@decaf-ts/integrations 0.8.0 → 0.10.0

package/lib/cjs/graph/engine/runs/GraphRunService.cjs

@@ -0,0 +1,259 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GraphRunService = void 0;
+/**
+ * @module integrations/graph/engine/runs/GraphRunService
+ * @summary Graph run lifecycle service (DECAF-50 §4.16).
+ * @description Creates, tracks, cancels, and observes graph runs on top of a
+ * {@link GraphRunStore} and {@link GraphRunEventStore}: per-caller run
+ * limits (concurrency buckets keyed by owner or caller key, timeout, event
+ * payload size), fail-closed ownership scoping on every read/cancel,
+ * event-state auto-release after the replay window (SAA-595), and the
+ * sequenced event stream the SSE controller replays.
+ */
+const db_decorators_1 = require("@decaf-ts/db-decorators");
+const graph_1 = require("@decaf-ts/ui-decorators/graph");
+const index_js_1 = require("./index.cjs");
+const GraphRunFingerprint_js_1 = require("./GraphRunFingerprint.cjs");
+const graph_2 = require("@decaf-ts/ui-decorators/graph");
+const ownership_js_1 = require("./ownership.cjs");
+/**
+ * Run lifecycle service (DECAF-50 §4.16): creates, tracks, cancels, and
+ * observes graph runs on top of a {@link GraphRunStore} and
+ * {@link GraphRunEventStore}. Enforces per-caller run limits (concurrency
+ * buckets keyed by owner or caller key, timeout, event payload size), scopes
+ * every read/cancel to the owning user, auto-releases retained event state
+ * after the configured replay window (SAA-595), and exposes the sequenced
+ * event stream the SSE controller replays.
+ */
+class GraphRunService {
+    constructor(engine, runStore, eventStore, options = {}) {
+        this.activeByCaller = new Map();
+        this.callerKeysByRun = new Map();
+        this.releaseTimers = new Map();
+        this.engine = engine;
+        this.runStore = runStore;
+        this.eventStore = eventStore;
+        this.publisher = new index_js_1.GraphRunEventPublisher(eventStore, options.limits);
+        this.executor = new index_js_1.GraphRunExecutor(engine, runStore, this.publisher, { onRunCompleted: options.onRunCompleted }, options.limits);
+        this.options = {
+            ...options,
+            limits: { ...graph_2.DEFAULT_GRAPH_RUN_LIMITS, ...options.limits },
+        };
+    }
+    /** Effective run limits, with defaults applied. */
+    get limits() {
+        return this.options.limits;
+    }
+    /**
+     * Creates and schedules a run for a saved `workflowId` or an inline
+     * workflow document, enforcing the per-caller concurrency limit and
+     * ownership bookkeeping. Returns the queued run immediately; execution
+     * continues in the background.
+     *
+     * `concurrencyKey` buckets anonymous callers for the per-caller
+     * concurrency cap (e.g. a per-IP key from the HTTP layer); it defaults to
+     * the owner user, or `"anonymous"` when both are absent.
+     *
+     * @throws ValidationError when the request carries no workflow identity, a
+     * `workflowId` without a configured resolver, or the per-caller concurrency
+     * limit is exhausted.
+     */
+    async createRun(request, ownerUser, concurrencyKey, ...args) {
+        this.validateCreateRequest(request);
+        const workflowId = request.workflowId ?? request.workflow?.id ?? "";
+        if (!workflowId) {
+            throw new db_decorators_1.ValidationError("Graph run request must carry a workflow document with an id or a saved workflowId");
+        }
+        if (request.workflowId && !this.options.documentResolver) {
+            throw new db_decorators_1.ValidationError("Graph run requests by workflowId require a document resolver");
+        }
+        const callerKey = concurrencyKey ?? ownerUser ?? "anonymous";
+        const activeForCaller = this.activeByCaller.get(callerKey) ?? new Set();
+        if (activeForCaller.size >= this.options.limits.maxConcurrentRuns) {
+            throw new db_decorators_1.ValidationError(`Graph run rejected: the configured limit of ${this.options.limits.maxConcurrentRuns} concurrent runs per caller is exhausted`);
+        }
+        const runId = this.generateRunId();
+        const run = {
+            runId,
+            workflowId,
+            ownerUser,
+            status: "queued",
+            createdAt: new Date().toISOString(),
+        };
+        this.executor.begin(runId);
+        await this.runStore.saveRun({ ...run }, ...args);
+        const provider = this.documentProviderFor(request, ownerUser);
+        activeForCaller.add(runId);
+        this.activeByCaller.set(callerKey, activeForCaller);
+        this.callerKeysByRun.set(runId, callerKey);
+        const completion = this.executor.schedule(run, provider, request.inputs ?? {}, ...args);
+        void completion
+            .catch(() => undefined)
+            .finally(() => this.finishActiveRun(runId));
+        return run;
+    }
+    /** Reads a run, asserting it belongs to `ownerUser`. */
+    async getRun(runId, ownerUser, ...args) {
+        const run = await this.runStore.readRun(runId, ...args);
+        if (!run) {
+            throw new db_decorators_1.NotFoundError(`No graph run found for runId '${runId}'`);
+        }
+        this.assertOwnership(run, ownerUser);
+        return run;
+    }
+    /**
+     * Cancels a non-terminal run: aborts in-flight execution and persists the
+     * `cancelled` status. Terminal runs are returned unchanged.
+     */
+    async cancelRun(runId, ownerUser, ...args) {
+        const run = await this.runStore.readRun(runId, ...args);
+        if (!run) {
+            throw new db_decorators_1.NotFoundError(`No graph run found for runId '${runId}'`);
+        }
+        this.assertOwnership(run, ownerUser);
+        if ((0, graph_2.isGraphRunTerminalStatus)(run.status)) {
+            return run;
+        }
+        this.executor.abort(runId, "user");
+        run.status = "cancelled";
+        run.finishedAt = new Date().toISOString();
+        await this.runStore.saveRun({ ...run }, ...args);
+        return run;
+    }
+    /** Lists a run's event envelopes after the given sequence (ownership-checked). */
+    async listEvents(runId, afterSequence, ownerUser, ...args) {
+        await this.getRun(runId, ownerUser, ...args);
+        return this.eventStore.listAfter(runId, afterSequence);
+    }
+    /** Subscribes a live listener to a run's event stream (ownership-checked); returns an unsubscribe function. */
+    async subscribeEvents(runId, ownerUser, listener, ...args) {
+        await this.getRun(runId, ownerUser, ...args);
+        return this.eventStore.subscribe(runId, listener);
+    }
+    /** Subscribes a listener to a run's event stream without re-reading the run. */
+    subscribeRunEvents(run, listener) {
+        return this.eventStore.subscribe(run.runId, listener);
+    }
+    /** Waits for a scheduled run to finish, then returns its final state. */
+    async waitForRun(runId, ownerUser, ...args) {
+        const completion = this.executor.waitFor(runId);
+        if (completion)
+            await completion;
+        return this.getRun(runId, ownerUser, ...args);
+    }
+    /**
+     * Convenience helper: creates a run and waits for its completion. The
+     * optional `concurrencyKey` is forwarded to {@link createRun} to bucket
+     * anonymous callers for the per-caller concurrency cap.
+     */
+    async executeAndWait(request, ownerUser, concurrencyKey, ...args) {
+        const run = await this.createRun(request, ownerUser, concurrencyKey, ...args);
+        return this.waitForRun(run.runId, ownerUser, ...args);
+    }
+    /**
+     * Releases all per-run bookkeeping for a finished run: caller-bucket
+     * membership, executor state, publisher sequencing, retained event state,
+     * and any pending auto-release timer.
+     */
+    release(runId) {
+        this.finishActiveRun(runId);
+        const pending = this.releaseTimers.get(runId);
+        if (pending) {
+            clearTimeout(pending);
+            this.releaseTimers.delete(runId);
+        }
+        this.executor.release(runId);
+        this.eventStore.release?.(runId);
+    }
+    /**
+     * Removes a run from its caller's concurrency bucket and schedules event
+     * state release after the configured replay window.
+     */
+    finishActiveRun(runId) {
+        const callerKey = this.callerKeysByRun.get(runId);
+        if (callerKey !== undefined) {
+            this.callerKeysByRun.delete(runId);
+            const bucket = this.activeByCaller.get(callerKey);
+            if (bucket) {
+                bucket.delete(runId);
+                if (bucket.size === 0)
+                    this.activeByCaller.delete(callerKey);
+            }
+        }
+        if (this.releaseTimers.has(runId))
+            return;
+        const timer = setTimeout(() => {
+            this.releaseTimers.delete(runId);
+            this.release(runId);
+        }, this.options.limits.eventReplayWindowMs);
+        timer.unref?.();
+        this.releaseTimers.set(runId, timer);
+    }
+    validateCreateRequest(request) {
+        if (!request || typeof request !== "object" || Array.isArray(request)) {
+            throw new db_decorators_1.ValidationError("Graph run request must be an object carrying either a workflow document or a workflowId plus inputs");
+        }
+        const hasDocument = request.workflow !== undefined;
+        const hasWorkflowId = request.workflowId !== undefined;
+        if (hasDocument && hasWorkflowId) {
+            throw new db_decorators_1.ValidationError("Graph run request is ambiguous: supply either an unsaved workflow document or a saved workflowId, not both");
+        }
+        if (!hasDocument && !hasWorkflowId) {
+            throw new db_decorators_1.ValidationError("Graph run request must supply either an unsaved workflow document or a saved workflowId");
+        }
+        if (hasDocument && !(0, graph_1.isGraphWorkflowDocumentShape)(request.workflow)) {
+            throw new db_decorators_1.ValidationError("Graph run request carries a payload that is not a canonical GraphWorkflowDocument");
+        }
+        if (request.inputs !== undefined && !(0, graph_1.isGraphJsonSafeValue)(request.inputs)) {
+            throw new db_decorators_1.ValidationError("Graph run inputs must be JSON-safe: functions, class instances, undefined, NaN/Infinity, symbol keys and unsafe prototype keys (__proto__/prototype/constructor) are rejected");
+        }
+        const bytes = safeJsonLength(request);
+        if (bytes > this.options.limits.maxRequestBytes) {
+            throw new db_decorators_1.ValidationError(`Graph run request of ${bytes} bytes exceeds the configured limit of ${this.options.limits.maxRequestBytes} bytes`);
+        }
+    }
+    documentProviderFor(request, ownerUser) {
+        if (request.workflow) {
+            const document = request.workflow;
+            return async () => ({
+                document,
+                fingerprint: (0, GraphRunFingerprint_js_1.graphRunDocumentFingerprint)(document),
+            });
+        }
+        const workflowId = request.workflowId;
+        return async (...args) => {
+            const resolver = this.options.documentResolver;
+            if (!resolver) {
+                throw new db_decorators_1.ValidationError("Graph run requests by workflowId require a document resolver");
+            }
+            const document = await resolver.resolve(workflowId, ownerUser, ...args);
+            return {
+                document,
+                fingerprint: (0, GraphRunFingerprint_js_1.graphRunDocumentFingerprint)(document),
+            };
+        };
+    }
+    assertOwnership(run, ownerUser) {
+        (0, ownership_js_1.assertGraphResourceOwnership)({ owner: run.ownerUser }, ownerUser, {
+            allowAnonymousAccess: this.options.allowAnonymousAccess === true,
+            resourceKind: "Graph run",
+            resourceId: run.runId,
+        });
+    }
+    generateRunId() {
+        return (globalThis.crypto?.randomUUID?.() ??
+            `graph-run-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+    }
+}
+exports.GraphRunService = GraphRunService;
+function safeJsonLength(value) {
+    try {
+        return JSON.stringify(value)?.length ?? 0;
+    }
+    catch {
+        return Number.MAX_SAFE_INTEGER;
+    }
+}
+//# sourceMappingURL=GraphRunService.js.map
+//# sourceMappingURL=GraphRunService.cjs.map

package/lib/cjs/graph/engine/runs/GraphRunService.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph/engine/runs/GraphRunService.cjs","sourceRoot":"","sources":["graph/engine/runs/GraphRunService.js"],"names":[],"mappings":";;;AAAA;;;;;;;;;GASG;AACH,2DAAyE;AACzE,yDAAoG;AACpG,yCAAuE;AACvE,qEAAuE;AACvE,yDAAoG;AACpG,iDAA8D;AAC9D;;;;;;;;GAQG;AACH,MAAa,eAAe;IACxB,YAAY,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,GAAG,EAAE;QAClD,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,EAAE,CAAC;QAChC,IAAI,CAAC,eAAe,GAAG,IAAI,GAAG,EAAE,CAAC;QACjC,IAAI,CAAC,aAAa,GAAG,IAAI,GAAG,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,iCAAsB,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,GAAG,IAAI,2BAAgB,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACnI,IAAI,CAAC,OAAO,GAAG;YACX,GAAG,OAAO;YACV,MAAM,EAAE,EAAE,GAAG,gCAAwB,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE;SAC7D,CAAC;IACN,CAAC;IACD,mDAAmD;IACnD,IAAI,MAAM;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;IACD;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,IAAI;QACvD,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QACpE,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,MAAM,IAAI,+BAAe,CAAC,mFAAmF,CAAC,CAAC;QACnH,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;YACvD,MAAM,IAAI,+BAAe,CAAC,8DAA8D,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,SAAS,GAAG,cAAc,IAAI,SAAS,IAAI,WAAW,CAAC;QAC7D,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;QACxE,IAAI,eAAe,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAChE,MAAM,IAAI,+BAAe,CAAC,+CAA+C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,0CAA0C,CAAC,CAAC;QAC9J,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG;YACR,KAAK;YACL,UAAU;YACV,SAAS;YACT,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC9D,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QACpD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;QACxF,KAAK,UAAU;aACV,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;aACtB,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;QAChD,OAAO,GAAG,CAAC;IACf,CAAC;IACD,wDAAwD;IACxD,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI;QAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,MAAM,IAAI,6BAAa,CAAC,iCAAiC,KAAK,GAAG,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACrC,OAAO,GAAG,CAAC;IACf,CAAC;IACD;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI;QACrC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,MAAM,IAAI,6BAAa,CAAC,iCAAiC,KAAK,GAAG,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACrC,IAAI,IAAA,gCAAwB,EAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,OAAO,GAAG,CAAC;QACf,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACnC,GAAG,CAAC,MAAM,GAAG,WAAW,CAAC;QACzB,GAAG,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,OAAO,GAAG,CAAC;IACf,CAAC;IACD,kFAAkF;IAClF,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,IAAI;QACrD,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAC3D,CAAC;IACD,+GAA+G;IAC/G,KAAK,CAAC,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI;QACrD,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACtD,CAAC;IACD,gFAAgF;IAChF,kBAAkB,CAAC,GAAG,EAAE,QAAQ;QAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1D,CAAC;IACD,yEAAyE;IACzE,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI;QACtC,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChD,IAAI,UAAU;YACV,MAAM,UAAU,CAAC;QACrB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,CAAC;IAClD,CAAC;IACD;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,IAAI;QAC5D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1D,CAAC;IACD;;;;OAIG;IACH,OAAO,CAAC,KAAK;QACT,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,OAAO,EAAE,CAAC;YACV,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IACD;;;OAGG;IACH,eAAe,CAAC,KAAK;QACjB,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,MAAM,EAAE,CAAC;gBACT,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACrB,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;oBACjB,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9C,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC;YAC7B,OAAO;QACX,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC1B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC5C,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,qBAAqB,CAAC,OAAO;QACzB,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,+BAAe,CAAC,qGAAqG,CAAC,CAAC;QACrI,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC;QACnD,MAAM,aAAa,GAAG,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC;QACvD,IAAI,WAAW,IAAI,aAAa,EAAE,CAAC;YAC/B,MAAM,IAAI,+BAAe,CAAC,4GAA4G,CAAC,CAAC;QAC5I,CAAC;QACD,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,EAAE,CAAC;YACjC,MAAM,IAAI,+BAAe,CAAC,yFAAyF,CAAC,CAAC;QACzH,CAAC;QACD,IAAI,WAAW,IAAI,CAAC,IAAA,oCAA4B,EAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,+BAAe,CAAC,mFAAmF,CAAC,CAAC;QACnH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,IAAA,4BAAoB,EAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,+BAAe,CAAC,+KAA+K,CAAC,CAAC;QAC/M,CAAC;QACD,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;YAC9C,MAAM,IAAI,+BAAe,CAAC,wBAAwB,KAAK,0CAA0C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,QAAQ,CAAC,CAAC;QAClJ,CAAC;IACL,CAAC;IACD,mBAAmB,CAAC,OAAO,EAAE,SAAS;QAClC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACnB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;YAClC,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC;gBAChB,QAAQ;gBACR,WAAW,EAAE,IAAA,oDAA2B,EAAC,QAAQ,CAAC;aACrD,CAAC,CAAC;QACP,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,OAAO,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE;YACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,MAAM,IAAI,+BAAe,CAAC,8DAA8D,CAAC,CAAC;YAC9F,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,CAAC;YACxE,OAAO;gBACH,QAAQ;gBACR,WAAW,EAAE,IAAA,oDAA2B,EAAC,QAAQ,CAAC;aACrD,CAAC;QACN,CAAC,CAAC;IACN,CAAC;IACD,eAAe,CAAC,GAAG,EAAE,SAAS;QAC1B,IAAA,2CAA4B,EAAC,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE;YAC9D,oBAAoB,EAAE,IAAI,CAAC,OAAO,CAAC,oBAAoB,KAAK,IAAI;YAChE,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,GAAG,CAAC,KAAK;SACxB,CAAC,CAAC;IACP,CAAC;IACD,aAAa;QACT,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE;YACrC,aAAa,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;CACJ;AA3ND,0CA2NC;AACD,SAAS,cAAc,CAAC,KAAK;IACzB,IAAI,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,CAAC;QACH,OAAO,MAAM,CAAC,gBAAgB,CAAC;IACnC,CAAC;AACL,CAAC;AACD,2CAA2C"}

package/lib/cjs/graph/engine/runs/InMemoryGraphRunEventStore.cjs

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InMemoryGraphRunEventStore = void 0;
+const graph_1 = require("@decaf-ts/ui-decorators/graph");
+/**
+ * Non-persistent {@link GraphRunEventStore} backed by per-run arrays:
+ * appends notify live subscribers, `listAfter` serves SSE replays, and
+ * retention keeps at most `maxEventsPerRun` envelopes per run — evicting
+ * non-terminal events first so terminal outcomes are never dropped.
+ */
+class InMemoryGraphRunEventStore {
+    constructor(limits = {}) {
+        this.events = new Map();
+        this.listeners = new Map();
+        this.limits = { ...graph_1.DEFAULT_GRAPH_RUN_LIMITS, ...limits };
+    }
+    async append(event) {
+        let list = this.events.get(event.runId);
+        if (!list) {
+            list = [];
+            this.events.set(event.runId, list);
+        }
+        list.push(event);
+        this.enforceRetention(list);
+        for (const listener of this.listeners.get(event.runId) ?? []) {
+            try {
+                listener(event);
+            }
+            catch {
+                // a misbehaving subscriber must not break the append pipeline
+            }
+        }
+    }
+    async listAfter(runId, sequence) {
+        const list = this.events.get(runId);
+        if (!list)
+            return [];
+        return list.filter((event) => event.sequence > sequence);
+    }
+    subscribe(runId, listener) {
+        let set = this.listeners.get(runId);
+        if (!set) {
+            set = new Set();
+            this.listeners.set(runId, set);
+        }
+        set.add(listener);
+        return () => {
+            set.delete(listener);
+            if (set.size === 0)
+                this.listeners.delete(runId);
+        };
+    }
+    release(runId) {
+        this.events.delete(runId);
+        this.listeners.delete(runId);
+    }
+    enforceRetention(list) {
+        const max = this.limits.maxEventsPerRun;
+        while (list.length > max) {
+            const evictIndex = list.findIndex((event) => !(0, graph_1.isGraphRunTerminalEventType)(event.type));
+            if (evictIndex === -1)
+                break;
+            list.splice(evictIndex, 1);
+        }
+    }
+}
+exports.InMemoryGraphRunEventStore = InMemoryGraphRunEventStore;
+//# sourceMappingURL=InMemoryGraphRunEventStore.js.map
+//# sourceMappingURL=InMemoryGraphRunEventStore.cjs.map

package/lib/cjs/graph/engine/runs/InMemoryGraphRunEventStore.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph/engine/runs/InMemoryGraphRunEventStore.cjs","sourceRoot":"","sources":["graph/engine/runs/InMemoryGraphRunEventStore.js"],"names":[],"mappings":";;;AAAA,yDAAuG;AACvG;;;;;GAKG;AACH,MAAa,0BAA0B;IACnC,YAAY,MAAM,GAAG,EAAE;QACnB,IAAI,CAAC,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,gCAAwB,EAAE,GAAG,MAAM,EAAE,CAAC;IAC7D,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,KAAK;QACd,IAAI,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,IAAI,GAAG,EAAE,CAAC;YACV,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAC3D,IAAI,CAAC;gBACD,QAAQ,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;YACD,MAAM,CAAC;gBACH,8DAA8D;YAClE,CAAC;QACL,CAAC;IACL,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ;QAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YACL,OAAO,EAAE,CAAC;QACd,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC,CAAC;IAC7D,CAAC;IACD,SAAS,CAAC,KAAK,EAAE,QAAQ;QACrB,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClB,OAAO,GAAG,EAAE;YACR,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrB,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC;gBACd,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC,CAAC;IACN,CAAC;IACD,OAAO,CAAC,KAAK;QACT,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IACD,gBAAgB,CAAC,IAAI;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;QACxC,OAAO,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACvB,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAA,mCAA2B,EAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACvF,IAAI,UAAU,KAAK,CAAC,CAAC;gBACjB,MAAM;YACV,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAC/B,CAAC;IACL,CAAC;CACJ;AAvDD,gEAuDC;AACD,sDAAsD"}

package/lib/cjs/graph/engine/runs/InMemoryGraphRunStore.cjs

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InMemoryGraphRunStore = void 0;
+/**
+ * Non-persistent {@link GraphRunStore} backed by a `Map`: serves tests and
+ * in-process deployments. Runs are cloned on save/read so callers never
+ * share mutable references with the store.
+ */
+class InMemoryGraphRunStore {
+    constructor() {
+        this.runs = new Map();
+    }
+    async saveRun(run) {
+        this.runs.set(run.runId, { ...run });
+    }
+    async readRun(runId) {
+        const run = this.runs.get(runId);
+        return run ? { ...run } : null;
+    }
+    release(runId) {
+        this.runs.delete(runId);
+    }
+}
+exports.InMemoryGraphRunStore = InMemoryGraphRunStore;
+//# sourceMappingURL=InMemoryGraphRunStore.js.map
+//# sourceMappingURL=InMemoryGraphRunStore.cjs.map

package/lib/cjs/graph/engine/runs/InMemoryGraphRunStore.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph/engine/runs/InMemoryGraphRunStore.cjs","sourceRoot":"","sources":["graph/engine/runs/InMemoryGraphRunStore.js"],"names":[],"mappings":";;;AAAA;;;;GAIG;AACH,MAAa,qBAAqB;IAC9B;QACI,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;IAC1B,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,GAAG;QACb,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;IACzC,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,KAAK;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;IACD,OAAO,CAAC,KAAK;QACT,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;CACJ;AAdD,sDAcC;AACD,iDAAiD"}

package/lib/cjs/graph/engine/runs/index.cjs

@@ -0,0 +1,26 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./types.cjs"), exports);
+__exportStar(require("./ownership.cjs"), exports);
+__exportStar(require("./GraphRunFingerprint.cjs"), exports);
+__exportStar(require("./InMemoryGraphRunEventStore.cjs"), exports);
+__exportStar(require("./InMemoryGraphRunStore.cjs"), exports);
+__exportStar(require("./GraphRunEventPublisher.cjs"), exports);
+__exportStar(require("./GraphRunExecutor.cjs"), exports);
+__exportStar(require("./GraphRunService.cjs"), exports);
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.cjs.map

package/lib/cjs/graph/engine/runs/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph/engine/runs/index.cjs","sourceRoot":"","sources":["graph/engine/runs/index.js"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,6CAA2B;AAC3B,iDAA+B;AAC/B,2DAAyC;AACzC,kEAAgD;AAChD,6DAA2C;AAC3C,8DAA4C;AAC5C,wDAAsC;AACtC,uDAAqC;AACrC,iCAAiC"}

package/lib/cjs/graph/engine/runs/ownership.cjs

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertGraphResourceOwnership = assertGraphResourceOwnership;
+const core_1 = require("@decaf-ts/core");
+/**
+ * Centralized graph resource ownership check (SAA-595 security hardening).
+ *
+ * Fail-closed by default: a resource that carries an owner is only accessible
+ * to that owner; an absent caller identity is denied unless the explicit
+ * `allowAnonymousAccess` tolerance (DECAF-48 §4.15 standalone runs) is set.
+ * Owner-less resources remain accessible to everyone.
+ *
+ * @param resource - The guarded resource (or its persisted record); only its
+ *   `owner` member is read. `null`/`undefined` counts as owner-less.
+ * @param callerOwner - Identity of the caller resolved from the request
+ *   context; `null`/`undefined`/`""` represent anonymous callers.
+ * @param options - `resourceKind`/`resourceId` name the resource in the
+ *   denial message; `allowAnonymousAccess` opts in to the DECAF-48 §4.15
+ *   standalone tolerance (default `false`).
+ * @throws ForbiddenError when the resource is owned and the caller is a
+ *   different user, or an anonymous caller without the explicit tolerance.
+ */
+function assertGraphResourceOwnership(resource, callerOwner, options) {
+    const owner = resource?.owner ?? null;
+    if (!owner || owner === callerOwner)
+        return;
+    if ((callerOwner === undefined || callerOwner === null || callerOwner === "") &&
+        options.allowAnonymousAccess === true) {
+        return;
+    }
+    throw new core_1.ForbiddenError(`${options.resourceKind} '${options.resourceId}' is owned by another user`);
+}
+//# sourceMappingURL=ownership.js.map
+//# sourceMappingURL=ownership.cjs.map

package/lib/cjs/graph/engine/runs/ownership.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph/engine/runs/ownership.cjs","sourceRoot":"","sources":["graph/engine/runs/ownership.js"],"names":[],"mappings":";;AAmBA,oEASC;AA5BD,yCAAgD;AAChD;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,4BAA4B,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO;IACvE,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,IAAI,IAAI,CAAC;IACtC,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,WAAW;QAC/B,OAAO;IACX,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,EAAE,CAAC;QACzE,OAAO,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QACxC,OAAO;IACX,CAAC;IACD,MAAM,IAAI,qBAAc,CAAC,GAAG,OAAO,CAAC,YAAY,KAAK,OAAO,CAAC,UAAU,4BAA4B,CAAC,CAAC;AACzG,CAAC;AACD,qCAAqC"}

package/lib/cjs/graph/engine/runs/types.cjs

@@ -0,0 +1,4 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map
+//# sourceMappingURL=types.cjs.map

package/lib/cjs/graph/engine/runs/types.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph/engine/runs/types.cjs","sourceRoot":"","sources":["graph/engine/runs/types.js"],"names":[],"mappings":";;AACA,iCAAiC"}

package/lib/cjs/graph/engine/snapshots/GraphExecutionSnapshotMapper.cjs

@@ -6,7 +6,7 @@ exports.GraphExecutionSnapshotMapper = void 0;
  * @summary Maps execution results to snapshot patches.
  * @description Produces a GraphExecutionSnapshotPatch consumable by `@decaf-ts/ui-decorators/graph` snapshots, rather than replacing the snapshot system.
  */
-const constants_js_1 = require("./../../shared/constants.cjs");
+const graph_1 = require("@decaf-ts/ui-decorators/graph");
 /**
  * Maps a {@link GraphExecutionResult} to a {@link GraphExecutionSnapshotPatch}.
  */
@@ -31,7 +31,7 @@ class GraphExecutionSnapshotMapper {
         for (const event of result.events) {
             if (event.edgeId && event.type === "edge.valueRouted") {
                 edges[event.edgeId] = {
-                    status: constants_js_1.GraphExecutionStatus.SUCCEEDED,
+                    status: graph_1.GraphExecutionStatus.SUCCEEDED,
                     lastValue: event.payload?.value,
                     updatedAt: event.timestamp.toISOString(),
                 };

package/lib/cjs/graph/engine/snapshots/GraphExecutionSnapshotMapper.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"graph/engine/snapshots/GraphExecutionSnapshotMapper.cjs","sourceRoot":"","sources":["graph/engine/snapshots/GraphExecutionSnapshotMapper.js"],"names":[],"mappings":";;;AAAA;;;;GAIG;AACH,8DAAmE;AACnE;;GAEG;AACH,MAAa,4BAA4B;IACrC;;OAEG;IACH,GAAG,CAAC,MAAM;QACN,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,KAAK,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAChE,KAAK,CAAC,EAAE,CAAC,GAAG;gBACR,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,WAAW,EAAE;gBAC9C,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,WAAW,EAAE;gBAChD,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC5B,CAAC;QACN,CAAC;QACD,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBACpD,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG;oBAClB,MAAM,EAAE,mCAAoB,CAAC,SAAS;oBACtC,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK;oBAC/B,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;iBAC3C,CAAC;YACN,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO;YACH,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK;YACL,KAAK;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM;SACT,CAAC;IACN,CAAC;CACJ;AArCD,oEAqCC;AACD,wDAAwD"}
+{"version":3,"file":"graph/engine/snapshots/GraphExecutionSnapshotMapper.cjs","sourceRoot":"","sources":["graph/engine/snapshots/GraphExecutionSnapshotMapper.js"],"names":[],"mappings":";;;AAAA;;;;GAIG;AACH,yDAAqE;AACrE;;GAEG;AACH,MAAa,4BAA4B;IACrC;;OAEG;IACH,GAAG,CAAC,MAAM;QACN,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,KAAK,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YAChE,KAAK,CAAC,EAAE,CAAC,GAAG;gBACR,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,WAAW,EAAE;gBAC9C,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,WAAW,EAAE;gBAChD,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC5B,CAAC;QACN,CAAC;QACD,MAAM,KAAK,GAAG,EAAE,CAAC;QACjB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBACpD,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG;oBAClB,MAAM,EAAE,4BAAoB,CAAC,SAAS;oBACtC,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK;oBAC/B,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;iBAC3C,CAAC;YACN,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO;YACH,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK;YACL,KAAK;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM;SACT,CAAC;IACN,CAAC;CACJ;AArCD,oEAqCC;AACD,wDAAwD"}

package/lib/cjs/graph/engine/validation/GraphConnectionPolicyValidator.cjs

@@ -0,0 +1,142 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GraphConnectionPolicyValidator = void 0;
+/**
+ * Validates connection policies and edge-level structural conflicts.
+ */
+class GraphConnectionPolicyValidator {
+    /**
+     * Stage 6 — connection policies and counts. Operates on the resolved
+     * workflow (stage 5 output). Records issues; never mutates the graph.
+     */
+    validate(workflow, issues) {
+        this.validateDuplicates(workflow.edges, issues);
+        this.validatePolicies(workflow, issues);
+    }
+    /**
+     * Conflicting duplicate edges: two edges with identical flattened
+     * endpoints (`source:port -> target:port`) are rejected, whatever their
+     * ids.
+     */
+    validateDuplicates(edges, issues) {
+        const seen = new Map();
+        for (const edge of edges) {
+            const key = `${edge.sourceNodeId}:${edge.sourcePort}->${edge.targetNodeId}:${edge.targetPort}`;
+            const previous = seen.get(key);
+            if (previous) {
+                issues.push({
+                    code: "connection.duplicate-edge",
+                    path: `edges[${edge.id}]`,
+                    message: `Edge '${edge.id}' duplicates the routing of edge '${previous.id}' (${key})`,
+                    edgeId: edge.id,
+                    details: { duplicateOf: previous.id, routing: key },
+                });
+                continue;
+            }
+            seen.set(key, edge);
+        }
+    }
+    /**
+     * Port-declared connection policies: kind allow/block lists, port
+     * categories, self-connections, and connection counts.
+     */
+    validatePolicies(workflow, issues) {
+        const connectionsByPort = new Map();
+        for (const edge of workflow.edges) {
+            if (edge.type !== "connection")
+                continue;
+            const key = `${edge.targetNodeId}:${edge.targetPort}`;
+            const list = connectionsByPort.get(key) ?? [];
+            list.push(edge);
+            connectionsByPort.set(key, list);
+        }
+        for (const edge of workflow.edges) {
+            if (edge.type !== "connection")
+                continue;
+            const target = workflow.nodeById.get(edge.targetNodeId);
+            const policy = target?.manifest.connections?.find((candidate) => candidate.id === edge.targetPort)?.connectionPolicy;
+            this.validateEdgePolicy(edge, workflow.nodeById, policy, issues);
+        }
+        for (const [key, connections] of connectionsByPort) {
+            const separator = key.lastIndexOf(":");
+            const nodeId = key.slice(0, separator);
+            const portId = key.slice(separator + 1);
+            const target = workflow.nodeById.get(nodeId);
+            const policy = target?.manifest.connections?.find((candidate) => candidate.id === portId)?.connectionPolicy;
+            if (!policy)
+                continue;
+            const max = policy.maxConnections !== undefined
+                ? policy.maxConnections
+                : policy.allowMultiple === false
+                    ? 1
+                    : Number.POSITIVE_INFINITY;
+            if (connections.length > max) {
+                issues.push({
+                    code: "connection.max-connections",
+                    path: `edges[${connections[connections.length - 1].id}]`,
+                    message: `Connection port '${portId}' on node '${nodeId}' accepts at most ${max} connection(s) but has ${connections.length}`,
+                    nodeId,
+                    edgeId: connections[connections.length - 1].id,
+                    details: { port: portId, max, actual: connections.length },
+                });
+            }
+        }
+    }
+    validateEdgePolicy(edge, nodeById, policy, issues) {
+        // Self-connections are rejected unless the policy allows them.
+        if (edge.sourceNodeId === edge.targetNodeId) {
+            if (!policy?.allowSelf) {
+                issues.push({
+                    code: "connection.self-connection",
+                    path: `edges[${edge.id}]`,
+                    message: `Edge '${edge.id}' connects node '${edge.sourceNodeId}' to itself, which the target port policy does not allow`,
+                    edgeId: edge.id,
+                    nodeId: edge.sourceNodeId,
+                });
+                return;
+            }
+        }
+        if (!policy)
+            return;
+        const source = nodeById.get(edge.sourceNodeId);
+        const sourceKind = source?.manifest.kind;
+        if (policy.allowedNodeKinds?.length &&
+            (!sourceKind || !policy.allowedNodeKinds.includes(sourceKind))) {
+            issues.push({
+                code: "connection.policy",
+                path: `edges[${edge.id}]`,
+                message: `Connection edge '${edge.id}' source kind '${sourceKind ?? "unknown"}' is not in the allowed node kinds of target port '${edge.targetPort}'`,
+                edgeId: edge.id,
+                nodeId: edge.sourceNodeId,
+                details: { allowedNodeKinds: policy.allowedNodeKinds },
+            });
+        }
+        if (sourceKind && policy.blockedNodeKinds?.includes(sourceKind)) {
+            issues.push({
+                code: "connection.policy",
+                path: `edges[${edge.id}]`,
+                message: `Connection edge '${edge.id}' source kind '${sourceKind}' is blocked by target port '${edge.targetPort}'`,
+                edgeId: edge.id,
+                nodeId: edge.sourceNodeId,
+                details: { blockedNodeKinds: policy.blockedNodeKinds },
+            });
+        }
+        if (policy.allowedPortCategories?.length) {
+            const sourcePortCategory = source?.manifest.connections?.find((candidate) => candidate.id === edge.sourcePort)?.category;
+            if (!sourcePortCategory ||
+                !policy.allowedPortCategories.includes(sourcePortCategory)) {
+                issues.push({
+                    code: "connection.policy",
+                    path: `edges[${edge.id}]`,
+                    message: `Connection edge '${edge.id}' source port '${edge.sourcePort}' category '${sourcePortCategory ?? "unknown"}' is not in the allowed port categories of target port '${edge.targetPort}'`,
+                    edgeId: edge.id,
+                    nodeId: edge.sourceNodeId,
+                    details: { allowedPortCategories: policy.allowedPortCategories },
+                });
+            }
+        }
+    }
+}
+exports.GraphConnectionPolicyValidator = GraphConnectionPolicyValidator;
+//# sourceMappingURL=GraphConnectionPolicyValidator.js.map
+//# sourceMappingURL=GraphConnectionPolicyValidator.cjs.map

package/lib/cjs/graph/engine/validation/GraphConnectionPolicyValidator.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph/engine/validation/GraphConnectionPolicyValidator.cjs","sourceRoot":"","sources":["graph/engine/validation/GraphConnectionPolicyValidator.js"],"names":[],"mappings":";;;AAAA;;GAEG;AACH,MAAa,8BAA8B;IACvC;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM;QACrB,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD;;;;OAIG;IACH,kBAAkB,CAAC,KAAK,EAAE,MAAM;QAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC/F,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,QAAQ,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,2BAA2B;oBACjC,IAAI,EAAE,SAAS,IAAI,CAAC,EAAE,GAAG;oBACzB,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,qCAAqC,QAAQ,CAAC,EAAE,MAAM,GAAG,GAAG;oBACrF,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,OAAO,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE;iBACtD,CAAC,CAAC;gBACH,SAAS;YACb,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACxB,CAAC;IACL,CAAC;IACD;;;OAGG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM;QAC7B,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAE,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAChC,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;gBAC1B,SAAS;YACb,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACtD,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChB,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAChC,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY;gBAC1B,SAAS;YACb,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,MAAM,EAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;YACrH,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACrE,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,iBAAiB,EAAE,CAAC;YACjD,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC7C,MAAM,MAAM,GAAG,MAAM,EAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,gBAAgB,CAAC;YAC5G,IAAI,CAAC,MAAM;gBACP,SAAS;YACb,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,KAAK,SAAS;gBAC3C,CAAC,CAAC,MAAM,CAAC,cAAc;gBACvB,CAAC,CAAC,MAAM,CAAC,aAAa,KAAK,KAAK;oBAC5B,CAAC,CAAC,CAAC;oBACH,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC;YACnC,IAAI,WAAW,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,4BAA4B;oBAClC,IAAI,EAAE,SAAS,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;oBACxD,OAAO,EAAE,oBAAoB,MAAM,cAAc,MAAM,qBAAqB,GAAG,0BAA0B,WAAW,CAAC,MAAM,EAAE;oBAC7H,MAAM;oBACN,MAAM,EAAE,WAAW,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE;oBAC9C,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE;iBAC7D,CAAC,CAAC;YACP,CAAC;QACL,CAAC;IACL,CAAC;IACD,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM;QAC7C,+DAA+D;QAC/D,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;gBACrB,MAAM,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,4BAA4B;oBAClC,IAAI,EAAE,SAAS,IAAI,CAAC,EAAE,GAAG;oBACzB,OAAO,EAAE,SAAS,IAAI,CAAC,EAAE,oBAAoB,IAAI,CAAC,YAAY,0DAA0D;oBACxH,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,MAAM,EAAE,IAAI,CAAC,YAAY;iBAC5B,CAAC,CAAC;gBACH,OAAO;YACX,CAAC;QACL,CAAC;QACD,IAAI,CAAC,MAAM;YACP,OAAO;QACX,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC;QACzC,IAAI,MAAM,CAAC,gBAAgB,EAAE,MAAM;YAC/B,CAAC,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,mBAAmB;gBACzB,IAAI,EAAE,SAAS,IAAI,CAAC,EAAE,GAAG;gBACzB,OAAO,EAAE,oBAAoB,IAAI,CAAC,EAAE,kBAAkB,UAAU,IAAI,SAAS,sDAAsD,IAAI,CAAC,UAAU,GAAG;gBACrJ,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,MAAM,EAAE,IAAI,CAAC,YAAY;gBACzB,OAAO,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE;aACzD,CAAC,CAAC;QACP,CAAC;QACD,IAAI,UAAU,IAAI,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9D,MAAM,CAAC,IAAI,CAAC;gBACR,IAAI,EAAE,mBAAmB;gBACzB,IAAI,EAAE,SAAS,IAAI,CAAC,EAAE,GAAG;gBACzB,OAAO,EAAE,oBAAoB,IAAI,CAAC,EAAE,kBAAkB,UAAU,gCAAgC,IAAI,CAAC,UAAU,GAAG;gBAClH,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,MAAM,EAAE,IAAI,CAAC,YAAY;gBACzB,OAAO,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE;aACzD,CAAC,CAAC;QACP,CAAC;QACD,IAAI,MAAM,CAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;YACvC,MAAM,kBAAkB,GAAG,MAAM,EAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC;YACzH,IAAI,CAAC,kBAAkB;gBACnB,CAAC,MAAM,CAAC,qBAAqB,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,mBAAmB;oBACzB,IAAI,EAAE,SAAS,IAAI,CAAC,EAAE,GAAG;oBACzB,OAAO,EAAE,oBAAoB,IAAI,CAAC,EAAE,kBAAkB,IAAI,CAAC,UAAU,eAAe,kBAAkB,IAAI,SAAS,2DAA2D,IAAI,CAAC,UAAU,GAAG;oBAChM,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,MAAM,EAAE,IAAI,CAAC,YAAY;oBACzB,OAAO,EAAE,EAAE,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,EAAE;iBACnE,CAAC,CAAC;YACP,CAAC;QACL,CAAC;IACL,CAAC;CACJ;AApID,wEAoIC;AACD,0DAA0D"}