@cleocode/core 2026.4.0 → 2026.4.2

package/dist/cant/approval.js

@@ -1,185 +0,0 @@
-/**
- * Approval gate manager for CANT workflow execution.
- *
- * Manages the lifecycle of approval tokens: generation, validation,
- * approval, rejection, and expiration. Tokens follow the state machine
- * defined in CANT-DSL-SPEC.md Section 8.2.
- *
- * State transitions are atomic (CAS): only `pending -> approved`,
- * `pending -> rejected`, and `pending -> expired` are permitted.
- *
- * @see docs/specs/CANT-DSL-SPEC.md Section 8 (Approval Token Protocol)
- */
-import { createHash, randomUUID } from 'node:crypto';
-/** Default token expiration duration: 24 hours in milliseconds. */
-const DEFAULT_EXPIRY_MS = 24 * 60 * 60 * 1000;
-/**
- * Manages approval tokens for CANT workflow gates.
- *
- * Tokens are stored in-memory per instance. In production, these are
- * persisted via the session's `approvalTokensJson` column in tasks.db.
- */
-export class ApprovalManager {
-    /** In-memory token store keyed by token UUID. */
-    tokens = new Map();
-    /**
-     * Generates a new approval token for a workflow gate.
-     *
-     * @param sessionId - The session that owns this token.
-     * @param workflowName - The workflow containing the approval gate.
-     * @param gateName - The label of the specific approval gate.
-     * @param message - The message to display to the approver.
-     * @param workflowHash - SHA-256 hash of the workflow definition.
-     * @param requestedBy - The agent/workflow requesting approval.
-     * @param expiresInMs - Token lifetime in milliseconds (default: 24h).
-     * @returns The generated approval token.
-     */
-    generateToken(sessionId, workflowName, gateName, message, workflowHash, requestedBy, expiresInMs = DEFAULT_EXPIRY_MS) {
-        const now = new Date();
-        const token = {
-            token: randomUUID(),
-            sessionId,
-            workflowName,
-            gateName,
-            workflowHash,
-            message,
-            createdAt: now.toISOString(),
-            expiresAt: new Date(now.getTime() + expiresInMs).toISOString(),
-            status: 'pending',
-            requestedBy,
-        };
-        this.tokens.set(token.token, token);
-        return token;
-    }
-    /**
-     * Validates an approval token against the current execution context.
-     *
-     * Checks: (a) token exists, (b) sessionId matches, (c) status is pending,
-     * (d) not expired, (e) workflowHash matches current workflow.
-     *
-     * @param tokenId - The token UUID to validate.
-     * @param currentSessionId - The current session to validate against.
-     * @param currentWorkflowHash - The current workflow hash for TOCTOU check.
-     * @returns Validation result with reason if invalid.
-     */
-    validateToken(tokenId, currentSessionId, currentWorkflowHash) {
-        const token = this.tokens.get(tokenId);
-        if (!token) {
-            return { valid: false, reason: 'not_found' };
-        }
-        if (token.sessionId !== currentSessionId) {
-            return { valid: false, reason: 'wrong_session', token };
-        }
-        if (token.status !== 'pending') {
-            return { valid: false, reason: 'not_pending', token };
-        }
-        // Check expiration
-        if (new Date(token.expiresAt).getTime() < Date.now()) {
-            // Atomically transition to expired
-            this.transitionStatus(tokenId, 'expired');
-            return { valid: false, reason: 'expired', token: { ...token, status: 'expired' } };
-        }
-        // TOCTOU: verify workflow has not been modified
-        if (token.workflowHash !== currentWorkflowHash) {
-            return { valid: false, reason: 'hash_mismatch', token };
-        }
-        return { valid: true, token };
-    }
-    /**
-     * Approves a pending token.
-     *
-     * Performs an atomic CAS transition: `pending -> approved`. If the token
-     * is not in `pending` state, the operation is a no-op and returns false.
-     *
-     * @param tokenId - The token UUID to approve.
-     * @param approvedBy - The identifier of the approving actor.
-     * @returns `true` if the transition succeeded, `false` if CAS failed.
-     */
-    approveToken(tokenId, approvedBy) {
-        const token = this.tokens.get(tokenId);
-        if (!token || token.status !== 'pending') {
-            return false;
-        }
-        const now = new Date().toISOString();
-        token.status = 'approved';
-        token.approvedBy = approvedBy;
-        token.approvedAt = now;
-        token.usedAt = now;
-        return true;
-    }
-    /**
-     * Rejects a pending token.
-     *
-     * Performs an atomic CAS transition: `pending -> rejected`.
-     *
-     * @param tokenId - The token UUID to reject.
-     * @returns `true` if the transition succeeded, `false` if CAS failed.
-     */
-    rejectToken(tokenId) {
-        const token = this.tokens.get(tokenId);
-        if (!token || token.status !== 'pending') {
-            return false;
-        }
-        token.status = 'rejected';
-        token.usedAt = new Date().toISOString();
-        return true;
-    }
-    /**
-     * Expires a pending token.
-     *
-     * Performs an atomic CAS transition: `pending -> expired`.
-     *
-     * @param tokenId - The token UUID to expire.
-     * @returns `true` if the transition succeeded, `false` if CAS failed.
-     */
-    expireToken(tokenId) {
-        return this.transitionStatus(tokenId, 'expired');
-    }
-    /**
-     * Retrieves a token by its UUID.
-     *
-     * @param tokenId - The token UUID to look up.
-     * @returns The token if found, otherwise undefined.
-     */
-    getToken(tokenId) {
-        return this.tokens.get(tokenId);
-    }
-    /**
-     * Lists all tokens for a given session.
-     *
-     * @param sessionId - The session to filter by.
-     * @returns Array of tokens belonging to the session.
-     */
-    getTokensForSession(sessionId) {
-        return Array.from(this.tokens.values()).filter((t) => t.sessionId === sessionId);
-    }
-    /**
-     * Computes a SHA-256 hash of a workflow definition string.
-     *
-     * Used for TOCTOU protection: the hash at token creation time is compared
-     * against the hash at approval time.
-     *
-     * @param workflowText - The raw workflow definition text.
-     * @returns Hex-encoded SHA-256 hash.
-     */
-    static computeWorkflowHash(workflowText) {
-        return createHash('sha256').update(workflowText).digest('hex');
-    }
-    /**
-     * Atomically transitions a token from `pending` to the target status.
-     *
-     * @param tokenId - The token UUID.
-     * @param targetStatus - The desired new status.
-     * @returns `true` if the CAS transition succeeded.
-     */
-    transitionStatus(tokenId, targetStatus) {
-        const token = this.tokens.get(tokenId);
-        if (!token || token.status !== 'pending') {
-            return false;
-        }
-        token.status = targetStatus;
-        token.usedAt = new Date().toISOString();
-        return true;
-    }
-}
-//# sourceMappingURL=approval.js.map

package/dist/cant/approval.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"approval.js","sourceRoot":"","sources":["../../src/cant/approval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGrD,mEAAmE;AACnE,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,OAAO,eAAe;IAC1B,iDAAiD;IACzC,MAAM,GAA+B,IAAI,GAAG,EAAE,CAAC;IAEvD;;;;;;;;;;;OAWG;IACH,aAAa,CACX,SAAiB,EACjB,YAAoB,EACpB,QAAgB,EAChB,OAAe,EACf,YAAoB,EACpB,WAAmB,EACnB,cAAsB,iBAAiB;QAEvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAkB;YAC3B,KAAK,EAAE,UAAU,EAAE;YACnB,SAAS;YACT,YAAY;YACZ,QAAQ;YACR,YAAY;YACZ,OAAO;YACP,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;YAC5B,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,CAAC,WAAW,EAAE;YAC9D,MAAM,EAAE,SAAS;YACjB,WAAW;SACZ,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;OAUG;IACH,aAAa,CACX,OAAe,EACf,gBAAwB,EACxB,mBAA2B;QAE3B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC/C,CAAC;QAED,IAAI,KAAK,CAAC,SAAS,KAAK,gBAAgB,EAAE,CAAC;YACzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QAC1D,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QACxD,CAAC;QAED,mBAAmB;QACnB,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACrD,mCAAmC;YACnC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC;QACrF,CAAC;QAED,gDAAgD;QAChD,IAAI,KAAK,CAAC,YAAY,KAAK,mBAAmB,EAAE,CAAC;YAC/C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;QAC1D,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAChC,CAAC;IAED;;;;;;;;;OASG;IACH,YAAY,CAAC,OAAe,EAAE,UAAkB;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,KAAK,CAAC,MAAM,GAAG,UAAU,CAAC;QAC1B,KAAK,CAAC,UAAU,GAAG,UAAU,CAAC;QAC9B,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;QACvB,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,OAAe;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,CAAC,MAAM,GAAG,UAAU,CAAC;QAC1B,KAAK,CAAC,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,WAAW,CAAC,OAAe;QACzB,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,OAAe;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,mBAAmB,CAAC,SAAiB;QACnC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACnF,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,mBAAmB,CAAC,YAAoB;QAC7C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CAAC,OAAe,EAAE,YAAiC;QACzE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,CAAC,MAAM,GAAG,YAAY,CAAC;QAC5B,KAAK,CAAC,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/cant/context-builder.js

@@ -1,117 +0,0 @@
-/**
- * Execution context builder for CANT workflows.
- *
- * Resolves variable references and manages the scope chain for workflow
- * execution. Variables from workflow parameters, step outputs, and
- * intermediate bindings are tracked in a hierarchical scope.
- *
- * @see docs/specs/CANT-DSL-SPEC.md Section 7.2 (Workflow Execution)
- */
-/**
- * Creates a new root execution scope with initial variable bindings.
- *
- * @param initialBindings - Initial variable values (typically workflow parameters).
- * @returns A new root scope.
- */
-export function createScope(initialBindings = {}) {
-    return {
-        variables: { ...initialBindings },
-    };
-}
-/**
- * Creates a child scope that inherits from a parent.
- *
- * Lookups in the child scope fall through to the parent if not found locally.
- * This is used for parallel arms, loop iterations, and nested blocks.
- *
- * @param parent - The parent scope.
- * @param localBindings - Local variable overrides for this child scope.
- * @returns A new child scope.
- */
-export function createChildScope(parent, localBindings = {}) {
-    return {
-        variables: { ...localBindings },
-        parent,
-    };
-}
-/**
- * Resolves a variable name in the scope chain.
- *
- * Searches the current scope first, then walks up the parent chain.
- *
- * @param scope - The scope to search in.
- * @param name - The variable name to resolve.
- * @returns The variable value, or `undefined` if not found in any scope.
- */
-export function resolveVariable(scope, name) {
-    // Check current scope
-    if (name in scope.variables) {
-        return scope.variables[name];
-    }
-    // Check parent chain
-    if (scope.parent) {
-        return resolveVariable(scope.parent, name);
-    }
-    return undefined;
-}
-/**
- * Sets a variable in the current scope (does not affect parent scopes).
- *
- * @param scope - The scope to modify.
- * @param name - The variable name to set.
- * @param value - The value to assign.
- */
-export function setVariable(scope, name, value) {
-    scope.variables[name] = value;
-}
-/**
- * Resolves `{variable}` placeholders in a template string against the scope.
- *
- * Performs single-pass replacement per the T07 security rule: nested
- * interpolation within resolved values is treated as literal text.
- *
- * @param template - The string containing `{variable}` placeholders.
- * @param scope - The execution scope for variable resolution.
- * @returns The string with all placeholders resolved.
- * @throws {Error} If a referenced variable is not found in any scope.
- */
-export function resolveTemplate(template, scope) {
-    return template.replace(/\{([^}]+)\}/g, (_match, varName) => {
-        const value = resolveVariable(scope, varName);
-        if (value === undefined) {
-            throw new Error(`Variable '${varName}' not found in execution scope`);
-        }
-        return String(value);
-    });
-}
-/**
- * Merges step output into the current scope.
- *
- * Binds `<stepName>.stdout`, `<stepName>.stderr`, and `<stepName>.exitCode`
- * for use in subsequent step variable resolution.
- *
- * @param scope - The scope to add bindings to.
- * @param stepName - The name of the completed step.
- * @param output - The step output to merge.
- */
-export function mergeStepOutput(scope, stepName, output) {
-    // Bind the full output object under the step name
-    scope.variables[stepName] = output;
-    // Also bind dotted access for convenience
-    for (const [key, value] of Object.entries(output)) {
-        scope.variables[`${stepName}.${key}`] = value;
-    }
-}
-/**
- * Collects all variable bindings visible from the given scope (including parents).
- *
- * Parent bindings are overridden by child bindings of the same name.
- *
- * @param scope - The scope to flatten.
- * @returns A flat record of all visible variable bindings.
- */
-export function flattenScope(scope) {
-    const parentVars = scope.parent ? flattenScope(scope.parent) : {};
-    return { ...parentVars, ...scope.variables };
-}
-//# sourceMappingURL=context-builder.js.map

package/dist/cant/context-builder.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"context-builder.js","sourceRoot":"","sources":["../../src/cant/context-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,kBAA2C,EAAE;IACvE,OAAO;QACL,SAAS,EAAE,EAAE,GAAG,eAAe,EAAE;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAsB,EACtB,gBAAyC,EAAE;IAE3C,OAAO;QACL,SAAS,EAAE,EAAE,GAAG,aAAa,EAAE;QAC/B,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,KAAqB,EAAE,IAAY;IACjE,sBAAsB;IACtB,IAAI,IAAI,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,qBAAqB;IACrB,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,KAAqB,EAAE,IAAY,EAAE,KAAc;IAC7E,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;AAChC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,KAAqB;IACrE,OAAO,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,OAAe,EAAE,EAAE;QAClE,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,aAAa,OAAO,gCAAgC,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAqB,EACrB,QAAgB,EAChB,MAA+B;IAE/B,kDAAkD;IAClD,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;IAEnC,0CAA0C;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,KAAK,CAAC,SAAS,CAAC,GAAG,QAAQ,IAAI,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC;IAChD,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,KAAqB;IAChD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;AAC/C,CAAC"}

package/dist/cant/discretion.js

@@ -1,116 +0,0 @@
-/**
- * Discretion evaluation for CANT workflow conditionals.
- *
- * Discretion conditions (`**prose text**`) are AI-evaluated logic gates
- * in CANT workflows. The evaluation is pluggable: the default evaluator
- * stubs `true` (real LLM integration is a separate task), while custom
- * evaluators can be injected for testing, rule-based shortcuts, or
- * alternative model backends.
- *
- * @see docs/specs/CANT-DSL-SPEC.md Section 7.3 (Discretion Evaluation)
- */
-// ---------------------------------------------------------------------------
-// Default Evaluator (Stub)
-// ---------------------------------------------------------------------------
-/**
- * Default discretion evaluator that always returns `true`.
- *
- * This is a stub implementation. The real LLM-backed evaluator will be
- * implemented as a separate task. In production, this should be replaced
- * with an evaluator that:
- * - Calls the LLM API with the condition in a structured field
- * - Uses structured prompting (tool use / JSON mode)
- * - Returns a boolean judgment
- */
-export class DefaultDiscretionEvaluator {
-    /** Always returns `true` (stub). */
-    async evaluate(_condition, _context) {
-        return true;
-    }
-}
-// ---------------------------------------------------------------------------
-// Mock Evaluator (Testing)
-// ---------------------------------------------------------------------------
-/**
- * Mock discretion evaluator with configurable responses for testing.
- *
- * Responses can be set per condition text or as a blanket default.
- */
-export class MockDiscretionEvaluator {
-    responses = new Map();
-    defaultResponse;
-    evaluationLog = [];
-    /**
-     * Creates a mock evaluator.
-     *
-     * @param defaultResponse - The response for conditions without a specific mapping.
-     */
-    constructor(defaultResponse = true) {
-        this.defaultResponse = defaultResponse;
-    }
-    /** Set the response for a specific condition text. */
-    setResponse(condition, result) {
-        this.responses.set(condition, result);
-    }
-    /** Evaluate using the configured response map. */
-    async evaluate(condition, context) {
-        const result = this.responses.get(condition) ?? this.defaultResponse;
-        this.evaluationLog.push({ condition, context, result });
-        return result;
-    }
-    /** Get the log of all evaluations performed. */
-    getLog() {
-        return this.evaluationLog;
-    }
-    /** Reset the evaluation log. */
-    clearLog() {
-        this.evaluationLog = [];
-    }
-}
-// ---------------------------------------------------------------------------
-// Rate-Limited Evaluator (Decorator)
-// ---------------------------------------------------------------------------
-/**
- * Wraps a discretion evaluator with rate limiting.
- *
- * Enforces a configurable maximum number of discretion evaluations per
- * workflow execution. Default limit is 100 per the spec. This prevents
- * runaway costs from loops containing discretion conditions.
- */
-export class RateLimitedDiscretionEvaluator {
-    inner;
-    maxEvaluations;
-    evaluationCount = 0;
-    /**
-     * Creates a rate-limited evaluator wrapper.
-     *
-     * @param inner - The underlying evaluator to delegate to.
-     * @param maxEvaluations - Maximum evaluations allowed (default: 100).
-     */
-    constructor(inner, maxEvaluations = 100) {
-        this.inner = inner;
-        this.maxEvaluations = maxEvaluations;
-    }
-    /**
-     * Evaluate with rate limiting.
-     *
-     * @throws {Error} If the evaluation count exceeds the configured maximum.
-     */
-    async evaluate(condition, context) {
-        this.evaluationCount++;
-        if (this.evaluationCount > this.maxEvaluations) {
-            throw new Error(`Discretion evaluation limit exceeded: ${this.evaluationCount} > ${this.maxEvaluations}. ` +
-                'This prevents runaway costs from loops containing discretion conditions.');
-        }
-        return this.inner.evaluate(condition, context);
-    }
-    /** Get the current evaluation count. */
-    getEvaluationCount() {
-        return this.evaluationCount;
-    }
-    /** Reset the evaluation counter (for reuse across workflow runs). */
-    resetCount() {
-        this.evaluationCount = 0;
-    }
-}
-//# sourceMappingURL=discretion.js.map

package/dist/cant/discretion.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"discretion.js","sourceRoot":"","sources":["../../src/cant/discretion.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAoBH,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,OAAO,0BAA0B;IACrC,oCAAoC;IACpC,KAAK,CAAC,QAAQ,CAAC,UAAkB,EAAE,QAA2B;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,OAAO,uBAAuB;IAC1B,SAAS,GAAyB,IAAI,GAAG,EAAE,CAAC;IAC5C,eAAe,CAAU;IACzB,aAAa,GACnB,EAAE,CAAC;IAEL;;;;OAIG;IACH,YAAY,eAAe,GAAG,IAAI;QAChC,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;IAED,sDAAsD;IACtD,WAAW,CAAC,SAAiB,EAAE,MAAe;QAC5C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,kDAAkD;IAClD,KAAK,CAAC,QAAQ,CAAC,SAAiB,EAAE,OAA0B;QAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC;QACrE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,gDAAgD;IAChD,MAAM;QACJ,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,gCAAgC;IAChC,QAAQ;QACN,IAAI,CAAC,aAAa,GAAG,EAAE,CAAC;IAC1B,CAAC;CACF;AAED,8EAA8E;AAC9E,qCAAqC;AACrC,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,OAAO,8BAA8B;IAUtB;IACA;IAVX,eAAe,GAAG,CAAC,CAAC;IAE5B;;;;;OAKG;IACH,YACmB,KAA0B,EAC1B,iBAAyB,GAAG;QAD5B,UAAK,GAAL,KAAK,CAAqB;QAC1B,mBAAc,GAAd,cAAc,CAAc;IAC5C,CAAC;IAEJ;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,SAAiB,EAAE,OAA0B;QAC1D,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,yCAAyC,IAAI,CAAC,eAAe,MAAM,IAAI,CAAC,cAAc,IAAI;gBACxF,0EAA0E,CAC7E,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,wCAAwC;IACxC,kBAAkB;QAChB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED,qEAAqE;IACrE,UAAU;QACR,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC;IAC3B,CAAC;CACF"}

package/dist/cant/index.js

@@ -1,23 +0,0 @@
-/**
- * CANT DSL runtime — TypeScript workflow executor.
- *
- * This module provides the TypeScript side of the CANT hybrid runtime:
- * - Workflow execution (sessions, parallel, conditionals, loops, try/catch)
- * - Discretion evaluation (pluggable AI-judged conditions)
- * - Approval gate management (token generation, validation, state machine)
- * - Parallel arm execution (all/race/settle strategies)
- * - Execution context and scope management
- *
- * Pipeline execution is handled by the Rust `cant-runtime` crate and
- * bridged via napi-rs.
- *
- * @see docs/specs/CANT-DSL-SPEC.md Section 7 (Runtime) and Section 8 (Approval Tokens)
- */
-// Approval gate management
-export { ApprovalManager } from './approval.js';
-// Execution context and scope
-export { createChildScope, createScope, flattenScope, mergeStepOutput, resolveTemplate, resolveVariable, setVariable, } from './context-builder.js';
-export { DefaultDiscretionEvaluator, MockDiscretionEvaluator, RateLimitedDiscretionEvaluator, } from './discretion.js';
-export { executeParallel } from './parallel-runner.js';
-export { WorkflowExecutor } from './workflow-executor.js';
-//# sourceMappingURL=index.js.map

package/dist/cant/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cant/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,2BAA2B;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,8BAA8B;AAC9B,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,eAAe,EACf,eAAe,EACf,eAAe,EACf,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,8BAA8B,GAC/B,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAiBvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/cant/parallel-runner.js

@@ -1,173 +0,0 @@
-/**
- * Parallel arm execution for CANT workflow parallel blocks.
- *
- * Supports three join strategies:
- * - `all` (default): Wait for ALL arms. Fail if any arm fails.
- * - `race`: Return when the FIRST arm completes. Cancel remaining.
- * - `settle`: Wait for ALL arms. Collect successes and failures.
- *
- * @see docs/specs/CANT-DSL-SPEC.md Section 7.5 (Parallel Execution)
- */
-/**
- * Executes parallel arms according to the specified join strategy.
- *
- * @param arms - The arms to execute concurrently.
- * @param strategy - The join strategy (default: 'all').
- * @returns Parallel execution result.
- */
-export async function executeParallel(arms, strategy = 'all') {
-    switch (strategy) {
-        case 'race':
-            return executeRace(arms);
-        case 'settle':
-            return executeSettle(arms);
-        default: // 'all' or any other value
-            return executeAll(arms);
-    }
-}
-/**
- * Execute all arms concurrently. Fail if any arm fails.
- */
-async function executeAll(arms) {
-    const startTimes = new Map();
-    const promises = arms.map(async (arm) => {
-        const start = Date.now();
-        startTimes.set(arm.name, start);
-        const result = await arm.execute();
-        return { name: arm.name, result, duration: Date.now() - start };
-    });
-    try {
-        const outcomes = await Promise.all(promises);
-        const results = {};
-        const steps = [];
-        for (const outcome of outcomes) {
-            results[outcome.name] = outcome.result;
-            steps.push({
-                name: outcome.name,
-                type: 'parallel',
-                success: true,
-                output: outcome.result,
-                duration: outcome.duration,
-            });
-        }
-        return { success: true, results, steps };
-    }
-    catch (err) {
-        const error = err instanceof Error ? err.message : String(err);
-        return {
-            success: false,
-            results: {},
-            steps: [
-                {
-                    name: 'parallel:all',
-                    type: 'parallel',
-                    success: false,
-                    error,
-                    duration: 0,
-                },
-            ],
-        };
-    }
-}
-/**
- * Execute all arms concurrently. Return on first completion.
- */
-async function executeRace(arms) {
-    const promises = arms.map(async (arm) => {
-        const start = Date.now();
-        const result = await arm.execute();
-        return { name: arm.name, result, duration: Date.now() - start };
-    });
-    try {
-        const winner = await Promise.race(promises);
-        return {
-            success: true,
-            results: { [winner.name]: winner.result },
-            steps: [
-                {
-                    name: winner.name,
-                    type: 'parallel',
-                    success: true,
-                    output: winner.result,
-                    duration: winner.duration,
-                },
-            ],
-        };
-    }
-    catch (err) {
-        const error = err instanceof Error ? err.message : String(err);
-        return {
-            success: false,
-            results: {},
-            steps: [
-                {
-                    name: 'parallel:race',
-                    type: 'parallel',
-                    success: false,
-                    error,
-                    duration: 0,
-                },
-            ],
-        };
-    }
-}
-/**
- * Execute all arms concurrently. Collect all successes and failures.
- */
-async function executeSettle(arms) {
-    const promises = arms.map(async (arm) => {
-        const start = Date.now();
-        try {
-            const result = await arm.execute();
-            return {
-                name: arm.name,
-                status: 'fulfilled',
-                result,
-                duration: Date.now() - start,
-            };
-        }
-        catch (err) {
-            return {
-                name: arm.name,
-                status: 'rejected',
-                error: err instanceof Error ? err.message : String(err),
-                duration: Date.now() - start,
-            };
-        }
-    });
-    const outcomes = await Promise.all(promises);
-    const successes = [];
-    const failures = [];
-    const results = {};
-    const steps = [];
-    for (const outcome of outcomes) {
-        if (outcome.status === 'fulfilled') {
-            successes.push({ name: outcome.name, result: outcome.result });
-            results[outcome.name] = outcome.result;
-            steps.push({
-                name: outcome.name,
-                type: 'parallel',
-                success: true,
-                output: outcome.result,
-                duration: outcome.duration,
-            });
-        }
-        else {
-            failures.push({ name: outcome.name, error: outcome.error });
-            steps.push({
-                name: outcome.name,
-                type: 'parallel',
-                success: false,
-                error: outcome.error,
-                duration: outcome.duration,
-            });
-        }
-    }
-    return {
-        success: failures.length === 0,
-        results,
-        steps,
-        settleResult: { successes, failures },
-    };
-}
-//# sourceMappingURL=parallel-runner.js.map

package/dist/cant/parallel-runner.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"parallel-runner.js","sourceRoot":"","sources":["../../src/cant/parallel-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAwBH;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAmB,EACnB,WAAyB,KAAK;IAE9B,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,MAAM;YACT,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3B,KAAK,QAAQ;YACX,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC;QAC7B,SAAS,2BAA2B;YAClC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,UAAU,CAAC,IAAmB;IAC3C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,OAAO,GAA4B,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAiB,EAAE,CAAC;QAE/B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/D,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,EAAE;YACX,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,cAAc;oBACpB,IAAI,EAAE,UAAU;oBAChB,OAAO,EAAE,KAAK;oBACd,KAAK;oBACL,QAAQ,EAAE,CAAC;iBACZ;aACF;SACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,WAAW,CAAC,IAAmB;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5C,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YACzC,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,IAAI,EAAE,UAAU;oBAChB,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B;aACF;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/D,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,EAAE;YACX,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,eAAe;oBACrB,IAAI,EAAE,UAAU;oBAChB,OAAO,EAAE,KAAK;oBACd,KAAK;oBACL,QAAQ,EAAE,CAAC;iBACZ;aACF;SACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,aAAa,CAAC,IAAmB;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC;YACnC,OAAO;gBACL,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,WAAoB;gBAC5B,MAAM;gBACN,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;aAC7B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,UAAmB;gBAC3B,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACvD,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;aAC7B,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE7C,MAAM,SAAS,GAA8B,EAAE,CAAC;IAChD,MAAM,QAAQ,GAA6B,EAAE,CAAC;IAC9C,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAiB,EAAE,CAAC;IAE/B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACnC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/D,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;YAC5D,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC9B,OAAO;QACP,KAAK;QACL,YAAY,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;KACtC,CAAC;AACJ,CAAC"}

package/dist/cant/types.js

@@ -1,11 +0,0 @@
-/**
- * Runtime types for the CANT DSL workflow executor.
- *
- * These types are used by the TypeScript workflow execution layer to
- * represent execution results, step outcomes, discretion evaluation
- * contexts, and approval tokens.
- *
- * @see docs/specs/CANT-DSL-SPEC.md Section 7 (Runtime) and Section 8 (Approval Tokens)
- */
-export {};
-//# sourceMappingURL=types.js.map

package/dist/cant/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/cant/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG"}