@zhin.js/workroom 0.0.0 → 0.0.2

package/lib/workroom/assignment-authority.js

@@ -0,0 +1,179 @@
+import { canonicalWorkroomJson, compareCanonicalWorkroomText, deepFreezeWorkroomValue as deepFreeze, digestCanonicalWorkroomValue as digest, } from './canonical-value.js';
+export function createWorkroomAssignmentAuthorityGrant(input) {
+    exactKeys(input, [
+        'generation', 'projectId', 'runId', 'taskKey', 'taskRevision',
+        'assignmentId', 'assignmentRevision', 'attempt', 'fence',
+        'agentDefinitionId', 'endpointId', 'endpointAuthorityDigest',
+        'catalogRevision', 'catalogBindingDigest', 'profileRevisionId', 'profileDigest',
+        'principalId', 'role', 'capabilitySnapshotRef', 'capabilitySnapshotRevision',
+        'roleCapabilities', 'taskCapabilities', 'policyCapabilities',
+        'plan', 'contextPolicy', 'policySnapshot', 'workspace', 'contextView',
+        'capabilityGrantRef', 'disclosureManifest', 'remoteWorkspace',
+    ], 'issuance grant');
+    const projection = deepFreeze({
+        version: 1,
+        ...structuredClone(input),
+        roleCapabilities: createCeiling(input.roleCapabilities, 'roleCapabilities'),
+        taskCapabilities: createCeiling(input.taskCapabilities, 'taskCapabilities'),
+        policyCapabilities: createCeiling(input.policyCapabilities, 'policyCapabilities'),
+    });
+    validateGrantProjection(projection);
+    return deepFreeze({ ...projection, digest: digest(projection) });
+}
+export function assertWorkroomAssignmentAuthorityGrant(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('Remote Assignment issuance grant is invalid');
+    }
+    const { version, digest: actualDigest, roleCapabilities, taskCapabilities, policyCapabilities, ...rest } = value;
+    if (version !== 1)
+        throw new Error('Remote Assignment issuance grant version is unsupported');
+    const canonical = createWorkroomAssignmentAuthorityGrant({
+        ...rest,
+        roleCapabilities: ceilingInput(roleCapabilities),
+        taskCapabilities: ceilingInput(taskCapabilities),
+        policyCapabilities: ceilingInput(policyCapabilities),
+    });
+    if (actualDigest !== canonical.digest || canonicalWorkroomJson(value) !== canonicalWorkroomJson(canonical)) {
+        throw new Error('Remote Assignment issuance grant digest drift');
+    }
+    return canonical;
+}
+function createCeiling(input, label) {
+    text(input.id, `${label}.id`);
+    positive(input.revision, `${label}.revision`);
+    const projection = {
+        id: input.id,
+        revision: input.revision,
+        tools: canonicalTools(input.tools, `${label}.tools`),
+        skills: canonicalSkills(input.skills, `${label}.skills`),
+    };
+    return deepFreeze({ ...projection, digest: digest(projection) });
+}
+function ceilingInput(value) {
+    if (!value || typeof value !== 'object')
+        throw new Error('Remote Assignment capability ceiling is invalid');
+    const { digest: actualDigest, ...input } = value;
+    const canonical = createCeiling(input, 'capability ceiling');
+    if (canonical.digest !== actualDigest)
+        throw new Error('Remote Assignment capability ceiling digest drift');
+    return input;
+}
+function validateGrantProjection(input) {
+    for (const [label, value] of Object.entries({
+        projectId: input.projectId, runId: input.runId, taskKey: input.taskKey,
+        assignmentId: input.assignmentId, agentDefinitionId: input.agentDefinitionId,
+        catalogRevision: input.catalogRevision, catalogBindingDigest: input.catalogBindingDigest,
+        profileRevisionId: input.profileRevisionId, profileDigest: input.profileDigest,
+        principalId: input.principalId, capabilitySnapshotRef: input.capabilitySnapshotRef,
+        capabilityGrantRef: input.capabilityGrantRef,
+    }))
+        text(value, label);
+    if (input.endpointId !== undefined)
+        text(input.endpointId, 'endpointId');
+    if (input.endpointAuthorityDigest !== undefined)
+        sha(input.endpointAuthorityDigest, 'endpointAuthorityDigest');
+    for (const [label, value] of Object.entries({
+        generation: input.generation, taskRevision: input.taskRevision,
+        assignmentRevision: input.assignmentRevision, attempt: input.attempt,
+        fence: input.fence, capabilitySnapshotRevision: input.capabilitySnapshotRevision,
+    }))
+        positive(value, label);
+    if (input.role !== 'executor' && input.role !== 'integration') {
+        throw new Error('Remote Assignment grant role is not executable');
+    }
+    reference(input.plan, 'plan');
+    reference(input.contextPolicy, 'contextPolicy');
+    reference(input.policySnapshot, 'policySnapshot');
+    if (input.workspace) {
+        text(input.workspace.leaseRef, 'workspace.leaseRef');
+        text(input.workspace.mountRef, 'workspace.mountRef');
+        text(input.workspace.baseRevision, 'workspace.baseRevision');
+        positive(input.workspace.fence, 'workspace.fence');
+    }
+    text(input.contextView.ref, 'contextView.ref');
+    sha(input.contextView.hash, 'contextView.hash');
+    if (input.disclosureManifest) {
+        text(input.disclosureManifest.request.operationId, 'disclosureManifest.request.operationId');
+        text(input.disclosureManifest.request.projectId, 'disclosureManifest.request.projectId');
+        text(input.disclosureManifest.request.sourceRef, 'disclosureManifest.request.sourceRef');
+        sha(input.disclosureManifest.request.sourceDigest, 'disclosureManifest.request.sourceDigest');
+        text(input.disclosureManifest.request.sinkRuleId, 'disclosureManifest.request.sinkRuleId');
+        text(input.disclosureManifest.request.principalId, 'disclosureManifest.request.principalId');
+        text(input.disclosureManifest.manifest.id, 'disclosureManifest.manifest.id');
+        sha(input.disclosureManifest.manifest.digest, 'disclosureManifest.manifest.digest');
+    }
+    sha(input.profileDigest, 'profileDigest');
+    catalogRevision(input.catalogRevision);
+    sha(input.catalogBindingDigest, 'catalogBindingDigest');
+}
+function canonicalTools(value, label) {
+    if (!Array.isArray(value))
+        throw new Error(`${label} must be an array`);
+    const result = value.map(item => {
+        text(item.name, `${label}.name`);
+        sha(item.digest, `${label}.${item.name}.digest`);
+        return { name: item.name, digest: item.digest, ...(item.deferred === undefined ? {} : { deferred: item.deferred }) };
+    }).sort((left, right) => compareCanonicalWorkroomText(left.name, right.name));
+    uniqueNames(result, label);
+    return Object.freeze(result);
+}
+function canonicalSkills(value, label) {
+    if (!Array.isArray(value))
+        throw new Error(`${label} must be an array`);
+    const result = value.map(item => {
+        text(item.name, `${label}.name`);
+        sha(item.digest, `${label}.${item.name}.digest`);
+        const requiredTools = canonicalNames(item.requiredTools, `${label}.${item.name}.requiredTools`);
+        return { name: item.name, digest: item.digest, requiredTools,
+            ...(item.deferred === undefined ? {} : { deferred: item.deferred }) };
+    }).sort((left, right) => compareCanonicalWorkroomText(left.name, right.name));
+    uniqueNames(result, label);
+    return Object.freeze(result);
+}
+function canonicalNames(value, label) {
+    if (!Array.isArray(value))
+        throw new Error(`${label} must be an array`);
+    value.forEach(item => text(item, label));
+    const names = [...new Set(value)].sort((left, right) => compareCanonicalWorkroomText(left, right));
+    if (names.length !== value.length)
+        throw new Error(`${label} contains duplicate values`);
+    return Object.freeze(names);
+}
+function uniqueNames(value, label) {
+    const names = new Set();
+    for (const item of value) {
+        if (names.has(item.name))
+            throw new Error(`${label} contains duplicate ${item.name}`);
+        names.add(item.name);
+    }
+}
+function reference(value, label) {
+    text(value?.ref, `${label}.ref`);
+    positive(value?.revision, `${label}.revision`);
+    sha(value?.digest, `${label}.digest`);
+}
+function sha(value, label) {
+    if (typeof value !== 'string' || !/^sha256:[a-f0-9]{64}$/u.test(value)) {
+        throw new Error(`Remote Assignment ${label} must be a canonical digest`);
+    }
+}
+function catalogRevision(value) {
+    if (typeof value !== 'string' || !/^[a-f0-9]{64}$/u.test(value)) {
+        throw new Error('Remote Assignment catalogRevision must be a canonical Catalog revision');
+    }
+}
+function text(value, label) {
+    if (typeof value !== 'string' || !value.trim())
+        throw new Error(`Remote Assignment ${label} is required`);
+}
+function positive(value, label) {
+    if (!Number.isSafeInteger(value) || Number(value) < 1) {
+        throw new Error(`Remote Assignment ${label} must be a positive integer`);
+    }
+}
+function exactKeys(value, allowed, label) {
+    const unexpected = Object.keys(value).find(key => !allowed.includes(key));
+    if (unexpected)
+        throw new Error(`Remote Assignment ${label} contains unexpected field ${unexpected}`);
+}
+//# sourceMappingURL=assignment-authority.js.map

package/lib/workroom/assignment-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assignment-authority.js","sourceRoot":"","sources":["../../src/workroom/assignment-authority.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,uBAAuB,IAAI,UAAU,EACrC,4BAA4B,IAAI,MAAM,GACvC,MAAM,sBAAsB,CAAC;AA6E9B,MAAM,UAAU,sCAAsC,CACpD,KAA4C;IAE5C,SAAS,CAAC,KAAK,EAAE;QACf,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc;QAC7D,cAAc,EAAE,oBAAoB,EAAE,SAAS,EAAE,OAAO;QACxD,mBAAmB,EAAE,YAAY,EAAE,yBAAyB;QAC5D,iBAAiB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,eAAe;QAC/E,aAAa,EAAE,MAAM,EAAE,uBAAuB,EAAE,4BAA4B;QAC5E,kBAAkB,EAAE,kBAAkB,EAAE,oBAAoB;QAC5D,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa;QACrE,oBAAoB,EAAE,oBAAoB,EAAE,iBAAiB;KAC9D,EAAE,gBAAgB,CAAC,CAAC;IACrB,MAAM,UAAU,GAAG,UAAU,CAAC;QAC5B,OAAO,EAAE,CAAU;QACnB,GAAG,eAAe,CAAC,KAAK,CAAC;QACzB,gBAAgB,EAAE,aAAa,CAAC,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;QAC3E,gBAAgB,EAAE,aAAa,CAAC,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;QAC3E,kBAAkB,EAAE,aAAa,CAAC,KAAK,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;KAClF,CAAC,CAAC;IACH,uBAAuB,CAAC,UAAU,CAAC,CAAC;IACpC,OAAO,UAAU,CAAC,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,KAAuC;IAEvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IACjH,IAAI,OAAO,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC9F,MAAM,SAAS,GAAG,sCAAsC,CAAC;QACvD,GAAG,IAAI;QACP,gBAAgB,EAAE,YAAY,CAAC,gBAAgB,CAAC;QAChD,gBAAgB,EAAE,YAAY,CAAC,gBAAgB,CAAC;QAChD,kBAAkB,EAAE,YAAY,CAAC,kBAAkB,CAAC;KACrD,CAAC,CAAC;IACH,IAAI,YAAY,KAAK,SAAS,CAAC,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,KAAK,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3G,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,KAAqC,EAAE,KAAa;IACzE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,KAAK,KAAK,CAAC,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,KAAK,WAAW,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG;QACjB,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,QAAQ,CAAC;QACpD,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,SAAS,CAAC;KACzD,CAAC;IACF,OAAO,UAAU,CAAC,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,YAAY,CAAC,KAAgC;IACpD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC5G,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,KAAK,EAAE,GAAG,KAAK,CAAC;IACjD,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;IAC7D,IAAI,SAAS,CAAC,MAAM,KAAK,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC5G,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAuD;IACtF,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC;QAC1C,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC5E,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QACxF,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa;QAC9E,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClF,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC;QAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACvB,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACzE,IAAI,KAAK,CAAC,uBAAuB,KAAK,SAAS;QAAE,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,yBAAyB,CAAC,CAAC;IAC/G,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC;QAC1C,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY;QAC9D,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO;QACpE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,0BAA0B,EAAE,KAAK,CAAC,0BAA0B;KACjF,CAAC;QAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9B,SAAS,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IAChD,SAAS,CAAC,KAAK,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,YAAY,EAAE,wBAAwB,CAAC,CAAC;QAC7D,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC/C,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,WAAW,EAAE,wCAAwC,CAAC,CAAC;QAC7F,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,SAAS,EAAE,sCAAsC,CAAC,CAAC;QACzF,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,SAAS,EAAE,sCAAsC,CAAC,CAAC;QACzF,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,YAAY,EAAE,yCAAyC,CAAC,CAAC;QAC9F,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,UAAU,EAAE,uCAAuC,CAAC,CAAC;QAC3F,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,WAAW,EAAE,wCAAwC,CAAC,CAAC;QAC7F,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,gCAAgC,CAAC,CAAC;QAC7E,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC;IACtF,CAAC;IACD,GAAG,CAAC,KAAK,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IAC1C,eAAe,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACvC,GAAG,CAAC,KAAK,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,cAAc,CAAC,KAA4C,EAAE,KAAa;IACjF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QAC9B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;QACjC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,IAAI,IAAI,CAAC,IAAI,SAAS,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;IACvH,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,4BAA4B,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,eAAe,CAAC,KAA6C,EAAE,KAAa;IACnF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QAC9B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;QACjC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,IAAI,IAAI,CAAC,IAAI,SAAS,CAAC,CAAC;QACjD,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,KAAK,IAAI,IAAI,CAAC,IAAI,gBAAgB,CAAC,CAAC;QAChG,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa;YAC1D,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;IAC1E,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,4BAA4B,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,cAAc,CAAC,KAAwB,EAAE,KAAa;IAC7D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC;IACxE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,4BAA4B,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACnG,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;IACzF,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,WAAW,CAAC,KAA4C,EAAE,KAAa;IAC9E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uBAAuB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACtF,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAA2C,EAAE,KAAa;IAC3E,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,KAAK,WAAW,CAAC,CAAC;IAC/C,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,GAAG,CAAC,KAAc,EAAE,KAAa;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,6BAA6B,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,KAAa;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,cAAc,CAAC,CAAC;AAC5G,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc,EAAE,KAAa;IAC7C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,6BAA6B,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,OAA0B,EAAE,KAAa;IACzE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1E,IAAI,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,8BAA8B,UAAU,EAAE,CAAC,CAAC;AACxG,CAAC"}

package/lib/workroom/assignment-executor.d.ts

@@ -0,0 +1,110 @@
+import type { WorkroomExecutionRole } from './kernel-contracts.js';
+export type AssignmentExecutorRole = Extract<WorkroomExecutionRole, 'executor' | 'integration'>;
+export interface AssignmentExecutionSnapshotReference {
+    readonly ref: string;
+    readonly revision: number;
+    readonly digest: string;
+}
+export interface AssignmentExecutionWorkspaceReference {
+    readonly leaseRef: string;
+    readonly mountRef: string;
+    readonly baseRevision: string;
+    readonly fence: number;
+}
+export interface AssignmentExecutionFactAnchor {
+    readonly ref: string;
+    readonly sequence: number;
+    readonly digest: string;
+}
+export interface AssignmentExecutionEnvelopeInput {
+    readonly projectId: string;
+    readonly runId: string;
+    readonly taskKey: string;
+    readonly taskRevision: number;
+    readonly assignmentId: string;
+    readonly assignmentRevision: number;
+    readonly attempt: number;
+    readonly fence: number;
+    readonly principalId: string;
+    readonly role: AssignmentExecutorRole;
+    readonly agentDefinition: AssignmentExecutionSnapshotReference;
+    readonly plan: AssignmentExecutionSnapshotReference;
+    readonly contextPolicy: AssignmentExecutionSnapshotReference;
+    readonly factAnchor: AssignmentExecutionFactAnchor;
+    readonly capabilitySnapshot: AssignmentExecutionSnapshotReference;
+    readonly policySnapshot: AssignmentExecutionSnapshotReference;
+    readonly workspace: AssignmentExecutionWorkspaceReference;
+}
+export interface AssignmentExecutionEnvelope extends AssignmentExecutionEnvelopeInput {
+    readonly version: 1;
+    readonly digest: string;
+}
+export interface AssignmentProgressObservation {
+    readonly version: 1;
+    readonly type: 'progress';
+    readonly observationId: string;
+    readonly envelopeDigest: string;
+    readonly progress: Readonly<{
+        summary: string;
+        completedUnits?: number;
+        totalUnits?: number;
+    }>;
+}
+export interface AssignmentHeartbeatObservation {
+    readonly version: 1;
+    readonly type: 'heartbeat';
+    readonly observationId: string;
+    readonly envelopeDigest: string;
+}
+export interface AssignmentCheckpointObservation {
+    readonly version: 1;
+    readonly type: 'checkpoint';
+    readonly observationId: string;
+    readonly envelopeDigest: string;
+    readonly checkpoint: Readonly<{
+        ref: string;
+        digest: string;
+    }>;
+}
+export interface AssignmentExecutionCompletedObservation {
+    readonly version: 1;
+    readonly type: 'execution_completed';
+    readonly observationId: string;
+    readonly envelopeDigest: string;
+    readonly completion: Readonly<{
+        report: Readonly<{
+            ref: string;
+            digest: string;
+        }>;
+        candidate: Readonly<{
+            ref: string;
+            hash: string;
+        }>;
+        completionReceiptDigest?: string;
+    }>;
+}
+export type AssignmentExecutionObservation = AssignmentProgressObservation | AssignmentHeartbeatObservation | AssignmentCheckpointObservation | AssignmentExecutionCompletedObservation;
+/** Transport adapters receive no mutable Workroom state or command surface. */
+export interface AssignmentExecutorPort {
+    /** The adapter must stop its transport/sandbox when the trusted caller aborts. */
+    execute(envelope: AssignmentExecutionEnvelope, signal: AbortSignal): AsyncIterable<AssignmentExecutionObservation>;
+}
+/**
+ * Materializes the exact role-scoped authority a trusted Workroom issuer gives
+ * one Assignment attempt. Executors may consume this value, but never widen it.
+ */
+export declare function createAssignmentExecutionEnvelope(input: AssignmentExecutionEnvelopeInput): AssignmentExecutionEnvelope;
+/**
+ * Caller-owned execution boundary. Cancellation is checked before transport
+ * dispatch and before any observation escapes toward a trusted Kernel adapter.
+ */
+export declare function executeAssignment(port: AssignmentExecutorPort, envelope: AssignmentExecutionEnvelope, signal: AbortSignal): AsyncIterable<AssignmentExecutionObservation>;
+/**
+ * Validates an Executor observation before any trusted adapter may translate
+ * it into a Kernel proposal. The observation itself carries no target scope;
+ * its exact Project/Run/Task/Assignment authority is the Envelope digest.
+ */
+export declare function validateAssignmentExecutionObservation(envelope: AssignmentExecutionEnvelope, value: unknown): AssignmentExecutionObservation;
+/** Guards the trusted local boundary against corrupted or mutable Envelopes. */
+export declare function assertAssignmentExecutionEnvelope(value: unknown): asserts value is AssignmentExecutionEnvelope;
+//# sourceMappingURL=assignment-executor.d.ts.map

package/lib/workroom/assignment-executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assignment-executor.d.ts","sourceRoot":"","sources":["../../src/workroom/assignment-executor.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAEnE,MAAM,MAAM,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,EAAE,UAAU,GAAG,aAAa,CAAC,CAAC;AAEhG,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,qCAAqC;IACpD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,eAAe,EAAE,oCAAoC,CAAC;IAC/D,QAAQ,CAAC,IAAI,EAAE,oCAAoC,CAAC;IACpD,QAAQ,CAAC,aAAa,EAAE,oCAAoC,CAAC;IAC7D,QAAQ,CAAC,UAAU,EAAE,6BAA6B,CAAC;IACnD,QAAQ,CAAC,kBAAkB,EAAE,oCAAoC,CAAC;IAClE,QAAQ,CAAC,cAAc,EAAE,oCAAoC,CAAC;IAC9D,QAAQ,CAAC,SAAS,EAAE,qCAAqC,CAAC;CAC3D;AAED,MAAM,WAAW,2BAA4B,SAAQ,gCAAgC;IACnF,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC;QAC5B,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,uCAAuC;IACtD,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC;QAC5B,MAAM,EAAE,QAAQ,CAAC;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAClD,SAAS,EAAE,QAAQ,CAAC;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACnD,uBAAuB,CAAC,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;CACJ;AAED,MAAM,MAAM,8BAA8B,GACtC,6BAA6B,GAC7B,8BAA8B,GAC9B,+BAA+B,GAC/B,uCAAuC,CAAC;AAE5C,+EAA+E;AAC/E,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,OAAO,CACL,QAAQ,EAAE,2BAA2B,EACrC,MAAM,EAAE,WAAW,GAClB,aAAa,CAAC,8BAA8B,CAAC,CAAC;CAClD;AAED;;;GAGG;AACH,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,gCAAgC,GACtC,2BAA2B,CAiB7B;AAED;;;GAGG;AACH,wBAAuB,iBAAiB,CACtC,IAAI,EAAE,sBAAsB,EAC5B,QAAQ,EAAE,2BAA2B,EACrC,MAAM,EAAE,WAAW,GAClB,aAAa,CAAC,8BAA8B,CAAC,CAkB/C;AAED;;;;GAIG;AACH,wBAAgB,sCAAsC,CACpD,QAAQ,EAAE,2BAA2B,EACrC,KAAK,EAAE,OAAO,GACb,8BAA8B,CAqGhC;AAED,gFAAgF;AAChF,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,KAAK,IAAI,2BAA2B,CA+D9C"}