rea-agents 3.2.1 → 4.0.1

package/dist/domain/replayMachineRuntime.js

@@ -1,296 +0,0 @@
-import { z } from "zod";
-import { isJsonCompatible, replayValuesEqual } from "./replayMachineValues.js";
-/** One bounded inbound protocol event offered to a replay machine. */
-const replayEventHeadersSchema = z
-    .record(z
-    .string()
-    .min(1)
-    .regex(/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/u), z.string().regex(/^[\t\x20-\x7e\x80-\xff]*$/u))
-    .superRefine((headers, context) => {
-    const normalized = Object.keys(headers).map((name) => name.toLowerCase());
-    if (new Set(normalized).size !== normalized.length)
-        context.addIssue({
-            code: "custom",
-            message: "replay event headers must be unique ignoring case",
-            input: headers,
-        });
-});
-const replayEventFields = {
-    at_ms: z.number().int().safe().nonnegative(),
-    path: z.string().startsWith("/"),
-    headers: replayEventHeadersSchema,
-    body: z.string(),
-};
-export const replayMachineEventSchema = z.discriminatedUnion("protocol", [
-    z.strictObject({
-        protocol: z.literal("http"),
-        connection: z.literal("not_applicable"),
-        method: z
-            .string()
-            .min(1)
-            .transform((method) => method.toUpperCase()),
-        ...replayEventFields,
-    }),
-    z.strictObject({
-        protocol: z.literal("websocket_connect"),
-        connection: z.enum(["initial", "reconnect"]),
-        method: z.null(),
-        ...replayEventFields,
-    }),
-    z.strictObject({
-        protocol: z.literal("websocket_message"),
-        connection: z.enum(["initial", "reconnect"]),
-        method: z.null(),
-        ...replayEventFields,
-    }),
-]);
-const parseJson = (value) => {
-    try {
-        const parsed = JSON.parse(value);
-        return parsed;
-    }
-    catch {
-        return undefined;
-    }
-};
-const atPath = (value, path) => {
-    let current = value;
-    for (const segment of path) {
-        if (typeof segment === "number") {
-            if (!Array.isArray(current))
-                return undefined;
-            current = current[segment];
-            continue;
-        }
-        if (typeof current !== "object" ||
-            current === null ||
-            !Object.hasOwn(current, segment))
-            return undefined;
-        const next = Reflect.get(current, segment);
-        current = next;
-    }
-    return current;
-};
-const actionJsonBody = (transition) => {
-    for (const action of transition.actions)
-        if (action.type === "http_response")
-            return action.body;
-        else if (action.type === "websocket_send")
-            return action.data;
-    return undefined;
-};
-const triggerKey = (transition) => `${transition.trigger.protocol}\0${transition.trigger.path}`;
-const readValue = (source, event, transition) => {
-    switch (source.source) {
-        case "request_header":
-            return event.headers[source.name.toLowerCase()];
-        case "request_json":
-            return atPath(parseJson(event.body), source.path);
-        case "websocket_json":
-            return atPath(parseJson(event.body), source.path);
-        case "action_json": {
-            const body = actionJsonBody(transition);
-            return body === undefined
-                ? undefined
-                : atPath(parseJson(body), source.path);
-        }
-    }
-};
-const triggerMatches = (transition, event) => {
-    const trigger = transition.trigger;
-    if (trigger.protocol !== event.protocol || trigger.path !== event.path)
-        return false;
-    if ("headers" in trigger &&
-        Object.entries(trigger.headers).some(([name, value]) => event.headers[name.toLowerCase()] !== value))
-        return false;
-    if (trigger.protocol === "http")
-        return (trigger.method === event.method &&
-            (trigger.body === null || trigger.body === event.body));
-    if (trigger.protocol === "websocket_message")
-        return trigger.body === null || trigger.body === event.body;
-    return true;
-};
-const createTransitionRecord = ({ sequence, atMs, stateBefore, transition, captures, }) => ({
-    sequence,
-    at_ms: atMs,
-    transition_id: transition.id,
-    state_before: stateBefore,
-    state_after: transition.to,
-    sensitive_aliases: captures
-        .filter(({ sensitive }) => sensitive)
-        .map(({ variable }) => variable)
-        .sort(),
-});
-/** Stateful evaluator for one validated replay-machine instance. */
-export class ReplayMachineRuntime {
-    machine;
-    #transitionsByTrigger = new Map();
-    #variables = new Map();
-    #sensitiveValues = new Map();
-    #uses = new Map();
-    #stateVisits = new Map();
-    #timeline = [];
-    #state;
-    #connections = 0;
-    #messages = 0;
-    #bytes = 0;
-    #lastAtMs = 0;
-    #events = 0;
-    constructor(machine) {
-        this.machine = machine;
-        this.#state = machine.initial_state;
-        this.#stateVisits.set(machine.initial_state, 1);
-        const byTrigger = new Map();
-        for (const [declarationOrder, transition,] of machine.transitions.entries()) {
-            const key = triggerKey(transition);
-            const indexed = byTrigger.get(key) ?? [];
-            indexed.push({ transition, declarationOrder });
-            byTrigger.set(key, indexed);
-        }
-        for (const [key, indexed] of byTrigger)
-            this.#transitionsByTrigger.set(key, indexed.sort((left, right) => left.transition.priority - right.transition.priority ||
-                left.declarationOrder - right.declarationOrder));
-    }
-    /** Current machine state after all accepted transitions. */
-    get state() {
-        return this.#state;
-    }
-    /** Ordered, secret-free transition records. */
-    get timeline() {
-        return this.#timeline;
-    }
-    /** Current committed use of the machine's declared limits. */
-    get usage() {
-        return {
-            events: this.#events,
-            transitions: this.#timeline.length,
-            connections: this.#connections,
-            messages: this.#messages,
-            bytes: this.#bytes,
-            last_at_ms: this.#lastAtMs,
-        };
-    }
-    /** Replace captured secret values with stable aliases before persistence. */
-    redact(value) {
-        let redacted = value;
-        const secrets = [...this.#sensitiveValues]
-            .flatMap(([variable, values]) => [...values].map((secret) => ({ variable, secret })))
-            .sort((left, right) => right.secret.length - left.secret.length ||
-            left.variable.localeCompare(right.variable));
-        for (const { variable, secret } of secrets)
-            redacted = redacted.replaceAll(secret, `<secret:${variable}>`);
-        return redacted;
-    }
-    /** Replace a field containing captured secrets with one stable alias only. */
-    redactField(value) {
-        const alias = [...this.#sensitiveValues]
-            .filter(([, values]) => [...values].some((secret) => value.includes(secret)))
-            .map(([variable]) => variable)
-            .sort()[0];
-        return alias === undefined ? value : `<secret:${alias}>`;
-    }
-    /** Evaluate and, when admitted, commit one protocol event. */
-    dispatch(event) {
-        const normalizedEvent = {
-            ...event,
-            headers: Object.fromEntries(Object.entries(event.headers).map(([name, value]) => [
-                name.toLowerCase(),
-                value,
-            ])),
-        };
-        if (!this.#admitEvent(normalizedEvent))
-            return this.#refusal("limit_exhausted");
-        const matching = this.#matchingTransitions(normalizedEvent);
-        const eligible = matching.filter(({ transition }) => this.#transitionStartsHere(transition));
-        if (eligible.length === 0)
-            return this.#refusal(this.#noEligibleReason(matching, normalizedEvent));
-        const guarded = eligible.filter(({ transition }) => this.#transitionGuardsMatch(transition, normalizedEvent));
-        if (guarded.length === 0)
-            return this.#refusal("guard_failed");
-        if (this.#timeline.length >= this.machine.max_transitions)
-            return this.#refusal("transition_exhausted");
-        const usable = guarded.find(({ transition }) => (this.#uses.get(transition.id) ?? 0) < transition.max_uses);
-        if (usable === undefined)
-            return this.#refusal("transition_exhausted");
-        const transition = usable.transition;
-        const used = this.#uses.get(transition.id) ?? 0;
-        const nextState = this.machine.states.find(({ name }) => name === transition.to);
-        const nextVisits = (this.#stateVisits.get(transition.to) ?? 0) + 1;
-        if (nextState === undefined || nextVisits > nextState.max_visits)
-            return this.#refusal("limit_exhausted");
-        const captures = transition.captures.map((capture) => ({
-            ...capture,
-            captured: readValue(capture.value, normalizedEvent, transition),
-        }));
-        if (captures.some(({ captured, sensitive }) => !isJsonCompatible(captured) ||
-            (sensitive && typeof captured !== "string")))
-            return this.#refusal("invalid_capture");
-        for (const capture of captures) {
-            this.#variables.set(capture.variable, capture.captured);
-            if (capture.sensitive && typeof capture.captured === "string") {
-                const values = this.#sensitiveValues.get(capture.variable) ?? new Set();
-                if (capture.captured.length > 0)
-                    values.add(capture.captured);
-                this.#sensitiveValues.set(capture.variable, values);
-            }
-        }
-        const record = createTransitionRecord({
-            sequence: this.#timeline.length,
-            atMs: normalizedEvent.recorded_at_ms ?? normalizedEvent.at_ms,
-            stateBefore: this.#state,
-            transition,
-            captures,
-        });
-        this.#uses.set(transition.id, used + 1);
-        this.#stateVisits.set(transition.to, nextVisits);
-        this.#state = transition.to;
-        this.#timeline.push(record);
-        return {
-            outcome: "matched",
-            actions: transition.actions,
-            transition: record,
-        };
-    }
-    #matchingTransitions(event) {
-        return (this.#transitionsByTrigger.get(`${event.protocol}\0${event.path}`) ?? []).filter(({ transition }) => triggerMatches(transition, event));
-    }
-    #transitionStartsHere(transition) {
-        return transition.from === this.#state;
-    }
-    #noEligibleReason(matching, event) {
-        if (matching.length === 0)
-            return "unmatched";
-        return event.protocol === "websocket_connect" &&
-            event.connection === "reconnect"
-            ? "unexpected_reconnect"
-            : "invalid_state";
-    }
-    #transitionGuardsMatch(transition, event) {
-        return transition.guards.every((guard) => {
-            if (!this.#variables.has(guard.variable))
-                return false;
-            return replayValuesEqual(this.#variables.get(guard.variable), readValue(guard.value, event, transition));
-        });
-    }
-    #admitEvent(event) {
-        const connections = this.#connections + (event.protocol === "websocket_connect" ? 1 : 0);
-        const messages = this.#messages + (event.protocol === "websocket_message" ? 1 : 0);
-        const bytes = this.#bytes + Buffer.byteLength(event.body);
-        if (!Number.isSafeInteger(event.at_ms) ||
-            event.at_ms < this.#lastAtMs ||
-            event.at_ms > this.machine.limits.duration_ms ||
-            connections > this.machine.limits.connections ||
-            messages > this.machine.limits.messages ||
-            bytes > this.machine.limits.bytes)
-            return false;
-        this.#connections = connections;
-        this.#messages = messages;
-        this.#bytes = bytes;
-        this.#lastAtMs = event.at_ms;
-        this.#events += 1;
-        return true;
-    }
-    #refusal(outcome) {
-        return { outcome, actions: [], transition: null };
-    }
-}

package/dist/domain/replayMachineValues.js

@@ -1,84 +0,0 @@
-/** Compare JSON-compatible replay values without recursive stack growth. */
-export const replayValuesEqual = (left, right) => {
-    const pending = [[left, right]];
-    while (pending.length > 0) {
-        const pair = pending.pop();
-        if (pair === undefined)
-            continue;
-        const [currentLeft, currentRight] = pair;
-        const primitive = equalPrimitiveReplayValues(currentLeft, currentRight);
-        if (primitive !== undefined) {
-            if (!primitive)
-                return false;
-            continue;
-        }
-        const array = compareReplayArrays(currentLeft, currentRight, pending);
-        if (array !== undefined) {
-            if (!array)
-                return false;
-            continue;
-        }
-        if (!compareReplayRecords(currentLeft, currentRight, pending))
-            return false;
-    }
-    return true;
-};
-/** Check that captured values can be serialized as JSON without recursion. */
-export const isJsonCompatible = (value) => {
-    const pending = [value];
-    while (pending.length > 0) {
-        const candidate = pending.pop();
-        if (candidate === null ||
-            typeof candidate === "string" ||
-            typeof candidate === "boolean")
-            continue;
-        if (typeof candidate === "number") {
-            if (!Number.isFinite(candidate))
-                return false;
-            continue;
-        }
-        if (Array.isArray(candidate)) {
-            for (const item of candidate)
-                pending.push(item);
-            continue;
-        }
-        if (typeof candidate !== "object")
-            return false;
-        for (const item of Object.values(candidate))
-            pending.push(item);
-    }
-    return true;
-};
-const equalPrimitiveReplayValues = (left, right) => {
-    if (left === null || typeof left === "string" || typeof left === "boolean")
-        return left === right;
-    if (typeof left !== "number")
-        return undefined;
-    return (Number.isFinite(left) &&
-        left === right &&
-        typeof right === "number" &&
-        Number.isFinite(right));
-};
-const compareReplayArrays = (left, right, pending) => {
-    if (!Array.isArray(left))
-        return undefined;
-    if (!Array.isArray(right) || left.length !== right.length)
-        return false;
-    for (let index = 0; index < left.length; index += 1)
-        pending.push([left[index], right[index]]);
-    return true;
-};
-const compareReplayRecords = (left, right, pending) => {
-    if (typeof left !== "object" || left === null)
-        return undefined;
-    if (typeof right !== "object" || right === null || Array.isArray(right))
-        return false;
-    const leftKeys = Object.keys(left).sort();
-    const rightKeys = Object.keys(right).sort();
-    if (leftKeys.length !== rightKeys.length ||
-        leftKeys.some((key, index) => key !== rightKeys[index]))
-        return false;
-    for (const key of leftKeys)
-        pending.push([Reflect.get(left, key), Reflect.get(right, key)]);
-    return true;
-};

package/dist/domain/runtimeCharacterization.js

@@ -1,84 +0,0 @@
-import { createHash } from "node:crypto";
-import canonicalize from "canonicalize";
-import { z } from "zod";
-const digestSchema = z.string().regex(/^[a-f0-9]{64}$/u);
-const stableIdSchema = z.string().regex(/^[A-Za-z][A-Za-z0-9._:/-]*$/u);
-const runtimeIdentitySchema = z.strictObject({
-    family: z.string().trim().min(1),
-    provider_id: stableIdSchema,
-    executable_path: z.string().min(1),
-    executable_sha256: digestSchema,
-    version: z.string().trim().min(1),
-    profile_sha256: digestSchema,
-});
-const artifactIdentitySchema = z.strictObject({
-    path: z.string().min(1),
-    sha256: digestSchema,
-    byte_length: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
-});
-const callableIdentitySchema = z.strictObject({
-    callable_id: stableIdSchema,
-    module_id: stableIdSchema,
-    export_name: z.string().min(1),
-    semantic_evidence_id: z
-        .string()
-        .regex(/^ev_[a-f0-9]{64}$/u)
-        .nullable(),
-    selector_sha256: digestSchema,
-});
-export const runtimeCharacterizationPlanSchema = z.strictObject({
-    plan_sha256: digestSchema,
-    preparation_sha256: digestSchema,
-    artifact: artifactIdentitySchema,
-    runtime: runtimeIdentitySchema,
-    callable: callableIdentitySchema,
-    working_directory: z.string().min(1),
-    isolated_home: z.string().min(1),
-    expected_effect: z.enum(["pure", "bounded-effects", "observation-only"]),
-    allowed_boundaries: z.array(stableIdSchema),
-    limits: z.strictObject({
-        max_calls: z.number().int().min(1),
-        max_processes: z.number().int().min(0),
-        max_files: z.number().int().min(0),
-        max_bytes: z.number().int().min(1).max(Number.MAX_SAFE_INTEGER),
-        max_handles: z.number().int().min(0),
-        timeout_ms: z.number().int().min(1),
-        idle_timeout_ms: z.number().int().min(1),
-    }),
-    determinism: z.strictObject({
-        clock: z.enum(["fixed", "real"]),
-        randomness: z.enum(["seeded", "system"]),
-        identifiers: z.enum(["deterministic", "runtime"]),
-        seed: z.number().int().min(0).max(0xffff_ffff),
-    }),
-    authority: z.strictObject({
-        preparation_approved: z.literal(true),
-        execution_approved: z.literal(false),
-        network: z.enum(["none", "loopback"]),
-        provider_owned_process_only: z.literal(true),
-    }),
-});
-/** Commit a provider-neutral preparation plan; execution requires a later approval. */
-export const createRuntimeCharacterizationPlan = (input) => {
-    const parsed = runtimeCharacterizationPlanSchema
-        .omit({ plan_sha256: true })
-        .parse(input);
-    return runtimeCharacterizationPlanSchema.parse({
-        ...parsed,
-        plan_sha256: digest(parsed),
-    });
-};
-/** Parse a characterization plan and reject altered commitments. */
-export const parseRuntimeCharacterizationPlan = (input) => {
-    const parsed = runtimeCharacterizationPlanSchema.parse(input);
-    const { plan_sha256: planSha256, ...semantic } = parsed;
-    if (planSha256 !== digest(semantic))
-        throw new TypeError("Runtime characterization plan digest is invalid");
-    return parsed;
-};
-const digest = (value) => {
-    const encoded = canonicalize(value);
-    if (encoded === undefined)
-        throw new TypeError("Runtime characterization plan is not canonical JSON");
-    return createHash("sha256").update(encoded).digest("hex");
-};