@bastani/atomic 0.8.31-alpha.5 → 0.9.0-alpha.2

package/dist/builtin/workflows/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bastani/workflows",
-  "version": "0.8.31-alpha.5",
+  "version": "0.9.0-alpha.2",
   "private": true,
   "description": "Atomic extension for multi-stage workflow authoring and execution.",
   "contributors": [
@@ -83,7 +83,7 @@
   },
   "peerDependencies": {
     "@bastani/atomic": "*",
-    "@earendil-works/pi-tui": "^0.79.7"
+    "@earendil-works/pi-tui": "^0.79.9"
   },
   "peerDependenciesMeta": {
     "@bastani/atomic": {

package/dist/builtin/workflows/skills/impeccable/scripts/detector/detect-antipatterns-browser.js

@@ -1144,8 +1144,8 @@ function checkHtmlPatterns(html) {
   // runs in the bundled browser path too, not just the CLI/static path.
   {
     const bodyText = html
-      .replace(/<script\b[^>]*>[\s\S]*?<\/script>/gi, ' ')
-      .replace(/<style\b[^>]*>[\s\S]*?<\/style>/gi, ' ')
+      .replace(/<script\b[^>]*>[\s\S]*?<\/script[^>]*>/gi, ' ')
+      .replace(/<style\b[^>]*>[\s\S]*?<\/style[^>]*>/gi, ' ')
       .replace(/<[^>]+>/g, ' ');
     const tm = /\b(\w+)\s+theater\b/i.exec(bodyText);
     if (tm) findings.push({ id: 'theater-slop-phrase', snippet: `"${tm[0].trim()}"` });

package/dist/builtin/workflows/skills/impeccable/scripts/detector/engines/regex/detect-text.mjs

@@ -16,8 +16,8 @@ const isSafeElement = (line) => /<(?:blockquote|nav[\s>]|pre[\s>]|code[\s>]|a\s|
  *  content-text analyzers don't false-positive on code or CSS. */
 function stripHtmlToText(html) {
   return html
-    .replace(/<script\b[^>]*>[\s\S]*?<\/script>/gi, ' ')
-    .replace(/<style\b[^>]*>[\s\S]*?<\/style>/gi, ' ')
+    .replace(/<script\b[^>]*>[\s\S]*?<\/script[^>]*>/gi, ' ')
+    .replace(/<style\b[^>]*>[\s\S]*?<\/style[^>]*>/gi, ' ')
     .replace(/<!--[\s\S]*?-->/g, ' ')
     .replace(/<[^>]+>/g, ' ')
     .replace(/\s+/g, ' ');

package/dist/builtin/workflows/skills/impeccable/scripts/detector/rules/checks.mjs

@@ -574,8 +574,8 @@ function checkHtmlPatterns(html) {
   // runs in the bundled browser path too, not just the CLI/static path.
   {
     const bodyText = html
-      .replace(/<script\b[^>]*>[\s\S]*?<\/script>/gi, ' ')
-      .replace(/<style\b[^>]*>[\s\S]*?<\/style>/gi, ' ')
+      .replace(/<script\b[^>]*>[\s\S]*?<\/script[^>]*>/gi, ' ')
+      .replace(/<style\b[^>]*>[\s\S]*?<\/style[^>]*>/gi, ' ')
       .replace(/<[^>]+>/g, ' ');
     const tm = /\b(\w+)\s+theater\b/i.exec(bodyText);
     if (tm) findings.push({ id: 'theater-slop-phrase', snippet: `"${tm[0].trim()}"` });

package/dist/builtin/workflows/skills/impeccable/scripts/detector/shared/page.mjs

@@ -1,6 +1,13 @@
 /** Check if content looks like a full page (not a component/partial) */
 function isFullPage(content) {
-  const stripped = content.replace(/<!--[\s\S]*?-->/g, '');
+  // Strip comments until stable so a nested/overlapping <!-- ... --> cannot
+  // survive a single pass (incomplete multi-character sanitization).
+  let stripped = content;
+  let prevStripped;
+  do {
+    prevStripped = stripped;
+    stripped = stripped.replace(/<!--[\s\S]*?-->/g, '');
+  } while (stripped !== prevStripped);
   return /<!doctype\s|<html[\s>]|<head[\s>]/i.test(stripped);
 }
 

package/dist/builtin/workflows/skills/impeccable/scripts/live-accept.mjs

@@ -405,19 +405,16 @@ function stripStyleAndJoin(lines, block) {
     let line = lines[i];
 
     if (!inStyle) {
-      // Strip any complete <style> elements on this line (self-closed or
-      // same-line-closed), including their body content.
-      line = line
-        .replace(/<style\b[^>]*>[\s\S]*?<\/style\s*>/g, '')
-        .replace(/<style\b[^>]*\/\s*>/g, '');
-
-      // If a <style> opener remains (multi-line body starts here), strip from
-      // the opener to end-of-line and flip into skip mode.
-      const openerIdx = line.search(/<style\b/);
-      if (openerIdx !== -1) {
-        line = line.slice(0, openerIdx);
-        inStyle = true;
-      }
+      // An unclosed <style> opener (more non-self-closed openers than same-line
+      // closers) starts a multi-line body that continues on following lines.
+      const openers = (line.match(/<style\b/gi) || []).length;
+      const selfClosed = (line.match(/<style\b[^>]*\/\s*>/gi) || []).length;
+      const closers = (line.match(/<\/style\b/gi) || []).length;
+      if (openers - selfClosed > closers) inStyle = true;
+      // Remove every <style> element on this line in a single pass — self-closed
+      // <style/>, same-line <style>…</style>, or an unclosed opener through end
+      // of line — so the result provably cannot retain a <style fragment.
+      line = line.replace(/<style\b(?:[^>]*\/>|[^>]*>[\s\S]*?(?:<\/style[^>]*>|$))/gi, '');
       out.push(line);
     } else {
       // In multi-line style body; drop everything until we see </style>.
@@ -435,7 +432,8 @@ function stripStyleAndJoin(lines, block) {
 /**
  * Find the inner content of `<TAG ...attrMatch...>…</TAG>` inside `text`,
  * handling nested same-tag elements via depth counting. `attrMatch` is a
- * regex source fragment that must appear inside the opener tag.
+ * regex source fragment that must appear inside the opener tag; callers must
+ * pre-escape any dynamic (non-constant) portion with `escapeRegExp`.
  * Returns the inner string (may be empty), or null if not found.
  */
 function extractInnerByAttr(text, attrMatch) {
@@ -483,7 +481,7 @@ function extractOriginal(lines, block) {
  */
 function extractVariant(lines, block, variantNum) {
   const text = stripStyleAndJoin(lines, block);
-  const inner = extractInnerByAttr(text, 'data-impeccable-variant="' + variantNum + '"');
+  const inner = extractInnerByAttr(text, 'data-impeccable-variant="' + escapeRegExp(variantNum) + '"');
   if (inner === null) return null;
   const result = inner.split('\n');
   // Collapse a lone empty leading/trailing line (common after string splice).

package/dist/builtin/workflows/skills/impeccable/scripts/live-manual-edit-evidence.mjs

@@ -353,9 +353,9 @@ function decodeBasicHtml(value) {
     .replace(/"/g, '"')
     .replace(/'/g, "'")
     .replace(/'/g, "'")
-    .replace(/&/g, '&')
     .replace(/&lt;/g, '<')
-    .replace(/&gt;/g, '>');
+    .replace(/&gt;/g, '>')
+    .replace(/&amp;/g, '&');
 }
 
 function escapeRegExp(value) {

package/dist/builtin/workflows/skills/impeccable/scripts/live-server.mjs

@@ -1872,7 +1872,16 @@ function handlePollGet(req, res, url) {
     return;
   }
   state.lastPollAt = Date.now();
+  // Bound the client-supplied long-poll timeout so a user-provided value cannot
+  // schedule an unbounded timer (resource exhaustion).
   const timeout = parseInt(url.searchParams.get('timeout') || DEFAULT_POLL_TIMEOUT, 10);
+  if (!Number.isFinite(timeout) || timeout < 0 || timeout > 300000) {
+    // Reject out-of-range long-poll lifetimes so a user-provided value cannot
+    // schedule an unbounded timer (resource exhaustion).
+    res.writeHead(400, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Invalid timeout' }));
+    return;
+  }
   const leaseMs = parseInt(url.searchParams.get('leaseMs') || '30000', 10);
   const available = findAvailablePendingEvent();
   if (available) {

package/dist/builtin/workflows/src/authoring/typebox-defaults.d.ts

@@ -0,0 +1,41 @@
+import type * as TypeBox from "typebox";
+import type { TAny, TArray, TArrayOptions, TBoolean, TEnum, TEnumValue, TInteger, TIntersect, TIntersectOptions, TLiteral, TLiteralValue, TNull, TNumber, TNumberOptions, TObject, TObjectOptions, TOmit, TPartial, TPick, TProperties, TRequired, TSchema, TSchemaOptions, TString, TStringOptions, TTuple, TTupleOptions, TTypeScriptEnumLike, TTypeScriptEnumToEnumValues, TUnion, TUnknown } from "typebox";
+import type { WorkflowSerializableValue } from "../shared/authoring-contract.js";
+type TypeBoxDefaultOptions<TOptions> = TOptions & {
+    readonly default: WorkflowSerializableValue;
+};
+type TypeBoxDefaulted<TOptions extends {
+    readonly default: WorkflowSerializableValue;
+}> = {
+    readonly default: TOptions["default"];
+};
+type TypeBoxKeysToLiterals<TKeys extends readonly PropertyKey[], TResult extends TLiteral[] = []> = TKeys extends readonly [infer TLeft extends PropertyKey, ...infer TRight extends PropertyKey[]] ? TLeft extends TLiteralValue ? TypeBoxKeysToLiterals<TRight, [...TResult, TLiteral<TLeft>]> : TypeBoxKeysToLiterals<TRight, TResult> : TResult;
+type TypeBoxKeysToIndexer<TKeys extends readonly PropertyKey[]> = TUnion<TypeBoxKeysToLiterals<TKeys>>;
+type TypeBoxRecord<TKey extends TSchema, TValue extends TSchema> = ReturnType<typeof TypeBox.Type.Record<TKey, TValue>>;
+declare module "typebox" {
+    namespace Type {
+        function Any<const TOptions extends TypeBoxDefaultOptions<TSchemaOptions>>(options: TOptions): TAny & TypeBoxDefaulted<TOptions>;
+        function Unknown<const TOptions extends TypeBoxDefaultOptions<TSchemaOptions>>(options: TOptions): TUnknown & TypeBoxDefaulted<TOptions>;
+        function String<const TOptions extends TypeBoxDefaultOptions<TStringOptions>>(options: TOptions): TString & TypeBoxDefaulted<TOptions>;
+        function Number<const TOptions extends TypeBoxDefaultOptions<TNumberOptions>>(options: TOptions): TNumber & TypeBoxDefaulted<TOptions>;
+        function Integer<const TOptions extends TypeBoxDefaultOptions<TNumberOptions>>(options: TOptions): TInteger & TypeBoxDefaulted<TOptions>;
+        function Boolean<const TOptions extends TypeBoxDefaultOptions<TSchemaOptions>>(options: TOptions): TBoolean & TypeBoxDefaulted<TOptions>;
+        function Literal<const TValue extends TLiteralValue, const TOptions extends TypeBoxDefaultOptions<TSchemaOptions>>(value: TValue, options: TOptions): TLiteral<TValue> & TypeBoxDefaulted<TOptions>;
+        function Enum<const TValues extends TEnumValue[], const TOptions extends TypeBoxDefaultOptions<TSchemaOptions>>(values: readonly [...TValues], options: TOptions): TEnum<TValues> & TypeBoxDefaulted<TOptions>;
+        function Enum<const TEnumLike extends TTypeScriptEnumLike, const TOptions extends TypeBoxDefaultOptions<TSchemaOptions>>(value: TEnumLike, options: TOptions): TEnum<TTypeScriptEnumToEnumValues<TEnumLike>> & TypeBoxDefaulted<TOptions>;
+        function Array<const TItem extends TSchema, const TOptions extends TypeBoxDefaultOptions<TArrayOptions>>(items: TItem, options: TOptions): TArray<TItem> & TypeBoxDefaulted<TOptions>;
+        function Object<const TSchemaProperties extends TProperties, const TOptions extends TypeBoxDefaultOptions<TObjectOptions>>(properties: TSchemaProperties, options: TOptions): TObject<TSchemaProperties> & TypeBoxDefaulted<TOptions>;
+        function Partial<const TType extends TSchema, const TOptions extends TypeBoxDefaultOptions<TSchemaOptions>>(type: TType, options: TOptions): TPartial<TType> & TypeBoxDefaulted<TOptions>;
+        function Pick<const TType extends TSchema, const TIndexer extends PropertyKey[], const TOptions extends TypeBoxDefaultOptions<TSchemaOptions>>(type: TType, indexer: readonly [...TIndexer], options: TOptions): TPick<TType, TypeBoxKeysToIndexer<TIndexer>> & TypeBoxDefaulted<TOptions>;
+        function Pick<const TType extends TSchema, const TIndexer extends TSchema, const TOptions extends TypeBoxDefaultOptions<TSchemaOptions>>(type: TType, indexer: TIndexer, options: TOptions): TPick<TType, TIndexer> & TypeBoxDefaulted<TOptions>;
+        function Omit<const TType extends TSchema, const TIndexer extends PropertyKey[], const TOptions extends TypeBoxDefaultOptions<TSchemaOptions>>(type: TType, indexer: readonly [...TIndexer], options: TOptions): TOmit<TType, TypeBoxKeysToIndexer<TIndexer>> & TypeBoxDefaulted<TOptions>;
+        function Omit<const TType extends TSchema, const TIndexer extends TSchema, const TOptions extends TypeBoxDefaultOptions<TSchemaOptions>>(type: TType, indexer: TIndexer, options: TOptions): TOmit<TType, TIndexer> & TypeBoxDefaulted<TOptions>;
+        function Required<const TType extends TSchema, const TOptions extends TypeBoxDefaultOptions<TSchemaOptions>>(type: TType, options: TOptions): TRequired<TType> & TypeBoxDefaulted<TOptions>;
+        function Union<const TTypes extends TSchema[], const TOptions extends TypeBoxDefaultOptions<TSchemaOptions>>(anyOf: [...TTypes], options: TOptions): TUnion<TTypes> & TypeBoxDefaulted<TOptions>;
+        function Intersect<const TTypes extends TSchema[], const TOptions extends TypeBoxDefaultOptions<TIntersectOptions>>(types: [...TTypes], options: TOptions): TIntersect<TTypes> & TypeBoxDefaulted<TOptions>;
+        function Record<const TKey extends TSchema, const TValue extends TSchema, const TOptions extends TypeBoxDefaultOptions<TObjectOptions>>(key: TKey, value: TValue, options: TOptions): TypeBoxRecord<TKey, TValue> & TypeBoxDefaulted<TOptions>;
+        function Tuple<const TTypes extends TSchema[], const TOptions extends TypeBoxDefaultOptions<TTupleOptions>>(types: [...TTypes], options: TOptions): TTuple<TTypes> & TypeBoxDefaulted<TOptions>;
+        function Null<const TOptions extends TypeBoxDefaultOptions<TSchemaOptions>>(options: TOptions): TNull & TypeBoxDefaulted<TOptions>;
+    }
+}
+export {};

package/dist/builtin/workflows/src/authoring/typebox-defaults.ts

@@ -0,0 +1,217 @@
+import type * as TypeBox from "typebox";
+import type {
+  TAny,
+  TArray,
+  TArrayOptions,
+  TBoolean,
+  TEnum,
+  TEnumValue,
+  TInteger,
+  TIntersect,
+  TIntersectOptions,
+  TLiteral,
+  TLiteralValue,
+  TNull,
+  TNumber,
+  TNumberOptions,
+  TObject,
+  TObjectOptions,
+  TOmit,
+  TPartial,
+  TPick,
+  TProperties,
+  TRequired,
+  TSchema,
+  TSchemaOptions,
+  TString,
+  TStringOptions,
+  TTuple,
+  TTupleOptions,
+  TTypeScriptEnumLike,
+  TTypeScriptEnumToEnumValues,
+  TUnion,
+  TUnknown,
+} from "typebox";
+import type { WorkflowSerializableValue } from "../shared/authoring-contract.js";
+
+type TypeBoxDefaultOptions<TOptions> = TOptions & {
+  readonly default: WorkflowSerializableValue;
+};
+
+type TypeBoxDefaulted<TOptions extends { readonly default: WorkflowSerializableValue }> = {
+  readonly default: TOptions["default"];
+};
+
+type TypeBoxKeysToLiterals<
+  TKeys extends readonly PropertyKey[],
+  TResult extends TLiteral[] = [],
+> = TKeys extends readonly [infer TLeft extends PropertyKey, ...infer TRight extends PropertyKey[]]
+  ? TLeft extends TLiteralValue
+    ? TypeBoxKeysToLiterals<TRight, [...TResult, TLiteral<TLeft>]>
+    : TypeBoxKeysToLiterals<TRight, TResult>
+  : TResult;
+
+type TypeBoxKeysToIndexer<TKeys extends readonly PropertyKey[]> = TUnion<TypeBoxKeysToLiterals<TKeys>>;
+
+type TypeBoxRecord<TKey extends TSchema, TValue extends TSchema> = ReturnType<typeof TypeBox.Type.Record<TKey, TValue>>;
+
+declare module "typebox" {
+  export namespace Type {
+    export function Any<const TOptions extends TypeBoxDefaultOptions<TSchemaOptions>>(
+      options: TOptions,
+    ): TAny & TypeBoxDefaulted<TOptions>;
+
+    export function Unknown<const TOptions extends TypeBoxDefaultOptions<TSchemaOptions>>(
+      options: TOptions,
+    ): TUnknown & TypeBoxDefaulted<TOptions>;
+
+    export function String<const TOptions extends TypeBoxDefaultOptions<TStringOptions>>(
+      options: TOptions,
+    ): TString & TypeBoxDefaulted<TOptions>;
+
+    export function Number<const TOptions extends TypeBoxDefaultOptions<TNumberOptions>>(
+      options: TOptions,
+    ): TNumber & TypeBoxDefaulted<TOptions>;
+
+    export function Integer<const TOptions extends TypeBoxDefaultOptions<TNumberOptions>>(
+      options: TOptions,
+    ): TInteger & TypeBoxDefaulted<TOptions>;
+
+    export function Boolean<const TOptions extends TypeBoxDefaultOptions<TSchemaOptions>>(
+      options: TOptions,
+    ): TBoolean & TypeBoxDefaulted<TOptions>;
+
+    export function Literal<
+      const TValue extends TLiteralValue,
+      const TOptions extends TypeBoxDefaultOptions<TSchemaOptions>,
+    >(
+      value: TValue,
+      options: TOptions,
+    ): TLiteral<TValue> & TypeBoxDefaulted<TOptions>;
+
+    export function Enum<
+      const TValues extends TEnumValue[],
+      const TOptions extends TypeBoxDefaultOptions<TSchemaOptions>,
+    >(
+      values: readonly [...TValues],
+      options: TOptions,
+    ): TEnum<TValues> & TypeBoxDefaulted<TOptions>;
+    export function Enum<
+      const TEnumLike extends TTypeScriptEnumLike,
+      const TOptions extends TypeBoxDefaultOptions<TSchemaOptions>,
+    >(
+      value: TEnumLike,
+      options: TOptions,
+    ): TEnum<TTypeScriptEnumToEnumValues<TEnumLike>> & TypeBoxDefaulted<TOptions>;
+
+    export function Array<
+      const TItem extends TSchema,
+      const TOptions extends TypeBoxDefaultOptions<TArrayOptions>,
+    >(
+      items: TItem,
+      options: TOptions,
+    ): TArray<TItem> & TypeBoxDefaulted<TOptions>;
+
+    export function Object<
+      const TSchemaProperties extends TProperties,
+      const TOptions extends TypeBoxDefaultOptions<TObjectOptions>,
+    >(
+      properties: TSchemaProperties,
+      options: TOptions,
+    ): TObject<TSchemaProperties> & TypeBoxDefaulted<TOptions>;
+
+    export function Partial<
+      const TType extends TSchema,
+      const TOptions extends TypeBoxDefaultOptions<TSchemaOptions>,
+    >(
+      type: TType,
+      options: TOptions,
+    ): TPartial<TType> & TypeBoxDefaulted<TOptions>;
+
+    export function Pick<
+      const TType extends TSchema,
+      const TIndexer extends PropertyKey[],
+      const TOptions extends TypeBoxDefaultOptions<TSchemaOptions>,
+    >(
+      type: TType,
+      indexer: readonly [...TIndexer],
+      options: TOptions,
+    ): TPick<TType, TypeBoxKeysToIndexer<TIndexer>> & TypeBoxDefaulted<TOptions>;
+    export function Pick<
+      const TType extends TSchema,
+      const TIndexer extends TSchema,
+      const TOptions extends TypeBoxDefaultOptions<TSchemaOptions>,
+    >(
+      type: TType,
+      indexer: TIndexer,
+      options: TOptions,
+    ): TPick<TType, TIndexer> & TypeBoxDefaulted<TOptions>;
+
+    export function Omit<
+      const TType extends TSchema,
+      const TIndexer extends PropertyKey[],
+      const TOptions extends TypeBoxDefaultOptions<TSchemaOptions>,
+    >(
+      type: TType,
+      indexer: readonly [...TIndexer],
+      options: TOptions,
+    ): TOmit<TType, TypeBoxKeysToIndexer<TIndexer>> & TypeBoxDefaulted<TOptions>;
+    export function Omit<
+      const TType extends TSchema,
+      const TIndexer extends TSchema,
+      const TOptions extends TypeBoxDefaultOptions<TSchemaOptions>,
+    >(
+      type: TType,
+      indexer: TIndexer,
+      options: TOptions,
+    ): TOmit<TType, TIndexer> & TypeBoxDefaulted<TOptions>;
+
+    export function Required<
+      const TType extends TSchema,
+      const TOptions extends TypeBoxDefaultOptions<TSchemaOptions>,
+    >(
+      type: TType,
+      options: TOptions,
+    ): TRequired<TType> & TypeBoxDefaulted<TOptions>;
+
+    export function Union<
+      const TTypes extends TSchema[],
+      const TOptions extends TypeBoxDefaultOptions<TSchemaOptions>,
+    >(
+      anyOf: [...TTypes],
+      options: TOptions,
+    ): TUnion<TTypes> & TypeBoxDefaulted<TOptions>;
+
+    export function Intersect<
+      const TTypes extends TSchema[],
+      const TOptions extends TypeBoxDefaultOptions<TIntersectOptions>,
+    >(
+      types: [...TTypes],
+      options: TOptions,
+    ): TIntersect<TTypes> & TypeBoxDefaulted<TOptions>;
+
+    export function Record<
+      const TKey extends TSchema,
+      const TValue extends TSchema,
+      const TOptions extends TypeBoxDefaultOptions<TObjectOptions>,
+    >(
+      key: TKey,
+      value: TValue,
+      options: TOptions,
+    ): TypeBoxRecord<TKey, TValue> & TypeBoxDefaulted<TOptions>;
+
+    export function Tuple<
+      const TTypes extends TSchema[],
+      const TOptions extends TypeBoxDefaultOptions<TTupleOptions>,
+    >(
+      types: [...TTypes],
+      options: TOptions,
+    ): TTuple<TTypes> & TypeBoxDefaulted<TOptions>;
+
+    export function Null<const TOptions extends TypeBoxDefaultOptions<TSchemaOptions>>(
+      options: TOptions,
+    ): TNull & TypeBoxDefaulted<TOptions>;
+  }
+}
+
+export {};

package/dist/builtin/workflows/src/authoring/workflow.ts

@@ -0,0 +1,184 @@
+import { basename } from "node:path";
+import { fileURLToPath } from "node:url";
+import type {
+  AuthoredWorkflowSpec as SharedAuthoredWorkflowSpec,
+  WorkflowInputsFromSchemas,
+  WorkflowOutputsFromSchemas,
+  WorkflowProvidedInputsFromSchemas,
+} from "../shared/workflow-authoring-types.js";
+import type {
+  WorkflowDefinition,
+  WorkflowInputBindings,
+  WorkflowInputSchemaMap,
+  WorkflowInputValues,
+  WorkflowOutputSchemaMap,
+  WorkflowOutputValues,
+  WorkflowRunContext,
+  WorkflowRunFn,
+  WorkflowWorktreeInputBinding,
+} from "../shared/types.js";
+import { normalizeWorkflowName } from "../workflows/identity.js";
+
+export type {
+  WorkflowInputsFromSchemas,
+  WorkflowOutputsFromSchemas,
+  WorkflowProvidedInputsFromSchemas,
+} from "../shared/workflow-authoring-types.js";
+
+const BRANDED_WORKFLOW_DEFINITIONS = new WeakSet<object>();
+
+export type AuthoredWorkflowSpec<
+  TInputs extends WorkflowInputSchemaMap = {},
+  TOutputs extends WorkflowOutputSchemaMap = WorkflowOutputSchemaMap,
+  TActualOutputs extends WorkflowOutputsFromSchemas<TOutputs> = WorkflowOutputsFromSchemas<TOutputs>,
+> = SharedAuthoredWorkflowSpec<
+  TInputs,
+  TOutputs,
+  TActualOutputs,
+  WorkflowRunContext<WorkflowInputsFromSchemas<TInputs>, WorkflowOutputsFromSchemas<TOutputs>>
+>;
+
+export type AuthoredWorkflowDefinition<
+  TInputs extends WorkflowInputSchemaMap,
+  TOutputs extends WorkflowOutputSchemaMap,
+> = WorkflowDefinition<
+  WorkflowInputsFromSchemas<TInputs>,
+  WorkflowOutputsFromSchemas<TOutputs>,
+  WorkflowProvidedInputsFromSchemas<TInputs>
+> & {
+  readonly outputs: Readonly<TOutputs>;
+};
+
+// Package-internal runtime brand. It deliberately is not exported through the
+// public SDK surface; workflow({...}) and executor-created direct workflows are
+// the only package code paths that can mint accepted runtime definitions.
+export function stampWorkflowDefinition<
+  TInputs extends WorkflowInputValues,
+  TOutputs extends WorkflowOutputValues,
+  TRunInputs extends WorkflowInputValues = TInputs,
+>(
+  definition: object,
+): WorkflowDefinition<TInputs, TOutputs, TRunInputs> {
+  BRANDED_WORKFLOW_DEFINITIONS.add(definition);
+  return definition as never as WorkflowDefinition<TInputs, TOutputs, TRunInputs>;
+}
+
+export function isBrandedWorkflowDefinition(value: object): value is WorkflowDefinition {
+  return BRANDED_WORKFLOW_DEFINITIONS.has(value);
+}
+
+function requireNonEmptyString(value: string, label: string): void {
+  if (value.trim().length === 0) {
+    throw new TypeError(`workflow: ${label} must be a non-empty string`);
+  }
+}
+
+function freezeSchemaMap<TSchemas extends WorkflowInputSchemaMap | WorkflowOutputSchemaMap>(
+  schemas: TSchemas,
+): Readonly<TSchemas> {
+  return Object.freeze({ ...schemas }) as Readonly<TSchemas>;
+}
+
+function stackFilePath(line: string): string | undefined {
+  const fileUrlMatch = line.match(/\(?((?:file:\/\/)[^\s)]+?\.[cm]?[jt]sx?):\d+:\d+\)?/);
+  const rawPath = fileUrlMatch?.[1]
+    ?? line.match(/\(?((?:\/|[A-Za-z]:[\\/])[^():]+?\.[cm]?[jt]sx?):\d+:\d+\)?/)?.[1];
+  if (rawPath === undefined) return undefined;
+  if (!rawPath.startsWith("file://")) return rawPath;
+  try {
+    return fileURLToPath(rawPath);
+  } catch {
+    return undefined;
+  }
+}
+
+function isWorkflowAuthoringImplementationFrame(filePath: string): boolean {
+  const normalized = filePath.replace(/\\/g, "/");
+  if (!/\/authoring\/workflow\.[cm]?[jt]sx?$/.test(normalized)) return false;
+  return normalized.includes("/packages/workflows/")
+    || normalized.includes("/node_modules/@bastani/workflows/")
+    || normalized.includes("/dist/builtin/workflows/")
+    || normalized.includes("/.atomic/agent/extensions/workflows/")
+    || normalized.includes("/.pi/agent/extensions/workflows/");
+}
+
+function workflowNameFromCaller(): string | undefined {
+  const stack = new Error().stack;
+  if (stack === undefined) return undefined;
+
+  for (const line of stack.split("\n")) {
+    const filePath = stackFilePath(line);
+    if (filePath === undefined) continue;
+    if (isWorkflowAuthoringImplementationFrame(filePath)) continue;
+    const base = basename(filePath.replace(/\\/g, "/")).replace(/\.[cm]?[jt]sx?$/, "");
+    if (base.length > 0) return base;
+  }
+
+  return undefined;
+}
+
+function resolveWorkflowName(name: string | undefined): string {
+  const resolved = name ?? workflowNameFromCaller();
+  if (resolved === undefined) {
+    throw new TypeError("workflow: name must be provided when caller filename cannot be inferred");
+  }
+  requireNonEmptyString(resolved, "name");
+  return resolved;
+}
+
+function freezeInputBindings(
+  binding: WorkflowWorktreeInputBinding | undefined,
+): WorkflowInputBindings | undefined {
+  if (binding === undefined) return undefined;
+  return Object.freeze({
+    worktree: Object.freeze({ ...binding }),
+  });
+}
+
+export function workflow<
+  const TInputs extends WorkflowInputSchemaMap = {},
+  const TOutputs extends WorkflowOutputSchemaMap = WorkflowOutputSchemaMap,
+  TActualOutputs extends WorkflowOutputsFromSchemas<TOutputs> = WorkflowOutputsFromSchemas<TOutputs>,
+>(
+  spec: AuthoredWorkflowSpec<TInputs, TOutputs, TActualOutputs>,
+): AuthoredWorkflowDefinition<TInputs, TOutputs> {
+  const specRun = spec.run;
+  if (typeof spec.description !== "string") {
+    throw new TypeError("workflow: description must be a string");
+  }
+  if (typeof specRun !== "function") {
+    throw new TypeError("workflow: run must be a function");
+  }
+  if (spec.outputs === undefined || spec.outputs === null || typeof spec.outputs !== "object" || Array.isArray(spec.outputs)) {
+    throw new TypeError("workflow: outputs must be a schema map");
+  }
+  if (spec.inputs !== undefined && (spec.inputs === null || typeof spec.inputs !== "object" || Array.isArray(spec.inputs))) {
+    throw new TypeError("workflow: inputs must be a schema map");
+  }
+
+  const name = resolveWorkflowName(spec.name);
+  const normalizedName = normalizeWorkflowName(name);
+  requireNonEmptyString(normalizedName, "normalized name");
+  const frozenInputs = freezeSchemaMap(spec.inputs ?? {} as TInputs);
+  const frozenOutputs = freezeSchemaMap(spec.outputs);
+  const inputBindings = freezeInputBindings(spec.worktreeFromInputs);
+  const run: WorkflowRunFn<WorkflowInputsFromSchemas<TInputs>, WorkflowOutputsFromSchemas<TOutputs>> = async (ctx) => specRun(ctx);
+
+  const definition = {
+    __piWorkflow: true,
+    name,
+    normalizedName,
+    description: spec.description,
+    inputs: frozenInputs,
+    outputs: frozenOutputs,
+    ...(inputBindings !== undefined ? { inputBindings } : {}),
+    run,
+  };
+
+  const branded = stampWorkflowDefinition<
+    WorkflowInputsFromSchemas<TInputs>,
+    WorkflowOutputsFromSchemas<TOutputs>,
+    WorkflowProvidedInputsFromSchemas<TInputs>
+  >(definition);
+  return Object.freeze(branded) as AuthoredWorkflowDefinition<TInputs, TOutputs>;
+}