@cleocode/core 2026.3.74 → 2026.4.0

package/README.md

@@ -565,7 +565,7 @@ async function buildKnowledge() {
 
 - `@cleocode/contracts` - Type definitions
 - `@cleocode/caamp` - Context-aware agent memory protocol
-- `@cleocode/lafs-protocol` - Language-agnostic feedback schema
+- `@cleocode/lafs` - Language-agnostic feedback schema
 - `drizzle-orm` - Database ORM
 - `zod` - Schema validation
 - `pino` - Logging

package/dist/agents/agent-schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-schema.d.ts","sourceRoot":"","sources":["../../src/agents/agent-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH,iEAAiE;AACjE,eAAO,MAAM,uBAAuB,wEAO1B,CAAC;AAEX,4CAA4C;AAC5C,eAAO,MAAM,WAAW,uGAQd,CAAC;AAMX,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8B1B,CAAC;AAMF,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkBzB,CAAC;AAMF,MAAM,MAAM,gBAAgB,GAAG,OAAO,cAAc,CAAC,YAAY,CAAC;AAClE,MAAM,MAAM,mBAAmB,GAAG,OAAO,cAAc,CAAC,YAAY,CAAC;AACrE,MAAM,MAAM,gBAAgB,GAAG,OAAO,aAAa,CAAC,YAAY,CAAC;AACjE,MAAM,MAAM,mBAAmB,GAAG,OAAO,aAAa,CAAC,YAAY,CAAC;AACpE,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAC3E,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AACrD,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,WAAW,GAAG,SAAS,CAAC"}
+{"version":3,"file":"agent-schema.d.ts","sourceRoot":"","sources":["../../src/agents/agent-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH,iEAAiE;AACjE,eAAO,MAAM,uBAAuB,wEAO1B,CAAC;AAEX,4CAA4C;AAC5C,eAAO,MAAM,WAAW,uGAQd,CAAC;AAMX,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2B1B,CAAC;AAMF,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkBzB,CAAC;AAMF,MAAM,MAAM,gBAAgB,GAAG,OAAO,cAAc,CAAC,YAAY,CAAC;AAClE,MAAM,MAAM,mBAAmB,GAAG,OAAO,cAAc,CAAC,YAAY,CAAC;AACrE,MAAM,MAAM,gBAAgB,GAAG,OAAO,aAAa,CAAC,YAAY,CAAC;AACjE,MAAM,MAAM,mBAAmB,GAAG,OAAO,aAAa,CAAC,YAAY,CAAC;AACpE,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAC3E,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AACrD,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,WAAW,GAAG,SAAS,CAAC"}

package/dist/agents/retry.js

@@ -110,30 +110,35 @@ export function shouldRetry(error, attempt, policy) {
  */
 export async function withRetry(fn, policy) {
     const effectivePolicy = createRetryPolicy(policy);
-    const { withRetry: coreRetry } = await import('../lib/retry.js');
     let attemptCount = 0;
-    try {
-        const value = await coreRetry(async () => {
+    let totalDelayMs = 0;
+    const maxAttempts = effectivePolicy.maxRetries + 1;
+    let lastError;
+    for (let attempt = 0; attempt < maxAttempts; attempt++) {
+        try {
             attemptCount++;
-            return fn();
-        }, {
-            maxAttempts: effectivePolicy.maxRetries + 1,
-            baseDelayMs: effectivePolicy.baseDelayMs,
-            maxDelayMs: effectivePolicy.maxDelayMs,
-            retryableErrors: [(err) => shouldRetry(err, attemptCount - 1, effectivePolicy)],
-        });
-        return { success: true, value, attempts: attemptCount, totalDelayMs: 0 };
-    }
-    catch (err) {
-        const error = err instanceof Error ? err : new Error(String(err));
-        const context = err;
-        return {
-            success: false,
-            error,
-            attempts: attemptCount,
-            totalDelayMs: context.totalDelayMs ?? 0,
-        };
+            const value = await fn();
+            return { success: true, value, attempts: attemptCount, totalDelayMs };
+        }
+        catch (err) {
+            lastError = err;
+            const isLastAttempt = attempt === maxAttempts - 1;
+            if (isLastAttempt)
+                break;
+            if (!shouldRetry(err, attempt, effectivePolicy))
+                break;
+            const delay = calculateDelay(attempt, effectivePolicy);
+            totalDelayMs += delay;
+            await new Promise((resolve) => setTimeout(resolve, delay));
+        }
     }
+    const error = lastError instanceof Error ? lastError : new Error(String(lastError));
+    return {
+        success: false,
+        error,
+        attempts: attemptCount,
+        totalDelayMs,
+    };
 }
 /**
  * Attempt to recover crashed agents.

package/dist/agents/retry.js.map

@@ -1 +1 @@
-{"version":3,"file":"retry.js","sourceRoot":"","sources":["../../src/agents/retry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AAsBvB,6DAA6D;AAC7D,MAAM,CAAC,MAAM,oBAAoB,GAA0B,MAAM,CAAC,MAAM,CAAC;IACvE,UAAU,EAAE,CAAC;IACb,WAAW,EAAE,KAAK;IAClB,UAAU,EAAE,MAAM;IAClB,iBAAiB,EAAE,CAAC;IACpB,MAAM,EAAE,IAAI;IACZ,cAAc,EAAE,IAAI;CACrB,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAgC;IAChE,OAAO,EAAE,GAAG,oBAAoB,EAAE,GAAG,SAAS,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,MAAmB;IACjE,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,iBAAiB,IAAI,OAAO,CAAC;IAClF,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAEnE,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,YAAY,CAAC;IAExC,mBAAmB;IACnB,MAAM,WAAW,GAAG,YAAY,GAAG,IAAI,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,WAAW,CAAC;IAChD,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,WAAW,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,OAAe,EAAE,MAAmB;IAC9E,IAAI,OAAO,IAAI,MAAM,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE/C,MAAM,cAAc,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAE5C,IAAI,cAAc,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,cAAc,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAEhD,yDAAyD;IACzD,OAAO,MAAM,CAAC,cAAc,CAAC;AAC/B,CAAC;AAeD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,EAAoB,EACpB,MAA6B;IAE7B,MAAM,eAAe,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACjE,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,SAAS,CAC3B,KAAK,IAAI,EAAE;YACT,YAAY,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,CAAC;QACd,CAAC,EACD;YACE,WAAW,EAAE,eAAe,CAAC,UAAU,GAAG,CAAC;YAC3C,WAAW,EAAE,eAAe,CAAC,WAAW;YACxC,UAAU,EAAE,eAAe,CAAC,UAAU;YACtC,eAAe,EAAE,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,YAAY,GAAG,CAAC,EAAE,eAAe,CAAC,CAAC;SACzF,CACF,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;IAC3E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,GAAwC,CAAC;QACzD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK;YACL,QAAQ,EAAE,YAAY;YACtB,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC;SACxC,CAAC;IACJ,CAAC;AACH,CAAC;AAcD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,cAAsB,MAAM,EAC5B,GAAY;IAEZ,MAAM,OAAO,GAA0B,EAAE,CAAC;IAE1C,oDAAoD;IACpD,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,iBAAiB,CACrB,KAAK,CAAC,EAAE,EACR,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,kDAAkD,EAAE,EAChF,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,qCAAqC;IACrC,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;IAE3E,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,mDAAmD;QACnD,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEvE,6BAA6B;QAC7B,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,iBAAiB,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC;gBACX,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,WAAW;gBACnB,MAAM,EAAE,gBAAgB,KAAK,CAAC,UAAU,yBAAyB;aAClE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,sCAAsC;QACtC,IAAI,SAAS,EAAE,SAAS,KAAK,WAAW,EAAE,CAAC;YACzC,MAAM,iBAAiB,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC;gBACX,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,WAAW;gBACnB,MAAM,EAAE,oBAAoB,SAAS,CAAC,OAAO,EAAE;aAChD,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,qEAAqE;QACrE,MAAM,iBAAiB,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC;YACX,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,2CAA2C;SACpD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E"}
+{"version":3,"file":"retry.js","sourceRoot":"","sources":["../../src/agents/retry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AAsBvB,6DAA6D;AAC7D,MAAM,CAAC,MAAM,oBAAoB,GAA0B,MAAM,CAAC,MAAM,CAAC;IACvE,UAAU,EAAE,CAAC;IACb,WAAW,EAAE,KAAK;IAClB,UAAU,EAAE,MAAM;IAClB,iBAAiB,EAAE,CAAC;IACpB,MAAM,EAAE,IAAI;IACZ,cAAc,EAAE,IAAI;CACrB,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAgC;IAChE,OAAO,EAAE,GAAG,oBAAoB,EAAE,GAAG,SAAS,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,MAAmB;IACjE,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,iBAAiB,IAAI,OAAO,CAAC;IAClF,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAEnE,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,YAAY,CAAC;IAExC,mBAAmB;IACnB,MAAM,WAAW,GAAG,YAAY,GAAG,IAAI,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,WAAW,CAAC;IAChD,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,WAAW,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,OAAe,EAAE,MAAmB;IAC9E,IAAI,OAAO,IAAI,MAAM,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAE/C,MAAM,cAAc,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAE5C,IAAI,cAAc,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,cAAc,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAEhD,yDAAyD;IACzD,OAAO,MAAM,CAAC,cAAc,CAAC;AAC/B,CAAC;AAeD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,EAAoB,EACpB,MAA6B;IAE7B,MAAM,eAAe,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,MAAM,WAAW,GAAG,eAAe,CAAC,UAAU,GAAG,CAAC,CAAC;IAEnD,IAAI,SAAkB,CAAC;IAEvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,YAAY,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,MAAM,EAAE,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,GAAG,CAAC;YAChB,MAAM,aAAa,GAAG,OAAO,KAAK,WAAW,GAAG,CAAC,CAAC;YAClD,IAAI,aAAa;gBAAE,MAAM;YAEzB,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,eAAe,CAAC;gBAAE,MAAM;YAEvD,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YACvD,YAAY,IAAI,KAAK,CAAC;YACtB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IACpF,OAAO;QACL,OAAO,EAAE,KAAK;QACd,KAAK;QACL,QAAQ,EAAE,YAAY;QACtB,YAAY;KACb,CAAC;AACJ,CAAC;AAcD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,cAAsB,MAAM,EAC5B,GAAY;IAEZ,MAAM,OAAO,GAA0B,EAAE,CAAC;IAE1C,oDAAoD;IACpD,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,MAAM,iBAAiB,CACrB,KAAK,CAAC,EAAE,EACR,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,kDAAkD,EAAE,EAChF,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,qCAAqC;IACrC,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;IAE3E,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,mDAAmD;QACnD,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEvE,6BAA6B;QAC7B,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,iBAAiB,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC;gBACX,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,WAAW;gBACnB,MAAM,EAAE,gBAAgB,KAAK,CAAC,UAAU,yBAAyB;aAClE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,sCAAsC;QACtC,IAAI,SAAS,EAAE,SAAS,KAAK,WAAW,EAAE,CAAC;YACzC,MAAM,iBAAiB,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC;gBACX,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,WAAW;gBACnB,MAAM,EAAE,oBAAoB,SAAS,CAAC,OAAO,EAAE;aAChD,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,qEAAqE;QACrE,MAAM,iBAAiB,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC;YACX,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,2CAA2C;SACpD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E"}

package/dist/cant/approval.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Approval gate manager for CANT workflow execution.
+ *
+ * Manages the lifecycle of approval tokens: generation, validation,
+ * approval, rejection, and expiration. Tokens follow the state machine
+ * defined in CANT-DSL-SPEC.md Section 8.2.
+ *
+ * State transitions are atomic (CAS): only `pending -> approved`,
+ * `pending -> rejected`, and `pending -> expired` are permitted.
+ *
+ * @see docs/specs/CANT-DSL-SPEC.md Section 8 (Approval Token Protocol)
+ */
+import type { ApprovalToken, TokenValidation } from './types.js';
+/**
+ * Manages approval tokens for CANT workflow gates.
+ *
+ * Tokens are stored in-memory per instance. In production, these are
+ * persisted via the session's `approvalTokensJson` column in tasks.db.
+ */
+export declare class ApprovalManager {
+    /** In-memory token store keyed by token UUID. */
+    private tokens;
+    /**
+     * Generates a new approval token for a workflow gate.
+     *
+     * @param sessionId - The session that owns this token.
+     * @param workflowName - The workflow containing the approval gate.
+     * @param gateName - The label of the specific approval gate.
+     * @param message - The message to display to the approver.
+     * @param workflowHash - SHA-256 hash of the workflow definition.
+     * @param requestedBy - The agent/workflow requesting approval.
+     * @param expiresInMs - Token lifetime in milliseconds (default: 24h).
+     * @returns The generated approval token.
+     */
+    generateToken(sessionId: string, workflowName: string, gateName: string, message: string, workflowHash: string, requestedBy: string, expiresInMs?: number): ApprovalToken;
+    /**
+     * Validates an approval token against the current execution context.
+     *
+     * Checks: (a) token exists, (b) sessionId matches, (c) status is pending,
+     * (d) not expired, (e) workflowHash matches current workflow.
+     *
+     * @param tokenId - The token UUID to validate.
+     * @param currentSessionId - The current session to validate against.
+     * @param currentWorkflowHash - The current workflow hash for TOCTOU check.
+     * @returns Validation result with reason if invalid.
+     */
+    validateToken(tokenId: string, currentSessionId: string, currentWorkflowHash: string): TokenValidation;
+    /**
+     * Approves a pending token.
+     *
+     * Performs an atomic CAS transition: `pending -> approved`. If the token
+     * is not in `pending` state, the operation is a no-op and returns false.
+     *
+     * @param tokenId - The token UUID to approve.
+     * @param approvedBy - The identifier of the approving actor.
+     * @returns `true` if the transition succeeded, `false` if CAS failed.
+     */
+    approveToken(tokenId: string, approvedBy: string): boolean;
+    /**
+     * Rejects a pending token.
+     *
+     * Performs an atomic CAS transition: `pending -> rejected`.
+     *
+     * @param tokenId - The token UUID to reject.
+     * @returns `true` if the transition succeeded, `false` if CAS failed.
+     */
+    rejectToken(tokenId: string): boolean;
+    /**
+     * Expires a pending token.
+     *
+     * Performs an atomic CAS transition: `pending -> expired`.
+     *
+     * @param tokenId - The token UUID to expire.
+     * @returns `true` if the transition succeeded, `false` if CAS failed.
+     */
+    expireToken(tokenId: string): boolean;
+    /**
+     * Retrieves a token by its UUID.
+     *
+     * @param tokenId - The token UUID to look up.
+     * @returns The token if found, otherwise undefined.
+     */
+    getToken(tokenId: string): ApprovalToken | undefined;
+    /**
+     * Lists all tokens for a given session.
+     *
+     * @param sessionId - The session to filter by.
+     * @returns Array of tokens belonging to the session.
+     */
+    getTokensForSession(sessionId: string): ApprovalToken[];
+    /**
+     * Computes a SHA-256 hash of a workflow definition string.
+     *
+     * Used for TOCTOU protection: the hash at token creation time is compared
+     * against the hash at approval time.
+     *
+     * @param workflowText - The raw workflow definition text.
+     * @returns Hex-encoded SHA-256 hash.
+     */
+    static computeWorkflowHash(workflowText: string): string;
+    /**
+     * Atomically transitions a token from `pending` to the target status.
+     *
+     * @param tokenId - The token UUID.
+     * @param targetStatus - The desired new status.
+     * @returns `true` if the CAS transition succeeded.
+     */
+    private transitionStatus;
+}
+//# sourceMappingURL=approval.d.ts.map

package/dist/cant/approval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval.d.ts","sourceRoot":"","sources":["../../src/cant/approval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAuB,eAAe,EAAE,MAAM,YAAY,CAAC;AAKtF;;;;;GAKG;AACH,qBAAa,eAAe;IAC1B,iDAAiD;IACjD,OAAO,CAAC,MAAM,CAAyC;IAEvD;;;;;;;;;;;OAWG;IACH,aAAa,CACX,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,WAAW,GAAE,MAA0B,GACtC,aAAa;IAmBhB;;;;;;;;;;OAUG;IACH,aAAa,CACX,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,MAAM,EACxB,mBAAmB,EAAE,MAAM,GAC1B,eAAe;IA8BlB;;;;;;;;;OASG;IACH,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO;IAc1D;;;;;;;OAOG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAWrC;;;;;;;OAOG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAIrC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAIpD;;;;;OAKG;IACH,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,EAAE;IAIvD;;;;;;;;OAQG;IACH,MAAM,CAAC,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAIxD;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;CASzB"}

package/dist/cant/approval.js

@@ -0,0 +1,185 @@
+/**
+ * Approval gate manager for CANT workflow execution.
+ *
+ * Manages the lifecycle of approval tokens: generation, validation,
+ * approval, rejection, and expiration. Tokens follow the state machine
+ * defined in CANT-DSL-SPEC.md Section 8.2.
+ *
+ * State transitions are atomic (CAS): only `pending -> approved`,
+ * `pending -> rejected`, and `pending -> expired` are permitted.
+ *
+ * @see docs/specs/CANT-DSL-SPEC.md Section 8 (Approval Token Protocol)
+ */
+import { createHash, randomUUID } from 'node:crypto';
+/** Default token expiration duration: 24 hours in milliseconds. */
+const DEFAULT_EXPIRY_MS = 24 * 60 * 60 * 1000;
+/**
+ * Manages approval tokens for CANT workflow gates.
+ *
+ * Tokens are stored in-memory per instance. In production, these are
+ * persisted via the session's `approvalTokensJson` column in tasks.db.
+ */
+export class ApprovalManager {
+    /** In-memory token store keyed by token UUID. */
+    tokens = new Map();
+    /**
+     * Generates a new approval token for a workflow gate.
+     *
+     * @param sessionId - The session that owns this token.
+     * @param workflowName - The workflow containing the approval gate.
+     * @param gateName - The label of the specific approval gate.
+     * @param message - The message to display to the approver.
+     * @param workflowHash - SHA-256 hash of the workflow definition.
+     * @param requestedBy - The agent/workflow requesting approval.
+     * @param expiresInMs - Token lifetime in milliseconds (default: 24h).
+     * @returns The generated approval token.
+     */
+    generateToken(sessionId, workflowName, gateName, message, workflowHash, requestedBy, expiresInMs = DEFAULT_EXPIRY_MS) {
+        const now = new Date();
+        const token = {
+            token: randomUUID(),
+            sessionId,
+            workflowName,
+            gateName,
+            workflowHash,
+            message,
+            createdAt: now.toISOString(),
+            expiresAt: new Date(now.getTime() + expiresInMs).toISOString(),
+            status: 'pending',
+            requestedBy,
+        };
+        this.tokens.set(token.token, token);
+        return token;
+    }
+    /**
+     * Validates an approval token against the current execution context.
+     *
+     * Checks: (a) token exists, (b) sessionId matches, (c) status is pending,
+     * (d) not expired, (e) workflowHash matches current workflow.
+     *
+     * @param tokenId - The token UUID to validate.
+     * @param currentSessionId - The current session to validate against.
+     * @param currentWorkflowHash - The current workflow hash for TOCTOU check.
+     * @returns Validation result with reason if invalid.
+     */
+    validateToken(tokenId, currentSessionId, currentWorkflowHash) {
+        const token = this.tokens.get(tokenId);
+        if (!token) {
+            return { valid: false, reason: 'not_found' };
+        }
+        if (token.sessionId !== currentSessionId) {
+            return { valid: false, reason: 'wrong_session', token };
+        }
+        if (token.status !== 'pending') {
+            return { valid: false, reason: 'not_pending', token };
+        }
+        // Check expiration
+        if (new Date(token.expiresAt).getTime() < Date.now()) {
+            // Atomically transition to expired
+            this.transitionStatus(tokenId, 'expired');
+            return { valid: false, reason: 'expired', token: { ...token, status: 'expired' } };
+        }
+        // TOCTOU: verify workflow has not been modified
+        if (token.workflowHash !== currentWorkflowHash) {
+            return { valid: false, reason: 'hash_mismatch', token };
+        }
+        return { valid: true, token };
+    }
+    /**
+     * Approves a pending token.
+     *
+     * Performs an atomic CAS transition: `pending -> approved`. If the token
+     * is not in `pending` state, the operation is a no-op and returns false.
+     *
+     * @param tokenId - The token UUID to approve.
+     * @param approvedBy - The identifier of the approving actor.
+     * @returns `true` if the transition succeeded, `false` if CAS failed.
+     */
+    approveToken(tokenId, approvedBy) {
+        const token = this.tokens.get(tokenId);
+        if (!token || token.status !== 'pending') {
+            return false;
+        }
+        const now = new Date().toISOString();
+        token.status = 'approved';
+        token.approvedBy = approvedBy;
+        token.approvedAt = now;
+        token.usedAt = now;
+        return true;
+    }
+    /**
+     * Rejects a pending token.
+     *
+     * Performs an atomic CAS transition: `pending -> rejected`.
+     *
+     * @param tokenId - The token UUID to reject.
+     * @returns `true` if the transition succeeded, `false` if CAS failed.
+     */
+    rejectToken(tokenId) {
+        const token = this.tokens.get(tokenId);
+        if (!token || token.status !== 'pending') {
+            return false;
+        }
+        token.status = 'rejected';
+        token.usedAt = new Date().toISOString();
+        return true;
+    }
+    /**
+     * Expires a pending token.
+     *
+     * Performs an atomic CAS transition: `pending -> expired`.
+     *
+     * @param tokenId - The token UUID to expire.
+     * @returns `true` if the transition succeeded, `false` if CAS failed.
+     */
+    expireToken(tokenId) {
+        return this.transitionStatus(tokenId, 'expired');
+    }
+    /**
+     * Retrieves a token by its UUID.
+     *
+     * @param tokenId - The token UUID to look up.
+     * @returns The token if found, otherwise undefined.
+     */
+    getToken(tokenId) {
+        return this.tokens.get(tokenId);
+    }
+    /**
+     * Lists all tokens for a given session.
+     *
+     * @param sessionId - The session to filter by.
+     * @returns Array of tokens belonging to the session.
+     */
+    getTokensForSession(sessionId) {
+        return Array.from(this.tokens.values()).filter((t) => t.sessionId === sessionId);
+    }
+    /**
+     * Computes a SHA-256 hash of a workflow definition string.
+     *
+     * Used for TOCTOU protection: the hash at token creation time is compared
+     * against the hash at approval time.
+     *
+     * @param workflowText - The raw workflow definition text.
+     * @returns Hex-encoded SHA-256 hash.
+     */
+    static computeWorkflowHash(workflowText) {
+        return createHash('sha256').update(workflowText).digest('hex');
+    }
+    /**
+     * Atomically transitions a token from `pending` to the target status.
+     *
+     * @param tokenId - The token UUID.
+     * @param targetStatus - The desired new status.
+     * @returns `true` if the CAS transition succeeded.
+     */
+    transitionStatus(tokenId, targetStatus) {
+        const token = this.tokens.get(tokenId);
+        if (!token || token.status !== 'pending') {
+            return false;
+        }
+        token.status = targetStatus;
+        token.usedAt = new Date().toISOString();
+        return true;
+    }
+}
+//# sourceMappingURL=approval.js.map

package/dist/cant/approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval.js","sourceRoot":"","sources":["../../src/cant/approval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGrD,mEAAmE;AACnE,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IAC1B,iDAAiD;IACzC,MAAM,GAA+B,IAAI,GAAG,EAAE,CAAC;IAEvD;;;;;;;;;;;OAWG;IACH,aAAa,CACX,SAAiB,EACjB,YAAoB,EACpB,QAAgB,EAChB,OAAe,EACf,YAAoB,EACpB,WAAmB,EACnB,cAAsB,iBAAiB;QAEvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAkB;YAC3B,KAAK,EAAE,UAAU,EAAE;YACnB,SAAS;YACT,YAAY;YACZ,QAAQ;YACR,YAAY;YACZ,OAAO;YACP,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;YAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC,WAAW,EAAE;YAC9D,MAAM,EAAE,SAAS;YACjB,WAAW;SACZ,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;OAUG;IACH,aAAa,CACX,OAAe,EACf,gBAAwB,EACxB,mBAA2B;QAE3B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC/C,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,KAAK,gBAAgB,EAAE,CAAC;YACzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QAC1D,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QACxD,CAAC;QAED,mBAAmB;QACnB,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACrD,mCAAmC;YACnC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC;QACrF,CAAC;QAED,gDAAgD;QAChD,IAAI,KAAK,CAAC,YAAY,KAAK,mBAAmB,EAAE,CAAC;YAC/C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QAC1D,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAChC,CAAC;IAED;;;;;;;;;OASG;IACH,YAAY,CAAC,OAAe,EAAE,UAAkB;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,KAAK,CAAC,MAAM,GAAG,UAAU,CAAC;QAC1B,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;QAC9B,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;QACvB,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,OAAe;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,CAAC,MAAM,GAAG,UAAU,CAAC;QAC1B,KAAK,CAAC,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,OAAe;QACzB,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,OAAe;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,mBAAmB,CAAC,SAAiB;QACnC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACnF,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,mBAAmB,CAAC,YAAoB;QAC7C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CAAC,OAAe,EAAE,YAAiC;QACzE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,CAAC,MAAM,GAAG,YAAY,CAAC;QAC5B,KAAK,CAAC,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/cant/context-builder.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Execution context builder for CANT workflows.
+ *
+ * Resolves variable references and manages the scope chain for workflow
+ * execution. Variables from workflow parameters, step outputs, and
+ * intermediate bindings are tracked in a hierarchical scope.
+ *
+ * @see docs/specs/CANT-DSL-SPEC.md Section 7.2 (Workflow Execution)
+ */
+import type { ExecutionScope } from './types.js';
+/**
+ * Creates a new root execution scope with initial variable bindings.
+ *
+ * @param initialBindings - Initial variable values (typically workflow parameters).
+ * @returns A new root scope.
+ */
+export declare function createScope(initialBindings?: Record<string, unknown>): ExecutionScope;
+/**
+ * Creates a child scope that inherits from a parent.
+ *
+ * Lookups in the child scope fall through to the parent if not found locally.
+ * This is used for parallel arms, loop iterations, and nested blocks.
+ *
+ * @param parent - The parent scope.
+ * @param localBindings - Local variable overrides for this child scope.
+ * @returns A new child scope.
+ */
+export declare function createChildScope(parent: ExecutionScope, localBindings?: Record<string, unknown>): ExecutionScope;
+/**
+ * Resolves a variable name in the scope chain.
+ *
+ * Searches the current scope first, then walks up the parent chain.
+ *
+ * @param scope - The scope to search in.
+ * @param name - The variable name to resolve.
+ * @returns The variable value, or `undefined` if not found in any scope.
+ */
+export declare function resolveVariable(scope: ExecutionScope, name: string): unknown;
+/**
+ * Sets a variable in the current scope (does not affect parent scopes).
+ *
+ * @param scope - The scope to modify.
+ * @param name - The variable name to set.
+ * @param value - The value to assign.
+ */
+export declare function setVariable(scope: ExecutionScope, name: string, value: unknown): void;
+/**
+ * Resolves `{variable}` placeholders in a template string against the scope.
+ *
+ * Performs single-pass replacement per the T07 security rule: nested
+ * interpolation within resolved values is treated as literal text.
+ *
+ * @param template - The string containing `{variable}` placeholders.
+ * @param scope - The execution scope for variable resolution.
+ * @returns The string with all placeholders resolved.
+ * @throws {Error} If a referenced variable is not found in any scope.
+ */
+export declare function resolveTemplate(template: string, scope: ExecutionScope): string;
+/**
+ * Merges step output into the current scope.
+ *
+ * Binds `<stepName>.stdout`, `<stepName>.stderr`, and `<stepName>.exitCode`
+ * for use in subsequent step variable resolution.
+ *
+ * @param scope - The scope to add bindings to.
+ * @param stepName - The name of the completed step.
+ * @param output - The step output to merge.
+ */
+export declare function mergeStepOutput(scope: ExecutionScope, stepName: string, output: Record<string, unknown>): void;
+/**
+ * Collects all variable bindings visible from the given scope (including parents).
+ *
+ * Parent bindings are overridden by child bindings of the same name.
+ *
+ * @param scope - The scope to flatten.
+ * @returns A flat record of all visible variable bindings.
+ */
+export declare function flattenScope(scope: ExecutionScope): Record<string, unknown>;
+//# sourceMappingURL=context-builder.d.ts.map

package/dist/cant/context-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-builder.d.ts","sourceRoot":"","sources":["../../src/cant/context-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,eAAe,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,cAAc,CAIzF;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,cAAc,EACtB,aAAa,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAC1C,cAAc,CAKhB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAY5E;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAErF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,MAAM,CAQ/E;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,cAAc,EACrB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,IAAI,CAQN;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAG3E"}

package/dist/cant/context-builder.js

@@ -0,0 +1,117 @@
+/**
+ * Execution context builder for CANT workflows.
+ *
+ * Resolves variable references and manages the scope chain for workflow
+ * execution. Variables from workflow parameters, step outputs, and
+ * intermediate bindings are tracked in a hierarchical scope.
+ *
+ * @see docs/specs/CANT-DSL-SPEC.md Section 7.2 (Workflow Execution)
+ */
+/**
+ * Creates a new root execution scope with initial variable bindings.
+ *
+ * @param initialBindings - Initial variable values (typically workflow parameters).
+ * @returns A new root scope.
+ */
+export function createScope(initialBindings = {}) {
+    return {
+        variables: { ...initialBindings },
+    };
+}
+/**
+ * Creates a child scope that inherits from a parent.
+ *
+ * Lookups in the child scope fall through to the parent if not found locally.
+ * This is used for parallel arms, loop iterations, and nested blocks.
+ *
+ * @param parent - The parent scope.
+ * @param localBindings - Local variable overrides for this child scope.
+ * @returns A new child scope.
+ */
+export function createChildScope(parent, localBindings = {}) {
+    return {
+        variables: { ...localBindings },
+        parent,
+    };
+}
+/**
+ * Resolves a variable name in the scope chain.
+ *
+ * Searches the current scope first, then walks up the parent chain.
+ *
+ * @param scope - The scope to search in.
+ * @param name - The variable name to resolve.
+ * @returns The variable value, or `undefined` if not found in any scope.
+ */
+export function resolveVariable(scope, name) {
+    // Check current scope
+    if (name in scope.variables) {
+        return scope.variables[name];
+    }
+    // Check parent chain
+    if (scope.parent) {
+        return resolveVariable(scope.parent, name);
+    }
+    return undefined;
+}
+/**
+ * Sets a variable in the current scope (does not affect parent scopes).
+ *
+ * @param scope - The scope to modify.
+ * @param name - The variable name to set.
+ * @param value - The value to assign.
+ */
+export function setVariable(scope, name, value) {
+    scope.variables[name] = value;
+}
+/**
+ * Resolves `{variable}` placeholders in a template string against the scope.
+ *
+ * Performs single-pass replacement per the T07 security rule: nested
+ * interpolation within resolved values is treated as literal text.
+ *
+ * @param template - The string containing `{variable}` placeholders.
+ * @param scope - The execution scope for variable resolution.
+ * @returns The string with all placeholders resolved.
+ * @throws {Error} If a referenced variable is not found in any scope.
+ */
+export function resolveTemplate(template, scope) {
+    return template.replace(/\{([^}]+)\}/g, (_match, varName) => {
+        const value = resolveVariable(scope, varName);
+        if (value === undefined) {
+            throw new Error(`Variable '${varName}' not found in execution scope`);
+        }
+        return String(value);
+    });
+}
+/**
+ * Merges step output into the current scope.
+ *
+ * Binds `<stepName>.stdout`, `<stepName>.stderr`, and `<stepName>.exitCode`
+ * for use in subsequent step variable resolution.
+ *
+ * @param scope - The scope to add bindings to.
+ * @param stepName - The name of the completed step.
+ * @param output - The step output to merge.
+ */
+export function mergeStepOutput(scope, stepName, output) {
+    // Bind the full output object under the step name
+    scope.variables[stepName] = output;
+    // Also bind dotted access for convenience
+    for (const [key, value] of Object.entries(output)) {
+        scope.variables[`${stepName}.${key}`] = value;
+    }
+}
+/**
+ * Collects all variable bindings visible from the given scope (including parents).
+ *
+ * Parent bindings are overridden by child bindings of the same name.
+ *
+ * @param scope - The scope to flatten.
+ * @returns A flat record of all visible variable bindings.
+ */
+export function flattenScope(scope) {
+    const parentVars = scope.parent ? flattenScope(scope.parent) : {};
+    return { ...parentVars, ...scope.variables };
+}
+//# sourceMappingURL=context-builder.js.map

package/dist/cant/context-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-builder.js","sourceRoot":"","sources":["../../src/cant/context-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,kBAA2C,EAAE;IACvE,OAAO;QACL,SAAS,EAAE,EAAE,GAAG,eAAe,EAAE;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAsB,EACtB,gBAAyC,EAAE;IAE3C,OAAO;QACL,SAAS,EAAE,EAAE,GAAG,aAAa,EAAE;QAC/B,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,KAAqB,EAAE,IAAY;IACjE,sBAAsB;IACtB,IAAI,IAAI,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,qBAAqB;IACrB,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,KAAqB,EAAE,IAAY,EAAE,KAAc;IAC7E,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;AAChC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,KAAqB;IACrE,OAAO,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,OAAe,EAAE,EAAE;QAClE,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,aAAa,OAAO,gCAAgC,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAqB,EACrB,QAAgB,EAChB,MAA+B;IAE/B,kDAAkD;IAClD,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;IAEnC,0CAA0C;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,KAAK,CAAC,SAAS,CAAC,GAAG,QAAQ,IAAI,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC;IAChD,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,KAAqB;IAChD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;AAC/C,CAAC"}