@xemahq/agent-session-runtime 0.6.7 → 0.7.0

package/src/lib/launch-identity/runtime-template-key.ts

@@ -0,0 +1,148 @@
+import {
+  assertNoTenantOrSecretTemplateFields,
+  canonicalContractJson,
+  hashCanonicalContract,
+  requireEnumValue,
+  requireExactObject,
+  requireNonEmptyString,
+  requireSha256,
+} from './canonical-contract';
+
+export enum RuntimeTemplateTenantDependency {
+  OrganizationNeutral = 'organization-neutral',
+  OrganizationBound = 'organization-bound',
+}
+
+export enum RuntimeTemplateTrustPolicy {
+  Shared = 'shared',
+  Dedicated = 'dedicated',
+  Confidential = 'confidential',
+}
+
+export interface RuntimeTemplateKey {
+  readonly schemaVersion: 1;
+  readonly tenantDependency: RuntimeTemplateTenantDependency;
+  readonly trustPolicy: RuntimeTemplateTrustPolicy;
+  readonly runtimeRef: string;
+  readonly runtimeRevision: string;
+  readonly imageDigest: string;
+  readonly agentRevision: string;
+  readonly primaryAgentHash: string;
+  readonly subagentsHash: string;
+  readonly skillsHash: string;
+  readonly toolsHash: string;
+  readonly capabilityDescriptorsHash: string;
+  readonly mcpDescriptorsHash: string;
+  readonly workspacePlanHash: string;
+  readonly layoutProfile: string;
+}
+
+const REQUIRED_KEYS = [
+  'schemaVersion',
+  'tenantDependency',
+  'trustPolicy',
+  'runtimeRef',
+  'runtimeRevision',
+  'imageDigest',
+  'agentRevision',
+  'primaryAgentHash',
+  'subagentsHash',
+  'skillsHash',
+  'toolsHash',
+  'capabilityDescriptorsHash',
+  'mcpDescriptorsHash',
+  'workspacePlanHash',
+  'layoutProfile',
+] as const;
+
+const TENANT_DEPENDENCIES = Object.values(RuntimeTemplateTenantDependency);
+const TRUST_POLICIES = Object.values(RuntimeTemplateTrustPolicy);
+const IMAGE_DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/u;
+
+/**
+ * Validates and canonicalizes the immutable execution dimensions used to
+ * select warm compute. Tenant, invocation and credential data have no valid
+ * slot in this contract and are rejected even when supplied as extra fields.
+ */
+export function createRuntimeTemplateKey(input: unknown): RuntimeTemplateKey {
+  assertNoTenantOrSecretTemplateFields(input, 'RuntimeTemplateKey');
+  const object = requireExactObject(input, 'RuntimeTemplateKey', REQUIRED_KEYS);
+
+  if (object.schemaVersion !== 1) {
+    throw new TypeError('RuntimeTemplateKey.schemaVersion must be 1.');
+  }
+
+  const imageDigest = requireNonEmptyString(
+    object.imageDigest,
+    'RuntimeTemplateKey.imageDigest',
+  );
+  if (!IMAGE_DIGEST_PATTERN.test(imageDigest)) {
+    throw new TypeError(
+      'RuntimeTemplateKey.imageDigest must be an immutable sha256 image digest.',
+    );
+  }
+
+  return Object.freeze({
+    schemaVersion: 1,
+    tenantDependency: requireEnumValue(
+      object.tenantDependency,
+      'RuntimeTemplateKey.tenantDependency',
+      TENANT_DEPENDENCIES,
+    ),
+    trustPolicy: requireEnumValue(
+      object.trustPolicy,
+      'RuntimeTemplateKey.trustPolicy',
+      TRUST_POLICIES,
+    ),
+    runtimeRef: requireNonEmptyString(
+      object.runtimeRef,
+      'RuntimeTemplateKey.runtimeRef',
+    ),
+    runtimeRevision: requireNonEmptyString(
+      object.runtimeRevision,
+      'RuntimeTemplateKey.runtimeRevision',
+    ),
+    imageDigest,
+    agentRevision: requireNonEmptyString(
+      object.agentRevision,
+      'RuntimeTemplateKey.agentRevision',
+    ),
+    primaryAgentHash: requireSha256(
+      object.primaryAgentHash,
+      'RuntimeTemplateKey.primaryAgentHash',
+    ),
+    subagentsHash: requireSha256(
+      object.subagentsHash,
+      'RuntimeTemplateKey.subagentsHash',
+    ),
+    skillsHash: requireSha256(
+      object.skillsHash,
+      'RuntimeTemplateKey.skillsHash',
+    ),
+    toolsHash: requireSha256(object.toolsHash, 'RuntimeTemplateKey.toolsHash'),
+    capabilityDescriptorsHash: requireSha256(
+      object.capabilityDescriptorsHash,
+      'RuntimeTemplateKey.capabilityDescriptorsHash',
+    ),
+    mcpDescriptorsHash: requireSha256(
+      object.mcpDescriptorsHash,
+      'RuntimeTemplateKey.mcpDescriptorsHash',
+    ),
+    workspacePlanHash: requireSha256(
+      object.workspacePlanHash,
+      'RuntimeTemplateKey.workspacePlanHash',
+    ),
+    layoutProfile: requireNonEmptyString(
+      object.layoutProfile,
+      'RuntimeTemplateKey.layoutProfile',
+    ),
+  });
+}
+
+export function serializeRuntimeTemplateKey(input: RuntimeTemplateKey): string {
+  return canonicalContractJson(createRuntimeTemplateKey(input));
+}
+
+export function hashRuntimeTemplateKey(input: RuntimeTemplateKey): string {
+  return hashCanonicalContract(createRuntimeTemplateKey(input));
+}

package/src/lib/launch-identity/session-binding.ts

@@ -0,0 +1,152 @@
+import {
+  canonicalContractJson,
+  type CanonicalJsonValue,
+  hashCanonicalContract,
+  type ResourceBindingRef,
+  requireExactObject,
+  requireNonEmptyString,
+  requireNonNegativeSafeInteger,
+  requireResourceBindingRefs,
+  requireSecretFreeJsonObject,
+  requireStringRefs,
+} from './canonical-contract';
+
+export interface SessionBinding {
+  readonly schemaVersion: 1;
+  readonly sessionId: string;
+  readonly organizationId: string;
+  readonly projectId: string;
+  readonly userId: string;
+  readonly domainRefs: readonly ResourceBindingRef[];
+  readonly storageAllocationRef: string;
+  readonly workingFileSourceRefs: readonly string[];
+  readonly outputRouteRef: string;
+  readonly actorTokenRef?: string;
+  readonly serviceTokenRef?: string;
+  readonly providerTokenRefs: readonly string[];
+  readonly credentialGrantRefs: readonly string[];
+  readonly databaseGrantRefs: readonly string[];
+  readonly dynamicContext: Readonly<Record<string, CanonicalJsonValue>>;
+  readonly bindingRevision: string;
+  readonly bindingEpoch: number;
+}
+
+const REQUIRED_KEYS = [
+  'schemaVersion',
+  'sessionId',
+  'organizationId',
+  'projectId',
+  'userId',
+  'domainRefs',
+  'storageAllocationRef',
+  'workingFileSourceRefs',
+  'outputRouteRef',
+  'providerTokenRefs',
+  'credentialGrantRefs',
+  'databaseGrantRefs',
+  'dynamicContext',
+  'bindingRevision',
+  'bindingEpoch',
+] as const;
+
+const OPTIONAL_KEYS = ['actorTokenRef', 'serviceTokenRef'] as const;
+
+/**
+ * Canonical tenant/session state applied atomically after a runtime claim.
+ * Credentials are represented only by opaque refs; raw secrets are rejected
+ * from dynamicContext.
+ */
+export function createSessionBinding(input: unknown): SessionBinding {
+  const object = requireExactObject(
+    input,
+    'SessionBinding',
+    REQUIRED_KEYS,
+    OPTIONAL_KEYS,
+  );
+
+  if (object.schemaVersion !== 1) {
+    throw new TypeError('SessionBinding.schemaVersion must be 1.');
+  }
+
+  const actorTokenRef =
+    object.actorTokenRef === undefined
+      ? undefined
+      : requireNonEmptyString(
+          object.actorTokenRef,
+          'SessionBinding.actorTokenRef',
+        );
+  const serviceTokenRef =
+    object.serviceTokenRef === undefined
+      ? undefined
+      : requireNonEmptyString(
+          object.serviceTokenRef,
+          'SessionBinding.serviceTokenRef',
+        );
+
+  return Object.freeze({
+    schemaVersion: 1,
+    sessionId: requireNonEmptyString(
+      object.sessionId,
+      'SessionBinding.sessionId',
+    ),
+    organizationId: requireNonEmptyString(
+      object.organizationId,
+      'SessionBinding.organizationId',
+    ),
+    projectId: requireNonEmptyString(
+      object.projectId,
+      'SessionBinding.projectId',
+    ),
+    userId: requireNonEmptyString(object.userId, 'SessionBinding.userId'),
+    domainRefs: requireResourceBindingRefs(
+      object.domainRefs,
+      'SessionBinding.domainRefs',
+    ),
+    storageAllocationRef: requireNonEmptyString(
+      object.storageAllocationRef,
+      'SessionBinding.storageAllocationRef',
+    ),
+    workingFileSourceRefs: requireStringRefs(
+      object.workingFileSourceRefs,
+      'SessionBinding.workingFileSourceRefs',
+    ),
+    outputRouteRef: requireNonEmptyString(
+      object.outputRouteRef,
+      'SessionBinding.outputRouteRef',
+    ),
+    ...(actorTokenRef === undefined ? {} : { actorTokenRef }),
+    ...(serviceTokenRef === undefined ? {} : { serviceTokenRef }),
+    providerTokenRefs: requireStringRefs(
+      object.providerTokenRefs,
+      'SessionBinding.providerTokenRefs',
+    ),
+    credentialGrantRefs: requireStringRefs(
+      object.credentialGrantRefs,
+      'SessionBinding.credentialGrantRefs',
+    ),
+    databaseGrantRefs: requireStringRefs(
+      object.databaseGrantRefs,
+      'SessionBinding.databaseGrantRefs',
+    ),
+    dynamicContext: requireSecretFreeJsonObject(
+      object.dynamicContext,
+      'SessionBinding.dynamicContext',
+    ),
+    bindingRevision: requireNonEmptyString(
+      object.bindingRevision,
+      'SessionBinding.bindingRevision',
+    ),
+    bindingEpoch: requireNonNegativeSafeInteger(
+      object.bindingEpoch,
+      'SessionBinding.bindingEpoch',
+    ),
+  });
+}
+
+export function serializeSessionBinding(input: SessionBinding): string {
+  return canonicalContractJson(createSessionBinding(input));
+}
+
+export function hashSessionBinding(input: SessionBinding): string {
+  return hashCanonicalContract(createSessionBinding(input));
+}

package/src/lib/launch-identity/thread-reuse-key.ts

@@ -0,0 +1,93 @@
+import {
+  canonicalContractJson,
+  hashCanonicalContract,
+  type ResourceBindingRef,
+  requireEnumValue,
+  requireExactObject,
+  requireNonEmptyString,
+  requireResourceBindingRefs,
+  requireSha256,
+} from './canonical-contract';
+
+export enum ThreadReusePolicy {
+  ExplicitlyShareable = 'explicitly-shareable',
+}
+
+export interface ThreadReuseKey {
+  readonly schemaVersion: 1;
+  readonly reusePolicy: ThreadReusePolicy.ExplicitlyShareable;
+  readonly organizationId: string;
+  readonly projectId: string;
+  readonly userId: string;
+  readonly runtimeTemplateHash: string;
+  readonly conversationRef: string;
+  readonly workspaceRef: string;
+  readonly domainRefs: readonly ResourceBindingRef[];
+}
+
+const REQUIRED_KEYS = [
+  'schemaVersion',
+  'reusePolicy',
+  'organizationId',
+  'projectId',
+  'userId',
+  'runtimeTemplateHash',
+  'conversationRef',
+  'workspaceRef',
+  'domainRefs',
+] as const;
+
+/**
+ * Canonical identity for the deliberately narrower same-user conversation and
+ * filesystem reuse decision. A RuntimeTemplateKey match alone never permits
+ * Thread reuse.
+ */
+export function createThreadReuseKey(input: unknown): ThreadReuseKey {
+  const object = requireExactObject(input, 'ThreadReuseKey', REQUIRED_KEYS);
+
+  if (object.schemaVersion !== 1) {
+    throw new TypeError('ThreadReuseKey.schemaVersion must be 1.');
+  }
+
+  return Object.freeze({
+    schemaVersion: 1,
+    reusePolicy: requireEnumValue(
+      object.reusePolicy,
+      'ThreadReuseKey.reusePolicy',
+      [ThreadReusePolicy.ExplicitlyShareable],
+    ),
+    organizationId: requireNonEmptyString(
+      object.organizationId,
+      'ThreadReuseKey.organizationId',
+    ),
+    projectId: requireNonEmptyString(
+      object.projectId,
+      'ThreadReuseKey.projectId',
+    ),
+    userId: requireNonEmptyString(object.userId, 'ThreadReuseKey.userId'),
+    runtimeTemplateHash: requireSha256(
+      object.runtimeTemplateHash,
+      'ThreadReuseKey.runtimeTemplateHash',
+    ),
+    conversationRef: requireNonEmptyString(
+      object.conversationRef,
+      'ThreadReuseKey.conversationRef',
+    ),
+    workspaceRef: requireNonEmptyString(
+      object.workspaceRef,
+      'ThreadReuseKey.workspaceRef',
+    ),
+    domainRefs: requireResourceBindingRefs(
+      object.domainRefs,
+      'ThreadReuseKey.domainRefs',
+    ),
+  });
+}
+
+export function serializeThreadReuseKey(input: ThreadReuseKey): string {
+  return canonicalContractJson(createThreadReuseKey(input));
+}
+
+export function hashThreadReuseKey(input: ThreadReuseKey): string {
+  return hashCanonicalContract(createThreadReuseKey(input));
+}

package/dist/lib/composition-resolution.d.ts

@@ -1,43 +0,0 @@
-import { type ModelRef, type NodeOverlayFragment, type SubAgentBinding } from '@xemahq/kernel-contracts/workflow';
-import type { ResolvedAgent, ResolvedAgentNode } from '@xemahq/kernel-contracts/agent-composition';
-import type { PermissionMap } from '@xemahq/kernel-contracts/agent-permission';
-import { type ToolSelectionEntry } from '@xemahq/kernel-contracts/mcp-tool';
-export declare class AgentResolutionError extends Error {
-    constructor(context: string, detail: string);
-}
-export interface FlattenedAgentNode {
-    readonly slug: string;
-    readonly alias?: string;
-    readonly modelOverride?: ModelRef;
-    readonly instructions?: string;
-    readonly permission?: PermissionMap;
-}
-export interface CollectScopeOptions {
-    readonly scope?: 'tree' | 'root';
-}
-export interface RuntimeAgentConfig {
-    readonly agentRef: string;
-    readonly primaryAgentSlug: string;
-    readonly primaryInstructions: string | null;
-    readonly primaryPermission: PermissionMap | null;
-    readonly primaryModelOverride: ModelRef | null;
-    readonly subAgentBindings: readonly SubAgentBinding[];
-    readonly subAgentInstructionsBySlug: Readonly<Record<string, string>>;
-    readonly subAgentPermissionBySlug: Readonly<Record<string, PermissionMap>>;
-    readonly subAgentModelOverridesBySlug: Readonly<Record<string, ModelRef>>;
-    readonly defaultSkillSlugs: readonly string[];
-    readonly allSkillSlugs: readonly string[];
-    readonly defaultToolSelection: readonly ToolSelectionEntry[];
-}
-export declare function flattenAgentTree(root: ResolvedAgentNode): readonly FlattenedAgentNode[];
-export declare function collectSkills(root: ResolvedAgentNode, opts?: CollectScopeOptions): readonly string[];
-export declare function collectTools(root: ResolvedAgentNode, opts?: CollectScopeOptions): readonly ToolSelectionEntry[];
-export declare function collectInstructionsBySlug(root: ResolvedAgentNode): Readonly<Record<string, string>>;
-export declare function collectPermissionsBySlug(root: ResolvedAgentNode): Readonly<Record<string, PermissionMap>>;
-export declare function collectModelOverridesBySlug(root: ResolvedAgentNode): Readonly<Record<string, ModelRef>>;
-export declare function appendInstructions(baseSystemPrompt: string, nodeInstructions: string | null): string;
-export declare function normalizeInstructions(raw: string | undefined): string | null;
-export declare function normalizePermission(raw: PermissionMap | undefined): PermissionMap | null;
-export declare function projectModelOverride(raw: ModelRef | undefined, context: string): ModelRef | null;
-export declare function projectAgentToRuntimeConfig(resolved: ResolvedAgent, overlay?: NodeOverlayFragment): RuntimeAgentConfig;
-//# sourceMappingURL=composition-resolution.d.ts.map

package/dist/lib/composition-resolution.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"composition-resolution.d.ts","sourceRoot":"","sources":["../../src/lib/composition-resolution.ts"],"names":[],"mappings":"AA4BA,OAAO,EAIL,KAAK,QAAQ,EACb,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EACV,aAAa,EACb,iBAAiB,EAClB,MAAM,4CAA4C,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,mCAAmC,CAAC;AAU3C,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAI5C;AAWD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;CACrC;AAGD,MAAM,WAAW,mBAAmB;IAKlC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CAClC;AAOD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAElC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAE5C,QAAQ,CAAC,iBAAiB,EAAE,aAAa,GAAG,IAAI,CAAC;IAEjD,QAAQ,CAAC,oBAAoB,EAAE,QAAQ,GAAG,IAAI,CAAC;IAE/C,QAAQ,CAAC,gBAAgB,EAAE,SAAS,eAAe,EAAE,CAAC;IACtD,QAAQ,CAAC,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtE,QAAQ,CAAC,wBAAwB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;IAC3E,QAAQ,CAAC,4BAA4B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE1E,QAAQ,CAAC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IAE9C,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAE1C,QAAQ,CAAC,oBAAoB,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAC9D;AAaD,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,iBAAiB,GACtB,SAAS,kBAAkB,EAAE,CA0B/B;AAQD,wBAAgB,aAAa,CAC3B,IAAI,EAAE,iBAAiB,EACvB,IAAI,CAAC,EAAE,mBAAmB,GACzB,SAAS,MAAM,EAAE,CAuBnB;AAQD,wBAAgB,YAAY,CAC1B,IAAI,EAAE,iBAAiB,EACvB,IAAI,CAAC,EAAE,mBAAmB,GACzB,SAAS,kBAAkB,EAAE,CAe/B;AAOD,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,iBAAiB,GACtB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAIlC;AAMD,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,iBAAiB,GACtB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAIzC;AAOD,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,iBAAiB,GACtB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAIpC;AA2CD,wBAAgB,kBAAkB,CAChC,gBAAgB,EAAE,MAAM,EACxB,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAC9B,MAAM,CAWR;AAWD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAM5E;AAQD,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,aAAa,GAAG,SAAS,GAC7B,aAAa,GAAG,IAAI,CAKtB;AAOD,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,QAAQ,GAAG,SAAS,EACzB,OAAO,EAAE,MAAM,GACd,QAAQ,GAAG,IAAI,CA4BjB;AAqGD,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,kBAAkB,CAyCpB"}

package/dist/lib/composition-resolution.js

@@ -1,236 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AgentResolutionError = void 0;
-exports.flattenAgentTree = flattenAgentTree;
-exports.collectSkills = collectSkills;
-exports.collectTools = collectTools;
-exports.collectInstructionsBySlug = collectInstructionsBySlug;
-exports.collectPermissionsBySlug = collectPermissionsBySlug;
-exports.collectModelOverridesBySlug = collectModelOverridesBySlug;
-exports.appendInstructions = appendInstructions;
-exports.normalizeInstructions = normalizeInstructions;
-exports.normalizePermission = normalizePermission;
-exports.projectModelOverride = projectModelOverride;
-exports.projectAgentToRuntimeConfig = projectAgentToRuntimeConfig;
-const workflow_1 = require("@xemahq/kernel-contracts/workflow");
-const mcp_tool_1 = require("@xemahq/kernel-contracts/mcp-tool");
-class AgentResolutionError extends Error {
-    constructor(context, detail) {
-        super(`Agent resolution failed for "${context}": ${detail}`);
-        this.name = 'AgentResolutionError';
-    }
-}
-exports.AgentResolutionError = AgentResolutionError;
-function flattenAgentTree(root) {
-    const seen = new Set();
-    const out = [];
-    const visit = (node) => {
-        for (const child of node.children) {
-            const slug = child.kernel.slug;
-            if (slug.length === 0) {
-                continue;
-            }
-            if (!seen.has(slug)) {
-                seen.add(slug);
-                out.push({
-                    slug,
-                    ...(child.alias ? { alias: child.alias } : {}),
-                    ...(child.modelOverride
-                        ? { modelOverride: child.modelOverride }
-                        : {}),
-                    ...(child.instructions ? { instructions: child.instructions } : {}),
-                    ...(child.permission ? { permission: child.permission } : {}),
-                });
-            }
-            visit(child);
-        }
-    };
-    visit(root);
-    return out;
-}
-function collectSkills(root, opts) {
-    const scope = opts?.scope ?? 'tree';
-    const seen = new Set();
-    const out = [];
-    const addNode = (node) => {
-        for (const slug of projectSkillSlugs(node.skills)) {
-            if (!seen.has(slug)) {
-                seen.add(slug);
-                out.push(slug);
-            }
-        }
-    };
-    addNode(root);
-    if (scope === 'tree') {
-        const visit = (node) => {
-            for (const child of node.children) {
-                addNode(child);
-                visit(child);
-            }
-        };
-        visit(root);
-    }
-    return out;
-}
-function collectTools(root, opts) {
-    const scope = opts?.scope ?? 'root';
-    const ctx = root.kernel.slug;
-    if (scope === 'root') {
-        return projectToolSelection(root.tools, ctx);
-    }
-    const out = [...projectToolSelection(root.tools, ctx)];
-    const visit = (node) => {
-        for (const child of node.children) {
-            out.push(...projectToolSelection(child.tools, child.kernel.slug));
-            visit(child);
-        }
-    };
-    visit(root);
-    return out;
-}
-function collectInstructionsBySlug(root) {
-    return collectDescendantOverlay(root, (child) => normalizeInstructions(child.instructions));
-}
-function collectPermissionsBySlug(root) {
-    return collectDescendantOverlay(root, (child) => normalizePermission(child.permission));
-}
-function collectModelOverridesBySlug(root) {
-    return collectDescendantOverlay(root, (child) => projectModelOverride(child.modelOverride, child.kernel.slug));
-}
-function collectDescendantOverlay(root, project) {
-    const out = {};
-    const seen = new Set();
-    const visit = (node) => {
-        for (const child of node.children) {
-            const slug = child.kernel.slug;
-            if (slug.length === 0) {
-                continue;
-            }
-            if (!seen.has(slug)) {
-                seen.add(slug);
-                const value = project(child);
-                if (value !== null) {
-                    out[slug] = value;
-                }
-            }
-            visit(child);
-        }
-    };
-    visit(root);
-    return out;
-}
-function appendInstructions(baseSystemPrompt, nodeInstructions) {
-    const trimmed = nodeInstructions === null ? '' : nodeInstructions.trim();
-    if (trimmed.length === 0) {
-        return baseSystemPrompt;
-    }
-    if (baseSystemPrompt.length === 0) {
-        return trimmed;
-    }
-    return `${baseSystemPrompt}\n\n${trimmed}`;
-}
-function normalizeInstructions(raw) {
-    if (typeof raw !== 'string') {
-        return null;
-    }
-    const trimmed = raw.trim();
-    return trimmed.length > 0 ? trimmed : null;
-}
-function normalizePermission(raw) {
-    if (!raw || typeof raw !== 'object' || Object.keys(raw).length === 0) {
-        return null;
-    }
-    return raw;
-}
-function projectModelOverride(raw, context) {
-    if (raw === undefined) {
-        return null;
-    }
-    if (raw.kind === workflow_1.ModelRefKind.CONCRETE) {
-        if (typeof raw.modelId !== 'string' || raw.modelId.trim().length === 0) {
-            throw new AgentResolutionError(context, 'concrete modelOverride is missing a modelId');
-        }
-        return raw;
-    }
-    const modelClass = raw.modelClass;
-    if (modelClass === undefined ||
-        !workflow_1.MODEL_CLASS_VALUES.includes(modelClass)) {
-        throw new AgentResolutionError(context, `strategy modelOverride.modelClass must be one of ${workflow_1.MODEL_CLASS_VALUES.join(', ')}`);
-    }
-    return raw;
-}
-function projectSkillSlugs(skills) {
-    if (!Array.isArray(skills)) {
-        return [];
-    }
-    return skills
-        .map((s) => s.slug)
-        .filter((slug) => typeof slug === 'string' && slug.length > 0);
-}
-function projectToolSelection(tools, context) {
-    if (!Array.isArray(tools)) {
-        return [];
-    }
-    const validKinds = new Set(Object.values(mcp_tool_1.ToolProviderKind));
-    const out = [];
-    for (const [idx, tool] of tools.entries()) {
-        if (typeof tool.providerKind !== 'string' ||
-            !validKinds.has(tool.providerKind)) {
-            throw new AgentResolutionError(context, `tools[${idx}].providerKind must be one of ${Object.values(mcp_tool_1.ToolProviderKind).join(', ')}`);
-        }
-        if (typeof tool.resourceId !== 'string' ||
-            tool.resourceId.trim().length === 0) {
-            throw new AgentResolutionError(context, `tools[${idx}].resourceId must be a non-empty string`);
-        }
-        if (tool.kind === 'provider') {
-            out.push({
-                kind: 'provider',
-                providerKind: tool.providerKind,
-                resourceId: tool.resourceId,
-            });
-        }
-        else if (tool.kind === 'tool') {
-            if (typeof tool.toolName !== 'string' ||
-                tool.toolName.trim().length === 0) {
-                throw new AgentResolutionError(context, `tools[${idx}].toolName must be a non-empty string for kind='tool'`);
-            }
-            out.push({
-                kind: 'tool',
-                providerKind: tool.providerKind,
-                resourceId: tool.resourceId,
-                toolName: tool.toolName,
-            });
-        }
-        else {
-            throw new AgentResolutionError(context, `tools[${idx}].kind must be "provider" or "tool"`);
-        }
-    }
-    return out;
-}
-function projectAgentToRuntimeConfig(resolved, overlay) {
-    const root = resolved.root;
-    const agentRef = `${resolved.slug}@${resolved.version}`;
-    const rootInstructions = normalizeInstructions(root.instructions);
-    const overlayInstructions = normalizeInstructions(overlay?.instructions);
-    const primaryInstructions = appendInstructions(rootInstructions ?? '', overlayInstructions);
-    const rootModelOverride = projectModelOverride(root.modelOverride, agentRef);
-    const overlayModelOverride = projectModelOverride(overlay?.modelOverride, `${agentRef}#overlay`);
-    const rootPermission = normalizePermission(root.permission);
-    const overlayPermission = normalizePermission(overlay?.permission);
-    const flattened = flattenAgentTree(root);
-    return {
-        agentRef,
-        primaryAgentSlug: root.kernel.slug,
-        primaryInstructions: primaryInstructions.length > 0 ? primaryInstructions : null,
-        primaryPermission: overlayPermission ?? rootPermission,
-        primaryModelOverride: overlayModelOverride ?? rootModelOverride,
-        subAgentBindings: flattened.map((n) => ({ ...n })),
-        subAgentInstructionsBySlug: collectInstructionsBySlug(root),
-        subAgentPermissionBySlug: collectPermissionsBySlug(root),
-        subAgentModelOverridesBySlug: collectModelOverridesBySlug(root),
-        defaultSkillSlugs: collectSkills(root, { scope: 'root' }),
-        allSkillSlugs: collectSkills(root, { scope: 'tree' }),
-        defaultToolSelection: collectTools(root, { scope: 'root' }),
-    };
-}
-//# sourceMappingURL=composition-resolution.js.map