akm-cli 0.9.16 → 0.9.17-alpha.10

package/dist/integrations/agent/execution-cascade.js

@@ -1,566 +0,0 @@
-// This Source Code Form is subject to the terms of the Mozilla Public
-// License, v. 2.0. If a copy of the MPL was not distributed with this
-// file, You can obtain one at https://mozilla.org/MPL/2.0/.
-import { ENGINE_NAME_PATTERN_SOURCE } from "../../core/config/engine-semantics.js";
-import { ConfigError } from "../../core/errors.js";
-import { DURATION_UNITS, parseDuration } from "../../core/time.js";
-import { cloneExecutionJson, cloneExecutionJsonObject, } from "../../execution/json.js";
-import { EXECUTION_MAX_TIMEOUT_MS } from "../../execution/limits.js";
-import { assertSnapshotKeys, requireSnapshotField, snapshotStrictRecord, } from "../../execution/record.js";
-import { cloneResolvedCommandContent, cloneResolvedPersonaContent, createResolvedExecutionRequest, } from "../../execution/resolved-request.js";
-import { cloneAdapterExtensions, cloneToolSelection, cloneUnresolvedExecutionDefaults, executionPersonaMatchesSelector, isPortableExecutionAgentSelector, requireStableExecutionSelector, } from "../../execution/source.js";
-import { resolveModelMapAlias } from "./model-map.js";
-export const EXECUTION_CASCADE_PLAN_VERSION = 1;
-export const FIXED_EXECUTION_ENGINE_FALLBACK = "opencode-sdk";
-const planInstances = new WeakSet();
-const ENGINE_NAME_PATTERN = new RegExp(ENGINE_NAME_PATTERN_SOURCE);
-const MODEL_ALIAS_PATTERN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
-const RESERVED_ENGINE_KEYS = new Set(["__proto__", "constructor", "prototype", "tostring"]);
-function record(value, path) {
-    return snapshotStrictRecord(value, path);
-}
-function only(recordValue, allowed, path) {
-    assertSnapshotKeys(recordValue, allowed, path);
-}
-function own(recordValue, key) {
-    return Object.hasOwn(recordValue, key);
-}
-function required(recordValue, key, path) {
-    return requireSnapshotField(recordValue, key, path);
-}
-function stableIdentifier(value, path) {
-    return requireStableExecutionSelector(value, path);
-}
-function canonicalEngineName(value, path) {
-    const name = stableIdentifier(value, path);
-    if (!ENGINE_NAME_PATTERN.test(name) || RESERVED_ENGINE_KEYS.has(name.toLowerCase())) {
-        throw new TypeError(`${path} must be a canonical, non-reserved engine name`);
-    }
-    return name;
-}
-function frozenNullPrototypeRecord(entries) {
-    const out = Object.create(null);
-    for (const [key, value] of entries) {
-        Object.defineProperty(out, key, { value, enumerable: true, configurable: false, writable: false });
-    }
-    return Object.freeze(out);
-}
-function normalizeLayer(value, kind, path) {
-    const input = record(value, path);
-    only(input, ["id", "values"], path);
-    const id = stableIdentifier(required(input, "id", path), `${path}.id`);
-    const values = cloneUnresolvedExecutionDefaults(required(input, "values", path), `${path}.values`);
-    return Object.freeze({ id, kind, values });
-}
-function normalizeEngineSelection(value, path) {
-    const input = record(value, path);
-    only(input, ["name", "kind", "platform", "settings", "extensions"], path);
-    const name = canonicalEngineName(required(input, "name", path), `${path}.name`);
-    const kind = required(input, "kind", path);
-    if (kind !== "agent" && kind !== "sdk" && kind !== "llm") {
-        throw new TypeError(`${path}.kind must be agent, sdk, or llm`);
-    }
-    const out = { name, kind };
-    if (own(input, "platform")) {
-        if (input.platform !== null && typeof input.platform !== "string") {
-            throw new TypeError(`${path}.platform must be a string or null`);
-        }
-        out.platform = input.platform;
-    }
-    if (own(input, "settings")) {
-        out.settings = input.settings === null ? null : cloneExecutionJsonObject(input.settings, `${path}.settings`);
-    }
-    if (own(input, "extensions")) {
-        out.extensions = cloneAdapterExtensions(input.extensions, `${path}.extensions`);
-    }
-    return Object.freeze(out);
-}
-function normalizeEngineDefinition(value, name) {
-    const path = `engines.${name}`;
-    const input = record(value, path);
-    only(input, ["selection", "defaults", "modelMapKey"], path);
-    const selection = normalizeEngineSelection(required(input, "selection", path), `${path}.selection`);
-    if (selection.name !== name) {
-        throw new TypeError(`${path}.selection.name must match its engine registry key`);
-    }
-    const defaults = own(input, "defaults")
-        ? cloneUnresolvedExecutionDefaults(input.defaults, `${path}.defaults`)
-        : Object.freeze({});
-    if (own(defaults, "engine")) {
-        throw new TypeError(`${path}.defaults.engine is invalid because the engine layer cannot select itself`);
-    }
-    const rawMapKey = own(input, "modelMapKey") ? input.modelMapKey : (selection.platform ?? selection.name);
-    const modelMapKey = stableIdentifier(rawMapKey, `${path}.modelMapKey`);
-    return Object.freeze({
-        selection,
-        defaults,
-        modelMapKey,
-    });
-}
-function normalizeEngines(value) {
-    const input = record(value, "engines");
-    const entries = [];
-    for (const [name, definition] of Object.entries(input)) {
-        canonicalEngineName(name, `engines.${name}`);
-        entries.push([name, normalizeEngineDefinition(definition, name)]);
-    }
-    return frozenNullPrototypeRecord(entries);
-}
-function normalizeModelMap(value) {
-    const input = record(value, "modelMap");
-    only(input, ["version", "aliases"], "modelMap");
-    if (required(input, "version", "modelMap") !== 1) {
-        throw new TypeError("modelMap.version must be 1");
-    }
-    const aliasesInput = record(required(input, "aliases", "modelMap"), "modelMap.aliases");
-    const aliases = [];
-    for (const [alias, rawEngines] of Object.entries(aliasesInput)) {
-        stableIdentifier(alias, `modelMap.aliases.${alias}`);
-        if (!MODEL_ALIAS_PATTERN.test(alias) || RESERVED_ENGINE_KEYS.has(alias.toLowerCase())) {
-            throw new TypeError(`modelMap alias ${JSON.stringify(alias)} is not canonical`);
-        }
-        const engineInput = record(rawEngines, `modelMap.aliases.${alias}`);
-        const profiles = [];
-        for (const [engine, rawProfile] of Object.entries(engineInput)) {
-            if (engine !== "*")
-                canonicalEngineName(engine, `modelMap.aliases.${alias}.${engine}`);
-            const profile = record(rawProfile, `modelMap.aliases.${alias}.${engine}`);
-            only(profile, ["model", "inference"], `modelMap.aliases.${alias}.${engine}`);
-            const model = required(profile, "model", `modelMap.aliases.${alias}.${engine}`);
-            if (typeof model !== "string" || model.length === 0 || model.trim() !== model) {
-                throw new TypeError(`modelMap.aliases.${alias}.${engine}.model must be a non-empty exact identifier`);
-            }
-            const normalized = { model };
-            if (own(profile, "inference")) {
-                normalized.inference =
-                    profile.inference === null
-                        ? null
-                        : cloneExecutionJsonObject(profile.inference, `modelMap.aliases.${alias}.${engine}.inference`);
-            }
-            profiles.push([engine, Object.freeze(normalized)]);
-        }
-        aliases.push([alias, frozenNullPrototypeRecord(profiles)]);
-    }
-    return Object.freeze({ version: 1, aliases: frozenNullPrototypeRecord(aliases) });
-}
-function normalizeLayers(value) {
-    const input = record(value, "layers");
-    only(input, ["installation", "agent", "command", "invocationDefaults", "current"], "layers");
-    const out = {
-        installation: normalizeLayer(required(input, "installation", "layers"), "installation", "layers.installation"),
-    };
-    for (const [key, kind] of [
-        ["agent", "agent"],
-        ["command", "command"],
-        ["invocationDefaults", "invocation-defaults"],
-        ["current", "current"],
-    ]) {
-        if (own(input, key)) {
-            if (input[key] === undefined)
-                throw new TypeError(`layers.${key} must be omitted rather than undefined`);
-            out[key] = normalizeLayer(input[key], kind, `layers.${key}`);
-        }
-    }
-    return Object.freeze(out);
-}
-function orderedWithoutEngine(layers) {
-    return [layers.installation, layers.agent, layers.command, layers.invocationDefaults, layers.current].filter((layer) => layer !== undefined);
-}
-function selectNearest(layers, key) {
-    for (let index = layers.length - 1; index >= 0; index -= 1) {
-        const layer = layers[index];
-        if (layer && own(layer.values, key)) {
-            return { present: true, value: layer.values[key], layer, index };
-        }
-    }
-    return { present: false, index: -1 };
-}
-function provenance(layer, via = "explicit") {
-    return Object.freeze({ layer: layer.id, kind: layer.kind, via });
-}
-function fallbackProvenance() {
-    return Object.freeze({ layer: FIXED_EXECUTION_ENGINE_FALLBACK, kind: "fallback", via: "fallback" });
-}
-function sourceProvenance(layer, kind) {
-    return Object.freeze({ layer, kind, via: "source" });
-}
-function chooseEngine(layers, engines) {
-    const selected = selectNearest(layers, "engine");
-    let name;
-    let field;
-    let fallback = false;
-    if (!selected.present || selected.value === null) {
-        name = FIXED_EXECUTION_ENGINE_FALLBACK;
-        field = fallbackProvenance();
-        fallback = true;
-    }
-    else {
-        if (typeof selected.value !== "string" || selected.value.length === 0) {
-            throw new ConfigError("Selected engine must be a non-empty configured engine name.", "INVALID_CONFIG_FILE");
-        }
-        name = selected.value;
-        field = provenance(selected.layer);
-    }
-    const definition = engines[name];
-    if (!definition) {
-        if (fallback) {
-            throw new ConfigError("No engine was selected and the fixed opencode-sdk fallback is unavailable.", "INVALID_CONFIG_FILE", "Configure defaults.engine or configure/install the opencode-sdk engine.");
-        }
-        throw new ConfigError(`Selected engine ${JSON.stringify(name)} is not configured.`, "INVALID_CONFIG_FILE");
-    }
-    return {
-        definition,
-        field,
-        ...(selected.present ? { requested: provenance(selected.layer) } : {}),
-        fallback,
-    };
-}
-function cloneJsonValue(value, path) {
-    return cloneExecutionJson(value, path);
-}
-function isObject(value) {
-    return value !== null && value !== undefined && typeof value === "object" && !Array.isArray(value);
-}
-function deleteInferenceProvenance(fields) {
-    for (const key of Object.keys(fields)) {
-        if (key === "/inference" || key.startsWith("/inference/"))
-            delete fields[key];
-    }
-}
-function deleteInferenceDescendantProvenance(fields, path) {
-    for (const key of Object.keys(fields)) {
-        if (key.startsWith(`${path}/`))
-            delete fields[key];
-    }
-}
-function jsonPointerSegment(value) {
-    return value.replaceAll("~", "~0").replaceAll("/", "~1");
-}
-function setInferenceTreeProvenance(value, path, source, fields) {
-    fields[path] = source;
-    if (!isObject(value))
-        return;
-    for (const [key, child] of Object.entries(value)) {
-        setInferenceTreeProvenance(child, `${path}/${jsonPointerSegment(key)}`, source, fields);
-    }
-}
-function mergeInferenceObject(base, overlay, prefix, source, fields) {
-    const out = new Map();
-    for (const [key, value] of Object.entries(base))
-        out.set(key, cloneJsonValue(value, `${prefix}.${key}`));
-    for (const [key, value] of Object.entries(overlay)) {
-        const path = `${prefix}/${jsonPointerSegment(key)}`;
-        const previous = out.get(key);
-        if (isObject(previous) && isObject(value)) {
-            out.set(key, mergeInferenceObject(previous, value, path, source, fields));
-            fields[path] = source;
-        }
-        else {
-            deleteInferenceDescendantProvenance(fields, path);
-            out.set(key, cloneJsonValue(value, path));
-            setInferenceTreeProvenance(value, path, source, fields);
-        }
-    }
-    return Object.freeze(Object.fromEntries(out));
-}
-function resolveInference(layers, aliasInferenceByLayer, fields) {
-    let present = false;
-    let current;
-    const apply = (value, layer, via) => {
-        const field = provenance(layer, via);
-        present = true;
-        if (value === null) {
-            current = null;
-            deleteInferenceProvenance(fields);
-            fields["/inference"] = field;
-            return;
-        }
-        fields["/inference"] = field;
-        current = mergeInferenceObject(isObject(current) ? current : Object.freeze({}), value, "/inference", field, fields);
-    };
-    for (const [index, layer] of layers.entries()) {
-        if (aliasInferenceByLayer.has(index)) {
-            apply(aliasInferenceByLayer.get(index), layer, "model-alias");
-        }
-        if (own(layer.values, "inference")) {
-            apply(layer.values.inference, layer, "explicit");
-        }
-    }
-    return present ? { present: true, value: current } : { present: false };
-}
-function resolveModels(layers, definition, modelMap) {
-    let selected = { present: false, index: -1 };
-    let resolved;
-    const aliasInferenceByLayer = new Map();
-    for (const [index, layer] of layers.entries()) {
-        if (!own(layer.values, "model"))
-            continue;
-        const value = layer.values.model;
-        selected = { present: true, value, layer, index };
-        if (value === null) {
-            resolved = null;
-            continue;
-        }
-        if (typeof value !== "string" || value.length === 0) {
-            throw new ConfigError("Resolved model must be null or a non-empty string.", "INVALID_CONFIG_FILE");
-        }
-        const selection = resolveModelMapAlias(value, definition.modelMapKey, modelMap);
-        if (selection.interpretation === "alias" && selection.inference !== undefined) {
-            aliasInferenceByLayer.set(index, selection.inference);
-        }
-        resolved = Object.freeze({
-            input: selection.input,
-            interpretation: selection.interpretation,
-            resolved: selection.model,
-        });
-    }
-    return Object.freeze({ selected, resolved, aliasInferenceByLayer });
-}
-function normalizeTimeout(value) {
-    if (value === null)
-        return null;
-    const milliseconds = typeof value === "string" ? parseDuration(value, DURATION_UNITS) : value;
-    if (milliseconds === null ||
-        !Number.isInteger(milliseconds) ||
-        milliseconds < 0 ||
-        milliseconds > EXECUTION_MAX_TIMEOUT_MS) {
-        throw new ConfigError(`Resolved execution timeout must be null, a bounded integer in milliseconds, or a duration such as 20m.`, "INVALID_CONFIG_FILE");
-    }
-    return milliseconds;
-}
-function toolsRequireAuthorization(value, present) {
-    if (!present || value === null)
-        return false;
-    if (typeof value === "string")
-        return value.length > 0;
-    if (Array.isArray(value))
-        return value.length > 0;
-    return typeof value === "object" && value !== null && Object.keys(value).length > 0;
-}
-function normalizeAuthorizationDecision(value) {
-    const input = record(value, "tool authorization decision");
-    only(input, ["status", "policy"], "tool authorization decision");
-    const status = required(input, "status", "tool authorization decision");
-    if (status !== "allowed" && status !== "denied") {
-        throw new TypeError("tool authorization decision.status must be allowed or denied");
-    }
-    const policy = stableIdentifier(required(input, "policy", "tool authorization decision"), "tool authorization decision.policy");
-    return Object.freeze({ status, policy });
-}
-function authorizationFor(requiresAuthorization, authorizer, input) {
-    if (!requiresAuthorization)
-        return Object.freeze({ status: "not-required" });
-    if (!authorizer || !input) {
-        return Object.freeze({
-            status: "denied",
-            reason: "Selected tools require an explicit machine/user authorization policy.",
-            policy: Object.freeze({ id: "unconfigured" }),
-        });
-    }
-    const decision = normalizeAuthorizationDecision(authorizer(Object.freeze(input)));
-    return Object.freeze({
-        status: decision.status,
-        reason: decision.status === "allowed"
-            ? "Selected tools were authorized by operator policy."
-            : "Selected tools are not authorized by operator policy.",
-        policy: Object.freeze({ id: decision.policy }),
-    });
-}
-function freezeProvenance(fields) {
-    return frozenNullPrototypeRecord(Object.entries(fields)
-        .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
-        .map(([key, value]) => [key, Object.freeze({ ...value })]));
-}
-export function planExecutionCascade(raw) {
-    const input = record(raw, "execution cascade input");
-    only(input, ["command", "conversation", "persona", "layers", "engines", "modelMap", "invocationKind", "authorizeTools"], "execution cascade input");
-    const command = cloneResolvedCommandContent(required(input, "command", "execution cascade input"));
-    const invocationKind = required(input, "invocationKind", "execution cascade input");
-    if (invocationKind !== "direct" && invocationKind !== "task" && invocationKind !== "workflow") {
-        throw new TypeError("execution cascade input.invocationKind is invalid");
-    }
-    const normalizedInvocationKind = invocationKind;
-    const personaPresent = own(input, "persona");
-    if (personaPresent && input.persona === undefined) {
-        throw new TypeError("execution cascade input.persona must be omitted, null, or a resolved persona");
-    }
-    let persona = personaPresent
-        ? input.persona === null
-            ? null
-            : cloneResolvedPersonaContent(input.persona)
-        : undefined;
-    if (own(input, "authorizeTools") &&
-        input.authorizeTools !== undefined &&
-        typeof input.authorizeTools !== "function") {
-        throw new TypeError("execution cascade input.authorizeTools must be a function or omitted");
-    }
-    const normalizedLayers = normalizeLayers(required(input, "layers", "execution cascade input"));
-    const engines = normalizeEngines(required(input, "engines", "execution cascade input"));
-    const modelMap = normalizeModelMap(required(input, "modelMap", "execution cascade input"));
-    const beforeEngine = orderedWithoutEngine(normalizedLayers);
-    const selectedEngine = chooseEngine(beforeEngine, engines);
-    const engineLayer = Object.freeze({
-        id: selectedEngine.definition.selection.name,
-        kind: "engine",
-        values: selectedEngine.definition.defaults,
-    });
-    const layers = [
-        normalizedLayers.installation,
-        engineLayer,
-        normalizedLayers.agent,
-        normalizedLayers.command,
-        normalizedLayers.invocationDefaults,
-        normalizedLayers.current,
-    ].filter((layer) => layer !== undefined);
-    const fields = Object.create(null);
-    fields.engine = selectedEngine.field;
-    if (selectedEngine.requested)
-        fields["engine.requested"] = selectedEngine.requested;
-    const commandRef = command.source?.ref ?? null;
-    fields.command = sourceProvenance(commandRef ?? "inline", "command");
-    const selectedAgent = selectNearest(layers, "agent");
-    let resolvedAgent;
-    let requestPersonaPresent = personaPresent;
-    if (selectedAgent.present) {
-        fields.agent = provenance(selectedAgent.layer);
-        if (selectedAgent.value === null) {
-            resolvedAgent = null;
-            persona = null;
-            requestPersonaPresent = true;
-        }
-        else {
-            const selector = stableIdentifier(selectedAgent.value, "selected agent");
-            resolvedAgent = selector;
-            if (isPortableExecutionAgentSelector(selector)) {
-                if (!persona || !executionPersonaMatchesSelector(selector, persona.source.ref)) {
-                    throw new ConfigError(`Selected agent ${JSON.stringify(selector)} does not match the resolved persona source.`, "INVALID_CONFIG_FILE", "Resolve the selected agent through its bundle adapter before planning execution.");
-                }
-            }
-            else {
-                persona = null;
-                requestPersonaPresent = true;
-            }
-        }
-    }
-    const personaRef = persona?.source.ref ?? null;
-    if (persona)
-        fields.persona = sourceProvenance(personaRef, "agent");
-    const modelResolution = resolveModels(layers, selectedEngine.definition, modelMap);
-    const selectedModel = modelResolution.selected;
-    if (selectedModel.present) {
-        fields.model = provenance(selectedModel.layer);
-    }
-    const inference = resolveInference(layers, modelResolution.aliasInferenceByLayer, fields);
-    const selectedSchema = selectNearest(layers, "outputSchema");
-    if (selectedSchema.present)
-        fields.outputSchema = provenance(selectedSchema.layer);
-    const selectedTools = selectNearest(layers, "tools");
-    if (selectedTools.present)
-        fields.tools = provenance(selectedTools.layer);
-    const selectedTimeout = selectNearest(layers, "timeout");
-    const selectedWorkspace = selectNearest(layers, "workspace");
-    const selectedEnvironment = selectNearest(layers, "environment");
-    const selectedRuntime = selectNearest(layers, "runtime");
-    const runtime = {};
-    if (selectedTimeout.present) {
-        runtime.timeoutMs = normalizeTimeout(selectedTimeout.value);
-        fields["runtime.timeoutMs"] = provenance(selectedTimeout.layer);
-    }
-    if (selectedWorkspace.present) {
-        runtime.workspace = selectedWorkspace.value;
-        fields["runtime.workspace"] = provenance(selectedWorkspace.layer);
-    }
-    if (selectedEnvironment.present) {
-        runtime.environment = selectedEnvironment.value;
-        fields["runtime.environment"] = provenance(selectedEnvironment.layer);
-    }
-    if (selectedRuntime.present) {
-        runtime.settings = selectedRuntime.value;
-        fields["runtime.settings"] = provenance(selectedRuntime.layer);
-    }
-    const notices = selectedEngine.fallback
-        ? [
-            {
-                code: "engine-fallback",
-                severity: "info",
-                adapter: "akm",
-                field: "engine",
-                message: "No engine was selected; using the fixed opencode-sdk fallback.",
-            },
-        ]
-        : [];
-    const tools = selectedTools.present ? cloneToolSelection(selectedTools.value, "resolved tools") : undefined;
-    const requiresAuthorization = toolsRequireAuthorization(tools, selectedTools.present);
-    const provisionalAuthorization = requiresAuthorization
-        ? { status: "allowed", policy: { id: "pre-authorization-validation" } }
-        : { status: "not-required" };
-    const requestInput = {
-        command,
-        engine: selectedEngine.definition.selection,
-        authorization: provisionalAuthorization,
-        runtime,
-        notices,
-    };
-    if (own(input, "conversation"))
-        requestInput.conversation = input.conversation;
-    if (selectedAgent.present)
-        requestInput.agent = resolvedAgent;
-    if (requestPersonaPresent)
-        requestInput.persona = persona;
-    if (selectedModel.present)
-        requestInput.model = modelResolution.resolved;
-    if (inference.present)
-        requestInput.inference = inference.value;
-    if (selectedSchema.present)
-        requestInput.outputSchema = selectedSchema.value;
-    if (selectedTools.present)
-        requestInput.tools = tools;
-    // Validate every dispatch-significant value and source provenance before a
-    // policy callback can observe the request or any caller can dispatch it.
-    const provisionalRequest = createResolvedExecutionRequest(requestInput);
-    if (own(provisionalRequest, "conversation"))
-        requestInput.conversation = provisionalRequest.conversation;
-    const authorizationInput = requiresAuthorization
-        ? {
-            tools: tools,
-            engine: Object.freeze({
-                name: selectedEngine.definition.selection.name,
-                kind: selectedEngine.definition.selection.kind,
-                ...(own(selectedEngine.definition.selection, "platform")
-                    ? { platform: selectedEngine.definition.selection.platform }
-                    : {}),
-            }),
-            invocationKind: normalizedInvocationKind,
-            commandRef,
-            personaRef,
-        }
-        : undefined;
-    const authorization = authorizationFor(requiresAuthorization, input.authorizeTools, authorizationInput);
-    fields.authorization = Object.freeze({
-        layer: authorization.policy && typeof authorization.policy.id === "string" ? authorization.policy.id : "not-required",
-        kind: "authorization",
-        via: "policy",
-    });
-    requestInput.authorization = authorization;
-    const request = createResolvedExecutionRequest(requestInput);
-    const planObject = {
-        schemaVersion: EXECUTION_CASCADE_PLAN_VERSION,
-        invocationKind: normalizedInvocationKind,
-        request,
-        provenance: freezeProvenance(fields),
-    };
-    if (selectedAgent.present)
-        planObject.selectedAgent = resolvedAgent;
-    const plan = Object.freeze(planObject);
-    planInstances.add(plan);
-    return plan;
-}
-export function requireAuthorizedExecutionPlan(plan) {
-    if (!planInstances.has(plan) || !Object.isFrozen(plan)) {
-        throw new TypeError("execution plan must be constructed by the common cascade resolver");
-    }
-    if (plan.request.authorization.status === "denied") {
-        throw new ConfigError(plan.request.authorization.reason ?? "Resolved execution is not authorized by operator policy.", "EXECUTION_NOT_AUTHORIZED");
-    }
-    return plan.request;
-}