@aigne/ash 0.0.1

package/dist/compiler.cjs

@@ -0,0 +1,802 @@
+const require_lexer = require('./lexer.cjs');
+const require_parser = require('./parser.cjs');
+const require_type_checker = require('./type-checker.cjs');
+const require_template = require('./template.cjs');
+
+//#region src/compiler.ts
+function fnv1aHash(str) {
+	let hash = 2166136261;
+	for (let i = 0; i < str.length; i++) {
+		hash ^= str.charCodeAt(i);
+		hash = Math.imul(hash, 16777619) >>> 0;
+	}
+	return hash.toString(16).padStart(8, "0");
+}
+function collectActions(stages) {
+	const actions = [];
+	for (const stage of stages) if (stage.kind === "action") actions.push(stage);
+	else if (stage.kind === "fanout") for (const branch of stage.branches) actions.push(...collectActions(branch));
+	return actions;
+}
+function compileSource(source) {
+	const diagnostics = [];
+	const sourceHash = fnv1aHash(source);
+	const lexer = new require_lexer.AshLexer();
+	const parser = new require_parser.AshParser();
+	const compiler = new AshCompiler();
+	let tokens;
+	try {
+		tokens = lexer.tokenize(source);
+	} catch (e) {
+		return {
+			sourceHash,
+			diagnostics: [require_type_checker.parseSyntaxError(e.message ?? String(e))]
+		};
+	}
+	let ast;
+	try {
+		ast = parser.parse(tokens);
+	} catch (e) {
+		return {
+			sourceHash,
+			diagnostics: [require_type_checker.parseSyntaxError(e.message ?? String(e))]
+		};
+	}
+	const prohibErrors = require_type_checker.checkProhibitedPatterns(ast);
+	diagnostics.push(...require_type_checker.compileErrorsToDiagnostics(prohibErrors));
+	for (const job of ast.jobs) {
+		const typeErrors = require_type_checker.checkPipelineTypes(job.pipeline);
+		diagnostics.push(...require_type_checker.typeErrorsToDiagnostics(typeErrors));
+		const annErrors = require_type_checker.checkAnnotations(job);
+		diagnostics.push(...require_type_checker.annotationErrorsToDiagnostics(annErrors));
+		diagnostics.push(...require_type_checker.checkJobCaps(job));
+		if (job.annotations.some((a) => a.name === "readonly")) {
+			for (const stage of job.pipeline) if (stage.kind === "save" || stage.kind === "publish" || stage.kind === "tee" || stage.kind === "action") diagnostics.push({
+				code: "ASH_READONLY_VIOLATION",
+				message: `@readonly job '${job.name}' contains '${stage.kind}' which writes data`
+			});
+			for (const stage of job.pipeline) if (stage.kind === "route") {
+				const targetNames = [...stage.branches.map((b) => b.targetJob), ...stage.fallback ? [stage.fallback] : []];
+				for (const targetName of targetNames) {
+					const targetJob = ast.jobs.find((j) => j.name === targetName);
+					if (!targetJob) continue;
+					for (const tStage of targetJob.pipeline) if (tStage.kind === "save" || tStage.kind === "publish" || tStage.kind === "tee" || tStage.kind === "action") {
+						diagnostics.push({
+							code: "ASH_READONLY_VIOLATION",
+							message: `@readonly job '${job.name}' routes to '${targetName}' which contains '${tStage.kind}' (write operation)`
+						});
+						break;
+					}
+				}
+			}
+		}
+	}
+	const WRITE_STAGES = new Set([
+		"save",
+		"publish",
+		"tee",
+		"action"
+	]);
+	const letStatements = ast.statements.filter((s) => s.kind === "let" && !!s.pipeline);
+	for (const letStmt of letStatements) if (letStmt.pipeline) {
+		for (const stage of letStmt.pipeline) if (WRITE_STAGES.has(stage.kind)) diagnostics.push({
+			code: "ASH_LET_WRITE",
+			message: `let '${letStmt.name}' pipeline contains '${stage.kind}' — write operations in let bindings are not permitted`
+		});
+	}
+	if (ast.jobs.some((j) => j.annotations.some((a) => a.name === "approval")) && letStatements.length > 0) {
+		const sideEffectLets = letStatements.filter((s) => s.pipeline?.some((stage) => stage.kind === "find" || stage.kind === "action"));
+		if (sideEffectLets.length > 0) diagnostics.push({
+			code: "ASH_LET_PRE_APPROVAL",
+			severity: "warning",
+			message: `let bindings (${sideEffectLets.map((s) => s.name).join(", ")}) execute before @approval checks — side effects in let pipelines bypass approval`
+		});
+	}
+	const paramNames = new Set(ast.statements.filter((s) => s.kind === "param").map((s) => s.name));
+	if (paramNames.size > 0) for (const job of ast.jobs) {
+		if (!job.pipeline.some((s) => WRITE_STAGES.has(s.kind))) continue;
+		for (const stage of job.pipeline) if (stage.kind === "where" && typeof stage.right === "string" && stage.right.startsWith("$")) {
+			const varName = stage.right.slice(1);
+			if (paramNames.has(varName)) {
+				diagnostics.push({
+					code: "ASH_PARAM_WRITE_GATE",
+					severity: "warning",
+					message: `Job '${job.name}': param '$${varName}' gates write operations — callers can override param to change behavior`
+				});
+				break;
+			}
+		}
+	}
+	const readonlyJobs = ast.jobs.filter((j) => j.annotations.some((a) => a.name === "readonly"));
+	if (readonlyJobs.length > 0 && readonlyJobs.length < ast.jobs.length) {
+		const writingJobs = ast.jobs.filter((j) => !j.annotations.some((a) => a.name === "readonly")).filter((j) => j.pipeline.some((s) => s.kind === "save" || s.kind === "publish" || s.kind === "tee" || s.kind === "action"));
+		if (writingJobs.length > 0) diagnostics.push({
+			code: "ASH_MIXED_SECURITY",
+			severity: "warning",
+			message: `Program has mixed security posture: ${readonlyJobs.length} @readonly job(s) alongside ${writingJobs.length} unrestricted writing job(s) (${writingJobs.map((j) => j.name).join(", ")}) — this can mask malicious intent`
+		});
+	}
+	for (const job of ast.jobs) {
+		const actions = collectActions(job.pipeline);
+		if (actions.length === 0) continue;
+		const hasCaps = job.annotations.some((a) => a.name === "caps");
+		const hasBudget = job.annotations.some((a) => a.name === "budget");
+		if (!hasCaps) diagnostics.push({
+			code: "ASH_UNCAPPED_ACTION",
+			message: `Job '${job.name}' contains action stages but has no @caps — actions require explicit capability declaration`
+		});
+		if (actions.length > 1) if (hasCaps && hasBudget) diagnostics.push({
+			code: "ASH_ACTION_AMPLIFICATION",
+			severity: "warning",
+			message: `Job '${job.name}' contains ${actions.length} action stages — budget-gated multi-action execution permitted`
+		});
+		else diagnostics.push({
+			code: "ASH_ACTION_AMPLIFICATION",
+			message: `Job '${job.name}' contains ${actions.length} action stages — multi-action jobs require @caps and @budget to prevent amplification attacks`
+		});
+		const providers = new Set(actions.filter((a) => !a.relative).map((a) => a.path.split("/")[1]).filter(Boolean));
+		if (providers.size > 1) if (hasCaps && hasBudget) diagnostics.push({
+			code: "ASH_CROSS_PROVIDER_ACTION",
+			severity: "warning",
+			message: `Job '${job.name}' has actions targeting ${providers.size} providers (${[...providers].join(", ")}) — budget-gated cross-provider execution permitted`
+		});
+		else diagnostics.push({
+			code: "ASH_CROSS_PROVIDER_ACTION",
+			message: `Job '${job.name}' has actions targeting ${providers.size} providers (${[...providers].join(", ")}) — cross-provider actions require @caps and @budget`
+		});
+		const relativeActions = actions.filter((a) => a.relative);
+		if (relativeActions.length > 0) {
+			if (!job.pipeline.some((s, idx) => s.kind === "find" && job.pipeline.findIndex((p) => p === relativeActions[0]) > idx)) diagnostics.push({
+				code: "ASH_RELATIVE_ACTION_NO_FIND",
+				message: `Job '${job.name}': relative action '${relativeActions[0].path}' has no upstream 'find' — relative actions require a find stage to provide records with paths`
+			});
+			if (hasCaps && hasBudget) diagnostics.push({
+				code: "ASH_ACTION_AMPLIFICATION",
+				severity: "warning",
+				message: `Job '${job.name}': relative action '${relativeActions[0].path}' executes per-record — budget-gated amplification permitted`
+			});
+			else if (!hasCaps || !hasBudget) diagnostics.push({
+				code: "ASH_ACTION_AMPLIFICATION",
+				message: `Job '${job.name}': relative action '${relativeActions[0].path}' executes per-record — requires @caps and @budget to prevent amplification`
+			});
+		}
+	}
+	for (const job of ast.jobs) {
+		const hasCaps = job.annotations.some((a) => a.name === "caps");
+		const hasFind = job.pipeline.some((s) => s.kind === "find" || s.kind === "lookup");
+		const writeStages = job.pipeline.filter((s) => s.kind === "publish" || s.kind === "tee");
+		if (writeStages.length > 0 && hasFind && !hasCaps) for (const ws of writeStages) diagnostics.push({
+			code: "ASH_UNCAPPED_WRITE",
+			message: `Job '${job.name}': '${ws.kind}' combined with data reads requires @caps — write operations on external data must declare capabilities`
+		});
+	}
+	const BUDGET_CEILINGS = {
+		actions: 100,
+		writes: 100,
+		records: 1e4
+	};
+	for (const job of ast.jobs) {
+		const budgetAnn = job.annotations.find((a) => a.name === "budget");
+		if (!budgetAnn) continue;
+		for (let i = 0; i < budgetAnn.args.length; i += 2) {
+			const dim = budgetAnn.args[i];
+			const val = Number(budgetAnn.args[i + 1]);
+			if (dim in BUDGET_CEILINGS && val > BUDGET_CEILINGS[dim]) diagnostics.push({
+				code: "ASH_BUDGET_EXCESSIVE",
+				message: `Job '${job.name}': @budget(${dim} ${val}) exceeds ceiling of ${BUDGET_CEILINGS[dim]} — reduce budget or justify with explicit approval`
+			});
+		}
+	}
+	return {
+		program: compiler.compile(ast),
+		diagnostics,
+		sourceHash
+	};
+}
+function safeOutput(ctx, content, logContext) {
+	if (ctx.output) try {
+		ctx.output.output({
+			kind: "text",
+			content,
+			context: logContext
+		});
+	} catch {}
+	safeEmit(ctx.logger, "info", content, logContext);
+}
+function safeEmit(logger, level, message, context) {
+	if (logger.emit) try {
+		logger.emit(level, message, context);
+	} catch {}
+}
+/**
+* Strict equality with boolean coercion only.
+* No string fallback (prevents type confusion like 0 == "0").
+* Boolean coercion: true/"true" and false/"false" are equal.
+*/
+function strictEqual(a, b) {
+	if (a === b) return true;
+	if (typeof a === "boolean" && typeof b === "string") return a === (b === "true");
+	if (typeof b === "boolean" && typeof a === "string") return b === (a === "true");
+	return false;
+}
+var AshCompiler = class {
+	_currentJobName;
+	_currentStageIndex;
+	_jobMap = /* @__PURE__ */ new Map();
+	compile(ast) {
+		const params = /* @__PURE__ */ new Map();
+		for (const stmt of ast.statements) if (stmt.kind === "param") params.set(stmt.name, stmt.defaultValue);
+		const variables = new Map(params);
+		const runtimeLets = [];
+		for (const stmt of ast.statements) if (stmt.kind === "let") if (stmt.pipeline) runtimeLets.push(stmt);
+		else variables.set(stmt.name, stmt.value);
+		const units = ast.statements.filter((s) => s.kind !== "let" && s.kind !== "param").map((stmt) => this.compileStatement(stmt, variables, runtimeLets));
+		const jobs = units.filter((u) => u.kind === "job");
+		const jobMap = /* @__PURE__ */ new Map();
+		for (const job of jobs) jobMap.set(job.name, job);
+		this._jobMap = jobMap;
+		const routeTargetNames = /* @__PURE__ */ new Set();
+		const triggeredJobs = /* @__PURE__ */ new Set();
+		for (const job of ast.jobs) {
+			if (job.trigger) triggeredJobs.add(job.name);
+			for (const stage of job.pipeline) if (stage.kind === "route") {
+				for (const branch of stage.branches) routeTargetNames.add(branch.targetJob);
+				if (stage.fallback) routeTargetNames.add(stage.fallback);
+			}
+		}
+		for (const name of triggeredJobs) routeTargetNames.delete(name);
+		return {
+			jobs,
+			units,
+			jobMap,
+			params,
+			routeTargets: routeTargetNames.size > 0 ? routeTargetNames : void 0
+		};
+	}
+	compileStatement(stmt, variables, runtimeLets = []) {
+		if (stmt.kind === "output") return this.compileTopLevelOutput(stmt);
+		return this.compileJob(stmt, variables, runtimeLets);
+	}
+	compileTopLevelOutput(output) {
+		return {
+			kind: "output",
+			message: output.message,
+			execute: async (ctx) => {
+				ctx.logger.log("output", "output", { message: output.message });
+				safeOutput(ctx, output.message);
+			}
+		};
+	}
+	compileJob(job, variables = /* @__PURE__ */ new Map(), runtimeLets = []) {
+		const stages = job.pipeline;
+		const annotations = job.annotations;
+		const retryAnn = annotations.find((a) => a.name === "retry");
+		const timeoutAnn = annotations.find((a) => a.name === "timeout");
+		const onErrorAnn = annotations.find((a) => a.name === "on_error");
+		const budgetAnn = annotations.find((a) => a.name === "budget");
+		const retryCount = retryAnn ? retryAnn.args.length > 0 ? Number(retryAnn.args[0]) : 3 : 0;
+		const timeoutMs = timeoutAnn ? timeoutAnn.args.length > 0 ? Number(timeoutAnn.args[0]) : 0 : 0;
+		const onErrorStrategy = onErrorAnn?.args[0];
+		const onErrorPath = onErrorStrategy === "save" ? onErrorAnn?.args[1] : void 0;
+		const budgetLimits = {};
+		if (budgetAnn) for (let i = 0; i < budgetAnn.args.length; i += 2) budgetLimits[budgetAnn.args[i]] = Number(budgetAnn.args[i + 1]);
+		const capsAnns = annotations.filter((a) => a.name === "caps");
+		const scriptCaps = [];
+		for (const ann of capsAnns) if (ann.args.length > 0 && ann.args.length % 2 === 0) scriptCaps.push(...require_type_checker.parseCaps(ann));
+		const self = this;
+		const runOnce = async (ctx, initialStream) => {
+			const errors = [];
+			const jobInitialStream = initialStream ?? [];
+			let stream = [...jobInitialStream];
+			const stageMetrics = [];
+			const jobStart = performance.now();
+			const budgetUsed = {
+				actions: 0,
+				writes: 0,
+				records: 0,
+				tokens: 0,
+				cost: 0
+			};
+			const checkBudget = (dim, increment) => {
+				if (!(dim in budgetLimits)) return;
+				budgetUsed[dim] += increment;
+				if (budgetUsed[dim] > budgetLimits[dim]) throw new Error(`budget exceeded: ${dim} used ${budgetUsed[dim]}, limit ${budgetLimits[dim]}`);
+			};
+			const checkCap = (op, path) => {
+				if (scriptCaps.length > 0 && !require_type_checker.hasCapFor(scriptCaps, op, path)) throw new Error(`Permission denied: @caps does not allow ${op} '${path}'`);
+			};
+			const runtimeVars = new Map(variables);
+			for (const rtLet of runtimeLets) if (rtLet.pipeline) try {
+				let rtStream = [];
+				for (const stage of rtLet.pipeline) rtStream = await self.executeStage(stage, rtStream, ctx, errors, runtimeVars);
+				if (rtStream.length === 1 && typeof rtStream[0] === "object" && rtStream[0] !== null) {
+					const obj = rtStream[0];
+					const keys = Object.keys(obj);
+					if (keys.length === 1) {
+						const val = obj[keys[0]];
+						if (typeof val === "number" || typeof val === "string") {
+							runtimeVars.set(rtLet.name, val);
+							continue;
+						}
+					}
+				}
+				if (rtStream.length === 1) {
+					const v = rtStream[0];
+					if (typeof v === "number" || typeof v === "string") runtimeVars.set(rtLet.name, v);
+					else runtimeVars.set(rtLet.name, rtStream.length);
+				} else runtimeVars.set(rtLet.name, rtStream.length);
+			} catch (e) {
+				errors.push(`Runtime let '${rtLet.name}' failed: ${e.message ?? String(e)}`);
+				return {
+					status: "error",
+					recordCount: 0,
+					errors,
+					jobName: job.name,
+					totalDurationMs: performance.now() - jobStart,
+					stages: stageMetrics
+				};
+			}
+			for (let i = 0; i < stages.length; i++) {
+				const stage = stages[i];
+				const inputCount = stream.length;
+				const stageStart = performance.now();
+				self._currentJobName = job.name;
+				self._currentStageIndex = i;
+				try {
+					if (stage.kind === "action" && !stage.relative && i > 0 && stream.length === 0) {
+						const durationMs$1 = performance.now() - stageStart;
+						ctx.logger.log(stage.kind, "skip", { reason: "empty-stream" });
+						safeEmit(ctx.logger, "debug", `${stage.kind} skip (empty stream)`, {
+							jobName: job.name,
+							stageIndex: i
+						});
+						stageMetrics.push({
+							name: stage.kind,
+							index: i,
+							inputCount,
+							outputCount: 0,
+							durationMs: durationMs$1
+						});
+						continue;
+					}
+					ctx.logger.log(stage.kind, "enter", { recordCount: stream.length });
+					safeEmit(ctx.logger, "debug", `${stage.kind} enter`, {
+						jobName: job.name,
+						stageIndex: i
+					});
+					stream = await self.executeStage(stage, stream, ctx, errors, runtimeVars, checkBudget, checkCap, jobInitialStream);
+					const hasInlineParams = stage.kind === "action" && !stage.relative && stage.params && Object.keys(stage.params).length > 0;
+					if (stage.kind === "action" && !stage.relative && !hasInlineParams) checkBudget("actions", 1);
+					if (stage.kind === "save" || stage.kind === "publish" || stage.kind === "tee") checkBudget("writes", 1);
+					checkBudget("records", stream.length);
+					const durationMs = performance.now() - stageStart;
+					ctx.logger.log(stage.kind, "exit", { recordCount: stream.length });
+					safeEmit(ctx.logger, "debug", `${stage.kind} exit`, {
+						jobName: job.name,
+						stageIndex: i
+					});
+					stageMetrics.push({
+						name: stage.kind,
+						index: i,
+						inputCount,
+						outputCount: stream.length,
+						durationMs
+					});
+				} catch (e) {
+					const durationMs = performance.now() - stageStart;
+					const errMsg = e.message ?? String(e);
+					errors.push(errMsg);
+					if (onErrorStrategy === "skip") {
+						stageMetrics.push({
+							name: stage.kind,
+							index: i,
+							inputCount,
+							outputCount: stream.length,
+							durationMs,
+							error: errMsg
+						});
+						continue;
+					} else if (onErrorStrategy === "save" && onErrorPath) {
+						try {
+							ctx.world.write(onErrorPath, stream.map((item) => ({
+								_error: errMsg,
+								_item: item
+							})));
+						} catch {
+							errors.push(`Failed to write errors to ${onErrorPath}`);
+						}
+						stageMetrics.push({
+							name: stage.kind,
+							index: i,
+							inputCount,
+							outputCount: stream.length,
+							durationMs,
+							error: errMsg
+						});
+						continue;
+					}
+					stageMetrics.push({
+						name: stage.kind,
+						index: i,
+						inputCount,
+						outputCount: stream.length,
+						durationMs,
+						error: errMsg
+					});
+					return {
+						status: "error",
+						recordCount: stream.length,
+						errors,
+						jobName: job.name,
+						totalDurationMs: performance.now() - jobStart,
+						stages: stageMetrics
+					};
+				}
+			}
+			return {
+				status: errors.length > 0 ? "partial" : "ok",
+				recordCount: stream.length,
+				errors,
+				jobName: job.name,
+				totalDurationMs: performance.now() - jobStart,
+				stages: stageMetrics
+			};
+		};
+		const runWithTimeout = async (ctx, initialStream) => {
+			if (timeoutMs <= 0) return runOnce(ctx, initialStream);
+			return Promise.race([runOnce(ctx, initialStream), new Promise((_, reject) => setTimeout(() => reject(/* @__PURE__ */ new Error(`Timeout: job exceeded ${timeoutMs}ms`)), timeoutMs))]);
+		};
+		return {
+			kind: "job",
+			name: job.name,
+			trigger: job.trigger,
+			execute: async (ctx, initialStream) => {
+				if (retryCount <= 0 && !retryAnn) return runWithTimeout(ctx, initialStream);
+				const maxAttempts = retryCount > 0 ? retryCount : 1;
+				const allErrors = [];
+				for (let attempt = 0; attempt < maxAttempts; attempt++) try {
+					const result = await runWithTimeout(ctx, initialStream);
+					if (result.status !== "error") return result;
+					allErrors.push(...result.errors);
+					if (attempt === maxAttempts - 1) return {
+						status: "error",
+						recordCount: result.recordCount,
+						errors: allErrors
+					};
+				} catch (e) {
+					allErrors.push(e.message ?? String(e));
+					if (attempt === maxAttempts - 1) return {
+						status: "error",
+						recordCount: 0,
+						errors: allErrors
+					};
+				}
+				return {
+					status: "error",
+					recordCount: 0,
+					errors: allErrors
+				};
+			}
+		};
+	}
+	async executeStage(stage, stream, ctx, errors, variables = /* @__PURE__ */ new Map(), budgetCheck, capCheck, initialStream) {
+		switch (stage.kind) {
+			case "find": {
+				let findPath = stage.path;
+				if (findPath.includes("${") && stream.length > 0) {
+					const rec = typeof stream[0] === "object" && stream[0] !== null ? stream[0] : {};
+					findPath = require_template.resolveTemplatePath(findPath, rec);
+				}
+				if (capCheck) capCheck("read", findPath);
+				const capPath = findPath.split("/").slice(0, 3).join("/");
+				if (ctx.caps.size > 0 && !ctx.caps.has(capPath) && !ctx.caps.has("*")) throw new Error(`Permission denied: cannot read '${findPath}'`);
+				try {
+					const query = stage.query ? this.resolveQueryVars(stage.query, variables) : void 0;
+					let result = await ctx.world.read(findPath, query);
+					if (query && result.length > 0) result = result.filter((item) => {
+						try {
+							return this.evaluateWhere({
+								kind: "where",
+								left: query.field,
+								op: query.op,
+								right: query.value
+							}, item);
+						} catch {
+							return false;
+						}
+					});
+					return result;
+				} catch {
+					return [];
+				}
+			}
+			case "where": {
+				const resolvedStage = this.resolveWhereVars(stage, variables);
+				return stream.filter((item) => {
+					try {
+						return this.evaluateWhere(resolvedStage, item);
+					} catch {
+						return false;
+					}
+				});
+			}
+			case "map": {
+				const IMMUTABLE_FIELDS = ["path", "kind"];
+				const preserveSystemFields = (original, mapped) => {
+					if (typeof original === "object" && original !== null) {
+						for (const field of IMMUTABLE_FIELDS) if (field in original) mapped[field] = original[field];
+					}
+					return mapped;
+				};
+				if (stage.exprMappings) return stream.map((item) => {
+					const result = {};
+					for (const [key, expr] of Object.entries(stage.exprMappings)) result[key] = this.evaluateExpression(expr, item, variables);
+					return preserveSystemFields(item, result);
+				});
+				if (stage.expression) return stream.map((item) => this.evaluateExpression(stage.expression, item, variables));
+				if (stage.mappings) return stream.map((item) => {
+					const result = {};
+					for (const [key, field] of Object.entries(stage.mappings)) result[key] = this.resolveField(item, field);
+					return preserveSystemFields(item, result);
+				});
+				return stream.map((item) => this.resolveField(item, stage.field));
+			}
+			case "save": {
+				if (capCheck) capCheck("write", stage.path);
+				const capPath = stage.path.split("/").slice(0, 3).join("/");
+				if (ctx.caps.size > 0 && !ctx.caps.has(capPath) && !ctx.caps.has("*")) {
+					errors.push(`Permission denied: cannot write '${stage.path}'`);
+					return stream;
+				}
+				ctx.world.write(stage.path, stream);
+				return [];
+			}
+			case "publish": {
+				if (capCheck) capCheck("write", stage.path);
+				const capPath = stage.path.split("/").slice(0, 3).join("/");
+				if (ctx.caps.size > 0 && !ctx.caps.has(capPath) && !ctx.caps.has("*")) {
+					errors.push(`Permission denied: cannot publish '${stage.path}'`);
+					return stream;
+				}
+				ctx.world.publish(stage.path, stream);
+				return [];
+			}
+			case "tee":
+				if (capCheck) capCheck("write", stage.path);
+				try {
+					ctx.world.write(stage.path, [...stream]);
+				} catch (e) {
+					errors.push(`tee side-write failed: ${e.message}`);
+				}
+				return stream;
+			case "fanout": return await this.executeFanout(stage, stream, ctx, errors, variables, budgetCheck, capCheck, initialStream);
+			case "output":
+				if (stage.expression) for (const item of stream) {
+					const val = this.evaluateExpression(stage.expression, item, variables);
+					const text = val == null ? "" : String(val);
+					ctx.logger.log("output", "output", {
+						message: text,
+						streamSize: stream.length
+					});
+					safeOutput(ctx, text, {
+						jobName: this._currentJobName,
+						stageIndex: this._currentStageIndex
+					});
+				}
+				else {
+					ctx.logger.log("output", "output", {
+						message: stage.message,
+						streamSize: stream.length
+					});
+					safeOutput(ctx, stage.message, {
+						jobName: this._currentJobName,
+						stageIndex: this._currentStageIndex
+					});
+				}
+				return stream;
+			case "input": {
+				ctx.logger.log("input", "prompt", { prompt: stage.prompt });
+				const response = ctx.world.input ? await ctx.world.input(stage.prompt) : "";
+				return [{
+					prompt: stage.prompt,
+					response
+				}];
+			}
+			case "count": return [{ count: stream.length }];
+			case "group-by": {
+				const groups = /* @__PURE__ */ new Map();
+				for (const item of stream) {
+					const key = this.resolveField(item, stage.field);
+					if (!groups.has(key)) groups.set(key, []);
+					groups.get(key).push(item);
+				}
+				return Array.from(groups.entries()).map(([key, items]) => ({
+					key,
+					items
+				}));
+			}
+			case "route": {
+				const buckets = /* @__PURE__ */ new Map();
+				for (const item of stream) {
+					const val = String(this.resolveField(item, stage.field) ?? "");
+					const branch = stage.branches.find((b) => b.value === val);
+					const targetJob = branch ? branch.targetJob : stage.fallback;
+					if (targetJob) {
+						if (!buckets.has(targetJob)) buckets.set(targetJob, []);
+						buckets.get(targetJob).push(item);
+					}
+				}
+				for (const [jobName, items] of buckets) {
+					const compiled = this._jobMap.get(jobName);
+					if (!compiled) {
+						errors.push(`Route target job '${jobName}' not found`);
+						continue;
+					}
+					await compiled.execute(ctx, items);
+				}
+				return [];
+			}
+			case "lookup": {
+				const lookupData = await ctx.world.read(stage.path);
+				const index = /* @__PURE__ */ new Map();
+				for (const item of lookupData) {
+					const key = String(this.resolveField(item, stage.joinKey) ?? "");
+					if (!index.has(key)) index.set(key, item);
+				}
+				return stream.map((item) => {
+					const key = String(this.resolveField(item, stage.joinKey) ?? "");
+					const match = index.get(key);
+					if (match && typeof match === "object" && match !== null && typeof item === "object" && item !== null) return {
+						...match,
+						...item
+					};
+					return item;
+				});
+			}
+			case "action": {
+				if (!ctx.world.exec) throw new Error(`WorldInterface.exec not available — cannot execute action '${stage.path}'`);
+				const hasParams = stage.params && Object.keys(stage.params).length > 0;
+				const hasTemplatePath = stage.path.includes("${");
+				if (stage.relative) {
+					const results = [];
+					for (const record of stream) {
+						if (budgetCheck) budgetCheck("actions", 1);
+						if (typeof record !== "object" || record === null || !("path" in record)) throw new Error(`Relative action '${stage.path}' requires records with a 'path' field`);
+						const fullPath = String(record.path) + "/.actions/" + stage.path;
+						if (capCheck) capCheck("exec", fullPath);
+						const capPath$1 = fullPath.split("/").slice(0, 3).join("/");
+						if (ctx.caps.size > 0 && !ctx.caps.has(capPath$1) && !ctx.caps.has("*")) throw new Error(`Permission denied: cannot exec '${fullPath}'`);
+						const rec = record;
+						const resolvedParams = hasParams ? require_template.resolveActionParams(stage.params, rec) : void 0;
+						const input = hasParams ? [] : [record];
+						const result$1 = await ctx.world.exec(fullPath, input, resolvedParams);
+						if (result$1 != null) if (Array.isArray(result$1)) results.push(...result$1);
+						else results.push(result$1);
+					}
+					return results;
+				}
+				if (hasParams || hasTemplatePath) {
+					const results = [];
+					const records = stream.length > 0 ? stream : [{}];
+					const initialRec = initialStream && initialStream.length > 0 && typeof initialStream[0] === "object" && initialStream[0] !== null ? initialStream[0] : void 0;
+					for (const record of records) {
+						if (budgetCheck) budgetCheck("actions", 1);
+						const rec = typeof record === "object" && record !== null ? record : {};
+						const pathRec = initialRec ?? rec;
+						const resolvedPath = hasTemplatePath ? require_template.resolveTemplatePath(stage.path, pathRec) : stage.path;
+						if (capCheck) capCheck("exec", resolvedPath);
+						const capPath$1 = resolvedPath.split("/").slice(0, 3).join("/");
+						if (ctx.caps.size > 0 && !ctx.caps.has(capPath$1) && !ctx.caps.has("*")) throw new Error(`Permission denied: cannot exec '${resolvedPath}'`);
+						const resolvedParams = hasParams ? require_template.resolveActionParams(stage.params, rec) : void 0;
+						const input = hasParams ? [] : [record];
+						const result$1 = await ctx.world.exec(resolvedPath, input, resolvedParams);
+						if (result$1 != null) if (Array.isArray(result$1)) results.push(...result$1);
+						else results.push(result$1);
+					}
+					return results;
+				}
+				if (capCheck) capCheck("exec", stage.path);
+				const capPath = stage.path.split("/").slice(0, 3).join("/");
+				if (ctx.caps.size > 0 && !ctx.caps.has(capPath) && !ctx.caps.has("*")) throw new Error(`Permission denied: cannot exec '${stage.path}'`);
+				const result = await ctx.world.exec(stage.path, stream, void 0);
+				if (result == null) return [];
+				if (!Array.isArray(result)) return [result];
+				return result;
+			}
+			default: throw new Error(`Unknown stage kind: ${stage.kind}`);
+		}
+	}
+	resolveQueryVars(query, variables) {
+		if (typeof query.value === "string" && /^\$[a-zA-Z_]\w*$/.test(query.value)) {
+			const varName = query.value.slice(1);
+			if (!variables.has(varName)) throw new Error(`Undefined variable: $${varName}`);
+			return {
+				...query,
+				value: variables.get(varName)
+			};
+		}
+		return query;
+	}
+	resolveWhereVars(clause, variables) {
+		if (typeof clause.right === "string" && /^\$[a-zA-Z_]\w*$/.test(clause.right)) {
+			const varName = clause.right.slice(1);
+			if (!variables.has(varName)) throw new Error(`Undefined variable: $${varName}`);
+			return {
+				...clause,
+				right: variables.get(varName)
+			};
+		}
+		return clause;
+	}
+	evaluateWhere(clause, item) {
+		const left = this.resolveField(item, clause.left);
+		const right = clause.right;
+		switch (clause.op) {
+			case "==": return strictEqual(left, right);
+			case "!=": return !strictEqual(left, right);
+			case ">":
+			case "<":
+			case ">=":
+			case "<=": {
+				const l = Number(left);
+				const r = Number(right);
+				if (!Number.isFinite(l) || !Number.isFinite(r)) return false;
+				if (clause.op === ">") return l > r;
+				if (clause.op === "<") return l < r;
+				if (clause.op === ">=") return l >= r;
+				return l <= r;
+			}
+			default: return false;
+		}
+	}
+	resolveField(item, field) {
+		const parts = field.split(".");
+		let current = item;
+		for (const part of parts) {
+			if (current == null) return void 0;
+			if (typeof current !== "object" || !Object.hasOwn(current, part)) return void 0;
+			current = current[part];
+		}
+		return current;
+	}
+	evaluateExpression(expr, item, variables) {
+		switch (expr.kind) {
+			case "literal": return expr.value;
+			case "field_access": return this.resolveField(item, expr.path);
+			case "var_ref":
+				if (!variables.has(expr.name)) throw new Error(`Undefined variable: $${expr.name}`);
+				return variables.get(expr.name);
+			case "binary": {
+				const left = this.evaluateExpression(expr.left, item, variables);
+				const right = this.evaluateExpression(expr.right, item, variables);
+				switch (expr.op) {
+					case "+":
+						if (typeof left === "string" || typeof right === "string") return String(left ?? "") + String(right ?? "");
+						return Number(left) + Number(right);
+					case "-": return Number(left) - Number(right);
+					case "*": return Number(left) * Number(right);
+					case "/": return Number(left) / Number(right);
+					default: throw new Error(`Unknown operator: ${expr.op}`);
+				}
+			}
+			default: throw new Error(`Unknown expression kind: ${expr.kind}`);
+		}
+	}
+	async executeFanout(stage, stream, ctx, errors, variables = /* @__PURE__ */ new Map(), budgetCheck, capCheck, initialStream) {
+		const results = [];
+		for (const branch of stage.branches) {
+			let branchStream = [...stream];
+			try {
+				for (const branchStage of branch) branchStream = await this.executeStage(branchStage, branchStream, ctx, errors, variables, budgetCheck, capCheck, initialStream);
+				results.push(branchStream);
+			} catch (e) {
+				errors.push(`fanout branch failed: ${e.message}`);
+			}
+		}
+		return results.flat();
+	}
+};
+
+//#endregion
+exports.AshCompiler = AshCompiler;
+exports.compileSource = compileSource;