akm-cli 0.9.17-alpha.2 → 0.9.17-alpha.4

package/dist/execution/resolved-request.js

@@ -1,730 +1,176 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-import { cloneExecutionJson, cloneExecutionJsonObject, sortExecutionJson } from "./json.js";
-import { EXECUTION_MAX_TIMEOUT_MS } from "./limits.js";
-import { assertSnapshotKeys, requireSnapshotField, snapshotStrictRecord } from "./record.js";
-import { cloneAdapterExtensions, cloneToolSelection, decodeExecutionSourceIdentity, executionPersonaMatchesSelector, isAdapterRenderedCommandSource, isAdapterRenderedPersonaSource, isPortableExecutionAgentSelector, requireStableExecutionSelector, } from "./source.js";
+import { sortExecutionJson } from "./json.js";
+import { decodeExecutionSourceIdentity, } from "./source.js";
 export const RESOLVED_EXECUTION_SCHEMA_VERSION = 1;
-const resolvedCommandBrand = Symbol("akm.resolved-command");
-const resolvedPersonaBrand = Symbol("akm.resolved-persona");
-const resolvedCommandInstances = new WeakSet();
-const resolvedPersonaInstances = new WeakSet();
-const resolvedRequestInstances = new WeakSet();
-function defineBrand(value, brand, instances) {
-    Object.defineProperty(value, brand, { value: true, enumerable: false });
-    const frozen = Object.freeze(value);
-    instances.add(frozen);
-    return frozen;
-}
-function cloneIdentity(value) {
-    return decodeExecutionSourceIdentity(value);
+const COMMAND_KEYS = ["template", "argumentInput", "content", "source", "extensions"];
+const PERSONA_KEYS = ["content", "source", "extensions"];
+const ENGINE_KEYS = ["name", "kind", "platform", "settings", "extensions"];
+const MODEL_KEYS = ["input", "interpretation", "resolved", "extensions"];
+const AUTHORIZATION_KEYS = ["status", "reason", "policy"];
+const RUNTIME_KEYS = ["timeoutMs", "workspace", "environment", "settings", "extensions"];
+const NOTICE_KEYS = ["code", "severity", "adapter", "field", "message", "details"];
+const IDENTITY_KEYS = ["ref", "bundle", "adapter", "file", "hash"];
+const OPTIONAL_REQUEST_KEYS = [
+    "conversation",
+    "agent",
+    "persona",
+    "model",
+    "inference",
+    "outputSchema",
+    "tools",
+    "extensions",
+];
+/** Copy the own, defined fields named by `keys`; omitted stays omitted, `null` stays `null`. */
+function pick(value, keys) {
+    const record = value;
+    const out = {};
+    for (const key of keys) {
+        if (Object.hasOwn(record, key) && record[key] !== undefined)
+            out[key] = record[key];
+    }
+    return out;
 }
-function copyArgumentInput(input, output) {
-    if (!Object.hasOwn(input, "argumentInput"))
-        return;
-    if (typeof input.argumentInput !== "string") {
-        throw new TypeError("command argumentInput must be omitted or a string");
+function requireRecord(value, path) {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        throw new TypeError(`${path} must be an object`);
     }
-    output.argumentInput = input.argumentInput;
+    return value;
 }
 export function createResolvedCommand(input) {
-    const record = requireObject(input, "resolved command input");
-    assertOnlyKeys(record, ["source", "argumentInput", "content"], "resolved command input");
-    const source = requireOwn(record, "source", "resolved command input");
-    const content = requireOwn(record, "content", "resolved command input");
-    if (!isAdapterRenderedCommandSource(source)) {
-        throw new TypeError("source must be an adapter-rendered command source");
-    }
-    if (typeof content !== "string")
+    if (typeof input.content !== "string")
         throw new TypeError("resolved command content must be a string");
-    const out = {
-        template: source.content,
-        content,
-        source: cloneIdentity(source.identity),
-        ...(source.extensions
-            ? { extensions: cloneAdapterExtensions(source.extensions, "resolved command extensions") }
-            : {}),
-    };
-    copyArgumentInput(record, out);
-    return defineBrand(out, resolvedCommandBrand, resolvedCommandInstances);
+    return Object.freeze({
+        template: input.source.content,
+        ...(input.argumentInput !== undefined ? { argumentInput: input.argumentInput } : {}),
+        content: input.content,
+        source: decodeExecutionSourceIdentity(input.source.identity),
+        ...(input.source.extensions ? { extensions: input.source.extensions } : {}),
+    });
 }
 export function createInlineResolvedCommand(input) {
-    const record = requireObject(input, "inline resolved command input");
-    assertOnlyKeys(record, ["template", "argumentInput", "content"], "inline resolved command input");
-    const template = requireOwn(record, "template", "inline resolved command input");
-    const content = requireOwn(record, "content", "inline resolved command input");
-    if (typeof template !== "string" || typeof content !== "string") {
+    if (typeof input.template !== "string" || typeof input.content !== "string") {
         throw new TypeError("inline command template and content must be strings");
     }
-    const out = { template, content, source: null };
-    copyArgumentInput(record, out);
-    return defineBrand(out, resolvedCommandBrand, resolvedCommandInstances);
+    return Object.freeze({
+        template: input.template,
+        ...(input.argumentInput !== undefined ? { argumentInput: input.argumentInput } : {}),
+        content: input.content,
+        source: null,
+    });
 }
 export function createResolvedPersona(source) {
-    if (!isAdapterRenderedPersonaSource(source)) {
-        throw new TypeError("source must be an adapter-rendered persona source");
-    }
-    const out = {
+    return Object.freeze({
         content: source.content,
-        source: cloneIdentity(source.identity),
-        ...(source.extensions
-            ? { extensions: cloneAdapterExtensions(source.extensions, "resolved persona extensions") }
-            : {}),
-    };
-    return defineBrand(out, resolvedPersonaBrand, resolvedPersonaInstances);
-}
-function hasOwnFrozenBrand(value, brand, instances) {
-    if (typeof value !== "object" ||
-        value === null ||
-        !instances.has(value) ||
-        Object.getPrototypeOf(value) !== Object.prototype ||
-        !Object.isFrozen(value) ||
-        !Object.hasOwn(value, brand)) {
-        return false;
-    }
-    const descriptor = Object.getOwnPropertyDescriptor(value, brand);
-    return (descriptor?.value === true &&
-        descriptor.enumerable === false &&
-        descriptor.configurable === false &&
-        descriptor.writable === false);
-}
-function isResolvedCommand(value) {
-    if (!hasOwnFrozenBrand(value, resolvedCommandBrand, resolvedCommandInstances))
-        return false;
-    try {
-        const allowedSymbols = new Set([resolvedCommandBrand]);
-        const record = requireObject(value, "command", allowedSymbols);
-        assertOnlyKeys(record, ["template", "argumentInput", "content", "source", "extensions"], "command", allowedSymbols);
-        const template = requireOwn(record, "template", "command");
-        const content = requireOwn(record, "content", "command");
-        const source = requireOwn(record, "source", "command");
-        if (typeof template !== "string" || typeof content !== "string")
-            return false;
-        if (Object.hasOwn(record, "argumentInput") && typeof record.argumentInput !== "string")
-            return false;
-        if (source !== null)
-            decodeExecutionSourceIdentity(source, "command.source");
-        if (Object.hasOwn(record, "extensions"))
-            cloneAdapterExtensions(record.extensions, "command.extensions");
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function isResolvedPersona(value) {
-    if (!hasOwnFrozenBrand(value, resolvedPersonaBrand, resolvedPersonaInstances))
-        return false;
-    try {
-        const allowedSymbols = new Set([resolvedPersonaBrand]);
-        const record = requireObject(value, "persona", allowedSymbols);
-        assertOnlyKeys(record, ["content", "source", "extensions"], "persona", allowedSymbols);
-        if (typeof requireOwn(record, "content", "persona") !== "string")
-            return false;
-        decodeExecutionSourceIdentity(requireOwn(record, "source", "persona"), "persona.source");
-        if (Object.hasOwn(record, "extensions"))
-            cloneAdapterExtensions(record.extensions, "persona.extensions");
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function requireString(value, path) {
-    if (typeof value !== "string" || value.length === 0)
-        throw new TypeError(`${path} must be a non-empty string`);
-    return value;
-}
-function cloneEngine(input) {
-    const record = requireObject(input, "engine");
-    assertOnlyKeys(record, ["name", "kind", "platform", "settings", "extensions"], "engine");
-    const name = requireString(requireOwn(record, "name", "engine"), "engine.name");
-    const kind = requireOwn(record, "kind", "engine");
-    if (!(kind === "agent" || kind === "sdk" || kind === "llm"))
-        throw new TypeError("engine.kind is invalid");
-    const out = { name, kind };
-    for (const key of ["platform", "settings", "extensions"]) {
-        if (!Object.hasOwn(record, key))
-            continue;
-        const value = record[key];
-        if (value === undefined)
-            throw new TypeError(`engine.${key} must be omitted rather than undefined`);
-        if (key === "platform") {
-            if (value !== null && typeof value !== "string")
-                throw new TypeError("engine.platform must be a string or null");
-            out.platform = value;
-        }
-        else if (key === "settings") {
-            out.settings = value === null ? null : cloneExecutionJsonObject(value, "engine.settings");
-        }
-        else {
-            out.extensions = cloneAdapterExtensions(value, "engine.extensions");
-        }
-    }
-    return Object.freeze(out);
-}
-function cloneModel(input) {
-    const record = requireObject(input, "model");
-    assertOnlyKeys(record, ["input", "interpretation", "resolved", "extensions"], "model");
-    const modelInput = requireString(requireOwn(record, "input", "model"), "model.input");
-    const interpretation = requireOwn(record, "interpretation", "model");
-    const resolved = requireString(requireOwn(record, "resolved", "model"), "model.resolved");
-    if (interpretation !== "alias" && interpretation !== "exact") {
-        throw new TypeError("model.interpretation is invalid");
-    }
-    if (interpretation === "exact" && modelInput !== resolved) {
-        throw new TypeError("model.input must match model.resolved when interpretation is exact");
-    }
-    const out = {
-        input: modelInput,
-        interpretation,
-        resolved,
-    };
-    if (Object.hasOwn(record, "extensions")) {
-        if (record.extensions === null || record.extensions === undefined) {
-            throw new TypeError("model.extensions must be omitted or an adapter-owned extension object");
-        }
-        out.extensions = cloneAdapterExtensions(record.extensions, "model.extensions");
-    }
-    return Object.freeze(out);
-}
-function cloneAuthorization(input) {
-    const record = requireObject(input, "authorization");
-    assertOnlyKeys(record, ["status", "reason", "policy"], "authorization");
-    const status = requireOwn(record, "status", "authorization");
-    if (!(status === "allowed" || status === "denied" || status === "not-required")) {
-        throw new TypeError("authorization.status is invalid");
-    }
-    const out = { status };
-    if (Object.hasOwn(record, "reason")) {
-        if (record.reason !== null && typeof record.reason !== "string") {
-            throw new TypeError("authorization.reason must be a string or null");
-        }
-        out.reason = record.reason;
-    }
-    if (Object.hasOwn(record, "policy")) {
-        out.policy = record.policy === null ? null : cloneExecutionJsonObject(record.policy, "authorization.policy");
-    }
-    return Object.freeze(out);
-}
-function cloneRuntime(input) {
-    const record = requireObject(input, "runtime");
-    assertOnlyKeys(record, ["timeoutMs", "workspace", "environment", "settings", "extensions"], "runtime");
-    const out = {};
-    if (Object.hasOwn(record, "timeoutMs")) {
-        const timeoutMs = record.timeoutMs;
-        if (timeoutMs !== null &&
-            (typeof timeoutMs !== "number" ||
-                !Number.isInteger(timeoutMs) ||
-                timeoutMs < 0 ||
-                timeoutMs > EXECUTION_MAX_TIMEOUT_MS)) {
-            throw new TypeError(`runtime.timeoutMs must be null or an integer from 0 through ${EXECUTION_MAX_TIMEOUT_MS}`);
-        }
-        out.timeoutMs = timeoutMs;
-    }
-    if (Object.hasOwn(record, "workspace")) {
-        if (record.workspace !== null && typeof record.workspace !== "string") {
-            throw new TypeError("runtime.workspace must be a string or null");
-        }
-        out.workspace = record.workspace;
-    }
-    if (Object.hasOwn(record, "environment")) {
-        if (record.environment === null)
-            out.environment = null;
-        else {
-            const environment = cloneExecutionJsonObject(record.environment, "runtime.environment");
-            if (Object.values(environment).some((value) => typeof value !== "string")) {
-                throw new TypeError("runtime.environment values must be strings");
-            }
-            out.environment = environment;
-        }
-    }
-    if (Object.hasOwn(record, "settings")) {
-        out.settings = record.settings === null ? null : cloneExecutionJsonObject(record.settings, "runtime.settings");
-    }
-    if (Object.hasOwn(record, "extensions")) {
-        out.extensions = cloneAdapterExtensions(record.extensions, "runtime.extensions");
-    }
-    return Object.freeze(out);
-}
-function cloneNotice(input, index) {
-    const path = `notices[${index}]`;
-    const record = requireObject(input, path);
-    assertOnlyKeys(record, ["code", "severity", "adapter", "field", "message", "details"], path);
-    const code = requireString(requireOwn(record, "code", path), `${path}.code`);
-    const severity = requireOwn(record, "severity", path);
-    const adapter = requireString(requireOwn(record, "adapter", path), `${path}.adapter`);
-    const message = requireString(requireOwn(record, "message", path), `${path}.message`);
-    if (severity !== "info" && severity !== "warning") {
-        throw new TypeError(`notices[${index}].severity is invalid`);
-    }
-    const out = {
-        code,
-        severity,
-        adapter,
-        message,
-    };
-    if (Object.hasOwn(record, "field")) {
-        if (record.field !== null && typeof record.field !== "string") {
-            throw new TypeError(`notices[${index}].field must be a string or null`);
-        }
-        out.field = record.field;
-    }
-    if (Object.hasOwn(record, "details")) {
-        out.details = record.details === null ? null : cloneExecutionJsonObject(record.details, `${path}.details`);
-    }
-    return Object.freeze(out);
-}
-function cloneConversation(input, path = "conversation") {
-    const cloned = cloneExecutionJson(input, path);
-    if (!Array.isArray(cloned))
-        throw new TypeError(`${path} must be an array`);
-    return Object.freeze(cloned.map((message, index) => {
-        const messagePath = `${path}[${index}]`;
-        const record = requireObject(message, messagePath);
-        assertOnlyKeys(record, ["role", "content"], messagePath);
-        const role = requireOwn(record, "role", messagePath);
-        const content = requireOwn(record, "content", messagePath);
-        if (role !== "system" && role !== "user" && role !== "assistant") {
-            throw new TypeError(`${messagePath}.role must be system, user, or assistant`);
-        }
-        if (typeof content !== "string")
-            throw new TypeError(`${messagePath}.content must be a string`);
-        return Object.freeze({ role, content });
-    }));
-}
-function cloneResolvedCommandLeaf(input) {
-    if (!isResolvedCommand(input))
-        throw new TypeError("command must be constructed by the execution boundary");
-    const allowedSymbols = new Set([resolvedCommandBrand]);
-    const record = requireObject(input, "command", allowedSymbols);
-    assertOnlyKeys(record, ["template", "argumentInput", "content", "source", "extensions"], "command", allowedSymbols);
-    const template = requireOwn(record, "template", "command");
-    const content = requireOwn(record, "content", "command");
-    const source = requireOwn(record, "source", "command");
-    if (typeof template !== "string" || typeof content !== "string") {
-        throw new TypeError("command template and content must be strings");
-    }
-    const out = {
-        template,
-        content,
-        source: source === null ? null : decodeExecutionSourceIdentity(source, "command.source"),
-    };
-    copyArgumentInput(record, out);
-    if (Object.hasOwn(record, "extensions")) {
-        out.extensions = cloneAdapterExtensions(record.extensions, "command.extensions");
-    }
-    return defineBrand(out, resolvedCommandBrand, resolvedCommandInstances);
-}
-function cloneResolvedPersonaLeaf(input) {
-    if (!isResolvedPersona(input))
-        throw new TypeError("persona must be constructed by the execution boundary");
-    const allowedSymbols = new Set([resolvedPersonaBrand]);
-    const record = requireObject(input, "persona", allowedSymbols);
-    assertOnlyKeys(record, ["content", "source", "extensions"], "persona", allowedSymbols);
-    const content = requireOwn(record, "content", "persona");
-    if (typeof content !== "string")
-        throw new TypeError("persona.content must be a string");
-    const out = {
-        content,
-        source: decodeExecutionSourceIdentity(requireOwn(record, "source", "persona"), "persona.source"),
-    };
-    if (Object.hasOwn(record, "extensions")) {
-        out.extensions = cloneAdapterExtensions(record.extensions, "persona.extensions");
-    }
-    return defineBrand(out, resolvedPersonaBrand, resolvedPersonaInstances);
-}
-/** Revalidate and detach one command leaf before any caller dereferences it. */
-export function cloneResolvedCommandContent(input) {
-    return cloneResolvedCommandLeaf(input);
-}
-/** Revalidate and detach one persona leaf before any caller dereferences it. */
-export function cloneResolvedPersonaContent(input) {
-    return cloneResolvedPersonaLeaf(input);
-}
-function cloneAgentSelector(input, path) {
-    if (input === null)
-        return null;
-    return requireStableExecutionSelector(input, path);
-}
-function assertAgentPersonaInvariant(request, path) {
-    if (!Object.hasOwn(request, "agent"))
-        return;
-    if (!Object.hasOwn(request, "persona")) {
-        throw new TypeError(`${path}.persona must be present when ${path}.agent is selected or explicitly null`);
-    }
-    const agent = request.agent;
-    const persona = request.persona;
-    if (agent === null) {
-        if (persona !== null)
-            throw new TypeError(`${path}.agent null requires ${path}.persona null`);
-        return;
-    }
-    if (isPortableExecutionAgentSelector(agent)) {
-        if (persona === null || !executionPersonaMatchesSelector(agent, persona.source.ref)) {
-            throw new TypeError(`${path}.agent portable selector must match the non-null persona source`);
-        }
-        return;
-    }
-    if (persona !== null) {
-        throw new TypeError(`${path}.agent native selector requires ${path}.persona null`);
-    }
+        source: decodeExecutionSourceIdentity(source.identity),
+        ...(source.extensions ? { extensions: source.extensions } : {}),
+    });
 }
-/** Validate and freeze one request without normalizing away optional-field presence. */
+/** Freeze one request without normalizing away optional-field presence. */
 export function createResolvedExecutionRequest(input) {
-    const record = requireObject(input, "resolved execution request input");
-    assertOnlyKeys(record, [
-        "command",
-        "conversation",
-        "agent",
-        "persona",
-        "engine",
-        "model",
-        "inference",
-        "outputSchema",
-        "tools",
-        "authorization",
-        "runtime",
-        "notices",
-        "extensions",
-    ], "resolved execution request input");
-    const command = requireOwn(record, "command", "resolved execution request input");
-    const engine = requireOwn(record, "engine", "resolved execution request input");
-    const authorization = requireOwn(record, "authorization", "resolved execution request input");
-    const runtime = requireOwn(record, "runtime", "resolved execution request input");
-    const notices = requireOwn(record, "notices", "resolved execution request input");
-    if (!isResolvedCommand(command))
-        throw new TypeError("command must be constructed by the execution boundary");
-    const clonedNotices = cloneExecutionJson(notices, "notices");
-    if (!Array.isArray(clonedNotices))
-        throw new TypeError("notices must be an array");
-    const out = {
-        schemaVersion: RESOLVED_EXECUTION_SCHEMA_VERSION,
-        command: cloneResolvedCommandLeaf(command),
-        engine: cloneEngine(engine),
-        authorization: cloneAuthorization(authorization),
-        runtime: cloneRuntime(runtime),
-        notices: Object.freeze(clonedNotices.map((notice, index) => cloneNotice(notice, index))),
-    };
-    if (Object.hasOwn(record, "conversation"))
-        out.conversation = cloneConversation(record.conversation);
-    if (Object.hasOwn(record, "agent")) {
-        if (record.agent === undefined)
-            throw new TypeError("agent must be omitted, null, or a selected agent string");
-        out.agent = cloneAgentSelector(record.agent, "agent");
-    }
-    if (Object.hasOwn(record, "persona")) {
-        if (record.persona !== null && !isResolvedPersona(record.persona)) {
-            throw new TypeError("persona must be null or constructed by the execution boundary");
-        }
-        out.persona = record.persona === null ? null : cloneResolvedPersonaLeaf(record.persona);
-    }
-    assertAgentPersonaInvariant(out, "resolved execution request");
-    if (Object.hasOwn(record, "model")) {
-        if (record.model === undefined)
-            throw new TypeError("model must be omitted, null, or a model selection");
-        out.model = record.model === null ? null : cloneModel(record.model);
-    }
-    if (Object.hasOwn(record, "inference")) {
-        out.inference = record.inference === null ? null : cloneExecutionJsonObject(record.inference, "inference");
-    }
-    if (Object.hasOwn(record, "outputSchema")) {
-        out.outputSchema =
-            record.outputSchema === null ? null : cloneExecutionJsonObject(record.outputSchema, "outputSchema");
-    }
-    if (Object.hasOwn(record, "tools"))
-        out.tools = cloneToolSelection(record.tools, "tools");
-    const toolsRequireAuthorization = toolSelectionRequiresAuthorization(out.tools, Object.hasOwn(out, "tools"));
-    const authorizationStatus = out.authorization.status;
-    if (toolsRequireAuthorization && authorizationStatus === "not-required") {
-        throw new TypeError("authorization.status not-required is valid only when no tools are selected");
-    }
-    if (!toolsRequireAuthorization && authorizationStatus !== "not-required") {
-        throw new TypeError("empty or omitted tool selection requires authorization.status not-required");
-    }
-    if (Object.hasOwn(record, "extensions")) {
-        out.extensions = cloneAdapterExtensions(record.extensions, "request.extensions");
-    }
-    const frozen = Object.freeze(out);
-    resolvedRequestInstances.add(frozen);
-    return frozen;
-}
-function toolSelectionRequiresAuthorization(value, present) {
-    // WP1's transport-level invariant is intentionally syntax based: omitted,
-    // null, "", [], and {} are the only empty spellings. Adapters/resolvers own
-    // any format-specific normalization before they construct this request.
-    if (!present || value === null)
-        return false;
-    if (typeof value === "string")
-        return value.length > 0;
-    if (Array.isArray(value))
-        return value.length > 0;
-    return typeof value === "object" && value !== null && Object.keys(value).length > 0;
-}
-function requireObject(value, path, allowedSymbols = new Set()) {
-    return snapshotStrictRecord(value, path, { allowedSymbols });
-}
-function assertOnlyKeys(value, allowed, path, allowedSymbols = new Set()) {
-    assertSnapshotKeys(value, allowed, path, allowedSymbols);
-}
-function requireOwn(value, key, path) {
-    return requireSnapshotField(value, key, path);
-}
-function decodeExtensions(value, path) {
-    return cloneAdapterExtensions(requireObject(value, path), path);
-}
-function decodeResolvedCommand(value) {
-    const input = requireObject(value, "command");
-    assertOnlyKeys(input, ["template", "argumentInput", "content", "source", "extensions"], "command");
-    const template = requireOwn(input, "template", "command");
-    const content = requireOwn(input, "content", "command");
-    const source = requireOwn(input, "source", "command");
-    if (typeof template !== "string" || typeof content !== "string") {
-        throw new TypeError("command template and content must be strings");
+    if (!input.command || !input.engine || !input.authorization || !input.runtime || !input.notices) {
+        throw new TypeError("resolved execution request requires command, engine, authorization, runtime, and notices");
     }
     const out = {
-        template,
-        content,
-        source: source === null ? null : decodeExecutionSourceIdentity(source, "command.source"),
+        schemaVersion: RESOLVED_EXECUTION_SCHEMA_VERSION,
+        command: input.command,
+        engine: input.engine,
+        authorization: input.authorization,
+        runtime: input.runtime,
+        notices: input.notices,
+        ...pick(input, OPTIONAL_REQUEST_KEYS),
     };
-    if (Object.hasOwn(input, "argumentInput")) {
-        if (typeof input.argumentInput !== "string")
-            throw new TypeError("command.argumentInput must be a string");
-        out.argumentInput = input.argumentInput;
-    }
-    if (Object.hasOwn(input, "extensions"))
-        out.extensions = decodeExtensions(input.extensions, "command.extensions");
-    return defineBrand(out, resolvedCommandBrand, resolvedCommandInstances);
-}
-function decodeResolvedPersona(value) {
-    const input = requireObject(value, "persona");
-    assertOnlyKeys(input, ["content", "source", "extensions"], "persona");
-    const content = requireOwn(input, "content", "persona");
-    if (typeof content !== "string")
-        throw new TypeError("persona.content must be a string");
-    const source = decodeExecutionSourceIdentity(requireOwn(input, "source", "persona"), "persona.source");
-    const out = { content, source };
-    if (Object.hasOwn(input, "extensions"))
-        out.extensions = decodeExtensions(input.extensions, "persona.extensions");
-    return defineBrand(out, resolvedPersonaBrand, resolvedPersonaInstances);
-}
-function decodeEngine(value) {
-    const input = requireObject(value, "engine");
-    assertOnlyKeys(input, ["name", "kind", "platform", "settings", "extensions"], "engine");
-    requireOwn(input, "name", "engine");
-    requireOwn(input, "kind", "engine");
-    return cloneEngine(input);
-}
-function decodeModel(value) {
-    const input = requireObject(value, "model");
-    assertOnlyKeys(input, ["input", "interpretation", "resolved", "extensions"], "model");
-    for (const key of ["input", "interpretation", "resolved"])
-        requireOwn(input, key, "model");
-    return cloneModel(input);
-}
-function decodeAuthorization(value) {
-    const input = requireObject(value, "authorization");
-    assertOnlyKeys(input, ["status", "reason", "policy"], "authorization");
-    requireOwn(input, "status", "authorization");
-    return cloneAuthorization(input);
-}
-function decodeRuntime(value) {
-    const input = requireObject(value, "runtime");
-    assertOnlyKeys(input, ["timeoutMs", "workspace", "environment", "settings", "extensions"], "runtime");
-    return cloneRuntime(input);
-}
-function decodeNotice(value, index) {
-    const input = requireObject(value, `notices[${index}]`);
-    assertOnlyKeys(input, ["code", "severity", "adapter", "field", "message", "details"], `notices[${index}]`);
-    for (const key of ["code", "severity", "adapter", "message"])
-        requireOwn(input, key, `notices[${index}]`);
-    return cloneNotice(input, index);
+    return Object.freeze(out);
 }
 /**
- * Strictly rehydrate a frozen JSON request after workflow resume/replay.
- * Symbol construction brands are restored only after every wire field has
- * been validated; raw/frontmatter lookalike fields are rejected as unknown.
+ * Rehydrate a frozen JSON request after workflow resume/replay. Tolerant of
+ * unknown keys; refuses only a request written by a newer schema.
  */
 export function decodeResolvedExecutionRequest(value) {
-    const input = requireObject(value, "resolved execution request");
-    assertOnlyKeys(input, [
-        "schemaVersion",
-        "command",
-        "conversation",
-        "agent",
-        "persona",
-        "engine",
-        "model",
-        "inference",
-        "outputSchema",
-        "tools",
-        "authorization",
-        "runtime",
-        "notices",
-        "extensions",
-    ], "resolved execution request");
-    if (requireOwn(input, "schemaVersion", "resolved execution request") !== RESOLVED_EXECUTION_SCHEMA_VERSION) {
-        throw new TypeError(`unsupported resolved execution schemaVersion: ${String(input.schemaVersion)}`);
+    const input = requireRecord(value, "resolved execution request");
+    const version = input.schemaVersion;
+    if (version !== RESOLVED_EXECUTION_SCHEMA_VERSION) {
+        throw new TypeError(typeof version === "number" && version > RESOLVED_EXECUTION_SCHEMA_VERSION
+            ? `resolved execution request schemaVersion ${version} was written by a newer akm; upgrade akm to run it`
+            : `unsupported resolved execution schemaVersion: ${String(version)}`);
+    }
+    const command = requireRecord(input.command, "command");
+    if (typeof command.template !== "string" || typeof command.content !== "string") {
+        throw new TypeError("command template and content must be strings");
+    }
+    const engine = requireRecord(input.engine, "engine");
+    if (typeof engine.name !== "string" || (engine.kind !== "agent" && engine.kind !== "sdk" && engine.kind !== "llm")) {
+        throw new TypeError("engine.name must be a string and engine.kind must be agent, sdk, or llm");
     }
-    const notices = requireOwn(input, "notices", "resolved execution request");
-    const clonedNotices = cloneExecutionJson(notices, "resolved execution request.notices");
-    if (!Array.isArray(clonedNotices))
-        throw new TypeError("resolved execution request.notices must be an array");
+    const notices = input.notices;
+    if (!Array.isArray(notices))
+        throw new TypeError("notices must be an array");
     const request = {
-        command: decodeResolvedCommand(requireOwn(input, "command", "resolved execution request")),
-        engine: decodeEngine(requireOwn(input, "engine", "resolved execution request")),
-        authorization: decodeAuthorization(requireOwn(input, "authorization", "resolved execution request")),
-        runtime: decodeRuntime(requireOwn(input, "runtime", "resolved execution request")),
-        notices: clonedNotices.map(decodeNotice),
+        command: Object.freeze({
+            ...pick(command, COMMAND_KEYS),
+            source: command.source === null ? null : decodeExecutionSourceIdentity(command.source, "command.source"),
+        }),
+        engine: Object.freeze(pick(engine, ENGINE_KEYS)),
+        authorization: Object.freeze(pick(requireRecord(input.authorization, "authorization"), AUTHORIZATION_KEYS)),
+        runtime: Object.freeze(pick(requireRecord(input.runtime, "runtime"), RUNTIME_KEYS)),
+        notices: Object.freeze(notices.map((notice, index) => Object.freeze(pick(requireRecord(notice, `notices[${index}]`), NOTICE_KEYS)))),
     };
-    if (Object.hasOwn(input, "conversation")) {
-        request.conversation = cloneConversation(input.conversation, "resolved execution request.conversation");
+    if (Array.isArray(input.conversation)) {
+        request.conversation = Object.freeze(input.conversation.map((message, index) => Object.freeze(pick(requireRecord(message, `conversation[${index}]`), ["role", "content"]))));
+    }
+    if (Object.hasOwn(input, "agent") && input.agent !== undefined)
+        request.agent = input.agent;
+    if (Object.hasOwn(input, "persona") && input.persona !== undefined) {
+        if (input.persona === null)
+            request.persona = null;
+        else {
+            const persona = requireRecord(input.persona, "persona");
+            request.persona = Object.freeze({
+                ...pick(persona, PERSONA_KEYS),
+                source: decodeExecutionSourceIdentity(persona.source, "persona.source"),
+            });
+        }
     }
-    if (Object.hasOwn(input, "agent")) {
-        request.agent = cloneAgentSelector(input.agent, "resolved execution request.agent");
+    if (Object.hasOwn(input, "model") && input.model !== undefined) {
+        request.model = input.model === null ? null : Object.freeze(pick(requireRecord(input.model, "model"), MODEL_KEYS));
     }
-    if (Object.hasOwn(input, "persona")) {
-        request.persona = input.persona === null ? null : decodeResolvedPersona(input.persona);
+    for (const key of ["inference", "outputSchema", "tools", "extensions"]) {
+        if (Object.hasOwn(input, key) && input[key] !== undefined)
+            request[key] = input[key];
     }
-    if (Object.hasOwn(input, "model"))
-        request.model = input.model === null ? null : decodeModel(input.model);
-    if (Object.hasOwn(input, "inference"))
-        request.inference = input.inference;
-    if (Object.hasOwn(input, "outputSchema"))
-        request.outputSchema = input.outputSchema;
-    if (Object.hasOwn(input, "tools"))
-        request.tools = input.tools;
-    if (Object.hasOwn(input, "extensions"))
-        request.extensions = decodeExtensions(input.extensions, "request.extensions");
     return createResolvedExecutionRequest(request);
 }
-function projectIdentity(identity) {
-    return {
-        ref: identity.ref,
-        bundle: identity.bundle,
-        adapter: identity.adapter,
-        file: identity.file,
-        hash: identity.hash,
-    };
-}
-function projectCommand(command) {
-    const out = {
-        template: command.template,
-        content: command.content,
-        source: command.source === null ? null : projectIdentity(command.source),
-    };
-    if (Object.hasOwn(command, "argumentInput"))
-        out.argumentInput = command.argumentInput;
-    if (Object.hasOwn(command, "extensions"))
-        out.extensions = command.extensions;
-    return out;
-}
-function projectPersona(persona) {
-    const out = { content: persona.content, source: projectIdentity(persona.source) };
-    if (Object.hasOwn(persona, "extensions"))
-        out.extensions = persona.extensions;
-    return out;
-}
-function projectEngine(engine) {
-    const out = { name: engine.name, kind: engine.kind };
-    for (const key of ["platform", "settings", "extensions"]) {
-        if (Object.hasOwn(engine, key))
-            out[key] = engine[key];
-    }
-    return out;
-}
-function projectModel(model) {
-    const out = {
-        input: model.input,
-        interpretation: model.interpretation,
-        resolved: model.resolved,
-    };
-    if (Object.hasOwn(model, "extensions"))
-        out.extensions = model.extensions;
-    return out;
-}
-function projectAuthorization(authorization) {
-    const out = { status: authorization.status };
-    for (const key of ["reason", "policy"]) {
-        if (Object.hasOwn(authorization, key))
-            out[key] = authorization[key];
-    }
-    return out;
-}
-function projectRuntime(runtime) {
-    const out = {};
-    for (const key of ["timeoutMs", "workspace", "environment", "settings", "extensions"]) {
-        if (Object.hasOwn(runtime, key))
-            out[key] = runtime[key];
-    }
-    return out;
-}
-function projectNotice(notice) {
-    const out = {
-        code: notice.code,
-        severity: notice.severity,
-        adapter: notice.adapter,
-        message: notice.message,
-    };
-    for (const key of ["field", "details"]) {
-        if (Object.hasOwn(notice, key))
-            out[key] = notice[key];
-    }
-    return out;
-}
-function projectConversationMessage(message) {
-    return { role: message.role, content: message.content };
-}
-function projectResolvedExecutionWire(request) {
-    const out = {
+/** Stable bytes for freeze hashes and entrypoint-equivalence projections. */
+export function canonicalResolvedExecutionRequest(request) {
+    const wire = {
         schemaVersion: RESOLVED_EXECUTION_SCHEMA_VERSION,
-        command: projectCommand(request.command),
-        engine: projectEngine(request.engine),
-        authorization: projectAuthorization(request.authorization),
-        runtime: projectRuntime(request.runtime),
-        notices: request.notices.map(projectNotice),
+        command: {
+            ...pick(request.command, COMMAND_KEYS),
+            source: request.command.source === null ? null : pick(request.command.source, IDENTITY_KEYS),
+        },
+        engine: pick(request.engine, ENGINE_KEYS),
+        authorization: pick(request.authorization, AUTHORIZATION_KEYS),
+        runtime: pick(request.runtime, RUNTIME_KEYS),
+        notices: request.notices.map((notice) => pick(notice, NOTICE_KEYS)),
     };
-    if (Object.hasOwn(request, "conversation")) {
-        if (request.conversation === undefined) {
-            throw new TypeError("constructed request conversation cannot be undefined");
-        }
-        out.conversation = request.conversation.map(projectConversationMessage);
-    }
-    if (Object.hasOwn(request, "agent")) {
-        if (request.agent === undefined)
-            throw new TypeError("constructed request agent cannot be undefined");
-        out.agent = request.agent;
+    if (request.conversation !== undefined) {
+        wire.conversation = request.conversation.map((message) => ({ role: message.role, content: message.content }));
     }
-    if (Object.hasOwn(request, "persona")) {
-        if (request.persona === undefined)
-            throw new TypeError("constructed request persona cannot be undefined");
-        out.persona = request.persona === null ? null : projectPersona(request.persona);
+    if (Object.hasOwn(request, "agent") && request.agent !== undefined)
+        wire.agent = request.agent;
+    if (Object.hasOwn(request, "persona") && request.persona !== undefined) {
+        wire.persona =
+            request.persona === null
+                ? null
+                : { ...pick(request.persona, PERSONA_KEYS), source: pick(request.persona.source, IDENTITY_KEYS) };
     }
-    if (Object.hasOwn(request, "model")) {
-        if (request.model === undefined)
-            throw new TypeError("constructed request model cannot be undefined");
-        out.model = request.model === null ? null : projectModel(request.model);
+    if (Object.hasOwn(request, "model") && request.model !== undefined) {
+        wire.model = request.model === null ? null : pick(request.model, MODEL_KEYS);
     }
     for (const key of ["inference", "outputSchema", "tools", "extensions"]) {
-        if (Object.hasOwn(request, key))
-            out[key] = request[key];
-    }
-    return out;
-}
-function encodeResolvedExecutionWire(request) {
-    const json = cloneExecutionJson(projectResolvedExecutionWire(request), "resolved execution request wire DTO");
-    return `${JSON.stringify(sortExecutionJson(json))}\n`;
-}
-/** Stable bytes for freeze hashes and entrypoint-equivalence projections. */
-export function canonicalResolvedExecutionRequest(request) {
-    if (typeof request !== "object" || request === null || !resolvedRequestInstances.has(request)) {
-        throw new TypeError("resolved execution request must be constructed by the execution boundary");
-    }
-    const canonical = encodeResolvedExecutionWire(request);
-    const decoded = decodeResolvedExecutionRequest(JSON.parse(canonical));
-    if (encodeResolvedExecutionWire(decoded) !== canonical) {
-        throw new TypeError("resolved execution request failed canonical decode/re-encode validation");
+        if (Object.hasOwn(request, key) && request[key] !== undefined)
+            wire[key] = request[key];
     }
-    return canonical;
+    return `${JSON.stringify(sortExecutionJson(wire))}\n`;
 }