@wildo-ai/saas-models 1.1.1 → 1.1.3

package/dist/esm/flows-actors/mcp-servers.shared.schemas.js

@@ -0,0 +1,142 @@
+import { z } from 'zod';
+//===============================================================
+//  MCP SERVERS — what an agent's `mcpRefs` resolve AGAINST
+//===============================================================
+/**
+ * An MCP server an application permits its agents to reach.
+ *
+ * ## Why this exists (#491)
+ *
+ * `capabilities.tools.mcpRefs` was declared on the agent model, populated by a shipped catalog, and
+ * rendered on the agent card — while nothing resolved a ref into a callable tool. The refs in that
+ * catalog (`filesystem-mcp`, `git-mcp`, `browser-mcp`, `mongodb-mcp`, …) named no server anywhere;
+ * they were authored against a field nothing read, so an agent card told a person the agent had a
+ * reach it did not have.
+ *
+ * A ref must map to a transport, an endpoint and a credential. `functionRefs` have
+ * `getFunctionTool`; these had no equivalent, so there was nothing to resolve against. This is that
+ * equivalent, and it is what makes an `mcpRef` checkable.
+ *
+ * ## Why the APPLICATION declares it
+ *
+ * Decided 2026-09-09. An MCP tool call leaves the application's trust boundary and reaches a server
+ * whose authorization is its own, so which third parties an application's agents may reach is the
+ * application's decision — the same shape in which it already declares providers and capabilities.
+ * Rejected: sourcing servers from the vendor provider catalogue (it describes REST operations, not
+ * MCP endpoints, and would couple this to the provider architecture), and a platform-curated set an
+ * application opts into (it makes the framework the gatekeeper of every application's third-party
+ * reach, and needs a curation process that does not exist).
+ *
+ * This does not contradict the standing position that MCP is not an application's integration
+ * runtime: an application calls a third-party API DIRECTLY, with typed operations. MCP is for the
+ * case where an LLM agent sits between the application and the external system, which is exactly
+ * what an agent's tool call is.
+ */
+/**
+ * How the runtime reaches the server.
+ *
+ * A closed vocabulary rather than a free string: the transport decides the whole connection
+ * lifecycle — how a session opens, whether the server can push, how a stream ends — so a value
+ * nobody implemented must be unrepresentable rather than discovered at the first call.
+ *
+ * STDIO is deliberately ABSENT. It launches a local subprocess, which is the coding-agent lane's
+ * shape and not an application's: a generated application runs in a container it does not control,
+ * and "the agent may spawn a process" is a different security decision from "the agent may call an
+ * endpoint". Adding it later is a decision, not an omission.
+ */
+export var FlowsActors_McpTransport;
+(function (FlowsActors_McpTransport) {
+    /** Streamable HTTP — the current MCP transport for remote servers. */
+    FlowsActors_McpTransport["HTTP_STREAM"] = "http_stream";
+    /** Server-sent events — the earlier remote transport, still widely deployed. */
+    FlowsActors_McpTransport["SSE"] = "sse";
+})(FlowsActors_McpTransport || (FlowsActors_McpTransport = {}));
+/**
+ * WHOSE credential the call carries.
+ *
+ * The distinction is not a preference. A tool call that reaches a third party on a user's behalf
+ * should be attributable to that user AT THE FAR END — that is what makes it revocable there and
+ * auditable by the party being called. An application-wide service identity loses that: every
+ * user's call looks identical to the server, and one leaked credential exposes every tenant.
+ */
+export var FlowsActors_McpCredentialSubject;
+(function (FlowsActors_McpCredentialSubject) {
+    /**
+     * The acting user's own delegated credential, falling back to the organization's connection when
+     * the user has none. The default, and the reason a fallback exists at all: an agent acting for a
+     * user who has never connected the server would otherwise have no path, which would make every
+     * unattended and batch turn impossible.
+     */
+    FlowsActors_McpCredentialSubject["USER_THEN_ORGANIZATION"] = "user_then_organization";
+    /** The organization's connection only — for a server the tenant connects once on everyone's behalf. */
+    FlowsActors_McpCredentialSubject["ORGANIZATION"] = "organization";
+    /** The acting user's own credential only. No fallback: a user who has not connected cannot call. */
+    FlowsActors_McpCredentialSubject["USER"] = "user";
+})(FlowsActors_McpCredentialSubject || (FlowsActors_McpCredentialSubject = {}));
+/**
+ * Which stored credential authorizes the call.
+ *
+ * `providerRef` names a provider the application has already connected, so the credential comes from
+ * `organizationProviderCredentials` / `userProviderCredentials` rather than from a store invented
+ * for MCP. Those exist, carry per-tenant isolation by construction, and already have the connect and
+ * consent flow in front of them — a second credential store for this one call shape would be a
+ * second thing to rotate, audit and leak.
+ */
+export const FlowsActors_McpServerCredentialSchema = z.object({
+    providerRef: z.string().min(1),
+    subject: z.enum(FlowsActors_McpCredentialSubject).default(FlowsActors_McpCredentialSubject.USER_THEN_ORGANIZATION),
+});
+/**
+ * Bounds on a call that leaves the trust boundary.
+ *
+ * Present with defaults rather than optional-and-unbounded, because an MCP call is a REMOTE call and
+ * the mistake this whole issue warns against is modelling it as a second kind of local function. A
+ * local function cannot hang; this can, and an unbounded tool call holds a model turn open for as
+ * long as somebody else's server feels like it.
+ */
+export const FlowsActors_McpServerTimeoutsSchema = z.object({
+    /** How long tool DISCOVERY may take before the server contributes no tools to the turn. */
+    discoveryMs: z.number().int().positive().default(5_000),
+    /** How long one tool CALL may take before it returns a typed timeout to the agent. */
+    callMs: z.number().int().positive().default(30_000),
+});
+export const FlowsActors_McpServerSchema = z.object({
+    /** The value an agent's `capabilities.tools.mcpRefs` names. Unique within an application. */
+    ref: z.string().min(1),
+    displayName: z.string().min(1),
+    transport: z.enum(FlowsActors_McpTransport),
+    /** The server's endpoint. `https` in every deployed environment; the runtime refuses plaintext. */
+    url: z.string().url(),
+    credential: FlowsActors_McpServerCredentialSchema,
+    timeouts: FlowsActors_McpServerTimeoutsSchema.default({ discoveryMs: 5_000, callMs: 30_000 }),
+});
+/**
+ * Whether an MCP endpoint is reached over plaintext.
+ *
+ * Exported rather than inlined because two callers need the same answer — registration, which
+ * refuses, and the audit trail, which records what was refused — and a second spelling of "is this
+ * http" is how the two come to disagree. Mirrors the webhook lane's identical predicate.
+ */
+export function mcpServerTransportIsPlaintext(url) {
+    try {
+        return new URL(url).protocol === 'http:';
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The server's host, for a log or an audit row that must NOT carry the full URL.
+ *
+ * An MCP endpoint routinely carries a tenant or session identifier in its path or query, so the host
+ * is the part that can be recorded freely.
+ */
+export function mcpServerDestinationHost(url) {
+    try {
+        return new URL(url).host;
+    }
+    catch {
+        return 'unparseable';
+    }
+}
+//# sourceMappingURL=mcp-servers.shared.schemas.js.map

package/dist/esm/flows-actors/mcp-servers.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-servers.shared.schemas.js","sourceRoot":"","sources":["../../../../src/flows-actors/mcp-servers.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,iEAAiE;AACjE,2DAA2D;AAC3D,iEAAiE;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,wBAKX;AALD,WAAY,wBAAwB;IAClC,sEAAsE;IACtE,uDAA2B,CAAA;IAC3B,gFAAgF;IAChF,uCAAW,CAAA;AACb,CAAC,EALW,wBAAwB,KAAxB,wBAAwB,QAKnC;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,gCAYX;AAZD,WAAY,gCAAgC;IAC1C;;;;;OAKG;IACH,qFAAiD,CAAA;IACjD,uGAAuG;IACvG,iEAA6B,CAAA;IAC7B,oGAAoG;IACpG,iDAAa,CAAA;AACf,CAAC,EAZW,gCAAgC,KAAhC,gCAAgC,QAY3C;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,OAAO,CAAC,gCAAgC,CAAC,sBAAsB,CAAC;CACnH,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,2FAA2F;IAC3F,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACvD,sFAAsF;IACtF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;CACpD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,6FAA6F;IAC7F,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC;IAC3C,mGAAmG;IACnG,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,UAAU,EAAE,qCAAqC;IACjD,QAAQ,EAAE,mCAAmC,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;CAC9F,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAAC,GAAW;IACvD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAC;IACvB,CAAC;AACH,CAAC","sourcesContent":["import { z } from 'zod';\n\n//===============================================================\n//  MCP SERVERS — what an agent's `mcpRefs` resolve AGAINST\n//===============================================================\n\n/**\n * An MCP server an application permits its agents to reach.\n *\n * ## Why this exists (#491)\n *\n * `capabilities.tools.mcpRefs` was declared on the agent model, populated by a shipped catalog, and\n * rendered on the agent card — while nothing resolved a ref into a callable tool. The refs in that\n * catalog (`filesystem-mcp`, `git-mcp`, `browser-mcp`, `mongodb-mcp`, …) named no server anywhere;\n * they were authored against a field nothing read, so an agent card told a person the agent had a\n * reach it did not have.\n *\n * A ref must map to a transport, an endpoint and a credential. `functionRefs` have\n * `getFunctionTool`; these had no equivalent, so there was nothing to resolve against. This is that\n * equivalent, and it is what makes an `mcpRef` checkable.\n *\n * ## Why the APPLICATION declares it\n *\n * Decided 2026-09-09. An MCP tool call leaves the application's trust boundary and reaches a server\n * whose authorization is its own, so which third parties an application's agents may reach is the\n * application's decision — the same shape in which it already declares providers and capabilities.\n * Rejected: sourcing servers from the vendor provider catalogue (it describes REST operations, not\n * MCP endpoints, and would couple this to the provider architecture), and a platform-curated set an\n * application opts into (it makes the framework the gatekeeper of every application's third-party\n * reach, and needs a curation process that does not exist).\n *\n * This does not contradict the standing position that MCP is not an application's integration\n * runtime: an application calls a third-party API DIRECTLY, with typed operations. MCP is for the\n * case where an LLM agent sits between the application and the external system, which is exactly\n * what an agent's tool call is.\n */\n\n/**\n * How the runtime reaches the server.\n *\n * A closed vocabulary rather than a free string: the transport decides the whole connection\n * lifecycle — how a session opens, whether the server can push, how a stream ends — so a value\n * nobody implemented must be unrepresentable rather than discovered at the first call.\n *\n * STDIO is deliberately ABSENT. It launches a local subprocess, which is the coding-agent lane's\n * shape and not an application's: a generated application runs in a container it does not control,\n * and \"the agent may spawn a process\" is a different security decision from \"the agent may call an\n * endpoint\". Adding it later is a decision, not an omission.\n */\nexport enum FlowsActors_McpTransport {\n  /** Streamable HTTP — the current MCP transport for remote servers. */\n  HTTP_STREAM = 'http_stream',\n  /** Server-sent events — the earlier remote transport, still widely deployed. */\n  SSE = 'sse',\n}\n\n/**\n * WHOSE credential the call carries.\n *\n * The distinction is not a preference. A tool call that reaches a third party on a user's behalf\n * should be attributable to that user AT THE FAR END — that is what makes it revocable there and\n * auditable by the party being called. An application-wide service identity loses that: every\n * user's call looks identical to the server, and one leaked credential exposes every tenant.\n */\nexport enum FlowsActors_McpCredentialSubject {\n  /**\n   * The acting user's own delegated credential, falling back to the organization's connection when\n   * the user has none. The default, and the reason a fallback exists at all: an agent acting for a\n   * user who has never connected the server would otherwise have no path, which would make every\n   * unattended and batch turn impossible.\n   */\n  USER_THEN_ORGANIZATION = 'user_then_organization',\n  /** The organization's connection only — for a server the tenant connects once on everyone's behalf. */\n  ORGANIZATION = 'organization',\n  /** The acting user's own credential only. No fallback: a user who has not connected cannot call. */\n  USER = 'user',\n}\n\n/**\n * Which stored credential authorizes the call.\n *\n * `providerRef` names a provider the application has already connected, so the credential comes from\n * `organizationProviderCredentials` / `userProviderCredentials` rather than from a store invented\n * for MCP. Those exist, carry per-tenant isolation by construction, and already have the connect and\n * consent flow in front of them — a second credential store for this one call shape would be a\n * second thing to rotate, audit and leak.\n */\nexport const FlowsActors_McpServerCredentialSchema = z.object({\n  providerRef: z.string().min(1),\n  subject: z.enum(FlowsActors_McpCredentialSubject).default(FlowsActors_McpCredentialSubject.USER_THEN_ORGANIZATION),\n});\nexport type FlowsActors_McpServerCredential = z.infer<typeof FlowsActors_McpServerCredentialSchema>;\n\n/**\n * Bounds on a call that leaves the trust boundary.\n *\n * Present with defaults rather than optional-and-unbounded, because an MCP call is a REMOTE call and\n * the mistake this whole issue warns against is modelling it as a second kind of local function. A\n * local function cannot hang; this can, and an unbounded tool call holds a model turn open for as\n * long as somebody else's server feels like it.\n */\nexport const FlowsActors_McpServerTimeoutsSchema = z.object({\n  /** How long tool DISCOVERY may take before the server contributes no tools to the turn. */\n  discoveryMs: z.number().int().positive().default(5_000),\n  /** How long one tool CALL may take before it returns a typed timeout to the agent. */\n  callMs: z.number().int().positive().default(30_000),\n});\nexport type FlowsActors_McpServerTimeouts = z.infer<typeof FlowsActors_McpServerTimeoutsSchema>;\n\nexport const FlowsActors_McpServerSchema = z.object({\n  /** The value an agent's `capabilities.tools.mcpRefs` names. Unique within an application. */\n  ref: z.string().min(1),\n  displayName: z.string().min(1),\n  transport: z.enum(FlowsActors_McpTransport),\n  /** The server's endpoint. `https` in every deployed environment; the runtime refuses plaintext. */\n  url: z.string().url(),\n  credential: FlowsActors_McpServerCredentialSchema,\n  timeouts: FlowsActors_McpServerTimeoutsSchema.default({ discoveryMs: 5_000, callMs: 30_000 }),\n});\nexport type FlowsActors_McpServer = z.infer<typeof FlowsActors_McpServerSchema>;\n\n/**\n * Whether an MCP endpoint is reached over plaintext.\n *\n * Exported rather than inlined because two callers need the same answer — registration, which\n * refuses, and the audit trail, which records what was refused — and a second spelling of \"is this\n * http\" is how the two come to disagree. Mirrors the webhook lane's identical predicate.\n */\nexport function mcpServerTransportIsPlaintext(url: string): boolean {\n  try {\n    return new URL(url).protocol === 'http:';\n  } catch {\n    return false;\n  }\n}\n\n/**\n * The server's host, for a log or an audit row that must NOT carry the full URL.\n *\n * An MCP endpoint routinely carries a tenant or session identifier in its path or query, so the host\n * is the part that can be recorded freely.\n */\nexport function mcpServerDestinationHost(url: string): string {\n  try {\n    return new URL(url).host;\n  } catch {\n    return 'unparseable';\n  }\n}\n"]}

package/dist/esm/flows-actors/meta-workflows/budget-authority.meta-workflows.shared.schemas.d.ts

@@ -7,14 +7,11 @@ export declare enum MetaWorkflowStructuredGenerationPlanKind {
 }
 export declare const MetaWorkflowStructuredGenerationPlanV1Schema: z.ZodObject<{
     schemaVersion: z.ZodLiteral<1>;
-    providerConfigurationDigest: z.ZodString;
     outputSchemaRef: z.ZodString;
-    outputSchemaDigest: z.ZodString;
     leafFieldCount: z.ZodNumber;
     maximumLeafFieldsPerCall: z.ZodNumber;
     planKind: z.ZodEnum<typeof MetaWorkflowStructuredGenerationPlanKind>;
     physicalCallCount: z.ZodNumber;
-    planDigest: z.ZodString;
 }, z.core.$strict>;
 export type MetaWorkflowStructuredGenerationPlanV1 = z.infer<typeof MetaWorkflowStructuredGenerationPlanV1Schema>;
 //# sourceMappingURL=budget-authority.meta-workflows.shared.schemas.d.ts.map

package/dist/esm/flows-actors/meta-workflows/budget-authority.meta-workflows.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"budget-authority.meta-workflows.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/flows-actors/meta-workflows/budget-authority.meta-workflows.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,oBAAY,wCAAwC;IAClD,WAAW,gBAAgB;IAC3B,OAAO,YAAY;IACnB,iGAAiG;IACjG,sBAAsB,2BAA2B;CAClD;AAED,eAAO,MAAM,4CAA4C;;;;;;;;;;kBAqBvD,CAAC;AACH,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4CAA4C,CAAC,CAAC"}
+{"version":3,"file":"budget-authority.meta-workflows.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/flows-actors/meta-workflows/budget-authority.meta-workflows.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB,oBAAY,wCAAwC;IAClD,WAAW,gBAAgB;IAC3B,OAAO,YAAY;IACnB,iGAAiG;IACjG,sBAAsB,2BAA2B;CAClD;AAED,eAAO,MAAM,4CAA4C;;;;;;;kBAkBvD,CAAC;AACH,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4CAA4C,CAAC,CAAC"}

package/dist/esm/flows-actors/meta-workflows/budget-authority.meta-workflows.shared.schemas.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { MetaWorkflow_NamespacedRefSchema, MetaWorkflow_Sha256DigestSchema, } from './portable-primitives.meta-workflows.shared.schemas.js';
+import { MetaWorkflow_NamespacedRefSchema, } from './portable-primitives.meta-workflows.shared.schemas.js';
 const nonnegativeSafeIntegerSchema = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER).refine((value) => !Object.is(value, -0), 'negative zero is not canonical');
 const positiveSafeIntegerSchema = nonnegativeSafeIntegerSchema.refine((value) => value > 0, 'value must be positive');
 export var MetaWorkflowStructuredGenerationPlanKind;
@@ -11,14 +11,11 @@ export var MetaWorkflowStructuredGenerationPlanKind;
 })(MetaWorkflowStructuredGenerationPlanKind || (MetaWorkflowStructuredGenerationPlanKind = {}));
 export const MetaWorkflowStructuredGenerationPlanV1Schema = z.strictObject({
     schemaVersion: z.literal(1),
-    providerConfigurationDigest: MetaWorkflow_Sha256DigestSchema,
     outputSchemaRef: MetaWorkflow_NamespacedRefSchema,
-    outputSchemaDigest: MetaWorkflow_Sha256DigestSchema,
     leafFieldCount: positiveSafeIntegerSchema,
     maximumLeafFieldsPerCall: positiveSafeIntegerSchema,
     planKind: z.enum(MetaWorkflowStructuredGenerationPlanKind),
     physicalCallCount: nonnegativeSafeIntegerSchema,
-    planDigest: MetaWorkflow_Sha256DigestSchema,
 }).superRefine((plan, context) => {
     const exceedsLimit = plan.leafFieldCount > plan.maximumLeafFieldsPerCall;
     if (plan.planKind === MetaWorkflowStructuredGenerationPlanKind.SINGLE_CALL && (plan.physicalCallCount !== 1 || exceedsLimit)) {

package/dist/esm/flows-actors/meta-workflows/budget-authority.meta-workflows.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"budget-authority.meta-workflows.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/flows-actors/meta-workflows/budget-authority.meta-workflows.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,gCAAgC,EAChC,+BAA+B,GAChC,MAAM,qDAAqD,CAAC;AAE7D,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,gCAAgC,CAAC,CAAC;AAC5K,MAAM,yBAAyB,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,EAAE,wBAAwB,CAAC,CAAC;AAEtH,MAAM,CAAN,IAAY,wCAKX;AALD,WAAY,wCAAwC;IAClD,uEAA2B,CAAA;IAC3B,+DAAmB,CAAA;IACnB,iGAAiG;IACjG,6FAAiD,CAAA;AACnD,CAAC,EALW,wCAAwC,KAAxC,wCAAwC,QAKnD;AAED,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAC,CAAC,YAAY,CAAC;IACzE,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,2BAA2B,EAAE,+BAA+B;IAC5D,eAAe,EAAE,gCAAgC;IACjD,kBAAkB,EAAE,+BAA+B;IACnD,cAAc,EAAE,yBAAyB;IACzC,wBAAwB,EAAE,yBAAyB;IACnD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,wCAAwC,CAAC;IAC1D,iBAAiB,EAAE,4BAA4B;IAC/C,UAAU,EAAE,+BAA+B;CAC5C,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;IAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,wBAAwB,CAAC;IACzE,IAAI,IAAI,CAAC,QAAQ,KAAK,wCAAwC,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,IAAI,YAAY,CAAC,EAAE,CAAC;QAC7H,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,qDAAqD,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC3H,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,wCAAwC,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACzH,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,mEAAmE,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACzI,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,wCAAwC,CAAC,sBAAsB,IAAI,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACzI,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,qEAAqE,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC3I,CAAC;AACH,CAAC,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport {\n  MetaWorkflow_NamespacedRefSchema,\n  MetaWorkflow_Sha256DigestSchema,\n} from './portable-primitives.meta-workflows.shared.schemas';\n\nconst nonnegativeSafeIntegerSchema = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER).refine((value) => !Object.is(value, -0), 'negative zero is not canonical');\nconst positiveSafeIntegerSchema = nonnegativeSafeIntegerSchema.refine((value) => value > 0, 'value must be positive');\n\nexport enum MetaWorkflowStructuredGenerationPlanKind {\n  SINGLE_CALL = 'SINGLE_CALL',\n  CHUNKED = 'CHUNKED',\n  /** Leaf ceiling is exceeded, but the root semantics cannot be preserved across partial calls. */\n  UNCHUNKABLE_OVER_LIMIT = 'UNCHUNKABLE_OVER_LIMIT',\n}\n\nexport const MetaWorkflowStructuredGenerationPlanV1Schema = z.strictObject({\n  schemaVersion: z.literal(1),\n  providerConfigurationDigest: MetaWorkflow_Sha256DigestSchema,\n  outputSchemaRef: MetaWorkflow_NamespacedRefSchema,\n  outputSchemaDigest: MetaWorkflow_Sha256DigestSchema,\n  leafFieldCount: positiveSafeIntegerSchema,\n  maximumLeafFieldsPerCall: positiveSafeIntegerSchema,\n  planKind: z.enum(MetaWorkflowStructuredGenerationPlanKind),\n  physicalCallCount: nonnegativeSafeIntegerSchema,\n  planDigest: MetaWorkflow_Sha256DigestSchema,\n}).superRefine((plan, context) => {\n  const exceedsLimit = plan.leafFieldCount > plan.maximumLeafFieldsPerCall;\n  if (plan.planKind === MetaWorkflowStructuredGenerationPlanKind.SINGLE_CALL && (plan.physicalCallCount !== 1 || exceedsLimit)) {\n    context.addIssue({ code: 'custom', message: 'SINGLE_CALL requires one within-limit physical call', path: ['planKind'] });\n  }\n  if (plan.planKind === MetaWorkflowStructuredGenerationPlanKind.CHUNKED && (plan.physicalCallCount <= 1 || !exceedsLimit)) {\n    context.addIssue({ code: 'custom', message: 'CHUNKED requires multiple physical calls for an over-limit schema', path: ['planKind'] });\n  }\n  if (plan.planKind === MetaWorkflowStructuredGenerationPlanKind.UNCHUNKABLE_OVER_LIMIT && (plan.physicalCallCount !== 0 || !exceedsLimit)) {\n    context.addIssue({ code: 'custom', message: 'UNCHUNKABLE_OVER_LIMIT requires zero calls for an over-limit schema', path: ['planKind'] });\n  }\n});\nexport type MetaWorkflowStructuredGenerationPlanV1 = z.infer<typeof MetaWorkflowStructuredGenerationPlanV1Schema>;\n"]}
+{"version":3,"file":"budget-authority.meta-workflows.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/flows-actors/meta-workflows/budget-authority.meta-workflows.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,gCAAgC,GACjC,MAAM,qDAAqD,CAAC;AAE7D,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,gCAAgC,CAAC,CAAC;AAC5K,MAAM,yBAAyB,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,EAAE,wBAAwB,CAAC,CAAC;AAEtH,MAAM,CAAN,IAAY,wCAKX;AALD,WAAY,wCAAwC;IAClD,uEAA2B,CAAA;IAC3B,+DAAmB,CAAA;IACnB,iGAAiG;IACjG,6FAAiD,CAAA;AACnD,CAAC,EALW,wCAAwC,KAAxC,wCAAwC,QAKnD;AAED,MAAM,CAAC,MAAM,4CAA4C,GAAG,CAAC,CAAC,YAAY,CAAC;IACzE,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,eAAe,EAAE,gCAAgC;IACjD,cAAc,EAAE,yBAAyB;IACzC,wBAAwB,EAAE,yBAAyB;IACnD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,wCAAwC,CAAC;IAC1D,iBAAiB,EAAE,4BAA4B;CAChD,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;IAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,wBAAwB,CAAC;IACzE,IAAI,IAAI,CAAC,QAAQ,KAAK,wCAAwC,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,IAAI,YAAY,CAAC,EAAE,CAAC;QAC7H,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,qDAAqD,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC3H,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,wCAAwC,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACzH,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,mEAAmE,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACzI,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,wCAAwC,CAAC,sBAAsB,IAAI,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACzI,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,qEAAqE,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC3I,CAAC;AACH,CAAC,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport {\n  MetaWorkflow_NamespacedRefSchema,\n} from './portable-primitives.meta-workflows.shared.schemas';\n\nconst nonnegativeSafeIntegerSchema = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER).refine((value) => !Object.is(value, -0), 'negative zero is not canonical');\nconst positiveSafeIntegerSchema = nonnegativeSafeIntegerSchema.refine((value) => value > 0, 'value must be positive');\n\nexport enum MetaWorkflowStructuredGenerationPlanKind {\n  SINGLE_CALL = 'SINGLE_CALL',\n  CHUNKED = 'CHUNKED',\n  /** Leaf ceiling is exceeded, but the root semantics cannot be preserved across partial calls. */\n  UNCHUNKABLE_OVER_LIMIT = 'UNCHUNKABLE_OVER_LIMIT',\n}\n\nexport const MetaWorkflowStructuredGenerationPlanV1Schema = z.strictObject({\n  schemaVersion: z.literal(1),\n  outputSchemaRef: MetaWorkflow_NamespacedRefSchema,\n  leafFieldCount: positiveSafeIntegerSchema,\n  maximumLeafFieldsPerCall: positiveSafeIntegerSchema,\n  planKind: z.enum(MetaWorkflowStructuredGenerationPlanKind),\n  physicalCallCount: nonnegativeSafeIntegerSchema,\n}).superRefine((plan, context) => {\n  const exceedsLimit = plan.leafFieldCount > plan.maximumLeafFieldsPerCall;\n  if (plan.planKind === MetaWorkflowStructuredGenerationPlanKind.SINGLE_CALL && (plan.physicalCallCount !== 1 || exceedsLimit)) {\n    context.addIssue({ code: 'custom', message: 'SINGLE_CALL requires one within-limit physical call', path: ['planKind'] });\n  }\n  if (plan.planKind === MetaWorkflowStructuredGenerationPlanKind.CHUNKED && (plan.physicalCallCount <= 1 || !exceedsLimit)) {\n    context.addIssue({ code: 'custom', message: 'CHUNKED requires multiple physical calls for an over-limit schema', path: ['planKind'] });\n  }\n  if (plan.planKind === MetaWorkflowStructuredGenerationPlanKind.UNCHUNKABLE_OVER_LIMIT && (plan.physicalCallCount !== 0 || !exceedsLimit)) {\n    context.addIssue({ code: 'custom', message: 'UNCHUNKABLE_OVER_LIMIT requires zero calls for an over-limit schema', path: ['planKind'] });\n  }\n});\nexport type MetaWorkflowStructuredGenerationPlanV1 = z.infer<typeof MetaWorkflowStructuredGenerationPlanV1Schema>;\n"]}

package/dist/esm/flows-actors/meta-workflows/context-selection.meta-workflows.shared.schemas.d.ts

@@ -73,19 +73,6 @@ export declare const MetaWorkflow_ContextSelectionPlanSchema: z.ZodObject<{
     assessmentSubjectRef: z.ZodString;
     scope: z.ZodRecord<z.ZodString, z.ZodString>;
     iterationOrdinal: z.ZodNumber;
-    /**
-     * The assessment stable kernel this selection is bound to — ASSESSMENT consumers only.
-     *
-     * Optional, because it is meaningful for exactly one consumer kind. The assessment input compiler and the
-     * semantic-evaluation service compare these two against the episode's own kernel; a CODING_AGENT run has
-     * no kernel to compare against, and supplying a manufactured ref and digest so the shape would parse
-     * would be inventing a fact the run does not have.
-     *
-     * Absence stays FAIL-CLOSED where it matters: both assessment readers compare with `!==`, so an absent
-     * value cannot equal a real kernel and the assessment refuses exactly as it did before.
-     */
-    stableKernelRef: z.ZodOptional<z.ZodString>;
-    stableKernelDigest: z.ZodOptional<z.ZodString>;
     consumerKind: z.ZodEnum<typeof MetaWorkflow_ContextSelectionConsumerKind>;
     maximumOptionalSources: z.ZodNumber;
     maximumTokenBudget: z.ZodNumber;
@@ -120,8 +107,6 @@ export declare const MetaWorkflow_ContextSelectionSchema: z.ZodObject<{
     assessmentSubjectRef: z.ZodString;
     scope: z.ZodRecord<z.ZodString, z.ZodString>;
     iterationOrdinal: z.ZodNumber;
-    stableKernelRef: z.ZodOptional<z.ZodString>;
-    stableKernelDigest: z.ZodOptional<z.ZodString>;
     consumerKind: z.ZodEnum<typeof MetaWorkflow_ContextSelectionConsumerKind>;
     selectedSources: z.ZodArray<z.ZodObject<{
         sourceRef: z.ZodString;
@@ -161,7 +146,6 @@ export declare enum MetaWorkflow_DeterministicFindingStatus {
 }
 export declare const MetaWorkflow_AssessmentStableKernelSchema: z.ZodObject<{
     kernelRef: z.ZodString;
-    kernelDigest: z.ZodString;
     declaredCriterionRefs: z.ZodArray<z.ZodString>;
     deterministicFindings: z.ZodArray<z.ZodObject<{
         findingRef: z.ZodString;

package/dist/esm/flows-actors/meta-workflows/context-selection.meta-workflows.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context-selection.meta-workflows.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/flows-actors/meta-workflows/context-selection.meta-workflows.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB,kEAAkE;AAClE,oBAAY,8BAA8B;IACxC,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,QAAQ,aAAa;CACtB;AAED,6DAA6D;AAC7D,oBAAY,mCAAmC;IAC7C,OAAO,YAAY;IACnB,KAAK,UAAU;IACf,OAAO,YAAY;CACpB;AAED,iFAAiF;AACjF,oBAAY,oCAAoC;IAC9C,cAAc,mBAAmB;IACjC,UAAU,eAAe;CAC1B;AAED,uGAAuG;AACvG,oBAAY,yCAAyC;IACnD,gBAAgB,qBAAqB;IACrC;;;;;;;;OAQG;IACH,YAAY,iBAAiB;CAC9B;AAED,iGAAiG;AACjG,eAAO,MAAM,yCAAyC;;;;;;;;;IASpD,+BAA+B;;kBAE/B,CAAC;AACH,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAE5G,+EAA+E;AAC/E,eAAO,MAAM,2CAA2C;;IAEtD,gFAAgF;;;;;;kBAMhF,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAEhH,yFAAyF;AACzF,eAAO,MAAM,iCAAiC;;;kBAG5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;GAIG;AACH,eAAO,MAAM,uCAAuC;;;;;;;IAOlD;;;;;;;;;;OAUG;;;;;;;;QAtCH,gFAAgF;;;;;;;;;QAAhF,gFAAgF;;;;;;;kBAoEhF,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG,eAAO,MAAM,mCAAmC;;;IAG9C;;;OAGG;;;;;;;;;;;;;;;;;QArFH,+BAA+B;;;IA8F/B;;;;;OAKG;;;;;kBAcH,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;GAKG;AACH,iFAAiF;AACjF,oBAAY,uCAAuC;IACjD,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,aAAa,kBAAkB;CAChC;AAED,eAAO,MAAM,yCAAyC;;;;;;;;;;;;;;;;;kBAiBpD,CAAC"}
+{"version":3,"file":"context-selection.meta-workflows.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/flows-actors/meta-workflows/context-selection.meta-workflows.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAaxB,kEAAkE;AAClE,oBAAY,8BAA8B;IACxC,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,QAAQ,aAAa;CACtB;AAED,6DAA6D;AAC7D,oBAAY,mCAAmC;IAC7C,OAAO,YAAY;IACnB,KAAK,UAAU;IACf,OAAO,YAAY;CACpB;AAED,iFAAiF;AACjF,oBAAY,oCAAoC;IAC9C,cAAc,mBAAmB;IACjC,UAAU,eAAe;CAC1B;AAED,uGAAuG;AACvG,oBAAY,yCAAyC;IACnD,gBAAgB,qBAAqB;IACrC;;;;;;;;OAQG;IACH,YAAY,iBAAiB;CAC9B;AAED,iGAAiG;AACjG,eAAO,MAAM,yCAAyC;;;;;;;;;IASpD,+BAA+B;;kBAE/B,CAAC;AACH,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAE5G,+EAA+E;AAC/E,eAAO,MAAM,2CAA2C;;IAEtD,gFAAgF;;;;;;kBAMhF,CAAC;AACH,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2CAA2C,CAAC,CAAC;AAEhH,yFAAyF;AACzF,eAAO,MAAM,iCAAiC;;;kBAG5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F;;;;GAIG;AACH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;QArBlD,gFAAgF;;;;;;;;;QAAhF,gFAAgF;;;;;;;kBAuDhF,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG,eAAO,MAAM,mCAAmC;;;IAG9C;;;OAGG;;;;;;;;;;;;;;;QAxEH,+BAA+B;;;IA+E/B;;;;;OAKG;;;;;kBAcH,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;GAKG;AACH,iFAAiF;AACjF,oBAAY,uCAAuC;IACjD,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,aAAa,kBAAkB;CAChC;AAED,eAAO,MAAM,yCAAyC;;;;;;;;;;;;;;;;kBAgBpD,CAAC"}

package/dist/esm/flows-actors/meta-workflows/context-selection.meta-workflows.shared.schemas.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { MetaWorkflow_NamespacedRefSchema, MetaWorkflow_OpaqueRefSchema, MetaWorkflow_PositiveVersionSchema, MetaWorkflow_Sha256DigestSchema, metaWorkflowValuesAreLexicallySorted, metaWorkflowValuesAreUnique, } from './portable-primitives.meta-workflows.shared.schemas.js';
+import { MetaWorkflow_NamespacedRefSchema, MetaWorkflow_OpaqueRefSchema, MetaWorkflow_PositiveVersionSchema, metaWorkflowValuesAreLexicallySorted, metaWorkflowValuesAreUnique, } from './portable-primitives.meta-workflows.shared.schemas.js';
 const positiveIntegerSchema = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
 const unitIntervalSchema = z.number().finite().min(0).max(1);
 /** Why a source participates in a semantic assessment package. */
@@ -77,19 +77,6 @@ export const MetaWorkflow_ContextSelectionPlanSchema = z.strictObject({
     assessmentSubjectRef: MetaWorkflow_NamespacedRefSchema,
     scope: z.record(z.string().min(1), z.string().min(1)),
     iterationOrdinal: positiveIntegerSchema,
-    /**
-     * The assessment stable kernel this selection is bound to — ASSESSMENT consumers only.
-     *
-     * Optional, because it is meaningful for exactly one consumer kind. The assessment input compiler and the
-     * semantic-evaluation service compare these two against the episode's own kernel; a CODING_AGENT run has
-     * no kernel to compare against, and supplying a manufactured ref and digest so the shape would parse
-     * would be inventing a fact the run does not have.
-     *
-     * Absence stays FAIL-CLOSED where it matters: both assessment readers compare with `!==`, so an absent
-     * value cannot equal a real kernel and the assessment refuses exactly as it did before.
-     */
-    stableKernelRef: MetaWorkflow_NamespacedRefSchema.optional(),
-    stableKernelDigest: MetaWorkflow_Sha256DigestSchema.optional(),
     consumerKind: z.enum(MetaWorkflow_ContextSelectionConsumerKind),
     maximumOptionalSources: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
     maximumTokenBudget: positiveIntegerSchema,
@@ -129,8 +116,6 @@ export const MetaWorkflow_ContextSelectionSchema = z.strictObject({
     assessmentSubjectRef: MetaWorkflow_NamespacedRefSchema,
     scope: z.record(z.string().min(1), z.string().min(1)),
     iterationOrdinal: positiveIntegerSchema,
-    stableKernelRef: MetaWorkflow_NamespacedRefSchema.optional(),
-    stableKernelDigest: MetaWorkflow_Sha256DigestSchema.optional(),
     consumerKind: z.enum(MetaWorkflow_ContextSelectionConsumerKind),
     selectedSources: z.array(MetaWorkflow_ContextSourceCandidateSchema),
     /**
@@ -168,7 +153,6 @@ export var MetaWorkflow_DeterministicFindingStatus;
 })(MetaWorkflow_DeterministicFindingStatus || (MetaWorkflow_DeterministicFindingStatus = {}));
 export const MetaWorkflow_AssessmentStableKernelSchema = z.strictObject({
     kernelRef: MetaWorkflow_NamespacedRefSchema,
-    kernelDigest: MetaWorkflow_Sha256DigestSchema,
     declaredCriterionRefs: z.array(MetaWorkflow_NamespacedRefSchema).refine(metaWorkflowValuesAreUnique, 'declaredCriterionRefs must be unique').refine(metaWorkflowValuesAreLexicallySorted, 'declaredCriterionRefs must be lexically sorted'),
     deterministicFindings: z.array(z.strictObject({
         findingRef: MetaWorkflow_NamespacedRefSchema,

package/dist/esm/flows-actors/meta-workflows/context-selection.meta-workflows.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"context-selection.meta-workflows.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/flows-actors/meta-workflows/context-selection.meta-workflows.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,gCAAgC,EAChC,4BAA4B,EAC5B,kCAAkC,EAClC,+BAA+B,EAC/B,oCAAoC,EACpC,2BAA2B,GAC5B,MAAM,qDAAqD,CAAC;AAE7D,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AACvF,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAE7D,kEAAkE;AAClE,MAAM,CAAN,IAAY,8BAIX;AAJD,WAAY,8BAA8B;IACxC,yDAAuB,CAAA;IACvB,6DAA2B,CAAA;IAC3B,uDAAqB,CAAA;AACvB,CAAC,EAJW,8BAA8B,KAA9B,8BAA8B,QAIzC;AAED,6DAA6D;AAC7D,MAAM,CAAN,IAAY,mCAIX;AAJD,WAAY,mCAAmC;IAC7C,0DAAmB,CAAA;IACnB,sDAAe,CAAA;IACf,0DAAmB,CAAA;AACrB,CAAC,EAJW,mCAAmC,KAAnC,mCAAmC,QAI9C;AAED,iFAAiF;AACjF,MAAM,CAAN,IAAY,oCAGX;AAHD,WAAY,oCAAoC;IAC9C,yEAAiC,CAAA;IACjC,iEAAyB,CAAA;AAC3B,CAAC,EAHW,oCAAoC,KAApC,oCAAoC,QAG/C;AAED,uGAAuG;AACvG,MAAM,CAAN,IAAY,yCAYX;AAZD,WAAY,yCAAyC;IACnD,kFAAqC,CAAA;IACrC;;;;;;;;OAQG;IACH,0EAA6B,CAAA;AAC/B,CAAC,EAZW,yCAAyC,KAAzC,yCAAyC,QAYpD;AAED,iGAAiG;AACjG,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,YAAY,CAAC;IACtE,SAAS,EAAE,gCAAgC;IAC3C,aAAa,EAAE,kCAAkC,CAAC,QAAQ,EAAE;IAC5D,SAAS,EAAE,gCAAgC;IAC3C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;IAC5C,SAAS,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACxC,eAAe,EAAE,qBAAqB;IACtC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC,QAAQ,EAAE;IACjE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC;IACxD,+BAA+B;IAC/B,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE;CAClB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,SAAS,EAAE,gCAAgC;IAC3C,gFAAgF;IAChF,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC;QACvB,mCAAmC,CAAC,OAAO;QAC3C,mCAAmC,CAAC,KAAK;KAC1C,CAAC;IACF,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;CAC7C,CAAC,CAAC;AAGH,yFAAyF;AACzF,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,SAAS,EAAE,gCAAgC;IAC3C,SAAS,EAAE,gCAAgC;CAC5C,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,YAAY,CAAC;IACpE,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,4BAA4B;IACrC,YAAY,EAAE,gCAAgC;IAC9C,oBAAoB,EAAE,gCAAgC;IACtD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrD,gBAAgB,EAAE,qBAAqB;IACvC;;;;;;;;;;OAUG;IACH,eAAe,EAAE,gCAAgC,CAAC,QAAQ,EAAE;IAC5D,kBAAkB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IAC9D,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,yCAAyC,CAAC;IAC/D,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC;IACnF,kBAAkB,EAAE,qBAAqB;IACzC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7E,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,2CAA2C,CAAC;CACjF,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;IAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrF,IAAI,CAAC,2BAA2B,CAAC,aAAa,CAAC,EAAE,CAAC;QAChD,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;IACpH,CAAC;IACD,IAAI,CAAC,2BAA2B,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/C,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,4BAA4B,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;IAC7H,CAAC;IACD,IAAI,CAAC,oCAAoC,CAAC,YAAY,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,4BAA4B,CAAC,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC,CAAC;IACvI,CAAC;IACD,IAAI,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,8BAA8B,CAAC,SAAS,CAAC,EAAE,CAAC;QACzH,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,4BAA4B,CAAC,EAAE,OAAO,EAAE,gEAAgE,EAAE,CAAC,CAAC;IACxJ,CAAC;IACD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IAC/C,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,4BAA4B,CAAC,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC,CAAC;IAC5I,CAAC;IACD,IAAI,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC,0BAA0B,CAAC,MAAM,EAAE,CAAC;QACzE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,wBAAwB,CAAC,EAAE,OAAO,EAAE,uEAAuE,EAAE,CAAC,CAAC;IAC3J,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,YAAY,CAAC;IAChE,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,4BAA4B;IACrC;;;OAGG;IACH,YAAY,EAAE,gCAAgC;IAC9C,oBAAoB,EAAE,gCAAgC;IACtD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrD,gBAAgB,EAAE,qBAAqB;IACvC,eAAe,EAAE,gCAAgC,CAAC,QAAQ,EAAE;IAC5D,kBAAkB,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IAC9D,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,yCAAyC,CAAC;IAC/D,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yCAAyC,CAAC;IACnE;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,iCAAiC,CAAC;CACrD,CAAC,CAAC,WAAW,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE;IACpC,MAAM,kBAAkB,GAAG,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvF,IAAI,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,MAAM,EAAE,CAAC;QACnE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,MAAM,WAAW,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACtG,IAAI,CAAC,2BAA2B,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9C,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC,CAAC;IAC5H,CAAC;IACD,IAAI,CAAC,oCAAoC,CAAC,WAAW,CAAC,EAAE,CAAC;QACvD,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,gEAAgE,EAAE,CAAC,CAAC;IACtI,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;GAKG;AACH,iFAAiF;AACjF,MAAM,CAAN,IAAY,uCAIX;AAJD,WAAY,uCAAuC;IACjD,4DAAiB,CAAA;IACjB,4DAAiB,CAAA;IACjB,0EAA+B,CAAA;AACjC,CAAC,EAJW,uCAAuC,KAAvC,uCAAuC,QAIlD;AAED,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,YAAY,CAAC;IACtE,SAAS,EAAE,gCAAgC;IAC3C,YAAY,EAAE,+BAA+B;IAC7C,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC,MAAM,CAAC,2BAA2B,EAAE,sCAAsC,CAAC,CAAC,MAAM,CAAC,oCAAoC,EAAE,gDAAgD,CAAC;IAC3O,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC;QAC5C,UAAU,EAAE,gCAAgC;QAC5C,cAAc,EAAE,gCAAgC;QAChD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC;QACvD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC,MAAM,CAAC,2BAA2B,EAAE,mDAAmD,CAAC,CAAC,MAAM,CAAC,oCAAoC,EAAE,6DAA6D,CAAC;QAC5P,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACpC,CAAC,CAAC;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC;QAC/B,WAAW,EAAE,gCAAgC;QAC7C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAClC,CAAC,CAAC;IACH,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC;IACxF,iBAAiB,EAAE,kBAAkB;CACtC,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport {\n  MetaWorkflow_NamespacedRefSchema,\n  MetaWorkflow_OpaqueRefSchema,\n  MetaWorkflow_PositiveVersionSchema,\n  MetaWorkflow_Sha256DigestSchema,\n  metaWorkflowValuesAreLexicallySorted,\n  metaWorkflowValuesAreUnique,\n} from './portable-primitives.meta-workflows.shared.schemas';\n\nconst positiveIntegerSchema = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);\nconst unitIntervalSchema = z.number().finite().min(0).max(1);\n\n/** Why a source participates in a semantic assessment package. */\nexport enum MetaWorkflow_ContextSourceRole {\n  MANDATORY = 'MANDATORY',\n  CONDITIONAL = 'CONDITIONAL',\n  ADVISORY = 'ADVISORY',\n}\n\n/** Freshness is source evidence, never a model inference. */\nexport enum MetaWorkflow_ContextSourceFreshness {\n  CURRENT = 'CURRENT',\n  STALE = 'STALE',\n  UNKNOWN = 'UNKNOWN',\n}\n\n/** Disclosure safety is decided by the source adapter before prompt assembly. */\nexport enum MetaWorkflow_ContextSourceDisclosure {\n  SAFE_FOR_MODEL = 'SAFE_FOR_MODEL',\n  RESTRICTED = 'RESTRICTED',\n}\n\n/** Who the assembled context is FOR. The consumer decides what may travel and what a mistake costs. */\nexport enum MetaWorkflow_ContextSelectionConsumerKind {\n  ASSESSMENT_INPUT = 'ASSESSMENT_INPUT',\n  /**\n   * Context assembled for a CODING AGENT that will mutate the application workspace.\n   *\n   * Deliberately not folded into `ASSESSMENT_INPUT`. The two consumers differ in what the context is FOR and\n   * in what a mistake costs: an assessment input feeds a judgement that produces a finding, while this feeds\n   * a run that writes files into a developer's source tree. They also differ in what may travel — the\n   * application coding-task contract refuses any source that is not `SAFE_FOR_MODEL`, because its content is\n   * rendered verbatim into the agent prompt.\n   */\n  CODING_AGENT = 'CODING_AGENT',\n}\n\n/** One acquired context source offered to the selector. `content` is portable JSON data only. */\nexport const MetaWorkflow_ContextSourceCandidateSchema = z.strictObject({\n  sourceRef: MetaWorkflow_NamespacedRefSchema,\n  sourceVersion: MetaWorkflow_PositiveVersionSchema.optional(),\n  originRef: MetaWorkflow_NamespacedRefSchema,\n  role: z.enum(MetaWorkflow_ContextSourceRole),\n  relevance: unitIntervalSchema.optional(),\n  estimatedTokens: positiveIntegerSchema,\n  freshness: z.enum(MetaWorkflow_ContextSourceFreshness).optional(),\n  disclosure: z.enum(MetaWorkflow_ContextSourceDisclosure),\n  /** Portable JSON data only. */\n  content: z.json(),\n});\nexport type MetaWorkflow_ContextSourceCandidate = z.infer<typeof MetaWorkflow_ContextSourceCandidateSchema>;\n\n/** Declared requirement: no planner or curator may remove this source role. */\nexport const MetaWorkflow_ContextSourceRequirementSchema = z.strictObject({\n  sourceRef: MetaWorkflow_NamespacedRefSchema,\n  /** Unknown freshness is never admissible for model-visible required context. */\n  minimumFreshness: z.enum([\n    MetaWorkflow_ContextSourceFreshness.CURRENT,\n    MetaWorkflow_ContextSourceFreshness.STALE,\n  ]),\n  role: z.enum(MetaWorkflow_ContextSourceRole),\n});\nexport type MetaWorkflow_ContextSourceRequirement = z.infer<typeof MetaWorkflow_ContextSourceRequirementSchema>;\n\n/** One deterministic omission recorded after acquisition, keyed by source and reason. */\nexport const MetaWorkflow_ContextWarningSchema = z.strictObject({\n  sourceRef: MetaWorkflow_NamespacedRefSchema,\n  reasonRef: MetaWorkflow_NamespacedRefSchema,\n});\nexport type MetaWorkflow_ContextWarning = z.infer<typeof MetaWorkflow_ContextWarningSchema>;\n\n/**\n * Bounded, source-grounded selection instruction for one assessment iteration.\n * It deliberately carries no filesystem, companion, Git, or application-family\n * concepts; those belong to the host adapter which supplies candidates.\n */\nexport const MetaWorkflow_ContextSelectionPlanSchema = z.strictObject({\n  schemaVersion: z.literal(1),\n  planRef: MetaWorkflow_OpaqueRefSchema,\n  objectiveRef: MetaWorkflow_NamespacedRefSchema,\n  assessmentSubjectRef: MetaWorkflow_NamespacedRefSchema,\n  scope: z.record(z.string().min(1), z.string().min(1)),\n  iterationOrdinal: positiveIntegerSchema,\n  /**\n   * The assessment stable kernel this selection is bound to — ASSESSMENT consumers only.\n   *\n   * Optional, because it is meaningful for exactly one consumer kind. The assessment input compiler and the\n   * semantic-evaluation service compare these two against the episode's own kernel; a CODING_AGENT run has\n   * no kernel to compare against, and supplying a manufactured ref and digest so the shape would parse\n   * would be inventing a fact the run does not have.\n   *\n   * Absence stays FAIL-CLOSED where it matters: both assessment readers compare with `!==`, so an absent\n   * value cannot equal a real kernel and the assessment refuses exactly as it did before.\n   */\n  stableKernelRef: MetaWorkflow_NamespacedRefSchema.optional(),\n  stableKernelDigest: MetaWorkflow_Sha256DigestSchema.optional(),\n  consumerKind: z.enum(MetaWorkflow_ContextSelectionConsumerKind),\n  maximumOptionalSources: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),\n  maximumTokenBudget: positiveIntegerSchema,\n  mandatorySources: z.array(MetaWorkflow_ContextSourceRequirementSchema).min(1),\n  optionalSourceRequirements: z.array(MetaWorkflow_ContextSourceRequirementSchema),\n}).superRefine((plan, context) => {\n  const mandatoryRefs = plan.mandatorySources.map((entry) => entry.sourceRef);\n  const optionalRefs = plan.optionalSourceRequirements.map((entry) => entry.sourceRef);\n  if (!metaWorkflowValuesAreUnique(mandatoryRefs)) {\n    context.addIssue({ code: 'custom', path: ['mandatorySources'], message: 'mandatory source refs must be unique' });\n  }\n  if (!metaWorkflowValuesAreUnique(optionalRefs)) {\n    context.addIssue({ code: 'custom', path: ['optionalSourceRequirements'], message: 'optional source refs must be unique' });\n  }\n  if (!metaWorkflowValuesAreLexicallySorted(optionalRefs)) {\n    context.addIssue({ code: 'custom', path: ['optionalSourceRequirements'], message: 'optional source refs must be lexically sorted' });\n  }\n  if (plan.optionalSourceRequirements.some((requirement) => requirement.role === MetaWorkflow_ContextSourceRole.MANDATORY)) {\n    context.addIssue({ code: 'custom', path: ['optionalSourceRequirements'], message: 'optional source requirements cannot declare the mandatory role' });\n  }\n  const mandatoryRefSet = new Set(mandatoryRefs);\n  if (optionalRefs.some((sourceRef) => mandatoryRefSet.has(sourceRef))) {\n    context.addIssue({ code: 'custom', path: ['optionalSourceRequirements'], message: 'a source ref cannot be both mandatory and optional' });\n  }\n  if (plan.maximumOptionalSources > plan.optionalSourceRequirements.length) {\n    context.addIssue({ code: 'custom', path: ['maximumOptionalSources'], message: 'optional-source capacity cannot exceed declared optional requirements' });\n  }\n});\nexport type MetaWorkflow_ContextSelectionPlan = z.infer<typeof MetaWorkflow_ContextSelectionPlanSchema>;\n\nexport const MetaWorkflow_ContextSelectionSchema = z.strictObject({\n  schemaVersion: z.literal(1),\n  planRef: MetaWorkflow_OpaqueRefSchema,\n  /**\n   * Repeated from the plan so a consumer can bind a sealed selection to its\n   * exact objective and assessment scope without reopening a mutable plan.\n   */\n  objectiveRef: MetaWorkflow_NamespacedRefSchema,\n  assessmentSubjectRef: MetaWorkflow_NamespacedRefSchema,\n  scope: z.record(z.string().min(1), z.string().min(1)),\n  iterationOrdinal: positiveIntegerSchema,\n  stableKernelRef: MetaWorkflow_NamespacedRefSchema.optional(),\n  stableKernelDigest: MetaWorkflow_Sha256DigestSchema.optional(),\n  consumerKind: z.enum(MetaWorkflow_ContextSelectionConsumerKind),\n  selectedSources: z.array(MetaWorkflow_ContextSourceCandidateSchema),\n  /**\n   * Deterministic omissions AFTER acquisition. A missing or unusable MANDATORY\n   * source is never one of these: the selector refuses outright, because a\n   * model input that silently lacks required evidence is exactly the fabricated\n   * completeness this contract exists to prevent.\n   */\n  warnings: z.array(MetaWorkflow_ContextWarningSchema),\n}).superRefine((selection, context) => {\n  const selectedSourceRefs = selection.selectedSources.map((source) => source.sourceRef);\n  if (new Set(selectedSourceRefs).size !== selectedSourceRefs.length) {\n    context.addIssue({ code: 'custom', path: ['selectedSources'], message: 'selected source refs must be unique' });\n  }\n  const warningKeys = selection.warnings.map((warning) => `${warning.sourceRef}\\0${warning.reasonRef}`);\n  if (!metaWorkflowValuesAreUnique(warningKeys)) {\n    context.addIssue({ code: 'custom', path: ['warnings'], message: 'context warnings must be unique by source and reason' });\n  }\n  if (!metaWorkflowValuesAreLexicallySorted(warningKeys)) {\n    context.addIssue({ code: 'custom', path: ['warnings'], message: 'context warnings must be lexically sorted by source and reason' });\n  }\n});\nexport type MetaWorkflow_ContextSelection = z.infer<typeof MetaWorkflow_ContextSelectionSchema>;\n\n/**\n * Stable assessment semantics supplied by the host alongside a selected\n * context package. It intentionally carries only declared references and\n * deterministic facts/guidance: the Treatment remains the owner of exact\n * evaluator protocol, criterion wording and authority boundaries.\n */\n/** Deterministic finding outcome carried inside the stable assessment kernel. */\nexport enum MetaWorkflow_DeterministicFindingStatus {\n  PASSED = 'PASSED',\n  FAILED = 'FAILED',\n  NOT_EVALUABLE = 'NOT_EVALUABLE',\n}\n\nexport const MetaWorkflow_AssessmentStableKernelSchema = z.strictObject({\n  kernelRef: MetaWorkflow_NamespacedRefSchema,\n  kernelDigest: MetaWorkflow_Sha256DigestSchema,\n  declaredCriterionRefs: z.array(MetaWorkflow_NamespacedRefSchema).refine(metaWorkflowValuesAreUnique, 'declaredCriterionRefs must be unique').refine(metaWorkflowValuesAreLexicallySorted, 'declaredCriterionRefs must be lexically sorted'),\n  deterministicFindings: z.array(z.strictObject({\n    findingRef: MetaWorkflow_NamespacedRefSchema,\n    findingKindRef: MetaWorkflow_NamespacedRefSchema,\n    status: z.enum(MetaWorkflow_DeterministicFindingStatus),\n    evidenceRefs: z.array(MetaWorkflow_NamespacedRefSchema).refine(metaWorkflowValuesAreUnique, 'deterministic finding evidenceRefs must be unique').refine(metaWorkflowValuesAreLexicallySorted, 'deterministic finding evidenceRefs must be lexically sorted'),\n    rationale: z.string().trim().min(1),\n  })),\n  guidance: z.array(z.strictObject({\n    guidanceRef: MetaWorkflow_NamespacedRefSchema,\n    content: z.string().trim().min(1),\n  })),\n  effectiveExplorationBreadth: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),\n  revisionThreshold: unitIntervalSchema,\n});\n"]}
+{"version":3,"file":"context-selection.meta-workflows.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/flows-actors/meta-workflows/context-selection.meta-workflows.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,gCAAgC,EAChC,4BAA4B,EAC5B,kCAAkC,EAClC,oCAAoC,EACpC,2BAA2B,GAC5B,MAAM,qDAAqD,CAAC;AAE7D,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AACvF,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAE7D,kEAAkE;AAClE,MAAM,CAAN,IAAY,8BAIX;AAJD,WAAY,8BAA8B;IACxC,yDAAuB,CAAA;IACvB,6DAA2B,CAAA;IAC3B,uDAAqB,CAAA;AACvB,CAAC,EAJW,8BAA8B,KAA9B,8BAA8B,QAIzC;AAED,6DAA6D;AAC7D,MAAM,CAAN,IAAY,mCAIX;AAJD,WAAY,mCAAmC;IAC7C,0DAAmB,CAAA;IACnB,sDAAe,CAAA;IACf,0DAAmB,CAAA;AACrB,CAAC,EAJW,mCAAmC,KAAnC,mCAAmC,QAI9C;AAED,iFAAiF;AACjF,MAAM,CAAN,IAAY,oCAGX;AAHD,WAAY,oCAAoC;IAC9C,yEAAiC,CAAA;IACjC,iEAAyB,CAAA;AAC3B,CAAC,EAHW,oCAAoC,KAApC,oCAAoC,QAG/C;AAED,uGAAuG;AACvG,MAAM,CAAN,IAAY,yCAYX;AAZD,WAAY,yCAAyC;IACnD,kFAAqC,CAAA;IACrC;;;;;;;;OAQG;IACH,0EAA6B,CAAA;AAC/B,CAAC,EAZW,yCAAyC,KAAzC,yCAAyC,QAYpD;AAED,iGAAiG;AACjG,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,YAAY,CAAC;IACtE,SAAS,EAAE,gCAAgC;IAC3C,aAAa,EAAE,kCAAkC,CAAC,QAAQ,EAAE;IAC5D,SAAS,EAAE,gCAAgC;IAC3C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;IAC5C,SAAS,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACxC,eAAe,EAAE,qBAAqB;IACtC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC,QAAQ,EAAE;IACjE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC;IACxD,+BAA+B;IAC/B,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE;CAClB,CAAC,CAAC;AAGH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,2CAA2C,GAAG,CAAC,CAAC,YAAY,CAAC;IACxE,SAAS,EAAE,gCAAgC;IAC3C,gFAAgF;IAChF,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC;QACvB,mCAAmC,CAAC,OAAO;QAC3C,mCAAmC,CAAC,KAAK;KAC1C,CAAC;IACF,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;CAC7C,CAAC,CAAC;AAGH,yFAAyF;AACzF,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,SAAS,EAAE,gCAAgC;IAC3C,SAAS,EAAE,gCAAgC;CAC5C,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,YAAY,CAAC;IACpE,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,4BAA4B;IACrC,YAAY,EAAE,gCAAgC;IAC9C,oBAAoB,EAAE,gCAAgC;IACtD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrD,gBAAgB,EAAE,qBAAqB;IACvC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,yCAAyC,CAAC;IAC/D,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC;IACnF,kBAAkB,EAAE,qBAAqB;IACzC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7E,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,2CAA2C,CAAC;CACjF,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;IAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrF,IAAI,CAAC,2BAA2B,CAAC,aAAa,CAAC,EAAE,CAAC;QAChD,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;IACpH,CAAC;IACD,IAAI,CAAC,2BAA2B,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/C,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,4BAA4B,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;IAC7H,CAAC;IACD,IAAI,CAAC,oCAAoC,CAAC,YAAY,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,4BAA4B,CAAC,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC,CAAC;IACvI,CAAC;IACD,IAAI,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,8BAA8B,CAAC,SAAS,CAAC,EAAE,CAAC;QACzH,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,4BAA4B,CAAC,EAAE,OAAO,EAAE,gEAAgE,EAAE,CAAC,CAAC;IACxJ,CAAC;IACD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IAC/C,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,4BAA4B,CAAC,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC,CAAC;IAC5I,CAAC;IACD,IAAI,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC,0BAA0B,CAAC,MAAM,EAAE,CAAC;QACzE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,wBAAwB,CAAC,EAAE,OAAO,EAAE,uEAAuE,EAAE,CAAC,CAAC;IAC3J,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,YAAY,CAAC;IAChE,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,OAAO,EAAE,4BAA4B;IACrC;;;OAGG;IACH,YAAY,EAAE,gCAAgC;IAC9C,oBAAoB,EAAE,gCAAgC;IACtD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrD,gBAAgB,EAAE,qBAAqB;IACvC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,yCAAyC,CAAC;IAC/D,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,yCAAyC,CAAC;IACnE;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,iCAAiC,CAAC;CACrD,CAAC,CAAC,WAAW,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,EAAE;IACpC,MAAM,kBAAkB,GAAG,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvF,IAAI,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,MAAM,EAAE,CAAC;QACnE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,MAAM,WAAW,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACtG,IAAI,CAAC,2BAA2B,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9C,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC,CAAC;IAC5H,CAAC;IACD,IAAI,CAAC,oCAAoC,CAAC,WAAW,CAAC,EAAE,CAAC;QACvD,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,gEAAgE,EAAE,CAAC,CAAC;IACtI,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;;GAKG;AACH,iFAAiF;AACjF,MAAM,CAAN,IAAY,uCAIX;AAJD,WAAY,uCAAuC;IACjD,4DAAiB,CAAA;IACjB,4DAAiB,CAAA;IACjB,0EAA+B,CAAA;AACjC,CAAC,EAJW,uCAAuC,KAAvC,uCAAuC,QAIlD;AAED,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,YAAY,CAAC;IACtE,SAAS,EAAE,gCAAgC;IAC3C,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC,MAAM,CAAC,2BAA2B,EAAE,sCAAsC,CAAC,CAAC,MAAM,CAAC,oCAAoC,EAAE,gDAAgD,CAAC;IAC3O,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC;QAC5C,UAAU,EAAE,gCAAgC;QAC5C,cAAc,EAAE,gCAAgC;QAChD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC;QACvD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC,MAAM,CAAC,2BAA2B,EAAE,mDAAmD,CAAC,CAAC,MAAM,CAAC,oCAAoC,EAAE,6DAA6D,CAAC;QAC5P,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACpC,CAAC,CAAC;IACH,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC;QAC/B,WAAW,EAAE,gCAAgC;QAC7C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAClC,CAAC,CAAC;IACH,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC;IACxF,iBAAiB,EAAE,kBAAkB;CACtC,CAAC,CAAC","sourcesContent":["import { z } from 'zod';\n\nimport {\n  MetaWorkflow_NamespacedRefSchema,\n  MetaWorkflow_OpaqueRefSchema,\n  MetaWorkflow_PositiveVersionSchema,\n  metaWorkflowValuesAreLexicallySorted,\n  metaWorkflowValuesAreUnique,\n} from './portable-primitives.meta-workflows.shared.schemas';\n\nconst positiveIntegerSchema = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);\nconst unitIntervalSchema = z.number().finite().min(0).max(1);\n\n/** Why a source participates in a semantic assessment package. */\nexport enum MetaWorkflow_ContextSourceRole {\n  MANDATORY = 'MANDATORY',\n  CONDITIONAL = 'CONDITIONAL',\n  ADVISORY = 'ADVISORY',\n}\n\n/** Freshness is source evidence, never a model inference. */\nexport enum MetaWorkflow_ContextSourceFreshness {\n  CURRENT = 'CURRENT',\n  STALE = 'STALE',\n  UNKNOWN = 'UNKNOWN',\n}\n\n/** Disclosure safety is decided by the source adapter before prompt assembly. */\nexport enum MetaWorkflow_ContextSourceDisclosure {\n  SAFE_FOR_MODEL = 'SAFE_FOR_MODEL',\n  RESTRICTED = 'RESTRICTED',\n}\n\n/** Who the assembled context is FOR. The consumer decides what may travel and what a mistake costs. */\nexport enum MetaWorkflow_ContextSelectionConsumerKind {\n  ASSESSMENT_INPUT = 'ASSESSMENT_INPUT',\n  /**\n   * Context assembled for a CODING AGENT that will mutate the application workspace.\n   *\n   * Deliberately not folded into `ASSESSMENT_INPUT`. The two consumers differ in what the context is FOR and\n   * in what a mistake costs: an assessment input feeds a judgement that produces a finding, while this feeds\n   * a run that writes files into a developer's source tree. They also differ in what may travel — the\n   * application coding-task contract refuses any source that is not `SAFE_FOR_MODEL`, because its content is\n   * rendered verbatim into the agent prompt.\n   */\n  CODING_AGENT = 'CODING_AGENT',\n}\n\n/** One acquired context source offered to the selector. `content` is portable JSON data only. */\nexport const MetaWorkflow_ContextSourceCandidateSchema = z.strictObject({\n  sourceRef: MetaWorkflow_NamespacedRefSchema,\n  sourceVersion: MetaWorkflow_PositiveVersionSchema.optional(),\n  originRef: MetaWorkflow_NamespacedRefSchema,\n  role: z.enum(MetaWorkflow_ContextSourceRole),\n  relevance: unitIntervalSchema.optional(),\n  estimatedTokens: positiveIntegerSchema,\n  freshness: z.enum(MetaWorkflow_ContextSourceFreshness).optional(),\n  disclosure: z.enum(MetaWorkflow_ContextSourceDisclosure),\n  /** Portable JSON data only. */\n  content: z.json(),\n});\nexport type MetaWorkflow_ContextSourceCandidate = z.infer<typeof MetaWorkflow_ContextSourceCandidateSchema>;\n\n/** Declared requirement: no planner or curator may remove this source role. */\nexport const MetaWorkflow_ContextSourceRequirementSchema = z.strictObject({\n  sourceRef: MetaWorkflow_NamespacedRefSchema,\n  /** Unknown freshness is never admissible for model-visible required context. */\n  minimumFreshness: z.enum([\n    MetaWorkflow_ContextSourceFreshness.CURRENT,\n    MetaWorkflow_ContextSourceFreshness.STALE,\n  ]),\n  role: z.enum(MetaWorkflow_ContextSourceRole),\n});\nexport type MetaWorkflow_ContextSourceRequirement = z.infer<typeof MetaWorkflow_ContextSourceRequirementSchema>;\n\n/** One deterministic omission recorded after acquisition, keyed by source and reason. */\nexport const MetaWorkflow_ContextWarningSchema = z.strictObject({\n  sourceRef: MetaWorkflow_NamespacedRefSchema,\n  reasonRef: MetaWorkflow_NamespacedRefSchema,\n});\nexport type MetaWorkflow_ContextWarning = z.infer<typeof MetaWorkflow_ContextWarningSchema>;\n\n/**\n * Bounded, source-grounded selection instruction for one assessment iteration.\n * It deliberately carries no filesystem, companion, Git, or application-family\n * concepts; those belong to the host adapter which supplies candidates.\n */\nexport const MetaWorkflow_ContextSelectionPlanSchema = z.strictObject({\n  schemaVersion: z.literal(1),\n  planRef: MetaWorkflow_OpaqueRefSchema,\n  objectiveRef: MetaWorkflow_NamespacedRefSchema,\n  assessmentSubjectRef: MetaWorkflow_NamespacedRefSchema,\n  scope: z.record(z.string().min(1), z.string().min(1)),\n  iterationOrdinal: positiveIntegerSchema,\n  consumerKind: z.enum(MetaWorkflow_ContextSelectionConsumerKind),\n  maximumOptionalSources: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),\n  maximumTokenBudget: positiveIntegerSchema,\n  mandatorySources: z.array(MetaWorkflow_ContextSourceRequirementSchema).min(1),\n  optionalSourceRequirements: z.array(MetaWorkflow_ContextSourceRequirementSchema),\n}).superRefine((plan, context) => {\n  const mandatoryRefs = plan.mandatorySources.map((entry) => entry.sourceRef);\n  const optionalRefs = plan.optionalSourceRequirements.map((entry) => entry.sourceRef);\n  if (!metaWorkflowValuesAreUnique(mandatoryRefs)) {\n    context.addIssue({ code: 'custom', path: ['mandatorySources'], message: 'mandatory source refs must be unique' });\n  }\n  if (!metaWorkflowValuesAreUnique(optionalRefs)) {\n    context.addIssue({ code: 'custom', path: ['optionalSourceRequirements'], message: 'optional source refs must be unique' });\n  }\n  if (!metaWorkflowValuesAreLexicallySorted(optionalRefs)) {\n    context.addIssue({ code: 'custom', path: ['optionalSourceRequirements'], message: 'optional source refs must be lexically sorted' });\n  }\n  if (plan.optionalSourceRequirements.some((requirement) => requirement.role === MetaWorkflow_ContextSourceRole.MANDATORY)) {\n    context.addIssue({ code: 'custom', path: ['optionalSourceRequirements'], message: 'optional source requirements cannot declare the mandatory role' });\n  }\n  const mandatoryRefSet = new Set(mandatoryRefs);\n  if (optionalRefs.some((sourceRef) => mandatoryRefSet.has(sourceRef))) {\n    context.addIssue({ code: 'custom', path: ['optionalSourceRequirements'], message: 'a source ref cannot be both mandatory and optional' });\n  }\n  if (plan.maximumOptionalSources > plan.optionalSourceRequirements.length) {\n    context.addIssue({ code: 'custom', path: ['maximumOptionalSources'], message: 'optional-source capacity cannot exceed declared optional requirements' });\n  }\n});\nexport type MetaWorkflow_ContextSelectionPlan = z.infer<typeof MetaWorkflow_ContextSelectionPlanSchema>;\n\nexport const MetaWorkflow_ContextSelectionSchema = z.strictObject({\n  schemaVersion: z.literal(1),\n  planRef: MetaWorkflow_OpaqueRefSchema,\n  /**\n   * Repeated from the plan so a consumer can bind a sealed selection to its\n   * exact objective and assessment scope without reopening a mutable plan.\n   */\n  objectiveRef: MetaWorkflow_NamespacedRefSchema,\n  assessmentSubjectRef: MetaWorkflow_NamespacedRefSchema,\n  scope: z.record(z.string().min(1), z.string().min(1)),\n  iterationOrdinal: positiveIntegerSchema,\n  consumerKind: z.enum(MetaWorkflow_ContextSelectionConsumerKind),\n  selectedSources: z.array(MetaWorkflow_ContextSourceCandidateSchema),\n  /**\n   * Deterministic omissions AFTER acquisition. A missing or unusable MANDATORY\n   * source is never one of these: the selector refuses outright, because a\n   * model input that silently lacks required evidence is exactly the fabricated\n   * completeness this contract exists to prevent.\n   */\n  warnings: z.array(MetaWorkflow_ContextWarningSchema),\n}).superRefine((selection, context) => {\n  const selectedSourceRefs = selection.selectedSources.map((source) => source.sourceRef);\n  if (new Set(selectedSourceRefs).size !== selectedSourceRefs.length) {\n    context.addIssue({ code: 'custom', path: ['selectedSources'], message: 'selected source refs must be unique' });\n  }\n  const warningKeys = selection.warnings.map((warning) => `${warning.sourceRef}\\0${warning.reasonRef}`);\n  if (!metaWorkflowValuesAreUnique(warningKeys)) {\n    context.addIssue({ code: 'custom', path: ['warnings'], message: 'context warnings must be unique by source and reason' });\n  }\n  if (!metaWorkflowValuesAreLexicallySorted(warningKeys)) {\n    context.addIssue({ code: 'custom', path: ['warnings'], message: 'context warnings must be lexically sorted by source and reason' });\n  }\n});\nexport type MetaWorkflow_ContextSelection = z.infer<typeof MetaWorkflow_ContextSelectionSchema>;\n\n/**\n * Stable assessment semantics supplied by the host alongside a selected\n * context package. It intentionally carries only declared references and\n * deterministic facts/guidance: the Treatment remains the owner of exact\n * evaluator protocol, criterion wording and authority boundaries.\n */\n/** Deterministic finding outcome carried inside the stable assessment kernel. */\nexport enum MetaWorkflow_DeterministicFindingStatus {\n  PASSED = 'PASSED',\n  FAILED = 'FAILED',\n  NOT_EVALUABLE = 'NOT_EVALUABLE',\n}\n\nexport const MetaWorkflow_AssessmentStableKernelSchema = z.strictObject({\n  kernelRef: MetaWorkflow_NamespacedRefSchema,\n  declaredCriterionRefs: z.array(MetaWorkflow_NamespacedRefSchema).refine(metaWorkflowValuesAreUnique, 'declaredCriterionRefs must be unique').refine(metaWorkflowValuesAreLexicallySorted, 'declaredCriterionRefs must be lexically sorted'),\n  deterministicFindings: z.array(z.strictObject({\n    findingRef: MetaWorkflow_NamespacedRefSchema,\n    findingKindRef: MetaWorkflow_NamespacedRefSchema,\n    status: z.enum(MetaWorkflow_DeterministicFindingStatus),\n    evidenceRefs: z.array(MetaWorkflow_NamespacedRefSchema).refine(metaWorkflowValuesAreUnique, 'deterministic finding evidenceRefs must be unique').refine(metaWorkflowValuesAreLexicallySorted, 'deterministic finding evidenceRefs must be lexically sorted'),\n    rationale: z.string().trim().min(1),\n  })),\n  guidance: z.array(z.strictObject({\n    guidanceRef: MetaWorkflow_NamespacedRefSchema,\n    content: z.string().trim().min(1),\n  })),\n  effectiveExplorationBreadth: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),\n  revisionThreshold: unitIntervalSchema,\n});\n"]}

package/dist/esm/flows-actors/meta-workflows/decisions.meta-workflows.shared.schemas.d.ts

@@ -282,9 +282,9 @@ export type MetaWorkflow_ContinuationPolicy = z.infer<typeof _MetaWorkflow_Conti
  * One self-contained executable decision treatment.
  *
  * Every member is carried in full so a catalog artifact has no ambient
- * semantic dependency. The backend integrity validator recomputes each nested
- * identity and checks that the Decision Point identities refer to these exact
- * members.
+ * semantic dependency. Referential coherence (a Decision Point naming only
+ * members carried here) is checked structurally by the schema refinements
+ * below; no identity is recomputed or compared against a stored digest.
  */
 declare const _MetaWorkflow_EvaluationTreatmentDefinitionSchema: z.ZodObject<{
     schemaVersion: z.ZodLiteral<1>;

package/dist/esm/flows-actors/meta-workflows/decisions.meta-workflows.shared.schemas.js

@@ -547,9 +547,9 @@ const _MetaWorkflow_ContinuationPolicySchema = z
  * One self-contained executable decision treatment.
  *
  * Every member is carried in full so a catalog artifact has no ambient
- * semantic dependency. The backend integrity validator recomputes each nested
- * identity and checks that the Decision Point identities refer to these exact
- * members.
+ * semantic dependency. Referential coherence (a Decision Point naming only
+ * members carried here) is checked structurally by the schema refinements
+ * below; no identity is recomputed or compared against a stored digest.
  */
 const _MetaWorkflow_EvaluationTreatmentDefinitionSchema = z
     .strictObject({