@alneas/eaos-server 0.0.0-stage → 0.2.0

package/dist/chunk-FD6VC2NA.js

@@ -0,0 +1,66 @@
+// src/agentic/workflow-manager.ts
+var ServerWorkflowManager = class {
+  onApprovalRequired;
+  authorizeResume;
+  /**
+   * Captures optional host approval notification and authorization callbacks.
+   * @param options - Host callbacks; omitted options perform no external notification and supply no resume authorizer.
+   */
+  constructor(options) {
+    this.onApprovalRequired = options?.onApprovalRequired;
+    this.authorizeResume = options?.authorizeResume;
+  }
+  /**
+   * Runs the graph and notifies the host if execution pauses for approval.
+   * @param graph - Configured graph with appropriate durable checkpointer/admission.
+   * @param initialState - Verified workflow identity and starting state.
+   * @returns Graph state after runStep, including any pending approval; notification failures do not change it.
+   * @throws Rejects graph execution failures; notification errors are caught and warned.
+   * @example
+   * ```typescript
+   * import { ServerWorkflowManager } from "@alneas/eaos-server/agentic/workflow-manager";
+   * import type { AgentGraphEngine, AgentGraphState } from "@alneas/eaos-server/agentic/graph";
+   * export async function run(graph: AgentGraphEngine, initialState: AgentGraphState) {
+   *   return new ServerWorkflowManager().runWorkflow(graph, initialState);
+   * }
+   * ```
+   */
+  async runWorkflow(graph, initialState) {
+    const state = await graph.runStep(initialState);
+    if (state.pendingApproval) {
+      if (this.onApprovalRequired) {
+        try {
+          await this.onApprovalRequired(state);
+        } catch (err) {
+          console.warn(`[ServerWorkflowManager] Approval notification failed: ${err.message}`);
+        }
+      }
+    }
+    return state;
+  }
+  /**
+   * Delegates an authenticated approval decision to graph checkpoint/binding verification and resume.
+   * @param graph - Graph owning the pending task checkpoint.
+   * @param payload - Verified approver decision with optional approval/hash bindings; taskId selects the graph session.
+   * @returns Resume outcome, optional updated state, or failure data from resumeAfterApproval.
+   * @throws Propagates graph/checkpointer errors not normalized by resumeAfterApproval.
+   * @remarks The host verifies caller identity and role before constructing payload. This wrapper does not send a second approval notification after resume.
+   * @example
+   * ```typescript
+   * import { ServerWorkflowManager, type ServerWorkflowOptions } from "@alneas/eaos-server/agentic/workflow-manager";
+   * import type { AgentGraphEngine } from "@alneas/eaos-server/agentic/graph";
+   * import type { ServerApprovalCallbackPayload } from "@alneas/eaos-server/agentic/types";
+   * export async function approve(graph: AgentGraphEngine, options: ServerWorkflowOptions, payload: ServerApprovalCallbackPayload) {
+   *   return new ServerWorkflowManager(options).handleApproval(graph, payload);
+   * }
+   * ```
+   */
+  async handleApproval(graph, payload) {
+    return graph.resumeAfterApproval({ sessionId: payload.taskId, approvalId: payload.approvalId, bindingHash: payload.bindingHash, approved: payload.approved, approverId: payload.approverId, approverRole: payload.approverRole, comment: payload.comment, authorizeResume: this.authorizeResume });
+  }
+};
+
+export {
+  ServerWorkflowManager
+};
+//# sourceMappingURL=chunk-FD6VC2NA.js.map

package/dist/chunk-FD6VC2NA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/agentic/workflow-manager.ts"],"sourcesContent":["import { AgentGraphEngine, type AgentGraphState } from './graph'\nimport type { ServerApprovalCallbackPayload } from './types'\n\n/**\n * Host notification and approval authority callbacks used by {@link ServerWorkflowManager}.\n */\nexport interface ServerWorkflowOptions {\n  /** Called after runStep returns pendingApproval; receives the returned state. Notification failures are warned and do not fail runWorkflow. */\n  onApprovalRequired?: (state: AgentGraphState) => Promise<void>\n  /** Live host approval check receiving workflow state and verified approver/decision; must resolve true to permit resume. Errors are delegated to graph resume handling. */\n  authorizeResume?: (state: AgentGraphState, input: {\n  /**\n   * Host-authenticated approver identifier attached to the pending decision.\n   */\n  approverId: string;\n  /**\n   * Host-verified approver role to recheck against current resource/approval policy.\n   */\n  approverRole: string;\n  /**\n   * True requests continuation; false requests rejection, and a supplied authorizer also checks that decision.\n   */\n  approved: boolean }) => Promise<boolean>\n}\n\n/**\n * Coordinates graph execution and host approval notifications without choosing a notification transport.\n * @remarks Checkpoint persistence and approval binding are delegated to AgentGraphEngine; the host authenticates approval callbacks. No webhook listener, retry queue, or delivery guarantee is installed.\n * @example\n * ```typescript\n * import { ServerWorkflowManager, type ServerWorkflowOptions } from \"@alneas/eaos-server/agentic/workflow-manager\";\n * export function workflowManager(options: ServerWorkflowOptions) {\n *   return new ServerWorkflowManager(options);\n * }\n * ```\n */\nexport class ServerWorkflowManager {\n  private onApprovalRequired?: (state: AgentGraphState) => Promise<void>\n  private authorizeResume?: ServerWorkflowOptions['authorizeResume']\n\n  /**\n   * Captures optional host approval notification and authorization callbacks.\n   * @param options - Host callbacks; omitted options perform no external notification and supply no resume authorizer.\n   */\n  constructor(options?: ServerWorkflowOptions) {\n    this.onApprovalRequired = options?.onApprovalRequired\n    this.authorizeResume = options?.authorizeResume\n  }\n\n  /**\n   * Runs the graph and notifies the host if execution pauses for approval.\n   * @param graph - Configured graph with appropriate durable checkpointer/admission.\n   * @param initialState - Verified workflow identity and starting state.\n   * @returns Graph state after runStep, including any pending approval; notification failures do not change it.\n   * @throws Rejects graph execution failures; notification errors are caught and warned.\n   * @example\n   * ```typescript\n   * import { ServerWorkflowManager } from \"@alneas/eaos-server/agentic/workflow-manager\";\n   * import type { AgentGraphEngine, AgentGraphState } from \"@alneas/eaos-server/agentic/graph\";\n   * export async function run(graph: AgentGraphEngine, initialState: AgentGraphState) {\n   *   return new ServerWorkflowManager().runWorkflow(graph, initialState);\n   * }\n   * ```\n   */\n  async runWorkflow(graph: AgentGraphEngine, initialState: AgentGraphState): Promise<AgentGraphState> {\n    const state = await graph.runStep(initialState)\n\n    if (state.pendingApproval) {\n      if (this.onApprovalRequired) {\n        try {\n          await this.onApprovalRequired(state)\n        } catch (err) {\n          console.warn(`[ServerWorkflowManager] Approval notification failed: ${(err as Error).message}`)\n        }\n      }\n    }\n\n    return state\n  }\n\n  /**\n   * Delegates an authenticated approval decision to graph checkpoint/binding verification and resume.\n   * @param graph - Graph owning the pending task checkpoint.\n   * @param payload - Verified approver decision with optional approval/hash bindings; taskId selects the graph session.\n   * @returns Resume outcome, optional updated state, or failure data from resumeAfterApproval.\n   * @throws Propagates graph/checkpointer errors not normalized by resumeAfterApproval.\n   * @remarks The host verifies caller identity and role before constructing payload. This wrapper does not send a second approval notification after resume.\n   * @example\n   * ```typescript\n   * import { ServerWorkflowManager, type ServerWorkflowOptions } from \"@alneas/eaos-server/agentic/workflow-manager\";\n   * import type { AgentGraphEngine } from \"@alneas/eaos-server/agentic/graph\";\n   * import type { ServerApprovalCallbackPayload } from \"@alneas/eaos-server/agentic/types\";\n   * export async function approve(graph: AgentGraphEngine, options: ServerWorkflowOptions, payload: ServerApprovalCallbackPayload) {\n   *   return new ServerWorkflowManager(options).handleApproval(graph, payload);\n   * }\n   * ```\n   */\n  async handleApproval(\n    graph: AgentGraphEngine,\n    payload: ServerApprovalCallbackPayload\n  ): Promise<{ \n  /** Whether graph approval verification/resumption produced a saved state; false can follow partial effects and is not proof that nothing ran. */\n  resumed: boolean; \n  /** Optional graph checkpoint state returned after successful resumption; absent on the normalized failure paths. */\n  state?: AgentGraphState; \n  /** Optional normalized checkpoint, approval, authorization or invocation failure detail when resumed is false; other errors can still reject the Promise. */\n  error?: string }> {\n    return graph.resumeAfterApproval({ sessionId: payload.taskId, approvalId: payload.approvalId, bindingHash: payload.bindingHash, approved: payload.approved, approverId: payload.approverId, approverRole: payload.approverRole, comment: payload.comment, authorizeResume: this.authorizeResume })\n  }\n}\n"],"mappings":";AAoCO,IAAM,wBAAN,MAA4B;AAAA,EACzB;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMR,YAAY,SAAiC;AAC3C,SAAK,qBAAqB,SAAS;AACnC,SAAK,kBAAkB,SAAS;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,YAAY,OAAyB,cAAyD;AAClG,UAAM,QAAQ,MAAM,MAAM,QAAQ,YAAY;AAE9C,QAAI,MAAM,iBAAiB;AACzB,UAAI,KAAK,oBAAoB;AAC3B,YAAI;AACF,gBAAM,KAAK,mBAAmB,KAAK;AAAA,QACrC,SAAS,KAAK;AACZ,kBAAQ,KAAK,yDAA0D,IAAc,OAAO,EAAE;AAAA,QAChG;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,MAAM,eACJ,OACA,SAOgB;AAChB,WAAO,MAAM,oBAAoB,EAAE,WAAW,QAAQ,QAAQ,YAAY,QAAQ,YAAY,aAAa,QAAQ,aAAa,UAAU,QAAQ,UAAU,YAAY,QAAQ,YAAY,cAAc,QAAQ,cAAc,SAAS,QAAQ,SAAS,iBAAiB,KAAK,gBAAgB,CAAC;AAAA,EACnS;AACF;","names":[]}

package/dist/chunk-FRRRWAHO.js

@@ -0,0 +1,14 @@
+// src/browser-auth/public-memberships.ts
+import { parseAccountMemberships } from "@alneas/eaos-server/platform";
+function publicAccountMemberships(identity) {
+  if (identity.state !== "active") throw new Error("Active identity required");
+  const value = identity.metadata_public;
+  if (value !== void 0 && value !== null && (typeof value !== "object" || Array.isArray(value))) throw new Error("Invalid public metadata");
+  const metadata = value ?? {};
+  return parseAccountMemberships({ memberships: metadata.eaos_memberships ?? [], defaultTenantId: metadata.eaos_default_tenant_id ?? void 0 });
+}
+
+export {
+  publicAccountMemberships
+};
+//# sourceMappingURL=chunk-FRRRWAHO.js.map

package/dist/chunk-FRRRWAHO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/browser-auth/public-memberships.ts"],"sourcesContent":["import { parseAccountMemberships, type AccountMemberships } from '@alneas/eaos-server/platform'\n\n/**\n * Parses account membership claims exclusively from an active identity's public metadata.\n * @param identity - Identity returned by a server-verified Kratos session; state must equal active.\n * @returns Parsed memberships and optional defaultTenantId; absent/null public metadata supplies an empty membership list.\n * @throws For inactive identities, malformed public metadata, or invalid membership claims rejected by the platform parser.\n * @remarks Never pass editable traits or unverified client JSON. There is no fallback to private metadata or SQL membership lookup, and parsing does not authenticate the identity.\n * @example\n * ```typescript\n * import { publicAccountMemberships } from \"@alneas/eaos-server/browser-auth/public-memberships\";\n * import { createKratosSessionVerifier } from \"@alneas/eaos-server/browser-auth/kratos-session\";\n * const verify = createKratosSessionVerifier({ publicUrl: \"https://identity.example.com\" });\n * export async function memberships(cookie: string | undefined) {\n *   const session = await verify({ cookie });\n *   return session ? publicAccountMemberships(session.identity) : null;\n * }\n * ```\n */\nexport function publicAccountMemberships(identity: Record<string, unknown>): AccountMemberships {\n  if (identity.state !== 'active') throw new Error('Active identity required')\n  const value = identity.metadata_public\n  if (value !== undefined && value !== null && (typeof value !== 'object' || Array.isArray(value))) throw new Error('Invalid public metadata')\n  const metadata = (value ?? {}) as Record<string, unknown>\n  // No fallback to editable traits, private metadata, or a SQL directory.\n  return parseAccountMemberships({ memberships: metadata.eaos_memberships ?? [], defaultTenantId: metadata.eaos_default_tenant_id ?? undefined })\n}\n"],"mappings":";AAAA,SAAS,+BAAwD;AAmB1D,SAAS,yBAAyB,UAAuD;AAC9F,MAAI,SAAS,UAAU,SAAU,OAAM,IAAI,MAAM,0BAA0B;AAC3E,QAAM,QAAQ,SAAS;AACvB,MAAI,UAAU,UAAa,UAAU,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAI,OAAM,IAAI,MAAM,yBAAyB;AAC3I,QAAM,WAAY,SAAS,CAAC;AAE5B,SAAO,wBAAwB,EAAE,aAAa,SAAS,oBAAoB,CAAC,GAAG,iBAAiB,SAAS,0BAA0B,OAAU,CAAC;AAChJ;","names":[]}

package/dist/chunk-HCKAGLLB.js

@@ -0,0 +1,17 @@
+// src/lifecycle-engine/platform/artifacts.ts
+function validatePlatformPackages(value) {
+  if (value === void 0) return [];
+  if (!Array.isArray(value)) throw new Error("Platform packages must be an array");
+  const ids = /* @__PURE__ */ new Set();
+  const path = (v) => typeof v === "string" && v.length > 0 && !v.startsWith("/") && !v.includes("\\") && v.split("/").every((p) => p && p !== "." && p !== "..");
+  for (const entry of value) {
+    if (!entry || typeof entry !== "object" || Object.keys(entry).some((k) => !["id", "inventory", "module", "tenantIds", "pluginIds", "settings"].includes(k)) || typeof entry.id !== "string" || !entry.id.trim() || ids.has(entry.id) || !path(entry.inventory) || !path(entry.module) || !Array.isArray(entry.pluginIds) || !entry.pluginIds.length || entry.pluginIds.some((p) => typeof p !== "string" || !p.trim()) || new Set(entry.pluginIds).size !== entry.pluginIds.length || !Array.isArray(entry.tenantIds) || !entry.tenantIds.length || entry.tenantIds.some((t) => typeof t !== "string" || !t.trim() || t !== t.trim() || t === "*") || entry.settings !== void 0 && (!entry.settings || typeof entry.settings !== "object" || Array.isArray(entry.settings))) throw new Error("Invalid platform package registration");
+    ids.add(entry.id);
+  }
+  return value;
+}
+
+export {
+  validatePlatformPackages
+};
+//# sourceMappingURL=chunk-HCKAGLLB.js.map

package/dist/chunk-HCKAGLLB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/lifecycle-engine/platform/artifacts.ts"],"sourcesContent":["import type { PluginManifest } from '@alneas/eaos-core/plugin-sdk'\nimport type { LifecyclePlugin } from '../index'\nimport type { DeploymentPlugin } from './deployment'\n\n/**\n * Trusted code contributions restricted to explicit tenant IDs; registration never activates a plugin.\n * \n * \n * Trusted package contributions; code registration does not grant tenant activation.\n * @see PluginLifecycle for canonical integration usage.\n */\nexport interface PlatformContribution {\n  /**\n   * Contribution contract discriminator; currently 1.\n   */\n  apiVersion: 1\n  /**\n   * Contribution/package identity.\n   */\n  id: string\n  /**\n   * Concrete admitted tenant catalog; never wildcard authorization.\n   */\n  tenantIds: string[]\n  /**\n   * Optional public plugin manifests contributed by the trusted package.\n   */\n  manifests?: PluginManifest[]\n  /**\n   * Optional trusted lifecycle release definitions.\n   */\n  lifecycle?: LifecyclePlugin[]\n  /**\n   * Optional plugin ID to allowed route-prefix contributions.\n   */\n  routePrefixes?: Record<string, string[]>\n}\n/**\n * Checksummed artifact metadata and explicit per-plugin deployment work, separate from runtime admission.\n * \n * @see PluginLifecycle for canonical integration usage.\n */\nexport interface DeploymentInventory {\n  /**\n   * Inventory discriminator; currently 1.\n   */\n  apiVersion: 1\n  /**\n   * Stable package/contribution owner used to bind receipts.\n   */\n  owner: string\n  /**\n   * Optional package release version.\n   */\n  version?: string\n  /**\n   * Optional declared execution runtime descriptor.\n   */\n  runtime?: string\n  /**\n   * Optional ordered lifecycle plugin IDs; required for classified plugin work.\n   */\n  lifecycleBundle?: string[]\n  /**\n   * Tenant-scoped function source declarations and required tenant bindings.\n   */\n  functions: Array<{ \n    /**\n     * Unique tenant-scoped function identity.\n     */\n    id: string; \n    /**\n     * Project-relative packaged function/database source path.\n     */\n    source: string; \n    /**\n     * Function scope discriminator; must be tenant.\n     */\n    scope: 'tenant'; \n    /**\n     * Explicit binding names that the host must resolve separately for each tenant.\n     */\n    requiredTenantBindings: string[] }>\n  /**\n   * Optional adopted existing-history database declaration; never an instruction to recreate history.\n   */\n  database?: { \n    /**\n     * Project-relative packaged function/database source path.\n     */\n    source: string; \n    /**\n     * Database history policy; adopt-existing-history never recreates historical migrations.\n     */\n    mode: 'adopt-existing-history'; \n    /**\n     * Canonical tenant isolation column; currently tenant_id.\n     */\n    tenantColumn: 'tenant_id' }\n  /**\n   * Exact project-relative packaged asset paths and SHA-256 digests.\n   */\n  assets: Array<{ \n    /**\n     * Exact project-relative packaged asset path.\n     */\n    path: string; \n    /**\n     * Lowercase SHA-256 digest of the asset bytes.\n     */\n    sha256: string }>\n  /**\n   * Optional classified component/task declarations; absence is legacy-unclassified.\n   * \n   * Explicit per-plugin composition and required work. Omission is legacy/unclassified.\n   */\n  plugins?: DeploymentPlugin[]\n}\n/**\n * Trusted project-relative artifact/module registration with explicit tenant/plugin scopes.\n * \n * \n * Paths are project-relative. Settings are non-secret; use host-resolved references for credentials.\n * @see PluginLifecycle for canonical integration usage.\n */\nexport interface PlatformPackage {\n  /**\n   * Unique nonblank registration ID.\n   */\n  id: string\n  /**\n   * Project-relative inventory path without absolute/traversal/backslash segments.\n   */\n  inventory: string\n  /**\n   * Project-relative entry module path without traversal.\n   */\n  module: string\n  /**\n   * Nonempty concrete trimmed tenant IDs; wildcard is forbidden.\n   */\n  tenantIds: string[]\n  /**\n   * Nonempty unique plugin IDs contributed by this package.\n   */\n  pluginIds: string[]\n  /**\n   * Optional nonsecret host configuration object; resolve credentials by host references.\n   */\n  settings?: Record<string, unknown>\n}\n/**\n * Validates explicit checksummed package registrations and concrete tenant/plugin scope metadata.\n * @param value - Untrusted package registration array, or undefined for no packages.\n * @returns The original accepted array, or a new empty array for undefined.\n * @throws Error for nonarray input, unknown fields, duplicate package IDs, invalid paths, empty/duplicate plugin IDs or invalid tenant scopes.\n * \n * @remarks\n * Checks project-relative nontraversing inventory/module paths and nonsecret settings shape. It does not load files, verify checksums, resolve membership or activate plugins.\n * \n * @example\n * ```typescript\n * import { validatePlatformPackages } from '@alneas/eaos-server/platform/artifacts';\n * const packages = validatePlatformPackages([{ id: 'reports', inventory: '.eaos/packages/reports/deployment.json', module: '.eaos/packages/reports/index.js', tenantIds: ['sample'], pluginIds: ['reports'] }]);\n * ```\n */\nexport function validatePlatformPackages(value: unknown): PlatformPackage[] {\n  if (value === undefined) return []\n  if (!Array.isArray(value)) throw new Error('Platform packages must be an array')\n  const ids = new Set<string>()\n  const path = (v: unknown) => typeof v === 'string' && v.length > 0 && !v.startsWith('/') && !v.includes('\\\\') && v.split('/').every(p => p && p !== '.' && p !== '..')\n  for (const entry of value) {\n    if (!entry || typeof entry !== 'object' || Object.keys(entry).some(k => !['id', 'inventory', 'module', 'tenantIds', 'pluginIds', 'settings'].includes(k))\n      || typeof entry.id !== 'string' || !entry.id.trim() || ids.has(entry.id) || !path(entry.inventory) || !path(entry.module)\n      || !Array.isArray(entry.pluginIds) || !entry.pluginIds.length || entry.pluginIds.some((p: unknown) => typeof p !== 'string' || !p.trim()) || new Set(entry.pluginIds).size !== entry.pluginIds.length\n      || !Array.isArray(entry.tenantIds) || !entry.tenantIds.length || entry.tenantIds.some((t: unknown) => typeof t !== 'string' || !t.trim() || t !== t.trim() || t === '*')\n      || (entry.settings !== undefined && (!entry.settings || typeof entry.settings !== 'object' || Array.isArray(entry.settings)))) throw new Error('Invalid platform package registration')\n    ids.add(entry.id)\n\n  }\n  return value\n}\n"],"mappings":";AAsKO,SAAS,yBAAyB,OAAmC;AAC1E,MAAI,UAAU,OAAW,QAAO,CAAC;AACjC,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,oCAAoC;AAC/E,QAAM,MAAM,oBAAI,IAAY;AAC5B,QAAM,OAAO,CAAC,MAAe,OAAO,MAAM,YAAY,EAAE,SAAS,KAAK,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC,EAAE,SAAS,IAAI,KAAK,EAAE,MAAM,GAAG,EAAE,MAAM,OAAK,KAAK,MAAM,OAAO,MAAM,IAAI;AACrK,aAAW,SAAS,OAAO;AACzB,QAAI,CAAC,SAAS,OAAO,UAAU,YAAY,OAAO,KAAK,KAAK,EAAE,KAAK,OAAK,CAAC,CAAC,MAAM,aAAa,UAAU,aAAa,aAAa,UAAU,EAAE,SAAS,CAAC,CAAC,KACnJ,OAAO,MAAM,OAAO,YAAY,CAAC,MAAM,GAAG,KAAK,KAAK,IAAI,IAAI,MAAM,EAAE,KAAK,CAAC,KAAK,MAAM,SAAS,KAAK,CAAC,KAAK,MAAM,MAAM,KACrH,CAAC,MAAM,QAAQ,MAAM,SAAS,KAAK,CAAC,MAAM,UAAU,UAAU,MAAM,UAAU,KAAK,CAAC,MAAe,OAAO,MAAM,YAAY,CAAC,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI,MAAM,SAAS,EAAE,SAAS,MAAM,UAAU,UAC5L,CAAC,MAAM,QAAQ,MAAM,SAAS,KAAK,CAAC,MAAM,UAAU,UAAU,MAAM,UAAU,KAAK,CAAC,MAAe,OAAO,MAAM,YAAY,CAAC,EAAE,KAAK,KAAK,MAAM,EAAE,KAAK,KAAK,MAAM,GAAG,KACnK,MAAM,aAAa,WAAc,CAAC,MAAM,YAAY,OAAO,MAAM,aAAa,YAAY,MAAM,QAAQ,MAAM,QAAQ,GAAK,OAAM,IAAI,MAAM,uCAAuC;AACxL,QAAI,IAAI,MAAM,EAAE;AAAA,EAElB;AACA,SAAO;AACT;","names":[]}

package/dist/chunk-HVC7FG6B.js

@@ -0,0 +1,191 @@
+// src/agentic/workflow-registry.ts
+import { canonicalJsonHash, validateWorkflowDefinition } from "@alneas/eaos-core";
+var InMemoryWorkflowDefinitionRegistry = class {
+  records = /* @__PURE__ */ new Map();
+  now;
+  validateDefinition;
+  /**
+   * Captures authoring clock and optional semantic validation callback.
+   * @param options - now returns a timestamp string and defaults to current ISO time; validate synchronously checks a structurally valid draft during validate and may throw.
+   */
+  constructor(options = {}) {
+    this.now = options.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
+    this.validateDefinition = options.validate;
+  }
+  /**
+   * Validates and inserts or replaces a draft version, incrementing its revision.
+   * @param input - Unknown workflow definition validated by core validation.
+   * @param actorId - Optional author label recorded as creator/updater; not authenticated here.
+   * @returns A cloned draft record with canonical definition hash.
+   * @throws Invalid definition, non-draft existing version, clock/hash/clone failure.
+   * @example
+   * ```typescript
+   * import { InMemoryWorkflowDefinitionRegistry } from "@alneas/eaos-server/agentic/workflow-registry";
+   * export function draft(input: unknown) { return new InMemoryWorkflowDefinitionRegistry().saveDraft(input); }
+   * ```
+   */
+  saveDraft(input, actorId) {
+    const definition = validateWorkflowDefinition(input);
+    const key = this.key(definition.workflowId, definition.version);
+    const current = this.records.get(key);
+    if (current && current.status !== "draft") throw new Error(`Workflow version '${definition.workflowId}@${definition.version}' is immutable after draft`);
+    const timestamp = this.now();
+    const record = {
+      workflowId: definition.workflowId,
+      version: definition.version,
+      status: "draft",
+      definition,
+      definitionHash: canonicalJsonHash(definition),
+      revision: (current?.revision ?? 0) + 1,
+      createdAt: current?.createdAt ?? timestamp,
+      updatedAt: timestamp,
+      ...current?.createdBy ?? actorId ? { createdBy: current?.createdBy ?? actorId } : {},
+      ...actorId === void 0 ? {} : { updatedBy: actorId }
+    };
+    this.records.set(key, record);
+    return clone(record);
+  }
+  /**
+   * Transitions an existing draft to validated after core and optional host checks.
+   * @param workflowId - Exact workflow identifier.
+   * @param version - Exact stored version.
+   * @param actorId - Optional updater label.
+   * @returns A cloned validated record with incremented revision.
+   * @throws Missing version, nondraft status, validation/callback/clock failure.
+   * @example
+   * ```typescript
+   * import { InMemoryWorkflowDefinitionRegistry } from "@alneas/eaos-server/agentic/workflow-registry";
+   * export function validate(registry: InMemoryWorkflowDefinitionRegistry, workflowId: string, version: string) { return registry.validate(workflowId, version); }
+   * ```
+   */
+  validate(workflowId, version, actorId) {
+    const current = this.require(workflowId, version);
+    if (current.status !== "draft") throw new Error(`Workflow version '${workflowId}@${version}' is not a draft`);
+    validateWorkflowDefinition(current.definition);
+    this.validateDefinition?.(current.definition);
+    return this.update(current, { status: "validated", ...actorId === void 0 ? {} : { updatedBy: actorId } });
+  }
+  /**
+   * Transitions a validated version to approved and records approver metadata.
+   * @param workflowId - Exact workflow identifier.
+   * @param version - Exact stored version.
+   * @param actorId - Nonblank verified host approver label; no role check occurs here.
+   * @returns A cloned approved record.
+   * @throws Blank actor, missing version, nonvalidated status, or clock failure.
+   * @example
+   * ```typescript
+   * import { InMemoryWorkflowDefinitionRegistry } from "@alneas/eaos-server/agentic/workflow-registry";
+   * export function approve(registry: InMemoryWorkflowDefinitionRegistry, workflowId: string, version: string, actorId: string) { return registry.approve(workflowId, version, actorId); }
+   * ```
+   */
+  approve(workflowId, version, actorId) {
+    if (!actorId.trim()) throw new Error("Workflow approver identity is required");
+    const current = this.require(workflowId, version);
+    if (current.status !== "validated") throw new Error(`Workflow version '${workflowId}@${version}' must be validated before approval`);
+    return this.update(current, { status: "approved", approvedAt: this.now(), approvedBy: actorId, updatedBy: actorId });
+  }
+  /**
+   * Publishes an approved version and retires any currently published version of the same workflow.
+   * @param workflowId - Exact workflow identifier.
+   * @param version - Approved version to publish.
+   * @param actorId - Nonblank verified host publisher label.
+   * @returns A cloned published record; previous published records become retired.
+   * @throws Blank actor, missing version, nonapproved status, or clock/clone failure; earlier retirement updates can already have occurred.
+   * @example
+   * ```typescript
+   * import { InMemoryWorkflowDefinitionRegistry } from "@alneas/eaos-server/agentic/workflow-registry";
+   * export function publish(registry: InMemoryWorkflowDefinitionRegistry, workflowId: string, version: string, actorId: string) { return registry.publish(workflowId, version, actorId); }
+   * ```
+   */
+  publish(workflowId, version, actorId) {
+    if (!actorId.trim()) throw new Error("Workflow publisher identity is required");
+    const current = this.require(workflowId, version);
+    if (current.status !== "approved") throw new Error(`Workflow version '${workflowId}@${version}' must be approved before publication`);
+    for (const record of this.records.values()) {
+      if (record.workflowId === workflowId && record.status === "published") this.records.set(this.key(record.workflowId, record.version), this.update(record, { status: "retired", retiredAt: this.now(), retiredBy: actorId }));
+    }
+    return this.update(current, { status: "published", publishedAt: this.now(), publishedBy: actorId, updatedBy: actorId });
+  }
+  /**
+   * Transitions a published version to retired and records retirement metadata.
+   * @param workflowId - Exact workflow identifier.
+   * @param version - Currently published version.
+   * @param actorId - Nonblank verified host operator label.
+   * @returns A cloned retired record.
+   * @throws Blank actor, missing version, nonpublished status, or clock failure.
+   * @example
+   * ```typescript
+   * import { InMemoryWorkflowDefinitionRegistry } from "@alneas/eaos-server/agentic/workflow-registry";
+   * export function retire(registry: InMemoryWorkflowDefinitionRegistry, workflowId: string, version: string, actorId: string) { return registry.retire(workflowId, version, actorId); }
+   * ```
+   */
+  retire(workflowId, version, actorId) {
+    if (!actorId.trim()) throw new Error("Workflow retire identity is required");
+    const current = this.require(workflowId, version);
+    if (current.status !== "published") throw new Error(`Workflow version '${workflowId}@${version}' is not published`);
+    return this.update(current, { status: "retired", retiredAt: this.now(), retiredBy: actorId, updatedBy: actorId });
+  }
+  /**
+   * Reads one workflow version without mutating lifecycle state.
+   * @param workflowId - Exact workflow identifier.
+   * @param version - Exact stored version.
+   * @returns A cloned record, or undefined when absent.
+   * @example
+   * ```typescript
+   * import { InMemoryWorkflowDefinitionRegistry } from "@alneas/eaos-server/agentic/workflow-registry";
+   * console.log(new InMemoryWorkflowDefinitionRegistry().get("example", "1.0.0")); // undefined
+   * ```
+   */
+  get(workflowId, version) {
+    const record = this.records.get(this.key(workflowId, version));
+    return record ? clone(record) : void 0;
+  }
+  /**
+   * Finds the currently published version of one workflow.
+   * @param workflowId - Exact workflow identifier.
+   * @returns A cloned published record, or undefined when none exists.
+   * @example
+   * ```typescript
+   * import { InMemoryWorkflowDefinitionRegistry } from "@alneas/eaos-server/agentic/workflow-registry";
+   * console.log(new InMemoryWorkflowDefinitionRegistry().getPublished("example")); // undefined
+   * ```
+   */
+  getPublished(workflowId) {
+    const record = [...this.records.values()].find((item) => item.workflowId === workflowId && item.status === "published");
+    return record ? clone(record) : void 0;
+  }
+  /**
+   * Lists records in insertion order with optional workflow filtering.
+   * @param workflowId - Exact workflow identifier to filter, or omit for all workflows.
+   * @returns Independent cloned records, or an empty array.
+   * @example
+   * ```typescript
+   * import { InMemoryWorkflowDefinitionRegistry } from "@alneas/eaos-server/agentic/workflow-registry";
+   * console.log(new InMemoryWorkflowDefinitionRegistry().list()); // []
+   * ```
+   */
+  list(workflowId) {
+    return [...this.records.values()].filter((record) => workflowId === void 0 || record.workflowId === workflowId).map(clone);
+  }
+  require(workflowId, version) {
+    const record = this.records.get(this.key(workflowId, version));
+    if (!record) throw new Error(`Workflow version '${workflowId}@${version}' was not found`);
+    return record;
+  }
+  update(current, patch) {
+    const next = { ...current, ...patch, revision: current.revision + 1, updatedAt: this.now() };
+    this.records.set(this.key(current.workflowId, current.version), next);
+    return clone(next);
+  }
+  key(workflowId, version) {
+    return `${workflowId}@${version}`;
+  }
+};
+function clone(record) {
+  return structuredClone(record);
+}
+
+export {
+  InMemoryWorkflowDefinitionRegistry
+};
+//# sourceMappingURL=chunk-HVC7FG6B.js.map

package/dist/chunk-HVC7FG6B.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/agentic/workflow-registry.ts"],"sourcesContent":["import { canonicalJsonHash, type WorkflowDefinition, type WorkflowDefinitionLifecycle, validateWorkflowDefinition } from '@alneas/eaos-core'\n\n/**\n * Versioned workflow definition with lifecycle, integrity hash, revision, and actor/timestamp metadata.\n * @see InMemoryWorkflowDefinitionRegistry.\n */\nexport interface WorkflowDefinitionRecord {\n  /** Workflow identifier copied from the validated definition. */\n  workflowId: string\n  /** Immutable version key within a workflow after draft. */\n  version: string\n  /** Current draft/validated/approved/published/retired lifecycle phase. */\n  status: WorkflowDefinitionLifecycle\n  /** Validated serializable definition; returned records are cloned by this registry. */\n  definition: WorkflowDefinition\n  /** Canonical SHA-256 definition hash calculated on saveDraft. */\n  definitionHash: string\n  /** Record revision starting at one and incrementing on each saved transition. */\n  revision: number\n  /** Creation timestamp from the registry clock. */\n  createdAt: string\n  /** Latest transition timestamp from the registry clock. */\n  updatedAt: string\n  /** Optional first author label. */\n  createdBy?: string\n  /** Optional latest actor label. */\n  updatedBy?: string\n  /** Optional approval timestamp. */\n  approvedAt?: string\n  /** Optional approver label. */\n  approvedBy?: string\n  /** Optional publication timestamp. */\n  publishedAt?: string\n  /** Optional publisher label. */\n  publishedBy?: string\n  /** Optional retirement timestamp. */\n  retiredAt?: string\n  /** Optional retiring actor label. */\n  retiredBy?: string\n}\n\n/**\n * Workflow authoring lifecycle contract; durable hosts must supply authorization and consistent persistence.\n * @see InMemoryWorkflowDefinitionRegistry for transition semantics.\n */\nexport interface WorkflowDefinitionRegistry {\n  /**\n   * Validates and inserts or replaces a draft version, incrementing its revision.\n   * @param definition - Unknown workflow definition validated by core validation.\n   * @param actorId - Optional author label recorded as creator/updater; not authenticated here.\n   * @returns A cloned draft record with canonical definition hash.\n   * @throws Invalid definition, non-draft existing version, clock/hash/clone failure.\n   \n   * @example\n   * ```typescript\n   * import type { WorkflowDefinitionRegistry } from \"@alneas/eaos-server\";\n   * export function saveReviewedDraft(\n   *   registry: WorkflowDefinitionRegistry,\n   *   definition: Parameters<WorkflowDefinitionRegistry[\"saveDraft\"]>[0], authenticatedActorId: string,\n   * ) {\n   *   // Supply a real host workflow definition with its registered node types.\n   *   return registry.saveDraft(definition, authenticatedActorId);\n   * }\n   * ```\n   */\n  saveDraft(definition: unknown, actorId?: string): WorkflowDefinitionRecord\n  /**\n   * Transitions an existing draft to validated after core and optional host checks.\n   * @param workflowId - Exact workflow identifier.\n   * @param version - Exact stored version.\n   * @param actorId - Optional updater label.\n   * @returns A cloned validated record with incremented revision.\n   * @throws Missing version, nondraft status, validation/callback/clock failure.\n   \n   * @example\n   * ```typescript\n   * import type { WorkflowDefinitionRegistry } from \"@alneas/eaos-server\";\n   * export function validateStoredDraft(\n   *   registry: WorkflowDefinitionRegistry, workflowId: string, version: string, actorId: string,\n   * ) {\n   *   const record = registry.validate(workflowId, version, actorId);\n   *   return record.status; // Host/Core validation must succeed before transition.\n   * }\n   * ```\n   */\n  validate(workflowId: string, version: string, actorId?: string): WorkflowDefinitionRecord\n  /**\n   * Transitions a validated version to approved and records approver metadata.\n   * @param workflowId - Exact workflow identifier.\n   * @param version - Exact stored version.\n   * @param actorId - Nonblank verified host approver label; no role check occurs here.\n   * @returns A cloned approved record.\n   * @throws Blank actor, missing version, nonvalidated status, or clock failure.\n   \n   * @example\n   * ```typescript\n   * import type { WorkflowDefinitionRegistry } from \"@alneas/eaos-server\";\n   * export function approveValidatedWorkflow(\n   *   registry: WorkflowDefinitionRegistry, workflowId: string, version: string, authorizedApproverId: string,\n   * ) {\n   *   // The host checks reviewer authority before requesting this lifecycle change.\n   *   return registry.approve(workflowId, version, authorizedApproverId);\n   * }\n   * ```\n   */\n  approve(workflowId: string, version: string, actorId: string): WorkflowDefinitionRecord\n  /**\n   * Publishes an approved version and retires any currently published version of the same workflow.\n   * @param workflowId - Exact workflow identifier.\n   * @param version - Approved version to publish.\n   * @param actorId - Nonblank verified host publisher label.\n   * @returns A cloned published record; previous published records become retired.\n   * @throws Blank actor, missing version, nonapproved status, or clock/clone failure; earlier retirement updates can already have occurred.\n   \n   * @example\n   * ```typescript\n   * import type { WorkflowDefinitionRegistry } from \"@alneas/eaos-server\";\n   * export function publishApprovedWorkflow(\n   *   registry: WorkflowDefinitionRegistry, workflowId: string, version: string, authorizedPublisherId: string,\n   * ) {\n   *   return registry.publish(workflowId, version, authorizedPublisherId);\n   *   // Host execution can select the resulting published record explicitly.\n   * }\n   * ```\n   */\n  publish(workflowId: string, version: string, actorId: string): WorkflowDefinitionRecord\n  /**\n   * Transitions a published version to retired and records retirement metadata.\n   * @param workflowId - Exact workflow identifier.\n   * @param version - Currently published version.\n   * @param actorId - Nonblank verified host operator label.\n   * @returns A cloned retired record.\n   * @throws Blank actor, missing version, nonpublished status, or clock failure.\n   \n   * @example\n   * ```typescript\n   * import type { WorkflowDefinitionRegistry } from \"@alneas/eaos-server\";\n   * export function retirePublishedWorkflow(\n   *   registry: WorkflowDefinitionRegistry, workflowId: string, version: string, authorizedActorId: string,\n   * ) {\n   *   return registry.retire(workflowId, version, authorizedActorId);\n   * }\n   * ```\n   */\n  retire(workflowId: string, version: string, actorId: string): WorkflowDefinitionRecord\n  /**\n   * Reads one workflow version without mutating lifecycle state.\n   * @param workflowId - Exact workflow identifier.\n   * @param version - Exact stored version.\n   * @returns A cloned record, or undefined when absent.\n   \n   * @example\n   * ```typescript\n   * import type { WorkflowDefinitionRegistry } from \"@alneas/eaos-server\";\n   * export function inspectWorkflowVersion(\n   *   registry: WorkflowDefinitionRegistry, workflowId: string, version: string,\n   * ) {\n   *   return registry.get(workflowId, version); // Undefined when this version is absent.\n   * }\n   * ```\n   */\n  get(workflowId: string, version: string): WorkflowDefinitionRecord | undefined\n  /**\n   * Finds the currently published version of one workflow.\n   * @param workflowId - Exact workflow identifier.\n   * @returns A cloned published record, or undefined when none exists.\n   \n   * @example\n   * ```typescript\n   * import type { WorkflowDefinitionRegistry } from \"@alneas/eaos-server\";\n   * export function inspectPublishedWorkflow(registry: WorkflowDefinitionRegistry, workflowId: string) {\n   *   return registry.getPublished(workflowId); // Undefined when no version is published.\n   * }\n   * ```\n   */\n  getPublished(workflowId: string): WorkflowDefinitionRecord | undefined\n  /**\n   * Lists records in insertion order with optional workflow filtering.\n   * @param workflowId - Exact workflow identifier to filter, or omit for all workflows.\n   * @returns Independent cloned records, or an empty array.\n   \n   * @example\n   * ```typescript\n   * import type { WorkflowDefinitionRegistry } from \"@alneas/eaos-server\";\n   * export function listWorkflowVersions(registry: WorkflowDefinitionRegistry, workflowId: string) {\n   *   return registry.list(workflowId).map(record => ({ version: record.version, status: record.status }));\n   * }\n   * ```\n   */\n  list(workflowId?: string): readonly WorkflowDefinitionRecord[]\n}\n\n/**\n * Stores versioned workflow drafts and validated/approved/published/retired records in process memory.\n * @remarks Reference registry for tests/local authoring; it performs no actor authentication, role authorization, durable storage, or cross-process coordination. Transitions increment record revision and preserve definitions after draft.\n * @example\n * ```typescript\n * import { InMemoryWorkflowDefinitionRegistry } from \"@alneas/eaos-server/agentic/workflow-registry\";\n * const registry = new InMemoryWorkflowDefinitionRegistry();\n * console.log(registry.list()); // []\n * ```\n */\nexport class InMemoryWorkflowDefinitionRegistry implements WorkflowDefinitionRegistry {\n  private readonly records = new Map<string, WorkflowDefinitionRecord>()\n  private readonly now: () => string\n  private readonly validateDefinition?: (definition: WorkflowDefinition) => void\n\n  /**\n   * Captures authoring clock and optional semantic validation callback.\n   * @param options - now returns a timestamp string and defaults to current ISO time; validate synchronously checks a structurally valid draft during validate and may throw.\n   */\n  constructor(options: { \n  /**\n   * Optional timestamp-string clock used when creating/updating registry records; defaults to current ISO time.\n   * @returns Timestamp text recorded without additional format validation by this registry.\n   * @see {@link InMemoryWorkflowDefinitionRegistry.saveDraft}\n   */\n  now?: () => string; \n  /**\n   * Optional synchronous host semantic validator called after Core structural validation during a draft-to-validated transition.\n   * @param definition - Structurally valid stored workflow definition presented for host semantic checks.\n   * @returns No value when accepted; throw to reject validation before the status update.\n   * @remarks The callback receives the stored definition reference, so it should inspect without mutating it; this registry supplies no actor authentication or cross-process coordination.\n   * @see {@link InMemoryWorkflowDefinitionRegistry.validate}\n   */\n  validate?: (definition: WorkflowDefinition) => void } = {}) {\n    this.now = options.now ?? (() => new Date().toISOString())\n    this.validateDefinition = options.validate\n  }\n\n  /**\n   * Validates and inserts or replaces a draft version, incrementing its revision.\n   * @param input - Unknown workflow definition validated by core validation.\n   * @param actorId - Optional author label recorded as creator/updater; not authenticated here.\n   * @returns A cloned draft record with canonical definition hash.\n   * @throws Invalid definition, non-draft existing version, clock/hash/clone failure.\n   * @example\n   * ```typescript\n   * import { InMemoryWorkflowDefinitionRegistry } from \"@alneas/eaos-server/agentic/workflow-registry\";\n   * export function draft(input: unknown) { return new InMemoryWorkflowDefinitionRegistry().saveDraft(input); }\n   * ```\n   */\n  saveDraft(input: unknown, actorId?: string): WorkflowDefinitionRecord {\n    const definition = validateWorkflowDefinition(input)\n    const key = this.key(definition.workflowId, definition.version)\n    const current = this.records.get(key)\n    if (current && current.status !== 'draft') throw new Error(`Workflow version '${definition.workflowId}@${definition.version}' is immutable after draft`)\n    const timestamp = this.now()\n    const record: WorkflowDefinitionRecord = {\n      workflowId: definition.workflowId,\n      version: definition.version,\n      status: 'draft',\n      definition,\n      definitionHash: canonicalJsonHash(definition),\n      revision: (current?.revision ?? 0) + 1,\n      createdAt: current?.createdAt ?? timestamp,\n      updatedAt: timestamp,\n      ...(current?.createdBy ?? actorId ? { createdBy: current?.createdBy ?? actorId } : {}),\n      ...(actorId === undefined ? {} : { updatedBy: actorId }),\n    }\n    this.records.set(key, record)\n    return clone(record)\n  }\n\n  /**\n   * Transitions an existing draft to validated after core and optional host checks.\n   * @param workflowId - Exact workflow identifier.\n   * @param version - Exact stored version.\n   * @param actorId - Optional updater label.\n   * @returns A cloned validated record with incremented revision.\n   * @throws Missing version, nondraft status, validation/callback/clock failure.\n   * @example\n   * ```typescript\n   * import { InMemoryWorkflowDefinitionRegistry } from \"@alneas/eaos-server/agentic/workflow-registry\";\n   * export function validate(registry: InMemoryWorkflowDefinitionRegistry, workflowId: string, version: string) { return registry.validate(workflowId, version); }\n   * ```\n   */\n  validate(workflowId: string, version: string, actorId?: string): WorkflowDefinitionRecord {\n    const current = this.require(workflowId, version)\n    if (current.status !== 'draft') throw new Error(`Workflow version '${workflowId}@${version}' is not a draft`)\n    validateWorkflowDefinition(current.definition)\n    this.validateDefinition?.(current.definition)\n    return this.update(current, { status: 'validated', ...(actorId === undefined ? {} : { updatedBy: actorId }) })\n  }\n\n  /**\n   * Transitions a validated version to approved and records approver metadata.\n   * @param workflowId - Exact workflow identifier.\n   * @param version - Exact stored version.\n   * @param actorId - Nonblank verified host approver label; no role check occurs here.\n   * @returns A cloned approved record.\n   * @throws Blank actor, missing version, nonvalidated status, or clock failure.\n   * @example\n   * ```typescript\n   * import { InMemoryWorkflowDefinitionRegistry } from \"@alneas/eaos-server/agentic/workflow-registry\";\n   * export function approve(registry: InMemoryWorkflowDefinitionRegistry, workflowId: string, version: string, actorId: string) { return registry.approve(workflowId, version, actorId); }\n   * ```\n   */\n  approve(workflowId: string, version: string, actorId: string): WorkflowDefinitionRecord {\n    if (!actorId.trim()) throw new Error('Workflow approver identity is required')\n    const current = this.require(workflowId, version)\n    if (current.status !== 'validated') throw new Error(`Workflow version '${workflowId}@${version}' must be validated before approval`)\n    return this.update(current, { status: 'approved', approvedAt: this.now(), approvedBy: actorId, updatedBy: actorId })\n  }\n\n  /**\n   * Publishes an approved version and retires any currently published version of the same workflow.\n   * @param workflowId - Exact workflow identifier.\n   * @param version - Approved version to publish.\n   * @param actorId - Nonblank verified host publisher label.\n   * @returns A cloned published record; previous published records become retired.\n   * @throws Blank actor, missing version, nonapproved status, or clock/clone failure; earlier retirement updates can already have occurred.\n   * @example\n   * ```typescript\n   * import { InMemoryWorkflowDefinitionRegistry } from \"@alneas/eaos-server/agentic/workflow-registry\";\n   * export function publish(registry: InMemoryWorkflowDefinitionRegistry, workflowId: string, version: string, actorId: string) { return registry.publish(workflowId, version, actorId); }\n   * ```\n   */\n  publish(workflowId: string, version: string, actorId: string): WorkflowDefinitionRecord {\n    if (!actorId.trim()) throw new Error('Workflow publisher identity is required')\n    const current = this.require(workflowId, version)\n    if (current.status !== 'approved') throw new Error(`Workflow version '${workflowId}@${version}' must be approved before publication`)\n    for (const record of this.records.values()) {\n      if (record.workflowId === workflowId && record.status === 'published') this.records.set(this.key(record.workflowId, record.version), this.update(record, { status: 'retired', retiredAt: this.now(), retiredBy: actorId }))\n    }\n    return this.update(current, { status: 'published', publishedAt: this.now(), publishedBy: actorId, updatedBy: actorId })\n  }\n\n  /**\n   * Transitions a published version to retired and records retirement metadata.\n   * @param workflowId - Exact workflow identifier.\n   * @param version - Currently published version.\n   * @param actorId - Nonblank verified host operator label.\n   * @returns A cloned retired record.\n   * @throws Blank actor, missing version, nonpublished status, or clock failure.\n   * @example\n   * ```typescript\n   * import { InMemoryWorkflowDefinitionRegistry } from \"@alneas/eaos-server/agentic/workflow-registry\";\n   * export function retire(registry: InMemoryWorkflowDefinitionRegistry, workflowId: string, version: string, actorId: string) { return registry.retire(workflowId, version, actorId); }\n   * ```\n   */\n  retire(workflowId: string, version: string, actorId: string): WorkflowDefinitionRecord {\n    if (!actorId.trim()) throw new Error('Workflow retire identity is required')\n    const current = this.require(workflowId, version)\n    if (current.status !== 'published') throw new Error(`Workflow version '${workflowId}@${version}' is not published`)\n    return this.update(current, { status: 'retired', retiredAt: this.now(), retiredBy: actorId, updatedBy: actorId })\n  }\n\n  /**\n   * Reads one workflow version without mutating lifecycle state.\n   * @param workflowId - Exact workflow identifier.\n   * @param version - Exact stored version.\n   * @returns A cloned record, or undefined when absent.\n   * @example\n   * ```typescript\n   * import { InMemoryWorkflowDefinitionRegistry } from \"@alneas/eaos-server/agentic/workflow-registry\";\n   * console.log(new InMemoryWorkflowDefinitionRegistry().get(\"example\", \"1.0.0\")); // undefined\n   * ```\n   */\n  get(workflowId: string, version: string): WorkflowDefinitionRecord | undefined {\n    const record = this.records.get(this.key(workflowId, version))\n    return record ? clone(record) : undefined\n  }\n\n  /**\n   * Finds the currently published version of one workflow.\n   * @param workflowId - Exact workflow identifier.\n   * @returns A cloned published record, or undefined when none exists.\n   * @example\n   * ```typescript\n   * import { InMemoryWorkflowDefinitionRegistry } from \"@alneas/eaos-server/agentic/workflow-registry\";\n   * console.log(new InMemoryWorkflowDefinitionRegistry().getPublished(\"example\")); // undefined\n   * ```\n   */\n  getPublished(workflowId: string): WorkflowDefinitionRecord | undefined {\n    const record = [...this.records.values()].find(item => item.workflowId === workflowId && item.status === 'published')\n    return record ? clone(record) : undefined\n  }\n\n  /**\n   * Lists records in insertion order with optional workflow filtering.\n   * @param workflowId - Exact workflow identifier to filter, or omit for all workflows.\n   * @returns Independent cloned records, or an empty array.\n   * @example\n   * ```typescript\n   * import { InMemoryWorkflowDefinitionRegistry } from \"@alneas/eaos-server/agentic/workflow-registry\";\n   * console.log(new InMemoryWorkflowDefinitionRegistry().list()); // []\n   * ```\n   */\n  list(workflowId?: string): readonly WorkflowDefinitionRecord[] {\n    return [...this.records.values()].filter(record => workflowId === undefined || record.workflowId === workflowId).map(clone)\n  }\n\n  private require(workflowId: string, version: string): WorkflowDefinitionRecord {\n    const record = this.records.get(this.key(workflowId, version))\n    if (!record) throw new Error(`Workflow version '${workflowId}@${version}' was not found`)\n    return record\n  }\n\n  private update(current: WorkflowDefinitionRecord, patch: Partial<WorkflowDefinitionRecord>): WorkflowDefinitionRecord {\n    const next = { ...current, ...patch, revision: current.revision + 1, updatedAt: this.now() }\n    this.records.set(this.key(current.workflowId, current.version), next)\n    return clone(next)\n  }\n\n  private key(workflowId: string, version: string): string { return `${workflowId}@${version}` }\n}\n\nfunction clone(record: WorkflowDefinitionRecord): WorkflowDefinitionRecord { return structuredClone(record) }\n"],"mappings":";AAAA,SAAS,mBAA8E,kCAAkC;AA0MlH,IAAM,qCAAN,MAA+E;AAAA,EACnE,UAAU,oBAAI,IAAsC;AAAA,EACpD;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMjB,YAAY,UAc4C,CAAC,GAAG;AAC1D,SAAK,MAAM,QAAQ,QAAQ,OAAM,oBAAI,KAAK,GAAE,YAAY;AACxD,SAAK,qBAAqB,QAAQ;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,UAAU,OAAgB,SAA4C;AACpE,UAAM,aAAa,2BAA2B,KAAK;AACnD,UAAM,MAAM,KAAK,IAAI,WAAW,YAAY,WAAW,OAAO;AAC9D,UAAM,UAAU,KAAK,QAAQ,IAAI,GAAG;AACpC,QAAI,WAAW,QAAQ,WAAW,QAAS,OAAM,IAAI,MAAM,qBAAqB,WAAW,UAAU,IAAI,WAAW,OAAO,4BAA4B;AACvJ,UAAM,YAAY,KAAK,IAAI;AAC3B,UAAM,SAAmC;AAAA,MACvC,YAAY,WAAW;AAAA,MACvB,SAAS,WAAW;AAAA,MACpB,QAAQ;AAAA,MACR;AAAA,MACA,gBAAgB,kBAAkB,UAAU;AAAA,MAC5C,WAAW,SAAS,YAAY,KAAK;AAAA,MACrC,WAAW,SAAS,aAAa;AAAA,MACjC,WAAW;AAAA,MACX,GAAI,SAAS,aAAa,UAAU,EAAE,WAAW,SAAS,aAAa,QAAQ,IAAI,CAAC;AAAA,MACpF,GAAI,YAAY,SAAY,CAAC,IAAI,EAAE,WAAW,QAAQ;AAAA,IACxD;AACA,SAAK,QAAQ,IAAI,KAAK,MAAM;AAC5B,WAAO,MAAM,MAAM;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,SAAS,YAAoB,SAAiB,SAA4C;AACxF,UAAM,UAAU,KAAK,QAAQ,YAAY,OAAO;AAChD,QAAI,QAAQ,WAAW,QAAS,OAAM,IAAI,MAAM,qBAAqB,UAAU,IAAI,OAAO,kBAAkB;AAC5G,+BAA2B,QAAQ,UAAU;AAC7C,SAAK,qBAAqB,QAAQ,UAAU;AAC5C,WAAO,KAAK,OAAO,SAAS,EAAE,QAAQ,aAAa,GAAI,YAAY,SAAY,CAAC,IAAI,EAAE,WAAW,QAAQ,EAAG,CAAC;AAAA,EAC/G;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,QAAQ,YAAoB,SAAiB,SAA2C;AACtF,QAAI,CAAC,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,wCAAwC;AAC7E,UAAM,UAAU,KAAK,QAAQ,YAAY,OAAO;AAChD,QAAI,QAAQ,WAAW,YAAa,OAAM,IAAI,MAAM,qBAAqB,UAAU,IAAI,OAAO,qCAAqC;AACnI,WAAO,KAAK,OAAO,SAAS,EAAE,QAAQ,YAAY,YAAY,KAAK,IAAI,GAAG,YAAY,SAAS,WAAW,QAAQ,CAAC;AAAA,EACrH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,QAAQ,YAAoB,SAAiB,SAA2C;AACtF,QAAI,CAAC,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,yCAAyC;AAC9E,UAAM,UAAU,KAAK,QAAQ,YAAY,OAAO;AAChD,QAAI,QAAQ,WAAW,WAAY,OAAM,IAAI,MAAM,qBAAqB,UAAU,IAAI,OAAO,uCAAuC;AACpI,eAAW,UAAU,KAAK,QAAQ,OAAO,GAAG;AAC1C,UAAI,OAAO,eAAe,cAAc,OAAO,WAAW,YAAa,MAAK,QAAQ,IAAI,KAAK,IAAI,OAAO,YAAY,OAAO,OAAO,GAAG,KAAK,OAAO,QAAQ,EAAE,QAAQ,WAAW,WAAW,KAAK,IAAI,GAAG,WAAW,QAAQ,CAAC,CAAC;AAAA,IAC5N;AACA,WAAO,KAAK,OAAO,SAAS,EAAE,QAAQ,aAAa,aAAa,KAAK,IAAI,GAAG,aAAa,SAAS,WAAW,QAAQ,CAAC;AAAA,EACxH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,OAAO,YAAoB,SAAiB,SAA2C;AACrF,QAAI,CAAC,QAAQ,KAAK,EAAG,OAAM,IAAI,MAAM,sCAAsC;AAC3E,UAAM,UAAU,KAAK,QAAQ,YAAY,OAAO;AAChD,QAAI,QAAQ,WAAW,YAAa,OAAM,IAAI,MAAM,qBAAqB,UAAU,IAAI,OAAO,oBAAoB;AAClH,WAAO,KAAK,OAAO,SAAS,EAAE,QAAQ,WAAW,WAAW,KAAK,IAAI,GAAG,WAAW,SAAS,WAAW,QAAQ,CAAC;AAAA,EAClH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,IAAI,YAAoB,SAAuD;AAC7E,UAAM,SAAS,KAAK,QAAQ,IAAI,KAAK,IAAI,YAAY,OAAO,CAAC;AAC7D,WAAO,SAAS,MAAM,MAAM,IAAI;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,aAAa,YAA0D;AACrE,UAAM,SAAS,CAAC,GAAG,KAAK,QAAQ,OAAO,CAAC,EAAE,KAAK,UAAQ,KAAK,eAAe,cAAc,KAAK,WAAW,WAAW;AACpH,WAAO,SAAS,MAAM,MAAM,IAAI;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,KAAK,YAA0D;AAC7D,WAAO,CAAC,GAAG,KAAK,QAAQ,OAAO,CAAC,EAAE,OAAO,YAAU,eAAe,UAAa,OAAO,eAAe,UAAU,EAAE,IAAI,KAAK;AAAA,EAC5H;AAAA,EAEQ,QAAQ,YAAoB,SAA2C;AAC7E,UAAM,SAAS,KAAK,QAAQ,IAAI,KAAK,IAAI,YAAY,OAAO,CAAC;AAC7D,QAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,qBAAqB,UAAU,IAAI,OAAO,iBAAiB;AACxF,WAAO;AAAA,EACT;AAAA,EAEQ,OAAO,SAAmC,OAAoE;AACpH,UAAM,OAAO,EAAE,GAAG,SAAS,GAAG,OAAO,UAAU,QAAQ,WAAW,GAAG,WAAW,KAAK,IAAI,EAAE;AAC3F,SAAK,QAAQ,IAAI,KAAK,IAAI,QAAQ,YAAY,QAAQ,OAAO,GAAG,IAAI;AACpE,WAAO,MAAM,IAAI;AAAA,EACnB;AAAA,EAEQ,IAAI,YAAoB,SAAyB;AAAE,WAAO,GAAG,UAAU,IAAI,OAAO;AAAA,EAAG;AAC/F;AAEA,SAAS,MAAM,QAA4D;AAAE,SAAO,gBAAgB,MAAM;AAAE;","names":[]}