@tangle-network/agent-runtime 0.104.0 → 0.106.0

package/dist/protected-redaction--F3v1oo8.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protected-redaction--F3v1oo8.js","names":[],"sources":["../src/candidate-execution/protected-redaction.ts"],"sourcesContent":["import { createHmac, randomBytes } from 'node:crypto'\n\nimport {\n  DEFAULT_REDACTION_RULES,\n  REDACTION_VERSION,\n  type RedactionRule,\n  redactString,\n} from '@tangle-network/agent-eval'\n\nexport interface ProtectedRedactionReport {\n  version: string\n  redactionCount: number\n  byRule: Record<string, number>\n}\n\nexport interface ProtectedTraceIdentity {\n  readonly runId: string\n  readonly tags: Readonly<Record<string, string>>\n}\n\nexport interface ProtectedRecordRedactor {\n  record<T>(value: T): T\n  query<T>(value: T): T\n  identifier(value: string): string\n  traceIdentity(trace: ProtectedTraceIdentity): ProtectedTraceIdentity\n  report(): ProtectedRedactionReport\n}\n\n/** Create one execution-local namespace for identifiers changed by redaction. */\nexport function createProtectedRecordRedactor(\n  protectedValues: readonly string[],\n): ProtectedRecordRedactor {\n  const identityKey = randomBytes(32)\n  const aggregate: ProtectedRedactionReport = {\n    version: REDACTION_VERSION,\n    redactionCount: 0,\n    byRule: {},\n  }\n\n  const mergeReport = (report: ProtectedRedactionReport): void => {\n    aggregate.version = report.version\n    aggregate.redactionCount += report.redactionCount\n    for (const [rule, count] of Object.entries(report.byRule)) {\n      aggregate.byRule[rule] = (aggregate.byRule[rule] ?? 0) + count\n    }\n  }\n\n  const redactScalar = <T>(value: T, record: boolean): T => {\n    const redacted = redactProtectedValue(value, protectedValues)\n    if (record) mergeReport(redacted.report)\n    return redacted.value\n  }\n\n  const identifier = (value: string, record: boolean): string => {\n    const redacted = redactScalar(value, record)\n    if (redacted === value) return value\n    const digest = createHmac('sha256', identityKey).update(value).digest('hex')\n    return `${redacted}:hmac-sha256:${digest}`\n  }\n\n  const transform = <T>(value: T, record: boolean): T => {\n    const transformed = transformProtectedRecord(\n      value,\n      undefined,\n      record,\n      redactScalar,\n      identifier,\n    ) as T\n    assertNoProtectedEvidence(transformed, protectedValues)\n    return transformed\n  }\n\n  return Object.freeze({\n    record: <T>(value: T): T => transform(value, true),\n    query: <T>(value: T): T => transform(value, false),\n    identifier: (value: string): string => identifier(value, false),\n    traceIdentity: (trace: ProtectedTraceIdentity): ProtectedTraceIdentity =>\n      transform(trace, false),\n    report: (): ProtectedRedactionReport => ({\n      version: aggregate.version,\n      redactionCount: aggregate.redactionCount,\n      byRule: { ...aggregate.byRule },\n    }),\n  })\n}\n\n/** Redact protected values at the first persistence boundary, including object keys and bytes. */\nexport function redactProtectedValue<T>(\n  value: T,\n  protectedValues: readonly string[],\n): { value: T; report: ProtectedRedactionReport } {\n  const report: ProtectedRedactionReport = {\n    version: REDACTION_VERSION,\n    redactionCount: 0,\n    byRule: {},\n  }\n  const rules = protectedRedactionRules(protectedValues)\n  const redacted = redactNode(value, protectedValues, rules, report) as T\n  assertNoProtectedEvidence(redacted, protectedValues)\n  return { value: redacted, report }\n}\n\nexport function redactProtectedReason(reason: string, protectedValues: readonly string[]): string {\n  try {\n    return redactProtectedValue(reason, protectedValues).value\n  } catch {\n    return 'candidate execution failed with a protected error'\n  }\n}\n\nexport function assertNoProtectedEvidence(\n  value: unknown,\n  protectedValues: readonly string[],\n): void {\n  if (value instanceof Uint8Array) {\n    assertNoProtectedBytes(value, protectedValues)\n    return\n  }\n  if (typeof value === 'string') {\n    for (const protectedValue of protectedValueVariants(protectedValues)) {\n      if (value.includes(protectedValue)) {\n        throw new Error('protected value survived candidate evidence redaction')\n      }\n    }\n    if (decodedBase64ContainsProtectedValue(value, protectedValues)) {\n      throw new Error('base64 protected value survived candidate evidence redaction')\n    }\n    return\n  }\n  if (Array.isArray(value)) {\n    for (const entry of value) assertNoProtectedEvidence(entry, protectedValues)\n    return\n  }\n  if (value && typeof value === 'object') {\n    for (const [key, entry] of Object.entries(value)) {\n      assertNoProtectedEvidence(key, protectedValues)\n      assertNoProtectedEvidence(entry, protectedValues)\n    }\n  }\n}\n\nexport function assertNoProtectedBytes(\n  bytes: Uint8Array,\n  protectedValues: readonly string[],\n): void {\n  if (containsProtectedBytes(bytes, protectedValues)) {\n    throw new Error('protected value survived candidate evidence byte redaction')\n  }\n}\n\nfunction redactNode(\n  value: unknown,\n  protectedValues: readonly string[],\n  rules: readonly RedactionRule[],\n  report: ProtectedRedactionReport,\n): unknown {\n  if (value instanceof Uint8Array) {\n    if (containsProtectedBytes(value, protectedValues)) {\n      recordRedaction(report, 'candidate-access-binary', 1)\n      return Uint8Array.from(Buffer.from('[redacted:candidate-access-binary]', 'utf8'))\n    }\n    return Uint8Array.from(value)\n  }\n  if (typeof value === 'string') {\n    if (decodedBase64ContainsProtectedValue(value, protectedValues)) {\n      recordRedaction(report, 'candidate-access-binary', 1)\n      return '[redacted:candidate-access-binary]'\n    }\n    const redacted = redactString(value, [...rules])\n    for (const [rule, count] of Object.entries(redacted.report.byRule)) {\n      recordRedaction(report, rule, count)\n    }\n    return redacted.output\n  }\n  if (Array.isArray(value)) {\n    return value.map((entry) => redactNode(entry, protectedValues, rules, report))\n  }\n  if (value && typeof value === 'object') {\n    const entries: Array<[string, unknown]> = []\n    const seenKeys = new Set<string>()\n    for (const [key, entry] of Object.entries(value)) {\n      const redactedKey = redactNode(key, protectedValues, rules, report)\n      if (typeof redactedKey !== 'string' || seenKeys.has(redactedKey)) {\n        throw new Error('protected evidence redaction produced an ambiguous object key')\n      }\n      seenKeys.add(redactedKey)\n      entries.push([redactedKey, redactNode(entry, protectedValues, rules, report)])\n    }\n    return Object.fromEntries(entries)\n  }\n  return value\n}\n\nfunction transformProtectedRecord(\n  value: unknown,\n  fieldName: string | undefined,\n  record: boolean,\n  redactScalar: <T>(value: T, record: boolean) => T,\n  redactIdentifier: (value: string, record: boolean) => string,\n): unknown {\n  if (value instanceof Uint8Array) return redactScalar(value, record)\n  if (typeof value === 'string') {\n    return fieldName && isIdentifierFieldName(fieldName)\n      ? redactIdentifier(value, record)\n      : redactScalar(value, record)\n  }\n  if (Array.isArray(value)) {\n    return value.map((entry) =>\n      transformProtectedRecord(entry, fieldName, record, redactScalar, redactIdentifier),\n    )\n  }\n  if (!value || typeof value !== 'object') return value\n\n  if (fieldName === 'tags') {\n    return transformTagMap(value, record, redactScalar, redactIdentifier)\n  }\n  if (fieldName === 'tag') {\n    return transformTagFilter(value, record, redactScalar, redactIdentifier)\n  }\n\n  const entries: Array<[string, unknown]> = []\n  const seenKeys = new Set<string>()\n  for (const [key, entry] of Object.entries(value)) {\n    const redactedKey = redactScalar(key, record)\n    if (seenKeys.has(redactedKey)) {\n      throw new Error('protected evidence redaction produced an ambiguous object key')\n    }\n    seenKeys.add(redactedKey)\n    entries.push([\n      redactedKey,\n      transformProtectedRecord(entry, key, record, redactScalar, redactIdentifier),\n    ])\n  }\n  return Object.fromEntries(entries)\n}\n\nfunction transformTagMap(\n  value: object,\n  record: boolean,\n  redactScalar: <T>(value: T, record: boolean) => T,\n  redactIdentifier: (value: string, record: boolean) => string,\n): Record<string, unknown> {\n  const entries: Array<[string, unknown]> = []\n  const seenKeys = new Set<string>()\n  for (const [key, entry] of Object.entries(value)) {\n    const redactedKey = redactIdentifier(key, record)\n    if (seenKeys.has(redactedKey)) {\n      throw new Error('protected evidence redaction produced an ambiguous trace tag')\n    }\n    seenKeys.add(redactedKey)\n    entries.push([\n      redactedKey,\n      typeof entry === 'string'\n        ? redactIdentifier(entry, record)\n        : transformProtectedRecord(entry, key, record, redactScalar, redactIdentifier),\n    ])\n  }\n  return Object.fromEntries(entries)\n}\n\nfunction transformTagFilter(\n  value: object,\n  record: boolean,\n  redactScalar: <T>(value: T, record: boolean) => T,\n  redactIdentifier: (value: string, record: boolean) => string,\n): Record<string, unknown> {\n  const output: Record<string, unknown> = {}\n  for (const [key, entry] of Object.entries(value)) {\n    const redactedKey = redactScalar(key, record)\n    output[redactedKey] =\n      (key === 'key' || key === 'value') && typeof entry === 'string'\n        ? redactIdentifier(entry, record)\n        : transformProtectedRecord(entry, key, record, redactScalar, redactIdentifier)\n  }\n  return output\n}\n\nfunction isIdentifierFieldName(name: string): boolean {\n  return /ids?$/i.test(name)\n}\n\nfunction protectedRedactionRules(protectedValues: readonly string[]): RedactionRule[] {\n  const exactRules = protectedValueVariants(protectedValues)\n    .sort((left, right) => right.length - left.length || left.localeCompare(right))\n    .map((value, index) => ({\n      id: `candidate-access-${index}`,\n      pattern: new RegExp(escapeRegularExpression(value), 'g'),\n      replacement: '[redacted:candidate-access]',\n    }))\n  return [...exactRules, ...DEFAULT_REDACTION_RULES]\n}\n\nfunction recordRedaction(report: ProtectedRedactionReport, rule: string, count: number): void {\n  if (count <= 0) return\n  report.redactionCount += count\n  report.byRule[rule] = (report.byRule[rule] ?? 0) + count\n}\n\nfunction containsProtectedBytes(bytes: Uint8Array, protectedValues: readonly string[]): boolean {\n  const source = Buffer.from(bytes)\n  return protectedValueVariants(protectedValues).some((value) =>\n    source.includes(Buffer.from(value, 'utf8')),\n  )\n}\n\nfunction decodedBase64ContainsProtectedValue(\n  value: string,\n  protectedValues: readonly string[],\n): boolean {\n  if (value.length < 4 || value.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/.test(value)) {\n    return false\n  }\n  try {\n    return containsProtectedBytes(Buffer.from(value, 'base64'), protectedValues)\n  } catch {\n    return false\n  }\n}\n\nfunction protectedValueVariants(protectedValues: readonly string[]): string[] {\n  const variants = new Set<string>()\n  for (const value of normalizedProtectedValues(protectedValues)) {\n    variants.add(value)\n    variants.add(Buffer.from(value, 'utf8').toString('base64'))\n    variants.add(Buffer.from(value, 'utf8').toString('base64url'))\n    variants.add(encodeURIComponent(value))\n  }\n  return [...variants]\n}\n\nfunction normalizedProtectedValues(values: readonly string[]): string[] {\n  return [...new Set(values.filter((value) => value.length > 0))]\n}\n\nfunction escapeRegularExpression(value: string): string {\n  return value.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')\n}\n"],"mappings":";;;;AA6BA,SAAgB,8BACd,iBACyB;CACzB,MAAM,cAAc,YAAY,EAAE;CAClC,MAAM,YAAsC;EAC1C,SAAS;EACT,gBAAgB;EAChB,QAAQ,CAAC;CACX;CAEA,MAAM,eAAe,WAA2C;EAC9D,UAAU,UAAU,OAAO;EAC3B,UAAU,kBAAkB,OAAO;EACnC,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,OAAO,MAAM,GACtD,UAAU,OAAO,SAAS,UAAU,OAAO,SAAS,KAAK;CAE7D;CAEA,MAAM,gBAAmB,OAAU,WAAuB;EACxD,MAAM,WAAW,qBAAqB,OAAO,eAAe;EAC5D,IAAI,QAAQ,YAAY,SAAS,MAAM;EACvC,OAAO,SAAS;CAClB;CAEA,MAAM,cAAc,OAAe,WAA4B;EAC7D,MAAM,WAAW,aAAa,OAAO,MAAM;EAC3C,IAAI,aAAa,OAAO,OAAO;EAE/B,OAAO,GAAG,SAAS,eADJ,WAAW,UAAU,WAAW,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAC/B;CACzC;CAEA,MAAM,aAAgB,OAAU,WAAuB;EACrD,MAAM,cAAc,yBAClB,OACA,KAAA,GACA,QACA,cACA,UACF;EACA,0BAA0B,aAAa,eAAe;EACtD,OAAO;CACT;CAEA,OAAO,OAAO,OAAO;EACnB,SAAY,UAAgB,UAAU,OAAO,IAAI;EACjD,QAAW,UAAgB,UAAU,OAAO,KAAK;EACjD,aAAa,UAA0B,WAAW,OAAO,KAAK;EAC9D,gBAAgB,UACd,UAAU,OAAO,KAAK;EACxB,eAAyC;GACvC,SAAS,UAAU;GACnB,gBAAgB,UAAU;GAC1B,QAAQ,EAAE,GAAG,UAAU,OAAO;EAChC;CACF,CAAC;AACH;;AAGA,SAAgB,qBACd,OACA,iBACgD;CAChD,MAAM,SAAmC;EACvC,SAAS;EACT,gBAAgB;EAChB,QAAQ,CAAC;CACX;CAEA,MAAM,WAAW,WAAW,OAAO,iBADrB,wBAAwB,eACkB,GAAG,MAAM;CACjE,0BAA0B,UAAU,eAAe;CACnD,OAAO;EAAE,OAAO;EAAU;CAAO;AACnC;AAEA,SAAgB,sBAAsB,QAAgB,iBAA4C;CAChG,IAAI;EACF,OAAO,qBAAqB,QAAQ,eAAe,CAAC,CAAC;CACvD,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAgB,0BACd,OACA,iBACM;CACN,IAAI,iBAAiB,YAAY;EAC/B,uBAAuB,OAAO,eAAe;EAC7C;CACF;CACA,IAAI,OAAO,UAAU,UAAU;EAC7B,KAAK,MAAM,kBAAkB,uBAAuB,eAAe,GACjE,IAAI,MAAM,SAAS,cAAc,GAC/B,MAAM,IAAI,MAAM,uDAAuD;EAG3E,IAAI,oCAAoC,OAAO,eAAe,GAC5D,MAAM,IAAI,MAAM,8DAA8D;EAEhF;CACF;CACA,IAAI,MAAM,QAAQ,KAAK,GAAG;EACxB,KAAK,MAAM,SAAS,OAAO,0BAA0B,OAAO,eAAe;EAC3E;CACF;CACA,IAAI,SAAS,OAAO,UAAU,UAC5B,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;EAChD,0BAA0B,KAAK,eAAe;EAC9C,0BAA0B,OAAO,eAAe;CAClD;AAEJ;AAEA,SAAgB,uBACd,OACA,iBACM;CACN,IAAI,uBAAuB,OAAO,eAAe,GAC/C,MAAM,IAAI,MAAM,4DAA4D;AAEhF;AAEA,SAAS,WACP,OACA,iBACA,OACA,QACS;CACT,IAAI,iBAAiB,YAAY;EAC/B,IAAI,uBAAuB,OAAO,eAAe,GAAG;GAClD,gBAAgB,QAAQ,2BAA2B,CAAC;GACpD,OAAO,WAAW,KAAK,OAAO,KAAK,sCAAsC,MAAM,CAAC;EAClF;EACA,OAAO,WAAW,KAAK,KAAK;CAC9B;CACA,IAAI,OAAO,UAAU,UAAU;EAC7B,IAAI,oCAAoC,OAAO,eAAe,GAAG;GAC/D,gBAAgB,QAAQ,2BAA2B,CAAC;GACpD,OAAO;EACT;EACA,MAAM,WAAW,aAAa,OAAO,CAAC,GAAG,KAAK,CAAC;EAC/C,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,SAAS,OAAO,MAAM,GAC/D,gBAAgB,QAAQ,MAAM,KAAK;EAErC,OAAO,SAAS;CAClB;CACA,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,MAAM,KAAK,UAAU,WAAW,OAAO,iBAAiB,OAAO,MAAM,CAAC;CAE/E,IAAI,SAAS,OAAO,UAAU,UAAU;EACtC,MAAM,UAAoC,CAAC;EAC3C,MAAM,2BAAW,IAAI,IAAY;EACjC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;GAChD,MAAM,cAAc,WAAW,KAAK,iBAAiB,OAAO,MAAM;GAClE,IAAI,OAAO,gBAAgB,YAAY,SAAS,IAAI,WAAW,GAC7D,MAAM,IAAI,MAAM,+DAA+D;GAEjF,SAAS,IAAI,WAAW;GACxB,QAAQ,KAAK,CAAC,aAAa,WAAW,OAAO,iBAAiB,OAAO,MAAM,CAAC,CAAC;EAC/E;EACA,OAAO,OAAO,YAAY,OAAO;CACnC;CACA,OAAO;AACT;AAEA,SAAS,yBACP,OACA,WACA,QACA,cACA,kBACS;CACT,IAAI,iBAAiB,YAAY,OAAO,aAAa,OAAO,MAAM;CAClE,IAAI,OAAO,UAAU,UACnB,OAAO,aAAa,sBAAsB,SAAS,IAC/C,iBAAiB,OAAO,MAAM,IAC9B,aAAa,OAAO,MAAM;CAEhC,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,MAAM,KAAK,UAChB,yBAAyB,OAAO,WAAW,QAAQ,cAAc,gBAAgB,CACnF;CAEF,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO;CAEhD,IAAI,cAAc,QAChB,OAAO,gBAAgB,OAAO,QAAQ,cAAc,gBAAgB;CAEtE,IAAI,cAAc,OAChB,OAAO,mBAAmB,OAAO,QAAQ,cAAc,gBAAgB;CAGzE,MAAM,UAAoC,CAAC;CAC3C,MAAM,2BAAW,IAAI,IAAY;CACjC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;EAChD,MAAM,cAAc,aAAa,KAAK,MAAM;EAC5C,IAAI,SAAS,IAAI,WAAW,GAC1B,MAAM,IAAI,MAAM,+DAA+D;EAEjF,SAAS,IAAI,WAAW;EACxB,QAAQ,KAAK,CACX,aACA,yBAAyB,OAAO,KAAK,QAAQ,cAAc,gBAAgB,CAC7E,CAAC;CACH;CACA,OAAO,OAAO,YAAY,OAAO;AACnC;AAEA,SAAS,gBACP,OACA,QACA,cACA,kBACyB;CACzB,MAAM,UAAoC,CAAC;CAC3C,MAAM,2BAAW,IAAI,IAAY;CACjC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;EAChD,MAAM,cAAc,iBAAiB,KAAK,MAAM;EAChD,IAAI,SAAS,IAAI,WAAW,GAC1B,MAAM,IAAI,MAAM,8DAA8D;EAEhF,SAAS,IAAI,WAAW;EACxB,QAAQ,KAAK,CACX,aACA,OAAO,UAAU,WACb,iBAAiB,OAAO,MAAM,IAC9B,yBAAyB,OAAO,KAAK,QAAQ,cAAc,gBAAgB,CACjF,CAAC;CACH;CACA,OAAO,OAAO,YAAY,OAAO;AACnC;AAEA,SAAS,mBACP,OACA,QACA,cACA,kBACyB;CACzB,MAAM,SAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;EAChD,MAAM,cAAc,aAAa,KAAK,MAAM;EAC5C,OAAO,gBACJ,QAAQ,SAAS,QAAQ,YAAY,OAAO,UAAU,WACnD,iBAAiB,OAAO,MAAM,IAC9B,yBAAyB,OAAO,KAAK,QAAQ,cAAc,gBAAgB;CACnF;CACA,OAAO;AACT;AAEA,SAAS,sBAAsB,MAAuB;CACpD,OAAO,SAAS,KAAK,IAAI;AAC3B;AAEA,SAAS,wBAAwB,iBAAqD;CAQpF,OAAO,CAAC,GAPW,uBAAuB,eAAe,CAAC,CACvD,MAAM,MAAM,UAAU,MAAM,SAAS,KAAK,UAAU,KAAK,cAAc,KAAK,CAAC,CAAC,CAC9E,KAAK,OAAO,WAAW;EACtB,IAAI,oBAAoB;EACxB,SAAS,IAAI,OAAO,wBAAwB,KAAK,GAAG,GAAG;EACvD,aAAa;CACf,EACkB,GAAG,GAAG,uBAAuB;AACnD;AAEA,SAAS,gBAAgB,QAAkC,MAAc,OAAqB;CAC5F,IAAI,SAAS,GAAG;CAChB,OAAO,kBAAkB;CACzB,OAAO,OAAO,SAAS,OAAO,OAAO,SAAS,KAAK;AACrD;AAEA,SAAS,uBAAuB,OAAmB,iBAA6C;CAC9F,MAAM,SAAS,OAAO,KAAK,KAAK;CAChC,OAAO,uBAAuB,eAAe,CAAC,CAAC,MAAM,UACnD,OAAO,SAAS,OAAO,KAAK,OAAO,MAAM,CAAC,CAC5C;AACF;AAEA,SAAS,oCACP,OACA,iBACS;CACT,IAAI,MAAM,SAAS,KAAK,MAAM,SAAS,MAAM,KAAK,CAAC,yBAAyB,KAAK,KAAK,GACpF,OAAO;CAET,IAAI;EACF,OAAO,uBAAuB,OAAO,KAAK,OAAO,QAAQ,GAAG,eAAe;CAC7E,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,uBAAuB,iBAA8C;CAC5E,MAAM,2BAAW,IAAI,IAAY;CACjC,KAAK,MAAM,SAAS,0BAA0B,eAAe,GAAG;EAC9D,SAAS,IAAI,KAAK;EAClB,SAAS,IAAI,OAAO,KAAK,OAAO,MAAM,CAAC,CAAC,SAAS,QAAQ,CAAC;EAC1D,SAAS,IAAI,OAAO,KAAK,OAAO,MAAM,CAAC,CAAC,SAAS,WAAW,CAAC;EAC7D,SAAS,IAAI,mBAAmB,KAAK,CAAC;CACxC;CACA,OAAO,CAAC,GAAG,QAAQ;AACrB;AAEA,SAAS,0BAA0B,QAAqC;CACtE,OAAO,CAAC,GAAG,IAAI,IAAI,OAAO,QAAQ,UAAU,MAAM,SAAS,CAAC,CAAC,CAAC;AAChE;AAEA,SAAS,wBAAwB,OAAuB;CACtD,OAAO,MAAM,QAAQ,uBAAuB,MAAM;AACpD"}

package/dist/redact-D-u-rrcn.js

@@ -0,0 +1,82 @@
+//#region src/redact.ts
+const redactedMarker = "[redacted]";
+/** Secret-bearing key names: when an object key matches, its value is fully
+*  replaced regardless of the value's own content. Lowercased compare. */
+const secretKeyPattern = /(api[-_]?key|secret|token|password|passwd|authorization|auth|private[-_]?key|credential|access[-_]?key|client[-_]?secret|session[-_]?(id|token)|cookie|bearer)/i;
+/** In-value secret/PII patterns scrubbed from any string, regardless of key. */
+const valuePatterns = [
+	/\bBearer\s+[A-Za-z0-9._\-+/=]{8,}/gi,
+	/\b(?:sk|pk|rk|ak)[-_][A-Za-z0-9_-]{12,}/g,
+	/\bgh[pousr]_[A-Za-z0-9]{20,}/g,
+	/\bAKIA[0-9A-Z]{16}\b/g,
+	/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+	/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g
+];
+/** Secret assignments embedded inside an otherwise opaque string, including
+* serialized JSON and log-style `key=value` text. */
+const secretAssignmentPattern = /((?:"|')?(?:api[-_]?key|secret|token|password|passwd|authorization|auth|private[-_]?key|credential|access[-_]?key|client[-_]?secret|session[-_]?(?:id|token)|cookie|bearer)(?:"|')?\s*[:=]\s*)(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\s,;}]+)/gi;
+/** Scrub a single string of in-value secret/PII patterns. */
+function scrubString(input) {
+	let out = input;
+	for (const pattern of valuePatterns) out = out.replace(pattern, redactedMarker);
+	return out.replace(secretAssignmentPattern, `$1${redactedMarker}`);
+}
+/**
+* The built-in redactor. Walks objects and arrays; replaces values under
+* secret-bearing keys wholesale; scrubs in-value patterns from every string.
+* Cycle-safe (a seen-set short-circuits self-referential payloads to
+* `'[circular]'`), depth-bounded, and total — never throws on customer input.
+*/
+function defaultRedactor(value) {
+	return walk(value, /* @__PURE__ */ new WeakSet(), 0);
+}
+const maxDepth = 32;
+function walk(value, seen, depth) {
+	if (depth > maxDepth) return "[truncated]";
+	if (typeof value === "string") return scrubString(value);
+	if (value === null || typeof value !== "object") return value;
+	if (seen.has(value)) return "[circular]";
+	seen.add(value);
+	if (Array.isArray(value)) return value.map((item) => walk(item, seen, depth + 1));
+	const out = {};
+	for (const [key, v] of Object.entries(value)) {
+		if (secretKeyPattern.test(key)) {
+			out[key] = redactedMarker;
+			continue;
+		}
+		out[key] = walk(v, seen, depth + 1);
+	}
+	return out;
+}
+/** Stable identity input for saved work that depends on built-in redaction behavior. */
+function defaultRedactorIdentityMaterial() {
+	const patternIdentity = (pattern) => ({
+		source: pattern.source,
+		flags: pattern.flags
+	});
+	return {
+		marker: redactedMarker,
+		secretKeyPattern: patternIdentity(secretKeyPattern),
+		valuePatterns: valuePatterns.map(patternIdentity),
+		secretAssignmentPattern: patternIdentity(secretAssignmentPattern),
+		maxDepth,
+		scrubString: Function.prototype.toString.call(scrubString),
+		walk: Function.prototype.toString.call(walk),
+		defaultRedactor: Function.prototype.toString.call(defaultRedactor)
+	};
+}
+/**
+* Resolve the redactor a client uses. A caller-supplied hook handles
+* domain-specific values first, then the built-in scrubber still removes
+* common credentials and email addresses. Returning `false` is the explicit
+* opt-out for already-reviewed public values.
+*/
+function resolveRedactor(redact) {
+	if (redact === false) return (value) => value;
+	if (!redact) return defaultRedactor;
+	return (value) => defaultRedactor(redact(value));
+}
+//#endregion
+export { defaultRedactorIdentityMaterial as n, resolveRedactor as r, defaultRedactor as t };
+
+//# sourceMappingURL=redact-D-u-rrcn.js.map

package/dist/redact-D-u-rrcn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-D-u-rrcn.js","names":[],"sources":["../src/redact.ts"],"sourcesContent":["/**\n *\n * Redaction for values that may leave the Runtime process. The default scrubs\n * common leak classes (API keys, bearer tokens, emails, private keys) from\n * strings and walks nested objects and arrays. A customer with domain-specific\n * PII supplies their own `redact` hook.\n *\n * This is intentionally narrower than `src/sanitize.ts` (which redacts the\n * runtime's *event envelope* field-by-field): here the value is opaque\n * customer payload, so the scrub is value-shaped, not schema-shaped.\n *\n * @experimental\n */\n\n/** A redactor maps an arbitrary trace value to a safe-to-export value. Pure;\n *  must not throw on cyclic input (the default tolerates cycles). */\nexport type Redactor = (value: unknown) => unknown\n\nconst redactedMarker = '[redacted]'\n\n/** Secret-bearing key names: when an object key matches, its value is fully\n *  replaced regardless of the value's own content. Lowercased compare. */\nconst secretKeyPattern =\n  /(api[-_]?key|secret|token|password|passwd|authorization|auth|private[-_]?key|credential|access[-_]?key|client[-_]?secret|session[-_]?(id|token)|cookie|bearer)/i\n\n/** In-value secret/PII patterns scrubbed from any string, regardless of key. */\nconst valuePatterns: ReadonlyArray<RegExp> = [\n  // Bearer tokens.\n  /\\bBearer\\s+[A-Za-z0-9._\\-+/=]{8,}/gi,\n  // Provider-style API keys (sk-..., sk-tan-..., pk_live_..., ghp_...).\n  /\\b(?:sk|pk|rk|ak)[-_][A-Za-z0-9_-]{12,}/g,\n  /\\bgh[pousr]_[A-Za-z0-9]{20,}/g,\n  // AWS access key ids.\n  /\\bAKIA[0-9A-Z]{16}\\b/g,\n  // PEM private-key blocks.\n  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\\s\\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,\n  // Email addresses.\n  /\\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}\\b/g,\n]\n\n/** Secret assignments embedded inside an otherwise opaque string, including\n * serialized JSON and log-style `key=value` text. */\nconst secretAssignmentPattern =\n  /((?:\"|')?(?:api[-_]?key|secret|token|password|passwd|authorization|auth|private[-_]?key|credential|access[-_]?key|client[-_]?secret|session[-_]?(?:id|token)|cookie|bearer)(?:\"|')?\\s*[:=]\\s*)(?:\"(?:\\\\.|[^\"\\\\])*\"|'(?:\\\\.|[^'\\\\])*'|[^\\s,;}]+)/gi\n\n/** Scrub a single string of in-value secret/PII patterns. */\nfunction scrubString(input: string): string {\n  let out = input\n  for (const pattern of valuePatterns) {\n    out = out.replace(pattern, redactedMarker)\n  }\n  return out.replace(secretAssignmentPattern, `$1${redactedMarker}`)\n}\n\n/**\n * The built-in redactor. Walks objects and arrays; replaces values under\n * secret-bearing keys wholesale; scrubs in-value patterns from every string.\n * Cycle-safe (a seen-set short-circuits self-referential payloads to\n * `'[circular]'`), depth-bounded, and total — never throws on customer input.\n */\nexport function defaultRedactor(value: unknown): unknown {\n  return walk(value, new WeakSet(), 0)\n}\n\nconst maxDepth = 32\n\nfunction walk(value: unknown, seen: WeakSet<object>, depth: number): unknown {\n  if (depth > maxDepth) return '[truncated]'\n  if (typeof value === 'string') return scrubString(value)\n  if (value === null || typeof value !== 'object') return value\n  if (seen.has(value)) return '[circular]'\n  seen.add(value)\n\n  if (Array.isArray(value)) {\n    return value.map((item) => walk(item, seen, depth + 1))\n  }\n\n  const out: Record<string, unknown> = {}\n  for (const [key, v] of Object.entries(value as Record<string, unknown>)) {\n    if (secretKeyPattern.test(key)) {\n      out[key] = redactedMarker\n      continue\n    }\n    out[key] = walk(v, seen, depth + 1)\n  }\n  return out\n}\n\n/** Stable identity input for saved work that depends on built-in redaction behavior. */\nexport function defaultRedactorIdentityMaterial(): unknown {\n  const patternIdentity = (pattern: RegExp) => ({\n    source: pattern.source,\n    flags: pattern.flags,\n  })\n  return {\n    marker: redactedMarker,\n    secretKeyPattern: patternIdentity(secretKeyPattern),\n    valuePatterns: valuePatterns.map(patternIdentity),\n    secretAssignmentPattern: patternIdentity(secretAssignmentPattern),\n    maxDepth,\n    scrubString: Function.prototype.toString.call(scrubString),\n    walk: Function.prototype.toString.call(walk),\n    defaultRedactor: Function.prototype.toString.call(defaultRedactor),\n  }\n}\n\n/**\n * Resolve the redactor a client uses. A caller-supplied hook handles\n * domain-specific values first, then the built-in scrubber still removes\n * common credentials and email addresses. Returning `false` is the explicit\n * opt-out for already-reviewed public values.\n */\nexport function resolveRedactor(redact: Redactor | false | undefined): Redactor {\n  if (redact === false) return (value) => value\n  if (!redact) return defaultRedactor\n  return (value) => defaultRedactor(redact(value))\n}\n"],"mappings":";AAkBA,MAAM,iBAAiB;;;AAIvB,MAAM,mBACJ;;AAGF,MAAM,gBAAuC;CAE3C;CAEA;CACA;CAEA;CAEA;CAEA;AACF;;;AAIA,MAAM,0BACJ;;AAGF,SAAS,YAAY,OAAuB;CAC1C,IAAI,MAAM;CACV,KAAK,MAAM,WAAW,eACpB,MAAM,IAAI,QAAQ,SAAS,cAAc;CAE3C,OAAO,IAAI,QAAQ,yBAAyB,KAAK,gBAAgB;AACnE;;;;;;;AAQA,SAAgB,gBAAgB,OAAyB;CACvD,OAAO,KAAK,uBAAO,IAAI,QAAQ,GAAG,CAAC;AACrC;AAEA,MAAM,WAAW;AAEjB,SAAS,KAAK,OAAgB,MAAuB,OAAwB;CAC3E,IAAI,QAAQ,UAAU,OAAO;CAC7B,IAAI,OAAO,UAAU,UAAU,OAAO,YAAY,KAAK;CACvD,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU,OAAO;CACxD,IAAI,KAAK,IAAI,KAAK,GAAG,OAAO;CAC5B,KAAK,IAAI,KAAK;CAEd,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,MAAM,KAAK,SAAS,KAAK,MAAM,MAAM,QAAQ,CAAC,CAAC;CAGxD,MAAM,MAA+B,CAAC;CACtC,KAAK,MAAM,CAAC,KAAK,MAAM,OAAO,QAAQ,KAAgC,GAAG;EACvE,IAAI,iBAAiB,KAAK,GAAG,GAAG;GAC9B,IAAI,OAAO;GACX;EACF;EACA,IAAI,OAAO,KAAK,GAAG,MAAM,QAAQ,CAAC;CACpC;CACA,OAAO;AACT;;AAGA,SAAgB,kCAA2C;CACzD,MAAM,mBAAmB,aAAqB;EAC5C,QAAQ,QAAQ;EAChB,OAAO,QAAQ;CACjB;CACA,OAAO;EACL,QAAQ;EACR,kBAAkB,gBAAgB,gBAAgB;EAClD,eAAe,cAAc,IAAI,eAAe;EAChD,yBAAyB,gBAAgB,uBAAuB;EAChE;EACA,aAAa,SAAS,UAAU,SAAS,KAAK,WAAW;EACzD,MAAM,SAAS,UAAU,SAAS,KAAK,IAAI;EAC3C,iBAAiB,SAAS,UAAU,SAAS,KAAK,eAAe;CACnE;AACF;;;;;;;AAQA,SAAgB,gBAAgB,QAAgD;CAC9E,IAAI,WAAW,OAAO,QAAQ,UAAU;CACxC,IAAI,CAAC,QAAQ,OAAO;CACpB,QAAQ,UAAU,gBAAgB,OAAO,KAAK,CAAC;AACjD"}

package/dist/redact-kbIOjfjM.d.ts

@@ -0,0 +1,452 @@
+import { a as LocalHarnessResult, c as runLocalHarness, i as LocalHarness, r as CodexTokenUsage, t as CodexExecutionEvidence } from "./local-harness-Dh8PJ0ot.js";
+import { AnalystFinding, CostLedgerHandle, MaximumCharge } from "@tangle-network/agent-eval";
+import { CompareOptimizationMethodsOptions, LabeledScenarioStore, OptimizationMethod, OptimizationMethodComparison, WorktreeAdapter } from "@tangle-network/agent-eval/campaign";
+import { AgentProfile as AgentProfile$1, ReasoningEffort, Sha256Digest } from "@tangle-network/agent-interface";
+import { MutableSurface, Scenario as Scenario$1, SelfImproveBudget, SelfImproveOptions, SelfImproveResult } from "@tangle-network/agent-eval/contract";
+//#region src/improvement/improvement-driver.d.ts
+/** The byte-producing seam — the ONE thing that differs between the cheap
+ *  reflective path and the full agentic path. A generator makes (uncommitted)
+ *  changes inside `worktreePath`; the driver commits them via the worktree
+ *  adapter's `finalize`. */
+interface CandidateGenerator {
+  kind: string;
+  /** Whether this generator can produce a candidate from an EMPTY findings set
+   *  and no phase-2 report — i.e. it draws its change signal from the repo and
+   *  the raw-trace filesystem context on disk, not only from pre-summarized
+   *  findings. An agentic coder (`agenticGenerator`) sets this: the seed repo +
+   *  raw traces ARE the signal, so it must still run the full `populationSize`
+   *  when the distiller yielded nothing (this is the meta-harness contract — the
+   *  agent diagnoses from the raw traces itself). A patch-applier
+   *  (`reflectiveGenerator`) leaves it unset — with no findings there is no
+   *  patch to draft, so the driver short-circuits rather than spin up worktrees
+   *  for a guaranteed no-op. Default `false`. */
+  proposesWithoutFindings?: boolean;
+  generate(args: {
+    /** The candidate worktree — a clean checkout of the current incumbent. */
+    worktreePath: string;
+    /** Phase-2 research report (analyst findings + diff), opaque. */
+    report: unknown;
+    /** Findings resolved from the report or the loop context. */
+    findings: AnalystFinding[];
+    /** Handle to all captured data, to ground the change. */
+    dataset?: LabeledScenarioStore;
+    /** DEPTH: max iterations the generator may take (agentic uses this; the
+     *  reflective generator ignores it). */
+    maxShots: number;
+    signal: AbortSignal;
+    /** Generation coordinates supplied by Runtime's internal code candidate driver. */
+    generation?: number;
+    candidateIndex?: number;
+    /** Shared run-wide paid-call account supplied by agent-eval 0.117+. */
+    costLedger?: CostLedgerHandle;
+    /** Receipt attribution phase supplied alongside `costLedger`. */
+    costPhase?: string;
+  }): Promise<{
+    applied: boolean;
+    summary: string;
+    /** Short slug for the candidate. When present (with `rationale`), the
+     *  driver returns a `ProposedCandidate` wrapper so the label survives to
+     *  `GenerationRecord` and the emitted provenance. */
+    label?: string;
+    /** Why this change was proposed — bounded, derived from the findings the
+     *  shot addressed. Paired with `label`. */
+    rationale?: string;
+  }>;
+}
+//#endregion
+//#region src/improvement/agentic-generator.d.ts
+/** Dedicated ephemeral root for generic author-profile files. Every declared
+ * file must live below this root so cleanup cannot alter candidate-owned files. */
+declare const AGENTIC_PROFILE_RESOURCE_ROOT = ".agent-runtime-profile-resources";
+/** Outcome of verifying a candidate worktree. `feedback` (compiler errors,
+ *  failing test output) is fed into the next shot when `ok` is false. */
+interface VerifyResult {
+  ok: boolean;
+  feedback?: string;
+}
+/** Verifies the edited worktree. Sync or async; throws only on a setup fault
+ *  (a candidate that fails verification returns `{ok:false}`, it does not
+ *  throw). */
+type Verifier = (worktreePath: string, signal?: AbortSignal) => Promise<VerifyResult> | VerifyResult;
+interface AgenticGeneratorShotReceipt {
+  readonly generation: number | null;
+  readonly candidateIndex: number | null;
+  /** One-based shot number within this candidate. */
+  readonly shot: number;
+  readonly maxShots: number;
+  readonly harness: LocalHarness;
+  readonly model: string | null;
+  readonly reasoningEffort: ReasoningEffort | null;
+  readonly promptSha256: `sha256:${string}`;
+  readonly startedAt: string;
+  readonly completedAt: string;
+  readonly durationMs: number;
+  readonly exitCode: number | null;
+  readonly timedOut: boolean;
+  /** True when caller cancellation reached the author process; absent in older receipts. */
+  readonly aborted?: boolean;
+  readonly killedBySignal: NodeJS.Signals | null;
+  readonly stdoutBytes: number | null;
+  readonly stdoutSha256: `sha256:${string}` | null;
+  readonly stderrBytes: number | null;
+  readonly stderrSha256: `sha256:${string}` | null;
+  readonly usage: CodexTokenUsage | null;
+  /** Digest of the exact profile-file workspace plan applied for this shot. */
+  readonly profileWorkspacePlanDigest: string | null;
+  readonly profileWorkspaceFileCount: number;
+  /** Shared run-ledger call id for this exact shot. */
+  readonly costCallId: string | null;
+  /** Whether dollars came from the provider, the pricing table, or are unknown. */
+  readonly costBasis: 'provider-reported' | 'estimated-pricing' | 'unknown';
+  readonly costUsd: number | null;
+  /** True only for a provider-reported amount, never for a pricing estimate. */
+  readonly costUsdKnown: boolean;
+  readonly evidence: CodexExecutionEvidence | null;
+  readonly error: {
+    readonly name: string;
+    readonly message: string;
+  } | null;
+}
+/** Frozen exact harness result for an author shot: full streams, process state,
+ *  token usage, and execution-policy evidence.
+ *  The `onShotCompleted` callback receives `null` when execution failed before
+ *  the harness returned. */
+type AgenticGeneratorShotExecution = Readonly<Omit<LocalHarnessResult, 'usage' | 'evidence'> & {
+  readonly usage?: Readonly<CodexTokenUsage>;
+  readonly evidence?: Readonly<Omit<CodexExecutionEvidence, 'readDeniedPaths' | 'policy'>> & {
+    readonly readDeniedPaths: ReadonlyArray<string>;
+    readonly policy: Readonly<CodexExecutionEvidence['policy']>;
+  };
+}>;
+/** Worktree decision emitted before a completed shot is retried, accepted, or
+ *  discarded. The callback runs while `worktreePath` is still available, so
+ *  callers can persist the exact diff. */
+type AgenticGeneratorShotDisposition = {
+  readonly kind: 'clean';
+  readonly worktreePath: string;
+} | {
+  readonly kind: 'rejected';
+  readonly worktreePath: string;
+  readonly stage: 'raw-trace-evidence' | 'verification';
+  readonly feedback: string | null;
+} | {
+  readonly kind: 'accepted';
+  readonly worktreePath: string;
+  readonly verified: boolean;
+} | {
+  readonly kind: 'setup-error';
+  readonly worktreePath: string;
+  readonly stage: 'worktree-inspection' | 'raw-trace-evidence' | 'verification';
+  readonly error: {
+    readonly name: string;
+    readonly message: string;
+  };
+};
+interface AgenticGeneratorOptions {
+  /** Local coding harness to run in the worktree. Default `claude`. */
+  harness?: LocalHarness;
+  /** Author profile rendered through the canonical harness mapper. Required
+   *  for reproducible Codex so model and reasoning settings are explicit. */
+  profile?: AgentProfile$1;
+  /** Run Codex with isolated configuration, exact prompt evidence, and required
+   *  terminal token usage. Requires `harness: 'codex'` and `profile`. */
+  codexReproducible?: boolean;
+  /** Absolute paths reproducible Codex must not read. A function can derive
+   *  candidate-specific paths after the driver creates its worktree. */
+  codexReadDeniedPaths?: ReadonlyArray<string> | ((worktreePath: string) => ReadonlyArray<string>);
+  /** Awaited once for every attempted author shot, including process failures.
+   *  The second argument preserves the exact harness result, including stdout
+   *  and stderr, before worktree inspection or verification can reject the
+   *  shot. Throwing aborts the candidate so evidence persistence fails closed. */
+  onShotCompleted?: (receipt: AgenticGeneratorShotReceipt, execution: AgenticGeneratorShotExecution | null) => void | Promise<void>;
+  /** Awaited after worktree inspection and before the shot is accepted,
+   *  retried, or discarded. Throwing aborts the candidate. */
+  onShotDisposition?: (receipt: AgenticGeneratorShotReceipt, disposition: AgenticGeneratorShotDisposition) => void | Promise<void>;
+  /** Optional hard upper bound passed to the run-wide CostLedger before each
+   *  author shot. This MUST be enforced by the provider or executor; a planning
+   *  estimate is not an admissible bound. Omit for an uncapped ledger. A capped
+   *  ledger rejects before model dispatch when this is absent. */
+  maximumCharge?: MaximumCharge;
+  /** Per-shot wall-clock timeout (ms). Default = `runLocalHarness` default (5m). */
+  timeoutMs?: number;
+  /** Build the harness task prompt from the report + findings. Override for
+   *  domain phrasing; the default turns findings into a concrete coder task. */
+  buildPrompt?: (args: {
+    report: unknown;
+    findings: AnalystFinding[];
+  }) => string;
+  /** Verify the worktree after each dirtying shot. When set, a candidate that
+   *  fails verification is NOT returned — the failure feeds the next shot
+   *  (verify-in-session), up to `maxShots`; a candidate that never verifies is
+   *  discarded (`applied:false`), never shipped. Omitted ⇒ legacy behavior:
+   *  the first dirty shot is the candidate. See `commandVerifier`. */
+  verify?: Verifier;
+  /** Test seam — inject the harness runner (defaults to `runLocalHarness`). */
+  runHarness?: typeof runLocalHarness;
+  /** Test seam — inject the worktree-dirty check (defaults to `git status`). */
+  isDirty?: (worktreePath: string) => boolean;
+}
+/** Full-agentic `CandidateGenerator` (the `shots=N, sandbox=on` setting): run a real coding harness inside the candidate worktree so the agent makes the change in place. */
+declare function agenticGenerator(opts?: AgenticGeneratorOptions): CandidateGenerator;
+/** Turn the analyst's findings (+ optional report) into a concrete coder task —
+ *  the senior scientific-method framing shared with the tool/MCP build prompts. */
+declare function defaultBuildPrompt(args: {
+  report: unknown;
+  findings: AnalystFinding[];
+}): string;
+/** A `Verifier` that runs a command in the worktree: exit 0 ⇒ ok, any other
+ *  exit ⇒ failed with stdout+stderr as feedback. The common case — verify by
+ *  `tsc --noEmit`, `pnpm build`, or a test command. A timeout is treated as a
+ *  FAILED candidate (a change that hangs the build is a bad change); a missing
+ *  binary or spawn fault throws (a setup bug, not a failed candidate — no
+ *  silent fallback). */
+declare function commandVerifier(command: string, args?: string[], timeoutMs?: number): Verifier;
+//#endregion
+//#region src/improvement/profile-types.d.ts
+type DeepReadonly<T> = T extends ((...args: never[]) => unknown) ? T : T extends readonly (infer TItem)[] ? readonly DeepReadonly<TItem>[] : T extends object ? { readonly [TKey in keyof T]: DeepReadonly<T[TKey]>; } : T;
+/** Complete immutable profile value used during measured execution. */
+type ReadonlyAgentProfile = DeepReadonly<AgentProfile$1>;
+//#endregion
+//#region src/improvement/improve-types.d.ts
+/** The executable agent lever `improve` optimizes. Profile fields remain
+ * portable AgentProfile coordinates; implementation and orchestration files
+ * use the code surface so a winner can be sealed into an exact candidate.
+ * `rollout-policy` is the inference-time structuralRollout dials
+ * (`profile.extensions['structural-rollout']`). */
+type ImproveSurface = 'prompt' | 'skills' | 'tools' | 'mcp' | 'hooks' | 'subagents' | 'agent-profile' | 'memory' | 'code' | 'rollout-policy';
+type ImproveProfileSurface = Exclude<ImproveSurface, 'code'>;
+interface ImproveMethodContext {
+  /** Validated baseline profile. */
+  readonly profile: ReadonlyAgentProfile;
+  /** Runtime-derived identity for upstream optimizer resume state. */
+  readonly evaluationRef: Sha256Digest;
+  /** Exact profile coordinate being optimized. */
+  readonly surface: ImproveProfileSurface;
+  /** Exact bytes supplied to the optimization method. */
+  readonly baselineSurface: MutableSurface;
+  /** Structured value represented by `baselineSurface`, before serialization. */
+  readonly baselineValue: unknown;
+  /** Findings produced before this search, if any. */
+  readonly findings: readonly unknown[];
+}
+/** Build a complete method after trace findings are available. */
+type ImproveMethodFactory<TScenario extends Scenario$1, TArtifact> = (context: ImproveMethodContext) => OptimizationMethod<TScenario, TArtifact>;
+type ImproveMethodSource<TScenario extends Scenario$1, TArtifact> = OptimizationMethod<TScenario, TArtifact> | ImproveMethodFactory<TScenario, TArtifact>;
+/** Runs one exact materialized profile on one scenario. */
+type ImproveProfileAgent<TScenario extends Scenario$1, TArtifact> = (profile: ReadonlyAgentProfile, scenario: TScenario, ctx: Parameters<CompareOptimizationMethodsOptions<TScenario, TArtifact>['dispatchWithSurface']>[2]) => Promise<TArtifact>;
+/** Exact materialized profile presented for validation before any candidate run. */
+interface ImproveCandidateValidationInput {
+  profile: ReadonlyAgentProfile;
+  surface: ImproveProfileSurface;
+  candidateSurface: MutableSurface;
+  value: unknown;
+  isBaseline: boolean;
+}
+type ImproveCandidateValidator = (input: ImproveCandidateValidationInput) => void;
+type ImproveOptimizationRunOptions<TScenario extends Scenario$1, TArtifact> = Omit<NonNullable<CompareOptimizationMethodsOptions<TScenario, TArtifact>['optimizationRunOptions']>, 'dispatchRef'>;
+/** Complete-method configuration for every non-code profile surface. */
+type ImproveMethodOptions<TScenario extends Scenario$1, TArtifact> = Omit<CompareOptimizationMethodsOptions<TScenario, TArtifact>, 'baselineSurface' | 'dispatchRef' | 'dispatchWithSurface' | 'methods' | 'optimizationConcurrency' | 'optimizationRunOptions'> & {
+  /** Exact profile coordinate optimized by `method`. Default `'prompt'`. */
+  surface?: ImproveProfileSurface;
+  /**
+   * Immutable digest of `agent`, profile component mapping, models, tools, and
+   * every closure or external setting that can change measured behavior.
+   */
+  executionRef: Sha256Digest;
+  /** A complete optimizer or a factory that can incorporate current findings. */
+  method: ImproveMethodSource<TScenario, TArtifact>;
+  /** Runs the exact complete profile materialized from one candidate surface. */
+  agent: ImproveProfileAgent<TScenario, TArtifact>;
+  /** Reject a materialized profile before it reaches the agent callback. */
+  validateCandidate?: ImproveCandidateValidator;
+  /** Trace or analyst findings available to a method factory. */
+  findings?: readonly unknown[];
+  /** Select the exact inline skill document for `surface: 'skills'`. */
+  skills?: ImproveSkillsOptions;
+  /**
+   * Map a profile to named text components and apply the winning components.
+   * Valid only with `surface: 'agent-profile'`.
+   */
+  profileComponents?: ImproveProfileComponents;
+  /** Shared settings for method train and selection calls. */
+  optimizationRunOptions?: ImproveOptimizationRunOptions<TScenario, TArtifact>;
+  /** Ship only when the paired final-test interval is entirely above this lift. Default `0`. */
+  minimumLift?: number;
+};
+/** Runtime-owned code search in isolated git worktrees. */
+type ImproveCodeRunOptions<TScenario extends Scenario$1, TArtifact> = Omit<SelfImproveOptions<TScenario, TArtifact>, 'analyzeGeneration' | 'baselineSurface' | 'budget' | 'findings' | 'gate' | 'llm' | 'method' | 'mutationPrimitives' | 'proposer' | 'proposerTarget' | 'selectionScenarios'> & {
+  surface: 'code';
+  /** Local code-search budget. Method-only selection controls do not apply. */
+  budget?: Omit<SelfImproveBudget, 'selectionFraction'>;
+  /** Findings supplied to Runtime's code candidate driver. */
+  findings?: readonly unknown[];
+  /** Gate mode. `'holdout'` (default) runs the held-out promotion gate;
+   * `'none'` is a baseline-only run (`budget.generations = 0`). */
+  gate?: 'holdout' | 'none';
+  /** Per-generation findings producer for Runtime's code search.
+   * Pass your own producer to replace the code-trace distiller; pass `null`
+   * to keep the static findings for every generation. */
+  analyzeGeneration?: SelfImproveOptions<TScenario, TArtifact>['analyzeGeneration'] | null;
+  /** Feed code candidates paths to prior raw traces instead of a failure digest.
+   * Defaults to true for durable runs and false for in-memory runs. */
+  rawTraceContext?: boolean;
+  /** Isolated repository and candidate generator settings. */
+  code: ImproveCodeOptions;
+  /** Custom held-back-exam decision. The string `gate` above controls whether
+   * the exam runs; this callback controls how its evidence decides promotion. */
+  promotionGate?: SelfImproveOptions<TScenario, TArtifact>['gate'];
+};
+/** The canonical improvement API: complete methods for profiles, worktrees for code. */
+type ImproveOptions<TScenario extends Scenario$1, TArtifact> = ImproveMethodOptions<TScenario, TArtifact> | ImproveCodeRunOptions<TScenario, TArtifact>;
+interface ImproveSkillsOptions {
+  /** `name` of one inline entry in `profile.resources.skills`. */
+  resourceName: string;
+}
+/** Caller-owned mapping for optimizing several profile fields as one candidate. */
+interface ImproveProfileComponents {
+  /** Extract the exact named text components optimized together. */
+  read(profile: ReadonlyAgentProfile): Readonly<Record<string, string>>;
+  /** Apply a complete winning component map to a detached profile. */
+  apply(profile: ReadonlyAgentProfile, components: Readonly<Record<string, string>>): ReadonlyAgentProfile;
+}
+interface ImproveCodeOptions {
+  /** Repo root candidate worktrees fork from. */
+  repoRoot: string;
+  /** Base ref candidates fork from. Default `main`. */
+  baseRef?: string;
+  /** Directory worktrees are created under. Default `<repoRoot>/.worktrees`. */
+  worktreeDir?: string;
+  /** Git-compatible adapter override, primarily for tests. Candidate advancement
+   * still requires normal Git worktree and commit semantics. */
+  worktree?: WorktreeAdapter;
+  /** Coding harness the agentic generator runs in each worktree. Default `claude`. */
+  harness?: LocalHarness;
+  /** Verify a candidate worktree before it becomes a measurable surface; failures
+   * feed the next shot (see `agenticGenerator.verify` / `commandVerifier`). */
+  verify?: Verifier;
+  /** Per-shot wall-clock timeout for the harness (ms). */
+  timeoutMs?: number;
+  /** Byte-producer override, used for tests and custom candidate production.
+   * When set, `harness`, `verify`, and `timeoutMs` are unused. */
+  generator?: CandidateGenerator;
+}
+interface ImprovementProfileCandidate {
+  /** Surface searched by this run. */
+  surface: ImproveProfileSurface;
+  /** Exact winning value returned by agent-eval. */
+  value: MutableSurface;
+  /** Exact complete profile instance measured on the final cases. */
+  profile: ReadonlyAgentProfile;
+}
+interface ImprovementCodeCandidate {
+  surface: 'code';
+  value: MutableSurface;
+  profile?: never;
+}
+type ImprovementCandidate = ImprovementProfileCandidate | ImprovementCodeCandidate;
+/** Normalized spend reported for one Runtime improvement run. */
+interface ImproveCost {
+  totalCostUsd: number;
+  accountingComplete: boolean;
+  incompleteReasons: string[];
+}
+/** Optimizer ancestry sealed into downstream candidate experiments. */
+interface ImproveLineage {
+  /** Unique Runtime invocation used to isolate this run's cost receipts. */
+  invocationId: string;
+  /** Upstream optimizer run when reported, otherwise this Runtime optimization invocation. */
+  runId: string;
+  /** Exact train-plus-selection scenario payloads exposed to candidate selection. */
+  developmentSplitDigest: Sha256Digest;
+  /** Complete callback, materializer, model, tool, and closure identity for a profile run. */
+  executionRef?: Sha256Digest;
+  /** Complete baseline profile identity for a profile run. */
+  baselineProfileDigest?: Sha256Digest;
+}
+interface ImproveResultBase<TCandidate extends ImprovementCandidate> {
+  /** Frozen candidate only. Live state is changed through an approved activation. */
+  candidate: TCandidate;
+  /** Final-test decision for this search result. */
+  decision: SelfImproveResult<Scenario$1, unknown>['gateDecision'];
+  /** Final-test lift when one was measured. */
+  lift?: number;
+  /** Paired final-test confidence interval for method-based profile runs. */
+  liftInterval?: {
+    low: number;
+    high: number;
+  };
+  /** Full search and final-test spend. */
+  cost: ImproveCost;
+  /** Full wall-clock duration. */
+  durationMs: number;
+  /** Optimizer ancestry used when sealing a candidate experiment. */
+  lineage: ImproveLineage;
+  /** Number of generations explored by Runtime's code path. */
+  generationsExplored?: number;
+  /** Release resources owned by this result. Idempotent; currently disposes
+   * the returned code worktree and is a no-op for profile-only surfaces. */
+  dispose(): Promise<void>;
+}
+interface ImproveMethodResult extends ImproveResultBase<ImprovementProfileCandidate> {
+  mode: 'method';
+  method: string;
+  /** External optimizer package and resumable run identity, when reported. */
+  provenance?: OptimizationMethodComparison['best']['provenance'];
+  decision: 'ship' | 'hold';
+  lift: number;
+  liftInterval: {
+    low: number;
+    high: number;
+  };
+  raw: OptimizationMethodComparison;
+}
+interface ImproveCodeResult<TScenario extends Scenario$1, TArtifact> extends ImproveResultBase<ImprovementCodeCandidate> {
+  mode: 'code';
+  raw: SelfImproveResult<TScenario, TArtifact>;
+}
+type ImproveResult<TScenario extends Scenario$1, TArtifact> = ImproveMethodResult | ImproveCodeResult<TScenario, TArtifact>;
+//#endregion
+//#region src/improvement/improve.d.ts
+/**
+ * Optimize one exact profile surface with a complete method.
+ */
+declare function improve<TScenario extends Scenario$1, TArtifact>(profile: AgentProfile$1, opts: ImproveMethodOptions<TScenario, TArtifact>): Promise<ImproveMethodResult>;
+/**
+ * Optimize repository code through Runtime's isolated worktree path.
+ */
+declare function improve<TScenario extends Scenario$1, TArtifact>(opts: ImproveCodeRunOptions<TScenario, TArtifact>): Promise<ImproveCodeResult<TScenario, TArtifact>>;
+//#endregion
+//#region src/redact.d.ts
+/**
+ *
+ * Redaction for values that may leave the Runtime process. The default scrubs
+ * common leak classes (API keys, bearer tokens, emails, private keys) from
+ * strings and walks nested objects and arrays. A customer with domain-specific
+ * PII supplies their own `redact` hook.
+ *
+ * This is intentionally narrower than `src/sanitize.ts` (which redacts the
+ * runtime's *event envelope* field-by-field): here the value is opaque
+ * customer payload, so the scrub is value-shaped, not schema-shaped.
+ *
+ * @experimental
+ */
+/** A redactor maps an arbitrary trace value to a safe-to-export value. Pure;
+ *  must not throw on cyclic input (the default tolerates cycles). */
+type Redactor = (value: unknown) => unknown;
+/**
+ * The built-in redactor. Walks objects and arrays; replaces values under
+ * secret-bearing keys wholesale; scrubs in-value patterns from every string.
+ * Cycle-safe (a seen-set short-circuits self-referential payloads to
+ * `'[circular]'`), depth-bounded, and total — never throws on customer input.
+ */
+declare function defaultRedactor(value: unknown): unknown;
+/**
+ * Resolve the redactor a client uses. A caller-supplied hook handles
+ * domain-specific values first, then the built-in scrubber still removes
+ * common credentials and email addresses. Returning `false` is the explicit
+ * opt-out for already-reviewed public values.
+ */
+declare function resolveRedactor(redact: Redactor | false | undefined): Redactor;
+//#endregion
+export { AGENTIC_PROFILE_RESOURCE_ROOT as A, CandidateGenerator as B, ImproveSkillsOptions as C, ImprovementProfileCandidate as D, ImprovementCodeCandidate as E, Verifier as F, VerifyResult as I, agenticGenerator as L, AgenticGeneratorShotDisposition as M, AgenticGeneratorShotExecution as N, DeepReadonly as O, AgenticGeneratorShotReceipt as P, commandVerifier as R, ImproveResult as S, ImprovementCandidate as T, ImproveOptimizationRunOptions as _, ImproveCandidateValidationInput as a, ImproveProfileComponents as b, ImproveCodeResult as c, ImproveLineage as d, ImproveMethodContext as f, ImproveMethodSource as g, ImproveMethodResult as h, improve as i, AgenticGeneratorOptions as j, ReadonlyAgentProfile as k, ImproveCodeRunOptions as l, ImproveMethodOptions as m, defaultRedactor as n, ImproveCandidateValidator as o, ImproveMethodFactory as p, resolveRedactor as r, ImproveCodeOptions as s, Redactor as t, ImproveCost as u, ImproveOptions as v, ImproveSurface as w, ImproveProfileSurface as x, ImproveProfileAgent as y, defaultBuildPrompt as z };
+//# sourceMappingURL=redact-kbIOjfjM.d.ts.map