntry & {
-        target: string;
-    }>;
-}
-export interface ProfileBundleClaim {
-    bundle: string;
-    files: Array<{
-        mountPath: string;
-        sha256: string;
-    }>;
-}
-export type ProfileBundleClaimResult = {
-    status: "hit";
-    linked: string[];
-} | {
-    status: "miss";
-    missing: string[];
-};
-export interface ProfileBundleCache {
-    root: string;
-    maxBytes: number;
-    admit(manifest: ProfileBundleManifest, readObject: (sha256: string) => Promise<Uint8Array> | Uint8Array): Promise<void>;
-    evict(): Promise<void>;
-    sweep(): Promise<void>;
-}
-/**
- * Derive the canonical bundle file entry for one inline mount. The sha256 is
- * computed over the exact inline content bytes and the mode mirrors the SDK's
- * `profileFileMode`/`isExecutableProfileFile`: `mount.executable` wins when
- * present, otherwise a path under a `bin/` or `sbin/` directory is executable.
- * A mount whose resource is not inline is a caller bug and throws, matching
- * the fail-closed discipline of {@link resolveInlineRef}.
- */
-export declare function profileBundleFileEntry(mount: AgentProfileFileMount): ProfileBundleFileEntry;
-/**
- * The canonical file table: one entry per mount, sorted by (mountPath, sha256)
- * so any array order of the same mounts produces the same table.
- */
-export declare function profileBundleFileTable(mounts: readonly AgentProfileFileMount[]): ProfileBundleFileEntry[];
-/**
- * The content-addressed bundle key. The digest covers EXACTLY the schema
- * version and, per file, the logical mount path, the sha256 of the content
- * bytes, and the full file mode — the same image-content-hash discipline as
- * scripts/ci/image-content-hash.mjs: hash exactly the inputs that determine
- * the cached bytes (and their placement semantics), nothing more. Any profile
- * change — content, path, or mode — produces a new key; anything else
- * (mount order, transport-only target paths, timestamps) does not.
- */
-export declare function profileFileBundleKey(mounts: readonly AgentProfileFileMount[]): string;

package/dist/profile-bundle-key.js

@@ -1,62 +0,0 @@
-import { createHash } from "node:crypto";
-import { canonicalCandidateDigest } from "@tangle-network/agent-interface";
-import { resolveInlineRef } from "./resource-resolution.js";
-import { compareStrings } from "./workspace-files.js";
-// The bundle key, wire shapes and limits shared by the SDK, sidecar and
-// host-agent. The cache itself (admit, claim, open) is profile-bundle-cache.ts.
-export const PROFILE_BUNDLE_SCHEMA = "agent-profile-bundle/v1";
-export const PROFILE_BUNDLE_MAX_FILES = 512;
-export const PROFILE_BUNDLE_MAX_BYTES = 256 * 1024 * 1024;
-export const PROFILE_BUNDLE_MAX_FILE_BYTES = 32 * 1024 * 1024;
-export const PROFILE_BUNDLE_DEFAULT_MAX_BYTES = 1024 * 1024 * 1024;
-// Mirrors PROFILE_BIN_DIR_RE in products/sandbox/sdk/src/profile-file-mounts.ts,
-// the canonical definition for staged profile delivery. The SDK consumes this
-// package, so the regex source is mirrored (not imported); tests assert parity
-// with the SDK's profileFileMode semantics for representative paths.
-const PROFILE_BIN_DIR_RE = /(^|\/)(s?bin)\//;
-/**
- * Derive the canonical bundle file entry for one inline mount. The sha256 is
- * computed over the exact inline content bytes and the mode mirrors the SDK's
- * `profileFileMode`/`isExecutableProfileFile`: `mount.executable` wins when
- * present, otherwise a path under a `bin/` or `sbin/` directory is executable.
- * A mount whose resource is not inline is a caller bug and throws, matching
- * the fail-closed discipline of {@link resolveInlineRef}.
- */
-export function profileBundleFileEntry(mount) {
-    const resolved = resolveInlineRef(mount.resource);
-    if (resolved === null) {
-        throw new Error(`profileBundleFileEntry: ${mount.path} requires an inline resource`);
-    }
-    const executable = mount.executable ?? PROFILE_BIN_DIR_RE.test(mount.path);
-    return {
-        mountPath: mount.path,
-        sha256: createHash("sha256").update(resolved.content, "utf8").digest("hex"),
-        mode: executable ? 0o755 : 0o644,
-    };
-}
-/**
- * The canonical file table: one entry per mount, sorted by (mountPath, sha256)
- * so any array order of the same mounts produces the same table.
- */
-export function profileBundleFileTable(mounts) {
-    return mounts
-        .map(profileBundleFileEntry)
-        .sort((left, right) => left.mountPath !== right.mountPath
-        ? compareStrings(left.mountPath, right.mountPath)
-        : compareStrings(left.sha256, right.sha256));
-}
-/**
- * The content-addressed bundle key. The digest covers EXACTLY the schema
- * version and, per file, the logical mount path, the sha256 of the content
- * bytes, and the full file mode — the same image-content-hash discipline as
- * scripts/ci/image-content-hash.mjs: hash exactly the inputs that determine
- * the cached bytes (and their placement semantics), nothing more. Any profile
- * change — content, path, or mode — produces a new key; anything else
- * (mount order, transport-only target paths, timestamps) does not.
- */
-export function profileFileBundleKey(mounts) {
-    return canonicalCandidateDigest({
-        schema: PROFILE_BUNDLE_SCHEMA,
-        files: profileBundleFileTable(mounts),
-    });
-}

package/dist/profile-bundle-lru.d.ts

@@ -1,56 +0,0 @@
-/**
- * Advisory lru accounting for the profile bundle cache (see
- * profile-bundle-cache.ts for the cache layout and durability invariants).
- * `lru.json` is never load-bearing: it is rebuilt from a disk scan whenever it
- * is absent or corrupt, and every write to it is best-effort so a full or
- * read-only cache can never break admit, claim, or eviction.
- */
-interface ProfileBundleLru {
-    v: 1;
-    objects: Record<string, {
-        bytes: number;
-        lastUsed: string;
-    }>;
-    bundles: Record<string, {
-        bytes: number;
-        lastUsed: string;
-        createdAt: string;
-    }>;
-}
-export declare function pathExistsFollowingLinks(path: string): Promise<boolean>;
-export declare function fsyncDir(dir: string): Promise<void>;
-export declare function withRootLock<T>(root: string, run: () => Promise<T>): Promise<T>;
-/** Synchronous open must not sweep a root with pending asynchronous work. */
-export declare function hasPendingRootWork(root: string): boolean;
-export declare function readManifestFile(path: string): Promise<{
-    schema?: unknown;
-    bundle?: unknown;
-    createdAt?: unknown;
-    files?: unknown;
-} | null>;
-/**
- * Bundle keys come from `canonicalCandidateDigest` as `sha256:<hex>`; the `:`
- * is encoded so the key is a safe single path segment on any host filesystem.
- * The raw key is always recoverable from the manifest's `bundle` field.
- */
-export declare function profileBundleManifestPath(root: string, bundle: string): string;
-/** Sweep only while holding the per-root lock; active admissions own incoming/. */
-export declare function sweepProfileBundleCache(root: string): Promise<void>;
-/** Remove interrupted admission residue; the caller must hold the per-root lock. */
-export declare function sweepUnlocked(root: string): Promise<void>;
-export declare function loadLru(root: string): Promise<ProfileBundleLru>;
-/** Best-effort by contract: lru corruption or a full cache must never break admit/claim. */
-export declare function saveLru(root: string, lru: ProfileBundleLru): Promise<void>;
-/** Eviction body; callers must already hold the per-root lock. */
-export declare function evictUnlocked(root: string, maxBytes: number): Promise<void>;
-/**
- * Evict least-recently-used objects until total object bytes are within
- * `maxBytes`. Unreferenced objects go first (they reclaim space with no
- * bundle impact); if the cap still does not hold, referenced objects are
- * evicted oldest-first, which makes their bundles partial — claims then miss
- * and re-deliver, so eviction can never serve wrong bytes. Bundle manifests
- * referencing no existing objects are removed. Mid-admit `incoming/` dirs are
- * never touched.
- */
-export declare function evictProfileBundles(root: string, maxBytes: number): Promise<void>;
-export {};

package/dist/profile-bundle-lru.js

@@ -1,220 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { open, readdir, readFile, rename, rm, stat, writeFile, } from "node:fs/promises";
-import { join, resolve } from "node:path";
-import { compareStrings } from "./workspace-files.js";
-export async function pathExistsFollowingLinks(path) {
-    try {
-        await stat(path);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-export async function fsyncDir(dir) {
-    try {
-        const handle = await open(dir, "r");
-        try {
-            await handle.sync();
-        }
-        finally {
-            await handle.close();
-        }
-    }
-    catch {
-        // Best-effort durability: a cache without directory fsync still verifies.
-    }
-}
-/** Serialize admissions, sweeps, and evictions per cache root. */
-const rootQueues = new Map();
-export function withRootLock(root, run) {
-    const key = resolve(root);
-    const previous = rootQueues.get(key) ?? Promise.resolve();
-    const next = previous.then(run, run);
-    const settled = next.then(() => undefined, () => undefined);
-    rootQueues.set(key, settled);
-    void settled.then(() => {
-        if (rootQueues.get(key) === settled)
-            rootQueues.delete(key);
-    });
-    return next;
-}
-/** Synchronous open must not sweep a root with pending asynchronous work. */
-export function hasPendingRootWork(root) {
-    return rootQueues.has(resolve(root));
-}
-export async function readManifestFile(path) {
-    try {
-        return JSON.parse(await readFile(path, "utf8"));
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Bundle keys come from `canonicalCandidateDigest` as `sha256:<hex>`; the `:`
- * is encoded so the key is a safe single path segment on any host filesystem.
- * The raw key is always recoverable from the manifest's `bundle` field.
- */
-export function profileBundleManifestPath(root, bundle) {
-    const filename = bundle.replace(/[^A-Za-z0-9._-]/g, (char) => `_${char.codePointAt(0)?.toString(16) ?? "3f"}_`);
-    return join(root, "bundles", `${filename}.json`);
-}
-/** Sweep only while holding the per-root lock; active admissions own incoming/. */
-export async function sweepProfileBundleCache(root) {
-    await withRootLock(root, () => sweepUnlocked(root));
-}
-/** Remove interrupted admission residue; the caller must hold the per-root lock. */
-export async function sweepUnlocked(root) {
-    const incoming = join(root, "incoming");
-    let entries;
-    try {
-        entries = await readdir(incoming);
-    }
-    catch {
-        return;
-    }
-    for (const entry of entries) {
-        await rm(join(incoming, entry), { recursive: true, force: true });
-    }
-    await fsyncDir(incoming);
-}
-async function rebuildLru(root) {
-    const lru = { v: 1, objects: {}, bundles: {} };
-    try {
-        for (const name of await readdir(join(root, "objects"))) {
-            const info = await stat(join(root, "objects", name));
-            if (info.isFile()) {
-                lru.objects[name] = {
-                    bytes: info.size,
-                    lastUsed: info.mtime.toISOString(),
-                };
-            }
-        }
-    }
-    catch {
-        // Missing objects dir: fresh cache.
-    }
-    try {
-        for (const name of await readdir(join(root, "bundles"))) {
-            const manifest = await readManifestFile(join(root, "bundles", name));
-            if (!manifest || typeof manifest.bundle !== "string")
-                continue;
-            const info = await stat(join(root, "bundles", name));
-            const files = Array.isArray(manifest.files) ? manifest.files : [];
-            const referenced = files.map((file) => file.sha256);
-            const bytes = referenced.reduce((sum, sha) => sum + (lru.objects[sha ?? ""]?.bytes ?? 0), 0);
-            lru.bundles[manifest.bundle] = {
-                bytes,
-                lastUsed: info.mtime.toISOString(),
-                createdAt: typeof manifest.createdAt === "string"
-                    ? manifest.createdAt
-                    : info.mtime.toISOString(),
-            };
-        }
-    }
-    catch {
-        // Missing bundles dir: fresh cache.
-    }
-    return lru;
-}
-export async function loadLru(root) {
-    try {
-        const parsed = JSON.parse(await readFile(join(root, "lru.json"), "utf8"));
-        if (parsed &&
-            parsed.v === 1 &&
-            typeof parsed.objects === "object" &&
-            typeof parsed.bundles === "object") {
-            return parsed;
-        }
-    }
-    catch {
-        // Corrupt or missing: rebuild below.
-    }
-    return rebuildLru(root);
-}
-/** Best-effort by contract: lru corruption or a full cache must never break admit/claim. */
-export async function saveLru(root, lru) {
-    try {
-        const path = join(root, "lru.json");
-        const temporary = `${path}.tmp-${randomUUID()}`;
-        await writeFile(temporary, JSON.stringify(lru));
-        await rename(temporary, path);
-    }
-    catch {
-        // Read-only or full cache: eviction still held on disk.
-    }
-}
-/** Eviction body; callers must already hold the per-root lock. */
-export async function evictUnlocked(root, maxBytes) {
-    const lru = await loadLru(root);
-    const objectsDir = join(root, "objects");
-    for (const sha of Object.keys(lru.objects)) {
-        if (!(await pathExistsFollowingLinks(join(objectsDir, sha)))) {
-            delete lru.objects[sha];
-        }
-    }
-    const manifests = new Map();
-    const bundlesDir = join(root, "bundles");
-    for (const name of await readdir(bundlesDir)) {
-        const manifest = await readManifestFile(join(bundlesDir, name));
-        if (manifest && typeof manifest.bundle === "string") {
-            manifests.set(manifest.bundle, manifest);
-        }
-        else {
-            await rm(join(bundlesDir, name), { force: true });
-        }
-    }
-    const referenced = new Set();
-    for (const manifest of manifests.values()) {
-        const files = Array.isArray(manifest.files) ? manifest.files : [];
-        for (const file of files) {
-            const sha = file.sha256;
-            if (typeof sha === "string")
-                referenced.add(sha);
-        }
-    }
-    let total = Object.values(lru.objects).reduce((sum, o) => sum + o.bytes, 0);
-    const byLastUsed = (sha) => lru.objects[sha]?.lastUsed ?? "";
-    const live = Object.keys(lru.objects);
-    const unreferenced = live
-        .filter((sha) => !referenced.has(sha))
-        .sort((a, b) => compareStrings(byLastUsed(a), byLastUsed(b)));
-    const referencedLive = live
-        .filter((sha) => referenced.has(sha))
-        .sort((a, b) => compareStrings(byLastUsed(a), byLastUsed(b)));
-    for (const sha of [...unreferenced, ...referencedLive]) {
-        if (total <= maxBytes)
-            break;
-        await rm(join(objectsDir, sha), { force: true });
-        total -= lru.objects[sha]?.bytes ?? 0;
-        delete lru.objects[sha];
-    }
-    // Bundles whose every object is gone can never be claimed; drop their manifests.
-    for (const [bundle, manifest] of manifests) {
-        const files = Array.isArray(manifest.files) ? manifest.files : [];
-        const alive = files.some((file) => Boolean(lru.objects[file.sha256 ?? ""]));
-        if (!alive) {
-            await rm(profileBundleManifestPath(root, bundle), { force: true });
-            delete lru.bundles[bundle];
-        }
-    }
-    await fsyncDir(objectsDir);
-    await fsyncDir(bundlesDir);
-    await saveLru(root, lru);
-}
-/**
- * Evict least-recently-used objects until total object bytes are within
- * `maxBytes`. Unreferenced objects go first (they reclaim space with no
- * bundle impact); if the cap still does not hold, referenced objects are
- * evicted oldest-first, which makes their bundles partial — claims then miss
- * and re-deliver, so eviction can never serve wrong bytes. Bundle manifests
- * referencing no existing objects are removed. Mid-admit `incoming/` dirs are
- * never touched.
- */
-export async function evictProfileBundles(root, maxBytes) {
-    if (!Number.isFinite(maxBytes) || maxBytes < 0) {
-        throw new Error(`Profile bundle cache maxBytes must be >= 0: ${maxBytes}`);
-    }
-    await withRootLock(root, () => evictUnlocked(root, maxBytes));
-}

package/dist/profile-materializer.d.ts

@@ -1,24 +0,0 @@
-import type { AgentProfile, AgentProfileSecretProvider, AgentRuntimeAttachments } from "@tangle-network/agent-interface";
-import { type HarnessId } from "./harness.js";
-import { type BindableLaunchControl, type PlanFileRoot, type SkippableDimension, type WorkspacePlan } from "./plan-types.js";
-export declare const UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER: AgentProfileSecretProvider;
-/**
- * Why a profile's tool and permission controls cannot reach one native policy
- * on this harness, or undefined when they can.
- *
- * Admission boundaries (profile save, Sandbox create) call this so a
- * contradictory control set is refused when it is submitted, not when a
- * user's turn materializes it. Controls a harness cannot enforce are not
- * contradictions: `resources.failOnError` decides those per turn.
- */
-export declare function executionControlConflict(profile: Pick<AgentProfile, "tools" | "permissions" | "mcp">, harness: HarnessId): string | undefined;
-/**
- * Build a pure workspace plan for one canonical harness.
- * The caller applies files, environment, and flags at its process boundary.
- */
-export declare function materializeProfile(inputProfile: AgentProfile, harness: HarnessId, opts?: {
-    skip?: SkippableDimension[];
-    binds?: readonly BindableLaunchControl[];
-    instructionsRoot?: PlanFileRoot;
-    runtimeAttachments?: AgentRuntimeAttachments;
-}): WorkspacePlan;

package/dist/profile-materializer.js

@@ -1,114 +0,0 @@
-import { AgentRuntimeAttachmentsSchema, agentProfileSchema, } from "@tangle-network/agent-interface";
-import { materializeExecutionControls } from "./execution-controls.js";
-import { assertMaterializerHarness, harnessAutoLoadsAgentContextFile, } from "./harness.js";
-import { materializeHooks } from "./hooks.js";
-import { materializeMcp } from "./mcp.js";
-import { assertBindableLaunchControls, assertSkippableDimensions, } from "./plan-types.js";
-import { createProfilePlanBuilder } from "./profile-plan.js";
-import { lowerProfilePrompt } from "./profile-prompt.js";
-import { activeMcpServers, extensionNamespaces } from "./profile-support.js";
-import { lowerProfileCommands, lowerProfileResources, lowerProfileSkills, } from "./resource-lowering.js";
-import { materializeSubagent } from "./subagents.js";
-export const UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER = Object.freeze({
-    async get() {
-        return undefined;
-    },
-});
-/**
- * Why a profile's tool and permission controls cannot reach one native policy
- * on this harness, or undefined when they can.
- *
- * Admission boundaries (profile save, Sandbox create) call this so a
- * contradictory control set is refused when it is submitted, not when a
- * user's turn materializes it. Controls a harness cannot enforce are not
- * contradictions: `resources.failOnError` decides those per turn.
- */
-export function executionControlConflict(profile, harness) {
-    const builder = createProfilePlanBuilder(harness);
-    try {
-        materializeExecutionControls(harness, profile.tools, profile.permissions, undefined, builder.plan, builder.add, builder.unsupported, Object.keys(activeMcpServers(profile.mcp)));
-    }
-    catch (error) {
-        return error instanceof Error ? error.message : String(error);
-    }
-    return undefined;
-}
-/**
- * Build a pure workspace plan for one canonical harness.
- * The caller applies files, environment, and flags at its process boundary.
- */
-export function materializeProfile(inputProfile, harness, opts = {}) {
-    assertMaterializerHarness(harness);
-    const profile = agentProfileSchema.parse(inputProfile);
-    const knowledge = profile.resources && Reflect.get(profile.resources, "knowledge");
-    if (Array.isArray(knowledge) && knowledge.length > 0) {
-        throw new Error("Knowledge source generations must be owner-authorized and resolved by the execution runtime before materialization");
-    }
-    const skip = new Set(assertSkippableDimensions(opts.skip));
-    const binds = assertBindableLaunchControls(opts.binds);
-    const instructionsRoot = opts.instructionsRoot ?? "workspace";
-    if (instructionsRoot !== "workspace" && instructionsRoot !== "agent") {
-        throw new Error(`materializeProfile: unsupported instructions root ${String(instructionsRoot)}`);
-    }
-    if (instructionsRoot === "agent" &&
-        !harnessAutoLoadsAgentContextFile(harness)) {
-        throw new Error(`materializeProfile: harness "${harness}" does not load instructions from its agent directory`);
-    }
-    const builder = createProfilePlanBuilder(harness);
-    lowerProfileResources(profile, harness, builder);
-    lowerProfilePrompt(profile, harness, binds, instructionsRoot, builder);
-    materializeExecutionControls(harness, profile.tools, profile.permissions, profile.modes, builder.plan, builder.add, builder.unsupported, skip.has("mcp") ? [] : Object.keys(activeMcpServers(profile.mcp)));
-    if ((profile.connections?.length ?? 0) > 0) {
-        builder.unsupported("connections", `${harness}: Hub connections must be resolved to authorized MCP servers by the execution runtime`);
-    }
-    if (profile.confidential !== undefined) {
-        builder.unsupported("confidential", `${harness}: confidential execution requires runtime placement and attestation, not workspace files`);
-    }
-    lowerProfileSkills(profile, harness, builder);
-    const attachmentMcp = opts.runtimeAttachments === undefined
-        ? undefined
-        : AgentRuntimeAttachmentsSchema.parse(opts.runtimeAttachments).mcp;
-    if (attachmentMcp && skip.has("mcp")) {
-        throw new Error("Runtime MCP attachments cannot be skipped");
-    }
-    const validatedAttachments = attachmentMcp;
-    for (const alias of Object.keys(validatedAttachments ?? {})) {
-        if (validatedAttachments?.[alias]?.enabled === false) {
-            throw new Error(`Runtime MCP attachment cannot be disabled: ${alias}`);
-        }
-        if (Object.hasOwn(profile.mcp ?? {}, alias)) {
-            throw new Error(`Runtime MCP attachment alias conflicts with profile: ${alias}`);
-        }
-    }
-    const mcp = activeMcpServers({ ...profile.mcp, ...validatedAttachments });
-    if (!skip.has("mcp") && Object.keys(mcp).length > 0) {
-        materializeMcp(harness, mcp, builder.plan, builder.add, builder.unsupported);
-        if (attachmentMcp &&
-            builder.plan.unsupported.some((entry) => entry.dimension === "mcp")) {
-            throw new Error(`${harness} cannot materialize the requested runtime MCP attachments`);
-        }
-    }
-    const hooks = profile.hooks ?? {};
-    if (Object.keys(hooks).length > 0) {
-        materializeHooks(harness, hooks, builder.add, builder.unsupported, builder.plan);
-    }
-    const subagents = profile.subagents ?? {};
-    for (const [name, subagent] of Object.entries(subagents)) {
-        materializeSubagent(harness, name, subagent, builder.plan, builder.add, builder.unsupported);
-    }
-    if (!skip.has("extensions")) {
-        for (const namespace of extensionNamespaces(harness)) {
-            const extension = profile.extensions?.[namespace];
-            // sdk-provider-pi reads extensions.pi natively (resolvePiExtensionArgs), with the same
-            // contract as cli-bridge's pi backend. Recording it as unsupported here would reject a
-            // profile that sets resources.failOnError, although the provider honors it.
-            if (harness === "pi")
-                continue;
-            if (extension && Object.keys(extension).length > 0) {
-                builder.unsupported("extensions", `${harness}: extension namespace "${namespace}" requires provider-native handling`);
-            }
-        }
-    }
-    lowerProfileCommands(profile, harness, builder);
-    return builder.finalize(profile.resources?.failOnError);
-}

package/dist/profile-plan.d.ts

@@ -1,16 +0,0 @@
-import type { AgentProfileConfigValue } from "@tangle-network/agent-interface";
-import type { HarnessId } from "./harness.js";
-import type { AddPlanFile, SerializedPlanFileContent } from "./plan-json.js";
-import type { PlanFileRoot, Unsupported, WorkspacePlan } from "./plan-types.js";
-export interface ProfilePlanBuilder {
-    plan: WorkspacePlan;
-    add: AddPlanFile;
-    addAtRoot: AddRootedPlanFile;
-    addExplicitResource: AddExplicitResource;
-    unsupported: (dimension: Unsupported["dimension"], reason: string) => void;
-    finalize: (failOnError?: boolean) => WorkspacePlan;
-}
-export type AddRootedPlanFile = (root: PlanFileRoot, path: string, content: string | SerializedPlanFileContent, mode?: number) => void;
-export type AddExplicitResource = (dimension: Unsupported["dimension"], path: string, content: string, mode?: number) => void;
-export declare function createProfilePlanBuilder(harness: HarnessId): ProfilePlanBuilder;
-export declare function setPlanEnvironment(plan: WorkspacePlan, name: string, value: string | AgentProfileConfigValue): void;

package/dist/profile-plan.js

@@ -1,90 +0,0 @@
-import { isMaterializerOwnedPath, MATERIALIZER_RESERVED_PATHS, } from "./harness.js";
-import { workspacePlanConfigValue } from "./plan-json.js";
-import { mergeJsonFiles } from "./plan-normalize.js";
-import { formatUnsupported } from "./plan-support.js";
-import { compareStrings, normalizeWorkspaceRelativePath, PRIVATE_FILE_MODE, validateFileMode, } from "./workspace-files.js";
-export function createProfilePlanBuilder(harness) {
-    const plan = {
-        harness,
-        files: [],
-        env: {},
-        flags: [],
-        unsupported: [],
-        requires: [],
-    };
-    const pushPlanFile = (relPath, serialized, source, mode, root = "workspace") => {
-        const normalizedPath = normalizeWorkspaceRelativePath(relPath);
-        const content = typeof serialized === "string" ? serialized : serialized.content;
-        const secretSlots = typeof serialized === "string" ? undefined : serialized.secretSlots;
-        const fileMode = mode ??
-            (secretSlots !== undefined && secretSlots.length > 0
-                ? PRIVATE_FILE_MODE
-                : undefined);
-        plan.files.push({
-            relPath: normalizedPath,
-            content,
-            source,
-            ...(root === "workspace" ? {} : { root }),
-            ...(source === "generated" && isMaterializerOwnedPath(normalizedPath)
-                ? { ownership: "materializer" }
-                : {}),
-            ...(fileMode === undefined ? {} : { mode: validateFileMode(fileMode) }),
-            ...(secretSlots === undefined
-                ? {}
-                : {
-                    secretSlots: secretSlots.map((slot) => ({
-                        path: [...slot.path],
-                        ref: { ...slot.ref },
-                    })),
-                }),
-        });
-    };
-    const add = (relPath, content, mode) => pushPlanFile(relPath, content, "generated", mode);
-    const addAtRoot = (root, relPath, content, mode) => pushPlanFile(relPath, content, "generated", mode, root);
-    const unsupported = (dimension, reason) => plan.unsupported.push({ dimension, reason });
-    const explicitResourcePaths = new Map();
-    const addExplicitResource = (dimension, relPath, content, mode) => {
-        const normalizedPath = normalizeWorkspaceRelativePath(relPath);
-        const previousDimension = explicitResourcePaths.get(normalizedPath);
-        if (previousDimension) {
-            throw new Error(`Duplicate profile resource path: ${normalizedPath} (${previousDimension}, ${dimension})`);
-        }
-        if (MATERIALIZER_RESERVED_PATHS.has(normalizedPath)) {
-            throw new Error(`Profile resource path is reserved by the materializer: ${normalizedPath} (${dimension}). ` +
-                "This package writes that path itself and replaces it on re-application, so a mount " +
-                "there cannot survive; choose another path.");
-        }
-        explicitResourcePaths.set(normalizedPath, dimension);
-        pushPlanFile(normalizedPath, content, "user", mode);
-    };
-    return {
-        plan,
-        add,
-        addAtRoot,
-        addExplicitResource,
-        unsupported,
-        finalize(failOnError) {
-            for (const [relPath, dimension] of explicitResourcePaths) {
-                const writers = plan.files.filter((file) => (file.root ?? "workspace") === "workspace" &&
-                    file.relPath === relPath).length;
-                if (writers > 1) {
-                    throw new Error(`Profile ${dimension} resource conflicts with generated harness file: ${relPath}`);
-                }
-            }
-            plan.files = mergeJsonFiles(plan.files).sort((a, b) => compareStrings(`${a.root ?? "workspace"}\0${a.relPath}`, `${b.root ?? "workspace"}\0${b.relPath}`));
-            if (failOnError && plan.unsupported.length) {
-                throw new Error(formatUnsupported(plan.unsupported));
-            }
-            return plan;
-        },
-    };
-}
-export function setPlanEnvironment(plan, name, value) {
-    const normalized = typeof value === "string" ? value : workspacePlanConfigValue(value);
-    const previous = plan.env[name];
-    if (previous !== undefined &&
-        JSON.stringify(previous) !== JSON.stringify(normalized)) {
-        throw new Error(`profile environment values disagree for ${name}`);
-    }
-    plan.env[name] = normalized;
-}

package/dist/profile-prompt.d.ts

@@ -1,4 +0,0 @@
-import type { AgentProfile } from "@tangle-network/agent-interface";
-import type { BindableLaunchControl, HarnessId, PlanFileRoot } from "./plan-types.js";
-import type { ProfilePlanBuilder } from "./profile-plan.js";
-export declare function lowerProfilePrompt(profile: AgentProfile, harness: HarnessId, binds: ReadonlySet<BindableLaunchControl>, instructionsRoot: PlanFileRoot, builder: ProfilePlanBuilder): void;