@tangle-network/agent-runtime 0.239.0 → 0.246.0

package/dist/{prepare-Dc30WRB0.js → prepare-CibQrhfi.js}

@@ -1,4 +1,4 @@
-import { a as canonicalCandidateBytes, c as deepFreezeCandidate, d as omitTopLevelDigest, f as sha256Bytes, i as redactProtectedValue, l as embeddedCandidateArtifact, n as createProtectedRecordRedactor, o as canonicalCandidateDigest$1, r as redactProtectedReason, s as canonicalCandidateDocument, t as assertNoProtectedBytes, u as immutableCandidateValue } from "./protected-redaction-wGo44k2K.js";
+import { a as canonicalCandidateBytes$1, c as deepFreezeCandidate, d as omitTopLevelDigest, f as sha256Bytes, i as redactProtectedValue, l as embeddedCandidateArtifact, n as createProtectedRecordRedactor, o as canonicalCandidateDigest$1, r as redactProtectedReason, s as canonicalCandidateDocument, t as assertNoProtectedBytes, u as immutableCandidateValue } from "./protected-redaction-Fn1ETfJ-.js";
 import { agentCandidateArtifactRefSchema, agentCandidateBenchmarkResultEvidenceSchema, agentCandidateBenchmarkSuiteSchema, agentCandidateBenchmarkTaskSchema, agentCandidateBundleSchema, agentCandidateContainerSchema, agentCandidateExecutionLimitsSchema, agentCandidateExecutionPlanEvidenceSchema, agentCandidateExecutionPlanMaterialSchema, agentCandidateMaterializationReceiptSchema, agentCandidateModelAccessNetworkSchema, agentCandidateModelSettlementEvidenceSchema, agentCandidateProfileActivationSchema, agentCandidateProfilePlanEvidenceSchema, agentCandidateProfileSchema, agentCandidateResolvedModelSchema, agentCandidateRunCellSchema, agentCandidateRunReceiptSchema, agentCandidateTaskOutcomeEvidenceSchema, agentCandidateTaskOutcomeSpecSchema, agentCandidateTerminationSchema, agentCandidateWorkspaceManifestMaterialSchema, agentCandidateWorkspaceSnapshotEvidenceSchema, agentProfileDiffSchema, agentProfileSchema, applyAgentProfileDiff, sha256DigestSchema } from "@tangle-network/agent-interface";
 import { REDACTION_VERSION, isLlmSpan } from "@tangle-network/agent-eval";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
@@ -883,7 +883,7 @@ function verifyBytes(bytes, digest, byteLength, label) {
 }
 async function verifyWorkspaceSnapshotArtifacts(snapshot, port) {
 	const [manifest, archive] = await Promise.all([readVerifiedArtifact(snapshot.manifest, port), readVerifiedArtifact(snapshot.archive, port)]);
-	const canonicalManifest = canonicalCandidateBytes(snapshot.material);
+	const canonicalManifest = canonicalCandidateBytes$1(snapshot.material);
 	if (!Buffer.from(manifest).equals(Buffer.from(canonicalManifest))) throw new Error("workspace manifest artifact is not the exact canonical manifest material");
 	if (sha256Bytes(canonicalManifest) !== snapshot.digest) throw new Error("workspace snapshot digest does not match its canonical manifest material");
 	return {
@@ -967,8 +967,8 @@ function capturedBytes(entry) {
 	return entry.bytes;
 }
 function assertWorkspaceManifest(observed, expected) {
-	if (Buffer.from(canonicalCandidateBytes(observed)).equals(canonicalCandidateBytes(expected))) return;
-	if (Buffer.from(canonicalCandidateBytes(withPortableModes(observed))).equals(canonicalCandidateBytes(withPortableModes(expected)))) throw new Error("materialized workspace files do not match the signed manifest: only the file modes differ, so the capture and this verify disagree about portableTree");
+	if (Buffer.from(canonicalCandidateBytes$1(observed)).equals(canonicalCandidateBytes$1(expected))) return;
+	if (Buffer.from(canonicalCandidateBytes$1(withPortableModes(observed))).equals(canonicalCandidateBytes$1(withPortableModes(expected)))) throw new Error("materialized workspace files do not match the signed manifest: only the file modes differ, so the capture and this verify disagree about portableTree");
 	throw new Error("materialized workspace files, modes, or bytes do not match the signed manifest");
 }
 function withPortableModes(material) {
@@ -987,7 +987,7 @@ async function verifyMaterializedProfileWorkspace(root, expected, fileRoot = "wo
 		contentSha256: sha256
 	}));
 	const expectedFiles = expected.files.filter((file) => (file.root ?? "workspace") === fileRoot).map(({ root: _root, ...file }) => file);
-	if (!Buffer.from(canonicalCandidateBytes(observedProfile)).equals(canonicalCandidateBytes(expectedFiles))) throw new Error(`profile ${fileRoot} staging files, modes, or bytes do not match the signed profile plan`);
+	if (!Buffer.from(canonicalCandidateBytes$1(observedProfile)).equals(canonicalCandidateBytes$1(expectedFiles))) throw new Error(`profile ${fileRoot} staging files, modes, or bytes do not match the signed profile plan`);
 }
 async function walkWorkspace(root, options, keepBytes) {
 	const ignoredProtectedRootEntries = new Set(options.ignoredProtectedRootEntries ?? []);
@@ -1229,7 +1229,7 @@ async function verifyTaskOutcomePatch(input) {
 		if (resultTree !== input.resultTree) throw new Error(`task outcome patch materialized tree ${resultTree} does not match ${input.resultTree}`);
 		await assertSafeTree(repositoryRoot, resultTree, gitEnvironment);
 		const observed = await workspaceManifestFromGitTree(repositoryRoot, resultTree, gitEnvironment);
-		if (!Buffer.from(canonicalCandidateBytes(observed)).equals(Buffer.from(canonicalCandidateBytes(input.afterState)))) throw new Error("task outcome after-state does not match the materialized result tree");
+		if (!Buffer.from(canonicalCandidateBytes$1(observed)).equals(Buffer.from(canonicalCandidateBytes$1(input.afterState)))) throw new Error("task outcome after-state does not match the materialized result tree");
 		const resultCommit = (await runCandidateGit(repositoryRoot, [
 			"commit-tree",
 			resultTree,
@@ -1641,7 +1641,7 @@ function profileFileLabel(root, relPath) {
 /** Parse and check every native file hash plus both canonical document digests. */
 function parseAgentCandidateProfileActivation(input, expectedProfilePlanDigest) {
 	const activation = agentCandidateProfileActivationSchema.parse(input);
-	const planBytes = canonicalCandidateBytes(activation.profilePlan.material);
+	const planBytes = canonicalCandidateBytes$1(activation.profilePlan.material);
 	const profilePlanArtifact = activation.profilePlan.artifact;
 	if (sha256Bytes(planBytes) !== activation.profilePlan.digest || profilePlanArtifact.sha256 !== activation.profilePlan.digest || profilePlanArtifact.byteLength !== planBytes.byteLength || "content" in profilePlanArtifact && !Buffer.from(profilePlanArtifact.content, "base64").equals(Buffer.from(planBytes)) || expectedProfilePlanDigest !== void 0 && activation.profilePlan.digest !== expectedProfilePlanDigest) throw new Error("candidate profile activation has an invalid canonical profile plan");
 	if (canonicalCandidateDigest$1(omitTopLevelDigest(activation)) !== activation.digest) throw new Error("candidate profile activation digest does not match");
@@ -1827,7 +1827,7 @@ function copyDirectProfileFields(target, source) {
 	for (const key of CANDIDATE_PROFILE_DIRECT_FIELDS) if (source[key] !== void 0) target[key] = source[key];
 }
 function assertCanonicalParse(input, parsed, label) {
-	if (!Buffer.from(canonicalCandidateBytes(input)).equals(canonicalCandidateBytes(parsed))) throw new Error(`${label} contains unsupported or non-canonical fields`);
+	if (!Buffer.from(canonicalCandidateBytes$1(input)).equals(canonicalCandidateBytes$1(parsed))) throw new Error(`${label} contains unsupported or non-canonical fields`);
 }
 function publicResource(resource) {
 	if (resource.kind === "inline") return {
@@ -2083,7 +2083,7 @@ function assertPrivateCandidateIntegrity(state) {
 	assertPlanEvidence(state.executionPlan.value, state.executionPlan.bytes, "execution plan");
 	agentCandidateExecutionPlanEvidenceSchema.parse(state.executionPlan.value);
 	const receipt = agentCandidateMaterializationReceiptSchema.parse(state.materializationReceipt.value);
-	const receiptBytes = canonicalCandidateBytes(omitTopLevelDigest(receipt));
+	const receiptBytes = canonicalCandidateBytes$1(omitTopLevelDigest(receipt));
 	if (canonicalCandidateDigest$1(omitTopLevelDigest(receipt)) !== state.materializationReceipt.digest || !Buffer.from(receiptBytes).equals(Buffer.from(state.materializationReceipt.bytes))) throw new Error("prepared materialization receipt no longer matches its canonical bytes");
 	assertSignedBenchmarkInput(state);
 	const instruction = Buffer.from(state.benchmarkTask.instruction, "utf8");
@@ -2110,7 +2110,7 @@ function assertPrivateCandidateIntegrity(state) {
 	if (!state.trace.runId.startsWith(`${state.executionId}:attempt-${state.executionPlan.value.material.runCell.attempt}:`) || canonicalCandidateDigest$1(state.trace.tags) !== canonicalCandidateDigest$1(expectedTags) || canonicalCandidateDigest$1(state.trace.env) !== canonicalCandidateDigest$1(expectedTraceEnvironment)) throw new Error("prepared trace identity no longer matches the signed execution");
 }
 function assertPlanEvidence(evidence, bytes, label) {
-	const expected = canonicalCandidateBytes(evidence.material);
+	const expected = canonicalCandidateBytes$1(evidence.material);
 	if (sha256Bytes(expected) !== evidence.digest || !Buffer.from(expected).equals(Buffer.from(bytes)) || evidence.artifact.sha256 !== evidence.digest || evidence.artifact.byteLength !== bytes.byteLength || !("content" in evidence.artifact) || !Buffer.from(evidence.artifact.content, "base64").equals(Buffer.from(bytes))) throw new Error(`prepared ${label} no longer matches its canonical bytes`);
 }
 function evidenceView(evidence) {
@@ -2215,8 +2215,8 @@ function assertSignedBenchmarkInput(state) {
 	const receipt = state.materializationReceipt.value;
 	const cellIndex = cell.taskIndex * suite.reps + cell.repetition;
 	if (canonicalCandidateDigest$1(omitTopLevelDigest(suite)) !== suite.digest || canonicalCandidateDigest$1(omitTopLevelDigest(task)) !== task.digest || canonicalCandidateDigest$1(omitTopLevelDigest(cell)) !== cell.digest || cell.bundleDigest !== state.bundle.digest || cell.suiteDigest !== suite.digest || cell.taskDigest !== task.digest || suite.taskDigests[cell.taskIndex] !== task.digest || suite.seeds[cellIndex] !== cell.seed || cell.repetition >= suite.reps || cell.attempt < 1 || cell.attempt > task.attempt.maxAttempts) throw new Error("prepared candidate no longer matches its signed experiment cell");
-	const suiteBytes = canonicalCandidateBytes(omitTopLevelDigest(suite));
-	const taskBytes = canonicalCandidateBytes(omitTopLevelDigest(task));
+	const suiteBytes = canonicalCandidateBytes$1(omitTopLevelDigest(suite));
+	const taskBytes = canonicalCandidateBytes$1(omitTopLevelDigest(task));
 	if (receipt.benchmark.suite.digest !== suite.digest || receipt.benchmark.suite.material.sha256 !== sha256Bytes(suiteBytes) || receipt.benchmark.suite.material.byteLength !== suiteBytes.byteLength || receipt.benchmark.task.digest !== task.digest || receipt.benchmark.task.material.sha256 !== sha256Bytes(taskBytes) || receipt.benchmark.task.material.byteLength !== taskBytes.byteLength) throw new Error("materialization receipt no longer matches its signed benchmark input");
 }
 function immutableExecutorFiles(files) {
@@ -2662,7 +2662,7 @@ async function finalizeAgentCandidateRun(state, capture, traceStore, traceIdenti
 		}, protectedValues);
 		const combinedByRule = { ...writeRedactionReport?.byRule ?? {} };
 		for (const [rule, count] of Object.entries(redacted.report.byRule)) combinedByRule[rule] = (combinedByRule[rule] ?? 0) + count;
-		const traceBytes = canonicalCandidateBytes({
+		const traceBytes = canonicalCandidateBytes$1({
 			...redacted.value,
 			evaluatorLimits: { resultTimeoutMs: state.resultTimeoutMs },
 			redaction: {
@@ -2769,7 +2769,7 @@ async function memoryReceipt(state, capture, persisted, signal) {
 	if (!capture.memoryAfter) throw new Error("isolated memory is missing its protected after-state");
 	if (!persisted) throw new Error("isolated memory is missing persisted capture evidence");
 	const afterState = capture.memoryAfter.afterState;
-	const manifestBytes = canonicalCandidateBytes(afterState);
+	const manifestBytes = canonicalCandidateBytes$1(afterState);
 	const snapshot = agentCandidateWorkspaceSnapshotEvidenceSchema.parse({
 		kind: "agent-candidate-workspace-snapshot",
 		digest: sha256Bytes(manifestBytes),
@@ -2899,7 +2899,7 @@ async function persistAgentCandidateExecutorCapture(identity, expected, capture,
 	}) : void 0;
 	const taskOutcome = capture.taskOutcome ? await persistTaskCapture(identity.executionId, expected, capture.taskOutcome, outputArtifacts, signal) : void 0;
 	const memoryAfter = capture.memoryAfter ? await persistWorkspaceCapture(identity.executionId, "memory-after-manifest", "memory-after-archive", capture.memoryAfter.afterState, capture.memoryAfter.archive, outputArtifacts, signal) : void 0;
-	const bytes = canonicalCandidateBytes({
+	const bytes = canonicalCandidateBytes$1({
 		kind: "agent-candidate-executor-capture",
 		executionPlanDigest: identity.executionPlanDigest,
 		...executorEvidence ? { executorEvidence } : {},
@@ -2952,7 +2952,7 @@ async function persistTaskCapture(executionId, expected, capture, outputArtifact
 	};
 }
 async function persistWorkspaceCapture(executionId, manifestPurpose, archivePurpose, afterState, archiveBytes, outputArtifacts, signal) {
-	const manifestBytes = canonicalCandidateBytes(afterState);
+	const manifestBytes = canonicalCandidateBytes$1(afterState);
 	const [manifest, archive] = await Promise.all([persistCandidateOutputArtifact(outputArtifacts, {
 		executionId,
 		purpose: manifestPurpose,
@@ -3008,7 +3008,7 @@ async function persistCandidateModelSettlementEvidence(identity, settlement, out
 		})),
 		usage: settlement.usage
 	};
-	const bytes = canonicalCandidateBytes(material);
+	const bytes = canonicalCandidateBytes$1(material);
 	const digest = sha256Bytes(bytes);
 	const artifact = await persistCandidateOutputArtifact(outputArtifacts, {
 		executionId: identity.executionId,
@@ -3064,7 +3064,7 @@ async function verifyWorkspaceTaskCapture(state, capture, protectedValues, signa
 		afterState
 	});
 	signal?.throwIfAborted();
-	const manifestBytes = canonicalCandidateBytes(afterState);
+	const manifestBytes = canonicalCandidateBytes$1(afterState);
 	assertNoProtectedBytes(manifestBytes, protectedValues);
 	await verifyTaskOutcomeArchive(state, agentCandidateWorkspaceSnapshotEvidenceSchema.parse({
 		kind: "agent-candidate-workspace-snapshot",
@@ -3165,7 +3165,7 @@ async function persistVerifiedOutputTaskOutcome(state, verified, persisted, outp
 	});
 }
 async function persistTaskOutcomeEvidence(state, material, outputArtifacts, signal) {
-	const bytes = canonicalCandidateBytes(material);
+	const bytes = canonicalCandidateBytes$1(material);
 	const digest = sha256Bytes(bytes);
 	const artifact = await persistCandidateOutputArtifact(outputArtifacts, {
 		executionId: state.executionId,
@@ -3215,7 +3215,7 @@ async function persistCandidateBenchmarkResult(state, termination, outcome, grad
 		passed: evaluation.passed,
 		dimensions: evaluation.dimensions
 	};
-	const bytes = canonicalCandidateBytes(material);
+	const bytes = canonicalCandidateBytes$1(material);
 	const digest = sha256Bytes(bytes);
 	const artifact = await persistCandidateOutputArtifact(outputArtifacts, {
 		executionId: state.executionId,
@@ -3256,7 +3256,7 @@ async function verifyMemoryCapture(state, capture, protectedValues, signal) {
 	const memory = capture.memoryAfter;
 	if (!memory) throw new Error("isolated memory is missing its protected after-state");
 	if (memory.archive.byteLength === 0) throw new Error("isolated memory archive cannot be empty");
-	const manifestBytes = canonicalCandidateBytes(memory.afterState);
+	const manifestBytes = canonicalCandidateBytes$1(memory.afterState);
 	assertNoProtectedBytes(manifestBytes, protectedValues);
 	assertNoProtectedBytes(memory.archive, protectedValues);
 	const snapshot = agentCandidateWorkspaceSnapshotEvidenceSchema.parse({
@@ -3812,7 +3812,7 @@ async function finishClaim(store, lease, terminal, deadlineAtMs) {
 	}
 }
 async function persistFailureEvidence(state, reason, failureClass, termination, outputArtifacts) {
-	const bytes = canonicalCandidateBytes({
+	const bytes = canonicalCandidateBytes$1({
 		kind: "agent-candidate-execution-failure",
 		executionId: state.executionId,
 		bundleDigest: state.bundle.digest,
@@ -3870,7 +3870,7 @@ async function verifyAgentCandidateBundle(input, ports) {
 	const withoutDigest = omitTopLevelDigest(parsed);
 	const actualDigest = canonicalCandidateDigest$1(withoutDigest);
 	if (actualDigest !== parsed.digest) throw new Error(`candidate bundle digest ${parsed.digest} does not match ${actualDigest}`);
-	const canonicalBytes = canonicalCandidateBytes(withoutDigest);
+	const canonicalBytes = canonicalCandidateBytes$1(withoutDigest);
 	verifyBytes(canonicalBytes, parsed.digest, canonicalBytes.byteLength, "candidate bundle");
 	assertCandidateProfileExecutionSupport(parsed.profile);
 	const artifactBytes = /* @__PURE__ */ new Map();
@@ -4079,7 +4079,7 @@ async function prepareAgentCandidateExecution(candidate, task, ports, options =
 		});
 	}
 	const profilePlanBytes = await readVerifiedArtifact(profileApplication.profileActivation.profilePlan.artifact, ports.artifacts);
-	if (!Buffer.from(profilePlanBytes).equals(Buffer.from(canonicalCandidateBytes(profileApplication.profileActivation.profilePlan.material)))) throw new Error("profile materializer did not capture exact canonical plan bytes");
+	if (!Buffer.from(profilePlanBytes).equals(Buffer.from(canonicalCandidateBytes$1(profileApplication.profileActivation.profilePlan.material)))) throw new Error("profile materializer did not capture exact canonical plan bytes");
 	const profileActivation = profileApplication.profileActivation;
 	const container = await resolveContainer(candidate, task, ports);
 	const resolvedModel = await resolveModel(candidate, task, ports);
@@ -4162,7 +4162,7 @@ async function prepareAgentCandidateExecution(candidate, task, ports, options =
 			network: { mode: "disabled" }
 		};
 		agentCandidateExecutionPlanMaterialSchema.parse(executionMaterial);
-		const executionBytes = canonicalCandidateBytes(executionMaterial);
+		const executionBytes = canonicalCandidateBytes$1(executionMaterial);
 		const executionDigest = canonicalCandidateDigest$1(executionMaterial);
 		if (sha256Bytes(executionBytes) !== executionDigest) throw new Error("execution plan canonical serializers disagree");
 		const executionPlan = agentCandidateExecutionPlanEvidenceSchema.parse({
@@ -4179,11 +4179,11 @@ async function prepareAgentCandidateExecution(candidate, task, ports, options =
 			benchmark: {
 				suite: {
 					digest: task.benchmarkSuite.digest,
-					material: embeddedCandidateArtifact(canonicalCandidateBytes(omitTopLevelDigest(task.benchmarkSuite)))
+					material: embeddedCandidateArtifact(canonicalCandidateBytes$1(omitTopLevelDigest(task.benchmarkSuite)))
 				},
 				task: {
 					digest: benchmarkTask.digest,
-					material: embeddedCandidateArtifact(canonicalCandidateBytes(omitTopLevelDigest(benchmarkTask)))
+					material: embeddedCandidateArtifact(canonicalCandidateBytes$1(omitTopLevelDigest(benchmarkTask)))
 				}
 			},
 			profileActivation,
@@ -4607,4 +4607,4 @@ function errorMessage(error) {
 //#endregion
 export { assertTerminalMatchesStaged as $, omitUndefinedObjectFields as A, captureMaterializedWorkspace as B, agentCandidateProfileAsAgentProfile as C, createAgentCandidateProfileActivation as D, candidateProfileAgentPaths as E, assertNoGitIndirection as F, InMemoryAgentCandidateExecutionClaimStore as G, scanMaterializedWorkspaceManifest as H, readCandidateGitTreeFiles as I, candidateCleanupTimeout as J, candidateClaimFileInternals as K, runCandidateGit as L, parseExactAgentProfile as M, parseExactAgentProfileDiff as N, freezeGenericAgentCandidateProfile as O, parseExactCandidateProfile as P, assertTerminalMatchesClaim as Q, assertAgentCandidateExecutionRoots as R, PI_CANDIDATE_SESSION_DIR_ENV as S, assertCandidateProfileBinding as T, verifyBytes as U, readVerifiedArtifact as V, verifyMaterializedWorkspace as W, assertRecoveryMatchesStaged as X, withinCandidateCleanupDeadline as Y, assertTerminalAllowedInPhase as Z, beginPreparedCandidateDisposal as _, AGENT_CANDIDATE_EXECUTION_SUPPORT as a, terminalRecord as at, CANDIDATE_TRACE_TAGS as b, executePreparedAgentCandidate as c, persistCandidateOutputArtifact as d, recoveredTerminalRecord as et, sealAgentCandidateModelSettlement as f, assertPreparedCandidateIntegrity as g, candidateExecutionClaim as h, candidateKnowledgeExecutionPaths as i, sealTerminalDigest as it, parseAgentCandidateProfileActivation as j, materializeAgentCandidateProfilePlan as k, RecoveryAgentCandidateTraceStore as l, sealAgentCandidateExecutorStopAcknowledgement as m, CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV as n, rejectedStage as nt, verifiedResourceTextByDigest as o, assertExactObjectKeys as ot, usdToNanos as p, candidateCleanupDeadline as q, CANDIDATE_KNOWLEDGE_ROOT_ENV as r, requireStagedTerminal as rt, verifyAgentCandidateBundle as s, isWellFormedUnicode as st, prepareAgentCandidateExecution as t, rejectedFinish as tt, persistCandidateModelSettlementEvidence as u, consumePreparedCandidateExecution as v, applyExactAgentProfileDiff as w, PI_CANDIDATE_AGENT_DIR_ENV as x, CANDIDATE_TRACE_ENV as y, candidateWorkspaceManifest as z };
 
-//# sourceMappingURL=prepare-Dc30WRB0.js.map
+//# sourceMappingURL=prepare-CibQrhfi.js.map