@themoltnet/agent-daemon 0.32.1 → 0.32.2

package/dist/main.js

@@ -4454,6 +4454,875 @@ function deepFreeze(value) {
 deepFreeze(RUNTIME_PROFILE_CONTEXT_CATALOGUE);
 Object.freeze(Object.keys(RUNTIME_PROFILE_CONTEXT_CATALOGUE.recipes));
 //#endregion
+//#region ../../libs/models/src/preview-sign.ts
+function schemaRef$1(schema, id) {
+	return Unsafe(Ref$1(id));
+}
+var PreviewSignBase64UrlSchema = String$1({
+	$id: "PreviewSignBase64Url",
+	minLength: 1,
+	maxLength: 5462,
+	pattern: "^[A-Za-z0-9_-]+$"
+});
+var PreviewSignSha256Base64UrlSchema = String$1({
+	$id: "PreviewSignSha256Base64Url",
+	minLength: 43,
+	maxLength: 43,
+	pattern: "^[A-Za-z0-9_-]+$"
+});
+var PreviewSignP256DerSignatureBase64UrlSchema = String$1({
+	$id: "PreviewSignP256DerSignatureBase64Url",
+	minLength: 11,
+	maxLength: 96,
+	pattern: "^[A-Za-z0-9_-]+$"
+});
+var PreviewSignEs256PublicKeySchema = _Object_({
+	kty: Literal(2),
+	algorithm: Literal(-7),
+	curve: Literal(1),
+	x: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
+	y: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url")
+}, {
+	$id: "PreviewSignEs256PublicKey",
+	additionalProperties: false
+});
+var PreviewSignEcdhEsHkdf256PublicKeySchema = _Object_({
+	kty: Literal(2),
+	algorithm: Literal(-25),
+	curve: Literal(1),
+	x: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
+	y: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url")
+}, {
+	$id: "PreviewSignEcdhEsHkdf256PublicKey",
+	additionalProperties: false
+});
+var PreviewSignEsp256PublicKeySchema = _Object_({
+	kty: Literal(2),
+	algorithm: Literal(-9),
+	curve: Literal(1),
+	x: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
+	y: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url")
+}, {
+	$id: "PreviewSignEsp256PublicKey",
+	additionalProperties: false
+});
+var PreviewSignArkgSeedPublicKeySchema = _Object_({
+	kty: Literal(-65537),
+	algorithm: Literal(-65700),
+	derivedAlgorithm: Literal(-9),
+	blindingKey: schemaRef$1(PreviewSignEs256PublicKeySchema, "PreviewSignEs256PublicKey"),
+	kemKey: schemaRef$1(PreviewSignEcdhEsHkdf256PublicKeySchema, "PreviewSignEcdhEsHkdf256PublicKey")
+}, {
+	$id: "PreviewSignArkgSeedPublicKey",
+	additionalProperties: false
+});
+var PreviewSignPublicMaterialSchema = _Object_({
+	version: Literal(1),
+	outerCredentialId: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
+	outerPublicKey: schemaRef$1(PreviewSignEs256PublicKeySchema, "PreviewSignEs256PublicKey"),
+	previewKeyHandle: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
+	seedPublicKey: schemaRef$1(PreviewSignArkgSeedPublicKeySchema, "PreviewSignArkgSeedPublicKey")
+}, {
+	$id: "PreviewSignPublicMaterial",
+	additionalProperties: false
+});
+var PreviewSignChallengeSchema = _Object_({
+	verificationMethod: Literal("human-hardware-previewsign"),
+	version: Literal(1),
+	envelope: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
+	digest: schemaRef$1(PreviewSignSha256Base64UrlSchema, "PreviewSignSha256Base64Url"),
+	additionalArguments: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
+	outerCredentialId: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url"),
+	outerPublicKey: schemaRef$1(PreviewSignEs256PublicKeySchema, "PreviewSignEs256PublicKey"),
+	previewKeyHandle: schemaRef$1(PreviewSignBase64UrlSchema, "PreviewSignBase64Url")
+}, {
+	$id: "PreviewSignChallenge",
+	additionalProperties: false
+});
+var PreviewSignChallengeValueSchema = _Object_({
+	verificationMethod: Literal("human-hardware-previewsign"),
+	value: schemaRef$1(PreviewSignChallengeSchema, "PreviewSignChallenge")
+}, {
+	$id: "PreviewSignChallengeValue",
+	additionalProperties: false
+});
+var PreviewSignChallengeOperationSchema = Union([Literal("credential-registration"), Literal("signing-request")], { $id: "PreviewSignChallengeOperation" });
+var PreviewSignReceiptSchema = _Object_({
+	version: Literal(1),
+	signature: schemaRef$1(PreviewSignP256DerSignatureBase64UrlSchema, "PreviewSignP256DerSignatureBase64Url")
+}, {
+	$id: "PreviewSignReceipt",
+	additionalProperties: false
+});
+var PreviewSignReceiptValueSchema = _Object_({
+	verificationMethod: Literal("human-hardware-previewsign"),
+	value: schemaRef$1(PreviewSignReceiptSchema, "PreviewSignReceipt")
+}, {
+	$id: "PreviewSignReceiptValue",
+	additionalProperties: false
+});
+var previewSignSchemaContext = {
+	PreviewSignBase64Url: PreviewSignBase64UrlSchema,
+	PreviewSignSha256Base64Url: PreviewSignSha256Base64UrlSchema,
+	PreviewSignP256DerSignatureBase64Url: PreviewSignP256DerSignatureBase64UrlSchema,
+	PreviewSignEs256PublicKey: PreviewSignEs256PublicKeySchema,
+	PreviewSignEcdhEsHkdf256PublicKey: PreviewSignEcdhEsHkdf256PublicKeySchema,
+	PreviewSignEsp256PublicKey: PreviewSignEsp256PublicKeySchema,
+	PreviewSignArkgSeedPublicKey: PreviewSignArkgSeedPublicKeySchema,
+	PreviewSignPublicMaterial: PreviewSignPublicMaterialSchema,
+	PreviewSignChallenge: PreviewSignChallengeSchema,
+	PreviewSignChallengeValue: PreviewSignChallengeValueSchema,
+	PreviewSignChallengeOperation: PreviewSignChallengeOperationSchema,
+	PreviewSignReceipt: PreviewSignReceiptSchema,
+	PreviewSignReceiptValue: PreviewSignReceiptValueSchema
+};
+//#endregion
+//#region ../../libs/models/src/verification-method.ts
+/**
+* Persisted and wire-level signing verification method identifiers.
+*
+* This vocabulary is append-only. Never rename, remove, or change an existing
+* value: PostgreSQL rows, workflow inputs, and API clients persist these exact
+* strings. Future signing methods must add a new property and value.
+*/
+var VERIFICATION_METHOD = {
+	AgentEd25519: "agent-ed25519",
+	HumanHardwarePreviewSign: "human-hardware-previewsign"
+};
+VERIFICATION_METHOD.AgentEd25519, VERIFICATION_METHOD.HumanHardwarePreviewSign;
+//#endregion
+//#region ../../libs/models/src/schemas.ts
+var UuidSchema = String$1({
+	format: "uuid",
+	description: "UUID v4 identifier"
+});
+var TimestampSchema = String$1({
+	format: "date-time",
+	description: "ISO 8601 timestamp"
+});
+Union([Literal(VERIFICATION_METHOD.AgentEd25519), Literal(VERIFICATION_METHOD.HumanHardwarePreviewSign)], { description: "Stable signing verification method identifier" });
+Union([
+	Literal("private"),
+	Literal("moltnet"),
+	Literal("public")
+], { description: "Entry visibility level" });
+var ENTRY_TYPE_VALUES = [
+	"episodic",
+	"semantic",
+	"procedural",
+	"reflection"
+];
+var EntryTypeSchema = Union([
+	Literal("episodic"),
+	Literal("semantic"),
+	Literal("procedural"),
+	Literal("reflection")
+], { description: "Entry memory type" });
+/** Regex fragment matching a single entry type value. */
+var ENTRY_TYPE_PATTERN = `(${ENTRY_TYPE_VALUES.join("|")})`;
+`${ENTRY_TYPE_PATTERN}${ENTRY_TYPE_PATTERN}`, ENTRY_TYPE_VALUES.length - 1;
+var PublicKeySchema = String$1({
+	pattern: "^ed25519:[A-Za-z0-9+/=]+$",
+	description: "Ed25519 public key with prefix"
+});
+var FingerprintSchema = String$1({
+	pattern: "^[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}-[A-Fa-f0-9]{4}$",
+	description: "Key fingerprint (A1B2-C3D4-E5F6-G7H8)"
+});
+_Object_({
+	title: Optional(String$1({ maxLength: 255 })),
+	content: String$1({
+		minLength: 1,
+		maxLength: 1e5
+	}),
+	tags: Optional(_Array_(String$1({ maxLength: 128 }), { maxItems: 20 }))
+});
+_Object_({
+	title: Optional(String$1({ maxLength: 255 })),
+	content: Optional(String$1({
+		minLength: 1,
+		maxLength: 1e5
+	})),
+	tags: Optional(_Array_(String$1({ maxLength: 128 }), { maxItems: 20 }))
+});
+_Object_({
+	query: Optional(String$1({
+		minLength: 1,
+		maxLength: 500
+	})),
+	tags: Optional(_Array_(String$1({ maxLength: 128 }), {
+		minItems: 1,
+		maxItems: 20,
+		description: "Filter: entry must have ALL specified tags"
+	})),
+	limit: Optional(Number$1({
+		minimum: 1,
+		maximum: 100,
+		default: 20
+	})),
+	offset: Optional(Number$1({
+		minimum: 0,
+		default: 0
+	}))
+});
+_Object_({
+	identityId: UuidSchema,
+	publicKey: PublicKeySchema,
+	fingerprint: FingerprintSchema,
+	createdAt: TimestampSchema
+});
+_Object_({
+	publicKey: PublicKeySchema,
+	fingerprint: FingerprintSchema
+});
+_Object_({ message: String$1({
+	minLength: 1,
+	maxLength: 1e4
+}) });
+_Object_({
+	message: String$1(),
+	signature: String$1({ description: "Base64 encoded Ed25519 signature" }),
+	publicKey: PublicKeySchema
+});
+_Object_({
+	message: String$1({
+		minLength: 1,
+		maxLength: 1e4
+	}),
+	signature: String$1({ description: "Base64 encoded signature" }),
+	publicKey: PublicKeySchema
+});
+_Object_({
+	valid: Boolean$1(),
+	signer: Optional(_Object_({ fingerprint: FingerprintSchema }))
+});
+var BaseAuthContextSchema = _Object_({
+	identityId: UuidSchema,
+	scopes: _Array_(String$1()),
+	subjectType: Union([Literal("agent"), Literal("human")]),
+	currentTeamId: Union([UuidSchema, Null()])
+});
+Union([Intersect([BaseAuthContextSchema, _Object_({
+	subjectType: Literal("agent"),
+	publicKey: PublicKeySchema,
+	fingerprint: FingerprintSchema,
+	clientId: String$1()
+})]), Intersect([BaseAuthContextSchema, _Object_({
+	subjectType: Literal("human"),
+	clientId: Union([String$1(), Null()])
+})])]);
+_Object_({
+	success: Boolean$1(),
+	message: Optional(String$1())
+});
+_Object_({ diaryId: UuidSchema });
+_Object_({
+	diaryId: UuidSchema,
+	entryId: UuidSchema
+});
+_Object_({ entryId: UuidSchema });
+_Object_({ id: UuidSchema });
+_Object_({
+	publicKey: PublicKeySchema,
+	fingerprint: FingerprintSchema,
+	agentName: String$1({
+		minLength: 1,
+		maxLength: 34
+	}),
+	org: Optional(String$1({
+		minLength: 1,
+		maxLength: 39,
+		pattern: "^[a-zA-Z0-9-]+$",
+		description: "GitHub organization name. When provided, the GitHub App will be created under this org instead of the personal account."
+	}))
+});
+_Object_({
+	workflowId: String$1(),
+	manifestFormUrl: String$1()
+});
+_Object_({
+	status: Union([
+		Literal("awaiting_github"),
+		Literal("github_code_ready"),
+		Literal("awaiting_installation"),
+		Literal("completed"),
+		Literal("failed")
+	]),
+	githubCode: Optional(String$1()),
+	identityId: Optional(String$1()),
+	clientId: Optional(String$1()),
+	clientSecret: Optional(String$1()),
+	installationId: Optional(String$1())
+});
+_Object_({
+	wf: String$1({
+		minLength: 1,
+		description: "Workflow ID baked into setup_url"
+	}),
+	installation_id: String$1({ minLength: 1 }),
+	setup_action: Optional(String$1())
+});
+_Object_({ id: UuidSchema });
+_Object_({
+	id: UuidSchema,
+	subjectId: UuidSchema
+});
+_Object_({
+	id: UuidSchema,
+	inviteId: UuidSchema
+});
+_Object_({ name: String$1({
+	minLength: 1,
+	maxLength: 255
+}) });
+_Object_({
+	role: Optional(Union([Literal("manager"), Literal("member")])),
+	maxUses: Optional(Integer({
+		minimum: 1,
+		default: 1
+	})),
+	expiresInHours: Optional(Integer({
+		minimum: 1,
+		maximum: 720,
+		default: 168
+	}))
+});
+_Object_({ code: String$1({ minLength: 1 }) });
+_Object_({ role: Union([Literal("manager"), Literal("member")]) });
+var TeamRoleSchema = Union([
+	Literal("owner"),
+	Literal("manager"),
+	Literal("member")
+]);
+_Object_({
+	id: UuidSchema,
+	name: String$1()
+});
+var DateTimeUnsafe = Unsafe(String$1({ format: "date-time" }));
+_Object_({
+	id: UuidSchema,
+	code: String$1(),
+	role: Union([Literal("manager"), Literal("member")]),
+	maxUses: Integer(),
+	useCount: Integer(),
+	expiresAt: DateTimeUnsafe,
+	createdAt: DateTimeUnsafe
+});
+var TeamMemberSchema = _Object_({
+	subjectId: UuidSchema,
+	subjectType: Union([Literal("agent"), Literal("human")]),
+	role: TeamRoleSchema,
+	displayName: String$1(),
+	fingerprint: Optional(String$1()),
+	email: Optional(String$1())
+});
+_Object_({
+	id: UuidSchema,
+	name: String$1(),
+	personal: Boolean$1(),
+	status: String$1(),
+	role: TeamRoleSchema
+});
+_Object_({
+	id: UuidSchema,
+	name: String$1(),
+	status: String$1(),
+	personal: Boolean$1(),
+	createdAt: DateTimeUnsafe,
+	updatedAt: DateTimeUnsafe,
+	members: _Array_(TeamMemberSchema)
+});
+_Object_({
+	teamId: UuidSchema,
+	role: Union([Literal("manager"), Literal("member")])
+});
+_Object_({
+	updated: Boolean$1(),
+	role: Union([Literal("manager"), Literal("member")])
+});
+_Object_({ deleted: Boolean$1() });
+_Object_({ removed: Boolean$1() });
+var FoundingMemberSchema = _Object_({
+	subjectId: UuidSchema,
+	subjectNs: Union([Literal("Agent"), Literal("Human")]),
+	role: Union([
+		Literal("owner"),
+		Literal("manager"),
+		Literal("member")
+	])
+});
+_Object_({
+	name: String$1({
+		minLength: 1,
+		maxLength: 255
+	}),
+	foundingMembers: Optional(_Array_(FoundingMemberSchema, { minItems: 1 }))
+});
+_Object_({
+	id: UuidSchema,
+	name: String$1(),
+	status: String$1(),
+	workflowId: Optional(String$1())
+});
+_Object_({});
+_Object_({
+	accepted: Boolean$1(),
+	teamStatus: String$1()
+});
+_Object_({ destinationTeamId: UuidSchema });
+_Object_({ transferId: UuidSchema });
+_Object_({ items: _Array_(_Object_({
+	id: UuidSchema,
+	diaryId: UuidSchema,
+	sourceTeamId: UuidSchema,
+	destinationTeamId: UuidSchema,
+	status: String$1(),
+	initiatedBy: UuidSchema,
+	expiresAt: Unsafe(String$1({ format: "date-time" })),
+	createdAt: Unsafe(String$1({ format: "date-time" }))
+})) });
+_Object_({ groupId: UuidSchema });
+_Object_({
+	groupId: UuidSchema,
+	subjectId: UuidSchema
+});
+_Object_({ name: String$1({
+	minLength: 1,
+	maxLength: 255
+}) });
+_Object_({
+	subjectId: UuidSchema,
+	subjectNs: Optional(Union([Literal("Agent"), Literal("Human")]))
+});
+_Object_({
+	id: UuidSchema,
+	name: String$1(),
+	teamId: UuidSchema
+});
+var GroupMemberResponseSchema = _Object_({
+	subjectId: UuidSchema,
+	subjectNs: String$1()
+});
+_Object_({
+	id: UuidSchema,
+	name: String$1(),
+	teamId: UuidSchema,
+	createdAt: DateTimeUnsafe,
+	members: _Array_(GroupMemberResponseSchema)
+});
+var DiaryGrantRoleSchema = Union([Literal("writer"), Literal("manager")]);
+var GrantSubjectNsSchema = Union([
+	Literal("Agent"),
+	Literal("Human"),
+	Literal("Group")
+]);
+_Object_({
+	subjectId: UuidSchema,
+	subjectNs: GrantSubjectNsSchema,
+	role: DiaryGrantRoleSchema
+});
+_Object_({
+	subjectId: UuidSchema,
+	subjectNs: GrantSubjectNsSchema,
+	role: DiaryGrantRoleSchema
+});
+_Object_({ grants: _Array_(_Object_({
+	subjectId: UuidSchema,
+	subjectNs: GrantSubjectNsSchema,
+	role: DiaryGrantRoleSchema
+})) });
+_Object_({ revoked: Boolean$1() });
+_Object_({ "x-moltnet-team-id": String$1({
+	format: "uuid",
+	description: "Team ID (UUID) that will own the resource. Required."
+}) });
+_Object_({ "x-moltnet-team-id": Optional(String$1({
+	format: "uuid",
+	description: "Team ID (UUID) for scoping the request. Optional."
+})) });
+_Object_({
+	kind: Literal("agent"),
+	identityId: UuidSchema,
+	fingerprint: FingerprintSchema,
+	publicKey: PublicKeySchema
+}, {
+	$id: "AgentPrincipal",
+	additionalProperties: false
+});
+_Object_({
+	kind: Literal("human"),
+	humanId: UuidSchema,
+	identityId: Union([UuidSchema, Null()])
+}, {
+	$id: "HumanPrincipal",
+	additionalProperties: false
+});
+var principalUnionVariants = [_Object_({
+	kind: Literal("agent"),
+	identityId: UuidSchema,
+	fingerprint: FingerprintSchema,
+	publicKey: PublicKeySchema
+}, { additionalProperties: false }), _Object_({
+	kind: Literal("human"),
+	humanId: UuidSchema,
+	identityId: Union([UuidSchema, Null()])
+}, { additionalProperties: false })];
+Union(principalUnionVariants, {
+	$id: "PrincipalIdentity",
+	discriminator: { propertyName: "kind" }
+});
+/**
+* `$id`-less twin of `PrincipalIdentitySchema`. Required anywhere the
+* schema is **embedded** inline into another schema (MCP `outputSchema`
+* — every tool that returns a creator-bearing object embeds its own
+* copy; provenance-graph node `meta.creator`, etc.). Ajv 8 throws
+* `reference "PrincipalIdentity" resolves to more than one schema` if
+* the same `$id` appears twice in the same compilation pass, which is
+* exactly what happens when the MCP server lists tools and Ajv
+* traverses every advertised `outputSchema`.
+*
+* Structurally identical to `PrincipalIdentitySchema` (they share the
+* variants array); change one, change both.
+*/
+var PrincipalIdentitySchemaInline = Union(principalUnionVariants, { discriminator: { propertyName: "kind" } });
+//#endregion
+//#region ../../libs/models/src/problem-details.ts
+var ProblemCodeSchema = Union([
+	Literal("UNAUTHORIZED"),
+	Literal("FORBIDDEN"),
+	Literal("NOT_FOUND"),
+	Literal("CONFLICT"),
+	Literal("UNSUPPORTED_MEDIA_TYPE"),
+	Literal("VALIDATION_FAILED"),
+	Literal("INVALID_CHALLENGE"),
+	Literal("INVALID_SIGNATURE"),
+	Literal("VOUCHER_LIMIT"),
+	Literal("RATE_LIMIT_EXCEEDED"),
+	Literal("SERIALIZATION_EXHAUSTED"),
+	Literal("SIGNING_REQUEST_EXPIRED"),
+	Literal("SIGNING_REQUEST_ALREADY_COMPLETED"),
+	Literal("SIGNING_REQUEST_LIMIT_REACHED"),
+	Literal("REGISTRATION_FAILED"),
+	Literal("UPSTREAM_ERROR"),
+	Literal("SERVICE_UNAVAILABLE"),
+	Literal("INTERNAL_SERVER_ERROR"),
+	Literal("TEAM_PERSONAL_IMMUTABLE"),
+	Literal("TEAM_NOT_ACTIVE"),
+	Literal("INVITE_EXPIRED"),
+	Literal("INVITE_EXHAUSTED"),
+	Literal("TEAM_LAST_OWNER"),
+	Literal("TEAM_ALREADY_ACTIVE"),
+	Literal("TEAM_NOT_FOUNDING"),
+	Literal("FOUNDING_ALREADY_ACCEPTED"),
+	Literal("DIARY_TRANSFER_PENDING"),
+	Literal("DIARY_TRANSFER_NOT_FOUND"),
+	Literal("DIARY_TRANSFER_ALREADY_RESOLVED")
+]);
+var ProblemDetailsSchema = _Object_({
+	type: String$1({ format: "uri" }),
+	title: String$1(),
+	status: Integer({
+		minimum: 100,
+		maximum: 599
+	}),
+	code: ProblemCodeSchema,
+	detail: Optional(String$1()),
+	instance: Optional(String$1())
+}, {
+	$id: "ProblemDetails",
+	additionalProperties: true
+});
+_Object_({
+	field: String$1(),
+	message: String$1(),
+	code: Optional(String$1())
+}, {
+	$id: "ValidationError",
+	additionalProperties: false
+});
+_Object_({
+	resource: String$1(),
+	id: Optional(String$1({ format: "uuid" })),
+	keys: Optional(Record(String$1(), String$1()))
+}, {
+	$id: "ConflictTarget",
+	additionalProperties: false
+});
+_Object_({
+	constraint: Optional(String$1()),
+	target: Optional(Ref$1("ConflictTarget"))
+}, {
+	$id: "ConflictError",
+	additionalProperties: false
+});
+var ConflictProblemDetailsSchema = Intersect([ProblemDetailsSchema, _Object_({ conflict: Ref$1("ConflictError") })], { $id: "ConflictProblemDetails" });
+_Object_({
+	type: String$1(),
+	severity: Number$1(),
+	match: String$1()
+}, {
+	$id: "InjectionThreat",
+	additionalProperties: false
+});
+Intersect([ConflictProblemDetailsSchema, _Object_({ flagged: Optional(_Array_(_Object_({
+	id: String$1({ format: "uuid" }),
+	threats: _Array_(Ref$1("InjectionThreat"))
+}, { additionalProperties: false }))) })], { $id: "InjectionConflictProblemDetails" });
+Intersect([ProblemDetailsSchema, _Object_({ errors: _Array_(Ref$1("ValidationError")) })], { $id: "ValidationProblemDetails" });
+Union([
+	Literal("pack"),
+	Literal("entry"),
+	Literal("rendered_pack")
+]);
+var ProvenanceGraphEdgeKindSchema = Union([
+	Literal("includes"),
+	Literal("supersedes"),
+	Literal("rendered_from")
+]);
+var ProvenanceGraphPackMetaSchema = _Object_({
+	packId: UuidSchema,
+	diaryId: UuidSchema,
+	packCid: String$1(),
+	packType: String$1(),
+	packCodec: String$1(),
+	pinned: Boolean$1(),
+	createdAt: TimestampSchema,
+	expiresAt: Union([TimestampSchema, Null()]),
+	supersedesPackId: Union([UuidSchema, Null()])
+});
+/**
+* Discriminated creator embedded inside provenance-node response
+* payloads. Re-uses the shared `PrincipalIdentitySchemaInline` (the
+* `$id`-less twin) — embedding the named `PrincipalIdentitySchema`
+* here would clash with the top-level registration via @fastify/swagger
+* (`reference "PrincipalIdentity" resolves to more than one schema`).
+*/
+var ProvenanceGraphCreatorSchema = PrincipalIdentitySchemaInline;
+var ProvenanceGraphEntryMetaSchema = _Object_({
+	entryId: UuidSchema,
+	diaryId: UuidSchema,
+	entryType: EntryTypeSchema,
+	contentHash: Union([String$1(), Null()]),
+	createdAt: TimestampSchema,
+	updatedAt: TimestampSchema,
+	signed: Boolean$1(),
+	title: Union([String$1(), Null()]),
+	tags: _Array_(String$1()),
+	creator: Optional(ProvenanceGraphCreatorSchema)
+});
+var ProvenanceGraphPackNodeSchema = _Object_({
+	id: String$1(),
+	kind: Literal("pack"),
+	label: String$1(),
+	cid: Union([String$1(), Null()]),
+	meta: Intersect([ProvenanceGraphPackMetaSchema, _Object_({ creator: Optional(ProvenanceGraphCreatorSchema) })])
+});
+var ProvenanceGraphEntryNodeSchema = _Object_({
+	id: String$1(),
+	kind: Literal("entry"),
+	label: String$1(),
+	cid: Union([String$1(), Null()]),
+	meta: ProvenanceGraphEntryMetaSchema
+});
+var ProvenanceGraphRenderedPackMetaSchema = _Object_({
+	renderedPackId: UuidSchema,
+	sourcePackId: UuidSchema,
+	diaryId: UuidSchema,
+	packCid: String$1(),
+	renderMethod: String$1(),
+	totalTokens: Number$1(),
+	pinned: Boolean$1(),
+	createdAt: TimestampSchema,
+	expiresAt: Union([TimestampSchema, Null()]),
+	creator: Optional(ProvenanceGraphCreatorSchema)
+});
+var ProvenanceGraphNodeSchema = Union([
+	ProvenanceGraphPackNodeSchema,
+	ProvenanceGraphEntryNodeSchema,
+	_Object_({
+		id: String$1(),
+		kind: Literal("rendered_pack"),
+		label: String$1(),
+		cid: Union([String$1(), Null()]),
+		meta: ProvenanceGraphRenderedPackMetaSchema
+	})
+]);
+var ProvenanceGraphEdgeSchema = _Object_({
+	id: String$1(),
+	from: String$1(),
+	to: String$1(),
+	kind: ProvenanceGraphEdgeKindSchema,
+	label: Optional(String$1()),
+	meta: Optional(Record(String$1(), Union([
+		String$1(),
+		Number$1(),
+		Boolean$1(),
+		Null()
+	])))
+});
+_Object_({
+	metadata: _Object_({
+		format: Literal("moltnet.provenance-graph/v1"),
+		generatedAt: TimestampSchema,
+		rootNodeId: String$1(),
+		rootPackId: UuidSchema,
+		depth: Number$1({ minimum: 0 })
+	}),
+	nodes: _Array_(ProvenanceGraphNodeSchema),
+	edges: _Array_(ProvenanceGraphEdgeSchema)
+}, { $id: "ProvenanceGraph" });
+//#endregion
+//#region ../../libs/models/src/signer-constraint.ts
+var SIGNER_CONSTRAINT_TYPE = {
+	Human: "human",
+	TeamRole: "team-role",
+	Group: "group"
+};
+Union([
+	_Object_({
+		type: Literal(SIGNER_CONSTRAINT_TYPE.Human),
+		id: String$1({ format: "uuid" })
+	}),
+	_Object_({
+		type: Literal(SIGNER_CONSTRAINT_TYPE.TeamRole),
+		id: TeamRoleSchema
+	}),
+	_Object_({
+		type: Literal(SIGNER_CONSTRAINT_TYPE.Group),
+		id: String$1({ format: "uuid" })
+	})
+]);
+//#endregion
+//#region ../../libs/models/src/signer-protocol.ts
+function schemaRef(schema) {
+	return Ref$1(schemaId(schema));
+}
+function schemaId(schema) {
+	const id = schema.$id;
+	if (typeof id !== "string" || id.length === 0) throw new Error("Signer protocol schemas must have an identifier");
+	return id;
+}
+var SignerBase64UrlSchema = PreviewSignBase64UrlSchema;
+var SignerUuidSchema = String$1({
+	$id: "SignerUuid",
+	pattern: "^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
+});
+var SignerOperationSchema = Union([
+	Literal("credential-enrollment"),
+	Literal("credential-registration"),
+	Literal("signing-request")
+], { $id: "SignerOperation" });
+var SignerChallengeOperationSchema = PreviewSignChallengeOperationSchema;
+var SignerPreviewSignPublicMaterialSchema = PreviewSignPublicMaterialSchema;
+var SignerPreviewSignChallengeValueSchema = PreviewSignChallengeValueSchema;
+var SignerProblemSchema = _Object_({
+	code: String$1({ minLength: 1 }),
+	message: String$1({ minLength: 1 })
+}, {
+	$id: "SignerProblem",
+	additionalProperties: false
+});
+var SignerCeremonyParamsSchema = _Object_({ ceremonyId: Unsafe(schemaRef(SignerBase64UrlSchema)) }, {
+	$id: "SignerCeremonyParams",
+	additionalProperties: false
+});
+var SignerSessionSchema = _Object_({
+	version: Literal(1),
+	token: Unsafe(schemaRef(SignerBase64UrlSchema)),
+	expiresAt: String$1()
+}, {
+	$id: "SignerSession",
+	additionalProperties: false
+});
+var SignerEnrollmentCeremonyRequestSchema = _Object_({
+	version: Literal(1),
+	operation: Literal("credential-enrollment"),
+	label: String$1({
+		minLength: 1,
+		maxLength: 255
+	}),
+	teamId: Unsafe(schemaRef(SignerUuidSchema))
+}, {
+	$id: "SignerEnrollmentCeremonyRequest",
+	additionalProperties: false
+});
+var SignerChallengeCeremonyRequestSchema = _Object_({
+	version: Literal(1),
+	operation: Unsafe(schemaRef(SignerChallengeOperationSchema)),
+	resourceId: Unsafe(schemaRef(SignerUuidSchema)),
+	challenge: Unsafe(schemaRef(SignerPreviewSignChallengeValueSchema))
+}, {
+	$id: "SignerChallengeCeremonyRequest",
+	additionalProperties: false
+});
+var SignerCeremonyRequestSchema = Union([Unsafe(schemaRef(SignerEnrollmentCeremonyRequestSchema)), Unsafe(schemaRef(SignerChallengeCeremonyRequestSchema))], { $id: "SignerCeremonyRequest" });
+var SignerCeremonySchema = _Object_({
+	version: Literal(1),
+	id: Unsafe(schemaRef(SignerBase64UrlSchema)),
+	operation: Unsafe(schemaRef(SignerOperationSchema)),
+	approvalUrl: String$1(),
+	expiresAt: String$1()
+}, {
+	$id: "SignerCeremony",
+	additionalProperties: false
+});
+var SignerPendingResultSchema = _Object_({
+	version: Literal(1),
+	status: Literal("pending"),
+	operation: Unsafe(schemaRef(SignerOperationSchema))
+}, {
+	$id: "SignerPendingResult",
+	additionalProperties: false
+});
+var SignerEnrollmentResultSchema = _Object_({
+	version: Literal(1),
+	status: Literal("completed"),
+	operation: Literal("credential-enrollment"),
+	publicMaterial: Unsafe(schemaRef(SignerPreviewSignPublicMaterialSchema))
+}, {
+	$id: "SignerEnrollmentResult",
+	additionalProperties: false
+});
+var SignerReceiptSchema = PreviewSignReceiptValueSchema;
+var SignerSignatureResultSchema = _Object_({
+	version: Literal(1),
+	status: Literal("completed"),
+	operation: Unsafe(schemaRef(SignerChallengeOperationSchema)),
+	receipt: Unsafe(schemaRef(SignerReceiptSchema))
+}, {
+	$id: "SignerSignatureResult",
+	additionalProperties: false
+});
+var SignerFailedResultSchema = _Object_({
+	version: Literal(1),
+	status: Literal("failed"),
+	operation: Unsafe(schemaRef(SignerOperationSchema)),
+	code: String$1(),
+	message: String$1()
+}, {
+	$id: "SignerFailedResult",
+	additionalProperties: false
+});
+var SignerCeremonyResultSchema = Union([
+	Unsafe(schemaRef(SignerPendingResultSchema)),
+	Unsafe(schemaRef(SignerEnrollmentResultSchema)),
+	Unsafe(schemaRef(SignerSignatureResultSchema)),
+	Unsafe(schemaRef(SignerFailedResultSchema))
+], { $id: "SignerCeremonyResult" });
+({ ...previewSignSchemaContext }), schemaId(SignerUuidSchema), schemaId(SignerOperationSchema), schemaId(SignerProblemSchema), schemaId(SignerCeremonyParamsSchema), schemaId(SignerSessionSchema), schemaId(SignerEnrollmentCeremonyRequestSchema), schemaId(SignerChallengeCeremonyRequestSchema), schemaId(SignerCeremonyRequestSchema), schemaId(SignerCeremonySchema), schemaId(SignerPendingResultSchema), schemaId(SignerEnrollmentResultSchema), schemaId(SignerSignatureResultSchema), schemaId(SignerFailedResultSchema), schemaId(SignerCeremonyResultSchema);
+//#endregion
+//#region ../../libs/models/src/tool-enforcement.ts
+var TOOL_ENFORCEMENT_VALUES = [
+	"off",
+	"watch",
+	"enforce"
+];
+var ToolEnforcementSchema = Union([
+	Literal(TOOL_ENFORCEMENT_VALUES[0]),
+	Literal(TOOL_ENFORCEMENT_VALUES[1]),
+	Literal(TOOL_ENFORCEMENT_VALUES[2])
+], { description: "Runtime tool-policy enforcement mode: off (inert), watch (audit only), enforce (block disallowed tools, fail-closed)." });
+//#endregion
 //#region ../../libs/tasks/src/runtime-profiles.ts
 var RuntimeProfileName = String$1({
 	minLength: 1,
@@ -4480,11 +5349,7 @@ var RuntimeProfileWorkspaceMode = Union([
 * `off` (inert), `watch` (audit only), `enforce` (block disallowed tools,
 * fail-closed). Read by the daemon via `GET /runtime-profiles/:id/allowed-tools`.
 */
-var RuntimeProfileToolEnforcement = Union([
-	Literal("off"),
-	Literal("watch"),
-	Literal("enforce")
-]);
+var RuntimeProfileToolEnforcement = ToolEnforcementSchema;
 var RuntimeProfileAllowedWorkspaceModes = _Array_(RuntimeProfileWorkspaceMode, {
 	minItems: 1,
 	maxItems: 3,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@themoltnet/agent-daemon",
-  "version": "0.32.1",
+  "version": "0.32.2",
   "license": "AGPL-3.0-only",
   "type": "module",
   "description": "MoltNet agent daemon — claims and executes tasks (fulfill_brief, assess_brief) from the MoltNet task-service via Pi-headless. CLI: moltnet-agent.",
@@ -51,19 +51,19 @@
     "@opentelemetry/semantic-conventions": "^1.39.0",
     "pino": "^10.3.1",
     "pino-pretty": "^13.1.3",
-    "@themoltnet/agent-runtime": "0.36.6",
     "@themoltnet/sdk": "0.127.0",
-    "@themoltnet/pi-extension": "0.36.1"
+    "@themoltnet/agent-runtime": "0.36.6",
+    "@themoltnet/pi-extension": "0.36.2"
   },
   "devDependencies": {
     "tsx": "^4.7.0",
     "typescript": "~5.9.2",
     "vite": "^8.0.0",
     "vitest": "^3.0.0",
-    "@moltnet/bootstrap": "0.1.0",
     "@moltnet/crypto-service": "0.1.0",
-    "@moltnet/tasks": "0.1.0",
-    "@moltnet/observability": "0.1.0"
+    "@moltnet/bootstrap": "0.1.0",
+    "@moltnet/observability": "0.1.0",
+    "@moltnet/tasks": "0.1.0"
   },
   "nx": {
     "projectType": "application",