@tangle-network/agent-runtime 0.348.1 → 0.350.2

package/dist/{profile-6OLpbjvV.js → profile-CAhZDW2T.js}

@@ -1,18 +1,15 @@
-import { m as ValidationError } from "./errors-DodWX-cb.js";
-import { B as sha256Bytes$1, F as canonicalCandidateDocument, L as embeddedCandidateArtifact, N as canonicalCandidateBytes$1, P as canonicalCandidateDigest$1, R as immutableCandidateValue, n as refuseSandboxProfileField, t as assertSandboxProfileCompatibility, z as omitTopLevelDigest } from "./sandbox-profile-compat-_fEtHPCj.js";
+import { m as ValidationError } from "./errors-wuhGvpE3.js";
+import { B as sha256Bytes$1, F as canonicalCandidateDocument, L as embeddedCandidateArtifact, N as canonicalCandidateBytes$1, P as canonicalCandidateDigest$1, R as immutableCandidateValue, U as nativeSystemPrompt, n as refuseSandboxProfileField, t as assertSandboxProfileCompatibility, z as omitTopLevelDigest } from "./sandbox-profile-compat-BxMQ1VXv.js";
 import { agentCandidateProfileActivationSchema, agentCandidateProfileSchema, agentProfileDiffSchema, agentProfileSchema, applyAgentProfileDiff } from "@tangle-network/agent-interface";
 import { posix } from "node:path";
 import { isMaterializerHarness, materializeCandidateProfile, resolvePiRuntimePaths } from "@tangle-network/agent-profile-materialize";
-//#region src/candidate-execution/public-config.ts
+// src/candidate-execution/public-config.ts
 /** Candidate execution has no private secret resolver; never lower a reference to argv or env. */
 function requirePublicCandidateConfigValue(value, path) {
 	if (value.kind !== "public") throw new ValidationError(`candidate ${path} requires a public value; secret references are unsupported`);
 	return value.value;
 }
-//#endregion
-//#region src/candidate-execution/system-prompt.ts
-const SYSTEM_PROMPT_FILE = ".tangle/system-prompt.md";
-const APPEND_SYSTEM_PROMPT_FILE = ".tangle/append-system-prompt.md";
+// src/candidate-execution/system-prompt.ts
 const SYSTEM_PROMPT_FLAGS = ["--system-prompt", "--system-prompt-file"];
 const APPEND_SYSTEM_PROMPT_FLAGS = ["--append-system-prompt", "--append-system-prompt-file"];
 function argsSetSystemPromptFlag(values) {
@@ -34,77 +31,46 @@ function argsSetCodexInstructionOverride(values) {
 const HARNESS_SYSTEM_PROMPTS = {
 	"claude-code": {
 		executable: "claude",
-		project: (plan, systemPrompt, path) => appendFlags(addPromptFile(plan, SYSTEM_PROMPT_FILE, systemPrompt), "--system-prompt-file", path),
-		projectAppend: (plan, appendSystemPrompt, path) => appendFlags(addPromptFile(plan, APPEND_SYSTEM_PROMPT_FILE, appendSystemPrompt), "--append-system-prompt-file", path),
 		conflictsWithArgs: argsSetSystemPromptFlag,
 		conflictsWithAppendArgs: argsSetAppendSystemPromptFlag
 	},
-	/** OpenCode's bound primary agent is already selected by the materializer's --agent flag. */
+	codex: {
+		executable: "codex",
+		conflictsWithArgs: argsSetCodexInstructionOverride,
+		conflictsWithAppendArgs: argsSetCodexInstructionOverride
+	},
 	opencode: {
 		executable: "opencode",
-		project: (plan) => plan,
-		retainsProjectedSystemPrompt: true,
 		conflictsWithArgs: (values) => values.some((value) => value === "--agent" || value.startsWith("--agent=")),
 		conflictsWithAppendArgs: argsSetAppendSystemPromptFlag
 	},
 	pi: {
 		executable: "pi",
-		project: (plan, systemPrompt, path) => appendFlags(addPromptFile(plan, SYSTEM_PROMPT_FILE, systemPrompt), "--system-prompt", path),
-		projectAppend: (plan, appendSystemPrompt, path) => appendFlags(addPromptFile(plan, APPEND_SYSTEM_PROMPT_FILE, appendSystemPrompt), "--append-system-prompt", path),
 		conflictsWithArgs: argsSetSystemPromptFlag,
 		conflictsWithAppendArgs: argsSetAppendSystemPromptFlag
 	},
 	prime: {
 		executable: "prime-agent",
-		project: (plan, systemPrompt, path) => appendFlags(addPromptFile(plan, SYSTEM_PROMPT_FILE, systemPrompt), "--system-prompt", path),
-		projectAppend: (plan, appendSystemPrompt, path) => appendFlags(addPromptFile(plan, APPEND_SYSTEM_PROMPT_FILE, appendSystemPrompt), "--append-system-prompt", path),
 		conflictsWithArgs: argsSetSystemPromptFlag,
 		conflictsWithAppendArgs: argsSetAppendSystemPromptFlag
 	},
-	/** Gemini's file and env lowering is materializer-owned; this row supplies the launch proof. */
 	gemini: {
 		executable: "gemini",
-		project: (plan) => plan,
 		conflictsWithArgs: argsSetSystemPromptFlag,
 		conflictsWithAppendArgs: argsSetAppendSystemPromptFlag
 	}
 };
-/**
-* These controls are lowered by agent-profile-materialize into files plus launch inputs. The
-* candidate adapter does not own the spawn, so it must reject an arbitrary entrypoint even when
-* the plan has the right bytes: only the native binary can make those inputs effective.
-*/
-const MATERIALIZED_PROMPT_DELIVERIES = {
-	codex: {
-		executable: "codex",
-		delivered: (plan) => plan.files.some((file) => file.relPath === ".codex/system-prompt.md") && plan.flags.some((flag) => requirePublicCandidateConfigValue(flag, "profile.flags") === "model_instructions_file=.codex/system-prompt.md"),
-		conflictsWithArgs: argsSetCodexInstructionOverride
-	},
-	gemini: {
-		executable: "gemini",
-		delivered: (plan) => {
-			const env = plan.env.GEMINI_SYSTEM_MD;
-			return plan.files.some((file) => file.relPath === ".gemini/system.md") && env !== void 0 && requirePublicCandidateConfigValue(env, "profile.env.GEMINI_SYSTEM_MD") === "1";
-		},
-		conflictsWithArgs: argsSetSystemPromptFlag
-	}
-};
 /** Project both prompt intents onto their distinct native process controls. */
 function projectCandidatePromptIntents(plan, launch, systemPromptFilePath, requestedSystemPrompt = plan.systemPrompt === void 0 ? void 0 : requirePublicCandidateConfigValue(plan.systemPrompt, "profile.systemPrompt"), requestedAppendSystemPrompt = plan.appendSystemPrompt === void 0 ? void 0 : requirePublicCandidateConfigValue(plan.appendSystemPrompt, "profile.appendSystemPrompt")) {
 	const systemPrompt = plan.systemPrompt;
 	const appendSystemPrompt = plan.appendSystemPrompt;
-	const delivery = MATERIALIZED_PROMPT_DELIVERIES[plan.harness];
-	if (systemPrompt === void 0 && delivery?.delivered(plan)) {
-		assertProvableNativeLaunch(plan.harness, delivery.executable, launch, "replacement");
-		assertNoShadowingArgs(plan.harness, delivery.conflictsWithArgs, launch, "replacement");
-		if (requestedSystemPrompt === void 0) return plan;
-		return plan;
-	}
+	const geminiSystem = plan.files.find((file) => file.relPath === ".gemini/system.md");
+	const delivered = plan.harness === "gemini" && geminiSystem?.content === requestedSystemPrompt && plan.env.GEMINI_SYSTEM_MD !== void 0 && requirePublicCandidateConfigValue(plan.env.GEMINI_SYSTEM_MD, "profile.env.GEMINI_SYSTEM_MD") === "1";
 	if (requestedSystemPrompt === void 0 && requestedAppendSystemPrompt === void 0) return plan;
 	const projection = HARNESS_SYSTEM_PROMPTS[plan.harness];
 	if (!projection) throw new Error(`candidate system prompt has no native launch projection for ${plan.harness}`);
 	const requestedReplacement = requestedSystemPrompt !== void 0;
-	if (requestedReplacement && systemPrompt === void 0) throw new Error(`profile materializer did not deliver the candidate system prompt for ${plan.harness}`);
+	if (requestedReplacement && systemPrompt === void 0 && !delivered) throw new Error(`profile materializer did not deliver the candidate system prompt for ${plan.harness}`);
 	if (systemPrompt !== void 0 && requestedSystemPrompt === void 0) throw new Error(`profile materializer added an unexpected candidate system prompt for ${plan.harness}`);
 	if (systemPrompt !== void 0 && requirePublicCandidateConfigValue(systemPrompt, "profile.systemPrompt") !== requestedSystemPrompt) throw new Error("profile materializer changed the candidate system prompt");
 	if (appendSystemPrompt !== void 0 && requirePublicCandidateConfigValue(appendSystemPrompt, "profile.appendSystemPrompt") !== requestedAppendSystemPrompt) throw new Error("profile materializer changed the candidate append system prompt");
@@ -113,51 +79,27 @@ function projectCandidatePromptIntents(plan, launch, systemPromptFilePath, reque
 	const launchArgs = (launch.args ?? []).map((value, index) => requirePublicCandidateConfigValue(value, `launch.args[${index}]`));
 	if (requestedReplacement && projection.conflictsWithArgs(launchArgs)) throw new Error(`${plan.harness} launch arguments conflict with the candidate profile system prompt`);
 	if (requestedAppendSystemPrompt !== void 0 && projection.conflictsWithAppendArgs(launchArgs)) throw new Error(`${plan.harness} launch arguments conflict with the candidate profile append system prompt`);
-	let projected = plan;
-	if (systemPrompt !== void 0) projected = projection.project(projection.retainsProjectedSystemPrompt ? projected : omitPromptIntent(projected, "systemPrompt"), requirePublicCandidateConfigValue(systemPrompt, "profile.systemPrompt"), systemPromptFilePath);
-	if (appendSystemPrompt !== void 0) {
-		if (!projection.projectAppend) throw new Error(`candidate append system prompt has no native launch projection for ${plan.harness}`);
-		projected = projection.projectAppend(omitPromptIntent(projected, "appendSystemPrompt"), requirePublicCandidateConfigValue(appendSystemPrompt, "profile.appendSystemPrompt"), posix.join(posix.dirname(systemPromptFilePath), "append-system-prompt.md"));
-	}
-	return projected;
+	if (plan.harness === "opencode" || plan.harness === "gemini") return plan;
+	const native = nativeSystemPrompt(plan.harness, {
+		...systemPrompt === void 0 ? {} : { systemPrompt: requestedSystemPrompt },
+		appendSystemPrompt: requestedAppendSystemPrompt
+	}, systemPromptFilePath);
+	for (const file of native.files) if (plan.files.some((existing) => existing.relPath === file.relPath)) throw new Error(`candidate profile conflicts with reserved ${file.relPath}`);
+	const { systemPrompt: _system, appendSystemPrompt: _append, ...projected } = plan;
+	return {
+		...projected,
+		files: [...plan.files, ...native.files],
+		flags: [...plan.flags, ...native.flags.map((value) => ({
+			kind: "public",
+			value
+		}))]
+	};
 }
 function assertProvableNativeLaunch(harness, expectedExecutable, launch, intent) {
 	if (launch.kind !== "container-command") throw new Error(`candidate-entrypoint launch cannot prove ${harness} system-prompt ${intent}`);
 	if (launch.executable !== expectedExecutable && !(posix.isAbsolute(launch.executable) && posix.basename(launch.executable) === expectedExecutable)) throw new Error(`${harness} system-prompt ${intent} requires the native ${expectedExecutable} executable`);
 }
-function assertNoShadowingArgs(harness, conflictsWithArgs, launch, intent) {
-	if (conflictsWithArgs((launch.args ?? []).map((value, index) => requirePublicCandidateConfigValue(value, `launch.args[${index}]`)))) throw new Error(`${harness} launch arguments conflict with the candidate profile ${intent === "replacement" ? "system" : "append system"} prompt`);
-}
-function omitPromptIntent(plan, intent) {
-	const projected = { ...plan };
-	delete projected[intent];
-	return projected;
-}
-function appendFlags(plan, ...values) {
-	return {
-		...plan,
-		flags: [...plan.flags, ...values.map(publicValue)]
-	};
-}
-function publicValue(value) {
-	return {
-		kind: "public",
-		value
-	};
-}
-function addPromptFile(plan, relPath, prompt) {
-	if (plan.files.some((file) => file.relPath === relPath)) throw new Error(`candidate profile conflicts with reserved ${relPath}`);
-	return {
-		...plan,
-		files: [...plan.files, {
-			relPath,
-			content: prompt,
-			source: "generated"
-		}]
-	};
-}
-//#endregion
-//#region src/candidate-execution/profile.ts
+// src/candidate-execution/profile.ts
 function candidateMaterializerHarness(harness) {
 	if (!isMaterializerHarness(harness)) throw new Error(`sealed candidate profile materialization is unsupported for harness ${harness}`);
 	return harness;
@@ -170,10 +112,32 @@ const PI_CANDIDATE_SESSION_DIR_ENV = "PI_CODING_AGENT_SESSION_DIR";
 function materializeAgentCandidateProfilePlan(options) {
 	const root = options.workspace === "task" ? options.workspaces.taskRoot : options.workspaces.candidateRoot;
 	if (!root) throw new Error("candidate profile target is missing its execution workspace root");
-	return projectCandidatePromptIntents(materializeCandidateProfile(options.profile, candidateMaterializerHarness(options.harness), {
+	const nativePrompt = [
+		"claude-code",
+		"codex",
+		"pi",
+		"prime"
+	].includes(options.harness) ? options.profile.prompt : void 0;
+	const { systemPrompt, appendSystemPrompt, ...structuralPrompt } = nativePrompt ?? {};
+	const plan = materializeCandidateProfile(nativePrompt === void 0 ? options.profile : {
+		...options.profile,
+		prompt: structuralPrompt
+	}, candidateMaterializerHarness(options.harness), {
 		binds: CANDIDATE_PROFILE_MATERIALIZER_BINDS,
 		resolvedResources: options.resolvedResources
-	}), options.launch, posix.join(root, ".tangle/system-prompt.md"), options.profile.prompt?.systemPrompt, options.profile.prompt?.appendSystemPrompt);
+	});
+	return projectCandidatePromptIntents(nativePrompt === void 0 ? plan : {
+		...plan,
+		sourceProfileDigest: canonicalCandidateDigest$1(options.profile),
+		...systemPrompt === void 0 ? {} : { systemPrompt: {
+			kind: "public",
+			value: systemPrompt
+		} },
+		...appendSystemPrompt === void 0 ? {} : { appendSystemPrompt: {
+			kind: "public",
+			value: appendSystemPrompt
+		} }
+	}, options.launch, posix.join(root, ".tangle/system-prompt.md"), options.profile.prompt?.systemPrompt, options.profile.prompt?.appendSystemPrompt);
 }
 /** Resolve the private Pi roots needed by an agent-root profile plan. */
 function candidateProfileAgentPaths(plan, runtimeHome) {
@@ -271,7 +235,8 @@ function candidateProfileFromGenericProfile(profile) {
 /** Prove the measured generic profile and sealed candidate profile describe the same behavior. */
 function assertCandidateProfileBinding(measuredInput, bundled) {
 	assertSandboxProfileCompatibility(measuredInput);
-	if (canonicalCandidateDigest$1(candidateProfileFromGenericProfile(parseExactAgentProfile(measuredInput, "measured agent profile"))) !== canonicalCandidateDigest$1(bundled)) throw new Error("measured agent profile does not match sealed candidate profile");
+	const expected = candidateProfileFromGenericProfile(parseExactAgentProfile(measuredInput, "measured agent profile"));
+	if (canonicalCandidateDigest$1(expected) !== canonicalCandidateDigest$1(bundled)) throw new Error("measured agent profile does not match sealed candidate profile");
 }
 /** Parse a complete profile without silently discarding unsupported fields. */
 function parseExactAgentProfile(input, label) {
@@ -297,7 +262,9 @@ function parseExactAgentProfileDiff(input, label) {
 }
 /** Apply one exact diff and reject any value that cannot be preserved canonically. */
 function applyExactAgentProfileDiff(baseInput, diffInput, label) {
-	return parseExactAgentProfile(omitUndefinedObjectFields(applyAgentProfileDiff(parseExactAgentProfile(baseInput, `${label} base profile`), parseExactAgentProfileDiff(diffInput, `${label} diff`)), label), `${label} result`);
+	const base = parseExactAgentProfile(baseInput, `${label} base profile`);
+	const diff = parseExactAgentProfileDiff(diffInput, `${label} diff`);
+	return parseExactAgentProfile(omitUndefinedObjectFields(applyAgentProfileDiff(base, diff), label), `${label} result`);
 }
 /** Parse a candidate profile without silently discarding unsupported or non-canonical fields. */
 function parseExactCandidateProfile(input) {
@@ -536,7 +503,6 @@ function exactProfileExecutorFiles(sourceFiles, expectedFiles) {
 		};
 	});
 }
-//#endregion
 export { parseAgentCandidateProfileActivation as _, applyExactAgentProfileDiff as a, parseExactCandidateProfile as b, buildLaunch as c, createAgentCandidateProfileActivation as d, exactProfileExecutorFiles as f, omitUndefinedObjectFields as g, modelRoutes as h, agentCandidateProfileAsAgentProfile as i, candidateEntrypointReceipt as l, materializeAgentCandidateProfilePlan as m, PI_CANDIDATE_SESSION_DIR_ENV as n, assertCandidateProfileBinding as o, freezeGenericAgentCandidateProfile as p, absoluteExecutionCwd as r, assertCandidateProfileExecutionSupport as s, PI_CANDIDATE_AGENT_DIR_ENV as t, candidateProfileAgentPaths as u, parseExactAgentProfile as v, requirePublicCandidateConfigValue as x, parseExactAgentProfileDiff as y };
 
-//# sourceMappingURL=profile-6OLpbjvV.js.map
+//# sourceMappingURL=profile-CAhZDW2T.js.map

package/dist/profile-CAhZDW2T.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-CAhZDW2T.js","names":["canonicalCandidateDigest","canonicalCandidateBytes","sha256Bytes"],"sources":["../src/candidate-execution/public-config.ts","../src/candidate-execution/system-prompt.ts","../src/candidate-execution/profile.ts"],"sourcesContent":["import type { AgentCandidateConfigValue } from '@tangle-network/agent-interface'\nimport { ValidationError } from '../errors'\n\n/** Candidate execution has no private secret resolver; never lower a reference to argv or env. */\nexport function requirePublicCandidateConfigValue(\n  value: AgentCandidateConfigValue,\n  path: string,\n): string {\n  if (value.kind !== 'public') {\n    throw new ValidationError(\n      `candidate ${path} requires a public value; secret references are unsupported`,\n    )\n  }\n  return value.value\n}\n","import { posix } from 'node:path'\nimport type {\n  AgentCandidateConfigValue,\n  AgentCandidateLaunch,\n} from '@tangle-network/agent-interface'\nimport type {\n  AgentCandidateWorkspacePlan,\n  HarnessId,\n} from '@tangle-network/agent-profile-materialize'\nimport { nativeSystemPrompt } from '../agent/native-system-prompt'\nimport { requirePublicCandidateConfigValue } from './public-config'\n\ninterface HarnessSystemPrompt {\n  readonly executable: string\n  readonly conflictsWithArgs: (values: readonly string[]) => boolean\n  readonly conflictsWithAppendArgs: (values: readonly string[]) => boolean\n}\n\nconst SYSTEM_PROMPT_FLAGS = ['--system-prompt', '--system-prompt-file'] as const\nconst APPEND_SYSTEM_PROMPT_FLAGS = [\n  '--append-system-prompt',\n  '--append-system-prompt-file',\n] as const\n\nfunction argsSetSystemPromptFlag(values: readonly string[]): boolean {\n  return values.some((value) =>\n    SYSTEM_PROMPT_FLAGS.some((flag) => value === flag || value.startsWith(`${flag}=`)),\n  )\n}\n\nfunction argsSetAppendSystemPromptFlag(values: readonly string[]): boolean {\n  return values.some((value) =>\n    APPEND_SYSTEM_PROMPT_FLAGS.some((flag) => value === flag || value.startsWith(`${flag}=`)),\n  )\n}\n\n/** Codex keys that can replace or contaminate the materializer's sealed instructions file. */\nconst CODEX_INSTRUCTION_KEYS = ['model_instructions_file', 'developer_instructions'] as const\n\nfunction argsSetCodexInstructionOverride(values: readonly string[]): boolean {\n  for (let index = 0; index < values.length; index++) {\n    const value = values[index]!\n    const config =\n      value === '-c' || value === '--config'\n        ? values[index + 1]\n        : value.startsWith('--config=')\n          ? value.slice('--config='.length)\n          : undefined\n    if (\n      config !== undefined &&\n      CODEX_INSTRUCTION_KEYS.some((key) => config.trimStart().startsWith(`${key}=`))\n    ) {\n      return true\n    }\n  }\n  return false\n}\n\nconst HARNESS_SYSTEM_PROMPTS = {\n  'claude-code': {\n    executable: 'claude',\n    conflictsWithArgs: argsSetSystemPromptFlag,\n    conflictsWithAppendArgs: argsSetAppendSystemPromptFlag,\n  },\n  codex: {\n    executable: 'codex',\n    conflictsWithArgs: argsSetCodexInstructionOverride,\n    conflictsWithAppendArgs: argsSetCodexInstructionOverride,\n  },\n  opencode: {\n    executable: 'opencode',\n    conflictsWithArgs: (values: readonly string[]) =>\n      values.some((value) => value === '--agent' || value.startsWith('--agent=')),\n    conflictsWithAppendArgs: argsSetAppendSystemPromptFlag,\n  },\n  pi: {\n    executable: 'pi',\n    conflictsWithArgs: argsSetSystemPromptFlag,\n    conflictsWithAppendArgs: argsSetAppendSystemPromptFlag,\n  },\n  prime: {\n    executable: 'prime-agent',\n    conflictsWithArgs: argsSetSystemPromptFlag,\n    conflictsWithAppendArgs: argsSetAppendSystemPromptFlag,\n  },\n  gemini: {\n    executable: 'gemini',\n    conflictsWithArgs: argsSetSystemPromptFlag,\n    conflictsWithAppendArgs: argsSetAppendSystemPromptFlag,\n  },\n} satisfies Partial<Record<HarnessId, HarnessSystemPrompt>>\n\n/** Project both prompt intents onto their distinct native process controls. */\nexport function projectCandidatePromptIntents(\n  plan: AgentCandidateWorkspacePlan,\n  launch: AgentCandidateLaunch,\n  systemPromptFilePath: string,\n  requestedSystemPrompt: string | undefined = plan.systemPrompt === undefined\n    ? undefined\n    : requirePublicCandidateConfigValue(plan.systemPrompt, 'profile.systemPrompt'),\n  requestedAppendSystemPrompt: string | undefined = plan.appendSystemPrompt === undefined\n    ? undefined\n    : requirePublicCandidateConfigValue(plan.appendSystemPrompt, 'profile.appendSystemPrompt'),\n): AgentCandidateWorkspacePlan {\n  const systemPrompt = plan.systemPrompt\n  const appendSystemPrompt = plan.appendSystemPrompt\n  const geminiSystem = plan.files.find((file) => file.relPath === '.gemini/system.md')\n  const delivered =\n    plan.harness === 'gemini' &&\n    geminiSystem?.content === requestedSystemPrompt &&\n    plan.env.GEMINI_SYSTEM_MD !== undefined &&\n    requirePublicCandidateConfigValue(plan.env.GEMINI_SYSTEM_MD, 'profile.env.GEMINI_SYSTEM_MD') ===\n      '1'\n\n  if (requestedSystemPrompt === undefined && requestedAppendSystemPrompt === undefined) {\n    return plan\n  }\n\n  const projection = HARNESS_SYSTEM_PROMPTS[plan.harness as keyof typeof HARNESS_SYSTEM_PROMPTS] as\n    | HarnessSystemPrompt\n    | undefined\n  if (!projection) {\n    throw new Error(`candidate system prompt has no native launch projection for ${plan.harness}`)\n  }\n\n  const requestedReplacement = requestedSystemPrompt !== undefined\n  if (requestedReplacement && systemPrompt === undefined && !delivered) {\n    throw new Error(\n      `profile materializer did not deliver the candidate system prompt for ${plan.harness}`,\n    )\n  }\n  if (systemPrompt !== undefined && requestedSystemPrompt === undefined) {\n    throw new Error(\n      `profile materializer added an unexpected candidate system prompt for ${plan.harness}`,\n    )\n  }\n  if (\n    systemPrompt !== undefined &&\n    requirePublicCandidateConfigValue(systemPrompt, 'profile.systemPrompt') !==\n      requestedSystemPrompt\n  ) {\n    throw new Error('profile materializer changed the candidate system prompt')\n  }\n  if (\n    appendSystemPrompt !== undefined &&\n    requirePublicCandidateConfigValue(appendSystemPrompt, 'profile.appendSystemPrompt') !==\n      requestedAppendSystemPrompt\n  ) {\n    throw new Error('profile materializer changed the candidate append system prompt')\n  }\n\n  const intent = requestedReplacement ? 'replacement' : 'addition'\n  assertProvableNativeLaunch(plan.harness, projection.executable, launch, intent)\n  const launchArgs = (launch.args ?? []).map((value, index) =>\n    requirePublicCandidateConfigValue(value, `launch.args[${index}]`),\n  )\n  if (requestedReplacement && projection.conflictsWithArgs(launchArgs)) {\n    throw new Error(\n      `${plan.harness} launch arguments conflict with the candidate profile system prompt`,\n    )\n  }\n  if (requestedAppendSystemPrompt !== undefined && projection.conflictsWithAppendArgs(launchArgs)) {\n    throw new Error(\n      `${plan.harness} launch arguments conflict with the candidate profile append system prompt`,\n    )\n  }\n\n  // These harnesses already have native file/config delivery owned by the materializer.\n  if (plan.harness === 'opencode' || plan.harness === 'gemini') return plan\n  const native = nativeSystemPrompt(\n    plan.harness,\n    {\n      ...(systemPrompt === undefined ? {} : { systemPrompt: requestedSystemPrompt }),\n      appendSystemPrompt: requestedAppendSystemPrompt,\n    },\n    systemPromptFilePath,\n  )\n  for (const file of native.files) {\n    if (plan.files.some((existing) => existing.relPath === file.relPath)) {\n      throw new Error(`candidate profile conflicts with reserved ${file.relPath}`)\n    }\n  }\n  const { systemPrompt: _system, appendSystemPrompt: _append, ...projected } = plan\n  return {\n    ...projected,\n    files: [...plan.files, ...native.files],\n    flags: [\n      ...plan.flags,\n      ...native.flags.map((value): AgentCandidateConfigValue => ({ kind: 'public', value })),\n    ],\n  }\n}\n\nfunction assertProvableNativeLaunch(\n  harness: string,\n  expectedExecutable: string,\n  launch: AgentCandidateLaunch,\n  intent: 'replacement' | 'addition',\n): asserts launch is AgentCandidateLaunch & { kind: 'container-command' } {\n  if (launch.kind !== 'container-command') {\n    throw new Error(`candidate-entrypoint launch cannot prove ${harness} system-prompt ${intent}`)\n  }\n  if (\n    launch.executable !== expectedExecutable &&\n    !(\n      posix.isAbsolute(launch.executable) &&\n      posix.basename(launch.executable) === expectedExecutable\n    )\n  ) {\n    throw new Error(\n      `${harness} system-prompt ${intent} requires the native ${expectedExecutable} executable`,\n    )\n  }\n}\n","import { posix } from 'node:path'\nimport type {\n  AgentCandidateConfigValue,\n  AgentCandidateExecutionPlanMaterial,\n  AgentCandidateLaunch,\n  AgentCandidateProfile,\n  AgentCandidateProfileActivation,\n  AgentCandidateProfilePlanEvidence,\n  AgentCandidateResourceRef,\n  AgentProfile,\n  AgentProfileConfigValue,\n  AgentProfileDiff,\n  AgentProfileMcpServer,\n  AgentProfileResourceRef,\n  HarnessType,\n  Sha256Digest,\n} from '@tangle-network/agent-interface'\nimport {\n  agentCandidateProfileActivationSchema,\n  agentCandidateProfileSchema,\n  agentProfileDiffSchema,\n  agentProfileSchema,\n  applyAgentProfileDiff,\n} from '@tangle-network/agent-interface'\nimport type {\n  AgentCandidateWorkspacePlan,\n  HarnessId,\n} from '@tangle-network/agent-profile-materialize'\nimport {\n  isMaterializerHarness,\n  materializeCandidateProfile,\n  resolvePiRuntimePaths,\n} from '@tangle-network/agent-profile-materialize'\nimport {\n  assertSandboxProfileCompatibility,\n  refuseSandboxProfileField,\n} from '../runtime/sandbox-profile-compat'\nimport {\n  canonicalCandidateBytes,\n  canonicalCandidateDigest,\n  canonicalCandidateDocument,\n  embeddedCandidateArtifact,\n  immutableCandidateValue,\n  omitTopLevelDigest,\n  sha256Bytes,\n} from './digest'\nimport { requirePublicCandidateConfigValue } from './public-config'\nimport { projectCandidatePromptIntents } from './system-prompt'\nimport type { AgentCandidateTaskExecution, VerifiedAgentCandidate } from './types'\n\nexport function candidateMaterializerHarness(harness: HarnessType): HarnessId {\n  if (!isMaterializerHarness(harness)) {\n    throw new Error(\n      `sealed candidate profile materialization is unsupported for harness ${harness}`,\n    )\n  }\n  return harness\n}\n\n/** Runtime applies the materializer's launch flags to the candidate process. */\nconst CANDIDATE_PROFILE_MATERIALIZER_BINDS = ['systemPrompt'] as const\nexport const PI_CANDIDATE_AGENT_DIR_ENV = 'PI_CODING_AGENT_DIR'\nexport const PI_CANDIDATE_SESSION_DIR_ENV = 'PI_CODING_AGENT_SESSION_DIR'\n\ninterface MaterializeAgentCandidateProfilePlanOptions {\n  profile: AgentCandidateProfile\n  harness: HarnessType\n  launch: AgentCandidateLaunch\n  workspace: 'task' | 'candidate'\n  workspaces: {\n    taskRoot: string\n    candidateRoot?: string\n  }\n  resolvedResources?: ReadonlyMap<Sha256Digest, string>\n}\n\n/** Derive the exact native profile plan used by preparation and later evidence checks. */\nexport function materializeAgentCandidateProfilePlan(\n  options: MaterializeAgentCandidateProfilePlanOptions,\n): AgentCandidateWorkspacePlan {\n  const root =\n    options.workspace === 'task' ? options.workspaces.taskRoot : options.workspaces.candidateRoot\n  if (!root) throw new Error('candidate profile target is missing its execution workspace root')\n  const nativePrompt = ['claude-code', 'codex', 'pi', 'prime'].includes(options.harness)\n    ? options.profile.prompt\n    : undefined\n  const { systemPrompt, appendSystemPrompt, ...structuralPrompt } = nativePrompt ?? {}\n  const plan = materializeCandidateProfile(\n    nativePrompt === undefined\n      ? options.profile\n      : {\n          ...options.profile,\n          prompt: structuralPrompt,\n        },\n    candidateMaterializerHarness(options.harness),\n    {\n      binds: CANDIDATE_PROFILE_MATERIALIZER_BINDS,\n      resolvedResources: options.resolvedResources,\n    },\n  )\n  return projectCandidatePromptIntents(\n    nativePrompt === undefined\n      ? plan\n      : {\n          ...plan,\n          sourceProfileDigest: canonicalCandidateDigest(options.profile),\n          ...(systemPrompt === undefined\n            ? {}\n            : { systemPrompt: { kind: 'public', value: systemPrompt } }),\n          ...(appendSystemPrompt === undefined\n            ? {}\n            : { appendSystemPrompt: { kind: 'public', value: appendSystemPrompt } }),\n        },\n    options.launch,\n    posix.join(root, '.tangle/system-prompt.md'),\n    options.profile.prompt?.systemPrompt,\n    options.profile.prompt?.appendSystemPrompt,\n  )\n}\n\n/** Resolve the private Pi roots needed by an agent-root profile plan. */\nexport function candidateProfileAgentPaths(\n  plan: {\n    harness: HarnessType\n    files: ReadonlyArray<{ root?: 'agent' | 'workspace' }>\n  },\n  runtimeHome: string | undefined,\n): { agentDir: string; sessionDir: string } | undefined {\n  if (!plan.files.some((file) => file.root === 'agent')) return undefined\n  if (plan.harness !== 'pi') {\n    throw new Error(`candidate profile agent-root files are unsupported for ${plan.harness}`)\n  }\n  if (runtimeHome === undefined) {\n    throw new Error('candidate profile agent-root files require executionRoots.profileRoot')\n  }\n  return resolvePiRuntimePaths(runtimeHome)\n}\n\n/** Bind exact native profile text to the canonical plan captured during preparation. */\nexport function createAgentCandidateProfileActivation(\n  plan: AgentCandidateWorkspacePlan,\n  profilePlan: AgentCandidateProfilePlanEvidence,\n): AgentCandidateProfileActivation {\n  const sourceByIdentity = new Map(\n    plan.files.map((file) => [profileFileIdentity(file.root, file.relPath), file]),\n  )\n  if (sourceByIdentity.size !== plan.files.length) {\n    throw new Error('candidate profile activation contains duplicate rooted native file paths')\n  }\n  const files = profilePlan.material.files.map((expected) => {\n    const source = sourceByIdentity.get(profileFileIdentity(expected.root, expected.relPath))\n    if (!source) {\n      throw new Error(\n        `candidate profile activation is missing ${profileFileLabel(expected.root, expected.relPath)}`,\n      )\n    }\n    const mode = source.mode ?? 0o644\n    if (!Number.isSafeInteger(mode) || mode < 0 || mode > 0o777) {\n      throw new Error(\n        `candidate profile activation has invalid mode for ${profileFileLabel(expected.root, expected.relPath)}`,\n      )\n    }\n    return { path: expected.relPath, mode, content: source.content }\n  })\n  if (files.length !== plan.files.length) {\n    throw new Error('candidate profile activation contains unplanned native files')\n  }\n  return parseAgentCandidateProfileActivation(\n    canonicalCandidateDocument<AgentCandidateProfileActivation>({\n      kind: 'agent-candidate-profile-activation',\n      profilePlan,\n      files,\n    }).value,\n    profilePlan.digest,\n  )\n}\n\nfunction profileFileIdentity(root: 'agent' | 'workspace' | undefined, relPath: string): string {\n  return `${root ?? 'workspace'}\\0${relPath}`\n}\n\nfunction profileFileLabel(root: 'agent' | 'workspace' | undefined, relPath: string): string {\n  return root === 'agent' ? `agent:${relPath}` : relPath\n}\n\n/** Parse and check every native file hash plus both canonical document digests. */\nexport function parseAgentCandidateProfileActivation(\n  input: unknown,\n  expectedProfilePlanDigest?: AgentCandidateProfilePlanEvidence['digest'],\n): AgentCandidateProfileActivation {\n  const activation = agentCandidateProfileActivationSchema.parse(input)\n  const planBytes = canonicalCandidateBytes(activation.profilePlan.material)\n  const profilePlanArtifact = activation.profilePlan.artifact\n  if (\n    sha256Bytes(planBytes) !== activation.profilePlan.digest ||\n    profilePlanArtifact.sha256 !== activation.profilePlan.digest ||\n    profilePlanArtifact.byteLength !== planBytes.byteLength ||\n    ('content' in profilePlanArtifact &&\n      !Buffer.from(profilePlanArtifact.content, 'base64').equals(Buffer.from(planBytes))) ||\n    (expectedProfilePlanDigest !== undefined &&\n      activation.profilePlan.digest !== expectedProfilePlanDigest)\n  ) {\n    throw new Error('candidate profile activation has an invalid canonical profile plan')\n  }\n  if (canonicalCandidateDigest(omitTopLevelDigest(activation)) !== activation.digest) {\n    throw new Error('candidate profile activation digest does not match')\n  }\n  return immutableCandidateValue(activation)\n}\n\nconst CANDIDATE_PROFILE_DIRECT_FIELDS = [\n  'name',\n  'description',\n  'version',\n  'tags',\n  'prompt',\n  'harness',\n  'permissions',\n  'tools',\n  'confidential',\n] as const\n\n/** Convert only behavior-preserving generic profile fields into the closed candidate contract. */\nexport function freezeGenericAgentCandidateProfile(input: AgentProfile): AgentCandidateProfile {\n  assertSandboxProfileCompatibility(input)\n  const profile = parseExactAgentProfile(input, 'profile')\n  return candidateProfileFromGenericProfile(profile)\n}\n\n/**\n * Keep every generic-profile-to-candidate conversion in one place.\n * Callers use this both when sealing a new bundle and when proving a measured\n * profile is exactly the profile in an existing candidate.\n */\nfunction candidateProfileFromGenericProfile(profile: AgentProfile): AgentCandidateProfile {\n  assertResolvedKnowledgeResources(profile.resources)\n  if (profile.connections !== undefined) unsupportedProfileField('connections')\n  if (profile.metadata !== undefined) unsupportedProfileField('metadata')\n  if (profile.extensions !== undefined) unsupportedProfileField('extensions')\n  if (profile.model?.metadata !== undefined) unsupportedProfileField('model.metadata')\n\n  const candidate: Record<string, unknown> = {}\n  copyDirectProfileFields(candidate, profile as Record<string, unknown>)\n  if (profile.model) {\n    const { metadata: _metadata, ...model } = profile.model\n    candidate.model = model\n  }\n  if (profile.mcp) candidate.mcp = freezeMcpServers(profile.mcp)\n  if (profile.subagents) {\n    candidate.subagents = Object.fromEntries(\n      Object.entries(profile.subagents).map(([name, subagent]) => {\n        if (subagent.metadata !== undefined) unsupportedProfileField(`subagents.${name}.metadata`)\n        const { metadata: _metadata, ...value } = subagent\n        return [name, value]\n      }),\n    )\n  }\n  if (profile.resources) candidate.resources = freezeResources(profile.resources)\n  if (profile.hooks && Object.values(profile.hooks).some((commands) => commands.length > 0)) {\n    throw new Error(\n      'generic AgentProfile hooks cannot be safely tokenized; use a candidate-profile source with executable/args',\n    )\n  }\n  if (profile.hooks) candidate.hooks = profile.hooks\n  if (profile.modes) {\n    candidate.modes = Object.fromEntries(\n      Object.entries(profile.modes).map(([name, mode]) => {\n        if (mode.metadata !== undefined) unsupportedProfileField(`modes.${name}.metadata`)\n        const { metadata: _metadata, ...value } = mode\n        return [name, value]\n      }),\n    )\n  }\n  const parsed = parseExactCandidateProfile(candidate)\n  return parsed\n}\n\n/** Prove the measured generic profile and sealed candidate profile describe the same behavior. */\nexport function assertCandidateProfileBinding(\n  measuredInput: unknown,\n  bundled: AgentCandidateProfile,\n): void {\n  assertSandboxProfileCompatibility(measuredInput)\n  const measured = parseExactAgentProfile(measuredInput, 'measured agent profile')\n  const expected = candidateProfileFromGenericProfile(measured)\n  if (canonicalCandidateDigest(expected) !== canonicalCandidateDigest(bundled)) {\n    throw new Error('measured agent profile does not match sealed candidate profile')\n  }\n}\n\n/** Parse a complete profile without silently discarding unsupported fields. */\nexport function parseExactAgentProfile(input: unknown, label: string): AgentProfile {\n  let parsed: AgentProfile\n  try {\n    parsed = agentProfileSchema.parse(input) as AgentProfile\n  } catch (cause) {\n    throw new Error(`${label} contains unsupported or non-canonical fields`, { cause })\n  }\n  assertCanonicalParse(input, parsed, label)\n  return parsed\n}\n\n/** Parse a profile diff without silently discarding unsupported fields. */\nexport function parseExactAgentProfileDiff(input: unknown, label: string): AgentProfileDiff {\n  let parsed: AgentProfileDiff\n  try {\n    parsed = agentProfileDiffSchema.parse(input) as AgentProfileDiff\n  } catch (cause) {\n    throw new Error(`${label} contains unsupported or non-canonical fields`, { cause })\n  }\n  assertCanonicalParse(input, parsed, label)\n  return parsed\n}\n\n/** Apply one exact diff and reject any value that cannot be preserved canonically. */\nexport function applyExactAgentProfileDiff(\n  baseInput: unknown,\n  diffInput: unknown,\n  label: string,\n): AgentProfile {\n  const base = parseExactAgentProfile(baseInput, `${label} base profile`)\n  const diff = parseExactAgentProfileDiff(diffInput, `${label} diff`)\n  const applied = omitUndefinedObjectFields(applyAgentProfileDiff(base, diff), label)\n  return parseExactAgentProfile(applied, `${label} result`)\n}\n\n/** Parse a candidate profile without silently discarding unsupported or non-canonical fields. */\nexport function parseExactCandidateProfile(input: unknown): AgentCandidateProfile {\n  const parsed = agentCandidateProfileSchema.parse(input)\n  assertCanonicalParse(input, parsed, 'candidate profile')\n  return parsed\n}\n\n/** Reject profile fields whose behavioral effect is not yet proven by candidate executors. */\nexport function assertCandidateProfileExecutionSupport(profile: AgentCandidateProfile): void {\n  assertResolvedKnowledgeResources(profile.resources)\n  assertSandboxProfileCompatibility(profile)\n  const fields = ['tools', 'permissions', 'modes', 'confidential'] as const\n  const unsupported = fields.filter((field) => hasEntries(profile[field]))\n  if (unsupported.length > 0) {\n    throw new Error(\n      `candidate execution cannot prove in-session effects for non-empty AgentProfile fields: ${unsupported.join(', ')}`,\n    )\n  }\n}\n\n/** Convert the candidate profile contract into the portable interface profile it represents. */\nexport function agentCandidateProfileAsAgentProfile(\n  candidate: AgentCandidateProfile,\n): AgentProfile {\n  assertResolvedKnowledgeResources(candidate.resources)\n  assertSandboxProfileCompatibility(candidate)\n  const output: Record<string, unknown> = {}\n  copyDirectProfileFields(output, candidate as unknown as Record<string, unknown>)\n  if (candidate.model) output.model = { ...candidate.model }\n  if (candidate.mcp) {\n    output.mcp = Object.fromEntries(\n      Object.entries(candidate.mcp).map(([name, server]) => [\n        name,\n        {\n          ...server,\n          // Candidate config values ({kind:'public', value}) are already valid\n          // AgentProfileConfigValue entries under interface >=0.40 — clone them\n          // rather than unwrapping to plain strings, which the 0.40 profile\n          // schema rejects.\n          ...(server.args ? { args: server.args.map((value) => ({ ...value })) } : {}),\n          ...(server.env ? { env: cloneRecord(server.env) } : {}),\n        },\n      ]),\n    )\n  }\n  if (candidate.subagents) output.subagents = cloneRecord(candidate.subagents)\n  if (candidate.modes) output.modes = cloneRecord(candidate.modes)\n  if (candidate.hooks) {\n    output.hooks = Object.fromEntries(\n      Object.entries(candidate.hooks).map(([event, hooks]) => [\n        event,\n        hooks.map(({ executable, args, env, ...hook }) => ({\n          ...hook,\n          command: [\n            executable,\n            ...(args ?? []).map((value, index) =>\n              requirePublicCandidateConfigValue(value, `hooks.${event}.args[${index}]`),\n            ),\n          ]\n            .map(shellQuote)\n            .join(' '),\n          // Hook env stays in config-value form: the 0.40 profile hook contract\n          // types env as Record<string, AgentProfileConfigValue>.\n          ...(env ? { env: cloneRecord(env) } : {}),\n        })),\n      ]),\n    )\n  }\n  if (candidate.resources) {\n    if (candidate.resources.failOnError !== true) {\n      throw new Error('sealed candidate profile contains fields unsupported by generic profiles')\n    }\n    output.resources = {\n      failOnError: true,\n      ...(candidate.resources.files\n        ? {\n            files: candidate.resources.files.map((file) => ({\n              ...file,\n              resource: publicResource(file.resource),\n            })),\n          }\n        : {}),\n      ...(candidate.resources.tools\n        ? { tools: candidate.resources.tools.map(publicResource) }\n        : {}),\n      ...(candidate.resources.skills\n        ? { skills: candidate.resources.skills.map(publicResource) }\n        : {}),\n      ...(candidate.resources.agents\n        ? { agents: candidate.resources.agents.map(publicResource) }\n        : {}),\n      ...(candidate.resources.commands\n        ? { commands: candidate.resources.commands.map(publicResource) }\n        : {}),\n      ...(candidate.resources.instructions !== undefined\n        ? {\n            instructions:\n              typeof candidate.resources.instructions === 'string'\n                ? candidate.resources.instructions\n                : publicResource(candidate.resources.instructions),\n          }\n        : {}),\n    }\n  }\n  return output as AgentProfile\n}\n\n/** Recursively remove undefined object fields while refusing undefined array entries. */\nexport function omitUndefinedObjectFields(value: unknown, path: string): unknown {\n  if (Array.isArray(value)) {\n    return value.map((entry, index) => {\n      if (entry === undefined) {\n        throw new Error(`${path} produced an undefined array entry at ${index}`)\n      }\n      return omitUndefinedObjectFields(entry, `${path}[${index}]`)\n    })\n  }\n  if (value === null || typeof value !== 'object') return value\n  return Object.fromEntries(\n    Object.entries(value as Record<string, unknown>)\n      .filter(([, entry]) => entry !== undefined)\n      .map(([key, entry]) => [key, omitUndefinedObjectFields(entry, `${path}.${key}`)]),\n  )\n}\n\nfunction freezeMcpServers(servers: Record<string, AgentProfileMcpServer>): Record<string, unknown> {\n  return Object.fromEntries(\n    Object.entries(servers).map(([name, server]) => {\n      if (server.transport !== undefined && server.transport !== 'stdio') {\n        unsupportedProfileField(`mcp.${name}.transport=${server.transport}`)\n      }\n      if (server.url !== undefined) unsupportedProfileField(`mcp.${name}.url`)\n      if (server.headers !== undefined) unsupportedProfileField(`mcp.${name}.headers`)\n      if (server.metadata !== undefined) unsupportedProfileField(`mcp.${name}.metadata`)\n      return [\n        name,\n        {\n          ...(server.transport ? { transport: server.transport } : {}),\n          ...(server.command ? { command: server.command } : {}),\n          ...(server.args\n            ? {\n                args: server.args.map((value, index) =>\n                  candidatePublicValue(value, `mcp.${name}.args[${index}]`),\n                ),\n              }\n            : {}),\n          ...(server.env ? { env: mapCandidatePublicValues(server.env, `mcp.${name}.env`) } : {}),\n          ...(server.cwd ? { cwd: server.cwd } : {}),\n          ...(server.enabled === undefined ? {} : { enabled: server.enabled }),\n        },\n      ]\n    }),\n  )\n}\n\n/** A newer peer may admit knowledge pins that these candidate conversions cannot preserve. */\nfunction assertResolvedKnowledgeResources(resources: unknown): void {\n  if (\n    resources !== null &&\n    typeof resources === 'object' &&\n    'knowledge' in resources &&\n    resources.knowledge !== undefined\n  ) {\n    throw new Error(\n      'candidate profile resources.knowledge must be owner-authorized and resolved before candidate conversion or execution',\n    )\n  }\n}\n\nfunction freezeResources(resources: NonNullable<AgentProfile['resources']>): unknown {\n  if (resources.failOnError !== true) {\n    throw new Error('candidate profile resources require failOnError: true')\n  }\n  return {\n    failOnError: true,\n    ...(resources.files\n      ? {\n          files: resources.files.map((file) => ({\n            ...file,\n            resource: freezeResource(file.resource),\n          })),\n        }\n      : {}),\n    ...(resources.tools ? { tools: resources.tools.map(freezeResource) } : {}),\n    ...(resources.skills ? { skills: resources.skills.map(freezeResource) } : {}),\n    ...(resources.agents ? { agents: resources.agents.map(freezeResource) } : {}),\n    ...(resources.commands ? { commands: resources.commands.map(freezeResource) } : {}),\n    ...(resources.instructions === undefined\n      ? {}\n      : {\n          instructions:\n            typeof resources.instructions === 'string'\n              ? resources.instructions\n              : freezeResource(resources.instructions),\n        }),\n  }\n}\n\nfunction freezeResource(resource: AgentProfileResourceRef): AgentCandidateResourceRef {\n  if (resource.kind === 'github') {\n    throw new Error(\n      'generic GitHub profile resources do not carry byte identity; use a candidate-profile source with a pinned commit, digest, and byte length',\n    )\n  }\n  const bytes = Buffer.from(resource.content, 'utf8')\n  return {\n    ...resource,\n    sha256: embeddedCandidateArtifact(bytes).sha256,\n    byteLength: bytes.byteLength,\n  }\n}\n\nfunction copyDirectProfileFields(\n  target: Record<string, unknown>,\n  source: Record<string, unknown>,\n): void {\n  for (const key of CANDIDATE_PROFILE_DIRECT_FIELDS) {\n    if (source[key] !== undefined) target[key] = source[key]\n  }\n}\n\nfunction assertCanonicalParse(input: unknown, parsed: unknown, label: string): void {\n  if (!Buffer.from(canonicalCandidateBytes(input)).equals(canonicalCandidateBytes(parsed))) {\n    throw new Error(`${label} contains unsupported or non-canonical fields`)\n  }\n}\n\nfunction publicResource(resource: AgentCandidateResourceRef): unknown {\n  if (resource.kind === 'inline') {\n    return { kind: 'inline', name: resource.name, content: resource.content }\n  }\n  return {\n    kind: 'github',\n    repository: `${resource.repository.owner}/${resource.repository.repo}`,\n    path: resource.path,\n    ref: resource.commit,\n    ...(resource.name ? { name: resource.name } : {}),\n  }\n}\n\n/** Freeze one profile config value into the candidate's PUBLIC-only config\n *  shape. A secret-ref is refused, never silently dropped or unwrapped. */\nfunction candidatePublicValue(\n  value: AgentProfileConfigValue,\n  path: string,\n): { kind: 'public'; value: string } {\n  if (value.kind !== 'public') refuseSandboxProfileField(`${path} (${value.kind})`)\n  return { kind: 'public', value: value.value }\n}\n\nfunction mapCandidatePublicValues(\n  values: Record<string, AgentProfileConfigValue>,\n  pathPrefix: string,\n): Record<string, { kind: 'public'; value: string }> {\n  return Object.fromEntries(\n    Object.entries(values).map(([name, value]) => [\n      name,\n      candidatePublicValue(value, `${pathPrefix}.${name}`),\n    ]),\n  )\n}\n\nfunction cloneRecord<T>(values: Record<string, T>): Record<string, T> {\n  return Object.fromEntries(\n    Object.entries(values).map(([key, value]) => [key, { ...value }]),\n  ) as Record<string, T>\n}\n\nfunction hasEntries(value: unknown): boolean {\n  return value !== undefined && value !== null && typeof value === 'object'\n    ? Object.keys(value).length > 0\n    : false\n}\n\nfunction shellQuote(value: string): string {\n  return /^[A-Za-z0-9_./:@%+=,-]+$/.test(value) ? value : `'${value.replaceAll(\"'\", `'\"'\"'`)}'`\n}\n\nfunction unsupportedProfileField(path: string): never {\n  throw new Error(\n    `generic AgentProfile field ${path} is not representable in a sealed candidate profile`,\n  )\n}\n\nexport function buildLaunch(\n  candidate: VerifiedAgentCandidate,\n  task: AgentCandidateTaskExecution,\n  profileFlags: AgentCandidateConfigValue[],\n): { executable: string; args: AgentCandidateConfigValue[] } {\n  const launch = candidate.bundle.execution.launch\n  if (launch.kind === 'container-command') {\n    return { executable: launch.executable, args: [...(launch.args ?? []), ...profileFlags] }\n  }\n  const candidateRoot = task.executionRoots.candidateRoot\n  if (!candidateRoot) throw new Error('candidate entrypoint requires a container candidate root')\n  const entrypoint = posix.join(candidateRoot, launch.entrypoint)\n  const candidateArgs = launch.args ?? []\n  if (launch.interpreter) {\n    return {\n      executable: launch.interpreter,\n      args: [{ kind: 'public', value: entrypoint }, ...candidateArgs, ...profileFlags],\n    }\n  }\n  return { executable: entrypoint, args: [...candidateArgs, ...profileFlags] }\n}\n\nexport function modelRoutes(\n  profile: VerifiedAgentCandidate['bundle']['profile'],\n  requested: string,\n): AgentCandidateExecutionPlanMaterial['model']['routes'] {\n  const routes: AgentCandidateExecutionPlanMaterial['model']['routes'] = [\n    { kind: 'primary', requested },\n  ]\n  if (profile.model?.small) routes.push({ kind: 'small', requested })\n  for (const name of Object.keys(profile.modes ?? {}).sort()) {\n    if (profile.modes?.[name]?.model) routes.push({ kind: 'mode', name, requested })\n  }\n  for (const name of Object.keys(profile.subagents ?? {}).sort()) {\n    if (profile.subagents?.[name]?.model) routes.push({ kind: 'subagent', name, requested })\n  }\n  return routes\n}\n\nexport function candidateEntrypointReceipt(\n  candidate: VerifiedAgentCandidate,\n): { path: string; sha256: `sha256:${string}`; byteLength: number } | undefined {\n  const launch = candidate.bundle.execution.launch\n  const workspace = candidate.bundle.execution.workspace\n  if (launch.kind !== 'candidate-entrypoint' || !workspace) return undefined\n  const file = workspace.material.files.find((entry) => entry.path === launch.entrypoint)\n  if (!file) throw new Error('candidate entrypoint is absent from the verified workspace')\n  return { path: file.path, sha256: file.sha256, byteLength: file.byteLength }\n}\n\nexport function absoluteExecutionCwd(\n  cwd: VerifiedAgentCandidate['bundle']['execution']['cwd'],\n  roots: AgentCandidateTaskExecution['executionRoots'],\n): string {\n  const root = workspaceExecutionRoot(cwd.workspace, roots)\n  const absolute = cwd.path === '.' ? root : posix.join(root, cwd.path)\n  if (absolute !== root && !absolute.startsWith(`${root}/`)) {\n    throw new Error('candidate cwd escapes its execution workspace')\n  }\n  return absolute\n}\n\nfunction workspaceExecutionRoot(\n  workspace: 'task' | 'candidate',\n  roots: AgentCandidateTaskExecution['executionRoots'],\n): string {\n  const root = workspace === 'task' ? roots.taskRoot : roots.candidateRoot\n  if (!root) throw new Error(`candidate ${workspace} workspace root is missing`)\n  return root\n}\n\nexport function exactProfileExecutorFiles(\n  sourceFiles: ReadonlyArray<{\n    relPath: string\n    content: string\n    mode?: number\n    root?: 'agent' | 'workspace'\n  }>,\n  expectedFiles: ReadonlyArray<{\n    relPath: string\n    mode: number\n    contentSha256: string\n    root?: 'agent'\n  }>,\n): Array<{ path: string; mode: number; root?: 'agent'; bytes: Uint8Array }> {\n  const byIdentity = new Map(\n    sourceFiles.map((file) => [profileFileIdentity(file.root, file.relPath), file]),\n  )\n  if (byIdentity.size !== sourceFiles.length || sourceFiles.length !== expectedFiles.length) {\n    throw new Error('profile source files do not match the signed profile plan')\n  }\n  return expectedFiles.map((expected) => {\n    const source = byIdentity.get(profileFileIdentity(expected.root, expected.relPath))\n    const mode = source?.mode ?? 0o644\n    const bytes = Buffer.from(source?.content ?? '', 'utf8')\n    if (\n      !source ||\n      !Number.isInteger(mode) ||\n      mode < 0 ||\n      mode > 0o777 ||\n      mode !== expected.mode ||\n      sha256Bytes(bytes) !== expected.contentSha256\n    ) {\n      throw new Error('profile source files do not match the signed profile plan')\n    }\n    return {\n      path: expected.relPath,\n      mode,\n      ...(expected.root === 'agent' ? { root: 'agent' as const } : {}),\n      bytes: Uint8Array.from(bytes),\n    }\n  })\n}\n"],"mappings":";;;;;;;AAIA,SAAgB,kCACd,OACA,MACQ;CACR,IAAI,MAAM,SAAS,UACjB,MAAM,IAAI,gBACR,aAAa,KAAK,4DACpB;CAEF,OAAO,MAAM;AACf;;ACIA,MAAM,sBAAsB,CAAC,mBAAmB,sBAAsB;AACtE,MAAM,6BAA6B,CACjC,0BACA,6BACF;AAEA,SAAS,wBAAwB,QAAoC;CACnE,OAAO,OAAO,MAAM,UAClB,oBAAoB,MAAM,SAAS,UAAU,QAAQ,MAAM,WAAW,GAAG,KAAK,EAAE,CAAC,CACnF;AACF;AAEA,SAAS,8BAA8B,QAAoC;CACzE,OAAO,OAAO,MAAM,UAClB,2BAA2B,MAAM,SAAS,UAAU,QAAQ,MAAM,WAAW,GAAG,KAAK,EAAE,CAAC,CAC1F;AACF;;AAGA,MAAM,yBAAyB,CAAC,2BAA2B,wBAAwB;AAEnF,SAAS,gCAAgC,QAAoC;CAC3E,KAAK,IAAI,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS;EAClD,MAAM,QAAQ,OAAO;EACrB,MAAM,SACJ,UAAU,QAAQ,UAAU,aACxB,OAAO,QAAQ,KACf,MAAM,WAAW,WAAW,IAC1B,MAAM,MAAM,CAAkB,IAC9B,KAAA;EACR,IACE,WAAW,KAAA,KACX,uBAAuB,MAAM,QAAQ,OAAO,UAAU,CAAC,CAAC,WAAW,GAAG,IAAI,EAAE,CAAC,GAE7E,OAAO;CAEX;CACA,OAAO;AACT;AAEA,MAAM,yBAAyB;CAC7B,eAAe;EACb,YAAY;EACZ,mBAAmB;EACnB,yBAAyB;CAC3B;CACA,OAAO;EACL,YAAY;EACZ,mBAAmB;EACnB,yBAAyB;CAC3B;CACA,UAAU;EACR,YAAY;EACZ,oBAAoB,WAClB,OAAO,MAAM,UAAU,UAAU,aAAa,MAAM,WAAW,UAAU,CAAC;EAC5E,yBAAyB;CAC3B;CACA,IAAI;EACF,YAAY;EACZ,mBAAmB;EACnB,yBAAyB;CAC3B;CACA,OAAO;EACL,YAAY;EACZ,mBAAmB;EACnB,yBAAyB;CAC3B;CACA,QAAQ;EACN,YAAY;EACZ,mBAAmB;EACnB,yBAAyB;CAC3B;AACF;;AAGA,SAAgB,8BACd,MACA,QACA,sBACA,wBAA4C,KAAK,iBAAiB,KAAA,IAC9D,KAAA,IACA,kCAAkC,KAAK,cAAc,sBAAsB,GAC/E,8BAAkD,KAAK,uBAAuB,KAAA,IAC1E,KAAA,IACA,kCAAkC,KAAK,oBAAoB,4BAA4B,GAC9D;CAC7B,MAAM,eAAe,KAAK;CAC1B,MAAM,qBAAqB,KAAK;CAChC,MAAM,eAAe,KAAK,MAAM,MAAM,SAAS,KAAK,YAAY,mBAAmB;CACnF,MAAM,YACJ,KAAK,YAAY,YACjB,cAAc,YAAY,yBAC1B,KAAK,IAAI,qBAAqB,KAAA,KAC9B,kCAAkC,KAAK,IAAI,kBAAkB,8BAA8B,MACzF;CAEJ,IAAI,0BAA0B,KAAA,KAAa,gCAAgC,KAAA,GACzE,OAAO;CAGT,MAAM,aAAa,uBAAuB,KAAK;CAG/C,IAAI,CAAC,YACH,MAAM,IAAI,MAAM,+DAA+D,KAAK,SAAS;CAG/F,MAAM,uBAAuB,0BAA0B,KAAA;CACvD,IAAI,wBAAwB,iBAAiB,KAAA,KAAa,CAAC,WACzD,MAAM,IAAI,MACR,wEAAwE,KAAK,SAC/E;CAEF,IAAI,iBAAiB,KAAA,KAAa,0BAA0B,KAAA,GAC1D,MAAM,IAAI,MACR,wEAAwE,KAAK,SAC/E;CAEF,IACE,iBAAiB,KAAA,KACjB,kCAAkC,cAAc,sBAAsB,MACpE,uBAEF,MAAM,IAAI,MAAM,0DAA0D;CAE5E,IACE,uBAAuB,KAAA,KACvB,kCAAkC,oBAAoB,4BAA4B,MAChF,6BAEF,MAAM,IAAI,MAAM,iEAAiE;CAGnF,MAAM,SAAS,uBAAuB,gBAAgB;CACtD,2BAA2B,KAAK,SAAS,WAAW,YAAY,QAAQ,MAAM;CAC9E,MAAM,cAAc,OAAO,QAAQ,CAAC,EAAA,CAAG,KAAK,OAAO,UACjD,kCAAkC,OAAO,eAAe,MAAM,EAAE,CAClE;CACA,IAAI,wBAAwB,WAAW,kBAAkB,UAAU,GACjE,MAAM,IAAI,MACR,GAAG,KAAK,QAAQ,oEAClB;CAEF,IAAI,gCAAgC,KAAA,KAAa,WAAW,wBAAwB,UAAU,GAC5F,MAAM,IAAI,MACR,GAAG,KAAK,QAAQ,2EAClB;CAIF,IAAI,KAAK,YAAY,cAAc,KAAK,YAAY,UAAU,OAAO;CACrE,MAAM,SAAS,mBACb,KAAK,SACL;EACE,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,sBAAsB;EAC5E,oBAAoB;CACtB,GACA,oBACF;CACA,KAAK,MAAM,QAAQ,OAAO,OACxB,IAAI,KAAK,MAAM,MAAM,aAAa,SAAS,YAAY,KAAK,OAAO,GACjE,MAAM,IAAI,MAAM,6CAA6C,KAAK,SAAS;CAG/E,MAAM,EAAE,cAAc,SAAS,oBAAoB,SAAS,GAAG,cAAc;CAC7E,OAAO;EACL,GAAG;EACH,OAAO,CAAC,GAAG,KAAK,OAAO,GAAG,OAAO,KAAK;EACtC,OAAO,CACL,GAAG,KAAK,OACR,GAAG,OAAO,MAAM,KAAK,WAAsC;GAAE,MAAM;GAAU;EAAM,EAAE,CACvF;CACF;AACF;AAEA,SAAS,2BACP,SACA,oBACA,QACA,QACwE;CACxE,IAAI,OAAO,SAAS,qBAClB,MAAM,IAAI,MAAM,4CAA4C,QAAQ,iBAAiB,QAAQ;CAE/F,IACE,OAAO,eAAe,sBACtB,EACE,MAAM,WAAW,OAAO,UAAU,KAClC,MAAM,SAAS,OAAO,UAAU,MAAM,qBAGxC,MAAM,IAAI,MACR,GAAG,QAAQ,iBAAiB,OAAO,uBAAuB,mBAAmB,YAC/E;AAEJ;;ACnKA,SAAgB,6BAA6B,SAAiC;CAC5E,IAAI,CAAC,sBAAsB,OAAO,GAChC,MAAM,IAAI,MACR,uEAAuE,SACzE;CAEF,OAAO;AACT;;AAGA,MAAM,uCAAuC,CAAC,cAAc;AAC5D,MAAa,6BAA6B;AAC1C,MAAa,+BAA+B;;AAe5C,SAAgB,qCACd,SAC6B;CAC7B,MAAM,OACJ,QAAQ,cAAc,SAAS,QAAQ,WAAW,WAAW,QAAQ,WAAW;CAClF,IAAI,CAAC,MAAM,MAAM,IAAI,MAAM,kEAAkE;CAC7F,MAAM,eAAe;EAAC;EAAe;EAAS;EAAM;CAAO,CAAC,CAAC,SAAS,QAAQ,OAAO,IACjF,QAAQ,QAAQ,SAChB,KAAA;CACJ,MAAM,EAAE,cAAc,oBAAoB,GAAG,qBAAqB,gBAAgB,CAAC;CACnF,MAAM,OAAO,4BACX,iBAAiB,KAAA,IACb,QAAQ,UACR;EACE,GAAG,QAAQ;EACX,QAAQ;CACV,GACJ,6BAA6B,QAAQ,OAAO,GAC5C;EACE,OAAO;EACP,mBAAmB,QAAQ;CAC7B,CACF;CACA,OAAO,8BACL,iBAAiB,KAAA,IACb,OACA;EACE,GAAG;EACH,qBAAqBA,2BAAyB,QAAQ,OAAO;EAC7D,GAAI,iBAAiB,KAAA,IACjB,CAAC,IACD,EAAE,cAAc;GAAE,MAAM;GAAU,OAAO;EAAa,EAAE;EAC5D,GAAI,uBAAuB,KAAA,IACvB,CAAC,IACD,EAAE,oBAAoB;GAAE,MAAM;GAAU,OAAO;EAAmB,EAAE;CAC1E,GACJ,QAAQ,QACR,MAAM,KAAK,MAAM,0BAA0B,GAC3C,QAAQ,QAAQ,QAAQ,cACxB,QAAQ,QAAQ,QAAQ,kBAC1B;AACF;;AAGA,SAAgB,2BACd,MAIA,aACsD;CACtD,IAAI,CAAC,KAAK,MAAM,MAAM,SAAS,KAAK,SAAS,OAAO,GAAG,OAAO,KAAA;CAC9D,IAAI,KAAK,YAAY,MACnB,MAAM,IAAI,MAAM,0DAA0D,KAAK,SAAS;CAE1F,IAAI,gBAAgB,KAAA,GAClB,MAAM,IAAI,MAAM,uEAAuE;CAEzF,OAAO,sBAAsB,WAAW;AAC1C;;AAGA,SAAgB,sCACd,MACA,aACiC;CACjC,MAAM,mBAAmB,IAAI,IAC3B,KAAK,MAAM,KAAK,SAAS,CAAC,oBAAoB,KAAK,MAAM,KAAK,OAAO,GAAG,IAAI,CAAC,CAC/E;CACA,IAAI,iBAAiB,SAAS,KAAK,MAAM,QACvC,MAAM,IAAI,MAAM,0EAA0E;CAE5F,MAAM,QAAQ,YAAY,SAAS,MAAM,KAAK,aAAa;EACzD,MAAM,SAAS,iBAAiB,IAAI,oBAAoB,SAAS,MAAM,SAAS,OAAO,CAAC;EACxF,IAAI,CAAC,QACH,MAAM,IAAI,MACR,2CAA2C,iBAAiB,SAAS,MAAM,SAAS,OAAO,GAC7F;EAEF,MAAM,OAAO,OAAO,QAAQ;EAC5B,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,KAAK,OAAO,KACpD,MAAM,IAAI,MACR,qDAAqD,iBAAiB,SAAS,MAAM,SAAS,OAAO,GACvG;EAEF,OAAO;GAAE,MAAM,SAAS;GAAS;GAAM,SAAS,OAAO;EAAQ;CACjE,CAAC;CACD,IAAI,MAAM,WAAW,KAAK,MAAM,QAC9B,MAAM,IAAI,MAAM,8DAA8D;CAEhF,OAAO,qCACL,2BAA4D;EAC1D,MAAM;EACN;EACA;CACF,CAAC,CAAC,CAAC,OACH,YAAY,MACd;AACF;AAEA,SAAS,oBAAoB,MAAyC,SAAyB;CAC7F,OAAO,GAAG,QAAQ,YAAY,IAAI;AACpC;AAEA,SAAS,iBAAiB,MAAyC,SAAyB;CAC1F,OAAO,SAAS,UAAU,SAAS,YAAY;AACjD;;AAGA,SAAgB,qCACd,OACA,2BACiC;CACjC,MAAM,aAAa,sCAAsC,MAAM,KAAK;CACpE,MAAM,YAAYC,0BAAwB,WAAW,YAAY,QAAQ;CACzE,MAAM,sBAAsB,WAAW,YAAY;CACnD,IACEC,cAAY,SAAS,MAAM,WAAW,YAAY,UAClD,oBAAoB,WAAW,WAAW,YAAY,UACtD,oBAAoB,eAAe,UAAU,cAC5C,aAAa,uBACZ,CAAC,OAAO,KAAK,oBAAoB,SAAS,QAAQ,CAAC,CAAC,OAAO,OAAO,KAAK,SAAS,CAAC,KAClF,8BAA8B,KAAA,KAC7B,WAAW,YAAY,WAAW,2BAEpC,MAAM,IAAI,MAAM,oEAAoE;CAEtF,IAAIF,2BAAyB,mBAAmB,UAAU,CAAC,MAAM,WAAW,QAC1E,MAAM,IAAI,MAAM,oDAAoD;CAEtE,OAAO,wBAAwB,UAAU;AAC3C;AAEA,MAAM,kCAAkC;CACtC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;AAGA,SAAgB,mCAAmC,OAA4C;CAC7F,kCAAkC,KAAK;CAEvC,OAAO,mCADS,uBAAuB,OAAO,SACE,CAAC;AACnD;;;;;;AAOA,SAAS,mCAAmC,SAA8C;CACxF,iCAAiC,QAAQ,SAAS;CAClD,IAAI,QAAQ,gBAAgB,KAAA,GAAW,wBAAwB,aAAa;CAC5E,IAAI,QAAQ,aAAa,KAAA,GAAW,wBAAwB,UAAU;CACtE,IAAI,QAAQ,eAAe,KAAA,GAAW,wBAAwB,YAAY;CAC1E,IAAI,QAAQ,OAAO,aAAa,KAAA,GAAW,wBAAwB,gBAAgB;CAEnF,MAAM,YAAqC,CAAC;CAC5C,wBAAwB,WAAW,OAAkC;CACrE,IAAI,QAAQ,OAAO;EACjB,MAAM,EAAE,UAAU,WAAW,GAAG,UAAU,QAAQ;EAClD,UAAU,QAAQ;CACpB;CACA,IAAI,QAAQ,KAAK,UAAU,MAAM,iBAAiB,QAAQ,GAAG;CAC7D,IAAI,QAAQ,WACV,UAAU,YAAY,OAAO,YAC3B,OAAO,QAAQ,QAAQ,SAAS,CAAC,CAAC,KAAK,CAAC,MAAM,cAAc;EAC1D,IAAI,SAAS,aAAa,KAAA,GAAW,wBAAwB,aAAa,KAAK,UAAU;EACzF,MAAM,EAAE,UAAU,WAAW,GAAG,UAAU;EAC1C,OAAO,CAAC,MAAM,KAAK;CACrB,CAAC,CACH;CAEF,IAAI,QAAQ,WAAW,UAAU,YAAY,gBAAgB,QAAQ,SAAS;CAC9E,IAAI,QAAQ,SAAS,OAAO,OAAO,QAAQ,KAAK,CAAC,CAAC,MAAM,aAAa,SAAS,SAAS,CAAC,GACtF,MAAM,IAAI,MACR,4GACF;CAEF,IAAI,QAAQ,OAAO,UAAU,QAAQ,QAAQ;CAC7C,IAAI,QAAQ,OACV,UAAU,QAAQ,OAAO,YACvB,OAAO,QAAQ,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,UAAU;EAClD,IAAI,KAAK,aAAa,KAAA,GAAW,wBAAwB,SAAS,KAAK,UAAU;EACjF,MAAM,EAAE,UAAU,WAAW,GAAG,UAAU;EAC1C,OAAO,CAAC,MAAM,KAAK;CACrB,CAAC,CACH;CAGF,OADe,2BAA2B,SAC9B;AACd;;AAGA,SAAgB,8BACd,eACA,SACM;CACN,kCAAkC,aAAa;CAE/C,MAAM,WAAW,mCADA,uBAAuB,eAAe,wBACI,CAAC;CAC5D,IAAIA,2BAAyB,QAAQ,MAAMA,2BAAyB,OAAO,GACzE,MAAM,IAAI,MAAM,gEAAgE;AAEpF;;AAGA,SAAgB,uBAAuB,OAAgB,OAA6B;CAClF,IAAI;CACJ,IAAI;EACF,SAAS,mBAAmB,MAAM,KAAK;CACzC,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,GAAG,MAAM,gDAAgD,EAAE,MAAM,CAAC;CACpF;CACA,qBAAqB,OAAO,QAAQ,KAAK;CACzC,OAAO;AACT;;AAGA,SAAgB,2BAA2B,OAAgB,OAAiC;CAC1F,IAAI;CACJ,IAAI;EACF,SAAS,uBAAuB,MAAM,KAAK;CAC7C,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,GAAG,MAAM,gDAAgD,EAAE,MAAM,CAAC;CACpF;CACA,qBAAqB,OAAO,QAAQ,KAAK;CACzC,OAAO;AACT;;AAGA,SAAgB,2BACd,WACA,WACA,OACc;CACd,MAAM,OAAO,uBAAuB,WAAW,GAAG,MAAM,cAAc;CACtE,MAAM,OAAO,2BAA2B,WAAW,GAAG,MAAM,MAAM;CAElE,OAAO,uBADS,0BAA0B,sBAAsB,MAAM,IAAI,GAAG,KACzC,GAAG,GAAG,MAAM,QAAQ;AAC1D;;AAGA,SAAgB,2BAA2B,OAAuC;CAChF,MAAM,SAAS,4BAA4B,MAAM,KAAK;CACtD,qBAAqB,OAAO,QAAQ,mBAAmB;CACvD,OAAO;AACT;;AAGA,SAAgB,uCAAuC,SAAsC;CAC3F,iCAAiC,QAAQ,SAAS;CAClD,kCAAkC,OAAO;CAEzC,MAAM,cAAc;EADJ;EAAS;EAAe;EAAS;CACxB,CAAC,CAAC,QAAQ,UAAU,WAAW,QAAQ,MAAM,CAAC;CACvE,IAAI,YAAY,SAAS,GACvB,MAAM,IAAI,MACR,0FAA0F,YAAY,KAAK,IAAI,GACjH;AAEJ;;AAGA,SAAgB,oCACd,WACc;CACd,iCAAiC,UAAU,SAAS;CACpD,kCAAkC,SAAS;CAC3C,MAAM,SAAkC,CAAC;CACzC,wBAAwB,QAAQ,SAA+C;CAC/E,IAAI,UAAU,OAAO,OAAO,QAAQ,EAAE,GAAG,UAAU,MAAM;CACzD,IAAI,UAAU,KACZ,OAAO,MAAM,OAAO,YAClB,OAAO,QAAQ,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY,CACpD,MACA;EACE,GAAG;EAKH,GAAI,OAAO,OAAO,EAAE,MAAM,OAAO,KAAK,KAAK,WAAW,EAAE,GAAG,MAAM,EAAE,EAAE,IAAI,CAAC;EAC1E,GAAI,OAAO,MAAM,EAAE,KAAK,YAAY,OAAO,GAAG,EAAE,IAAI,CAAC;CACvD,CACF,CAAC,CACH;CAEF,IAAI,UAAU,WAAW,OAAO,YAAY,YAAY,UAAU,SAAS;CAC3E,IAAI,UAAU,OAAO,OAAO,QAAQ,YAAY,UAAU,KAAK;CAC/D,IAAI,UAAU,OACZ,OAAO,QAAQ,OAAO,YACpB,OAAO,QAAQ,UAAU,KAAK,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CACtD,OACA,MAAM,KAAK,EAAE,YAAY,MAAM,KAAK,GAAG,YAAY;EACjD,GAAG;EACH,SAAS,CACP,YACA,IAAI,QAAQ,CAAC,EAAA,CAAG,KAAK,OAAO,UAC1B,kCAAkC,OAAO,SAAS,MAAM,QAAQ,MAAM,EAAE,CAC1E,CACF,CAAC,CACE,IAAI,UAAU,CAAC,CACf,KAAK,GAAG;EAGX,GAAI,MAAM,EAAE,KAAK,YAAY,GAAG,EAAE,IAAI,CAAC;CACzC,EAAE,CACJ,CAAC,CACH;CAEF,IAAI,UAAU,WAAW;EACvB,IAAI,UAAU,UAAU,gBAAgB,MACtC,MAAM,IAAI,MAAM,0EAA0E;EAE5F,OAAO,YAAY;GACjB,aAAa;GACb,GAAI,UAAU,UAAU,QACpB,EACE,OAAO,UAAU,UAAU,MAAM,KAAK,UAAU;IAC9C,GAAG;IACH,UAAU,eAAe,KAAK,QAAQ;GACxC,EAAE,EACJ,IACA,CAAC;GACL,GAAI,UAAU,UAAU,QACpB,EAAE,OAAO,UAAU,UAAU,MAAM,IAAI,cAAc,EAAE,IACvD,CAAC;GACL,GAAI,UAAU,UAAU,SACpB,EAAE,QAAQ,UAAU,UAAU,OAAO,IAAI,cAAc,EAAE,IACzD,CAAC;GACL,GAAI,UAAU,UAAU,SACpB,EAAE,QAAQ,UAAU,UAAU,OAAO,IAAI,cAAc,EAAE,IACzD,CAAC;GACL,GAAI,UAAU,UAAU,WACpB,EAAE,UAAU,UAAU,UAAU,SAAS,IAAI,cAAc,EAAE,IAC7D,CAAC;GACL,GAAI,UAAU,UAAU,iBAAiB,KAAA,IACrC,EACE,cACE,OAAO,UAAU,UAAU,iBAAiB,WACxC,UAAU,UAAU,eACpB,eAAe,UAAU,UAAU,YAAY,EACvD,IACA,CAAC;EACP;CACF;CACA,OAAO;AACT;;AAGA,SAAgB,0BAA0B,OAAgB,MAAuB;CAC/E,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,MAAM,KAAK,OAAO,UAAU;EACjC,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,GAAG,KAAK,wCAAwC,OAAO;EAEzE,OAAO,0BAA0B,OAAO,GAAG,KAAK,GAAG,MAAM,EAAE;CAC7D,CAAC;CAEH,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU,OAAO;CACxD,OAAO,OAAO,YACZ,OAAO,QAAQ,KAAgC,CAAC,CAC7C,QAAQ,GAAG,WAAW,UAAU,KAAA,CAAS,CAAC,CAC1C,KAAK,CAAC,KAAK,WAAW,CAAC,KAAK,0BAA0B,OAAO,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CACpF;AACF;AAEA,SAAS,iBAAiB,SAAyE;CACjG,OAAO,OAAO,YACZ,OAAO,QAAQ,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY;EAC9C,IAAI,OAAO,cAAc,KAAA,KAAa,OAAO,cAAc,SACzD,wBAAwB,OAAO,KAAK,aAAa,OAAO,WAAW;EAErE,IAAI,OAAO,QAAQ,KAAA,GAAW,wBAAwB,OAAO,KAAK,KAAK;EACvE,IAAI,OAAO,YAAY,KAAA,GAAW,wBAAwB,OAAO,KAAK,SAAS;EAC/E,IAAI,OAAO,aAAa,KAAA,GAAW,wBAAwB,OAAO,KAAK,UAAU;EACjF,OAAO,CACL,MACA;GACE,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;GAC1D,GAAI,OAAO,UAAU,EAAE,SAAS,OAAO,QAAQ,IAAI,CAAC;GACpD,GAAI,OAAO,OACP,EACE,MAAM,OAAO,KAAK,KAAK,OAAO,UAC5B,qBAAqB,OAAO,OAAO,KAAK,QAAQ,MAAM,EAAE,CAC1D,EACF,IACA,CAAC;GACL,GAAI,OAAO,MAAM,EAAE,KAAK,yBAAyB,OAAO,KAAK,OAAO,KAAK,KAAK,EAAE,IAAI,CAAC;GACrF,GAAI,OAAO,MAAM,EAAE,KAAK,OAAO,IAAI,IAAI,CAAC;GACxC,GAAI,OAAO,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,OAAO,QAAQ;EACpE,CACF;CACF,CAAC,CACH;AACF;;AAGA,SAAS,iCAAiC,WAA0B;CAClE,IACE,cAAc,QACd,OAAO,cAAc,YACrB,eAAe,aACf,UAAU,cAAc,KAAA,GAExB,MAAM,IAAI,MACR,sHACF;AAEJ;AAEA,SAAS,gBAAgB,WAA4D;CACnF,IAAI,UAAU,gBAAgB,MAC5B,MAAM,IAAI,MAAM,uDAAuD;CAEzE,OAAO;EACL,aAAa;EACb,GAAI,UAAU,QACV,EACE,OAAO,UAAU,MAAM,KAAK,UAAU;GACpC,GAAG;GACH,UAAU,eAAe,KAAK,QAAQ;EACxC,EAAE,EACJ,IACA,CAAC;EACL,GAAI,UAAU,QAAQ,EAAE,OAAO,UAAU,MAAM,IAAI,cAAc,EAAE,IAAI,CAAC;EACxE,GAAI,UAAU,SAAS,EAAE,QAAQ,UAAU,OAAO,IAAI,cAAc,EAAE,IAAI,CAAC;EAC3E,GAAI,UAAU,SAAS,EAAE,QAAQ,UAAU,OAAO,IAAI,cAAc,EAAE,IAAI,CAAC;EAC3E,GAAI,UAAU,WAAW,EAAE,UAAU,UAAU,SAAS,IAAI,cAAc,EAAE,IAAI,CAAC;EACjF,GAAI,UAAU,iBAAiB,KAAA,IAC3B,CAAC,IACD,EACE,cACE,OAAO,UAAU,iBAAiB,WAC9B,UAAU,eACV,eAAe,UAAU,YAAY,EAC7C;CACN;AACF;AAEA,SAAS,eAAe,UAA8D;CACpF,IAAI,SAAS,SAAS,UACpB,MAAM,IAAI,MACR,2IACF;CAEF,MAAM,QAAQ,OAAO,KAAK,SAAS,SAAS,MAAM;CAClD,OAAO;EACL,GAAG;EACH,QAAQ,0BAA0B,KAAK,CAAC,CAAC;EACzC,YAAY,MAAM;CACpB;AACF;AAEA,SAAS,wBACP,QACA,QACM;CACN,KAAK,MAAM,OAAO,iCAChB,IAAI,OAAO,SAAS,KAAA,GAAW,OAAO,OAAO,OAAO;AAExD;AAEA,SAAS,qBAAqB,OAAgB,QAAiB,OAAqB;CAClF,IAAI,CAAC,OAAO,KAAKC,0BAAwB,KAAK,CAAC,CAAC,CAAC,OAAOA,0BAAwB,MAAM,CAAC,GACrF,MAAM,IAAI,MAAM,GAAG,MAAM,8CAA8C;AAE3E;AAEA,SAAS,eAAe,UAA8C;CACpE,IAAI,SAAS,SAAS,UACpB,OAAO;EAAE,MAAM;EAAU,MAAM,SAAS;EAAM,SAAS,SAAS;CAAQ;CAE1E,OAAO;EACL,MAAM;EACN,YAAY,GAAG,SAAS,WAAW,MAAM,GAAG,SAAS,WAAW;EAChE,MAAM,SAAS;EACf,KAAK,SAAS;EACd,GAAI,SAAS,OAAO,EAAE,MAAM,SAAS,KAAK,IAAI,CAAC;CACjD;AACF;;;AAIA,SAAS,qBACP,OACA,MACmC;CACnC,IAAI,MAAM,SAAS,UAAU,0BAA0B,GAAG,KAAK,IAAI,MAAM,KAAK,EAAE;CAChF,OAAO;EAAE,MAAM;EAAU,OAAO,MAAM;CAAM;AAC9C;AAEA,SAAS,yBACP,QACA,YACmD;CACnD,OAAO,OAAO,YACZ,OAAO,QAAQ,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,WAAW,CAC5C,MACA,qBAAqB,OAAO,GAAG,WAAW,GAAG,MAAM,CACrD,CAAC,CACH;AACF;AAEA,SAAS,YAAe,QAA8C;CACpE,OAAO,OAAO,YACZ,OAAO,QAAQ,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC,CAClE;AACF;AAEA,SAAS,WAAW,OAAyB;CAC3C,OAAO,UAAU,KAAA,KAAa,UAAU,QAAQ,OAAO,UAAU,WAC7D,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,IAC5B;AACN;AAEA,SAAS,WAAW,OAAuB;CACzC,OAAO,2BAA2B,KAAK,KAAK,IAAI,QAAQ,IAAI,MAAM,WAAW,KAAK,OAAO,EAAE;AAC7F;AAEA,SAAS,wBAAwB,MAAqB;CACpD,MAAM,IAAI,MACR,8BAA8B,KAAK,oDACrC;AACF;AAEA,SAAgB,YACd,WACA,MACA,cAC2D;CAC3D,MAAM,SAAS,UAAU,OAAO,UAAU;CAC1C,IAAI,OAAO,SAAS,qBAClB,OAAO;EAAE,YAAY,OAAO;EAAY,MAAM,CAAC,GAAI,OAAO,QAAQ,CAAC,GAAI,GAAG,YAAY;CAAE;CAE1F,MAAM,gBAAgB,KAAK,eAAe;CAC1C,IAAI,CAAC,eAAe,MAAM,IAAI,MAAM,0DAA0D;CAC9F,MAAM,aAAa,MAAM,KAAK,eAAe,OAAO,UAAU;CAC9D,MAAM,gBAAgB,OAAO,QAAQ,CAAC;CACtC,IAAI,OAAO,aACT,OAAO;EACL,YAAY,OAAO;EACnB,MAAM;GAAC;IAAE,MAAM;IAAU,OAAO;GAAW;GAAG,GAAG;GAAe,GAAG;EAAY;CACjF;CAEF,OAAO;EAAE,YAAY;EAAY,MAAM,CAAC,GAAG,eAAe,GAAG,YAAY;CAAE;AAC7E;AAEA,SAAgB,YACd,SACA,WACwD;CACxD,MAAM,SAAiE,CACrE;EAAE,MAAM;EAAW;CAAU,CAC/B;CACA,IAAI,QAAQ,OAAO,OAAO,OAAO,KAAK;EAAE,MAAM;EAAS;CAAU,CAAC;CAClE,KAAK,MAAM,QAAQ,OAAO,KAAK,QAAQ,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,GACvD,IAAI,QAAQ,QAAQ,KAAK,EAAE,OAAO,OAAO,KAAK;EAAE,MAAM;EAAQ;EAAM;CAAU,CAAC;CAEjF,KAAK,MAAM,QAAQ,OAAO,KAAK,QAAQ,aAAa,CAAC,CAAC,CAAC,CAAC,KAAK,GAC3D,IAAI,QAAQ,YAAY,KAAK,EAAE,OAAO,OAAO,KAAK;EAAE,MAAM;EAAY;EAAM;CAAU,CAAC;CAEzF,OAAO;AACT;AAEA,SAAgB,2BACd,WAC8E;CAC9E,MAAM,SAAS,UAAU,OAAO,UAAU;CAC1C,MAAM,YAAY,UAAU,OAAO,UAAU;CAC7C,IAAI,OAAO,SAAS,0BAA0B,CAAC,WAAW,OAAO,KAAA;CACjE,MAAM,OAAO,UAAU,SAAS,MAAM,MAAM,UAAU,MAAM,SAAS,OAAO,UAAU;CACtF,IAAI,CAAC,MAAM,MAAM,IAAI,MAAM,4DAA4D;CACvF,OAAO;EAAE,MAAM,KAAK;EAAM,QAAQ,KAAK;EAAQ,YAAY,KAAK;CAAW;AAC7E;AAEA,SAAgB,qBACd,KACA,OACQ;CACR,MAAM,OAAO,uBAAuB,IAAI,WAAW,KAAK;CACxD,MAAM,WAAW,IAAI,SAAS,MAAM,OAAO,MAAM,KAAK,MAAM,IAAI,IAAI;CACpE,IAAI,aAAa,QAAQ,CAAC,SAAS,WAAW,GAAG,KAAK,EAAE,GACtD,MAAM,IAAI,MAAM,+CAA+C;CAEjE,OAAO;AACT;AAEA,SAAS,uBACP,WACA,OACQ;CACR,MAAM,OAAO,cAAc,SAAS,MAAM,WAAW,MAAM;CAC3D,IAAI,CAAC,MAAM,MAAM,IAAI,MAAM,aAAa,UAAU,2BAA2B;CAC7E,OAAO;AACT;AAEA,SAAgB,0BACd,aAMA,eAM0E;CAC1E,MAAM,aAAa,IAAI,IACrB,YAAY,KAAK,SAAS,CAAC,oBAAoB,KAAK,MAAM,KAAK,OAAO,GAAG,IAAI,CAAC,CAChF;CACA,IAAI,WAAW,SAAS,YAAY,UAAU,YAAY,WAAW,cAAc,QACjF,MAAM,IAAI,MAAM,2DAA2D;CAE7E,OAAO,cAAc,KAAK,aAAa;EACrC,MAAM,SAAS,WAAW,IAAI,oBAAoB,SAAS,MAAM,SAAS,OAAO,CAAC;EAClF,MAAM,OAAO,QAAQ,QAAQ;EAC7B,MAAM,QAAQ,OAAO,KAAK,QAAQ,WAAW,IAAI,MAAM;EACvD,IACE,CAAC,UACD,CAAC,OAAO,UAAU,IAAI,KACtB,OAAO,KACP,OAAO,OACP,SAAS,SAAS,QAClBC,cAAY,KAAK,MAAM,SAAS,eAEhC,MAAM,IAAI,MAAM,2DAA2D;EAE7E,OAAO;GACL,MAAM,SAAS;GACf;GACA,GAAI,SAAS,SAAS,UAAU,EAAE,MAAM,QAAiB,IAAI,CAAC;GAC9D,OAAO,WAAW,KAAK,KAAK;EAC9B;CACF,CAAC;AACH"}

package/dist/{profile-materialization-bPm0gGLO.d.ts → profile-materialization-BRY22Oh8.d.ts}

@@ -1,6 +1,5 @@
 import { AgentProfile, CanonicalAgentProfileMaterializationAxis } from "@tangle-network/agent-interface";
 import { HarnessId, SkippableDimension, WorkspacePlan } from "@tangle-network/agent-profile-materialize";
-//#region src/agent/profile-materialization.d.ts
 type KnownAgentProfileMaterializationAxis = CanonicalAgentProfileMaterializationAxis;
 /** AgentProfile axis name, with `custom:<name>` reserved for caller-owned extensions. */
 type AgentProfileMaterializationAxis = KnownAgentProfileMaterializationAxis | `custom:${string}`;
@@ -44,6 +43,5 @@ interface AssertProfileMaterializationOptions extends ValidateProfileMaterializa
  * not the plan's to lower.
  */
 declare function assertProfileMaterializes(profile: AgentProfile, harness: HarnessId, context: string, skip?: readonly SkippableDimension[]): WorkspacePlan;
-//#endregion
 export { ProfileMaterializationContract as a, assertProfileMaterializes as c, KnownAgentProfileMaterializationAxis as i, AssertProfileMaterializationOptions as n, ProfileMaterializationIssue as o, DefineProfileMaterializationContractOptions as r, ValidateProfileMaterializationOptions as s, AgentProfileMaterializationAxis as t };
-//# sourceMappingURL=profile-materialization-bPm0gGLO.d.ts.map
+//# sourceMappingURL=profile-materialization-BRY22Oh8.d.ts.map

package/dist/profiles.d.ts

@@ -1,18 +1,34 @@
-import { $h as UiFindingScreenshot, Qh as UiFinding, ag as ResearchSource, cg as researcherProfile, eg as UiFindingSeverity, ig as ResearchOutput, ng as KnowledgeItem, og as ResearchTask, rg as KnowledgeUpdate, sg as ResearcherProfileOptions, tg as UiLens } from "./types-hc4cmSc7.js";
+import { Ag as ResearchOutput, Dg as UiLens, Eg as UiFindingSeverity, Mg as ResearchTask, Ng as ResearcherProfileOptions, Og as KnowledgeItem, Pg as researcherProfile, Tg as UiFindingScreenshot, jg as ResearchSource, kg as KnowledgeUpdate, wg as UiFinding } from "./types-Fowuwdz2.js";
+import { AgentProfile } from "@tangle-network/agent-interface";
 import { SandboxEvent } from "@tangle-network/sandbox";
-//#region src/profiles/ui-auditor/lens-prompts.d.ts
+/** Canonical owners of the separately bundled designer capabilities. */
+export declare const graphDesignerSkillSources: Readonly<{
+  'graph-designer': "https://github.com/tangle-network/agent-runtime/blob/main/skills/graph-designer/SKILL.md";
+  'agent-graphs': "https://github.com/tangle-network/agent-runtime/blob/main/skills/agent-graphs/SKILL.md";
+  'be-ambitious': "https://github.com/drewstone/dotfiles/blob/main/claude/skills/be-ambitious/SKILL.md";
+}>;
+type SkillResource = NonNullable<NonNullable<AgentProfile['resources']>['skills']>[number];
+/** Read this installation's bundled skills without depending on a user's skill installation.
+ *  Self-resolution follows the public profiles entry in source checkouts and packed installs. */
+export declare function graphDesignerSkills(): SkillResource[];
+interface GraphDesignerProfileOptions {
+  /** Caller-owned exact harness/model, tools, permissions, connections and other capabilities. */
+  readonly profile: AgentProfile;
+  readonly name?: string;
+}
+/** Compose graph design capabilities onto a complete execution profile; the skills remain
+ *  distinct resources carried through the normal profile materializer. */
+export declare function graphDesignerProfile(options: GraphDesignerProfileOptions): AgentProfile;
 /** Cross-lens rules injected into every UI audit iteration: finding quality standards and scope limits. @experimental */
-declare const SHARED_AUDITOR_RULES: string;
+export declare const SHARED_AUDITOR_RULES: string;
 /** Per-lens auditor briefs: concrete signals to look for and cross-lens distinctions to respect. @experimental */
-declare const LENS_BRIEFS: Record<UiLens, string>;
+export declare const LENS_BRIEFS: Record<UiLens, string>;
 /**
  * Build a system prompt for a single auditor iteration.
  *
  * @experimental
  */
-declare function buildAuditorSystemPrompt(lens: UiLens): string;
-//#endregion
-//#region src/profiles/ui-auditor/task.d.ts
+export declare function buildAuditorSystemPrompt(lens: UiLens): string;
 /** @experimental */
 interface UiAuditViewport {
   width: number;
@@ -94,10 +110,7 @@ interface UiAuditOutput {
   /** Optional judge commentary (debug / triage aid). */
   notes?: string;
 }
-//#endregion
-//#region src/profiles/ui-auditor/output-adapter.d.ts
 /** Parse raw `SandboxEvent` emissions from an audit iteration into structured `UiAuditOutput`. @experimental */
-declare function parseAuditorEvents(events: SandboxEvent[]): UiAuditOutput;
-//#endregion
-export { type KnowledgeItem, type KnowledgeUpdate, LENS_BRIEFS, type ResearchOutput, type ResearchSource, type ResearchTask, type ResearcherProfileOptions, SHARED_AUDITOR_RULES, type UiAuditCapture, type UiAuditCaptureRequest, type UiAuditOutput, type UiAuditTask, type UiAuditViewport, type UiFinding, type UiFindingScreenshot, type UiFindingSeverity, type UiLens, buildAuditorSystemPrompt, parseAuditorEvents, researcherProfile };
+export declare function parseAuditorEvents(events: SandboxEvent[]): UiAuditOutput;
+export { type GraphDesignerProfileOptions, type KnowledgeItem, type KnowledgeUpdate, type ResearchOutput, type ResearchSource, type ResearchTask, type ResearcherProfileOptions, type UiAuditCapture, type UiAuditCaptureRequest, type UiAuditOutput, type UiAuditTask, type UiAuditViewport, type UiFinding, type UiFindingScreenshot, type UiFindingSeverity, type UiLens, researcherProfile };
 //# sourceMappingURL=profiles.d.ts.map

package/dist/profiles.js

@@ -1,9 +1,54 @@
-import "./errors-DodWX-cb.js";
-import { t as assertExecutableAgentProfile } from "./model-policy-CyCUwHed.js";
-import { t as UI_LENSES } from "./substrate-CGDFTSRh.js";
+import { m as ValidationError } from "./errors-wuhGvpE3.js";
+import { t as assertExecutableAgentProfile } from "./model-policy-GSxWwP-b.js";
+import { t as UI_LENSES } from "./substrate-Db2pp6y3.js";
 import { agentProfileSchema } from "@tangle-network/agent-interface";
 import { isRecord } from "@tangle-network/agent-core";
-//#region src/profiles/researcher.ts
+import { readFileSync } from "node:fs";
+// src/profiles/graph-designer.ts
+/** Canonical owners of the separately bundled designer capabilities. */
+const graphDesignerSkillSources = Object.freeze({
+	"graph-designer": "https://github.com/tangle-network/agent-runtime/blob/main/skills/graph-designer/SKILL.md",
+	"agent-graphs": "https://github.com/tangle-network/agent-runtime/blob/main/skills/agent-graphs/SKILL.md",
+	"be-ambitious": "https://github.com/drewstone/dotfiles/blob/main/claude/skills/be-ambitious/SKILL.md"
+});
+/** Read this installation's bundled skills without depending on a user's skill installation.
+*  Self-resolution follows the public profiles entry in source checkouts and packed installs. */
+function graphDesignerSkills() {
+	const directory = new URL("../skills/", import.meta.resolve("@tangle-network/agent-runtime/profiles"));
+	return Object.keys(graphDesignerSkillSources).map((name) => ({
+		kind: "inline",
+		name,
+		content: readFileSync(new URL(`${name}/SKILL.md`, directory), "utf8")
+	}));
+}
+/** Compose graph design capabilities onto a complete execution profile; the skills remain
+*  distinct resources carried through the normal profile materializer. */
+function graphDesignerProfile(options) {
+	const base = agentProfileSchema.parse(options.profile);
+	assertExecutableAgentProfile(base, "graphDesignerProfile");
+	const skills = [...base.resources?.skills ?? []];
+	for (const skill of graphDesignerSkills()) {
+		const existing = skills.find((resource) => resource.name === skill.name);
+		if (existing) {
+			if (JSON.stringify(existing) !== JSON.stringify(skill)) throw new ValidationError(`graphDesignerProfile: conflicting skill resource ${skill.name}`);
+		} else skills.push(skill);
+	}
+	return agentProfileSchema.parse({
+		...base,
+		name: options.name ?? base.name,
+		description: base.description ?? "Design, replay and improve checked Runtime graphs.",
+		prompt: {
+			...base.prompt,
+			instructions: [...base.prompt?.instructions ?? [], "You design or replay the graph requested by the task. Apply the bundled graph-designer, agent-graphs and be-ambitious skills; keep the task acceptance and granted authority fixed. Return the canonical graph file and its actual qualification evidence."]
+		},
+		resources: {
+			...base.resources,
+			skills,
+			failOnError: true
+		}
+	});
+}
+// src/profiles/researcher.ts
 /**
 * Opinionated preset for source-grounded research
 * tasks. The agent is told to:
@@ -414,8 +459,7 @@ function clamp01(value) {
 	if (value > 1) return 1;
 	return value;
 }
-//#endregion
-//#region src/profiles/ui-auditor/lens-prompts.ts
+// src/profiles/ui-auditor/lens-prompts.ts
 /** Cross-lens rules injected into every UI audit iteration: finding quality standards and scope limits. @experimental */
 const SHARED_AUDITOR_RULES = `
 You are auditing a UI for a specific class of problems. Stay strictly in your assigned lens — do not file issues that belong to another lens (a separate iteration will catch those).
@@ -530,8 +574,7 @@ function buildAuditorSystemPrompt(lens) {
 	const brief = LENS_BRIEFS[lens];
 	return `${SHARED_AUDITOR_RULES}\n\n${brief}`;
 }
-//#endregion
-//#region src/profiles/ui-auditor/output-adapter.ts
+// src/profiles/ui-auditor/output-adapter.ts
 const KNOWN_LENS_VALUES = new Set(UI_LENSES);
 function isUiLens(v) {
 	return typeof v === "string" && KNOWN_LENS_VALUES.has(v);
@@ -585,7 +628,6 @@ function parseAuditorEvents(events) {
 				if (typeof n === "string" && n.trim().length > 0) notes = n;
 				break;
 			}
-			default: break;
 		}
 	}
 	const out = {
@@ -596,7 +638,6 @@ function parseAuditorEvents(events) {
 	if (notes) out.notes = notes;
 	return out;
 }
-//#endregion
-export { LENS_BRIEFS, SHARED_AUDITOR_RULES, buildAuditorSystemPrompt, parseAuditorEvents, researcherProfile };
+export { LENS_BRIEFS, SHARED_AUDITOR_RULES, buildAuditorSystemPrompt, graphDesignerProfile, graphDesignerSkillSources, graphDesignerSkills, parseAuditorEvents, researcherProfile };
 
 //# sourceMappingURL=profiles.js.map