@tangle-network/cli-agent-registry 0.15.17 → 0.15.19

package/dist/{backend-types-DRmLR1e0.d.mts → backend-types-BZoSzUzQ.d.mts}

@@ -44,4 +44,4 @@ declare function isBackendType(value: string): value is BackendType;
 declare function parseBackendType(value: string): BackendType;
 //#endregion
 export { isBackendType as a, backendTypeSchema as i, BACKEND_TYPE as n, parseBackendType as o, BackendType as r, ALL_BACKEND_TYPES as t };
-//# sourceMappingURL=backend-types-DRmLR1e0.d.mts.map
+//# sourceMappingURL=backend-types-BZoSzUzQ.d.mts.map

package/dist/backend-types.d.mts

@@ -1,2 +1,2 @@
-import { a as isBackendType, i as backendTypeSchema, n as BACKEND_TYPE, o as parseBackendType, r as BackendType, t as ALL_BACKEND_TYPES } from "./backend-types-DRmLR1e0.mjs";
+import { a as isBackendType, i as backendTypeSchema, n as BACKEND_TYPE, o as parseBackendType, r as BackendType, t as ALL_BACKEND_TYPES } from "./backend-types-BZoSzUzQ.mjs";
 export { ALL_BACKEND_TYPES, BACKEND_TYPE, BackendType, backendTypeSchema, isBackendType, parseBackendType };

package/dist/{cli-auth-bundle-CwAaH0Ap.d.mts → cli-auth-bundle-BIABHp5D.d.mts}

@@ -48,4 +48,4 @@ declare function assertCliAuthReferenceSupported(backendType: string, model: {
 declare function resolveCliAuthReference(backendType: string, model: Parameters<typeof assertCliAuthReferenceSupported>[1], environment: Readonly<Record<string, string | undefined>>): CliAuthMaterial | undefined;
 //#endregion
 export { assertCliAuthReferenceSupported as a, resolveCliAuthReference as c, LocalCliAuthFile as i, CliAuthReference as l, CLI_AUTH_REFERENCE_ENV_VAR as n, cliAuthFilesSchema as o, CliAuthMaterial as r, materializeCliAuthBundle as s, AUTH_BUNDLE_PATHS as t, cliAuthReferenceSchema as u };
-//# sourceMappingURL=cli-auth-bundle-CwAaH0Ap.d.mts.map
+//# sourceMappingURL=cli-auth-bundle-BIABHp5D.d.mts.map

package/dist/cli-auth-bundle.d.mts

@@ -1,2 +1,2 @@
-import { a as assertCliAuthReferenceSupported, c as resolveCliAuthReference, i as LocalCliAuthFile, l as CliAuthReference, n as CLI_AUTH_REFERENCE_ENV_VAR, o as cliAuthFilesSchema, r as CliAuthMaterial, s as materializeCliAuthBundle, t as AUTH_BUNDLE_PATHS, u as cliAuthReferenceSchema } from "./cli-auth-bundle-CwAaH0Ap.mjs";
+import { a as assertCliAuthReferenceSupported, c as resolveCliAuthReference, i as LocalCliAuthFile, l as CliAuthReference, n as CLI_AUTH_REFERENCE_ENV_VAR, o as cliAuthFilesSchema, r as CliAuthMaterial, s as materializeCliAuthBundle, t as AUTH_BUNDLE_PATHS, u as cliAuthReferenceSchema } from "./cli-auth-bundle-BIABHp5D.mjs";
 export { AUTH_BUNDLE_PATHS, CLI_AUTH_REFERENCE_ENV_VAR, CliAuthMaterial, CliAuthReference, LocalCliAuthFile, assertCliAuthReferenceSupported, cliAuthFilesSchema, cliAuthReferenceSchema, materializeCliAuthBundle, resolveCliAuthReference };

package/dist/cli-auth-placeholder.d.mts

@@ -1,54 +1,28 @@
-import { l as CliAuthReference, r as CliAuthMaterial } from "./cli-auth-bundle-CwAaH0Ap.mjs";
-import { z } from "zod";
+import { l as CliAuthReference, r as CliAuthMaterial } from "./cli-auth-bundle-BIABHp5D.mjs";
+import { ProxySecretBinding, ProxySecretPresentation } from "@tangle-network/agent-interface";
 
 //#region src/cli-auth-placeholder.d.ts
-declare const metadataSchema: z.ZodObject<{
-  accountId: z.ZodOptional<z.ZodString>;
-  planType: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
-    free: "free";
-    plus: "plus";
-    pro: "pro";
-    business: "business";
-    enterprise: "enterprise";
-    edu: "edu";
-    team: "team";
-  }>, z.ZodEnum<{
-    free: "free";
-    pro: "pro";
-    enterprise: "enterprise";
-    team: "team";
-    max: "max";
-  }>]>>;
-  accessTokenExpiresAt: z.ZodOptional<z.ZodNumber>;
-  hasRefreshToken: z.ZodBoolean;
-}, z.core.$strict>;
-/** Routing/display hints only; these fields do not verify an account principal. */
-type CliAuthPlaceholderMetadata = z.infer<typeof metadataSchema>;
-type PlaceholderInput = {
-  backendType: string;
-  reference: CliAuthReference; /** The existing egress owner supplies this sandbox's declared-slot token. */
-  placeholder: string; /** CLI compatibility timestamp, never an assertion of provider validity. */
-  now: Date;
-  metadata: CliAuthPlaceholderMetadata;
-};
-/** Build sandbox-safe native material without accepting any provider token. */
-declare function buildCliAuthPlaceholderMaterial(input: PlaceholderInput): CliAuthMaterial;
+/** The box env name that holds a Codex seat's account-id placeholder. */
+declare function nativeAccountEnv(secretEnv: string): string;
+declare function isCliAuthPlaceholder(value: string | undefined): value is string;
+/** The egress bindings that hold a native seat at the proxy; none: unholdable (#15834). */
+declare function nativeProxyBindings(harness: string, reference: CliAuthReference): ProxySecretBinding[] | undefined;
 /**
- * TRUSTED OWNER ONLY. The explicit proxyAccessToken result must reach only the
- * host's existing egress holder. Only nativeMaterial may enter the sandbox.
- * The uploaded bundle, ID token and refresh token are never returned.
+ * TRUSTED OWNER ONLY: the value a proxy slot holds. A native bundle projects
+ * to its access token (bearer) or account id (header); every other value
+ * passes through; undefined refuses. Refresh and ID tokens never reach a slot.
  */
-declare function resolveCliAuthPlaceholder(input: {
+declare function nativeProxyValue(raw: string, presentation: ProxySecretPresentation): string | undefined;
+/** Sandbox-side native material built from placeholders only, never a provider token. */
+declare function buildCliAuthPlaceholderMaterial(input: {
   backendType: string;
   reference: CliAuthReference;
-  secretValue: string;
-  placeholder: string;
+  placeholders: {
+    access: string;
+    account?: string;
+  };
   now: Date;
-}): {
-  proxyAccessToken: string;
-  nativeMaterial: CliAuthMaterial;
-  metadata: CliAuthPlaceholderMetadata;
-};
+}): CliAuthMaterial;
 //#endregion
-export { CliAuthPlaceholderMetadata, buildCliAuthPlaceholderMaterial, resolveCliAuthPlaceholder };
+export { buildCliAuthPlaceholderMaterial, isCliAuthPlaceholder, nativeAccountEnv, nativeProxyBindings, nativeProxyValue };
 //# sourceMappingURL=cli-auth-placeholder.d.mts.map

package/dist/cli-auth-placeholder.mjs

@@ -1,118 +1,125 @@
-import { o as resolveCliAuthReference, r as assertCliAuthReferenceSupported, t as AUTH_BUNDLE_PATHS } from "./cli-auth-bundle-C6DtK7GX.mjs";
-import { i as baseProxyToken, r as declaredSecretSlotTokens } from "./harness-D1fTxnDD.mjs";
+import { i as cliAuthFilesSchema, o as resolveCliAuthReference, r as assertCliAuthReferenceSupported, t as AUTH_BUNDLE_PATHS } from "./cli-auth-bundle-C6DtK7GX.mjs";
 import { z } from "zod";
 //#region src/cli-auth-placeholder.ts
-const identity = z.string().regex(/^[A-Za-z0-9_-]{1,256}$/);
 const token = z.string().min(8).max(64 * 1024).regex(/^[^\s\0]+$/);
-const expiry = z.number().int().positive().max(864e13);
-const codexPlan = z.enum([
-	"free",
-	"plus",
-	"pro",
-	"business",
-	"enterprise",
-	"edu",
-	"team"
-]);
-const claudePlan = z.enum([
-	"free",
-	"pro",
-	"max",
-	"team",
-	"enterprise"
-]);
-const metadataSchema = z.object({
-	accountId: identity.optional(),
-	planType: z.union([codexPlan, claudePlan]).optional(),
-	accessTokenExpiresAt: expiry.optional(),
-	hasRefreshToken: z.boolean()
-}).strict();
 const codexBundle = z.object({ tokens: z.object({
 	access_token: token,
-	refresh_token: z.union([token, z.literal("")]).optional(),
-	id_token: token,
-	account_id: identity.nullable().optional()
-}) });
-const codexClaims = z.object({ "https://api.openai.com/auth": z.object({
-	chatgpt_account_id: identity.optional(),
-	chatgpt_plan_type: codexPlan.optional(),
-	chatgpt_account_is_fedramp: z.boolean().optional()
-}).optional() });
-const claudeBundle = z.object({ claudeAiOauth: z.object({
-	accessToken: token,
-	refreshToken: token.nullable().optional(),
-	expiresAt: expiry.nullable().optional(),
-	subscriptionType: claudePlan.nullable().optional()
+	account_id: z.string().regex(/^[A-Za-z0-9_-]{1,256}$/).nullable().optional()
 }) });
+const claudeBundle = z.object({ claudeAiOauth: z.object({ accessToken: token }) });
+const jwtHeader = btoa(JSON.stringify({
+	alg: "HS256",
+	typ: "JWT"
+}));
+const placeholderPattern = new RegExp(`^(?:proxy-declared-\\d+-token-|${jwtHeader}\\.[\\w-]+\\.)[\\w-]{43}$`);
 function invalidMaterial() {
 	throw new Error("Unsupported or invalid native credential material");
 }
-function parseJson(raw) {
-	try {
-		return JSON.parse(raw);
-	} catch {
-		return invalidMaterial();
-	}
+const ACCOUNT_HEADER = "ChatGPT-Account-Id";
+const isAccountHeader = (presentation) => presentation.type === "header" && presentation.name.toLowerCase() === ACCOUNT_HEADER.toLowerCase();
+/** The box env name that holds a Codex seat's account-id placeholder. */
+function nativeAccountEnv(secretEnv) {
+	return `${secretEnv}_ACCOUNT_ID`;
+}
+function isCliAuthPlaceholder(value) {
+	return value !== void 0 && placeholderPattern.test(value);
 }
-function jwtClaims(raw) {
-	const parts = raw.split(".");
-	if (parts.length !== 3 || parts.some((part) => !part)) return invalidMaterial();
+/** The egress bindings that hold a native seat at the proxy; none: unholdable (#15834). */
+function nativeProxyBindings(harness, reference) {
+	const secretRef = {
+		kind: "secret-ref",
+		key: reference.secretEnv
+	};
+	if (harness === "claude-code") return [{
+		envName: reference.secretEnv,
+		secretRef,
+		hosts: ["api.anthropic.com"],
+		presentation: { type: "bearer" },
+		placeholderFormat: "opaque"
+	}];
+	if (harness !== "codex") return void 0;
+	return [{
+		envName: reference.secretEnv,
+		secretRef,
+		hosts: ["chatgpt.com", "auth.openai.com"],
+		presentation: { type: "bearer" },
+		placeholderFormat: "jwt"
+	}, {
+		envName: nativeAccountEnv(reference.secretEnv),
+		secretRef,
+		hosts: ["chatgpt.com"],
+		presentation: {
+			type: "header",
+			name: ACCOUNT_HEADER
+		},
+		placeholderFormat: "opaque"
+	}];
+}
+function nativeBundle(raw) {
+	let value;
 	try {
-		const payload = (parts[1] ?? "").replaceAll("-", "+").replaceAll("_", "/");
-		const bytes = Uint8Array.from(atob(payload), (value) => value.charCodeAt(0));
-		return parseJson(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+		value = JSON.parse(raw);
 	} catch {
-		return invalidMaterial();
+		return;
+	}
+	if (Array.isArray(value)) {
+		const auth = cliAuthFilesSchema.safeParse(value).data?.find(({ path }) => path === AUTH_BUNDLE_PATHS.codex || path === AUTH_BUNDLE_PATHS["claude-code"]);
+		return auth ? nativeBundle(auth.content) : void 0;
 	}
+	const codex = codexBundle.safeParse(value);
+	if (codex.success) return {
+		access: codex.data.tokens.access_token,
+		account: codex.data.tokens.account_id ?? void 0
+	};
+	const claude = claudeBundle.safeParse(value);
+	return claude.success ? { access: claude.data.claudeAiOauth.accessToken } : void 0;
 }
-function accessTokenExpiry(value) {
-	if (value.split(".").length !== 3) return void 0;
-	const parsed = z.object({ exp: z.number().int().positive().optional() }).safeParse(jwtClaims(value));
-	if (!parsed.success) return invalidMaterial();
-	if (parsed.data.exp === void 0) return void 0;
-	const result = expiry.safeParse(parsed.data.exp * 1e3);
-	if (!result.success) return invalidMaterial();
-	return result.data;
+/**
+* TRUSTED OWNER ONLY: the value a proxy slot holds. A native bundle projects
+* to its access token (bearer) or account id (header); every other value
+* passes through; undefined refuses. Refresh and ID tokens never reach a slot.
+*/
+function nativeProxyValue(raw, presentation) {
+	const bundle = nativeBundle(raw);
+	if (!bundle) return isAccountHeader(presentation) ? void 0 : raw;
+	return presentation.type === "bearer" ? bundle.access : presentation.type === "header" ? bundle.account : void 0;
 }
-/** Build sandbox-safe native material without accepting any provider token. */
+/** Sandbox-side native material built from placeholders only, never a provider token. */
 function buildCliAuthPlaceholderMaterial(input) {
 	const reference = assertCliAuthReferenceSupported(input.backendType, { cliAuth: input.reference });
-	const metadata = metadataSchema.safeParse(input.metadata);
-	const declaredTokens = Object.values(declaredSecretSlotTokens());
-	if (!reference || !metadata.success || !Number.isFinite(input.now.getTime()) || !declaredTokens.includes(baseProxyToken(input.placeholder)) || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(input.placeholder)) return invalidMaterial();
-	if (input.backendType !== "codex" && input.backendType !== "claude-code") return invalidMaterial();
-	if (input.backendType === "codex" && reference.format === "token") return invalidMaterial();
-	const { accountId, planType, accessTokenExpiresAt, hasRefreshToken } = metadata.data;
+	const { access, account } = input.placeholders;
+	if (!reference || !isCliAuthPlaceholder(access) || account !== void 0 && !isCliAuthPlaceholder(account) || !Number.isFinite(input.now.getTime())) return invalidMaterial();
+	if (input.backendType === "claude-code" && reference.format === "token") return resolveCliAuthReference(input.backendType, { cliAuth: reference }, { [reference.secretEnv]: access }) ?? invalidMaterial();
 	let content;
 	if (input.backendType === "codex") {
-		if (planType !== void 0 && !codexPlan.safeParse(planType).success) return invalidMaterial();
-		const claims = {
-			sub: input.placeholder,
-			aud: "tangle-sandbox",
-			exp: Math.floor(input.now.getTime() / 1e3)
-		};
+		const [, payload] = access.split(".");
+		if (!payload) return invalidMaterial();
+		const base64 = payload.replaceAll("-", "+").replaceAll("_", "/");
+		const { exp } = z.object({ exp: z.number().int().positive() }).parse(JSON.parse(atob(base64)));
 		content = {
 			auth_mode: "chatgpt",
 			OPENAI_API_KEY: null,
 			tokens: {
-				id_token: `e30.${btoa(JSON.stringify(claims)).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "")}.tangle-placeholder`,
-				access_token: input.placeholder,
-				refresh_token: hasRefreshToken ? input.placeholder : "",
-				...accountId ? { account_id: accountId } : {}
+				id_token: `e30.${btoa(JSON.stringify({
+					sub: "sandbox-placeholder",
+					aud: "tangle-sandbox",
+					exp
+				})).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "")}.tangle-placeholder`,
+				access_token: access,
+				refresh_token: "",
+				...account ? { account_id: account } : {}
 			},
 			last_refresh: input.now.toISOString()
 		};
-	} else {
-		if (planType !== void 0 && !claudePlan.safeParse(planType).success) return invalidMaterial();
-		content = { claudeAiOauth: {
-			accessToken: input.placeholder,
-			refreshToken: hasRefreshToken ? input.placeholder : null,
-			expiresAt: accessTokenExpiresAt ?? null,
-			scopes: ["user:inference"],
-			subscriptionType: planType ?? null,
-			rateLimitTier: null
-		} };
-	}
+	} else if (input.backendType === "claude-code") content = { claudeAiOauth: {
+		accessToken: access,
+		refreshToken: null,
+		expiresAt: null,
+		scopes: ["user:inference"],
+		subscriptionType: null,
+		rateLimitTier: null
+	} };
+	else return invalidMaterial();
 	return {
 		reference,
 		authFiles: [{
@@ -123,78 +130,7 @@ function buildCliAuthPlaceholderMaterial(input) {
 		tokenEnvironment: {}
 	};
 }
-/**
-* TRUSTED OWNER ONLY. The explicit proxyAccessToken result must reach only the
-* host's existing egress holder. Only nativeMaterial may enter the sandbox.
-* The uploaded bundle, ID token and refresh token are never returned.
-*/
-function resolveCliAuthPlaceholder(input) {
-	if (input.secretValue.length > 1024 * 1024) return invalidMaterial();
-	const material = resolveCliAuthReference(input.backendType, { cliAuth: input.reference }, { [input.reference.secretEnv]: input.secretValue });
-	if (!material) return invalidMaterial();
-	let proxyAccessToken;
-	let metadata;
-	let credentials;
-	if (input.backendType === "claude-code" && material.reference.format === "token") {
-		const parsed = token.safeParse(Object.values(material.tokenEnvironment)[0]);
-		if (!parsed.success) return invalidMaterial();
-		proxyAccessToken = parsed.data;
-		credentials = [proxyAccessToken];
-		metadata = { hasRefreshToken: false };
-	} else {
-		const expectedPath = input.backendType === "codex" ? AUTH_BUNDLE_PATHS.codex : AUTH_BUNDLE_PATHS["claude-code"];
-		if (material.authFiles.length !== 1 || material.authFiles[0]?.path !== expectedPath) return invalidMaterial();
-		const bundle = parseJson(material.authFiles[0].content);
-		if (input.backendType === "codex") {
-			const parsed = codexBundle.safeParse(bundle);
-			if (!parsed.success) return invalidMaterial();
-			const tokens = parsed.data.tokens;
-			const parsedClaims = codexClaims.safeParse(jwtClaims(tokens.id_token));
-			if (!parsedClaims.success) return invalidMaterial();
-			const claims = parsedClaims.data["https://api.openai.com/auth"];
-			if (claims?.chatgpt_account_is_fedramp) return invalidMaterial();
-			if (tokens.account_id && claims?.chatgpt_account_id && tokens.account_id !== claims.chatgpt_account_id) return invalidMaterial();
-			proxyAccessToken = tokens.access_token;
-			credentials = [
-				proxyAccessToken,
-				tokens.id_token,
-				tokens.refresh_token ?? ""
-			];
-			metadata = {
-				accountId: tokens.account_id ?? claims?.chatgpt_account_id,
-				planType: claims?.chatgpt_plan_type,
-				accessTokenExpiresAt: accessTokenExpiry(proxyAccessToken),
-				hasRefreshToken: Boolean(tokens.refresh_token)
-			};
-		} else if (input.backendType === "claude-code") {
-			const parsed = claudeBundle.safeParse(bundle);
-			if (!parsed.success) return invalidMaterial();
-			const oauth = parsed.data.claudeAiOauth;
-			proxyAccessToken = oauth.accessToken;
-			credentials = [proxyAccessToken, oauth.refreshToken ?? ""];
-			metadata = {
-				planType: oauth.subscriptionType ?? void 0,
-				accessTokenExpiresAt: oauth.expiresAt ?? void 0,
-				hasRefreshToken: Boolean(oauth.refreshToken)
-			};
-		} else return invalidMaterial();
-	}
-	const nativeMaterial = buildCliAuthPlaceholderMaterial({
-		...input,
-		metadata
-	});
-	const publicOutput = JSON.stringify({
-		nativeMaterial,
-		metadata
-	});
-	if (credentials.some((value) => value && publicOutput.includes(value))) return invalidMaterial();
-	return {
-		proxyAccessToken,
-		nativeMaterial,
-		metadata
-	};
-}
 //#endregion
-export { buildCliAuthPlaceholderMaterial, resolveCliAuthPlaceholder };
+export { buildCliAuthPlaceholderMaterial, isCliAuthPlaceholder, nativeAccountEnv, nativeProxyBindings, nativeProxyValue };
 
 //# sourceMappingURL=cli-auth-placeholder.mjs.map

package/dist/cli-backend-auth-env.mjs

@@ -1,6 +1,183 @@
+import { n as HARNESS_WARM_TRANSPORT_ENV } from "./harness-contracts-BZoECCMc.mjs";
 import { l as getSpec } from "./specs-BBF55TnM.mjs";
 import { i as cliAuthFilesSchema, n as CLI_AUTH_REFERENCE_ENV_VAR, o as resolveCliAuthReference, s as cliAuthReferenceSchema } from "./cli-auth-bundle-C6DtK7GX.mjs";
-import { n as isSafeEnvVarName, t as isForbiddenEnvVarName } from "./harness-D1fTxnDD.mjs";
+import { ProxySecretBindingSchema, ProxySecretGrantSchema, ProxySecretReceiptSchema, ProxySecretUpdateControlsSchema, ProxySecretsSchema, isProxySecretScopeAttenuation, ownPropertyRecordSchema, proxySecretPresentationsEqual } from "@tangle-network/agent-interface";
+import { z } from "zod";
+//#region ../runtime-contracts/dist/model-key-proxy.js
+const MODEL_PROXY_TOKENS = {
+	OPENCODE_MODEL_API_KEY: "proxy-model-token",
+	OPENAI_API_KEY: "proxy-openai-token",
+	ANTHROPIC_API_KEY: "proxy-anthropic-token",
+	OPENROUTER_API_KEY: "proxy-openrouter-token",
+	TANGLE_INFERENCE_KEY: "proxy-openai-token",
+	ZAI_API_KEY: "proxy-zai-token",
+	ZHIPU_API_KEY: "proxy-zai-token"
+};
+new Set(Object.values(MODEL_PROXY_TOKENS));
+new Set([
+	...Object.keys(MODEL_PROXY_TOKENS),
+	"TANGLE_API_KEY",
+	"GITHUB_TOKEN",
+	"GH_TOKEN"
+]);
+/** True for a slot name, which exists at the proxy and never in a box env. */
+function isDeclaredSecretSlotEnvVar(name) {
+	return /^TANGLE_DECLARED_SLOT_\d+$/.test(name);
+}
+//#endregion
+//#region ../runtime-contracts/dist/proxy-secret-materialization.js
+const syntheticHeader = {
+	alg: "HS256",
+	typ: "JWT"
+};
+const encode = (value) => btoa(value instanceof Uint8Array ? String.fromCharCode(...value) : JSON.stringify(value)).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+function placeholderPrefix(slot, format, expiresAt) {
+	return format === "jwt" ? `${encode(syntheticHeader)}.${encode({
+		sub: "sandbox-placeholder",
+		aud: "proxy-secret-placeholder",
+		exp: Math.floor(Date.parse(expiresAt) / 1e3)
+	})}.` : `proxy-declared-${slot.slice(21)}-token-`;
+}
+function isSyntheticPlaceholder(material) {
+	const prefix = placeholderPrefix(material.slot, material.grant.placeholderFormat, material.issuerExpiresAt);
+	return material.placeholder.startsWith(prefix) && /^[A-Za-z0-9_-]{43}$/.test(material.placeholder.slice(prefix.length));
+}
+z.array(z.strictObject({
+	binding: ProxySecretBindingSchema,
+	grant: ProxySecretGrantSchema,
+	placeholder: z.string().min(1),
+	slot: z.string().refine(isDeclaredSecretSlotEnvVar),
+	issuerExpiresAt: z.iso.datetime()
+})).superRefine((materials, ctx) => {
+	const bindings = ProxySecretsSchema.safeParse(materials.map((m) => m.binding));
+	const unique = (values) => new Set(values).size === values.length;
+	if (!bindings.success || !unique(materials.map((m) => m.slot)) || !unique(materials.map((m) => m.placeholder)) || !unique(materials.map((m) => m.grant.grantId)) || new Set(materials.map((m) => m.grant.epoch)).size > 1 || new Set(materials.map((m) => m.grant.sandboxId)).size > 1 || materials.some((material) => !isSyntheticPlaceholder(material)) || materials.some(({ binding, grant, issuerExpiresAt }) => !isProxySecretScopeAttenuation(binding, grant.scope) || !proxySecretPresentationsEqual(binding.presentation, grant.presentation) || (binding.placeholderFormat ?? "opaque") !== grant.placeholderFormat || Date.parse(grant.expiresAt) > Date.parse(issuerExpiresAt))) ctx.addIssue({
+		code: "custom",
+		message: "Invalid proxy secret materialization"
+	});
+});
+ProxySecretUpdateControlsSchema.extend({
+	resolvedSecrets: ownPropertyRecordSchema(z.string().min(1), { maxEntries: Number.MAX_SAFE_INTEGER }).default({}),
+	proxySecretGrants: ProxySecretReceiptSchema.options[0].shape.bindings,
+	expectedProxySecretGeneration: ProxySecretUpdateControlsSchema.shape.expectedProxySecretGeneration.unwrap()
+}).strict().refine((body) => new Set(body.proxySecretGrants.map((b) => b.envName)).size === body.proxySecretGrants.length);
+//#endregion
+//#region ../runtime-contracts/dist/runtime-environment.js
+const SAFE_ENV_VAR_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function isSafeEnvVarName(name) {
+	if (typeof name !== "string") return false;
+	if (name.length === 0 || name.length > 256) return false;
+	return SAFE_ENV_VAR_NAME_RE.test(name);
+}
+/** Client proxy URLs first, then bypass names. */
+const EGRESS_PROXY_ENV_NAMES = [
+	"HTTPS_PROXY",
+	"https_proxy",
+	"HTTP_PROXY",
+	"http_proxy",
+	"NO_PROXY",
+	"no_proxy"
+];
+const CA_TRUST_ENV_NAMES = [
+	"NODE_EXTRA_CA_CERTS",
+	"SSL_CERT_FILE",
+	"CURL_CA_BUNDLE",
+	"GIT_SSL_CAINFO",
+	"NIX_SSL_CERT_FILE"
+];
+[...EGRESS_PROXY_ENV_NAMES, ...CA_TRUST_ENV_NAMES];
+const FORBIDDEN_ENV_VAR_NAMES = new Set([
+	"LD_PRELOAD",
+	"LD_LIBRARY_PATH",
+	"LD_AUDIT",
+	"DYLD_INSERT_LIBRARIES",
+	"DYLD_LIBRARY_PATH",
+	"DYLD_FALLBACK_LIBRARY_PATH",
+	"NODE_OPTIONS",
+	"NODE_PATH",
+	"NODE_TLS_REJECT_UNAUTHORIZED",
+	"PYTHONPATH",
+	"PYTHONSTARTUP",
+	"PERL5OPT",
+	"PERL5LIB",
+	"RUBYOPT",
+	"RUBYLIB",
+	"PATH",
+	"NIX_BIN_PATH",
+	"EGRESS_EDGE_POOL_ENABLED",
+	"EDGE_BIND_ID",
+	"PRIVACY_EGRESS",
+	"LOG_REDACT",
+	"IFS",
+	"BASH_ENV",
+	"ENV",
+	"SHELL",
+	"SHELLOPTS",
+	"PROMPT_COMMAND",
+	"HOME",
+	"XDG_CONFIG_HOME",
+	"XDG_DATA_HOME",
+	"XDG_CACHE_HOME",
+	"XDG_STATE_HOME",
+	"XDG_RUNTIME_DIR",
+	"HTTPS_PROXY",
+	"HTTP_PROXY",
+	"ALL_PROXY",
+	"NO_PROXY",
+	"https_proxy",
+	"http_proxy",
+	"all_proxy",
+	"no_proxy",
+	"SSL_CERT_FILE",
+	"SSL_CERT_DIR",
+	"REQUESTS_CA_BUNDLE",
+	"CURL_CA_BUNDLE",
+	"NODE_EXTRA_CA_CERTS",
+	"HOSTNAME",
+	"CONTAINER_ID",
+	"AGENT_WORKSPACE_ROOT",
+	"WORKSPACE_PATH",
+	"STORAGE_PATH",
+	"WORKSPACE_FILE_API_ROOT_ONLY",
+	"WORKSPACE_ALLOWED_ABSOLUTE_PATHS",
+	"TANGLE_PLAN_CALLBACK_ALLOWED_ORIGINS"
+]);
+const FORBIDDEN_ENV_VAR_PREFIXES = [
+	"SIDECAR_",
+	"ORCHESTRATOR_",
+	"AGENT_INTERNAL_",
+	"SANDBOX_DEV_",
+	"AGENT_SUBPROCESS_",
+	"TEE_ATTESTATION_"
+];
+const RUNTIME_CALLER_ALLOWED_ENV_NAMES = new Set(["SIDECAR_CAPABILITIES", "SIDECAR_PLATFORM_CONTROL_RUNTIME"]);
+new Set(Object.values(HARNESS_WARM_TRANSPORT_ENV).flatMap(({ warmServer, prewarm }) => [warmServer, prewarm]));
+function isForbiddenEnvVarName(name) {
+	if (RUNTIME_CALLER_ALLOWED_ENV_NAMES.has(name)) return false;
+	if (FORBIDDEN_ENV_VAR_NAMES.has(name)) return true;
+	for (const prefix of FORBIDDEN_ENV_VAR_PREFIXES) if (name.startsWith(prefix)) return true;
+	return false;
+}
+/**
+* POSIX names for caller-owned container env. Runtime process.env merges must additionally enforce
+* isForbiddenEnvVarName, including project provisioning and Sidecar config.
+*/
+const safeEnvRecordSchema = ownPropertyRecordSchema(z.string(), { maxEntries: Number.MAX_SAFE_INTEGER }).refine((value) => Object.keys(value).every(isSafeEnvVarName), { message: "invalid env var name" });
+/** Names only: the caller must keep a separate source and pass values to resume({ env }). */
+const sandboxEnvRecoverySchema = z.object({ callerResupplies: z.array(z.string().max(256).refine(isSafeEnvVarName, { message: "invalid env var name" })).max(128).refine((keys) => new Set(keys).size === keys.length, { message: "callerResupplies must contain unique keys" }) }).strict();
+z.object({
+	envRecovery: sandboxEnvRecoverySchema,
+	dryRun: z.boolean().optional()
+}).strict();
+z.object({
+	envRecovery: sandboxEnvRecoverySchema,
+	eligibleCallerResupplyKeys: z.array(z.string()),
+	requiredOnColdResumeKeys: z.array(z.string()),
+	automaticCredentialRecovery: z.literal(false),
+	dryRun: z.boolean()
+}).strict();
+safeEnvRecordSchema.refine((value) => Object.keys(value).every((key) => !isForbiddenEnvVarName(key) && !key.startsWith("SIDECAR_")), { message: "runtime-owned env var name cannot be set by callers" });
+//#endregion
 //#region src/cli-backend-auth-env.ts
 /** The narrow credential leg shared by the host and sidecar rebind boundary. */
 function assertCliBackendAuthEnv(backendType, authEnv) {

package/dist/default-backend.d.mts

@@ -1,4 +1,4 @@
-import { r as BackendType } from "./backend-types-DRmLR1e0.mjs";
+import { r as BackendType } from "./backend-types-BZoSzUzQ.mjs";
 //#region src/default-backend.d.ts
 /**
  * Platform-wide default agent backend, read from `DEFAULT_AGENT_BACKEND`.

package/dist/host-contracts.d.mts

@@ -1,5 +1,5 @@
-import { o as CliAgentEnvVars } from "./spec-CcvTM7-j.mjs";
-import { o as NativeSessionStore } from "./session-contract-BhzcbPRW.mjs";
+import { o as CliAgentEnvVars } from "./spec-0SzopzVq.mjs";
+import { o as NativeSessionStore } from "./session-contract-ChAfXj67.mjs";
 
 //#region src/host-contracts.d.ts
 type HostStore = Omit<NativeSessionStore, "format"> & {

package/dist/index.d.mts

@@ -1,7 +1,7 @@
-import { a as isBackendType, i as backendTypeSchema, n as BACKEND_TYPE, o as parseBackendType, r as BackendType, t as ALL_BACKEND_TYPES } from "./backend-types-DRmLR1e0.mjs";
-import { i as LocalCliAuthFile, s as materializeCliAuthBundle } from "./cli-auth-bundle-CwAaH0Ap.mjs";
-import { C as mergeCliDirLayout, S as DEFAULT_CLI_DIR_LAYOUT, _ as harnessModelSupportFor, a as CliAgentEnvExtraRole, b as CliDirLayout, c as CliAgentRuntimeSpec, d as HarnessSpecCapabilities, f as ProviderLogger, g as cliAgentEnvRoleName, h as cliAgentClaimEnvVarNames, i as CliAgentEnvExtraParser, l as CliAgentSpec, m as canonicalModelSlug, n as CliAgentBuiltinTool, o as CliAgentEnvVars, p as ProviderPhase, r as CliAgentEnvExtra, s as CliAgentModelWire, t as AdapterFactory, u as CliAuthHome, v as harnessModelWire, x as CliDirLayoutAdditions, y as SYNTHETIC_ROUTER_MODEL } from "./spec-CcvTM7-j.mjs";
-import { _ as substituteNativeSessionId, a as NativeSessionIdentity, c as SessionFormatId, d as assertStoreLocationHonoursSessionContract, f as compileSessionStoreGlob, g as sessionStoreForPath, h as sessionContractProblems, i as HarnessSessionEvidence, l as assertArgvHonoursSessionContract, m as normalizePosixPath, n as HarnessSessionContractError, o as NativeSessionStore, p as forbiddenArgViolations, r as HarnessSessionContractErrorCode, s as SESSION_FORMAT_IDS, t as HarnessSessionContract, u as assertFlagsHonourSessionContract } from "./session-contract-BhzcbPRW.mjs";
+import { a as isBackendType, i as backendTypeSchema, n as BACKEND_TYPE, o as parseBackendType, r as BackendType, t as ALL_BACKEND_TYPES } from "./backend-types-BZoSzUzQ.mjs";
+import { i as LocalCliAuthFile, s as materializeCliAuthBundle } from "./cli-auth-bundle-BIABHp5D.mjs";
+import { C as mergeCliDirLayout, S as DEFAULT_CLI_DIR_LAYOUT, _ as harnessModelSupportFor, a as CliAgentEnvExtraRole, b as CliDirLayout, c as CliAgentRuntimeSpec, d as HarnessSpecCapabilities, f as ProviderLogger, g as cliAgentEnvRoleName, h as cliAgentClaimEnvVarNames, i as CliAgentEnvExtraParser, l as CliAgentSpec, m as canonicalModelSlug, n as CliAgentBuiltinTool, o as CliAgentEnvVars, p as ProviderPhase, r as CliAgentEnvExtra, s as CliAgentModelWire, t as AdapterFactory, u as CliAuthHome, v as harnessModelWire, x as CliDirLayoutAdditions, y as SYNTHETIC_ROUTER_MODEL } from "./spec-0SzopzVq.mjs";
+import { _ as substituteNativeSessionId, a as NativeSessionIdentity, c as SessionFormatId, d as assertStoreLocationHonoursSessionContract, f as compileSessionStoreGlob, g as sessionStoreForPath, h as sessionContractProblems, i as HarnessSessionEvidence, l as assertArgvHonoursSessionContract, m as normalizePosixPath, n as HarnessSessionContractError, o as NativeSessionStore, p as forbiddenArgViolations, r as HarnessSessionContractErrorCode, s as SESSION_FORMAT_IDS, t as HarnessSessionContract, u as assertFlagsHonourSessionContract } from "./session-contract-ChAfXj67.mjs";
 import { AGENT_BACKEND_ENV_VAR, CLI_AGENT_SPECS, MANAGED_MODEL_KEY_ENV_VAR, MANAGED_MODEL_KEY_NAME_ENV_VAR, agentProfileSchema, claimDeliverableEnvVarNames, cliAgentEnvVarNamesByRole, cliAgentHostPassthroughEnvVarNames, getSpec, messageStorageDirOf } from "./specs.mjs";
 import { resolveDefaultBackend } from "./default-backend.mjs";
 import { describeLocalCliAuthExpectation, discoverLocalCliAuthFiles } from "./local-cli-auth.mjs";

package/dist/local-cli-auth.d.mts

@@ -1,4 +1,4 @@
-import { i as LocalCliAuthFile } from "./cli-auth-bundle-CwAaH0Ap.mjs";
+import { i as LocalCliAuthFile } from "./cli-auth-bundle-BIABHp5D.mjs";
 
 //#region src/local-cli-auth.d.ts
 type LocalCliAuthBackend = "codex" | "claude-code";

package/dist/native-session-contracts.d.mts

@@ -1,4 +1,4 @@
-import { o as NativeSessionStore } from "./session-contract-BhzcbPRW.mjs";
+import { o as NativeSessionStore } from "./session-contract-ChAfXj67.mjs";
 
 //#region src/native-session-contracts.d.ts
 /** Native session contracts. A receipt proves each pin. There is no pending list. */

package/dist/{session-contract-BhzcbPRW.d.mts → session-contract-ChAfXj67.d.mts}

@@ -94,4 +94,4 @@ declare function sessionStoreForPath(contract: Pick<HarnessSessionContract, "sto
 declare function sessionContractProblems(contract: HarnessSessionContract): string[];
 //#endregion
 export { substituteNativeSessionId as _, NativeSessionIdentity as a, SessionFormatId as c, assertStoreLocationHonoursSessionContract as d, compileSessionStoreGlob as f, sessionStoreForPath as g, sessionContractProblems as h, HarnessSessionEvidence as i, assertArgvHonoursSessionContract as l, normalizePosixPath as m, HarnessSessionContractError as n, NativeSessionStore as o, forbiddenArgViolations as p, HarnessSessionContractErrorCode as r, SESSION_FORMAT_IDS as s, HarnessSessionContract as t, assertFlagsHonourSessionContract as u };
-//# sourceMappingURL=session-contract-BhzcbPRW.d.mts.map
+//# sourceMappingURL=session-contract-ChAfXj67.d.mts.map

package/dist/session-contract.d.mts

@@ -1,2 +1,2 @@
-import { _ as substituteNativeSessionId, a as NativeSessionIdentity, c as SessionFormatId, d as assertStoreLocationHonoursSessionContract, f as compileSessionStoreGlob, g as sessionStoreForPath, h as sessionContractProblems, i as HarnessSessionEvidence, l as assertArgvHonoursSessionContract, m as normalizePosixPath, n as HarnessSessionContractError, o as NativeSessionStore, p as forbiddenArgViolations, r as HarnessSessionContractErrorCode, s as SESSION_FORMAT_IDS, t as HarnessSessionContract, u as assertFlagsHonourSessionContract } from "./session-contract-BhzcbPRW.mjs";
+import { _ as substituteNativeSessionId, a as NativeSessionIdentity, c as SessionFormatId, d as assertStoreLocationHonoursSessionContract, f as compileSessionStoreGlob, g as sessionStoreForPath, h as sessionContractProblems, i as HarnessSessionEvidence, l as assertArgvHonoursSessionContract, m as normalizePosixPath, n as HarnessSessionContractError, o as NativeSessionStore, p as forbiddenArgViolations, r as HarnessSessionContractErrorCode, s as SESSION_FORMAT_IDS, t as HarnessSessionContract, u as assertFlagsHonourSessionContract } from "./session-contract-ChAfXj67.mjs";
 export { HarnessSessionContract, HarnessSessionContractError, HarnessSessionContractErrorCode, HarnessSessionEvidence, NativeSessionIdentity, NativeSessionStore, SESSION_FORMAT_IDS, SessionFormatId, assertArgvHonoursSessionContract, assertFlagsHonourSessionContract, assertStoreLocationHonoursSessionContract, compileSessionStoreGlob, forbiddenArgViolations, normalizePosixPath, sessionContractProblems, sessionStoreForPath, substituteNativeSessionId };

package/dist/{spec-CcvTM7-j.d.mts → spec-0SzopzVq.d.mts}

@@ -1,4 +1,4 @@
-import { t as HarnessSessionContract } from "./session-contract-BhzcbPRW.mjs";
+import { t as HarnessSessionContract } from "./session-contract-ChAfXj67.mjs";
 import { SdkProviderAdapter, WellKnownInteractionKind } from "@tangle-network/agent-interface";
 import { HarnessModelSupport, HarnessModelSupportOptions } from "@tangle-network/agent-interface/harness-capabilities";
 
@@ -343,4 +343,4 @@ type ProviderLogger = {
 };
 //#endregion
 export { mergeCliDirLayout as C, DEFAULT_CLI_DIR_LAYOUT as S, harnessModelSupportFor as _, CliAgentEnvExtraRole as a, CliDirLayout as b, CliAgentRuntimeSpec as c, HarnessSpecCapabilities as d, ProviderLogger as f, cliAgentEnvRoleName as g, cliAgentClaimEnvVarNames as h, CliAgentEnvExtraParser as i, CliAgentSpec as l, canonicalModelSlug as m, CliAgentBuiltinTool as n, CliAgentEnvVars as o, ProviderPhase as p, CliAgentEnvExtra as r, CliAgentModelWire as s, AdapterFactory as t, CliAuthHome as u, harnessModelWire as v, CliDirLayoutAdditions as x, SYNTHETIC_ROUTER_MODEL as y };
-//# sourceMappingURL=spec-CcvTM7-j.d.mts.map
+//# sourceMappingURL=spec-0SzopzVq.d.mts.map

package/dist/specs.d.mts

@@ -1,5 +1,5 @@
-import { a as isBackendType, i as backendTypeSchema, n as BACKEND_TYPE, o as parseBackendType, r as BackendType, t as ALL_BACKEND_TYPES } from "./backend-types-DRmLR1e0.mjs";
-import { _ as harnessModelSupportFor, h as cliAgentClaimEnvVarNames, l as CliAgentSpec, m as canonicalModelSlug, s as CliAgentModelWire, v as harnessModelWire } from "./spec-CcvTM7-j.mjs";
+import { a as isBackendType, i as backendTypeSchema, n as BACKEND_TYPE, o as parseBackendType, r as BackendType, t as ALL_BACKEND_TYPES } from "./backend-types-BZoSzUzQ.mjs";
+import { _ as harnessModelSupportFor, h as cliAgentClaimEnvVarNames, l as CliAgentSpec, m as canonicalModelSlug, s as CliAgentModelWire, v as harnessModelWire } from "./spec-0SzopzVq.mjs";
 import { agentProfileSchema } from "@tangle-network/agent-interface";
 
 //#region src/specs.d.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/cli-agent-registry",
-  "version": "0.15.17",
+  "version": "0.15.19",
   "type": "module",
   "exports": {
     "./cli-backend-auth-env": {
@@ -72,12 +72,12 @@
     "tsdown": "^0.21.10",
     "typescript": "^6.0.3",
     "vitest": "^4.1.12",
-    "@tangle-network/runtime-contracts": "0.20.0",
-    "@repo/airgap-guard": "0.0.0"
+    "@repo/airgap-guard": "0.0.0",
+    "@tangle-network/runtime-contracts": "0.20.0"
   },
   "tangleRelease": {
-    "sourceSha": "973885fb1b534df359ea87b20d9899795cb8e86d",
-    "mergedAt": "2026-11-04T17:23:46-08:00"
+    "sourceSha": "3d96b2c54363c7349d59b881996231d3273d1456",
+    "mergedAt": "2026-11-04T18:40:48-08:00"
   },
   "scripts": {
     "build": "tsdown && node scripts/export-host-contracts.mjs --write",

package/dist/harness-D1fTxnDD.mjs

@@ -1,199 +0,0 @@
-import { n as HARNESS_WARM_TRANSPORT_ENV } from "./harness-contracts-BZoECCMc.mjs";
-import { ProxySecretBindingSchema, ProxySecretGrantSchema, ProxySecretReceiptSchema, ProxySecretUpdateControlsSchema, ProxySecretsSchema, isProxySecretScopeAttenuation, ownPropertyRecordSchema, proxySecretPresentationsEqual } from "@tangle-network/agent-interface";
-import { z } from "zod";
-function baseProxyToken(token) {
-	const i = token.indexOf(".");
-	return i === -1 ? token : token.slice(0, i);
-}
-const MODEL_PROXY_TOKENS = {
-	OPENCODE_MODEL_API_KEY: "proxy-model-token",
-	OPENAI_API_KEY: "proxy-openai-token",
-	ANTHROPIC_API_KEY: "proxy-anthropic-token",
-	OPENROUTER_API_KEY: "proxy-openrouter-token",
-	TANGLE_INFERENCE_KEY: "proxy-openai-token",
-	ZAI_API_KEY: "proxy-zai-token",
-	ZHIPU_API_KEY: "proxy-zai-token"
-};
-new Set(Object.values(MODEL_PROXY_TOKENS));
-new Set([
-	...Object.keys(MODEL_PROXY_TOKENS),
-	"TANGLE_API_KEY",
-	"GITHUB_TOKEN",
-	"GH_TOKEN"
-]);
-/** Proxy-private slot names shared by legacy and canonical bindings. */
-function declaredSecretSlotEnvVar(index) {
-	return `TANGLE_DECLARED_SLOT_${index}`;
-}
-/** True for a slot name, which exists at the proxy and never in a box env. */
-function isDeclaredSecretSlotEnvVar(name) {
-	return /^TANGLE_DECLARED_SLOT_\d+$/.test(name);
-}
-/** The base placeholder for the slot at `index`; the box holds it salted. */
-function declaredSecretBaseToken(index) {
-	return `proxy-declared-${index}-token`;
-}
-/** Every slot name mapped to its base placeholder. */
-function declaredSecretSlotTokens() {
-	const slots = {};
-	for (let index = 0; index < 16; index++) slots[declaredSecretSlotEnvVar(index)] = declaredSecretBaseToken(index);
-	return slots;
-}
-//#endregion
-//#region ../runtime-contracts/dist/proxy-secret-materialization.js
-const syntheticHeader = {
-	alg: "HS256",
-	typ: "JWT"
-};
-const encode = (value) => btoa(value instanceof Uint8Array ? String.fromCharCode(...value) : JSON.stringify(value)).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
-function placeholderPrefix(slot, format, expiresAt) {
-	return format === "jwt" ? `${encode(syntheticHeader)}.${encode({
-		sub: "sandbox-placeholder",
-		aud: "proxy-secret-placeholder",
-		exp: Math.floor(Date.parse(expiresAt) / 1e3)
-	})}.` : `proxy-declared-${slot.slice(21)}-token-`;
-}
-function isSyntheticPlaceholder(material) {
-	const prefix = placeholderPrefix(material.slot, material.grant.placeholderFormat, material.issuerExpiresAt);
-	return material.placeholder.startsWith(prefix) && /^[A-Za-z0-9_-]{43}$/.test(material.placeholder.slice(prefix.length));
-}
-z.array(z.strictObject({
-	binding: ProxySecretBindingSchema,
-	grant: ProxySecretGrantSchema,
-	placeholder: z.string().min(1),
-	slot: z.string().refine(isDeclaredSecretSlotEnvVar),
-	issuerExpiresAt: z.iso.datetime(),
-	native: z.unknown().optional()
-})).superRefine((materials, ctx) => {
-	const bindings = ProxySecretsSchema.safeParse(materials.map((m) => m.binding));
-	const unique = (values) => new Set(values).size === values.length;
-	if (!bindings.success || !unique(materials.map((m) => m.slot)) || !unique(materials.map((m) => m.placeholder)) || !unique(materials.map((m) => m.grant.grantId)) || new Set(materials.map((m) => m.grant.epoch)).size > 1 || new Set(materials.map((m) => m.grant.sandboxId)).size > 1 || materials.some((material) => !isSyntheticPlaceholder(material)) || materials.some(({ binding, grant, issuerExpiresAt }) => !isProxySecretScopeAttenuation(binding, grant.scope) || !proxySecretPresentationsEqual(binding.presentation, grant.presentation) || (binding.placeholderFormat ?? "opaque") !== grant.placeholderFormat || Date.parse(grant.expiresAt) > Date.parse(issuerExpiresAt))) ctx.addIssue({
-		code: "custom",
-		message: "Invalid proxy secret materialization"
-	});
-});
-ProxySecretUpdateControlsSchema.extend({
-	resolvedSecrets: ownPropertyRecordSchema(z.string().min(1), { maxEntries: Number.MAX_SAFE_INTEGER }).default({}),
-	proxySecretGrants: ProxySecretReceiptSchema.options[0].shape.bindings,
-	expectedProxySecretGeneration: ProxySecretUpdateControlsSchema.shape.expectedProxySecretGeneration.unwrap()
-}).strict().refine((body) => new Set(body.proxySecretGrants.map((b) => b.envName)).size === body.proxySecretGrants.length);
-//#endregion
-//#region ../runtime-contracts/dist/runtime-environment.js
-const SAFE_ENV_VAR_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
-function isSafeEnvVarName(name) {
-	if (typeof name !== "string") return false;
-	if (name.length === 0 || name.length > 256) return false;
-	return SAFE_ENV_VAR_NAME_RE.test(name);
-}
-/** Client proxy URLs first, then bypass names. */
-const EGRESS_PROXY_ENV_NAMES = [
-	"HTTPS_PROXY",
-	"https_proxy",
-	"HTTP_PROXY",
-	"http_proxy",
-	"NO_PROXY",
-	"no_proxy"
-];
-const CA_TRUST_ENV_NAMES = [
-	"NODE_EXTRA_CA_CERTS",
-	"SSL_CERT_FILE",
-	"CURL_CA_BUNDLE",
-	"GIT_SSL_CAINFO",
-	"NIX_SSL_CERT_FILE"
-];
-[...EGRESS_PROXY_ENV_NAMES, ...CA_TRUST_ENV_NAMES];
-const FORBIDDEN_ENV_VAR_NAMES = new Set([
-	"LD_PRELOAD",
-	"LD_LIBRARY_PATH",
-	"LD_AUDIT",
-	"DYLD_INSERT_LIBRARIES",
-	"DYLD_LIBRARY_PATH",
-	"DYLD_FALLBACK_LIBRARY_PATH",
-	"NODE_OPTIONS",
-	"NODE_PATH",
-	"NODE_TLS_REJECT_UNAUTHORIZED",
-	"PYTHONPATH",
-	"PYTHONSTARTUP",
-	"PERL5OPT",
-	"PERL5LIB",
-	"RUBYOPT",
-	"RUBYLIB",
-	"PATH",
-	"NIX_BIN_PATH",
-	"EGRESS_EDGE_POOL_ENABLED",
-	"EDGE_BIND_ID",
-	"PRIVACY_EGRESS",
-	"LOG_REDACT",
-	"IFS",
-	"BASH_ENV",
-	"ENV",
-	"SHELL",
-	"SHELLOPTS",
-	"PROMPT_COMMAND",
-	"HOME",
-	"XDG_CONFIG_HOME",
-	"XDG_DATA_HOME",
-	"XDG_CACHE_HOME",
-	"XDG_STATE_HOME",
-	"XDG_RUNTIME_DIR",
-	"HTTPS_PROXY",
-	"HTTP_PROXY",
-	"ALL_PROXY",
-	"NO_PROXY",
-	"https_proxy",
-	"http_proxy",
-	"all_proxy",
-	"no_proxy",
-	"SSL_CERT_FILE",
-	"SSL_CERT_DIR",
-	"REQUESTS_CA_BUNDLE",
-	"CURL_CA_BUNDLE",
-	"NODE_EXTRA_CA_CERTS",
-	"HOSTNAME",
-	"CONTAINER_ID",
-	"AGENT_WORKSPACE_ROOT",
-	"WORKSPACE_PATH",
-	"STORAGE_PATH",
-	"WORKSPACE_FILE_API_ROOT_ONLY",
-	"WORKSPACE_ALLOWED_ABSOLUTE_PATHS",
-	"TANGLE_PLAN_CALLBACK_ALLOWED_ORIGINS"
-]);
-const FORBIDDEN_ENV_VAR_PREFIXES = [
-	"SIDECAR_",
-	"ORCHESTRATOR_",
-	"AGENT_INTERNAL_",
-	"SANDBOX_DEV_",
-	"AGENT_SUBPROCESS_",
-	"TEE_ATTESTATION_"
-];
-const RUNTIME_CALLER_ALLOWED_ENV_NAMES = new Set(["SIDECAR_CAPABILITIES", "SIDECAR_PLATFORM_CONTROL_RUNTIME"]);
-new Set(Object.values(HARNESS_WARM_TRANSPORT_ENV).flatMap(({ warmServer, prewarm }) => [warmServer, prewarm]));
-function isForbiddenEnvVarName(name) {
-	if (RUNTIME_CALLER_ALLOWED_ENV_NAMES.has(name)) return false;
-	if (FORBIDDEN_ENV_VAR_NAMES.has(name)) return true;
-	for (const prefix of FORBIDDEN_ENV_VAR_PREFIXES) if (name.startsWith(prefix)) return true;
-	return false;
-}
-/**
-* POSIX names for caller-owned container env. Runtime process.env merges must additionally enforce
-* isForbiddenEnvVarName, including project provisioning and Sidecar config.
-*/
-const safeEnvRecordSchema = ownPropertyRecordSchema(z.string(), { maxEntries: Number.MAX_SAFE_INTEGER }).refine((value) => Object.keys(value).every(isSafeEnvVarName), { message: "invalid env var name" });
-/** Names only: the caller must keep a separate source and pass values to resume({ env }). */
-const sandboxEnvRecoverySchema = z.object({ callerResupplies: z.array(z.string().max(256).refine(isSafeEnvVarName, { message: "invalid env var name" })).max(128).refine((keys) => new Set(keys).size === keys.length, { message: "callerResupplies must contain unique keys" }) }).strict();
-z.object({
-	envRecovery: sandboxEnvRecoverySchema,
-	dryRun: z.boolean().optional()
-}).strict();
-z.object({
-	envRecovery: sandboxEnvRecoverySchema,
-	eligibleCallerResupplyKeys: z.array(z.string()),
-	requiredOnColdResumeKeys: z.array(z.string()),
-	automaticCredentialRecovery: z.literal(false),
-	dryRun: z.boolean()
-}).strict();
-safeEnvRecordSchema.refine((value) => Object.keys(value).every((key) => !isForbiddenEnvVarName(key) && !key.startsWith("SIDECAR_")), { message: "runtime-owned env var name cannot be set by callers" });
-//#endregion
-export { baseProxyToken as i, isSafeEnvVarName as n, declaredSecretSlotTokens as r, isForbiddenEnvVarName as t };
-
-//# sourceMappingURL=harness-D1fTxnDD.mjs.map