@tangle-network/agent-runtime 0.105.0 → 0.106.0

package/dist/chunk-UPWGXKXB.js

@@ -1,254 +0,0 @@
-// src/candidate-execution/protected-redaction.ts
-import { createHmac, randomBytes } from "crypto";
-import {
-  DEFAULT_REDACTION_RULES,
-  REDACTION_VERSION,
-  redactString
-} from "@tangle-network/agent-eval";
-function createProtectedRecordRedactor(protectedValues) {
-  const identityKey = randomBytes(32);
-  const aggregate = {
-    version: REDACTION_VERSION,
-    redactionCount: 0,
-    byRule: {}
-  };
-  const mergeReport = (report) => {
-    aggregate.version = report.version;
-    aggregate.redactionCount += report.redactionCount;
-    for (const [rule, count] of Object.entries(report.byRule)) {
-      aggregate.byRule[rule] = (aggregate.byRule[rule] ?? 0) + count;
-    }
-  };
-  const redactScalar = (value, record) => {
-    const redacted = redactProtectedValue(value, protectedValues);
-    if (record) mergeReport(redacted.report);
-    return redacted.value;
-  };
-  const identifier = (value, record) => {
-    const redacted = redactScalar(value, record);
-    if (redacted === value) return value;
-    const digest = createHmac("sha256", identityKey).update(value).digest("hex");
-    return `${redacted}:hmac-sha256:${digest}`;
-  };
-  const transform = (value, record) => {
-    const transformed = transformProtectedRecord(
-      value,
-      void 0,
-      record,
-      redactScalar,
-      identifier
-    );
-    assertNoProtectedEvidence(transformed, protectedValues);
-    return transformed;
-  };
-  return Object.freeze({
-    record: (value) => transform(value, true),
-    query: (value) => transform(value, false),
-    identifier: (value) => identifier(value, false),
-    traceIdentity: (trace) => transform(trace, false),
-    report: () => ({
-      version: aggregate.version,
-      redactionCount: aggregate.redactionCount,
-      byRule: { ...aggregate.byRule }
-    })
-  });
-}
-function redactProtectedValue(value, protectedValues) {
-  const report = {
-    version: REDACTION_VERSION,
-    redactionCount: 0,
-    byRule: {}
-  };
-  const rules = protectedRedactionRules(protectedValues);
-  const redacted = redactNode(value, protectedValues, rules, report);
-  assertNoProtectedEvidence(redacted, protectedValues);
-  return { value: redacted, report };
-}
-function redactProtectedReason(reason, protectedValues) {
-  try {
-    return redactProtectedValue(reason, protectedValues).value;
-  } catch {
-    return "candidate execution failed with a protected error";
-  }
-}
-function assertNoProtectedEvidence(value, protectedValues) {
-  if (value instanceof Uint8Array) {
-    assertNoProtectedBytes(value, protectedValues);
-    return;
-  }
-  if (typeof value === "string") {
-    for (const protectedValue of protectedValueVariants(protectedValues)) {
-      if (value.includes(protectedValue)) {
-        throw new Error("protected value survived candidate evidence redaction");
-      }
-    }
-    if (decodedBase64ContainsProtectedValue(value, protectedValues)) {
-      throw new Error("base64 protected value survived candidate evidence redaction");
-    }
-    return;
-  }
-  if (Array.isArray(value)) {
-    for (const entry of value) assertNoProtectedEvidence(entry, protectedValues);
-    return;
-  }
-  if (value && typeof value === "object") {
-    for (const [key, entry] of Object.entries(value)) {
-      assertNoProtectedEvidence(key, protectedValues);
-      assertNoProtectedEvidence(entry, protectedValues);
-    }
-  }
-}
-function assertNoProtectedBytes(bytes, protectedValues) {
-  if (containsProtectedBytes(bytes, protectedValues)) {
-    throw new Error("protected value survived candidate evidence byte redaction");
-  }
-}
-function redactNode(value, protectedValues, rules, report) {
-  if (value instanceof Uint8Array) {
-    if (containsProtectedBytes(value, protectedValues)) {
-      recordRedaction(report, "candidate-access-binary", 1);
-      return Uint8Array.from(Buffer.from("[redacted:candidate-access-binary]", "utf8"));
-    }
-    return Uint8Array.from(value);
-  }
-  if (typeof value === "string") {
-    if (decodedBase64ContainsProtectedValue(value, protectedValues)) {
-      recordRedaction(report, "candidate-access-binary", 1);
-      return "[redacted:candidate-access-binary]";
-    }
-    const redacted = redactString(value, [...rules]);
-    for (const [rule, count] of Object.entries(redacted.report.byRule)) {
-      recordRedaction(report, rule, count);
-    }
-    return redacted.output;
-  }
-  if (Array.isArray(value)) {
-    return value.map((entry) => redactNode(entry, protectedValues, rules, report));
-  }
-  if (value && typeof value === "object") {
-    const entries = [];
-    const seenKeys = /* @__PURE__ */ new Set();
-    for (const [key, entry] of Object.entries(value)) {
-      const redactedKey = redactNode(key, protectedValues, rules, report);
-      if (typeof redactedKey !== "string" || seenKeys.has(redactedKey)) {
-        throw new Error("protected evidence redaction produced an ambiguous object key");
-      }
-      seenKeys.add(redactedKey);
-      entries.push([redactedKey, redactNode(entry, protectedValues, rules, report)]);
-    }
-    return Object.fromEntries(entries);
-  }
-  return value;
-}
-function transformProtectedRecord(value, fieldName, record, redactScalar, redactIdentifier) {
-  if (value instanceof Uint8Array) return redactScalar(value, record);
-  if (typeof value === "string") {
-    return fieldName && isIdentifierFieldName(fieldName) ? redactIdentifier(value, record) : redactScalar(value, record);
-  }
-  if (Array.isArray(value)) {
-    return value.map(
-      (entry) => transformProtectedRecord(entry, fieldName, record, redactScalar, redactIdentifier)
-    );
-  }
-  if (!value || typeof value !== "object") return value;
-  if (fieldName === "tags") {
-    return transformTagMap(value, record, redactScalar, redactIdentifier);
-  }
-  if (fieldName === "tag") {
-    return transformTagFilter(value, record, redactScalar, redactIdentifier);
-  }
-  const entries = [];
-  const seenKeys = /* @__PURE__ */ new Set();
-  for (const [key, entry] of Object.entries(value)) {
-    const redactedKey = redactScalar(key, record);
-    if (seenKeys.has(redactedKey)) {
-      throw new Error("protected evidence redaction produced an ambiguous object key");
-    }
-    seenKeys.add(redactedKey);
-    entries.push([
-      redactedKey,
-      transformProtectedRecord(entry, key, record, redactScalar, redactIdentifier)
-    ]);
-  }
-  return Object.fromEntries(entries);
-}
-function transformTagMap(value, record, redactScalar, redactIdentifier) {
-  const entries = [];
-  const seenKeys = /* @__PURE__ */ new Set();
-  for (const [key, entry] of Object.entries(value)) {
-    const redactedKey = redactIdentifier(key, record);
-    if (seenKeys.has(redactedKey)) {
-      throw new Error("protected evidence redaction produced an ambiguous trace tag");
-    }
-    seenKeys.add(redactedKey);
-    entries.push([
-      redactedKey,
-      typeof entry === "string" ? redactIdentifier(entry, record) : transformProtectedRecord(entry, key, record, redactScalar, redactIdentifier)
-    ]);
-  }
-  return Object.fromEntries(entries);
-}
-function transformTagFilter(value, record, redactScalar, redactIdentifier) {
-  const output = {};
-  for (const [key, entry] of Object.entries(value)) {
-    const redactedKey = redactScalar(key, record);
-    output[redactedKey] = (key === "key" || key === "value") && typeof entry === "string" ? redactIdentifier(entry, record) : transformProtectedRecord(entry, key, record, redactScalar, redactIdentifier);
-  }
-  return output;
-}
-function isIdentifierFieldName(name) {
-  return /ids?$/i.test(name);
-}
-function protectedRedactionRules(protectedValues) {
-  const exactRules = protectedValueVariants(protectedValues).sort((left, right) => right.length - left.length || left.localeCompare(right)).map((value, index) => ({
-    id: `candidate-access-${index}`,
-    pattern: new RegExp(escapeRegularExpression(value), "g"),
-    replacement: "[redacted:candidate-access]"
-  }));
-  return [...exactRules, ...DEFAULT_REDACTION_RULES];
-}
-function recordRedaction(report, rule, count) {
-  if (count <= 0) return;
-  report.redactionCount += count;
-  report.byRule[rule] = (report.byRule[rule] ?? 0) + count;
-}
-function containsProtectedBytes(bytes, protectedValues) {
-  const source = Buffer.from(bytes);
-  return protectedValueVariants(protectedValues).some(
-    (value) => source.includes(Buffer.from(value, "utf8"))
-  );
-}
-function decodedBase64ContainsProtectedValue(value, protectedValues) {
-  if (value.length < 4 || value.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/.test(value)) {
-    return false;
-  }
-  try {
-    return containsProtectedBytes(Buffer.from(value, "base64"), protectedValues);
-  } catch {
-    return false;
-  }
-}
-function protectedValueVariants(protectedValues) {
-  const variants = /* @__PURE__ */ new Set();
-  for (const value of normalizedProtectedValues(protectedValues)) {
-    variants.add(value);
-    variants.add(Buffer.from(value, "utf8").toString("base64"));
-    variants.add(Buffer.from(value, "utf8").toString("base64url"));
-    variants.add(encodeURIComponent(value));
-  }
-  return [...variants];
-}
-function normalizedProtectedValues(values) {
-  return [...new Set(values.filter((value) => value.length > 0))];
-}
-function escapeRegularExpression(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-
-export {
-  createProtectedRecordRedactor,
-  redactProtectedValue,
-  redactProtectedReason,
-  assertNoProtectedBytes
-};
-//# sourceMappingURL=chunk-UPWGXKXB.js.map

package/dist/chunk-UPWGXKXB.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/candidate-execution/protected-redaction.ts"],"sourcesContent":["import { createHmac, randomBytes } from 'node:crypto'\n\nimport {\n  DEFAULT_REDACTION_RULES,\n  REDACTION_VERSION,\n  type RedactionRule,\n  redactString,\n} from '@tangle-network/agent-eval'\n\nexport interface ProtectedRedactionReport {\n  version: string\n  redactionCount: number\n  byRule: Record<string, number>\n}\n\nexport interface ProtectedTraceIdentity {\n  readonly runId: string\n  readonly tags: Readonly<Record<string, string>>\n}\n\nexport interface ProtectedRecordRedactor {\n  record<T>(value: T): T\n  query<T>(value: T): T\n  identifier(value: string): string\n  traceIdentity(trace: ProtectedTraceIdentity): ProtectedTraceIdentity\n  report(): ProtectedRedactionReport\n}\n\n/** Create one execution-local namespace for identifiers changed by redaction. */\nexport function createProtectedRecordRedactor(\n  protectedValues: readonly string[],\n): ProtectedRecordRedactor {\n  const identityKey = randomBytes(32)\n  const aggregate: ProtectedRedactionReport = {\n    version: REDACTION_VERSION,\n    redactionCount: 0,\n    byRule: {},\n  }\n\n  const mergeReport = (report: ProtectedRedactionReport): void => {\n    aggregate.version = report.version\n    aggregate.redactionCount += report.redactionCount\n    for (const [rule, count] of Object.entries(report.byRule)) {\n      aggregate.byRule[rule] = (aggregate.byRule[rule] ?? 0) + count\n    }\n  }\n\n  const redactScalar = <T>(value: T, record: boolean): T => {\n    const redacted = redactProtectedValue(value, protectedValues)\n    if (record) mergeReport(redacted.report)\n    return redacted.value\n  }\n\n  const identifier = (value: string, record: boolean): string => {\n    const redacted = redactScalar(value, record)\n    if (redacted === value) return value\n    const digest = createHmac('sha256', identityKey).update(value).digest('hex')\n    return `${redacted}:hmac-sha256:${digest}`\n  }\n\n  const transform = <T>(value: T, record: boolean): T => {\n    const transformed = transformProtectedRecord(\n      value,\n      undefined,\n      record,\n      redactScalar,\n      identifier,\n    ) as T\n    assertNoProtectedEvidence(transformed, protectedValues)\n    return transformed\n  }\n\n  return Object.freeze({\n    record: <T>(value: T): T => transform(value, true),\n    query: <T>(value: T): T => transform(value, false),\n    identifier: (value: string): string => identifier(value, false),\n    traceIdentity: (trace: ProtectedTraceIdentity): ProtectedTraceIdentity =>\n      transform(trace, false),\n    report: (): ProtectedRedactionReport => ({\n      version: aggregate.version,\n      redactionCount: aggregate.redactionCount,\n      byRule: { ...aggregate.byRule },\n    }),\n  })\n}\n\n/** Redact protected values at the first persistence boundary, including object keys and bytes. */\nexport function redactProtectedValue<T>(\n  value: T,\n  protectedValues: readonly string[],\n): { value: T; report: ProtectedRedactionReport } {\n  const report: ProtectedRedactionReport = {\n    version: REDACTION_VERSION,\n    redactionCount: 0,\n    byRule: {},\n  }\n  const rules = protectedRedactionRules(protectedValues)\n  const redacted = redactNode(value, protectedValues, rules, report) as T\n  assertNoProtectedEvidence(redacted, protectedValues)\n  return { value: redacted, report }\n}\n\nexport function redactProtectedReason(reason: string, protectedValues: readonly string[]): string {\n  try {\n    return redactProtectedValue(reason, protectedValues).value\n  } catch {\n    return 'candidate execution failed with a protected error'\n  }\n}\n\nexport function assertNoProtectedEvidence(\n  value: unknown,\n  protectedValues: readonly string[],\n): void {\n  if (value instanceof Uint8Array) {\n    assertNoProtectedBytes(value, protectedValues)\n    return\n  }\n  if (typeof value === 'string') {\n    for (const protectedValue of protectedValueVariants(protectedValues)) {\n      if (value.includes(protectedValue)) {\n        throw new Error('protected value survived candidate evidence redaction')\n      }\n    }\n    if (decodedBase64ContainsProtectedValue(value, protectedValues)) {\n      throw new Error('base64 protected value survived candidate evidence redaction')\n    }\n    return\n  }\n  if (Array.isArray(value)) {\n    for (const entry of value) assertNoProtectedEvidence(entry, protectedValues)\n    return\n  }\n  if (value && typeof value === 'object') {\n    for (const [key, entry] of Object.entries(value)) {\n      assertNoProtectedEvidence(key, protectedValues)\n      assertNoProtectedEvidence(entry, protectedValues)\n    }\n  }\n}\n\nexport function assertNoProtectedBytes(\n  bytes: Uint8Array,\n  protectedValues: readonly string[],\n): void {\n  if (containsProtectedBytes(bytes, protectedValues)) {\n    throw new Error('protected value survived candidate evidence byte redaction')\n  }\n}\n\nfunction redactNode(\n  value: unknown,\n  protectedValues: readonly string[],\n  rules: readonly RedactionRule[],\n  report: ProtectedRedactionReport,\n): unknown {\n  if (value instanceof Uint8Array) {\n    if (containsProtectedBytes(value, protectedValues)) {\n      recordRedaction(report, 'candidate-access-binary', 1)\n      return Uint8Array.from(Buffer.from('[redacted:candidate-access-binary]', 'utf8'))\n    }\n    return Uint8Array.from(value)\n  }\n  if (typeof value === 'string') {\n    if (decodedBase64ContainsProtectedValue(value, protectedValues)) {\n      recordRedaction(report, 'candidate-access-binary', 1)\n      return '[redacted:candidate-access-binary]'\n    }\n    const redacted = redactString(value, [...rules])\n    for (const [rule, count] of Object.entries(redacted.report.byRule)) {\n      recordRedaction(report, rule, count)\n    }\n    return redacted.output\n  }\n  if (Array.isArray(value)) {\n    return value.map((entry) => redactNode(entry, protectedValues, rules, report))\n  }\n  if (value && typeof value === 'object') {\n    const entries: Array<[string, unknown]> = []\n    const seenKeys = new Set<string>()\n    for (const [key, entry] of Object.entries(value)) {\n      const redactedKey = redactNode(key, protectedValues, rules, report)\n      if (typeof redactedKey !== 'string' || seenKeys.has(redactedKey)) {\n        throw new Error('protected evidence redaction produced an ambiguous object key')\n      }\n      seenKeys.add(redactedKey)\n      entries.push([redactedKey, redactNode(entry, protectedValues, rules, report)])\n    }\n    return Object.fromEntries(entries)\n  }\n  return value\n}\n\nfunction transformProtectedRecord(\n  value: unknown,\n  fieldName: string | undefined,\n  record: boolean,\n  redactScalar: <T>(value: T, record: boolean) => T,\n  redactIdentifier: (value: string, record: boolean) => string,\n): unknown {\n  if (value instanceof Uint8Array) return redactScalar(value, record)\n  if (typeof value === 'string') {\n    return fieldName && isIdentifierFieldName(fieldName)\n      ? redactIdentifier(value, record)\n      : redactScalar(value, record)\n  }\n  if (Array.isArray(value)) {\n    return value.map((entry) =>\n      transformProtectedRecord(entry, fieldName, record, redactScalar, redactIdentifier),\n    )\n  }\n  if (!value || typeof value !== 'object') return value\n\n  if (fieldName === 'tags') {\n    return transformTagMap(value, record, redactScalar, redactIdentifier)\n  }\n  if (fieldName === 'tag') {\n    return transformTagFilter(value, record, redactScalar, redactIdentifier)\n  }\n\n  const entries: Array<[string, unknown]> = []\n  const seenKeys = new Set<string>()\n  for (const [key, entry] of Object.entries(value)) {\n    const redactedKey = redactScalar(key, record)\n    if (seenKeys.has(redactedKey)) {\n      throw new Error('protected evidence redaction produced an ambiguous object key')\n    }\n    seenKeys.add(redactedKey)\n    entries.push([\n      redactedKey,\n      transformProtectedRecord(entry, key, record, redactScalar, redactIdentifier),\n    ])\n  }\n  return Object.fromEntries(entries)\n}\n\nfunction transformTagMap(\n  value: object,\n  record: boolean,\n  redactScalar: <T>(value: T, record: boolean) => T,\n  redactIdentifier: (value: string, record: boolean) => string,\n): Record<string, unknown> {\n  const entries: Array<[string, unknown]> = []\n  const seenKeys = new Set<string>()\n  for (const [key, entry] of Object.entries(value)) {\n    const redactedKey = redactIdentifier(key, record)\n    if (seenKeys.has(redactedKey)) {\n      throw new Error('protected evidence redaction produced an ambiguous trace tag')\n    }\n    seenKeys.add(redactedKey)\n    entries.push([\n      redactedKey,\n      typeof entry === 'string'\n        ? redactIdentifier(entry, record)\n        : transformProtectedRecord(entry, key, record, redactScalar, redactIdentifier),\n    ])\n  }\n  return Object.fromEntries(entries)\n}\n\nfunction transformTagFilter(\n  value: object,\n  record: boolean,\n  redactScalar: <T>(value: T, record: boolean) => T,\n  redactIdentifier: (value: string, record: boolean) => string,\n): Record<string, unknown> {\n  const output: Record<string, unknown> = {}\n  for (const [key, entry] of Object.entries(value)) {\n    const redactedKey = redactScalar(key, record)\n    output[redactedKey] =\n      (key === 'key' || key === 'value') && typeof entry === 'string'\n        ? redactIdentifier(entry, record)\n        : transformProtectedRecord(entry, key, record, redactScalar, redactIdentifier)\n  }\n  return output\n}\n\nfunction isIdentifierFieldName(name: string): boolean {\n  return /ids?$/i.test(name)\n}\n\nfunction protectedRedactionRules(protectedValues: readonly string[]): RedactionRule[] {\n  const exactRules = protectedValueVariants(protectedValues)\n    .sort((left, right) => right.length - left.length || left.localeCompare(right))\n    .map((value, index) => ({\n      id: `candidate-access-${index}`,\n      pattern: new RegExp(escapeRegularExpression(value), 'g'),\n      replacement: '[redacted:candidate-access]',\n    }))\n  return [...exactRules, ...DEFAULT_REDACTION_RULES]\n}\n\nfunction recordRedaction(report: ProtectedRedactionReport, rule: string, count: number): void {\n  if (count <= 0) return\n  report.redactionCount += count\n  report.byRule[rule] = (report.byRule[rule] ?? 0) + count\n}\n\nfunction containsProtectedBytes(bytes: Uint8Array, protectedValues: readonly string[]): boolean {\n  const source = Buffer.from(bytes)\n  return protectedValueVariants(protectedValues).some((value) =>\n    source.includes(Buffer.from(value, 'utf8')),\n  )\n}\n\nfunction decodedBase64ContainsProtectedValue(\n  value: string,\n  protectedValues: readonly string[],\n): boolean {\n  if (value.length < 4 || value.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/.test(value)) {\n    return false\n  }\n  try {\n    return containsProtectedBytes(Buffer.from(value, 'base64'), protectedValues)\n  } catch {\n    return false\n  }\n}\n\nfunction protectedValueVariants(protectedValues: readonly string[]): string[] {\n  const variants = new Set<string>()\n  for (const value of normalizedProtectedValues(protectedValues)) {\n    variants.add(value)\n    variants.add(Buffer.from(value, 'utf8').toString('base64'))\n    variants.add(Buffer.from(value, 'utf8').toString('base64url'))\n    variants.add(encodeURIComponent(value))\n  }\n  return [...variants]\n}\n\nfunction normalizedProtectedValues(values: readonly string[]): string[] {\n  return [...new Set(values.filter((value) => value.length > 0))]\n}\n\nfunction escapeRegularExpression(value: string): string {\n  return value.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&')\n}\n"],"mappings":";AAAA,SAAS,YAAY,mBAAmB;AAExC;AAAA,EACE;AAAA,EACA;AAAA,EAEA;AAAA,OACK;AAsBA,SAAS,8BACd,iBACyB;AACzB,QAAM,cAAc,YAAY,EAAE;AAClC,QAAM,YAAsC;AAAA,IAC1C,SAAS;AAAA,IACT,gBAAgB;AAAA,IAChB,QAAQ,CAAC;AAAA,EACX;AAEA,QAAM,cAAc,CAAC,WAA2C;AAC9D,cAAU,UAAU,OAAO;AAC3B,cAAU,kBAAkB,OAAO;AACnC,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,OAAO,MAAM,GAAG;AACzD,gBAAU,OAAO,IAAI,KAAK,UAAU,OAAO,IAAI,KAAK,KAAK;AAAA,IAC3D;AAAA,EACF;AAEA,QAAM,eAAe,CAAI,OAAU,WAAuB;AACxD,UAAM,WAAW,qBAAqB,OAAO,eAAe;AAC5D,QAAI,OAAQ,aAAY,SAAS,MAAM;AACvC,WAAO,SAAS;AAAA,EAClB;AAEA,QAAM,aAAa,CAAC,OAAe,WAA4B;AAC7D,UAAM,WAAW,aAAa,OAAO,MAAM;AAC3C,QAAI,aAAa,MAAO,QAAO;AAC/B,UAAM,SAAS,WAAW,UAAU,WAAW,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AAC3E,WAAO,GAAG,QAAQ,gBAAgB,MAAM;AAAA,EAC1C;AAEA,QAAM,YAAY,CAAI,OAAU,WAAuB;AACrD,UAAM,cAAc;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,8BAA0B,aAAa,eAAe;AACtD,WAAO;AAAA,EACT;AAEA,SAAO,OAAO,OAAO;AAAA,IACnB,QAAQ,CAAI,UAAgB,UAAU,OAAO,IAAI;AAAA,IACjD,OAAO,CAAI,UAAgB,UAAU,OAAO,KAAK;AAAA,IACjD,YAAY,CAAC,UAA0B,WAAW,OAAO,KAAK;AAAA,IAC9D,eAAe,CAAC,UACd,UAAU,OAAO,KAAK;AAAA,IACxB,QAAQ,OAAiC;AAAA,MACvC,SAAS,UAAU;AAAA,MACnB,gBAAgB,UAAU;AAAA,MAC1B,QAAQ,EAAE,GAAG,UAAU,OAAO;AAAA,IAChC;AAAA,EACF,CAAC;AACH;AAGO,SAAS,qBACd,OACA,iBACgD;AAChD,QAAM,SAAmC;AAAA,IACvC,SAAS;AAAA,IACT,gBAAgB;AAAA,IAChB,QAAQ,CAAC;AAAA,EACX;AACA,QAAM,QAAQ,wBAAwB,eAAe;AACrD,QAAM,WAAW,WAAW,OAAO,iBAAiB,OAAO,MAAM;AACjE,4BAA0B,UAAU,eAAe;AACnD,SAAO,EAAE,OAAO,UAAU,OAAO;AACnC;AAEO,SAAS,sBAAsB,QAAgB,iBAA4C;AAChG,MAAI;AACF,WAAO,qBAAqB,QAAQ,eAAe,EAAE;AAAA,EACvD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,0BACd,OACA,iBACM;AACN,MAAI,iBAAiB,YAAY;AAC/B,2BAAuB,OAAO,eAAe;AAC7C;AAAA,EACF;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,eAAW,kBAAkB,uBAAuB,eAAe,GAAG;AACpE,UAAI,MAAM,SAAS,cAAc,GAAG;AAClC,cAAM,IAAI,MAAM,uDAAuD;AAAA,MACzE;AAAA,IACF;AACA,QAAI,oCAAoC,OAAO,eAAe,GAAG;AAC/D,YAAM,IAAI,MAAM,8DAA8D;AAAA,IAChF;AACA;AAAA,EACF;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,SAAS,MAAO,2BAA0B,OAAO,eAAe;AAC3E;AAAA,EACF;AACA,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,gCAA0B,KAAK,eAAe;AAC9C,gCAA0B,OAAO,eAAe;AAAA,IAClD;AAAA,EACF;AACF;AAEO,SAAS,uBACd,OACA,iBACM;AACN,MAAI,uBAAuB,OAAO,eAAe,GAAG;AAClD,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AACF;AAEA,SAAS,WACP,OACA,iBACA,OACA,QACS;AACT,MAAI,iBAAiB,YAAY;AAC/B,QAAI,uBAAuB,OAAO,eAAe,GAAG;AAClD,sBAAgB,QAAQ,2BAA2B,CAAC;AACpD,aAAO,WAAW,KAAK,OAAO,KAAK,sCAAsC,MAAM,CAAC;AAAA,IAClF;AACA,WAAO,WAAW,KAAK,KAAK;AAAA,EAC9B;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,oCAAoC,OAAO,eAAe,GAAG;AAC/D,sBAAgB,QAAQ,2BAA2B,CAAC;AACpD,aAAO;AAAA,IACT;AACA,UAAM,WAAW,aAAa,OAAO,CAAC,GAAG,KAAK,CAAC;AAC/C,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,SAAS,OAAO,MAAM,GAAG;AAClE,sBAAgB,QAAQ,MAAM,KAAK;AAAA,IACrC;AACA,WAAO,SAAS;AAAA,EAClB;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,IAAI,CAAC,UAAU,WAAW,OAAO,iBAAiB,OAAO,MAAM,CAAC;AAAA,EAC/E;AACA,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,UAAM,UAAoC,CAAC;AAC3C,UAAM,WAAW,oBAAI,IAAY;AACjC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,YAAM,cAAc,WAAW,KAAK,iBAAiB,OAAO,MAAM;AAClE,UAAI,OAAO,gBAAgB,YAAY,SAAS,IAAI,WAAW,GAAG;AAChE,cAAM,IAAI,MAAM,+DAA+D;AAAA,MACjF;AACA,eAAS,IAAI,WAAW;AACxB,cAAQ,KAAK,CAAC,aAAa,WAAW,OAAO,iBAAiB,OAAO,MAAM,CAAC,CAAC;AAAA,IAC/E;AACA,WAAO,OAAO,YAAY,OAAO;AAAA,EACnC;AACA,SAAO;AACT;AAEA,SAAS,yBACP,OACA,WACA,QACA,cACA,kBACS;AACT,MAAI,iBAAiB,WAAY,QAAO,aAAa,OAAO,MAAM;AAClE,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,aAAa,sBAAsB,SAAS,IAC/C,iBAAiB,OAAO,MAAM,IAC9B,aAAa,OAAO,MAAM;AAAA,EAChC;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM;AAAA,MAAI,CAAC,UAChB,yBAAyB,OAAO,WAAW,QAAQ,cAAc,gBAAgB;AAAA,IACnF;AAAA,EACF;AACA,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAEhD,MAAI,cAAc,QAAQ;AACxB,WAAO,gBAAgB,OAAO,QAAQ,cAAc,gBAAgB;AAAA,EACtE;AACA,MAAI,cAAc,OAAO;AACvB,WAAO,mBAAmB,OAAO,QAAQ,cAAc,gBAAgB;AAAA,EACzE;AAEA,QAAM,UAAoC,CAAC;AAC3C,QAAM,WAAW,oBAAI,IAAY;AACjC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,UAAM,cAAc,aAAa,KAAK,MAAM;AAC5C,QAAI,SAAS,IAAI,WAAW,GAAG;AAC7B,YAAM,IAAI,MAAM,+DAA+D;AAAA,IACjF;AACA,aAAS,IAAI,WAAW;AACxB,YAAQ,KAAK;AAAA,MACX;AAAA,MACA,yBAAyB,OAAO,KAAK,QAAQ,cAAc,gBAAgB;AAAA,IAC7E,CAAC;AAAA,EACH;AACA,SAAO,OAAO,YAAY,OAAO;AACnC;AAEA,SAAS,gBACP,OACA,QACA,cACA,kBACyB;AACzB,QAAM,UAAoC,CAAC;AAC3C,QAAM,WAAW,oBAAI,IAAY;AACjC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,UAAM,cAAc,iBAAiB,KAAK,MAAM;AAChD,QAAI,SAAS,IAAI,WAAW,GAAG;AAC7B,YAAM,IAAI,MAAM,8DAA8D;AAAA,IAChF;AACA,aAAS,IAAI,WAAW;AACxB,YAAQ,KAAK;AAAA,MACX;AAAA,MACA,OAAO,UAAU,WACb,iBAAiB,OAAO,MAAM,IAC9B,yBAAyB,OAAO,KAAK,QAAQ,cAAc,gBAAgB;AAAA,IACjF,CAAC;AAAA,EACH;AACA,SAAO,OAAO,YAAY,OAAO;AACnC;AAEA,SAAS,mBACP,OACA,QACA,cACA,kBACyB;AACzB,QAAM,SAAkC,CAAC;AACzC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,UAAM,cAAc,aAAa,KAAK,MAAM;AAC5C,WAAO,WAAW,KACf,QAAQ,SAAS,QAAQ,YAAY,OAAO,UAAU,WACnD,iBAAiB,OAAO,MAAM,IAC9B,yBAAyB,OAAO,KAAK,QAAQ,cAAc,gBAAgB;AAAA,EACnF;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,MAAuB;AACpD,SAAO,SAAS,KAAK,IAAI;AAC3B;AAEA,SAAS,wBAAwB,iBAAqD;AACpF,QAAM,aAAa,uBAAuB,eAAe,EACtD,KAAK,CAAC,MAAM,UAAU,MAAM,SAAS,KAAK,UAAU,KAAK,cAAc,KAAK,CAAC,EAC7E,IAAI,CAAC,OAAO,WAAW;AAAA,IACtB,IAAI,oBAAoB,KAAK;AAAA,IAC7B,SAAS,IAAI,OAAO,wBAAwB,KAAK,GAAG,GAAG;AAAA,IACvD,aAAa;AAAA,EACf,EAAE;AACJ,SAAO,CAAC,GAAG,YAAY,GAAG,uBAAuB;AACnD;AAEA,SAAS,gBAAgB,QAAkC,MAAc,OAAqB;AAC5F,MAAI,SAAS,EAAG;AAChB,SAAO,kBAAkB;AACzB,SAAO,OAAO,IAAI,KAAK,OAAO,OAAO,IAAI,KAAK,KAAK;AACrD;AAEA,SAAS,uBAAuB,OAAmB,iBAA6C;AAC9F,QAAM,SAAS,OAAO,KAAK,KAAK;AAChC,SAAO,uBAAuB,eAAe,EAAE;AAAA,IAAK,CAAC,UACnD,OAAO,SAAS,OAAO,KAAK,OAAO,MAAM,CAAC;AAAA,EAC5C;AACF;AAEA,SAAS,oCACP,OACA,iBACS;AACT,MAAI,MAAM,SAAS,KAAK,MAAM,SAAS,MAAM,KAAK,CAAC,yBAAyB,KAAK,KAAK,GAAG;AACvF,WAAO;AAAA,EACT;AACA,MAAI;AACF,WAAO,uBAAuB,OAAO,KAAK,OAAO,QAAQ,GAAG,eAAe;AAAA,EAC7E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,uBAAuB,iBAA8C;AAC5E,QAAM,WAAW,oBAAI,IAAY;AACjC,aAAW,SAAS,0BAA0B,eAAe,GAAG;AAC9D,aAAS,IAAI,KAAK;AAClB,aAAS,IAAI,OAAO,KAAK,OAAO,MAAM,EAAE,SAAS,QAAQ,CAAC;AAC1D,aAAS,IAAI,OAAO,KAAK,OAAO,MAAM,EAAE,SAAS,WAAW,CAAC;AAC7D,aAAS,IAAI,mBAAmB,KAAK,CAAC;AAAA,EACxC;AACA,SAAO,CAAC,GAAG,QAAQ;AACrB;AAEA,SAAS,0BAA0B,QAAqC;AACtE,SAAO,CAAC,GAAG,IAAI,IAAI,OAAO,OAAO,CAAC,UAAU,MAAM,SAAS,CAAC,CAAC,CAAC;AAChE;AAEA,SAAS,wBAAwB,OAAuB;AACtD,SAAO,MAAM,QAAQ,uBAAuB,MAAM;AACpD;","names":[]}

package/dist/chunk-VISA6CI3.js

@@ -1,200 +0,0 @@
-import {
-  agentImprovementTargetDigest,
-  agentImprovementTargetInput,
-  verifyAgentImprovementActivation,
-  verifyAgentImprovementProposal
-} from "./chunk-UHEZW5BU.js";
-import {
-  canonicalCandidateDigest,
-  canonicalCandidateDocument,
-  immutableCandidateValue,
-  verifyCanonicalCandidateDocument
-} from "./chunk-WSTRQZYQ.js";
-
-// src/intelligence/activation.ts
-import {
-  agentImprovementActivationResultSchema,
-  agentImprovementActivationSchema
-} from "@tangle-network/agent-interface";
-function createAgentImprovementActivationResult(transition, options) {
-  const activation = verifyCanonicalCandidateDocument(
-    agentImprovementActivationSchema.parse(transition.activation),
-    "agent improvement activation"
-  );
-  assertTransitionInput(activation, transition);
-  const result = agentImprovementActivationResultSchema.parse(
-    canonicalCandidateDocument({
-      kind: "agent-improvement-activation-result",
-      idempotencyKey: activation.digest,
-      attemptedAt: transition.attemptedAt,
-      completedAt: options.completedAt,
-      outcome: options.outcome
-    }).value
-  );
-  assertResultAgainstActivation(activation, result);
-  assertOutcomeDesiredState(
-    activation,
-    result,
-    new Map(transition.targets.map((target) => [targetIdentity(target), target.desiredDigest]))
-  );
-  return immutableCandidateValue(result);
-}
-function verifyAgentImprovementActivationResult(input) {
-  const proposal = verifyAgentImprovementProposal(input.proposal);
-  const activation = verifyAgentImprovementActivation(input);
-  const result = verifyCanonicalCandidateDocument(
-    agentImprovementActivationResultSchema.parse(input.result),
-    "agent improvement activation result"
-  );
-  assertResultAgainstActivation(activation, result);
-  assertResultDesiredState(proposal, activation, result);
-  return result;
-}
-async function executeAgentImprovementActivation(input, options) {
-  const proposal = verifyAgentImprovementProposal(input.proposal);
-  const activation = verifyAgentImprovementActivation(input);
-  const experiment = proposal.evaluation.experiment;
-  const targetArm = activation.intent === "activate-candidate" ? "candidate" : "baseline";
-  const observedAt = (options.now ?? (() => /* @__PURE__ */ new Date()))().toISOString();
-  const attemptedAt = Date.parse(observedAt) < Date.parse(activation.authorizedAt) ? activation.authorizedAt : observedAt;
-  const transition = immutableCandidateValue({
-    activation,
-    candidateBundle: experiment.candidate,
-    bundle: experiment[targetArm],
-    targets: activation.targets.map((target) => ({
-      ...target,
-      desiredDigest: agentImprovementTargetDigest(experiment, targetArm, target.surface),
-      desiredInput: agentImprovementTargetInput(experiment[targetArm], target.surface)
-    })),
-    attemptedAt,
-    expired: Date.parse(attemptedAt) >= Date.parse(activation.expiresAt)
-  });
-  if (transition.expired) {
-    if (!options.reconcile) {
-      return uncertainActivationResult(transition, "RECONCILIATION_UNAVAILABLE");
-    }
-    let reconciled;
-    try {
-      reconciled = await options.reconcile(transition);
-    } catch {
-      return uncertainActivationResult(transition, "RECONCILIATION_THROW");
-    }
-    if (reconciled === void 0) {
-      return createAgentImprovementActivationResult(transition, {
-        completedAt: transition.attemptedAt,
-        outcome: { status: "expired" }
-      });
-    }
-    try {
-      return verifyAgentImprovementActivationResult({ ...input, result: reconciled });
-    } catch {
-      return uncertainActivationResult(transition, "INVALID_RECONCILIATION");
-    }
-  }
-  let rawResult;
-  try {
-    rawResult = await options.transition(transition);
-  } catch {
-    return uncertainActivationResult(transition, "TRANSITION_THROW");
-  }
-  try {
-    return verifyAgentImprovementActivationResult({ ...input, result: rawResult });
-  } catch {
-    return uncertainActivationResult(transition, "INVALID_RESULT");
-  }
-}
-function uncertainActivationResult(transition, code) {
-  return createAgentImprovementActivationResult(transition, {
-    completedAt: transition.attemptedAt,
-    outcome: {
-      status: "indeterminate",
-      code,
-      message: "The product transition did not return a trustworthy commit result."
-    }
-  });
-}
-function assertTransitionInput(activation, transition) {
-  const authorized = targetMap(activation.targets);
-  const planned = targetMap(transition.targets);
-  const desiredInputsMatch = transition.targets.every(
-    (target) => canonicalCandidateDigest(target.desiredInput) === canonicalCandidateDigest(agentImprovementTargetInput(transition.bundle, target.surface))
-  );
-  if (authorized.size !== planned.size || [...authorized.entries()].some(
-    ([identity, target]) => planned.get(identity)?.expectedBaseDigest !== target.expectedBaseDigest
-  ) || transition.expired !== Date.parse(transition.attemptedAt) >= Date.parse(activation.expiresAt) || transition.candidateBundle.digest !== activation.candidateBundleDigest || !desiredInputsMatch || activation.intent === "activate-candidate" && transition.bundle.digest !== transition.candidateBundle.digest) {
-    throw new Error("activation transition does not match its authorization");
-  }
-}
-function assertResultAgainstActivation(activation, result) {
-  const attemptedAt = Date.parse(result.attemptedAt);
-  const completedAt = Date.parse(result.completedAt);
-  const expiresAt = Date.parse(activation.expiresAt);
-  if (result.idempotencyKey !== activation.digest || attemptedAt < Date.parse(activation.authorizedAt) || completedAt < attemptedAt) {
-    throw new Error("activation result does not bind its authorization");
-  }
-  const expired = attemptedAt >= expiresAt;
-  if (result.outcome.status === "expired" && !expired || expired && !["expired", "indeterminate", "already-applied"].includes(result.outcome.status)) {
-    throw new Error("activation result does not honor its authorization expiry");
-  }
-  if (!("targets" in result.outcome)) return;
-  const authorized = targetMap(activation.targets);
-  const observed = new Set(result.outcome.targets.map(targetIdentity));
-  if (authorized.size !== observed.size || [...authorized.keys()].some((identity) => !observed.has(identity))) {
-    throw new Error("activation result must cover every authorized target exactly once");
-  }
-  if (result.outcome.status === "applied" && result.outcome.targets.some(
-    (target) => target.beforeDigest !== authorized.get(targetIdentity(target))?.expectedBaseDigest
-  )) {
-    throw new Error("applied activation did not start from its authorized base state");
-  }
-}
-function assertResultDesiredState(proposal, activation, result) {
-  if (!("targets" in result.outcome)) return;
-  const experiment = proposal.evaluation.experiment;
-  const targetArm = activation.intent === "activate-candidate" ? "candidate" : "baseline";
-  const desired = new Map(
-    activation.targets.map((target) => [
-      targetIdentity(target),
-      agentImprovementTargetDigest(experiment, targetArm, target.surface)
-    ])
-  );
-  assertOutcomeDesiredState(activation, result, desired);
-}
-function assertOutcomeDesiredState(activation, result, desired) {
-  if (!("targets" in result.outcome)) return;
-  if (result.outcome.status === "applied") {
-    if (result.outcome.targets.some(
-      (target) => target.afterDigest !== desired.get(targetIdentity(target))
-    )) {
-      throw new Error("applied activation does not match the requested bundle");
-    }
-    return;
-  }
-  const allDesired = result.outcome.targets.every(
-    (target) => target.currentDigest === desired.get(targetIdentity(target))
-  );
-  if (result.outcome.status === "already-applied") {
-    if (!allDesired) throw new Error("already-applied activation is not at the requested state");
-    return;
-  }
-  const authorized = targetMap(activation.targets);
-  const hasStaleTarget = result.outcome.targets.some(
-    (target) => target.currentDigest !== authorized.get(targetIdentity(target))?.expectedBaseDigest
-  );
-  if (allDesired || !hasStaleTarget) {
-    throw new Error("activation conflict does not identify stale target state");
-  }
-}
-function targetMap(targets) {
-  return new Map(targets.map((target) => [targetIdentity(target), target]));
-}
-function targetIdentity(target) {
-  return `${target.surface}\0${target.identity}`;
-}
-
-export {
-  createAgentImprovementActivationResult,
-  verifyAgentImprovementActivationResult,
-  executeAgentImprovementActivation
-};
-//# sourceMappingURL=chunk-VISA6CI3.js.map

package/dist/chunk-VISA6CI3.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/intelligence/activation.ts"],"sourcesContent":["import type {\n  AgentCandidateBundle,\n  AgentImprovementActivation,\n  AgentImprovementActivationOutcome,\n  AgentImprovementActivationResult,\n  AgentImprovementActivationTarget,\n  AgentImprovementProposal,\n  AgentImprovementReview,\n  AgentImprovementSurface,\n  Sha256Digest,\n} from '@tangle-network/agent-interface'\nimport {\n  agentImprovementActivationResultSchema,\n  agentImprovementActivationSchema,\n} from '@tangle-network/agent-interface'\n\nimport {\n  canonicalCandidateDigest,\n  canonicalCandidateDocument,\n  immutableCandidateValue,\n  verifyCanonicalCandidateDocument,\n} from '../candidate-execution/digest'\nimport {\n  verifyAgentImprovementActivation,\n  verifyAgentImprovementProposal,\n} from './improvement-cycle'\nimport { agentImprovementTargetDigest, agentImprovementTargetInput } from './improvement-surfaces'\n\nexport interface CreateAgentImprovementActivationResultOptions {\n  completedAt: string\n  outcome: AgentImprovementActivationOutcome\n}\n\nexport interface AgentImprovementActivationTargetPlan extends AgentImprovementActivationTarget {\n  desiredDigest: Sha256Digest\n  /**\n   * Exact measured input the product must apply to reach `desiredDigest`.\n   * Transition surfaces such as code and knowledge are applied operations, so\n   * their resulting state digest is not the digest of this input document.\n   */\n  desiredInput: unknown\n}\n\nexport interface AgentImprovementActivationTransitionInput {\n  activation: AgentImprovementActivation\n  candidateBundle: AgentCandidateBundle\n  bundle: AgentCandidateBundle\n  targets: [AgentImprovementActivationTargetPlan, ...AgentImprovementActivationTargetPlan[]]\n  attemptedAt: string\n  expired: boolean\n}\n\nexport interface AgentImprovementActivationResultStore {\n  load(idempotencyKey: Sha256Digest): Promise<unknown | undefined>\n  putIfAbsent(result: AgentImprovementActivationResult): Promise<unknown>\n}\n\n/**\n * Product-owned or Runtime-composed transition.\n *\n * Implementations resolve a stored result for `activation.digest`, compare\n * every target, and make the write durably idempotent. Co-located targets store\n * the all-or-none write with its result. Other targets throw when result\n * storage fails so a retry can reconcile it. Runtime never invokes this write\n * function after authorization expires.\n */\nexport type AgentImprovementActivationTransition = (\n  input: AgentImprovementActivationTransitionInput,\n) => Promise<unknown>\n\n/**\n * Target-read-only check for a prior exact write.\n * It may persist recovered result metadata, but must not change an activation target.\n * Return undefined only when no target write can have committed.\n */\nexport type AgentImprovementActivationReconciliation = (\n  input: AgentImprovementActivationTransitionInput,\n) => Promise<unknown | undefined>\n\nexport interface ExecuteAgentImprovementActivationInput {\n  proposal: AgentImprovementProposal\n  review: AgentImprovementReview\n  activation: AgentImprovementActivation\n}\n\nexport interface ExecuteAgentImprovementActivationOptions {\n  transition: AgentImprovementActivationTransition\n  reconcile?: AgentImprovementActivationReconciliation\n  now?: () => Date\n}\n\n/** Create the exact result a product stores in the same transaction as its target write. */\nexport function createAgentImprovementActivationResult(\n  transition: AgentImprovementActivationTransitionInput,\n  options: CreateAgentImprovementActivationResultOptions,\n): AgentImprovementActivationResult {\n  const activation = verifyCanonicalCandidateDocument(\n    agentImprovementActivationSchema.parse(transition.activation),\n    'agent improvement activation',\n  )\n  assertTransitionInput(activation, transition)\n  const result = agentImprovementActivationResultSchema.parse(\n    canonicalCandidateDocument<AgentImprovementActivationResult>({\n      kind: 'agent-improvement-activation-result',\n      idempotencyKey: activation.digest,\n      attemptedAt: transition.attemptedAt,\n      completedAt: options.completedAt,\n      outcome: options.outcome,\n    }).value,\n  )\n  assertResultAgainstActivation(activation, result)\n  assertOutcomeDesiredState(\n    activation,\n    result,\n    new Map(transition.targets.map((target) => [targetIdentity(target), target.desiredDigest])),\n  )\n  return immutableCandidateValue(result)\n}\n\n/**\n * Recompute one historical activation result against the exact measured proposal and authority.\n * The result records that attempt; it is not a query of the target's current state.\n */\nexport function verifyAgentImprovementActivationResult(input: {\n  proposal: unknown\n  review: unknown\n  activation: unknown\n  result: unknown\n}): AgentImprovementActivationResult {\n  const proposal = verifyAgentImprovementProposal(input.proposal)\n  const activation = verifyAgentImprovementActivation(input)\n  const result = verifyCanonicalCandidateDocument(\n    agentImprovementActivationResultSchema.parse(input.result),\n    'agent improvement activation result',\n  )\n  assertResultAgainstActivation(activation, result)\n  assertResultDesiredState(proposal, activation, result)\n  return result\n}\n\n/** Validate and execute one product-owned activation transition. */\nexport async function executeAgentImprovementActivation(\n  input: ExecuteAgentImprovementActivationInput,\n  options: ExecuteAgentImprovementActivationOptions,\n): Promise<AgentImprovementActivationResult> {\n  const proposal = verifyAgentImprovementProposal(input.proposal)\n  const activation = verifyAgentImprovementActivation(input)\n  const experiment = proposal.evaluation.experiment\n  const targetArm = activation.intent === 'activate-candidate' ? 'candidate' : 'baseline'\n  const observedAt = (options.now ?? (() => new Date()))().toISOString()\n  const attemptedAt =\n    Date.parse(observedAt) < Date.parse(activation.authorizedAt)\n      ? activation.authorizedAt\n      : observedAt\n  const transition = immutableCandidateValue<AgentImprovementActivationTransitionInput>({\n    activation,\n    candidateBundle: experiment.candidate,\n    bundle: experiment[targetArm],\n    targets: activation.targets.map((target) => ({\n      ...target,\n      desiredDigest: agentImprovementTargetDigest(experiment, targetArm, target.surface),\n      desiredInput: agentImprovementTargetInput(experiment[targetArm], target.surface),\n    })) as AgentImprovementActivationTransitionInput['targets'],\n    attemptedAt,\n    expired: Date.parse(attemptedAt) >= Date.parse(activation.expiresAt),\n  })\n\n  if (transition.expired) {\n    if (!options.reconcile) {\n      return uncertainActivationResult(transition, 'RECONCILIATION_UNAVAILABLE')\n    }\n    let reconciled: unknown\n    try {\n      reconciled = await options.reconcile(transition)\n    } catch {\n      return uncertainActivationResult(transition, 'RECONCILIATION_THROW')\n    }\n    if (reconciled === undefined) {\n      return createAgentImprovementActivationResult(transition, {\n        completedAt: transition.attemptedAt,\n        outcome: { status: 'expired' },\n      })\n    }\n    try {\n      return verifyAgentImprovementActivationResult({ ...input, result: reconciled })\n    } catch {\n      return uncertainActivationResult(transition, 'INVALID_RECONCILIATION')\n    }\n  }\n\n  let rawResult: unknown\n  try {\n    rawResult = await options.transition(transition)\n  } catch {\n    return uncertainActivationResult(transition, 'TRANSITION_THROW')\n  }\n  try {\n    return verifyAgentImprovementActivationResult({ ...input, result: rawResult })\n  } catch {\n    return uncertainActivationResult(transition, 'INVALID_RESULT')\n  }\n}\n\nfunction uncertainActivationResult(\n  transition: AgentImprovementActivationTransitionInput,\n  code: string,\n): AgentImprovementActivationResult {\n  return createAgentImprovementActivationResult(transition, {\n    completedAt: transition.attemptedAt,\n    outcome: {\n      status: 'indeterminate',\n      code,\n      message: 'The product transition did not return a trustworthy commit result.',\n    },\n  })\n}\n\nfunction assertTransitionInput(\n  activation: AgentImprovementActivation,\n  transition: AgentImprovementActivationTransitionInput,\n): void {\n  const authorized = targetMap(activation.targets)\n  const planned = targetMap(transition.targets)\n  const desiredInputsMatch = transition.targets.every(\n    (target) =>\n      canonicalCandidateDigest(target.desiredInput) ===\n      canonicalCandidateDigest(agentImprovementTargetInput(transition.bundle, target.surface)),\n  )\n  if (\n    authorized.size !== planned.size ||\n    [...authorized.entries()].some(\n      ([identity, target]) =>\n        planned.get(identity)?.expectedBaseDigest !== target.expectedBaseDigest,\n    ) ||\n    transition.expired !== Date.parse(transition.attemptedAt) >= Date.parse(activation.expiresAt) ||\n    transition.candidateBundle.digest !== activation.candidateBundleDigest ||\n    !desiredInputsMatch ||\n    (activation.intent === 'activate-candidate' &&\n      transition.bundle.digest !== transition.candidateBundle.digest)\n  ) {\n    throw new Error('activation transition does not match its authorization')\n  }\n}\n\nfunction assertResultAgainstActivation(\n  activation: AgentImprovementActivation,\n  result: AgentImprovementActivationResult,\n): void {\n  const attemptedAt = Date.parse(result.attemptedAt)\n  const completedAt = Date.parse(result.completedAt)\n  const expiresAt = Date.parse(activation.expiresAt)\n  if (\n    result.idempotencyKey !== activation.digest ||\n    attemptedAt < Date.parse(activation.authorizedAt) ||\n    completedAt < attemptedAt\n  ) {\n    throw new Error('activation result does not bind its authorization')\n  }\n  const expired = attemptedAt >= expiresAt\n  if (\n    (result.outcome.status === 'expired' && !expired) ||\n    (expired && !['expired', 'indeterminate', 'already-applied'].includes(result.outcome.status))\n  ) {\n    throw new Error('activation result does not honor its authorization expiry')\n  }\n  if (!('targets' in result.outcome)) return\n  const authorized = targetMap(activation.targets)\n  const observed = new Set(result.outcome.targets.map(targetIdentity))\n  if (\n    authorized.size !== observed.size ||\n    [...authorized.keys()].some((identity) => !observed.has(identity))\n  ) {\n    throw new Error('activation result must cover every authorized target exactly once')\n  }\n  if (\n    result.outcome.status === 'applied' &&\n    result.outcome.targets.some(\n      (target) =>\n        target.beforeDigest !== authorized.get(targetIdentity(target))?.expectedBaseDigest,\n    )\n  ) {\n    throw new Error('applied activation did not start from its authorized base state')\n  }\n}\n\nfunction assertResultDesiredState(\n  proposal: AgentImprovementProposal,\n  activation: AgentImprovementActivation,\n  result: AgentImprovementActivationResult,\n): void {\n  if (!('targets' in result.outcome)) return\n  const experiment = proposal.evaluation.experiment\n  const targetArm = activation.intent === 'activate-candidate' ? 'candidate' : 'baseline'\n  const desired = new Map(\n    activation.targets.map((target) => [\n      targetIdentity(target),\n      agentImprovementTargetDigest(experiment, targetArm, target.surface),\n    ]),\n  )\n  assertOutcomeDesiredState(activation, result, desired)\n}\n\nfunction assertOutcomeDesiredState(\n  activation: AgentImprovementActivation,\n  result: AgentImprovementActivationResult,\n  desired: ReadonlyMap<string, Sha256Digest>,\n): void {\n  if (!('targets' in result.outcome)) return\n  if (result.outcome.status === 'applied') {\n    if (\n      result.outcome.targets.some(\n        (target) => target.afterDigest !== desired.get(targetIdentity(target)),\n      )\n    ) {\n      throw new Error('applied activation does not match the requested bundle')\n    }\n    return\n  }\n  const allDesired = result.outcome.targets.every(\n    (target) => target.currentDigest === desired.get(targetIdentity(target)),\n  )\n  if (result.outcome.status === 'already-applied') {\n    if (!allDesired) throw new Error('already-applied activation is not at the requested state')\n    return\n  }\n  const authorized = targetMap(activation.targets)\n  const hasStaleTarget = result.outcome.targets.some(\n    (target) => target.currentDigest !== authorized.get(targetIdentity(target))?.expectedBaseDigest,\n  )\n  if (allDesired || !hasStaleTarget) {\n    throw new Error('activation conflict does not identify stale target state')\n  }\n}\n\nfunction targetMap<T extends { surface: AgentImprovementSurface; identity: string }>(\n  targets: readonly T[],\n): Map<string, T> {\n  return new Map(targets.map((target) => [targetIdentity(target), target]))\n}\n\nfunction targetIdentity(target: { surface: AgentImprovementSurface; identity: string }): string {\n  return `${target.surface}\\u0000${target.identity}`\n}\n"],"mappings":";;;;;;;;;;;;;;AAWA;AAAA,EACE;AAAA,EACA;AAAA,OACK;AA8EA,SAAS,uCACd,YACA,SACkC;AAClC,QAAM,aAAa;AAAA,IACjB,iCAAiC,MAAM,WAAW,UAAU;AAAA,IAC5D;AAAA,EACF;AACA,wBAAsB,YAAY,UAAU;AAC5C,QAAM,SAAS,uCAAuC;AAAA,IACpD,2BAA6D;AAAA,MAC3D,MAAM;AAAA,MACN,gBAAgB,WAAW;AAAA,MAC3B,aAAa,WAAW;AAAA,MACxB,aAAa,QAAQ;AAAA,MACrB,SAAS,QAAQ;AAAA,IACnB,CAAC,EAAE;AAAA,EACL;AACA,gCAA8B,YAAY,MAAM;AAChD;AAAA,IACE;AAAA,IACA;AAAA,IACA,IAAI,IAAI,WAAW,QAAQ,IAAI,CAAC,WAAW,CAAC,eAAe,MAAM,GAAG,OAAO,aAAa,CAAC,CAAC;AAAA,EAC5F;AACA,SAAO,wBAAwB,MAAM;AACvC;AAMO,SAAS,uCAAuC,OAKlB;AACnC,QAAM,WAAW,+BAA+B,MAAM,QAAQ;AAC9D,QAAM,aAAa,iCAAiC,KAAK;AACzD,QAAM,SAAS;AAAA,IACb,uCAAuC,MAAM,MAAM,MAAM;AAAA,IACzD;AAAA,EACF;AACA,gCAA8B,YAAY,MAAM;AAChD,2BAAyB,UAAU,YAAY,MAAM;AACrD,SAAO;AACT;AAGA,eAAsB,kCACpB,OACA,SAC2C;AAC3C,QAAM,WAAW,+BAA+B,MAAM,QAAQ;AAC9D,QAAM,aAAa,iCAAiC,KAAK;AACzD,QAAM,aAAa,SAAS,WAAW;AACvC,QAAM,YAAY,WAAW,WAAW,uBAAuB,cAAc;AAC7E,QAAM,cAAc,QAAQ,QAAQ,MAAM,oBAAI,KAAK,IAAI,EAAE,YAAY;AACrE,QAAM,cACJ,KAAK,MAAM,UAAU,IAAI,KAAK,MAAM,WAAW,YAAY,IACvD,WAAW,eACX;AACN,QAAM,aAAa,wBAAmE;AAAA,IACpF;AAAA,IACA,iBAAiB,WAAW;AAAA,IAC5B,QAAQ,WAAW,SAAS;AAAA,IAC5B,SAAS,WAAW,QAAQ,IAAI,CAAC,YAAY;AAAA,MAC3C,GAAG;AAAA,MACH,eAAe,6BAA6B,YAAY,WAAW,OAAO,OAAO;AAAA,MACjF,cAAc,4BAA4B,WAAW,SAAS,GAAG,OAAO,OAAO;AAAA,IACjF,EAAE;AAAA,IACF;AAAA,IACA,SAAS,KAAK,MAAM,WAAW,KAAK,KAAK,MAAM,WAAW,SAAS;AAAA,EACrE,CAAC;AAED,MAAI,WAAW,SAAS;AACtB,QAAI,CAAC,QAAQ,WAAW;AACtB,aAAO,0BAA0B,YAAY,4BAA4B;AAAA,IAC3E;AACA,QAAI;AACJ,QAAI;AACF,mBAAa,MAAM,QAAQ,UAAU,UAAU;AAAA,IACjD,QAAQ;AACN,aAAO,0BAA0B,YAAY,sBAAsB;AAAA,IACrE;AACA,QAAI,eAAe,QAAW;AAC5B,aAAO,uCAAuC,YAAY;AAAA,QACxD,aAAa,WAAW;AAAA,QACxB,SAAS,EAAE,QAAQ,UAAU;AAAA,MAC/B,CAAC;AAAA,IACH;AACA,QAAI;AACF,aAAO,uCAAuC,EAAE,GAAG,OAAO,QAAQ,WAAW,CAAC;AAAA,IAChF,QAAQ;AACN,aAAO,0BAA0B,YAAY,wBAAwB;AAAA,IACvE;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,gBAAY,MAAM,QAAQ,WAAW,UAAU;AAAA,EACjD,QAAQ;AACN,WAAO,0BAA0B,YAAY,kBAAkB;AAAA,EACjE;AACA,MAAI;AACF,WAAO,uCAAuC,EAAE,GAAG,OAAO,QAAQ,UAAU,CAAC;AAAA,EAC/E,QAAQ;AACN,WAAO,0BAA0B,YAAY,gBAAgB;AAAA,EAC/D;AACF;AAEA,SAAS,0BACP,YACA,MACkC;AAClC,SAAO,uCAAuC,YAAY;AAAA,IACxD,aAAa,WAAW;AAAA,IACxB,SAAS;AAAA,MACP,QAAQ;AAAA,MACR;AAAA,MACA,SAAS;AAAA,IACX;AAAA,EACF,CAAC;AACH;AAEA,SAAS,sBACP,YACA,YACM;AACN,QAAM,aAAa,UAAU,WAAW,OAAO;AAC/C,QAAM,UAAU,UAAU,WAAW,OAAO;AAC5C,QAAM,qBAAqB,WAAW,QAAQ;AAAA,IAC5C,CAAC,WACC,yBAAyB,OAAO,YAAY,MAC5C,yBAAyB,4BAA4B,WAAW,QAAQ,OAAO,OAAO,CAAC;AAAA,EAC3F;AACA,MACE,WAAW,SAAS,QAAQ,QAC5B,CAAC,GAAG,WAAW,QAAQ,CAAC,EAAE;AAAA,IACxB,CAAC,CAAC,UAAU,MAAM,MAChB,QAAQ,IAAI,QAAQ,GAAG,uBAAuB,OAAO;AAAA,EACzD,KACA,WAAW,YAAY,KAAK,MAAM,WAAW,WAAW,KAAK,KAAK,MAAM,WAAW,SAAS,KAC5F,WAAW,gBAAgB,WAAW,WAAW,yBACjD,CAAC,sBACA,WAAW,WAAW,wBACrB,WAAW,OAAO,WAAW,WAAW,gBAAgB,QAC1D;AACA,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACF;AAEA,SAAS,8BACP,YACA,QACM;AACN,QAAM,cAAc,KAAK,MAAM,OAAO,WAAW;AACjD,QAAM,cAAc,KAAK,MAAM,OAAO,WAAW;AACjD,QAAM,YAAY,KAAK,MAAM,WAAW,SAAS;AACjD,MACE,OAAO,mBAAmB,WAAW,UACrC,cAAc,KAAK,MAAM,WAAW,YAAY,KAChD,cAAc,aACd;AACA,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AACA,QAAM,UAAU,eAAe;AAC/B,MACG,OAAO,QAAQ,WAAW,aAAa,CAAC,WACxC,WAAW,CAAC,CAAC,WAAW,iBAAiB,iBAAiB,EAAE,SAAS,OAAO,QAAQ,MAAM,GAC3F;AACA,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACA,MAAI,EAAE,aAAa,OAAO,SAAU;AACpC,QAAM,aAAa,UAAU,WAAW,OAAO;AAC/C,QAAM,WAAW,IAAI,IAAI,OAAO,QAAQ,QAAQ,IAAI,cAAc,CAAC;AACnE,MACE,WAAW,SAAS,SAAS,QAC7B,CAAC,GAAG,WAAW,KAAK,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC,SAAS,IAAI,QAAQ,CAAC,GACjE;AACA,UAAM,IAAI,MAAM,mEAAmE;AAAA,EACrF;AACA,MACE,OAAO,QAAQ,WAAW,aAC1B,OAAO,QAAQ,QAAQ;AAAA,IACrB,CAAC,WACC,OAAO,iBAAiB,WAAW,IAAI,eAAe,MAAM,CAAC,GAAG;AAAA,EACpE,GACA;AACA,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACF;AAEA,SAAS,yBACP,UACA,YACA,QACM;AACN,MAAI,EAAE,aAAa,OAAO,SAAU;AACpC,QAAM,aAAa,SAAS,WAAW;AACvC,QAAM,YAAY,WAAW,WAAW,uBAAuB,cAAc;AAC7E,QAAM,UAAU,IAAI;AAAA,IAClB,WAAW,QAAQ,IAAI,CAAC,WAAW;AAAA,MACjC,eAAe,MAAM;AAAA,MACrB,6BAA6B,YAAY,WAAW,OAAO,OAAO;AAAA,IACpE,CAAC;AAAA,EACH;AACA,4BAA0B,YAAY,QAAQ,OAAO;AACvD;AAEA,SAAS,0BACP,YACA,QACA,SACM;AACN,MAAI,EAAE,aAAa,OAAO,SAAU;AACpC,MAAI,OAAO,QAAQ,WAAW,WAAW;AACvC,QACE,OAAO,QAAQ,QAAQ;AAAA,MACrB,CAAC,WAAW,OAAO,gBAAgB,QAAQ,IAAI,eAAe,MAAM,CAAC;AAAA,IACvE,GACA;AACA,YAAM,IAAI,MAAM,wDAAwD;AAAA,IAC1E;AACA;AAAA,EACF;AACA,QAAM,aAAa,OAAO,QAAQ,QAAQ;AAAA,IACxC,CAAC,WAAW,OAAO,kBAAkB,QAAQ,IAAI,eAAe,MAAM,CAAC;AAAA,EACzE;AACA,MAAI,OAAO,QAAQ,WAAW,mBAAmB;AAC/C,QAAI,CAAC,WAAY,OAAM,IAAI,MAAM,0DAA0D;AAC3F;AAAA,EACF;AACA,QAAM,aAAa,UAAU,WAAW,OAAO;AAC/C,QAAM,iBAAiB,OAAO,QAAQ,QAAQ;AAAA,IAC5C,CAAC,WAAW,OAAO,kBAAkB,WAAW,IAAI,eAAe,MAAM,CAAC,GAAG;AAAA,EAC/E;AACA,MAAI,cAAc,CAAC,gBAAgB;AACjC,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACF;AAEA,SAAS,UACP,SACgB;AAChB,SAAO,IAAI,IAAI,QAAQ,IAAI,CAAC,WAAW,CAAC,eAAe,MAAM,GAAG,MAAM,CAAC,CAAC;AAC1E;AAEA,SAAS,eAAe,QAAwE;AAC9F,SAAO,GAAG,OAAO,OAAO,KAAS,OAAO,QAAQ;AAClD;","names":[]}