@ankhorage/flow 0.0.0-stage → 0.5.0

package/dist/features/security/domain/validateFlowSecurityTarget.js

@@ -0,0 +1,57 @@
+import { FlowSecurityError } from '../FlowSecurityError.js';
+/*** Validates target syntax before the host transport verifies every resolved network peer. */
+export const validateFlowSecurityTarget = (target) => {
+    if (!target)
+        return undefined;
+    let url;
+    try {
+        url = new URL(target.url);
+    }
+    catch {
+        throw new FlowSecurityError('invalid_target', 'External targets must be absolute HTTPS URLs.');
+    }
+    const host = url.hostname.replace(/^\[|\]$/g, '').toLowerCase();
+    if (url.protocol !== 'https:' ||
+        url.username ||
+        url.password ||
+        url.hash ||
+        !uniqueStrings(target.allowedHosts) ||
+        !target.allowedHosts.includes(host) ||
+        isUnsafeLiteralHost(host))
+        throw new FlowSecurityError('invalid_target', 'External targets must use an explicitly allowlisted public HTTPS host.');
+    return host;
+};
+/*** Rejects normalized loopback, local, private, and special-use IP literals before transport access. */
+const isUnsafeLiteralHost = (host) => host === 'localhost' || host.endsWith('.localhost') || isUnsafeIpv4(host) || isUnsafeIpv6(host);
+/*** Identifies IPv4 ranges that must never be an outbound target. */
+const isUnsafeIpv4 = (host) => {
+    const parts = host.split('.').map(Number);
+    if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255))
+        return false;
+    const [first, second] = parts;
+    return (first === 0 ||
+        first === 10 ||
+        first === 127 ||
+        first >= 224 ||
+        (first === 169 && second === 254) ||
+        (first === 172 && second >= 16 && second <= 31) ||
+        (first === 192 && second === 168));
+};
+/*** Identifies IPv6 loopback, unspecified, unique-local, link-local, and mapped literal forms. */
+const isUnsafeIpv6 = (host) => {
+    const normalized = host.toLowerCase();
+    return (normalized === '::' ||
+        normalized === '::1' ||
+        normalized.startsWith('fc') ||
+        normalized.startsWith('fd') ||
+        normalized.startsWith('fe8') ||
+        normalized.startsWith('fe9') ||
+        normalized.startsWith('fea') ||
+        normalized.startsWith('feb') ||
+        normalized.startsWith('::ffff:'));
+};
+/*** Checks unique non-empty authority strings. */
+const uniqueStrings = (values) => values.length > 0 &&
+    values.every((value) => value.length > 0) &&
+    new Set(values).size === values.length;
+//# sourceMappingURL=validateFlowSecurityTarget.js.map

package/dist/features/security/domain/validateFlowSecurityTarget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateFlowSecurityTarget.js","sourceRoot":"","sources":["../../../../src/features/security/domain/validateFlowSecurityTarget.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,+FAA+F;AAC/F,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACxC,MAAsC,EAClB,EAAE;IACtB,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,EAAE,+CAA+C,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAChE,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,IAAI;QACR,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC;QACnC,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;QACnC,mBAAmB,CAAC,IAAI,CAAC;QAEzB,MAAM,IAAI,iBAAiB,CACzB,gBAAgB,EAChB,wEAAwE,CACzE,CAAC;IACJ,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,yGAAyG;AACzG,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAW,EAAE,CACpD,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;AAElG,qEAAqE;AACrE,MAAM,YAAY,GAAG,CAAC,IAAY,EAAW,EAAE;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,GAAG,CAAC;QAC/F,OAAO,KAAK,CAAC;IACf,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,KAAyC,CAAC;IAClE,OAAO,CACL,KAAK,KAAK,CAAC;QACX,KAAK,KAAK,EAAE;QACZ,KAAK,KAAK,GAAG;QACb,KAAK,IAAI,GAAG;QACZ,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;QACjC,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,CAAC;QAC/C,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC,CAClC,CAAC;AACJ,CAAC,CAAC;AAEF,kGAAkG;AAClG,MAAM,YAAY,GAAG,CAAC,IAAY,EAAW,EAAE;IAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACtC,OAAO,CACL,UAAU,KAAK,IAAI;QACnB,UAAU,KAAK,KAAK;QACpB,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;QAC3B,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;QAC3B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC5B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC5B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC5B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC5B,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CACjC,CAAC;AACJ,CAAC,CAAC;AAEF,kDAAkD;AAClD,MAAM,aAAa,GAAG,CAAC,MAAyB,EAAW,EAAE,CAC3D,MAAM,CAAC,MAAM,GAAG,CAAC;IACjB,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IACzC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC","sourcesContent":["import type { FlowSecurityTarget } from '../../../types/security.js';\nimport { FlowSecurityError } from '../FlowSecurityError.js';\n\n/*** Validates target syntax before the host transport verifies every resolved network peer. */\nexport const validateFlowSecurityTarget = (\n  target: FlowSecurityTarget | undefined,\n): string | undefined => {\n  if (!target) return undefined;\n  let url: URL;\n  try {\n    url = new URL(target.url);\n  } catch {\n    throw new FlowSecurityError('invalid_target', 'External targets must be absolute HTTPS URLs.');\n  }\n  const host = url.hostname.replace(/^\\[|\\]$/g, '').toLowerCase();\n  if (\n    url.protocol !== 'https:' ||\n    url.username ||\n    url.password ||\n    url.hash ||\n    !uniqueStrings(target.allowedHosts) ||\n    !target.allowedHosts.includes(host) ||\n    isUnsafeLiteralHost(host)\n  )\n    throw new FlowSecurityError(\n      'invalid_target',\n      'External targets must use an explicitly allowlisted public HTTPS host.',\n    );\n  return host;\n};\n\n/*** Rejects normalized loopback, local, private, and special-use IP literals before transport access. */\nconst isUnsafeLiteralHost = (host: string): boolean =>\n  host === 'localhost' || host.endsWith('.localhost') || isUnsafeIpv4(host) || isUnsafeIpv6(host);\n\n/*** Identifies IPv4 ranges that must never be an outbound target. */\nconst isUnsafeIpv4 = (host: string): boolean => {\n  const parts = host.split('.').map(Number);\n  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255))\n    return false;\n  const [first, second] = parts as [number, number, number, number];\n  return (\n    first === 0 ||\n    first === 10 ||\n    first === 127 ||\n    first >= 224 ||\n    (first === 169 && second === 254) ||\n    (first === 172 && second >= 16 && second <= 31) ||\n    (first === 192 && second === 168)\n  );\n};\n\n/*** Identifies IPv6 loopback, unspecified, unique-local, link-local, and mapped literal forms. */\nconst isUnsafeIpv6 = (host: string): boolean => {\n  const normalized = host.toLowerCase();\n  return (\n    normalized === '::' ||\n    normalized === '::1' ||\n    normalized.startsWith('fc') ||\n    normalized.startsWith('fd') ||\n    normalized.startsWith('fe8') ||\n    normalized.startsWith('fe9') ||\n    normalized.startsWith('fea') ||\n    normalized.startsWith('feb') ||\n    normalized.startsWith('::ffff:')\n  );\n};\n\n/*** Checks unique non-empty authority strings. */\nconst uniqueStrings = (values: readonly string[]): boolean =>\n  values.length > 0 &&\n  values.every((value) => value.length > 0) &&\n  new Set(values).size === values.length;\n"]}

package/dist/index.d.ts

@@ -0,0 +1,16 @@
+/*** Headless graph compilation and deterministic single-process execution. */
+export { createDurableRunAsync } from './features/execution/application/createDurableRunAsync.js';
+export { executeFlowAsync } from './features/execution/application/executeFlowAsync.js';
+export { calculateRetryDueAt } from './features/execution/domain/calculateRetryDueAt.js';
+export { compileFlowGraph } from './features/execution/domain/compileFlowGraph.js';
+export { createDefaultNodeRegistry } from './features/execution/domain/createDefaultNodeRegistry.js';
+export { createDurableRun } from './features/execution/domain/createDurableRun.js';
+export { createRetryWork } from './features/execution/domain/createRetryWork.js';
+export { isCronDueAt } from './features/execution/domain/isCronDueAt.js';
+export type { FlowPersistencePort } from './features/execution/ports/FlowPersistencePort.js';
+export { createFlowSecurityPort } from './features/security/application/createFlowSecurityPort.js';
+export { FlowSecurityError } from './features/security/FlowSecurityError.js';
+export type { FlowDefinitionRef, FlowDurableRun, FlowDurableWork, FlowOutboxRecord, FlowRetryPolicy, FlowRunCheckpoint, } from './types/durableExecution.js';
+export type { FlowClock, FlowCompiledGraph, FlowExecutionResult, FlowNodeOperation, FlowNodeOperationResult, FlowNodeRegistry, FlowRunRequest, } from './types/execution.js';
+export type { FlowApprovalStorePort, FlowOperationStorePort, FlowOutboundTransportPort, FlowRateLimitPort, FlowResolvedSecrets, FlowSecretCreateInput, FlowSecretMetadata, FlowSecretRevokeInput, FlowSecurityActor, FlowSecurityApproval, FlowSecurityAuditEvent, FlowSecurityAuditPort, FlowSecurityGrant, FlowSecurityOperation, FlowSecurityOperationIdentity, FlowSecurityPermit, FlowSecurityPort, FlowSecurityTarget, } from './types/security.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,2DAA2D,CAAC;AAClG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oDAAoD,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iDAAiD,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,0DAA0D,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,MAAM,iDAAiD,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,gDAAgD,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AACzE,YAAY,EAAE,mBAAmB,EAAE,MAAM,mDAAmD,CAAC;AAC7F,OAAO,EAAE,sBAAsB,EAAE,MAAM,2DAA2D,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,iBAAiB,GAClB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,SAAS,EACT,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,gBAAgB,EAChB,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,qBAAqB,EACrB,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,EACjB,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,6BAA6B,EAC7B,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -0,0 +1,12 @@
+/*** Headless graph compilation and deterministic single-process execution. */
+export { createDurableRunAsync } from './features/execution/application/createDurableRunAsync.js';
+export { executeFlowAsync } from './features/execution/application/executeFlowAsync.js';
+export { calculateRetryDueAt } from './features/execution/domain/calculateRetryDueAt.js';
+export { compileFlowGraph } from './features/execution/domain/compileFlowGraph.js';
+export { createDefaultNodeRegistry } from './features/execution/domain/createDefaultNodeRegistry.js';
+export { createDurableRun } from './features/execution/domain/createDurableRun.js';
+export { createRetryWork } from './features/execution/domain/createRetryWork.js';
+export { isCronDueAt } from './features/execution/domain/isCronDueAt.js';
+export { createFlowSecurityPort } from './features/security/application/createFlowSecurityPort.js';
+export { FlowSecurityError } from './features/security/FlowSecurityError.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,2DAA2D,CAAC;AAClG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oDAAoD,CAAC;AACzF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iDAAiD,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,0DAA0D,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,MAAM,iDAAiD,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,gDAAgD,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAC;AAEzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,2DAA2D,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC","sourcesContent":["/*** Headless graph compilation and deterministic single-process execution. */\nexport { createDurableRunAsync } from './features/execution/application/createDurableRunAsync.js';\nexport { executeFlowAsync } from './features/execution/application/executeFlowAsync.js';\nexport { calculateRetryDueAt } from './features/execution/domain/calculateRetryDueAt.js';\nexport { compileFlowGraph } from './features/execution/domain/compileFlowGraph.js';\nexport { createDefaultNodeRegistry } from './features/execution/domain/createDefaultNodeRegistry.js';\nexport { createDurableRun } from './features/execution/domain/createDurableRun.js';\nexport { createRetryWork } from './features/execution/domain/createRetryWork.js';\nexport { isCronDueAt } from './features/execution/domain/isCronDueAt.js';\nexport type { FlowPersistencePort } from './features/execution/ports/FlowPersistencePort.js';\nexport { createFlowSecurityPort } from './features/security/application/createFlowSecurityPort.js';\nexport { FlowSecurityError } from './features/security/FlowSecurityError.js';\nexport type {\n  FlowDefinitionRef,\n  FlowDurableRun,\n  FlowDurableWork,\n  FlowOutboxRecord,\n  FlowRetryPolicy,\n  FlowRunCheckpoint,\n} from './types/durableExecution.js';\nexport type {\n  FlowClock,\n  FlowCompiledGraph,\n  FlowExecutionResult,\n  FlowNodeOperation,\n  FlowNodeOperationResult,\n  FlowNodeRegistry,\n  FlowRunRequest,\n} from './types/execution.js';\nexport type {\n  FlowApprovalStorePort,\n  FlowOperationStorePort,\n  FlowOutboundTransportPort,\n  FlowRateLimitPort,\n  FlowResolvedSecrets,\n  FlowSecretCreateInput,\n  FlowSecretMetadata,\n  FlowSecretRevokeInput,\n  FlowSecurityActor,\n  FlowSecurityApproval,\n  FlowSecurityAuditEvent,\n  FlowSecurityAuditPort,\n  FlowSecurityGrant,\n  FlowSecurityOperation,\n  FlowSecurityOperationIdentity,\n  FlowSecurityPermit,\n  FlowSecurityPort,\n  FlowSecurityTarget,\n} from './types/security.js';\n"]}

package/dist/mcp.d.ts

@@ -0,0 +1,4 @@
+/*** Optional, allowlist-only MCP tool discovery and invocation integration. */
+export { createMcpToolRegistry } from './features/mcp/createMcpToolRegistry.js';
+export type { McpProviderDefinition, McpToolInvocation, McpToolMetadata, McpToolPermission, McpToolRegistry, McpToolResult, McpTrustedStdioProvider, } from './types/mcp.js';
+//# sourceMappingURL=mcp.d.ts.map

package/dist/mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAChF,YAAY,EACV,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,uBAAuB,GACxB,MAAM,gBAAgB,CAAC"}

package/dist/mcp.js

@@ -0,0 +1,3 @@
+/*** Optional, allowlist-only MCP tool discovery and invocation integration. */
+export { createMcpToolRegistry } from './features/mcp/createMcpToolRegistry.js';
+//# sourceMappingURL=mcp.js.map

package/dist/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC","sourcesContent":["/*** Optional, allowlist-only MCP tool discovery and invocation integration. */\nexport { createMcpToolRegistry } from './features/mcp/createMcpToolRegistry.js';\nexport type {\n  McpProviderDefinition,\n  McpToolInvocation,\n  McpToolMetadata,\n  McpToolPermission,\n  McpToolRegistry,\n  McpToolResult,\n  McpTrustedStdioProvider,\n} from './types/mcp.js';\n"]}

package/dist/social.d.ts

@@ -0,0 +1,7 @@
+/***
+ * Reserved public subpath for future social-provider adapters.
+ *
+ * This bootstrap intentionally provides no social execution, configuration, or dependencies.
+ */
+export {};
+//# sourceMappingURL=social.d.ts.map

package/dist/social.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"social.d.ts","sourceRoot":"","sources":["../src/social.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC"}

package/dist/social.js

@@ -0,0 +1,7 @@
+/***
+ * Reserved public subpath for future social-provider adapters.
+ *
+ * This bootstrap intentionally provides no social execution, configuration, or dependencies.
+ */
+export {};
+//# sourceMappingURL=social.js.map

package/dist/social.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"social.js","sourceRoot":"","sources":["../src/social.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC","sourcesContent":["/***\n * Reserved public subpath for future social-provider adapters.\n *\n * This bootstrap intentionally provides no social execution, configuration, or dependencies.\n */\nexport {};\n"]}

package/dist/types/durableExecution.d.ts

@@ -0,0 +1,55 @@
+import type { DataContractValue } from '@ankhorage/contracts/data';
+import type { FlowSecurityOperation } from './security.js';
+export interface FlowDefinitionRef {
+    readonly id: string;
+    readonly version: number;
+}
+export interface FlowDurableRun {
+    readonly checkpoint?: FlowRunCheckpoint;
+    readonly createdAt: string;
+    readonly flow: FlowDefinitionRef;
+    readonly id: string;
+    readonly revision: number;
+    readonly status: 'cancelled' | 'failed' | 'queued' | 'running' | 'succeeded' | 'waiting_approval';
+    readonly updatedAt: string;
+}
+export interface FlowDurableWork {
+    readonly attempt: number;
+    readonly dueAt: string;
+    /** Explicitly separates side-effect-free internal work from a security-protected provider effect. */
+    readonly effectKind: 'internal' | 'protected';
+    readonly flow: FlowDefinitionRef;
+    readonly id: string;
+    readonly idempotencyKey?: string;
+    readonly lease?: {
+        readonly expiresAt: string;
+        readonly fencingToken: number;
+        readonly workerId: string;
+    };
+    readonly runId: string;
+    readonly securityOperation?: FlowSecurityOperation;
+    readonly stepId?: string;
+    readonly status: 'cancelled' | 'claimed' | 'completed' | 'ready';
+}
+export interface FlowRetryPolicy {
+    readonly baseDelayMs: number;
+    readonly maxAttempts: number;
+    readonly maxDelayMs: number;
+}
+/** Persisted state for each completed or in-flight Flow step. */
+export interface FlowRunCheckpoint {
+    readonly completedStepIds: readonly string[];
+    readonly data?: DataContractValue;
+    readonly failedStepIds: readonly string[];
+}
+/** A durable outbox record separates at-least-once delivery from an idempotent application effect. */
+export interface FlowOutboxRecord {
+    readonly createdAt: string;
+    readonly id: string;
+    readonly idempotencyKey: string;
+    readonly payload?: DataContractValue;
+    readonly runId: string;
+    readonly status: 'delivered' | 'pending';
+    readonly workId: string;
+}
+//# sourceMappingURL=durableExecution.d.ts.map

package/dist/types/durableExecution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"durableExecution.d.ts","sourceRoot":"","sources":["../../src/types/durableExecution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAE3D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,kBAAkB,CAAC;IAClG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,qGAAqG;IACrG,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,WAAW,CAAC;IAC9C,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,qBAAqB,CAAC;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC;CAClE;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,sGAAsG;AACtG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB"}

package/dist/types/durableExecution.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=durableExecution.js.map

package/dist/types/durableExecution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"durableExecution.js","sourceRoot":"","sources":["../../src/types/durableExecution.ts"],"names":[],"mappings":"","sourcesContent":["import type { DataContractValue } from '@ankhorage/contracts/data';\n\nimport type { FlowSecurityOperation } from './security.js';\n\nexport interface FlowDefinitionRef {\n  readonly id: string;\n  readonly version: number;\n}\n\nexport interface FlowDurableRun {\n  readonly checkpoint?: FlowRunCheckpoint;\n  readonly createdAt: string;\n  readonly flow: FlowDefinitionRef;\n  readonly id: string;\n  readonly revision: number;\n  readonly status: 'cancelled' | 'failed' | 'queued' | 'running' | 'succeeded' | 'waiting_approval';\n  readonly updatedAt: string;\n}\n\nexport interface FlowDurableWork {\n  readonly attempt: number;\n  readonly dueAt: string;\n  /** Explicitly separates side-effect-free internal work from a security-protected provider effect. */\n  readonly effectKind: 'internal' | 'protected';\n  readonly flow: FlowDefinitionRef;\n  readonly id: string;\n  readonly idempotencyKey?: string;\n  readonly lease?: {\n    readonly expiresAt: string;\n    readonly fencingToken: number;\n    readonly workerId: string;\n  };\n  readonly runId: string;\n  readonly securityOperation?: FlowSecurityOperation;\n  readonly stepId?: string;\n  readonly status: 'cancelled' | 'claimed' | 'completed' | 'ready';\n}\n\nexport interface FlowRetryPolicy {\n  readonly baseDelayMs: number;\n  readonly maxAttempts: number;\n  readonly maxDelayMs: number;\n}\n\n/** Persisted state for each completed or in-flight Flow step. */\nexport interface FlowRunCheckpoint {\n  readonly completedStepIds: readonly string[];\n  readonly data?: DataContractValue;\n  readonly failedStepIds: readonly string[];\n}\n\n/** A durable outbox record separates at-least-once delivery from an idempotent application effect. */\nexport interface FlowOutboxRecord {\n  readonly createdAt: string;\n  readonly id: string;\n  readonly idempotencyKey: string;\n  readonly payload?: DataContractValue;\n  readonly runId: string;\n  readonly status: 'delivered' | 'pending';\n  readonly workId: string;\n}\n"]}

package/dist/types/execution.d.ts

@@ -0,0 +1,33 @@
+import type { DataSchemaRegistry } from '@ankhorage/contracts/data';
+import type { FlowDataRef, FlowDefinition, FlowEdge, FlowNode, FlowNodeConfig, FlowPortId, FlowRunSnapshot } from '@ankhorage/contracts/flow';
+export interface FlowClock {
+    readonly now: () => Date;
+}
+export interface FlowNodeOperationResult {
+    readonly output?: Readonly<Record<FlowPortId, FlowDataRef>>;
+}
+export interface FlowNodeOperation {
+    readonly executeAsync: (input: {
+        readonly config: FlowNodeConfig | undefined;
+        readonly input: Readonly<Record<FlowPortId, FlowDataRef>>;
+        readonly node: FlowNode;
+        readonly signal: AbortSignal;
+    }) => Promise<FlowNodeOperationResult>;
+}
+export type FlowNodeRegistry = Readonly<Record<string, FlowNodeOperation>>;
+export interface FlowCompiledGraph {
+    readonly definition: FlowDefinition;
+    readonly edgesBySourceNodeId: Readonly<Record<string, readonly FlowEdge[]>>;
+    readonly topologicalNodeIds: readonly string[];
+}
+export interface FlowRunRequest {
+    readonly input?: Readonly<Record<FlowPortId, FlowDataRef>>;
+    readonly runId: string;
+    readonly schemaRegistry?: DataSchemaRegistry;
+    readonly signal?: AbortSignal;
+    readonly triggerId: string;
+}
+export interface FlowExecutionResult {
+    readonly run: FlowRunSnapshot;
+}
+//# sourceMappingURL=execution.d.ts.map

package/dist/types/execution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution.d.ts","sourceRoot":"","sources":["../../src/types/execution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EACV,WAAW,EACX,cAAc,EACd,QAAQ,EACR,QAAQ,EACR,cAAc,EACd,UAAU,EACV,eAAe,EAChB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC;CAC1B;AACD,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;CAC7D;AACD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE;QAC7B,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,SAAS,CAAC;QAC5C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;QAC1D,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;KAC9B,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACxC;AACD,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAC3E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC5E,QAAQ,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD;AACD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;IAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,cAAc,CAAC,EAAE,kBAAkB,CAAC;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AACD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC;CAC/B"}

package/dist/types/execution.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=execution.js.map

package/dist/types/execution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution.js","sourceRoot":"","sources":["../../src/types/execution.ts"],"names":[],"mappings":"","sourcesContent":["import type { DataSchemaRegistry } from '@ankhorage/contracts/data';\nimport type {\n  FlowDataRef,\n  FlowDefinition,\n  FlowEdge,\n  FlowNode,\n  FlowNodeConfig,\n  FlowPortId,\n  FlowRunSnapshot,\n} from '@ankhorage/contracts/flow';\n\nexport interface FlowClock {\n  readonly now: () => Date;\n}\nexport interface FlowNodeOperationResult {\n  readonly output?: Readonly<Record<FlowPortId, FlowDataRef>>;\n}\nexport interface FlowNodeOperation {\n  readonly executeAsync: (input: {\n    readonly config: FlowNodeConfig | undefined;\n    readonly input: Readonly<Record<FlowPortId, FlowDataRef>>;\n    readonly node: FlowNode;\n    readonly signal: AbortSignal;\n  }) => Promise<FlowNodeOperationResult>;\n}\nexport type FlowNodeRegistry = Readonly<Record<string, FlowNodeOperation>>;\nexport interface FlowCompiledGraph {\n  readonly definition: FlowDefinition;\n  readonly edgesBySourceNodeId: Readonly<Record<string, readonly FlowEdge[]>>;\n  readonly topologicalNodeIds: readonly string[];\n}\nexport interface FlowRunRequest {\n  readonly input?: Readonly<Record<FlowPortId, FlowDataRef>>;\n  readonly runId: string;\n  readonly schemaRegistry?: DataSchemaRegistry;\n  readonly signal?: AbortSignal;\n  readonly triggerId: string;\n}\nexport interface FlowExecutionResult {\n  readonly run: FlowRunSnapshot;\n}\n"]}

package/dist/types/mcp.d.ts

@@ -0,0 +1,61 @@
+import type { SecretRef } from '@ankhorage/contracts/secrets';
+import type { FlowSecurityActor } from './security.js';
+/** Public configuration and results for the optional MCP integration. */
+export interface McpToolPermission {
+    readonly name: string;
+    readonly grantedScopes: readonly string[];
+}
+export type McpProviderDefinition = {
+    readonly id: string;
+    readonly transport: 'remote';
+    readonly endpoint: string;
+    readonly allowedHosts: readonly string[];
+    readonly allowedTools: readonly McpToolPermission[];
+    readonly grantedScopes: readonly string[];
+    readonly timeoutMs?: number;
+} | {
+    readonly id: string;
+    readonly transport: 'stdio';
+    readonly allowedTools: readonly McpToolPermission[];
+    readonly grantedScopes: readonly string[];
+    readonly timeoutMs?: number;
+};
+/** Host-owned command configuration. It is deliberately separate from workflow provider data. */
+export interface McpTrustedStdioProvider {
+    readonly command: string;
+    readonly args?: readonly string[];
+}
+export interface McpToolMetadata {
+    readonly providerId: string;
+    readonly name: string;
+    readonly title?: string;
+    readonly description?: string;
+    readonly inputSchema: Readonly<Record<string, unknown>>;
+    readonly schemaFingerprint: string;
+    readonly scopes: readonly string[];
+    readonly readOnly: boolean;
+}
+export interface McpToolInvocation {
+    readonly providerId: string;
+    readonly toolName: string;
+    readonly schemaFingerprint: string;
+    readonly arguments: Readonly<Record<string, unknown>>;
+    readonly scopes: readonly string[];
+    readonly security: {
+        readonly actor: FlowSecurityActor;
+        readonly idempotencyKey: string;
+        readonly operationId: string;
+        readonly secretRefs?: readonly SecretRef[];
+    };
+    readonly signal?: AbortSignal;
+}
+export interface McpToolResult {
+    readonly content: readonly unknown[];
+    readonly structuredContent?: Readonly<Record<string, unknown>>;
+    readonly isError: boolean;
+}
+export interface McpToolRegistry {
+    discoverAsync(signal?: AbortSignal): Promise<readonly McpToolMetadata[]>;
+    invokeAsync(invocation: McpToolInvocation): Promise<McpToolResult>;
+}
+//# sourceMappingURL=mcp.d.ts.map

package/dist/types/mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/types/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAE9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEvD,yEAAyE;AACzE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,MAAM,MAAM,qBAAqB,GAC7B;IACE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACpD,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,GACD;IACE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACpD,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEN,iGAAiG;AACjG,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;QAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;KAC5C,CAAC;IACF,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,SAAS,OAAO,EAAE,CAAC;IACrC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC,CAAC;IACzE,WAAW,CAAC,UAAU,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACpE"}

package/dist/types/mcp.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=mcp.js.map

package/dist/types/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../../src/types/mcp.ts"],"names":[],"mappings":"","sourcesContent":["import type { SecretRef } from '@ankhorage/contracts/secrets';\n\nimport type { FlowSecurityActor } from './security.js';\n\n/** Public configuration and results for the optional MCP integration. */\nexport interface McpToolPermission {\n  readonly name: string;\n  readonly grantedScopes: readonly string[];\n}\n\nexport type McpProviderDefinition =\n  | {\n      readonly id: string;\n      readonly transport: 'remote';\n      readonly endpoint: string;\n      readonly allowedHosts: readonly string[];\n      readonly allowedTools: readonly McpToolPermission[];\n      readonly grantedScopes: readonly string[];\n      readonly timeoutMs?: number;\n    }\n  | {\n      readonly id: string;\n      readonly transport: 'stdio';\n      readonly allowedTools: readonly McpToolPermission[];\n      readonly grantedScopes: readonly string[];\n      readonly timeoutMs?: number;\n    };\n\n/** Host-owned command configuration. It is deliberately separate from workflow provider data. */\nexport interface McpTrustedStdioProvider {\n  readonly command: string;\n  readonly args?: readonly string[];\n}\n\nexport interface McpToolMetadata {\n  readonly providerId: string;\n  readonly name: string;\n  readonly title?: string;\n  readonly description?: string;\n  readonly inputSchema: Readonly<Record<string, unknown>>;\n  readonly schemaFingerprint: string;\n  readonly scopes: readonly string[];\n  readonly readOnly: boolean;\n}\n\nexport interface McpToolInvocation {\n  readonly providerId: string;\n  readonly toolName: string;\n  readonly schemaFingerprint: string;\n  readonly arguments: Readonly<Record<string, unknown>>;\n  readonly scopes: readonly string[];\n  readonly security: {\n    readonly actor: FlowSecurityActor;\n    readonly idempotencyKey: string;\n    readonly operationId: string;\n    readonly secretRefs?: readonly SecretRef[];\n  };\n  readonly signal?: AbortSignal;\n}\n\nexport interface McpToolResult {\n  readonly content: readonly unknown[];\n  readonly structuredContent?: Readonly<Record<string, unknown>>;\n  readonly isError: boolean;\n}\n\nexport interface McpToolRegistry {\n  discoverAsync(signal?: AbortSignal): Promise<readonly McpToolMetadata[]>;\n  invokeAsync(invocation: McpToolInvocation): Promise<McpToolResult>;\n}\n"]}

package/dist/types/security.d.ts

@@ -0,0 +1,123 @@
+import type { SecretMetadata, SecretPayload, SecretRef } from '@ankhorage/contracts/secrets';
+/** Trusted execution identity supplied by the host authentication boundary. */
+export interface FlowSecurityActor {
+    readonly id: string;
+    readonly tenantId: string;
+    readonly projectId: string;
+    readonly environment: string;
+}
+/** An exact capability grant; omitted dimensions never imply access. */
+export interface FlowSecurityGrant {
+    readonly actorId: string;
+    readonly capability: string;
+    readonly tenantId: string;
+    readonly projectId: string;
+    readonly environment: string;
+}
+/** A protected external operation presented to the security boundary. */
+export interface FlowSecurityOperation {
+    readonly actor: FlowSecurityActor;
+    readonly capability: string;
+    readonly idempotencyKey: string;
+    readonly operationId: string;
+    readonly secretRefs?: readonly SecretRef[];
+    readonly target?: FlowSecurityTarget;
+}
+/** An outbound destination and its exact host authority. */
+export interface FlowSecurityTarget {
+    readonly allowedHosts: readonly string[];
+    readonly url: string;
+}
+/** The complete immutable identity that grants, claims, and consumes one operation. */
+export interface FlowSecurityOperationIdentity {
+    readonly actor: FlowSecurityActor;
+    readonly capability: string;
+    readonly idempotencyKey: string;
+    readonly operationId: string;
+    readonly secretRefs: readonly SecretRef[];
+    readonly target?: FlowSecurityTarget;
+}
+/** A durable human decision bound to exactly one complete operation identity. */
+export interface FlowSecurityApproval {
+    readonly operation: FlowSecurityOperationIdentity;
+    readonly status: 'approved' | 'pending' | 'rejected';
+}
+/** Host-owned persistence boundary for approval-gate state. */
+export interface FlowApprovalStorePort {
+    getAsync(operation: FlowSecurityOperationIdentity): Promise<FlowSecurityApproval | undefined>;
+}
+/**
+ * Host-owned durable exactly-once boundary. Every transition must be atomic across workers and
+ * restarts. `releaseAsync` may only release an unconsumed claim for this exact identity.
+ */
+export interface FlowOperationStorePort {
+    claimAsync(operation: FlowSecurityOperationIdentity): Promise<boolean>;
+    consumeAsync(operation: FlowSecurityOperationIdentity): Promise<boolean>;
+    releaseAsync(operation: FlowSecurityOperationIdentity): Promise<void>;
+}
+/**
+ * Host-owned network boundary that verifies every actual peer before opening a connection.
+ * It must enforce the supplied host allowlist, resolve immediately before every connection,
+ * reject private or special-use resolved addresses, and reapply that policy to redirects.
+ */
+export interface FlowOutboundTransportPort {
+    fetchAsync(input: {
+        readonly allowedHosts: readonly string[];
+        readonly init?: RequestInit;
+        readonly url: string;
+    }): Promise<Response>;
+}
+/** Host-owned rate limiter. A denied acquisition must have no external side effect. */
+export interface FlowRateLimitPort {
+    acquireAsync(input: {
+        readonly actor: FlowSecurityActor;
+        readonly capability: string;
+        readonly operationId: string;
+    }): Promise<boolean>;
+}
+/** Redaction-safe audit edge. Secret values and payloads are intentionally absent. */
+export interface FlowSecurityAuditPort {
+    writeAsync(event: FlowSecurityAuditEvent): Promise<void>;
+}
+/** Immutable audit metadata for one permit or denial. */
+export interface FlowSecurityAuditEvent {
+    readonly actorId: string;
+    readonly capability: string;
+    readonly decision: 'denied' | 'permitted';
+    readonly operationId: string;
+    readonly reason: 'approval_pending' | 'approval_rejected' | 'credential_create' | 'credential_revoke' | 'idempotency_conflict' | 'invalid_target' | 'permission_denied' | 'rate_limited' | 'secret_unavailable';
+    readonly secretRefs: readonly SecretRef[];
+    readonly targetHost?: string;
+}
+/** Metadata-only credential view safe for administrative or graph-facing callers. */
+export type FlowSecretMetadata = SecretMetadata;
+export type FlowResolvedSecrets = Readonly<Record<SecretRef, Readonly<Record<string, string>>>>;
+/** Protected server-side credential creation input. Its scope is always derived from the actor. */
+export interface FlowSecretCreateInput {
+    readonly actor: FlowSecurityActor;
+    readonly kind: string;
+    readonly payload: SecretPayload;
+    readonly provider?: string;
+    readonly ref: SecretRef;
+}
+/** Protected server-side credential revocation input. Its scope is always derived from the actor. */
+export interface FlowSecretRevokeInput {
+    readonly actor: FlowSecurityActor;
+    readonly ref: SecretRef;
+}
+/** One-use authorization result. Raw secrets stay private to the returned server closure. */
+export interface FlowSecurityPermit {
+    readonly operation: FlowSecurityOperationIdentity;
+    executeAsync<T>(operation: (secrets: FlowResolvedSecrets) => Promise<T>): Promise<T>;
+}
+/** Public server-side boundary consumed by provider, AI, MCP, and social adapters. */
+export interface FlowSecurityPort {
+    authorizeAsync(operation: FlowSecurityOperation): Promise<FlowSecurityPermit>;
+    createSecretAsync(input: FlowSecretCreateInput): Promise<FlowSecretMetadata>;
+    getSecretMetadataAsync(input: {
+        readonly actor: FlowSecurityActor;
+        readonly ref: SecretRef;
+    }): Promise<FlowSecretMetadata>;
+    revokeSecretAsync(input: FlowSecretRevokeInput): Promise<void>;
+}
+//# sourceMappingURL=security.d.ts.map

package/dist/types/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/types/security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAE7F,+EAA+E;AAC/E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,wEAAwE;AACxE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;CACtC;AAED,4DAA4D;AAC5D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,uFAAuF;AACvF,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;CACtC;AAED,iFAAiF;AACjF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,6BAA6B,CAAC;IAClD,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,UAAU,CAAC;CACtD;AAED,+DAA+D;AAC/D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,SAAS,EAAE,6BAA6B,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;CAC/F;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,UAAU,CAAC,SAAS,EAAE,6BAA6B,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,YAAY,CAAC,SAAS,EAAE,6BAA6B,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzE,YAAY,CAAC,SAAS,EAAE,6BAA6B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvE;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,UAAU,CAAC,KAAK,EAAE;QAChB,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC;QAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACvB;AAED,uFAAuF;AACvF,MAAM,WAAW,iBAAiB;IAChC,YAAY,CAAC,KAAK,EAAE;QAClB,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;QAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtB;AAED,sFAAsF;AACtF,MAAM,WAAW,qBAAqB;IACpC,UAAU,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1D;AAED,yDAAyD;AACzD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EACX,kBAAkB,GAClB,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,sBAAsB,GACtB,gBAAgB,GAChB,mBAAmB,GACnB,cAAc,GACd,oBAAoB,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,CAAC;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,qFAAqF;AACrF,MAAM,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAChD,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhG,mGAAmG;AACnG,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;CACzB;AAED,qGAAqG;AACrG,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;CACzB;AAED,6FAA6F;AAC7F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,6BAA6B,CAAC;IAClD,YAAY,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACtF;AAED,sFAAsF;AACtF,MAAM,WAAW,gBAAgB;IAC/B,cAAc,CAAC,SAAS,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC9E,iBAAiB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC7E,sBAAsB,CAAC,KAAK,EAAE;QAC5B,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;QAClC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;KACzB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAChC,iBAAiB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE"}

package/dist/types/security.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=security.js.map

package/dist/types/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/types/security.ts"],"names":[],"mappings":"","sourcesContent":["import type { SecretMetadata, SecretPayload, SecretRef } from '@ankhorage/contracts/secrets';\n\n/** Trusted execution identity supplied by the host authentication boundary. */\nexport interface FlowSecurityActor {\n  readonly id: string;\n  readonly tenantId: string;\n  readonly projectId: string;\n  readonly environment: string;\n}\n\n/** An exact capability grant; omitted dimensions never imply access. */\nexport interface FlowSecurityGrant {\n  readonly actorId: string;\n  readonly capability: string;\n  readonly tenantId: string;\n  readonly projectId: string;\n  readonly environment: string;\n}\n\n/** A protected external operation presented to the security boundary. */\nexport interface FlowSecurityOperation {\n  readonly actor: FlowSecurityActor;\n  readonly capability: string;\n  readonly idempotencyKey: string;\n  readonly operationId: string;\n  readonly secretRefs?: readonly SecretRef[];\n  readonly target?: FlowSecurityTarget;\n}\n\n/** An outbound destination and its exact host authority. */\nexport interface FlowSecurityTarget {\n  readonly allowedHosts: readonly string[];\n  readonly url: string;\n}\n\n/** The complete immutable identity that grants, claims, and consumes one operation. */\nexport interface FlowSecurityOperationIdentity {\n  readonly actor: FlowSecurityActor;\n  readonly capability: string;\n  readonly idempotencyKey: string;\n  readonly operationId: string;\n  readonly secretRefs: readonly SecretRef[];\n  readonly target?: FlowSecurityTarget;\n}\n\n/** A durable human decision bound to exactly one complete operation identity. */\nexport interface FlowSecurityApproval {\n  readonly operation: FlowSecurityOperationIdentity;\n  readonly status: 'approved' | 'pending' | 'rejected';\n}\n\n/** Host-owned persistence boundary for approval-gate state. */\nexport interface FlowApprovalStorePort {\n  getAsync(operation: FlowSecurityOperationIdentity): Promise<FlowSecurityApproval | undefined>;\n}\n\n/**\n * Host-owned durable exactly-once boundary. Every transition must be atomic across workers and\n * restarts. `releaseAsync` may only release an unconsumed claim for this exact identity.\n */\nexport interface FlowOperationStorePort {\n  claimAsync(operation: FlowSecurityOperationIdentity): Promise<boolean>;\n  consumeAsync(operation: FlowSecurityOperationIdentity): Promise<boolean>;\n  releaseAsync(operation: FlowSecurityOperationIdentity): Promise<void>;\n}\n\n/**\n * Host-owned network boundary that verifies every actual peer before opening a connection.\n * It must enforce the supplied host allowlist, resolve immediately before every connection,\n * reject private or special-use resolved addresses, and reapply that policy to redirects.\n */\nexport interface FlowOutboundTransportPort {\n  fetchAsync(input: {\n    readonly allowedHosts: readonly string[];\n    readonly init?: RequestInit;\n    readonly url: string;\n  }): Promise<Response>;\n}\n\n/** Host-owned rate limiter. A denied acquisition must have no external side effect. */\nexport interface FlowRateLimitPort {\n  acquireAsync(input: {\n    readonly actor: FlowSecurityActor;\n    readonly capability: string;\n    readonly operationId: string;\n  }): Promise<boolean>;\n}\n\n/** Redaction-safe audit edge. Secret values and payloads are intentionally absent. */\nexport interface FlowSecurityAuditPort {\n  writeAsync(event: FlowSecurityAuditEvent): Promise<void>;\n}\n\n/** Immutable audit metadata for one permit or denial. */\nexport interface FlowSecurityAuditEvent {\n  readonly actorId: string;\n  readonly capability: string;\n  readonly decision: 'denied' | 'permitted';\n  readonly operationId: string;\n  readonly reason:\n    | 'approval_pending'\n    | 'approval_rejected'\n    | 'credential_create'\n    | 'credential_revoke'\n    | 'idempotency_conflict'\n    | 'invalid_target'\n    | 'permission_denied'\n    | 'rate_limited'\n    | 'secret_unavailable';\n  readonly secretRefs: readonly SecretRef[];\n  readonly targetHost?: string;\n}\n\n/** Metadata-only credential view safe for administrative or graph-facing callers. */\nexport type FlowSecretMetadata = SecretMetadata;\nexport type FlowResolvedSecrets = Readonly<Record<SecretRef, Readonly<Record<string, string>>>>;\n\n/** Protected server-side credential creation input. Its scope is always derived from the actor. */\nexport interface FlowSecretCreateInput {\n  readonly actor: FlowSecurityActor;\n  readonly kind: string;\n  readonly payload: SecretPayload;\n  readonly provider?: string;\n  readonly ref: SecretRef;\n}\n\n/** Protected server-side credential revocation input. Its scope is always derived from the actor. */\nexport interface FlowSecretRevokeInput {\n  readonly actor: FlowSecurityActor;\n  readonly ref: SecretRef;\n}\n\n/** One-use authorization result. Raw secrets stay private to the returned server closure. */\nexport interface FlowSecurityPermit {\n  readonly operation: FlowSecurityOperationIdentity;\n  executeAsync<T>(operation: (secrets: FlowResolvedSecrets) => Promise<T>): Promise<T>;\n}\n\n/** Public server-side boundary consumed by provider, AI, MCP, and social adapters. */\nexport interface FlowSecurityPort {\n  authorizeAsync(operation: FlowSecurityOperation): Promise<FlowSecurityPermit>;\n  createSecretAsync(input: FlowSecretCreateInput): Promise<FlowSecretMetadata>;\n  getSecretMetadataAsync(input: {\n    readonly actor: FlowSecurityActor;\n    readonly ref: SecretRef;\n  }): Promise<FlowSecretMetadata>;\n  revokeSecretAsync(input: FlowSecretRevokeInput): Promise<void>;\n}\n"]}

package/package.json

@@ -1,6 +1,92 @@
 {
   "name": "@ankhorage/flow",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.5.0",
+  "description": "Standalone workflow engine foundation for Ankhorage.",
+  "keywords": [
+    "ankhorage",
+    "flow",
+    "workflow",
+    "automation"
+  ],
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./ai": {
+      "types": "./dist/ai.d.ts",
+      "default": "./dist/ai.js"
+    },
+    "./execution": {
+      "types": "./dist/execution.d.ts",
+      "default": "./dist/execution.js"
+    },
+    "./mcp": {
+      "types": "./dist/mcp.d.ts",
+      "default": "./dist/mcp.js"
+    },
+    "./social": {
+      "types": "./dist/social.d.ts",
+      "default": "./dist/social.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src",
+    "package.json",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ankhorage/flow.git"
+  },
+  "bugs": {
+    "url": "https://github.com/ankhorage/flow/issues"
+  },
+  "homepage": "https://github.com/ankhorage/flow#readme",
+  "license": "MIT",
+  "scripts": {
+    "build": "rm -rf dist tsconfig.tsbuildinfo && bun x tsc -p tsconfig.json",
+    "changeset": "ankhorage-changeset",
+    "changeset:status": "ankhorage-changeset status --since=origin/main",
+    "docs": "paradox",
+    "lint": "ankhorage-eslint . --max-warnings=0",
+    "lint:fix": "ankhorage-eslint . --fix --max-warnings=0",
+    "format": "ankhorage-prettier --write .",
+    "format:check": "ankhorage-prettier --check .",
+    "knip:check": "ankhorage-knip",
+    "test": "bun test src test",
+    "typecheck": "tsc --noEmit -p tsconfig.json && tsc --noEmit -p tsconfig.node-esm.json && tsc --noEmit -p tsconfig.test.json",
+    "version-packages": "ankhorage-changeset version"
+  },
+  "devDependencies": {
+    "@ankhorage/devtools": "^2.4.3",
+    "@ankhorage/paradox": "^0.3.6",
+    "@ankhorage/secrets-supabase-vault": "^1.0.0",
+    "@modelcontextprotocol/sdk": "^1.32.2",
+    "@types/bun": "^1.4.2",
+    "@types/node": "^26.6.6",
+    "typescript": "^6.0.3"
+  },
+  "packageManager": "bun@1.4.2",
+  "dependencies": {
+    "@ankhorage/contracts": "^26.7.0"
+  },
+  "peerDependencies": {
+    "@modelcontextprotocol/sdk": "^1.32.2"
+  },
+  "peerDependenciesMeta": {
+    "@modelcontextprotocol/sdk": {
+      "optional": true
+    }
+  }
+}

package/src/ai.ts

@@ -0,0 +1,6 @@
+/***
+ * Reserved public subpath for future AI-provider adapters.
+ *
+ * This bootstrap intentionally provides no AI execution, configuration, or dependencies.
+ */
+export {};