@tangle-network/agent-runtime 0.338.0 → 0.340.0

package/dist/candidate-execution/index.js

@@ -1,12 +1,12 @@
-import { A as verifyMaterializedWorkspace, C as candidateWorkspaceManifest, D as scanMaterializedWorkspaceManifest, E as readVerifiedArtifact, L as deepFreezeCandidate, N as verifiedArtifactChunks, P as canonicalCandidateBytes$1, R as embeddedCandidateArtifact, _ as workspaceLimits, a as materializeAgentCandidateWorkspaceFromArtifacts, c as verifyAgentCandidateWorkspaceTree, h as captureAgentCandidateWorkspaceFiles, i as captureAgentCandidateWorkspaceTreeToArtifacts, l as captureAgentCandidateWorkspace, r as captureAgentCandidateWorkspaceToArtifacts, s as verifyAgentCandidateWorkspaceArtifacts, u as createAgentCandidateWorkspacePort, v as persistCandidateOutputArtifact } from "../sandbox-profile-compat-xSoVtdWw.js";
-import { a as applyExactAgentProfileDiff, b as parseExactCandidateProfile, g as omitUndefinedObjectFields, i as agentCandidateProfileAsAgentProfile, o as assertCandidateProfileBinding, p as freezeGenericAgentCandidateProfile, v as parseExactAgentProfile, y as parseExactAgentProfileDiff } from "../profile-Do-5xO_D.js";
-import { t as sealAgentCandidateBundle } from "../bundle-DM60AI2B.js";
-import { A as candidateKnowledgeExecutionPaths, C as sealTerminalDigest, D as exactProcessProviderAsCandidateExecutor, E as sealAgentCandidateModelSettlement, F as CANDIDATE_TRACE_TAGS, N as verifyAgentCandidateBundle, O as CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV, P as CANDIDATE_TRACE_ENV, S as requireStagedTerminal, T as createProtectedAgentCandidateModelPort, _ as assertTerminalMatchesClaim, a as sealAgentCandidateExecutorStopAcknowledgement, b as rejectedFinish, c as beginPreparedCandidateDisposal, d as candidateClaimFileInternals, f as candidateCleanupDeadline, g as assertTerminalAllowedInPhase, h as assertRecoveryMatchesStaged, i as persistCandidateModelSettlementEvidence, j as AGENT_CANDIDATE_EXECUTION_SUPPORT, k as CANDIDATE_KNOWLEDGE_ROOT_ENV, l as consumePreparedCandidateExecution, m as withinCandidateCleanupDeadline, n as executePreparedAgentCandidate, o as candidateExecutionClaim, p as candidateCleanupTimeout, r as RecoveryAgentCandidateTraceStore, s as assertPreparedCandidateIntegrity, t as prepareAgentCandidateExecution, u as InMemoryAgentCandidateExecutionClaimStore, v as assertTerminalMatchesStaged, w as terminalRecord, x as rejectedStage, y as recoveredTerminalRecord } from "../prepare-Bt0IouPq.js";
-import { agentCandidateArtifactRefSchema, agentCandidateExecutionPlanMaterialSchema, agentCandidateMaterializationReceiptSchema, agentCandidateWorkspaceManifestMaterialSchema, agentCandidateWorkspaceSnapshotEvidenceSchema } from "@tangle-network/agent-interface";
-import { createHash, randomUUID } from "node:crypto";
-import { constants, linkSync } from "node:fs";
-import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { cp, lstat, mkdir, open, readdir, readlink, realpath, unlink } from "node:fs/promises";
+import { C as candidateWorkspaceManifest, I as deepFreezeCandidate, L as embeddedCandidateArtifact, M as verifiedArtifactChunks, N as canonicalCandidateBytes$1, _ as workspaceLimits, a as materializeAgentCandidateWorkspaceFromArtifacts, c as verifyAgentCandidateWorkspaceTree, h as captureAgentCandidateWorkspaceFiles, i as captureAgentCandidateWorkspaceTreeToArtifacts, l as captureAgentCandidateWorkspace, r as captureAgentCandidateWorkspaceToArtifacts, s as verifyAgentCandidateWorkspaceArtifacts, u as createAgentCandidateWorkspacePort } from "../sandbox-profile-compat-DRr3JwDx.js";
+import { a as applyExactAgentProfileDiff, b as parseExactCandidateProfile, i as agentCandidateProfileAsAgentProfile, o as assertCandidateProfileBinding, p as freezeGenericAgentCandidateProfile, v as parseExactAgentProfile, y as parseExactAgentProfileDiff } from "../profile-DToH0XEs.js";
+import { t as sealAgentCandidateBundle } from "../bundle-DNUq-OPW.js";
+import { _ as sealTerminalDigest, a as consumePreparedCandidateExecution, b as sealAgentCandidateModelSettlement, c as withinCandidateCleanupDeadline, d as assertTerminalMatchesClaim, f as assertTerminalMatchesStaged, g as requireStagedTerminal, h as rejectedStage, i as beginPreparedCandidateDisposal, l as assertRecoveryMatchesStaged, m as rejectedFinish, n as executePreparedAgentCandidate, o as candidateClaimFileInternals, p as recoveredTerminalRecord, r as assertPreparedCandidateIntegrity, s as candidateCleanupDeadline, t as prepareAgentCandidateExecution, u as assertTerminalAllowedInPhase, v as terminalRecord, w as verifyAgentCandidateBundle, x as exactProcessProviderAsCandidateExecutor, y as createProtectedAgentCandidateModelPort } from "../prepare-FzJoS68l.js";
+import { agentCandidateArtifactRefSchema, agentCandidateWorkspaceManifestMaterialSchema, agentCandidateWorkspaceSnapshotEvidenceSchema } from "@tangle-network/agent-interface";
+import { randomUUID } from "node:crypto";
+import { linkSync } from "node:fs";
+import { isAbsolute, join, resolve } from "node:path";
+import { lstat, mkdir, open, unlink } from "node:fs/promises";
 import { verifyCodeSurface } from "@tangle-network/agent-eval/campaign";
 //#region src/candidate-execution/builder.ts
 /**
@@ -439,145 +439,6 @@ function isCandidateGrantDrainingError(error) {
 	return typeof candidate.message === "string" && /\bcandidate_grant_draining\b/u.test(candidate.message);
 }
 //#endregion
-//#region src/candidate-execution/recover.ts
-/** Close an expired crashed attempt from persisted non-secret handles, then record failure. */
-async function recoverExpiredAgentCandidateExecution(options) {
-	const record = await options.claimStore.getAttempt(options.attempt);
-	if (!record) throw new Error("candidate execution recovery attempt is missing");
-	if (record.terminal) return Object.freeze({
-		finished: false,
-		terminal: record.terminal,
-		exactReplay: true
-	});
-	const cleanupTimeoutMs = candidateCleanupTimeout(options.cleanupTimeoutMs ?? record.claim.cleanup.cleanupTimeoutMs);
-	if (cleanupTimeoutMs > record.claim.cleanup.cleanupTimeoutMs) throw new Error("recovery cleanup timeout exceeds the frozen preparation bound");
-	if ((options.now ?? Date.now)() < record.claim.leaseExpiresAtMs) throw new Error("candidate execution lease has not expired");
-	const cleanupDeadlineAtMs = candidateCleanupDeadline(cleanupTimeoutMs);
-	const recoveryTraceStore = new RecoveryAgentCandidateTraceStore(options.traceStore);
-	const preparation = withinCandidateCleanupDeadline(() => readRecoveryPreparation(record.claim, options.outputArtifacts), cleanupDeadlineAtMs, "expired candidate preparation evidence read");
-	const processClosure = withinCandidateCleanupDeadline(async (cleanupSignal) => {
-		sealAgentCandidateExecutorStopAcknowledgement(await options.executor.stop({
-			executionId: record.claim.executionId,
-			executionPlanDigest: record.claim.executionPlanDigest
-		}, {
-			traceStore: recoveryTraceStore,
-			reason: "failed",
-			signal: cleanupSignal,
-			deadlineAtMs: cleanupDeadlineAtMs
-		}));
-		if (options.executor.dispose) {
-			const disposed = await options.executor.dispose({
-				executionId: record.claim.executionId,
-				executionPlanDigest: record.claim.executionPlanDigest
-			}, { signal: cleanupSignal });
-			if (disposed.disposed !== true || Object.keys(disposed).some((key) => key !== "disposed")) throw new Error("expired candidate executor did not acknowledge resource disposal");
-		}
-		return { stopped: true };
-	}, cleanupDeadlineAtMs, "expired candidate process termination");
-	const modelClosure = withinCandidateCleanupDeadline(async () => sealAgentCandidateModelSettlement(await options.ports.models.settleGrant({
-		executionId: record.claim.executionId,
-		preparationId: record.claim.cleanup.preparationId,
-		grantDigest: record.claim.cleanup.modelGrantDigest,
-		resolved: record.claim.cleanup.resolvedModel,
-		reason: "failed"
-	}), {
-		preparationId: record.claim.cleanup.preparationId,
-		grantDigest: record.claim.cleanup.modelGrantDigest,
-		model: record.claim.cleanup.resolvedModel.model
-	}), cleanupDeadlineAtMs, "expired candidate model settlement");
-	const memoryClosure = record.claim.cleanup.memory ? withinCandidateCleanupDeadline(async () => {
-		const memory = record.claim.cleanup.memory;
-		if (!memory) throw new Error("expired candidate memory handle is missing");
-		const closed = await options.ports.memory.close({
-			executionId: record.claim.executionId,
-			preparationId: record.claim.cleanup.preparationId,
-			accessDigest: memory.accessDigest,
-			effectiveNamespace: memory.effectiveNamespace,
-			reason: "failed"
-		});
-		if (closed.closed !== true || Object.keys(closed).some((key) => key !== "closed")) throw new Error("expired candidate memory did not acknowledge closure");
-		return { closed: true };
-	}, cleanupDeadlineAtMs, "expired candidate memory closure") : void 0;
-	const closureOutcomes = Promise.allSettled([modelClosure, memoryClosure ?? Promise.resolve(void 0)]);
-	const [preparationOutcome, processOutcome] = await Promise.allSettled([preparation, processClosure]);
-	const failures = [preparationOutcome, processOutcome].filter((outcome) => outcome.status === "rejected").map((outcome) => outcome.reason);
-	const [modelOutcome, memoryOutcome] = await closureOutcomes;
-	for (const outcome of [modelOutcome, memoryOutcome]) if (outcome.status === "rejected") failures.push(outcome.reason);
-	if (failures.length > 0) throw new AggregateError(failures, "expired candidate cleanup could not be proven");
-	if (modelOutcome.status !== "fulfilled") throw new Error("expired candidate model settlement was not recovered");
-	const model = modelOutcome.value;
-	const modelSettlement = await withinCandidateCleanupDeadline(() => persistCandidateModelSettlementEvidence({
-		executionId: record.claim.executionId,
-		executionPlanDigest: record.claim.executionPlanDigest,
-		resolvedModel: record.claim.cleanup.resolvedModel
-	}, model, options.outputArtifacts), cleanupDeadlineAtMs, "expired candidate model-settlement persistence");
-	const failureClass = record.phase === "claimed" && model.usage.modelCalls === 0 ? "pre-model-infrastructure" : "unknown";
-	const failureEvidence = await withinCandidateCleanupDeadline(() => persistCandidateOutputArtifact(options.outputArtifacts, {
-		executionId: record.claim.executionId,
-		purpose: "failure-evidence",
-		bytes: canonicalCandidateBytes$1({
-			kind: "agent-candidate-recovery-failure",
-			executionId: record.claim.executionId,
-			attempt: record.claim.attempt,
-			bundleDigest: record.claim.bundleDigest,
-			executionPlanDigest: record.claim.executionPlanDigest,
-			materializationReceiptDigest: record.claim.preparationEvidence.materializationReceipt.sha256,
-			failureClass,
-			processStopped: true,
-			modelSettlementDigest: modelSettlement.digest,
-			memoryClosed: record.claim.cleanup.memory !== void 0
-		})
-	}), cleanupDeadlineAtMs, "expired candidate failure-evidence persistence");
-	const memory = record.claim.cleanup.memory;
-	return await options.claimStore.recoverExpired(options.attempt, {
-		failureClass,
-		usage: model.usage,
-		modelSettlement: modelSettlement.artifact,
-		failureEvidence,
-		process: {
-			stopped: true,
-			executionPlanDigest: record.claim.executionPlanDigest
-		},
-		model: {
-			closed: true,
-			preparationId: record.claim.cleanup.preparationId,
-			grantDigest: record.claim.cleanup.modelGrantDigest
-		},
-		...memory ? { memory: {
-			closed: true,
-			preparationId: record.claim.cleanup.preparationId,
-			accessDigest: memory.accessDigest,
-			effectiveNamespace: memory.effectiveNamespace
-		} } : {}
-	});
-}
-async function readRecoveryPreparation(claim, artifacts) {
-	const [planBytes, receiptBytes] = await Promise.all([readVerifiedArtifact(claim.preparationEvidence.executionPlan, artifacts), readVerifiedArtifact(claim.preparationEvidence.materializationReceipt, artifacts)]);
-	const plan = agentCandidateExecutionPlanMaterialSchema.parse(parseCanonicalBytes(planBytes, "plan"));
-	if (claim.preparationEvidence.executionPlan.sha256 !== claim.executionPlanDigest) throw new Error("recovery execution plan artifact does not match the claimed digest");
-	const receiptMaterial = parseCanonicalBytes(receiptBytes, "materialization receipt");
-	const receipt = agentCandidateMaterializationReceiptSchema.parse({
-		...receiptMaterial,
-		digest: claim.preparationEvidence.materializationReceipt.sha256
-	});
-	if (receipt.bundleDigest !== claim.bundleDigest || receipt.executionPlan.digest !== claim.executionPlanDigest || plan.runCell.bundleDigest !== claim.bundleDigest || plan.executionId !== claim.executionId) throw new Error("recovery preparation evidence does not match the durable claim");
-	return {
-		plan,
-		receipt
-	};
-}
-function parseCanonicalBytes(bytes, label) {
-	let parsed;
-	try {
-		parsed = JSON.parse(Buffer.from(bytes).toString("utf8"));
-	} catch (error) {
-		throw new Error(`candidate recovery ${label} is not JSON`, { cause: error });
-	}
-	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`candidate recovery ${label} must be an object`);
-	if (!Buffer.from(canonicalCandidateBytes$1(parsed)).equals(Buffer.from(bytes))) throw new Error(`candidate recovery ${label} bytes are not canonical`);
-	return parsed;
-}
-//#endregion
 //#region src/candidate-execution/workspace-transfer.ts
 /**
 * Capture through the canonical archive owner and return references only.
@@ -657,252 +518,6 @@ async function assertAbsentDestination(destination) {
 	throw new Error("portable workspace destination already exists");
 }
 //#endregion
-//#region src/candidate-execution/workspace-tree.ts
-/**
-* A content digest over a DIRECTORY TREE, and the per-file seed that fills one.
-*
-* The question this answers is "is this workspace the same workspace" — the question every launch
-* and every close of a branchable run has to answer, about a tree that a live process is still
-* writing to. That is a different question from the one
-* {@link scanMaterializedWorkspaceManifest} answers, and the difference decides the policies here:
-*
-*  - A candidate manifest describes ONE EXACT regular-file workspace. It refuses a symbolic link
-*    outright, because `AgentCandidateWorkspaceManifestMaterial` has no representation for one, and
-*    it refuses an entry that disappears, because a signed manifest describes a settled tree.
-*  - A tree descriptor describes what a RUN PRODUCED. A python venv writes
-*    `bin/python -> /usr/bin/python3` as a matter of course, and a work directory can lose an entry
-*    between two directory reads. Refusing on either aborts the close, and a run that never wrote
-*    its digest can never be branched from.
-*
-* So the two policies are the caller's, one for links and one for vanishing entries, and both
-* default to `'refuse'` — the strict reading, correct for an INPUT seed, where a link that leaves
-* the tree means the seed describes bytes it does not contain. `'exclude'` is the reading a close
-* needs: the entry is never followed, it is recorded, and the exclusion itself is hashed, so two
-* trees that differ only in an excluded entry cannot share a digest.
-*
-* NOTHING is held in memory. A file reaches the tree digest as its own streamed sha-256 plus its
-* length, so the largest file in the tree does not decide whether the tree can be described:
-* `readFile` refuses anything above 2 GiB with `ERR_FS_FILE_TOO_LARGE`, and a single multi-gigabyte
-* artifact is exactly what a run leaves behind.
-*
-* @module
-* @experimental
-*/
-const TREE_ALGORITHMS = /* @__PURE__ */ new Set(["tree-v1", "portable-tree-v1"]);
-const ENTRY_POLICIES = /* @__PURE__ */ new Set(["refuse", "exclude"]);
-/**
-* Describe one directory tree by content, streaming every file.
-*
-* The digest covers, for every entry in sorted order: its kind, its tree-relative path, its mode
-* under the selected algorithm, and then — for a file, its length and its own sha-256; for a kept
-* link, its target; for an excluded entry, the reason and the target. A file's content therefore
-* never enters the tree hash directly, which is what removes any in-memory size ceiling: the tree
-* hash consumes 32 bytes per file however large the file is.
-*
-* A hard-linked regular file is described like any other regular file. Its content is what the
-* digest is about, and a package manager that links a store into `node_modules` is ordinary
-* content, not a reason to refuse a workspace.
-*/
-async function describeWorkspaceTree(directory, options = {}) {
-	const algorithm = options.algorithm ?? "tree-v1";
-	const onEscapingLink = options.onEscapingLink ?? "refuse";
-	const onMissingEntry = options.onMissingEntry ?? "refuse";
-	if (!TREE_ALGORITHMS.has(algorithm)) throw new Error(`unsupported workspace tree algorithm: ${algorithm}`);
-	for (const [name, policy] of [["onEscapingLink", onEscapingLink], ["onMissingEntry", onMissingEntry]]) if (!ENTRY_POLICIES.has(policy)) throw new Error(`unsupported workspace tree ${name} policy: ${policy}`);
-	const root = resolve(directory);
-	const rootStats = await lstatIfPresent(root);
-	if (rootStats === null || !rootStats.isDirectory() || rootStats.isSymbolicLink()) throw new Error(`workspace tree root must be a real directory: ${directory}`);
-	const physicalRoot = await realpath(root);
-	const hash = createHash("sha256");
-	hash.update(`workspace-tree\0${algorithm}\0`);
-	const counts = {
-		files: 0,
-		directories: 0,
-		symlinks: 0,
-		bytes: 0
-	};
-	const excluded = [];
-	const exclude = (path, reason, target) => {
-		const name = treePath(root, path);
-		excluded.push(Object.freeze(target === void 0 ? {
-			path: name,
-			reason
-		} : {
-			path: name,
-			reason,
-			target
-		}));
-		hash.update(`excluded\0${name}\0${reason}\0${target ?? ""}\0`);
-	};
-	/** True when the caller asked to continue past a vanished entry, and it was not the root. */
-	const recordMissing = (path) => {
-		if (onMissingEntry === "refuse" || path === root) return false;
-		exclude(path, "entry-disappeared");
-		return true;
-	};
-	const visit = async (path) => {
-		const info = await lstatIfPresent(path);
-		if (info === null) {
-			if (recordMissing(path)) return;
-			throw new Error(`workspace tree entry disappeared during the walk: ${treePath(root, path)}`);
-		}
-		const name = treePath(root, path);
-		const mode = entryMode(info.mode, algorithm, info.isDirectory(), info.isSymbolicLink());
-		if (info.isDirectory()) {
-			let entries;
-			try {
-				entries = await readdir(path);
-			} catch (error) {
-				if (isMissing(error) && recordMissing(path)) return;
-				throw error;
-			}
-			counts.directories += 1;
-			hash.update(`directory\0${name}\0${mode}\0`);
-			for (const entry of entries.sort()) await visit(join(path, entry));
-			return;
-		}
-		if (info.isSymbolicLink()) {
-			await visitSymbolicLink(path, name, mode);
-			return;
-		}
-		if (!info.isFile()) throw new Error(`workspace tree contains an unsupported entry: ${name}`);
-		const read = await digestFile(path);
-		if (read === null) {
-			if (recordMissing(path)) return;
-			throw new Error(`workspace tree entry disappeared during the walk: ${name}`);
-		}
-		counts.files += 1;
-		counts.bytes += read.byteLength;
-		hash.update(`file\0${name}\0${mode}\0${read.byteLength}\0${read.sha256}\0`);
-	};
-	const visitSymbolicLink = async (path, name, mode) => {
-		let target;
-		try {
-			target = await readlink(path);
-		} catch (error) {
-			if (isMissing(error) && recordMissing(path)) return;
-			throw error;
-		}
-		const refuse = (reason) => {
-			if (onEscapingLink === "refuse") throw new Error(`workspace tree contains a link that ${reasonText(reason)}: ${name} -> ${target}`);
-			exclude(path, reason, target);
-		};
-		if (isAbsolute(target)) return refuse("absolute-symlink");
-		if (!isWithin(root, resolve(dirname(path), target))) return refuse("symlink-escapes-tree");
-		let physicalTarget;
-		try {
-			physicalTarget = await realpath(path);
-		} catch {
-			return refuse("unresolved-symlink");
-		}
-		if (!isWithin(physicalRoot, physicalTarget)) return refuse("symlink-resolves-outside-tree");
-		counts.symlinks += 1;
-		hash.update(`symlink\0${name}\0${mode}\0${target}\0`);
-	};
-	await visit(root);
-	return Object.freeze({
-		algorithm,
-		digest: `sha256:${hash.digest("hex")}`,
-		files: counts.files,
-		directories: counts.directories,
-		symlinks: counts.symlinks,
-		bytes: counts.bytes,
-		excluded: Object.freeze(excluded)
-	});
-}
-/**
-* Seed a workspace from a directory, one entry at a time, and return the digest of what was
-* seeded.
-*
-* Nothing is packed: `cp` walks and copies file by file, so a multi-gigabyte seed costs one file
-* handle rather than one archive in memory. Existing destination entries are never overwritten —
-* a seed that could replace a file the workspace already holds would make the resulting tree
-* depend on the order two seeds ran in.
-*
-* Links are copied verbatim, exactly as they were written. Following them would copy bytes from
-* outside the seed into the workspace, which is the same rule {@link describeWorkspaceTree}
-* applies to the digest.
-*/
-async function seedWorkspaceTree(input) {
-	const source = resolve(input.source);
-	const destination = resolve(input.destination);
-	if (source === destination || isWithin(source, destination)) throw new Error("workspace seed must not contain its destination");
-	const destinationStats = await lstatIfPresent(destination);
-	if (destinationStats === null || !destinationStats.isDirectory()) throw new Error(`workspace seed destination must be an existing directory: ${input.destination}`);
-	const descriptor = await describeWorkspaceTree(source, { ...input.algorithm === void 0 ? {} : { algorithm: input.algorithm } });
-	for (const name of (await readdir(source)).sort()) {
-		if (await lstatIfPresent(join(destination, name)) !== null) throw new Error(`workspace seed would overwrite an existing entry: ${name}`);
-		await cp(join(source, name), join(destination, name), {
-			recursive: true,
-			force: false,
-			errorOnExist: true,
-			verbatimSymlinks: true
-		});
-	}
-	return descriptor;
-}
-/** Stream one regular file into its own digest, or `null` when it vanished mid-read. */
-async function digestFile(path) {
-	let descriptor;
-	try {
-		descriptor = await open(path, constants.O_RDONLY | (typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0));
-	} catch (error) {
-		if (isMissing(error)) return null;
-		throw error;
-	}
-	try {
-		const hash = createHash("sha256");
-		const buffer = Buffer.allocUnsafe(1024 * 1024);
-		let total = 0;
-		while (true) {
-			const { bytesRead } = await descriptor.read(buffer, 0, buffer.byteLength, null);
-			if (bytesRead === 0) break;
-			total += bytesRead;
-			hash.update(buffer.subarray(0, bytesRead));
-		}
-		return {
-			sha256: `sha256:${hash.digest("hex")}`,
-			byteLength: total
-		};
-	} finally {
-		await descriptor.close();
-	}
-}
-/** Git records exactly two file modes; a portable tree records the same two, plus 755 for a
-*  directory and 777 for a link, which is what every filesystem reports for one. */
-function entryMode(mode, algorithm, isDirectory, isSymbolicLink) {
-	const bits = Number(mode);
-	if (algorithm !== "portable-tree-v1") return String(bits & 511);
-	if (isDirectory) return "755";
-	if (isSymbolicLink) return "777";
-	return (bits & 73) !== 0 ? "755" : "644";
-}
-function reasonText(reason) {
-	switch (reason) {
-		case "absolute-symlink": return "is absolute";
-		case "symlink-escapes-tree": return "escapes its tree";
-		case "symlink-resolves-outside-tree": return "resolves outside its tree";
-		default: return "does not resolve";
-	}
-}
-function treePath(root, path) {
-	return relative(root, path).split(sep).join("/") || ".";
-}
-function isWithin(root, path) {
-	return path === root || path.startsWith(`${root}${sep}`);
-}
-function isMissing(error) {
-	return error?.code === "ENOENT";
-}
-async function lstatIfPresent(path) {
-	try {
-		return await lstat(path);
-	} catch (error) {
-		if (isMissing(error)) return null;
-		throw error;
-	}
-}
-//#endregion
-export { AGENT_CANDIDATE_EXECUTION_SUPPORT, CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV, CANDIDATE_KNOWLEDGE_ROOT_ENV, CANDIDATE_TRACE_ENV, CANDIDATE_TRACE_TAGS, FileAgentCandidateExecutionClaimStore, InMemoryAgentCandidateExecutionClaimStore, agentCandidateProfileAsAgentProfile, applyExactAgentProfileDiff, assertCandidateProfileBinding, buildAgentCandidateBundle, candidateExecutionClaim, candidateKnowledgeExecutionPaths, candidateWorkspaceManifest, captureAgentCandidateWorkspace, captureAgentCandidateWorkspaceFiles, captureAgentCandidateWorkspaceToArtifacts, captureAgentCandidateWorkspaceTreeToArtifacts, captureAgentWorkspaceSnapshot, createAgentCandidateWorkspacePort, createProtectedAgentCandidateModelPort, describeWorkspaceTree, disposePreparedAgentCandidateExecution, exactProcessProviderAsCandidateExecutor, executePreparedAgentCandidate, freezeGenericAgentCandidateProfile, materializeAgentCandidateWorkspaceFromArtifacts, materializeAgentWorkspaceSnapshot, omitUndefinedObjectFields, parseExactAgentProfile, parseExactAgentProfileDiff, parseExactCandidateProfile, persistCandidateOutputArtifact, prepareAgentCandidateExecution, recoverExpiredAgentCandidateExecution, runProtectedAgentCandidateModelGrant, scanMaterializedWorkspaceManifest, sealAgentCandidateBundle, seedWorkspaceTree, verifyAgentCandidateBundle, verifyAgentCandidateWorkspaceArtifacts, verifyAgentCandidateWorkspaceTree, verifyMaterializedWorkspace };
+export { FileAgentCandidateExecutionClaimStore, agentCandidateProfileAsAgentProfile, applyExactAgentProfileDiff, assertCandidateProfileBinding, buildAgentCandidateBundle, candidateWorkspaceManifest, captureAgentCandidateWorkspace, captureAgentCandidateWorkspaceFiles, captureAgentCandidateWorkspaceToArtifacts, captureAgentCandidateWorkspaceTreeToArtifacts, captureAgentWorkspaceSnapshot, createAgentCandidateWorkspacePort, createProtectedAgentCandidateModelPort, disposePreparedAgentCandidateExecution, exactProcessProviderAsCandidateExecutor, executePreparedAgentCandidate, freezeGenericAgentCandidateProfile, materializeAgentCandidateWorkspaceFromArtifacts, materializeAgentWorkspaceSnapshot, parseExactAgentProfileDiff, prepareAgentCandidateExecution, runProtectedAgentCandidateModelGrant, sealAgentCandidateBundle, verifyAgentCandidateBundle, verifyAgentCandidateWorkspaceArtifacts, verifyAgentCandidateWorkspaceTree };
 
 //# sourceMappingURL=index.js.map