@the-open-engine/zeroshot 6.30.2 → 6.31.1

package/lib/agent-cli-provider/omp/rpc-protocol.js

@@ -0,0 +1,208 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OmpRpcFrameDecoder = void 0;
+const json_1 = require("../json");
+const rpc_protocol_contract_1 = require("./rpc-protocol-contract");
+__exportStar(require("./rpc-protocol-contract"), exports);
+const STRICT_BASE64_PATTERN = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
+function decodeStrictBase64(data) {
+    if (typeof data !== 'string' || data.length === 0 || !STRICT_BASE64_PATTERN.test(data)) {
+        throw new rpc_protocol_contract_1.OmpRpcProtocolError('invalid-chunk-data', "rpc_chunk 'data' must be a non-empty, canonically-padded base64 string.");
+    }
+    const bytes = Buffer.from(data, 'base64');
+    if (bytes.toString('base64') !== data) {
+        throw new rpc_protocol_contract_1.OmpRpcProtocolError('invalid-chunk-data', "rpc_chunk 'data' failed a base64 round-trip check (non-canonical encoding).");
+    }
+    return bytes;
+}
+function decodeStrictUtf8(bytes) {
+    try {
+        return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    }
+    catch {
+        throw new rpc_protocol_contract_1.OmpRpcProtocolError('invalid-utf8-in-reassembled-frame', 'Reassembled rpc_chunk sequence is not valid UTF-8.');
+    }
+}
+function toPhysicalFrame(record) {
+    const type = (0, json_1.getString)(record, 'type');
+    if (type === null) {
+        throw new rpc_protocol_contract_1.OmpRpcProtocolError('malformed-physical-frame', "Physical frame is missing a string 'type' field.");
+    }
+    return { ...record, type };
+}
+function toReassembledFrame(record, chunkId) {
+    const type = (0, json_1.getString)(record, 'type');
+    if (type === null) {
+        throw new rpc_protocol_contract_1.OmpRpcProtocolError('malformed-json-in-reassembled-frame', `rpc_chunk sequence "${chunkId}" reassembled into an object missing a string 'type' field.`);
+    }
+    return { ...record, type };
+}
+function readChunkMetadata(parsed, limits) {
+    const chunkId = (0, json_1.getString)(parsed, 'chunkId');
+    if (chunkId === null || chunkId.length === 0 || chunkId.length > 128) {
+        throw new rpc_protocol_contract_1.OmpRpcProtocolError('invalid-chunk-metadata', "rpc_chunk 'chunkId' must be a non-empty string of at most 128 characters.");
+    }
+    const index = (0, json_1.getNumber)(parsed, 'index');
+    const count = (0, json_1.getNumber)(parsed, 'count');
+    const byteLength = (0, json_1.getNumber)(parsed, 'byteLength');
+    if (index === null ||
+        !Number.isSafeInteger(index) ||
+        index < 0 ||
+        count === null ||
+        !Number.isSafeInteger(count) ||
+        count < 2 ||
+        count > limits.maxChunksPerFrame ||
+        index >= count ||
+        byteLength === null ||
+        !Number.isSafeInteger(byteLength) ||
+        byteLength <= 0 ||
+        byteLength > limits.maxReassembledFrameBytes) {
+        throw new rpc_protocol_contract_1.OmpRpcProtocolError('invalid-chunk-metadata', "rpc_chunk has invalid 'index'/'count'/'byteLength' metadata.");
+    }
+    return { chunkId, index, count, byteLength };
+}
+class OmpRpcFrameDecoder {
+    limits;
+    buffer;
+    finished;
+    pendingReassemblies;
+    inflightReassemblyBytes;
+    constructor(limits) {
+        this.limits = limits;
+        this.buffer = Buffer.alloc(0);
+        this.finished = false;
+        this.pendingReassemblies = new Map();
+        this.inflightReassemblyBytes = 0;
+    }
+    // `negotiatedV2` defaults to true so callers that don't care about pre-negotiation gating
+    // (e.g. the fixture-replay tests below) see unchanged behavior; the RPC driver passes its
+    // live negotiation state so a bare `rpc_chunk` physical frame is rejected before negotiation
+    // succeeds, even though the decoder would otherwise buffer it silently pending reassembly.
+    push(chunk, negotiatedV2 = true) {
+        if (this.finished) {
+            throw new rpc_protocol_contract_1.OmpRpcProtocolError('decoder-finished', 'push() called after finish().');
+        }
+        this.buffer = Buffer.concat([this.buffer, Buffer.from(chunk)]);
+        const frames = [];
+        for (;;) {
+            const newlineIndex = this.buffer.indexOf(0x0a);
+            if (newlineIndex === -1) {
+                if (this.buffer.byteLength > this.limits.maxPhysicalFrameBytes) {
+                    throw new rpc_protocol_contract_1.OmpRpcProtocolError('physical-frame-too-large', `Buffered physical frame exceeds the ${this.limits.maxPhysicalFrameBytes}-byte limit without a terminating newline.`);
+                }
+                break;
+            }
+            const lineBytes = this.buffer.subarray(0, newlineIndex);
+            this.buffer = this.buffer.subarray(newlineIndex + 1);
+            if (lineBytes.byteLength + 1 > this.limits.maxPhysicalFrameBytes) {
+                throw new rpc_protocol_contract_1.OmpRpcProtocolError('physical-frame-too-large', `Physical frame of ${lineBytes.byteLength + 1} bytes exceeds the ${this.limits.maxPhysicalFrameBytes}-byte limit.`);
+            }
+            const frame = this.consumeLine(lineBytes, negotiatedV2);
+            if (frame !== null)
+                frames.push(frame);
+        }
+        return frames;
+    }
+    finish() {
+        this.finished = true;
+        if (this.buffer.byteLength > 0) {
+            throw new rpc_protocol_contract_1.OmpRpcProtocolError('incomplete-physical-frame', 'Stream ended with an unterminated physical frame (no trailing newline).');
+        }
+        if (this.pendingReassemblies.size > 0) {
+            throw new rpc_protocol_contract_1.OmpRpcProtocolError('incomplete-chunk-sequence', 'Stream ended with an incomplete rpc_chunk sequence still pending.');
+        }
+    }
+    consumeLine(lineBytes, negotiatedV2) {
+        let value;
+        try {
+            value = JSON.parse(lineBytes.toString('utf8'));
+        }
+        catch {
+            throw new rpc_protocol_contract_1.OmpRpcProtocolError('malformed-physical-frame', 'Physical frame is not valid JSON.');
+        }
+        if (!(0, json_1.isRecord)(value)) {
+            throw new rpc_protocol_contract_1.OmpRpcProtocolError('malformed-physical-frame', 'Physical frame must be a JSON object.');
+        }
+        const type = (0, json_1.getString)(value, 'type');
+        (0, rpc_protocol_contract_1.assertNoPreNegotiationRpcChunk)(type ?? '', negotiatedV2);
+        if (type !== 'rpc_chunk') {
+            if (this.pendingReassemblies.size > 0) {
+                throw new rpc_protocol_contract_1.OmpRpcProtocolError('interrupted-chunk-sequence', 'A non-chunk frame arrived while an rpc_chunk sequence was pending.');
+            }
+            return toPhysicalFrame(value);
+        }
+        return this.consumeChunk(value);
+    }
+    consumeChunk(parsed) {
+        const metadata = readChunkMetadata(parsed, this.limits);
+        const bytes = decodeStrictBase64(parsed.data);
+        let pending = this.pendingReassemblies.get(metadata.chunkId);
+        if (pending === undefined) {
+            if (metadata.index !== 0) {
+                throw new rpc_protocol_contract_1.OmpRpcProtocolError('chunk-sequence-must-start-at-zero', `rpc_chunk sequence "${metadata.chunkId}" must begin at index 0.`);
+            }
+            if (this.pendingReassemblies.size >= this.limits.maxConcurrentReassemblies) {
+                throw new rpc_protocol_contract_1.OmpRpcProtocolError('interleaved-chunk-sequence', `Starting rpc_chunk sequence "${metadata.chunkId}" would exceed the concurrent-reassembly limit of ${this.limits.maxConcurrentReassemblies}.`);
+            }
+            pending = {
+                chunkId: metadata.chunkId,
+                count: metadata.count,
+                byteLength: metadata.byteLength,
+                nextIndex: 0,
+                chunks: [],
+                receivedBytes: 0,
+            };
+            this.pendingReassemblies.set(metadata.chunkId, pending);
+        }
+        else if (pending.count !== metadata.count ||
+            pending.byteLength !== metadata.byteLength ||
+            pending.nextIndex !== metadata.index) {
+            throw new rpc_protocol_contract_1.OmpRpcProtocolError('chunk-sequence-mismatch', `rpc_chunk sequence "${metadata.chunkId}" metadata or ordering does not match the tracked sequence.`);
+        }
+        pending.chunks.push(bytes);
+        pending.receivedBytes += bytes.byteLength;
+        this.inflightReassemblyBytes += bytes.byteLength;
+        if (this.inflightReassemblyBytes > this.limits.maxInflightReassemblyBytes) {
+            throw new rpc_protocol_contract_1.OmpRpcProtocolError('inflight-reassembly-bytes-exceeded', `Total in-flight rpc_chunk reassembly bytes exceed the ${this.limits.maxInflightReassemblyBytes}-byte limit.`);
+        }
+        if (pending.receivedBytes > pending.byteLength) {
+            throw new rpc_protocol_contract_1.OmpRpcProtocolError('chunk-sequence-exceeds-declared-length', `rpc_chunk sequence "${metadata.chunkId}" received more bytes than its declared byteLength.`);
+        }
+        pending.nextIndex += 1;
+        if (pending.nextIndex < pending.count)
+            return null;
+        this.pendingReassemblies.delete(metadata.chunkId);
+        this.inflightReassemblyBytes -= pending.receivedBytes;
+        if (pending.receivedBytes !== pending.byteLength) {
+            throw new rpc_protocol_contract_1.OmpRpcProtocolError('chunk-sequence-length-mismatch', `rpc_chunk sequence "${metadata.chunkId}" completed with ${pending.receivedBytes} bytes but declared ${pending.byteLength}.`);
+        }
+        const decodedText = decodeStrictUtf8(Buffer.concat(pending.chunks));
+        let reassembled;
+        try {
+            reassembled = JSON.parse(decodedText);
+        }
+        catch {
+            throw new rpc_protocol_contract_1.OmpRpcProtocolError('malformed-json-in-reassembled-frame', `rpc_chunk sequence "${metadata.chunkId}" reassembled into invalid JSON.`);
+        }
+        if (!(0, json_1.isRecord)(reassembled)) {
+            throw new rpc_protocol_contract_1.OmpRpcProtocolError('non-object-reassembled-frame', `rpc_chunk sequence "${metadata.chunkId}" reassembled into a non-object JSON value.`);
+        }
+        return toReassembledFrame(reassembled, metadata.chunkId);
+    }
+}
+exports.OmpRpcFrameDecoder = OmpRpcFrameDecoder;
+//# sourceMappingURL=rpc-protocol.js.map

package/lib/agent-cli-provider/omp/rpc-protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc-protocol.js","sourceRoot":"","sources":["../../../src/agent-cli-provider/omp/rpc-protocol.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,kCAAyD;AACzD,mEAKiC;AAEjC,0DAAwC;AACxC,MAAM,qBAAqB,GAAG,kEAAkE,CAAC;AACjG,SAAS,kBAAkB,CAAC,IAAa;IACvC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,2CAAmB,CAC3B,oBAAoB,EACpB,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,2CAAmB,CAC3B,oBAAoB,EACpB,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,CAAC;QACH,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,2CAAmB,CAC3B,mCAAmC,EACnC,oDAAoD,CACrD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,MAA+B;IACtD,MAAM,IAAI,GAAG,IAAA,gBAAS,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,2CAAmB,CAC3B,0BAA0B,EAC1B,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,kBAAkB,CAAC,MAA+B,EAAE,OAAe;IAC1E,MAAM,IAAI,GAAG,IAAA,gBAAS,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,2CAAmB,CAC3B,qCAAqC,EACrC,uBAAuB,OAAO,6DAA6D,CAC5F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC;AAC7B,CAAC;AASD,SAAS,iBAAiB,CACxB,MAA+B,EAC/B,MAA2B;IAE3B,MAAM,OAAO,GAAG,IAAA,gBAAS,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC7C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACrE,MAAM,IAAI,2CAAmB,CAC3B,wBAAwB,EACxB,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAA,gBAAS,EAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAA,gBAAS,EAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,IAAA,gBAAS,EAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACnD,IACE,KAAK,KAAK,IAAI;QACd,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAC5B,KAAK,GAAG,CAAC;QACT,KAAK,KAAK,IAAI;QACd,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAC5B,KAAK,GAAG,CAAC;QACT,KAAK,GAAG,MAAM,CAAC,iBAAiB;QAChC,KAAK,IAAI,KAAK;QACd,UAAU,KAAK,IAAI;QACnB,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC;QACjC,UAAU,IAAI,CAAC;QACf,UAAU,GAAG,MAAM,CAAC,wBAAwB,EAC5C,CAAC;QACD,MAAM,IAAI,2CAAmB,CAC3B,wBAAwB,EACxB,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAC/C,CAAC;AAWD,MAAa,kBAAkB;IACZ,MAAM,CAAsB;IACrC,MAAM,CAAS;IACf,QAAQ,CAAU;IACT,mBAAmB,CAAiC;IAC7D,uBAAuB,CAAS;IAExC,YAAY,MAA2B;QACrC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC,mBAAmB,GAAG,IAAI,GAAG,EAAE,CAAC;QACrC,IAAI,CAAC,uBAAuB,GAAG,CAAC,CAAC;IACnC,CAAC;IAED,0FAA0F;IAC1F,0FAA0F;IAC1F,6FAA6F;IAC7F,2FAA2F;IAC3F,IAAI,CAAC,KAAiB,EAAE,YAAY,GAAG,IAAI;QACzC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,2CAAmB,CAAC,kBAAkB,EAAE,+BAA+B,CAAC,CAAC;QACrF,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAyB,EAAE,CAAC;QAExC,SAAS,CAAC;YACR,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;gBACxB,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;oBAC/D,MAAM,IAAI,2CAAmB,CAC3B,0BAA0B,EAC1B,uCAAuC,IAAI,CAAC,MAAM,CAAC,qBAAqB,4CAA4C,CACrH,CAAC;gBACJ,CAAC;gBACD,MAAM;YACR,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;YACxD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;YACrD,IAAI,SAAS,CAAC,UAAU,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC;gBACjE,MAAM,IAAI,2CAAmB,CAC3B,0BAA0B,EAC1B,qBAAqB,SAAS,CAAC,UAAU,GAAG,CAAC,sBAAsB,IAAI,CAAC,MAAM,CAAC,qBAAqB,cAAc,CACnH,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YACxD,IAAI,KAAK,KAAK,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM;QACJ,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,2CAAmB,CAC3B,2BAA2B,EAC3B,yEAAyE,CAC1E,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,2CAAmB,CAC3B,2BAA2B,EAC3B,mEAAmE,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,SAAiB,EAAE,YAAqB;QAC1D,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,2CAAmB,CAAC,0BAA0B,EAAE,mCAAmC,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,IAAA,eAAQ,EAAC,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,2CAAmB,CAC3B,0BAA0B,EAC1B,uCAAuC,CACxC,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,gBAAS,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACtC,IAAA,sDAA8B,EAAC,IAAI,IAAI,EAAE,EAAE,YAAY,CAAC,CAAC;QACzD,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,2CAAmB,CAC3B,4BAA4B,EAC5B,oEAAoE,CACrE,CAAC;YACJ,CAAC;YACD,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IAEO,YAAY,CAAC,MAA+B;QAClD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAE9C,IAAI,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,QAAQ,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,2CAAmB,CAC3B,mCAAmC,EACnC,uBAAuB,QAAQ,CAAC,OAAO,0BAA0B,CAClE,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,mBAAmB,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,yBAAyB,EAAE,CAAC;gBAC3E,MAAM,IAAI,2CAAmB,CAC3B,4BAA4B,EAC5B,gCAAgC,QAAQ,CAAC,OAAO,qDAAqD,IAAI,CAAC,MAAM,CAAC,yBAAyB,GAAG,CAC9I,CAAC;YACJ,CAAC;YACD,OAAO,GAAG;gBACR,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,SAAS,EAAE,CAAC;gBACZ,MAAM,EAAE,EAAE;gBACV,aAAa,EAAE,CAAC;aACjB,CAAC;YACF,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1D,CAAC;aAAM,IACL,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;YAChC,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;YAC1C,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,KAAK,EACpC,CAAC;YACD,MAAM,IAAI,2CAAmB,CAC3B,yBAAyB,EACzB,uBAAuB,QAAQ,CAAC,OAAO,6DAA6D,CACrG,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC,UAAU,CAAC;QAC1C,IAAI,CAAC,uBAAuB,IAAI,KAAK,CAAC,UAAU,CAAC;QACjD,IAAI,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC,MAAM,CAAC,0BAA0B,EAAE,CAAC;YAC1E,MAAM,IAAI,2CAAmB,CAC3B,oCAAoC,EACpC,yDAAyD,IAAI,CAAC,MAAM,CAAC,0BAA0B,cAAc,CAC9G,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;YAC/C,MAAM,IAAI,2CAAmB,CAC3B,wCAAwC,EACxC,uBAAuB,QAAQ,CAAC,OAAO,qDAAqD,CAC7F,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC;QACvB,IAAI,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAEnD,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,uBAAuB,IAAI,OAAO,CAAC,aAAa,CAAC;QACtD,IAAI,OAAO,CAAC,aAAa,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;YACjD,MAAM,IAAI,2CAAmB,CAC3B,gCAAgC,EAChC,uBAAuB,QAAQ,CAAC,OAAO,oBAAoB,OAAO,CAAC,aAAa,uBAAuB,OAAO,CAAC,UAAU,GAAG,CAC7H,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACpE,IAAI,WAAoB,CAAC;QACzB,IAAI,CAAC;YACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,2CAAmB,CAC3B,qCAAqC,EACrC,uBAAuB,QAAQ,CAAC,OAAO,kCAAkC,CAC1E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAA,eAAQ,EAAC,WAAW,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,2CAAmB,CAC3B,8BAA8B,EAC9B,uBAAuB,QAAQ,CAAC,OAAO,6CAA6C,CACrF,CAAC;QACJ,CAAC;QACD,OAAO,kBAAkB,CAAC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;CACF;AAvLD,gDAuLC"}

package/lib/agent-cli-provider/{omp-rpc-session.d.ts → omp/rpc-session.d.ts}

@@ -14,4 +14,4 @@ export type OmpSessionLaunch = {
     readonly partition: VerifiedOmpPartition;
     readonly file: VerifiedOmpSessionFile;
 };
-//# sourceMappingURL=omp-rpc-session.d.ts.map
+//# sourceMappingURL=rpc-session.d.ts.map

package/lib/agent-cli-provider/omp/rpc-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc-session.d.ts","sourceRoot":"","sources":["../../../src/agent-cli-provider/omp/rpc-session.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAA;CAAE,GACpE;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;CACvC,CAAC"}

package/lib/agent-cli-provider/{omp-rpc-session.js → omp/rpc-session.js}

@@ -3,4 +3,4 @@
 // (`--no-session`); `fresh`/`resume` carry a verified partition (and, for resume, a verified
 // session file) allocated and checked by the JS task-lib layer — never a raw, unverified path.
 Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=omp-rpc-session.js.map
+//# sourceMappingURL=rpc-session.js.map

package/lib/agent-cli-provider/omp/rpc-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rpc-session.js","sourceRoot":"","sources":["../../../src/agent-cli-provider/omp/rpc-session.ts"],"names":[],"mappings":";AAAA,kGAAkG;AAClG,6FAA6F;AAC7F,+FAA+F"}

package/lib/agent-cli-provider/omp/sdk-contract.d.ts

@@ -0,0 +1,34 @@
+import type { OmpSdkErrorCategory } from './sdk-protocol';
+import type { ProcessResult } from '../process-runner';
+import type { ErrorClassification } from '../types';
+export type ContractOmpSdkTerminal = {
+    readonly type: 'result';
+    readonly frame: Readonly<Record<string, unknown>>;
+    readonly event: Readonly<Record<string, unknown>> & {
+        readonly type: 'result';
+        readonly success: boolean;
+    };
+} | {
+    readonly type: 'error';
+    readonly frame: Readonly<Record<string, unknown>> & {
+        readonly error: {
+            readonly category: OmpSdkErrorCategory;
+            readonly retryable: boolean;
+        };
+    };
+};
+export interface ContractOmpSdkProcessResult extends ProcessResult {
+    readonly terminal: ContractOmpSdkTerminal;
+    readonly progress: readonly unknown[];
+    readonly diagnosticStderr: string;
+    readonly cleanupAttestation: Readonly<Record<string, unknown>>;
+}
+export declare function isOmpSdkErrorCategory(value: unknown): value is OmpSdkErrorCategory;
+export declare function isContractOmpSdkTerminal(value: unknown): value is ContractOmpSdkTerminal;
+export declare function isContractOmpSdkProcessResult(result: ProcessResult): result is ContractOmpSdkProcessResult;
+export type OmpSdkErrorClassification = ErrorClassification & {
+    readonly category: OmpSdkErrorCategory;
+};
+export declare function ompSdkFailureClassification(result: ContractOmpSdkProcessResult): OmpSdkErrorClassification | null;
+export declare function invokeEvidence(result: ProcessResult, timeoutMs: number | undefined): Record<string, unknown>;
+//# sourceMappingURL=sdk-contract.d.ts.map

package/lib/agent-cli-provider/omp/sdk-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk-contract.d.ts","sourceRoot":"","sources":["../../../src/agent-cli-provider/omp/sdk-contract.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAEpD,MAAM,MAAM,sBAAsB,GAC9B;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAClD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG;QAClD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;QACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;KAC3B,CAAC;CACH,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG;QAClD,QAAQ,CAAC,KAAK,EAAE;YACd,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;YACvC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;SAC7B,CAAC;KACH,CAAC;CACH,CAAC;AAEN,MAAM,WAAW,2BAA4B,SAAQ,aAAa;IAChE,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;IACtC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAChE;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAiBlF;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,sBAAsB,CAgBxF;AAED,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,aAAa,GACpB,MAAM,IAAI,2BAA2B,CAWvC;AAED,MAAM,MAAM,yBAAyB,GAAG,mBAAmB,GAAG;IAC5D,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;CACxC,CAAC;AAEF,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,2BAA2B,GAClC,yBAAyB,GAAG,IAAI,CAalC;AAED,wBAAgB,cAAc,CAC5B,MAAM,EAAE,aAAa,EACrB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAezB"}

package/lib/agent-cli-provider/omp/sdk-contract.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isOmpSdkErrorCategory = isOmpSdkErrorCategory;
+exports.isContractOmpSdkTerminal = isContractOmpSdkTerminal;
+exports.isContractOmpSdkProcessResult = isContractOmpSdkProcessResult;
+exports.ompSdkFailureClassification = ompSdkFailureClassification;
+exports.invokeEvidence = invokeEvidence;
+const json_1 = require("../json");
+function isOmpSdkErrorCategory(value) {
+    switch (value) {
+        case 'request':
+        case 'model':
+        case 'auth':
+        case 'rate-limit':
+        case 'timeout':
+        case 'provider':
+        case 'schema':
+        case 'cancelled':
+        case 'sdk':
+        case 'cleanup':
+        case 'internal':
+            return true;
+        default:
+            return false;
+    }
+}
+function isContractOmpSdkTerminal(value) {
+    if (!(0, json_1.isRecord)(value) || !(0, json_1.isRecord)(value.frame) || value.frame.type !== value.type) {
+        return false;
+    }
+    if (value.type === 'result') {
+        return ((0, json_1.isRecord)(value.event) &&
+            value.event.type === 'result' &&
+            typeof value.event.success === 'boolean');
+    }
+    if (value.type !== 'error' || !(0, json_1.isRecord)(value.frame.error))
+        return false;
+    return (isOmpSdkErrorCategory(value.frame.error.category) &&
+        typeof value.frame.error.retryable === 'boolean');
+}
+function isContractOmpSdkProcessResult(result) {
+    return ('terminal' in result &&
+        isContractOmpSdkTerminal(result.terminal) &&
+        'progress' in result &&
+        Array.isArray(result.progress) &&
+        'diagnosticStderr' in result &&
+        typeof result.diagnosticStderr === 'string' &&
+        'cleanupAttestation' in result &&
+        (0, json_1.isRecord)(result.cleanupAttestation));
+}
+function ompSdkFailureClassification(result) {
+    if (result.terminal.type !== 'error')
+        return null;
+    const { category, retryable } = result.terminal.frame.error;
+    return {
+        category,
+        retryable,
+        kind: category === 'cancelled'
+            ? 'cancelled'
+            : retryable
+                ? 'unknown-retryable'
+                : 'permanent-pattern',
+    };
+}
+function invokeEvidence(result, timeoutMs) {
+    const sdkResult = isContractOmpSdkProcessResult(result) ? result : null;
+    return {
+        exitCode: result.exitCode,
+        signal: result.signal,
+        durationMs: result.durationMs,
+        timedOut: result.timedOut ?? false,
+        timeoutMs: result.timeoutMs ?? timeoutMs ?? null,
+        ...(sdkResult === null
+            ? {}
+            : {
+                terminal: sdkResult.terminal.frame,
+                cleanupAttestation: sdkResult.cleanupAttestation,
+            }),
+    };
+}
+//# sourceMappingURL=sdk-contract.js.map

package/lib/agent-cli-provider/omp/sdk-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk-contract.js","sourceRoot":"","sources":["../../../src/agent-cli-provider/omp/sdk-contract.ts"],"names":[],"mappings":";;AA+BA,sDAiBC;AAED,4DAgBC;AAED,sEAaC;AAMD,kEAeC;AAED,wCAkBC;AA1HD,kCAAmC;AA+BnC,SAAgB,qBAAqB,CAAC,KAAc;IAClD,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,SAAS,CAAC;QACf,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,YAAY,CAAC;QAClB,KAAK,SAAS,CAAC;QACf,KAAK,UAAU,CAAC;QAChB,KAAK,QAAQ,CAAC;QACd,KAAK,WAAW,CAAC;QACjB,KAAK,KAAK,CAAC;QACX,KAAK,SAAS,CAAC;QACf,KAAK,UAAU;YACb,OAAO,IAAI,CAAC;QACd;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAgB,wBAAwB,CAAC,KAAc;IACrD,IAAI,CAAC,IAAA,eAAQ,EAAC,KAAK,CAAC,IAAI,CAAC,IAAA,eAAQ,EAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;QAClF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,CACL,IAAA,eAAQ,EAAC,KAAK,CAAC,KAAK,CAAC;YACrB,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ;YAC7B,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CACzC,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,IAAA,eAAQ,EAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzE,OAAO,CACL,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC;QACjD,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CACjD,CAAC;AACJ,CAAC;AAED,SAAgB,6BAA6B,CAC3C,MAAqB;IAErB,OAAO,CACL,UAAU,IAAI,MAAM;QACpB,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC;QACzC,UAAU,IAAI,MAAM;QACpB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC9B,kBAAkB,IAAI,MAAM;QAC5B,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ;QAC3C,oBAAoB,IAAI,MAAM;QAC9B,IAAA,eAAQ,EAAC,MAAM,CAAC,kBAAkB,CAAC,CACpC,CAAC;AACJ,CAAC;AAMD,SAAgB,2BAA2B,CACzC,MAAmC;IAEnC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC;IAC5D,OAAO;QACL,QAAQ;QACR,SAAS;QACT,IAAI,EACF,QAAQ,KAAK,WAAW;YACtB,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,SAAS;gBACT,CAAC,CAAC,mBAAmB;gBACrB,CAAC,CAAC,mBAAmB;KAC5B,CAAC;AACJ,CAAC;AAED,SAAgB,cAAc,CAC5B,MAAqB,EACrB,SAA6B;IAE7B,MAAM,SAAS,GAAG,6BAA6B,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,KAAK;QAClC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,SAAS,IAAI,IAAI;QAChD,GAAG,CAAC,SAAS,KAAK,IAAI;YACpB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,KAAK;gBAClC,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;aACjD,CAAC;KACP,CAAC;AACJ,CAAC"}

package/lib/agent-cli-provider/omp/sdk-process-credentials.d.ts

@@ -0,0 +1,6 @@
+export declare function credentialPayload(names: readonly string[], source: Readonly<Record<string, string | undefined>>): {
+    readonly payload: Buffer;
+    readonly secretValues: readonly string[];
+};
+export declare function redactDiagnostic(value: string, secrets: readonly string[]): string;
+//# sourceMappingURL=sdk-process-credentials.d.ts.map

package/lib/agent-cli-provider/omp/sdk-process-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk-process-credentials.d.ts","sourceRoot":"","sources":["../../../src/agent-cli-provider/omp/sdk-process-credentials.ts"],"names":[],"mappings":"AAQA,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,GACnD;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAmCxE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAMlF"}

package/lib/agent-cli-provider/omp/sdk-process-credentials.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.credentialPayload = credentialPayload;
+exports.redactDiagnostic = redactDiagnostic;
+const sdk_protocol_1 = require("./sdk-protocol");
+const sdk_process_error_1 = require("./sdk-process-error");
+const CREDENTIAL_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const MAX_CREDENTIAL_COUNT = 32;
+const MAX_CREDENTIAL_NAME_BYTES = 128;
+const MAX_CREDENTIAL_VALUE_BYTES = 16 * 1024;
+function credentialPayload(names, source) {
+    if (names.length > MAX_CREDENTIAL_COUNT || new Set(names).size !== names.length) {
+        throw new sdk_process_error_1.OmpSdkProcessRunnerError('credential-error', 'OMP SDK credential name set is invalid.');
+    }
+    const values = {};
+    const secretValues = [];
+    for (const name of names) {
+        const value = source[name];
+        if (!CREDENTIAL_NAME.test(name) ||
+            Buffer.byteLength(name) > MAX_CREDENTIAL_NAME_BYTES ||
+            typeof value !== 'string' ||
+            value.length === 0 ||
+            Buffer.byteLength(value) > MAX_CREDENTIAL_VALUE_BYTES) {
+            throw new sdk_process_error_1.OmpSdkProcessRunnerError('credential-error', `OMP SDK credential ${name} is missing or invalid.`);
+        }
+        values[name] = value;
+        secretValues.push(value);
+    }
+    const payload = Buffer.from(JSON.stringify({ protocolVersion: 1, values }), 'utf8');
+    if (payload.byteLength > sdk_protocol_1.OMP_SDK_MAX_CREDENTIAL_BYTES) {
+        payload.fill(0);
+        throw new sdk_process_error_1.OmpSdkProcessRunnerError('credential-error', 'OMP SDK credential document is oversized.');
+    }
+    return { payload, secretValues };
+}
+function redactDiagnostic(value, secrets) {
+    let redacted = value;
+    for (const secret of secrets) {
+        if (secret.length > 0)
+            redacted = redacted.split(secret).join('[REDACTED]');
+    }
+    return redacted;
+}
+//# sourceMappingURL=sdk-process-credentials.js.map

package/lib/agent-cli-provider/omp/sdk-process-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk-process-credentials.js","sourceRoot":"","sources":["../../../src/agent-cli-provider/omp/sdk-process-credentials.ts"],"names":[],"mappings":";;AAQA,8CAsCC;AAED,4CAMC;AAtDD,iDAA8D;AAC9D,2DAA+D;AAE/D,MAAM,eAAe,GAAG,0BAA0B,CAAC;AACnD,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,0BAA0B,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7C,SAAgB,iBAAiB,CAC/B,KAAwB,EACxB,MAAoD;IAEpD,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QAChF,MAAM,IAAI,4CAAwB,CAChC,kBAAkB,EAClB,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IACE,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3B,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,yBAAyB;YACnD,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,CAAC,MAAM,KAAK,CAAC;YAClB,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,0BAA0B,EACrD,CAAC;YACD,MAAM,IAAI,4CAAwB,CAChC,kBAAkB,EAClB,sBAAsB,IAAI,yBAAyB,CACpD,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACrB,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACpF,IAAI,OAAO,CAAC,UAAU,GAAG,2CAA4B,EAAE,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,MAAM,IAAI,4CAAwB,CAChC,kBAAkB,EAClB,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;AACnC,CAAC;AAED,SAAgB,gBAAgB,CAAC,KAAa,EAAE,OAA0B;IACxE,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/lib/agent-cli-provider/omp/sdk-process-error.d.ts

@@ -0,0 +1,5 @@
+export declare class OmpSdkProcessRunnerError extends Error {
+    readonly code: 'cleanup-error' | 'containment-error' | 'credential-error' | 'protocol-error';
+    constructor(code: OmpSdkProcessRunnerError['code'], message: string, options?: ErrorOptions);
+}
+//# sourceMappingURL=sdk-process-error.d.ts.map

package/lib/agent-cli-provider/omp/sdk-process-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk-process-error.d.ts","sourceRoot":"","sources":["../../../src/agent-cli-provider/omp/sdk-process-error.ts"],"names":[],"mappings":"AAAA,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,mBAAmB,GAAG,kBAAkB,GAAG,gBAAgB,CAAC;gBAEjF,IAAI,EAAE,wBAAwB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CAK5F"}

package/lib/agent-cli-provider/omp/sdk-process-error.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OmpSdkProcessRunnerError = void 0;
+class OmpSdkProcessRunnerError extends Error {
+    code;
+    constructor(code, message, options) {
+        super(message, options);
+        this.name = 'OmpSdkProcessRunnerError';
+        this.code = code;
+    }
+}
+exports.OmpSdkProcessRunnerError = OmpSdkProcessRunnerError;
+//# sourceMappingURL=sdk-process-error.js.map

package/lib/agent-cli-provider/omp/sdk-process-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk-process-error.js","sourceRoot":"","sources":["../../../src/agent-cli-provider/omp/sdk-process-error.ts"],"names":[],"mappings":";;;AAAA,MAAa,wBAAyB,SAAQ,KAAK;IACxC,IAAI,CAAgF;IAE7F,YAAY,IAAsC,EAAE,OAAe,EAAE,OAAsB;QACzF,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AARD,4DAQC"}

package/lib/agent-cli-provider/omp/sdk-process-io.d.ts

@@ -0,0 +1,18 @@
+import type { ChildProcess } from 'node:child_process';
+import { Writable } from 'node:stream';
+import { type OmpSdkCollectedTerminal, type OmpSdkSidecarRequest } from './sdk-protocol';
+export declare const MAX_STDERR_BYTES: number;
+export declare const DEFAULT_TERMINATION_GRACE_MS = 250;
+export declare const DEFAULT_REAP_TIMEOUT_MS = 2000;
+export interface ChildOutcome {
+    readonly exitCode: number | null;
+    readonly signal: NodeJS.Signals | null;
+    readonly spawnError?: Error;
+}
+export declare function cancelledTerminal(request: OmpSdkSidecarRequest): OmpSdkCollectedTerminal;
+export declare function childClose(child: ChildProcess): Promise<ChildOutcome>;
+export declare function credentialWriter(child: ChildProcess): Writable;
+export declare function writeCredentials(channel: Writable, payload: Buffer): Promise<void>;
+export declare function duration(value: number | undefined, fallback: number): number;
+export declare function testIdentityCapArgument(): readonly string[];
+//# sourceMappingURL=sdk-process-io.d.ts.map

package/lib/agent-cli-provider/omp/sdk-process-io.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk-process-io.d.ts","sourceRoot":"","sources":["../../../src/agent-cli-provider/omp/sdk-process-io.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EAIL,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EAC1B,MAAM,gBAAgB,CAAC;AAGxB,eAAO,MAAM,gBAAgB,QAAY,CAAC;AAC1C,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAChD,eAAO,MAAM,uBAAuB,OAAQ,CAAC;AAE7C,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC;CAC7B;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,oBAAoB,GAAG,uBAAuB,CAWxF;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAWrE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,QAAQ,CAY9D;AAED,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYxF;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED,wBAAgB,uBAAuB,IAAI,SAAS,MAAM,EAAE,CAW3D"}

package/lib/agent-cli-provider/omp/sdk-process-io.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_REAP_TIMEOUT_MS = exports.DEFAULT_TERMINATION_GRACE_MS = exports.MAX_STDERR_BYTES = void 0;
+exports.cancelledTerminal = cancelledTerminal;
+exports.childClose = childClose;
+exports.credentialWriter = credentialWriter;
+exports.writeCredentials = writeCredentials;
+exports.duration = duration;
+exports.testIdentityCapArgument = testIdentityCapArgument;
+const node_stream_1 = require("node:stream");
+const sdk_protocol_1 = require("./sdk-protocol");
+const sdk_process_private_runtime_1 = require("./sdk-process-private-runtime");
+exports.MAX_STDERR_BYTES = 64 * 1024;
+exports.DEFAULT_TERMINATION_GRACE_MS = 250;
+exports.DEFAULT_REAP_TIMEOUT_MS = 2_000;
+const TEST_IDENTITY_CAP_ENV = 'ZEROSHOT_OMP_TEST_IDENTITY_CAP';
+function cancelledTerminal(request) {
+    const frame = (0, sdk_protocol_1.parseOmpSdkProtocolFrame)({
+        protocolVersion: 1,
+        type: 'error',
+        runId: request.runId,
+        backend: { id: 'omp-sdk', version: sdk_protocol_1.OMP_SDK_BACKEND_VERSION },
+        runtime: { name: 'bun', version: sdk_protocol_1.OMP_SDK_BUN_VERSION },
+        error: { code: 'cancelled', category: 'cancelled', retryable: false, redacted: true },
+    });
+    if (frame.type !== 'error')
+        throw new Error('cancelled terminal construction failed');
+    return { type: 'error', frame };
+}
+function childClose(child) {
+    return new Promise((resolveClose) => {
+        const spawned = child.pid !== undefined;
+        let spawnError;
+        child.once('error', (error) => {
+            if (!spawned)
+                spawnError = error;
+        });
+        child.once('close', (exitCode, signal) => {
+            resolveClose({ exitCode, signal, ...(spawnError === undefined ? {} : { spawnError }) });
+        });
+    });
+}
+function credentialWriter(child) {
+    const channel = child.stdio[3];
+    if (!(channel instanceof node_stream_1.Writable)) {
+        throw new sdk_process_private_runtime_1.OmpSdkProcessRunnerError('protocol-error', 'OMP SDK credential channel was not created.');
+    }
+    channel.on('error', () => {
+        // Keep late peer-reset errors observed after the one-shot write callback from becoming uncaught.
+    });
+    return channel;
+}
+async function writeCredentials(channel, payload) {
+    try {
+        await new Promise((resolveWrite, rejectWrite) => {
+            channel.once('error', rejectWrite);
+            channel.end(payload, () => {
+                channel.removeListener('error', rejectWrite);
+                resolveWrite();
+            });
+        });
+    }
+    finally {
+        payload.fill(0);
+    }
+}
+function duration(value, fallback) {
+    return value !== undefined && Number.isFinite(value) && value >= 0 ? value : fallback;
+}
+function testIdentityCapArgument() {
+    const source = process.env.NODE_ENV === 'test' ? process.env[TEST_IDENTITY_CAP_ENV] : undefined;
+    if (source === undefined)
+        return [];
+    const cap = Number(source);
+    if (!Number.isSafeInteger(cap) || cap < 8 || cap > 4_096) {
+        throw new sdk_process_private_runtime_1.OmpSdkProcessRunnerError('protocol-error', 'OMP SDK private test identity cap is invalid.');
+    }
+    return [String(cap)];
+}
+//# sourceMappingURL=sdk-process-io.js.map

package/lib/agent-cli-provider/omp/sdk-process-io.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sdk-process-io.js","sourceRoot":"","sources":["../../../src/agent-cli-provider/omp/sdk-process-io.ts"],"names":[],"mappings":";;;AAsBA,8CAWC;AAED,gCAWC;AAED,4CAYC;AAED,4CAYC;AAED,4BAEC;AAED,0DAWC;AA1FD,6CAAuC;AAEvC,iDAMwB;AACxB,+EAAyE;AAE5D,QAAA,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AAC7B,QAAA,4BAA4B,GAAG,GAAG,CAAC;AACnC,QAAA,uBAAuB,GAAG,KAAK,CAAC;AAC7C,MAAM,qBAAqB,GAAG,gCAAgC,CAAC;AAO/D,SAAgB,iBAAiB,CAAC,OAA6B;IAC7D,MAAM,KAAK,GAAG,IAAA,uCAAwB,EAAC;QACrC,eAAe,EAAE,CAAC;QAClB,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,sCAAuB,EAAE;QAC5D,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,kCAAmB,EAAE;QACtD,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE;KACtF,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACtF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC;AAED,SAAgB,UAAU,CAAC,KAAmB;IAC5C,OAAO,IAAI,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE;QAClC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC;QACxC,IAAI,UAA6B,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC5B,IAAI,CAAC,OAAO;gBAAE,UAAU,GAAG,KAAK,CAAC;QACnC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;YACvC,YAAY,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,gBAAgB,CAAC,KAAmB;IAClD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC,OAAO,YAAY,sBAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,sDAAwB,CAChC,gBAAgB,EAChB,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACvB,iGAAiG;IACnG,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAEM,KAAK,UAAU,gBAAgB,CAAC,OAAiB,EAAE,OAAe;IACvE,IAAI,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE;YACpD,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE;gBACxB,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;gBAC7C,YAAY,EAAE,CAAC;YACjB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAgB,QAAQ,CAAC,KAAyB,EAAE,QAAgB;IAClE,OAAO,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AACxF,CAAC;AAED,SAAgB,uBAAuB;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,KAAK,EAAE,CAAC;QACzD,MAAM,IAAI,sDAAwB,CAChC,gBAAgB,EAChB,+CAA+C,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AACvB,CAAC"}

package/lib/agent-cli-provider/omp/sdk-process-private-runtime.d.ts

@@ -0,0 +1,51 @@
+import { type OmpSdkCollectedTerminal, type OmpSdkProtocolProgressFrame } from './sdk-protocol';
+import type { PreparedSingleAgentProviderCommand } from '../single-agent-runtime';
+import type { OmpSdkCleanupAttestation, OmpSdkContainmentRequirement, OmpSdkExecutionIdentity, OmpSdkSemanticIdentity, PreparedEnvironmentPolicy, PreparedPrivateArtifacts, PreparedProviderInvoke } from '../types';
+import type { ProcessResult, ProcessRunnerOptions } from '../process-runner';
+export { credentialPayload, redactDiagnostic } from './sdk-process-credentials';
+export { OmpSdkProcessRunnerError } from './sdk-process-error';
+export interface OmpSdkPreparedInvocation extends PreparedSingleAgentProviderCommand {
+    readonly invoke: PreparedProviderInvoke & {
+        readonly lane: 'spawn';
+        readonly parser: 'omp-sdk-ndjson';
+        readonly ptyEligible: false;
+        readonly strictTerminal: true;
+    };
+    readonly environmentPolicy: PreparedEnvironmentPolicy;
+    readonly credentialNames: readonly string[];
+    readonly privateArtifacts: PreparedPrivateArtifacts;
+    readonly containmentRequirement: OmpSdkContainmentRequirement;
+    readonly executionIdentity: OmpSdkExecutionIdentity;
+    readonly semanticIdentity: OmpSdkSemanticIdentity;
+}
+export interface OmpSdkProcessRunnerOptions extends ProcessRunnerOptions {
+    readonly onProgress?: (frame: OmpSdkProtocolProgressFrame) => void;
+    readonly reapTimeoutMs?: number;
+}
+export interface OmpSdkProcessResult extends ProcessResult {
+    readonly terminal: OmpSdkCollectedTerminal;
+    readonly progress: readonly OmpSdkProtocolProgressFrame[];
+    readonly diagnosticStderr: string;
+    readonly cleanupAttestation: OmpSdkCleanupAttestation;
+}
+export interface OmpSdkRunningProcess {
+    readonly pid: number;
+    readonly result: Promise<OmpSdkProcessResult>;
+    cancel(): void;
+}
+export interface PrivateRuntime {
+    readonly root: string;
+    readonly requestPath: string;
+    readonly home: string;
+    readonly xdgConfig: string;
+    readonly xdgCache: string;
+    readonly xdgData: string;
+    readonly xdgState: string;
+    readonly piDirectory: string;
+}
+export declare function assertPrepared(prepared: PreparedSingleAgentProviderCommand): asserts prepared is OmpSdkPreparedInvocation;
+export declare function assertHostContainment(requirement: OmpSdkContainmentRequirement): void;
+export declare function makePrivateRuntime(artifacts: PreparedPrivateArtifacts): Promise<PrivateRuntime>;
+export declare function removePrivateRoot(runtime: PrivateRuntime): Promise<void>;
+export declare function childEnvironment(policy: PreparedEnvironmentPolicy, runtime: PrivateRuntime): NodeJS.ProcessEnv;
+//# sourceMappingURL=sdk-process-private-runtime.d.ts.map