@tangle-network/agent-profile-materialize 1.1.7 → 1.1.9

package/dist/plan-digest.d.ts

@@ -1,18 +0,0 @@
-export declare const sha256: (value: string) => string;
-export declare function hashWorkspacePlan(plan: WorkspacePlan): string;
-/** Build the exact digest-free identity document required by agent-interface. */
-export declare function agentCandidateProfilePlanMaterial(plan: AgentCandidateWorkspacePlan): AgentCandidateProfilePlanMaterial;
-/**
- * Return the RFC 8785 UTF-8 bytes and SHA-256 identity of a candidate profile
- * plan. The returned bytes are the exact bytes embedded in receipt evidence.
- */
-export declare function canonicalizeAgentCandidateProfilePlan(plan: AgentCandidateWorkspacePlan): {
-    material: AgentCandidateProfilePlanMaterial;
-    bytes: Uint8Array;
-    digest: Sha256Digest;
-};
-/** Capture portable evidence of the exact canonical profile-plan bytes. */
-export declare function captureAgentCandidateProfilePlan(plan: AgentCandidateWorkspacePlan): AgentCandidateProfilePlanEvidence;
-import type { AgentCandidateProfilePlanEvidence, AgentCandidateProfilePlanMaterial, Sha256Digest } from "@tangle-network/agent-interface";
-import type { AgentCandidateWorkspacePlan } from "./candidate-types.js";
-import type { WorkspacePlan } from "./plan-types.js";

package/dist/plan-digest.js

@@ -1,116 +0,0 @@
-export const sha256 = (value) => createHash("sha256").update(value, "utf8").digest("hex");
-export function hashWorkspacePlan(plan) {
-    const files = normalizePlanFiles(plan.files).map((file) => ({
-        relPath: file.relPath,
-        ...(file.root === "workspace" ? {} : { root: file.root }),
-        mode: file.mode,
-        contentSha256: sha256(file.content),
-        // Ownership decides whether re-application may replace the file, so two
-        // plans identical in bytes but different here behave differently in the
-        // same workspace — the digest a receipt proves must say which one ran.
-        ownership: file.ownership,
-        ...(file.secretSlots.length === 0
-            ? {}
-            : {
-                secretSlots: [...file.secretSlots].sort((left, right) => compareStrings(JSON.stringify(left.path), JSON.stringify(right.path))),
-            }),
-    }));
-    const env = Object.fromEntries(Object.entries(plan.env)
-        .sort(([a], [b]) => compareStrings(a, b))
-        .map(([name, value]) => [
-        name,
-        typeof value === "string"
-            ? value
-            : agentProfileSecretRefSchema.parse(value),
-    ]));
-    const unsupported = [...plan.unsupported].sort((a, b) => compareStrings(`${a.dimension}\0${a.reason}`, `${b.dimension}\0${b.reason}`));
-    // A plan that needs an extension is not the same plan as one that does not, even when every
-    // byte it writes is identical — the digest is what a receipt proves, so it must say so.
-    const requires = [...(plan.requires ?? [])].sort((a, b) => compareStrings(`${a.kind}\0${a.id}`, `${b.kind}\0${b.id}`));
-    const canonical = JSON.stringify({
-        harness: plan.harness,
-        files,
-        env,
-        flags: plan.flags.map(normalizeWorkspacePlanArgument),
-        ...promptIntentFields(plan, samePromptIntentValue),
-        // A plan that owes a launcher a replacement is not the same plan as one
-        // that owes nothing, even when every byte it writes is identical.
-        ...systemPromptBindingField(plan),
-        unsupported,
-        ...(requires.length === 0 ? {} : { requires }),
-    });
-    return `sha256:${sha256(canonical)}`;
-}
-/**
- * Candidate material records prompt intents as public values only: a secret
- * reference there would put credential identity into sealed evidence.
- */
-function publicPromptValue(value) {
-    if (value.kind !== "public") {
-        throw new Error("Candidate plan material accepts public prompt values only");
-    }
-    return { kind: "public", value: value.value };
-}
-/** Build the exact digest-free identity document required by agent-interface. */
-export function agentCandidateProfilePlanMaterial(plan) {
-    const files = normalizePlanFiles(plan.files);
-    const materialFiles = files.map((file) => ({
-        relPath: file.relPath,
-        mode: file.mode,
-        contentSha256: `sha256:${sha256(file.content)}`,
-        ...(file.root === "agent" ? { root: "agent" } : {}),
-    }));
-    const material = {
-        sourceProfileDigest: plan.sourceProfileDigest,
-        harness: plan.harness,
-        // Interface 1 has the same candidate material shape without the optional
-        // root field. Keep the local file model richer, then validate against the
-        // installed peer schema at the compatibility boundary.
-        files: materialFiles,
-        env: Object.fromEntries(Object.entries(plan.env).sort(([left], [right]) => compareStrings(left, right))),
-        flags: [...plan.flags],
-        ...promptIntentFields(plan, publicPromptValue),
-        unsupported: [...plan.unsupported].sort((left, right) => compareStrings(`${left.dimension}\0${left.reason}`, `${right.dimension}\0${right.reason}`)),
-    };
-    const hasAgentRoot = materialFiles.some((file) => file.root === "agent");
-    if (!hasAgentRoot) {
-        return agentCandidateProfilePlanMaterialSchema.parse(material);
-    }
-    const parsed = agentCandidateProfilePlanMaterialSchema.safeParse(material);
-    if (!parsed.success) {
-        throw new Error("Agent-root candidate evidence requires @tangle-network/agent-interface >=2.1.1; " +
-            'the installed peer schema cannot preserve root:"agent". Upgrade the peer before applying this candidate plan.');
-    }
-    return parsed.data;
-}
-/**
- * Return the RFC 8785 UTF-8 bytes and SHA-256 identity of a candidate profile
- * plan. The returned bytes are the exact bytes embedded in receipt evidence.
- */
-export function canonicalizeAgentCandidateProfilePlan(plan) {
-    const material = agentCandidateProfilePlanMaterial(plan);
-    const bytes = canonicalCandidateBytes(material);
-    const digest = canonicalCandidateDigest(material);
-    return { material, bytes, digest };
-}
-/** Capture portable evidence of the exact canonical profile-plan bytes. */
-export function captureAgentCandidateProfilePlan(plan) {
-    const canonical = canonicalizeAgentCandidateProfilePlan(plan);
-    const artifact = {
-        encoding: "base64",
-        content: Buffer.from(canonical.bytes).toString("base64"),
-        sha256: canonical.digest,
-        byteLength: canonical.bytes.byteLength,
-    };
-    return agentCandidateProfilePlanEvidenceSchema.parse({
-        kind: "agent-profile-workspace-plan",
-        digest: canonical.digest,
-        material: canonical.material,
-        artifact,
-    });
-}
-import { createHash } from "node:crypto";
-import { agentCandidateProfilePlanEvidenceSchema, agentCandidateProfilePlanMaterialSchema, agentProfileSecretRefSchema, canonicalCandidateBytes, canonicalCandidateDigest, } from "@tangle-network/agent-interface";
-import { normalizePlanFiles, normalizeWorkspacePlanArgument, } from "./plan-normalize.js";
-import { promptIntentFields, samePromptIntentValue, systemPromptBindingField, } from "./plan-prompt.js";
-import { compareStrings } from "./workspace-files.js";

package/dist/plan-json.d.ts

@@ -1,13 +0,0 @@
-export declare const tomlStr: (s: string) => string;
-export interface SerializedPlanFileContent {
-    content: string;
-    secretSlots?: PlanFileSecretSlot[];
-}
-export type AddPlanFile = (path: string, content: string | SerializedPlanFileContent, mode?: number) => void;
-export declare function workspacePlanConfigValue(value: AgentProfileConfigValue): WorkspacePlanConfigValue;
-export declare function serializeWorkspacePlanJson(value: unknown): SerializedPlanFileContent;
-export declare function concatWorkspacePlanArguments(...values: WorkspacePlanArgument[]): WorkspacePlanArgument;
-export declare function joinWorkspacePlanArguments(values: WorkspacePlanArgument[], separator: string): WorkspacePlanArgument;
-export declare function tomlProfileConfigValue(value: AgentProfileConfigValue): WorkspacePlanArgument;
-import type { AgentProfileConfigValue } from "@tangle-network/agent-interface";
-import type { PlanFileSecretSlot, WorkspacePlanArgument, WorkspacePlanConfigValue } from "./plan-types.js";

package/dist/plan-json.js

@@ -1,91 +0,0 @@
-export const tomlStr = (s) => JSON.stringify(s); // valid TOML basic string
-function isProfilePublicConfigValue(value) {
-    return (typeof value === "object" &&
-        value !== null &&
-        !Array.isArray(value) &&
-        value.kind === "public" &&
-        typeof value.value === "string");
-}
-function isProfileSecretRef(value) {
-    return (typeof value === "object" &&
-        value !== null &&
-        !Array.isArray(value) &&
-        value.kind === "secret-ref" &&
-        typeof value.key === "string");
-}
-export function workspacePlanConfigValue(value) {
-    return isProfilePublicConfigValue(value) ? value.value : { ...value };
-}
-export function serializeWorkspacePlanJson(value) {
-    const secretSlots = [];
-    const lower = (current, path, arrayEntry = false) => {
-        if (isProfilePublicConfigValue(current))
-            return current.value;
-        if (isProfileSecretRef(current)) {
-            secretSlots.push({ path: [...path], ref: { ...current } });
-            return null;
-        }
-        if (Array.isArray(current)) {
-            return current.map((entry, index) => lower(entry, [...path, index], true));
-        }
-        if (current && typeof current === "object") {
-            const output = Object.create(null);
-            for (const [key, entry] of Object.entries(current)) {
-                const lowered = lower(entry, [...path, key]);
-                if (lowered !== undefined) {
-                    Object.defineProperty(output, key, {
-                        value: lowered,
-                        enumerable: true,
-                        configurable: true,
-                        writable: true,
-                    });
-                }
-            }
-            return output;
-        }
-        return current === undefined && arrayEntry ? null : current;
-    };
-    const content = JSON.stringify(lower(value, []), null, 2);
-    if (content === undefined) {
-        throw new Error("Generated profile JSON must have a serializable root");
-    }
-    return {
-        content,
-        ...(secretSlots.length === 0 ? {} : { secretSlots }),
-    };
-}
-function workspacePlanArgumentSegments(value) {
-    return typeof value === "string" ? [value] : [...value.segments];
-}
-export function concatWorkspacePlanArguments(...values) {
-    const segments = values.flatMap(workspacePlanArgumentSegments);
-    if (segments.every((segment) => typeof segment === "string")) {
-        return segments.join("");
-    }
-    return { kind: "workspace-plan-argument-template", segments };
-}
-export function joinWorkspacePlanArguments(values, separator) {
-    if (values.length === 0)
-        return "";
-    const joined = [];
-    for (const [index, value] of values.entries()) {
-        if (index > 0)
-            joined.push(separator);
-        joined.push(value);
-    }
-    return concatWorkspacePlanArguments(...joined);
-}
-export function tomlProfileConfigValue(value) {
-    if (isProfilePublicConfigValue(value))
-        return tomlStr(value.value);
-    return {
-        kind: "workspace-plan-argument-template",
-        segments: [
-            {
-                kind: "secret",
-                ref: { ...value },
-                encoding: "json-string",
-            },
-        ],
-    };
-}

package/dist/plan-normalize.d.ts

@@ -1,12 +0,0 @@
-export declare function mergeJsonFiles(files: PlanFile[]): PlanFile[];
-export interface NormalizedPlanFile {
-    relPath: string;
-    content: string;
-    root: PlanFileRoot;
-    mode: number;
-    ownership: NonNullable<PlanFile["ownership"]>;
-    secretSlots: PlanFileSecretSlot[];
-}
-export declare function normalizePlanFiles(files: PlanFile[]): NormalizedPlanFile[];
-export declare function normalizeWorkspacePlanArgument(value: WorkspacePlanArgument): WorkspacePlanArgument;
-import type { PlanFile, PlanFileRoot, PlanFileSecretSlot, WorkspacePlanArgument } from "./plan-types.js";

package/dist/plan-normalize.js

@@ -1,168 +0,0 @@
-export function mergeJsonFiles(files) {
-    const byPath = new Map();
-    for (const f of files) {
-        const root = normalizePlanFileRoot(f.root);
-        const identity = `${root}\0${f.relPath}`;
-        const prev = byPath.get(identity);
-        if (!prev) {
-            byPath.set(identity, f);
-            continue;
-        }
-        if (f.relPath.endsWith(".json")) {
-            try {
-                const next = JSON.parse(f.content);
-                const merged = {
-                    ...JSON.parse(prev.content),
-                    ...next,
-                };
-                const replacedRoots = new Set(Object.keys(next));
-                const secretSlots = [
-                    ...(prev.secretSlots ?? []).filter((slot) => typeof slot.path[0] === "string" &&
-                        !replacedRoots.has(slot.path[0])),
-                    ...(f.secretSlots ?? []),
-                ];
-                const { secretSlots: _previousSecretSlots, ...previousFile } = prev;
-                byPath.set(identity, {
-                    ...previousFile,
-                    content: JSON.stringify(merged, null, 2),
-                    ...(secretSlots.length > 0 ? { mode: PRIVATE_FILE_MODE } : {}),
-                    ...(secretSlots.length === 0 ? {} : { secretSlots }),
-                });
-                continue;
-            }
-            catch {
-                /* fall through to last-wins */
-            }
-        }
-        byPath.set(identity, f); // non-JSON or parse-fail: last wins
-    }
-    return [...byPath.values()];
-}
-function normalizePlanFileRoot(root) {
-    if (root === undefined || root === "workspace")
-        return "workspace";
-    if (root === "agent")
-        return root;
-    throw new Error(`Unsupported workspace plan file root: ${String(root)}`);
-}
-function valueAtJsonPath(root, path) {
-    let current = root;
-    for (const segment of path) {
-        if (current === null ||
-            typeof current !== "object" ||
-            !Object.hasOwn(current, segment)) {
-            return undefined;
-        }
-        current = current[segment];
-    }
-    return current;
-}
-function normalizePlanFileSecretSlots(file) {
-    if (file.secretSlots === undefined)
-        return [];
-    if (file.source !== "generated" ||
-        !file.relPath.endsWith(".json") ||
-        file.secretSlots.length === 0) {
-        throw new Error(`Workspace secret slots require a generated JSON file: ${file.relPath}`);
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(file.content);
-    }
-    catch {
-        throw new Error(`Workspace secret slots require valid JSON content: ${file.relPath}`);
-    }
-    const seen = new Set();
-    return file.secretSlots.map((slot) => {
-        if (!Array.isArray(slot.path) || slot.path.length === 0) {
-            throw new Error(`Workspace secret slot path must be non-empty: ${file.relPath}`);
-        }
-        const path = slot.path.map((segment) => {
-            if ((typeof segment !== "string" && typeof segment !== "number") ||
-                (typeof segment === "number" &&
-                    (!Number.isSafeInteger(segment) || segment < 0))) {
-                throw new Error(`Workspace secret slot path is invalid: ${file.relPath}`);
-            }
-            return segment;
-        });
-        const identity = JSON.stringify(path);
-        if (seen.has(identity)) {
-            throw new Error(`Duplicate workspace secret slot path: ${file.relPath} ${identity}`);
-        }
-        seen.add(identity);
-        if (valueAtJsonPath(parsed, path) !== null) {
-            throw new Error(`Workspace secret slot must point at a null placeholder: ${file.relPath} ${identity}`);
-        }
-        return {
-            path,
-            ref: agentProfileSecretRefSchema.parse(slot.ref),
-        };
-    });
-}
-export function normalizePlanFiles(files) {
-    const seen = new Set();
-    return files
-        .map((file) => {
-        const root = normalizePlanFileRoot(file.root);
-        const relPath = normalizeWorkspaceRelativePath(file.relPath);
-        const identity = `${root}\0${relPath}`;
-        if (seen.has(identity)) {
-            throw new Error(`Duplicate ${root} plan file: ${relPath}`);
-        }
-        seen.add(identity);
-        if (typeof file.content !== "string") {
-            throw new Error(`Workspace file content must be a string: ${relPath}`);
-        }
-        const mode = validateFileMode(file.mode);
-        const secretSlots = normalizePlanFileSecretSlots(file);
-        if (secretSlots.length > 0 && (mode & 0o077) !== 0) {
-            throw new Error(`Workspace secret-bearing file must not grant group or other access: ${relPath}`);
-        }
-        return {
-            relPath,
-            content: file.content,
-            root,
-            mode,
-            ownership: file.ownership ?? "shared",
-            secretSlots,
-        };
-    })
-        .sort((a, b) => compareStrings(`${a.root}\0${a.relPath}`, `${b.root}\0${b.relPath}`));
-}
-export function normalizeWorkspacePlanArgument(value) {
-    if (typeof value === "string")
-        return value;
-    if (value.kind !== "workspace-plan-argument-template" ||
-        !Array.isArray(value.segments) ||
-        value.segments.length === 0) {
-        throw new Error("Workspace plan argument template is malformed");
-    }
-    const segments = [];
-    for (const segment of value.segments) {
-        if (typeof segment === "string") {
-            const previous = segments.at(-1);
-            if (typeof previous === "string") {
-                segments[segments.length - 1] = previous + segment;
-            }
-            else if (segment.length > 0) {
-                segments.push(segment);
-            }
-            continue;
-        }
-        if (segment.kind !== "secret" ||
-            (segment.encoding !== "raw" && segment.encoding !== "json-string")) {
-            throw new Error("Workspace plan secret argument segment is malformed");
-        }
-        segments.push({
-            kind: "secret",
-            ref: agentProfileSecretRefSchema.parse(segment.ref),
-            encoding: segment.encoding,
-        });
-    }
-    if (segments.every((segment) => typeof segment === "string")) {
-        return segments.join("");
-    }
-    return { kind: "workspace-plan-argument-template", segments };
-}
-import { agentProfileSecretRefSchema } from "@tangle-network/agent-interface";
-import { compareStrings, normalizeWorkspaceRelativePath, PRIVATE_FILE_MODE, validateFileMode, } from "./workspace-files.js";

package/dist/plan-prompt.d.ts

@@ -1,38 +0,0 @@
-export declare function promptIntentFields<In, Out>(source: {
-    systemPrompt?: In;
-    appendSystemPrompt?: In;
-}, project: (value: In) => Out): {
-    systemPrompt?: Out;
-    appendSystemPrompt?: Out;
-};
-/** Identity projection for boundaries that pass the prompt intents through. */
-export declare const samePromptIntentValue: <T>(value: T) => T;
-/**
- * The launcher-bound intent, projected onto an outgoing object and omitted when
- * the source does not carry one.
- *
- * Beside {@link promptIntentFields} rather than inside it, because the two
- * disagree on both ends: the candidate boundaries that helper also serves have
- * no field for a binding — an {@link AgentCandidateWorkspacePlan} is built by a
- * caller that declares none, so it can never hold one — and a value projection
- * such as `candidatePublicString` has nothing to do to a structured binding.
- * Every boundary that carries the plan's own prompt intents calls both.
- */
-export declare function systemPromptBindingField(source: {
-    systemPromptBinding?: WorkspacePlanSystemPromptBinding;
-}): {
-    systemPromptBinding?: WorkspacePlanSystemPromptBinding;
-};
-/**
- * The replacement text this launcher must bind to `control`, or `undefined`
- * when the plan carries no launcher-bound intent.
- *
- * Throws for a binding addressed to a DIFFERENT control: the reader cannot
- * execute it, and answering `undefined` would start the agent with the
- * harness's own prompt still in force while nothing reported a problem — the
- * silent downgrade the binding exists to prevent. This is the seam where an
- * executor that cannot bind an intent says so, by name, instead of running a
- * profile whose prompt never took effect.
- */
-export declare function takeSystemPromptBinding(spawn: Pick<WorkspacePlanSpawnInputs, "systemPromptBinding">, control: ExecutorSystemPromptBinding): string | undefined;
-import type { ExecutorSystemPromptBinding, WorkspacePlanSpawnInputs, WorkspacePlanSystemPromptBinding } from "./plan-types.js";

package/dist/plan-prompt.js

@@ -1,49 +0,0 @@
-export function promptIntentFields(source, project) {
-    return {
-        ...(source.systemPrompt === undefined
-            ? {}
-            : { systemPrompt: project(source.systemPrompt) }),
-        ...(source.appendSystemPrompt === undefined
-            ? {}
-            : { appendSystemPrompt: project(source.appendSystemPrompt) }),
-    };
-}
-/** Identity projection for boundaries that pass the prompt intents through. */
-export const samePromptIntentValue = (value) => value;
-/**
- * The launcher-bound intent, projected onto an outgoing object and omitted when
- * the source does not carry one.
- *
- * Beside {@link promptIntentFields} rather than inside it, because the two
- * disagree on both ends: the candidate boundaries that helper also serves have
- * no field for a binding — an {@link AgentCandidateWorkspacePlan} is built by a
- * caller that declares none, so it can never hold one — and a value projection
- * such as `candidatePublicString` has nothing to do to a structured binding.
- * Every boundary that carries the plan's own prompt intents calls both.
- */
-export function systemPromptBindingField(source) {
-    return source.systemPromptBinding === undefined
-        ? {}
-        : { systemPromptBinding: { ...source.systemPromptBinding } };
-}
-/**
- * The replacement text this launcher must bind to `control`, or `undefined`
- * when the plan carries no launcher-bound intent.
- *
- * Throws for a binding addressed to a DIFFERENT control: the reader cannot
- * execute it, and answering `undefined` would start the agent with the
- * harness's own prompt still in force while nothing reported a problem — the
- * silent downgrade the binding exists to prevent. This is the seam where an
- * executor that cannot bind an intent says so, by name, instead of running a
- * profile whose prompt never took effect.
- */
-export function takeSystemPromptBinding(spawn, control) {
-    const binding = spawn.systemPromptBinding;
-    if (!binding)
-        return undefined;
-    if (binding.control !== control) {
-        throw new Error(`Workspace plan carries a system-prompt ${binding.intent} bound to ` +
-            `${binding.control}, which this executor cannot apply; it binds ${control}`);
-    }
-    return binding.systemPrompt;
-}

package/dist/plan-support.d.ts

@@ -1,9 +0,0 @@
-import type { Unsupported, WorkspacePlan } from "./plan-types.js";
-export declare function formatUnsupported(unsupported: Unsupported[]): string;
-/** Fail when a profile asks for controls the chosen harness cannot execute. */
-export declare function assertWorkspacePlanSupported(plan: Pick<WorkspacePlan, "unsupported">): void;
-/**
- * Enforce supportability under the profile's failOnError policy.
- * Strict mode throws; best-effort mode returns visible warnings.
- */
-export declare function enforceWorkspacePlanSupport(plan: Pick<WorkspacePlan, "unsupported">, failOnError: boolean | undefined): string[];

package/dist/plan-support.js

@@ -1,22 +0,0 @@
-export function formatUnsupported(unsupported) {
-    return `Unable to materialize ${unsupported.length} profile resource(s):\n${unsupported
-        .map(({ dimension, reason }) => `- ${dimension}: ${reason}`)
-        .join("\n")}`;
-}
-/** Fail when a profile asks for controls the chosen harness cannot execute. */
-export function assertWorkspacePlanSupported(plan) {
-    if (plan.unsupported.length > 0) {
-        throw new Error(formatUnsupported(plan.unsupported));
-    }
-}
-/**
- * Enforce supportability under the profile's failOnError policy.
- * Strict mode throws; best-effort mode returns visible warnings.
- */
-export function enforceWorkspacePlanSupport(plan, failOnError) {
-    if (failOnError !== false) {
-        assertWorkspacePlanSupported(plan);
-        return [];
-    }
-    return plan.unsupported.map(({ dimension, reason }) => `${dimension}: ${reason}`);
-}