@tangle-network/agent-runtime 0.102.0 → 0.102.1

package/dist/{chunk-TGDHHHH4.js → chunk-LJLG734E.js}

@@ -1,3 +1,9 @@
+import {
+  assertNoProtectedBytes,
+  createProtectedRecordRedactor,
+  redactProtectedReason,
+  redactProtectedValue
+} from "./chunk-UPWGXKXB.js";
 import {
   contentAddress
 } from "./chunk-IMSNJSXH.js";
@@ -2839,7 +2845,7 @@ function requireRecord(value, label) {
 }
 
 // src/candidate-execution/finalize.ts
-import { isLlmSpan as isLlmSpan2, REDACTION_VERSION as REDACTION_VERSION2 } from "@tangle-network/agent-eval";
+import { isLlmSpan as isLlmSpan2, REDACTION_VERSION } from "@tangle-network/agent-eval";
 import {
   agentCandidateRunReceiptSchema,
   agentCandidateWorkspaceSnapshotEvidenceSchema
@@ -3067,253 +3073,6 @@ function safeAdd(left, right, label) {
   return total;
 }
 
-// src/candidate-execution/protected-redaction.ts
-import { createHmac, randomBytes as randomBytes2 } from "crypto";
-import {
-  DEFAULT_REDACTION_RULES,
-  REDACTION_VERSION,
-  redactString
-} from "@tangle-network/agent-eval";
-function createProtectedRecordRedactor(protectedValues) {
-  const identityKey = randomBytes2(32);
-  const aggregate = {
-    version: REDACTION_VERSION,
-    redactionCount: 0,
-    byRule: {}
-  };
-  const mergeReport = (report) => {
-    aggregate.version = report.version;
-    aggregate.redactionCount += report.redactionCount;
-    for (const [rule, count] of Object.entries(report.byRule)) {
-      aggregate.byRule[rule] = (aggregate.byRule[rule] ?? 0) + count;
-    }
-  };
-  const redactScalar = (value, record) => {
-    const redacted = redactProtectedValue(value, protectedValues);
-    if (record) mergeReport(redacted.report);
-    return redacted.value;
-  };
-  const identifier = (value, record) => {
-    const redacted = redactScalar(value, record);
-    if (redacted === value) return value;
-    const digest = createHmac("sha256", identityKey).update(value).digest("hex");
-    return `${redacted}:hmac-sha256:${digest}`;
-  };
-  const transform = (value, record) => {
-    const transformed = transformProtectedRecord(
-      value,
-      void 0,
-      record,
-      redactScalar,
-      identifier
-    );
-    assertNoProtectedEvidence(transformed, protectedValues);
-    return transformed;
-  };
-  return Object.freeze({
-    record: (value) => transform(value, true),
-    query: (value) => transform(value, false),
-    identifier: (value) => identifier(value, false),
-    traceIdentity: (trace) => transform(trace, false),
-    report: () => ({
-      version: aggregate.version,
-      redactionCount: aggregate.redactionCount,
-      byRule: { ...aggregate.byRule }
-    })
-  });
-}
-function redactProtectedValue(value, protectedValues) {
-  const report = {
-    version: REDACTION_VERSION,
-    redactionCount: 0,
-    byRule: {}
-  };
-  const rules = protectedRedactionRules(protectedValues);
-  const redacted = redactNode(value, protectedValues, rules, report);
-  assertNoProtectedEvidence(redacted, protectedValues);
-  return { value: redacted, report };
-}
-function redactProtectedReason(reason, protectedValues) {
-  try {
-    return redactProtectedValue(reason, protectedValues).value;
-  } catch {
-    return "candidate execution failed with a protected error";
-  }
-}
-function assertNoProtectedEvidence(value, protectedValues) {
-  if (value instanceof Uint8Array) {
-    assertNoProtectedBytes(value, protectedValues);
-    return;
-  }
-  if (typeof value === "string") {
-    for (const protectedValue of protectedValueVariants(protectedValues)) {
-      if (value.includes(protectedValue)) {
-        throw new Error("protected value survived candidate evidence redaction");
-      }
-    }
-    if (decodedBase64ContainsProtectedValue(value, protectedValues)) {
-      throw new Error("base64 protected value survived candidate evidence redaction");
-    }
-    return;
-  }
-  if (Array.isArray(value)) {
-    for (const entry of value) assertNoProtectedEvidence(entry, protectedValues);
-    return;
-  }
-  if (value && typeof value === "object") {
-    for (const [key, entry] of Object.entries(value)) {
-      assertNoProtectedEvidence(key, protectedValues);
-      assertNoProtectedEvidence(entry, protectedValues);
-    }
-  }
-}
-function assertNoProtectedBytes(bytes, protectedValues) {
-  if (containsProtectedBytes(bytes, protectedValues)) {
-    throw new Error("protected value survived candidate evidence byte redaction");
-  }
-}
-function redactNode(value, protectedValues, rules, report) {
-  if (value instanceof Uint8Array) {
-    if (containsProtectedBytes(value, protectedValues)) {
-      recordRedaction(report, "candidate-access-binary", 1);
-      return Uint8Array.from(Buffer.from("[redacted:candidate-access-binary]", "utf8"));
-    }
-    return Uint8Array.from(value);
-  }
-  if (typeof value === "string") {
-    if (decodedBase64ContainsProtectedValue(value, protectedValues)) {
-      recordRedaction(report, "candidate-access-binary", 1);
-      return "[redacted:candidate-access-binary]";
-    }
-    const redacted = redactString(value, [...rules]);
-    for (const [rule, count] of Object.entries(redacted.report.byRule)) {
-      recordRedaction(report, rule, count);
-    }
-    return redacted.output;
-  }
-  if (Array.isArray(value)) {
-    return value.map((entry) => redactNode(entry, protectedValues, rules, report));
-  }
-  if (value && typeof value === "object") {
-    const entries = [];
-    const seenKeys = /* @__PURE__ */ new Set();
-    for (const [key, entry] of Object.entries(value)) {
-      const redactedKey = redactNode(key, protectedValues, rules, report);
-      if (typeof redactedKey !== "string" || seenKeys.has(redactedKey)) {
-        throw new Error("protected evidence redaction produced an ambiguous object key");
-      }
-      seenKeys.add(redactedKey);
-      entries.push([redactedKey, redactNode(entry, protectedValues, rules, report)]);
-    }
-    return Object.fromEntries(entries);
-  }
-  return value;
-}
-function transformProtectedRecord(value, fieldName, record, redactScalar, redactIdentifier) {
-  if (value instanceof Uint8Array) return redactScalar(value, record);
-  if (typeof value === "string") {
-    return fieldName && isIdentifierFieldName(fieldName) ? redactIdentifier(value, record) : redactScalar(value, record);
-  }
-  if (Array.isArray(value)) {
-    return value.map(
-      (entry) => transformProtectedRecord(entry, fieldName, record, redactScalar, redactIdentifier)
-    );
-  }
-  if (!value || typeof value !== "object") return value;
-  if (fieldName === "tags") {
-    return transformTagMap(value, record, redactScalar, redactIdentifier);
-  }
-  if (fieldName === "tag") {
-    return transformTagFilter(value, record, redactScalar, redactIdentifier);
-  }
-  const entries = [];
-  const seenKeys = /* @__PURE__ */ new Set();
-  for (const [key, entry] of Object.entries(value)) {
-    const redactedKey = redactScalar(key, record);
-    if (seenKeys.has(redactedKey)) {
-      throw new Error("protected evidence redaction produced an ambiguous object key");
-    }
-    seenKeys.add(redactedKey);
-    entries.push([
-      redactedKey,
-      transformProtectedRecord(entry, key, record, redactScalar, redactIdentifier)
-    ]);
-  }
-  return Object.fromEntries(entries);
-}
-function transformTagMap(value, record, redactScalar, redactIdentifier) {
-  const entries = [];
-  const seenKeys = /* @__PURE__ */ new Set();
-  for (const [key, entry] of Object.entries(value)) {
-    const redactedKey = redactIdentifier(key, record);
-    if (seenKeys.has(redactedKey)) {
-      throw new Error("protected evidence redaction produced an ambiguous trace tag");
-    }
-    seenKeys.add(redactedKey);
-    entries.push([
-      redactedKey,
-      typeof entry === "string" ? redactIdentifier(entry, record) : transformProtectedRecord(entry, key, record, redactScalar, redactIdentifier)
-    ]);
-  }
-  return Object.fromEntries(entries);
-}
-function transformTagFilter(value, record, redactScalar, redactIdentifier) {
-  const output = {};
-  for (const [key, entry] of Object.entries(value)) {
-    const redactedKey = redactScalar(key, record);
-    output[redactedKey] = (key === "key" || key === "value") && typeof entry === "string" ? redactIdentifier(entry, record) : transformProtectedRecord(entry, key, record, redactScalar, redactIdentifier);
-  }
-  return output;
-}
-function isIdentifierFieldName(name) {
-  return /ids?$/i.test(name);
-}
-function protectedRedactionRules(protectedValues) {
-  const exactRules = protectedValueVariants(protectedValues).sort((left, right) => right.length - left.length || left.localeCompare(right)).map((value, index) => ({
-    id: `candidate-access-${index}`,
-    pattern: new RegExp(escapeRegularExpression(value), "g"),
-    replacement: "[redacted:candidate-access]"
-  }));
-  return [...exactRules, ...DEFAULT_REDACTION_RULES];
-}
-function recordRedaction(report, rule, count) {
-  if (count <= 0) return;
-  report.redactionCount += count;
-  report.byRule[rule] = (report.byRule[rule] ?? 0) + count;
-}
-function containsProtectedBytes(bytes, protectedValues) {
-  const source = Buffer.from(bytes);
-  return protectedValueVariants(protectedValues).some(
-    (value) => source.includes(Buffer.from(value, "utf8"))
-  );
-}
-function decodedBase64ContainsProtectedValue(value, protectedValues) {
-  if (value.length < 4 || value.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/.test(value)) {
-    return false;
-  }
-  try {
-    return containsProtectedBytes(Buffer.from(value, "base64"), protectedValues);
-  } catch {
-    return false;
-  }
-}
-function protectedValueVariants(protectedValues) {
-  const variants = /* @__PURE__ */ new Set();
-  for (const value of normalizedProtectedValues(protectedValues)) {
-    variants.add(value);
-    variants.add(Buffer.from(value, "utf8").toString("base64"));
-    variants.add(Buffer.from(value, "utf8").toString("base64url"));
-    variants.add(encodeURIComponent(value));
-  }
-  return [...variants];
-}
-function normalizedProtectedValues(values) {
-  return [...new Set(values.filter((value) => value.length > 0))];
-}
-function escapeRegularExpression(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-
 // src/candidate-execution/finalize.ts
 async function finalizeAgentCandidateRun(state, capture, traceStore, traceIdentity, settlement, evidence, protectedValues, writeRedactionReport, signal) {
   let termination;
@@ -3361,7 +3120,7 @@ async function finalizeAgentCandidateRun(state, capture, traceStore, traceIdenti
     );
     const redacted = redactProtectedValue(
       {
-        run: { ...run, redactionVersion: REDACTION_VERSION2 },
+        run: { ...run, redactionVersion: REDACTION_VERSION },
         spans: orderedSpans,
         events: orderedEvents,
         budget: orderedBudget,
@@ -3377,7 +3136,7 @@ async function finalizeAgentCandidateRun(state, capture, traceStore, traceIdenti
       ...redacted.value,
       evaluatorLimits: { resultTimeoutMs: state.resultTimeoutMs },
       redaction: {
-        version: REDACTION_VERSION2,
+        version: REDACTION_VERSION,
         redactionCount: (writeRedactionReport?.redactionCount ?? 0) + redacted.report.redactionCount,
         byRule: combinedByRule
       }
@@ -4971,7 +4730,7 @@ var CandidateExecutionDeadlineError = class extends Error {
 };
 
 // src/candidate-execution/prepare.ts
-import { randomBytes as randomBytes3 } from "crypto";
+import { randomBytes as randomBytes2 } from "crypto";
 import { lstat as lstat2, readdir as readdir2 } from "fs/promises";
 import { isAbsolute, posix as posix2, relative as relative2, resolve as resolveHostPath } from "path";
 import {
@@ -5097,7 +4856,7 @@ async function prepareAgentCandidateExecution(candidate, task, ports, options =
   const profileActivation = profileApplication.profileActivation;
   const container = await resolveContainer(candidate, task, ports);
   const resolvedModel = await resolveModel(candidate, task, ports);
-  const preparationId = `candidate-preparation.${randomBytes3(32).toString("base64url")}`;
+  const preparationId = `candidate-preparation.${randomBytes2(32).toString("base64url")}`;
   const reservationExpiresAtMs = Date.now() + Math.max(MIN_RESERVATION_TTL_MS, reservationWindowMs);
   const modelReservation = await withinCandidateCleanupDeadline(
     () => ports.models.reserveGrant({
@@ -5815,4 +5574,4 @@ export {
   executePreparedAgentCandidate,
   prepareAgentCandidateExecution
 };
-//# sourceMappingURL=chunk-TGDHHHH4.js.map
+//# sourceMappingURL=chunk-LJLG734E.js.map