@nexusclawhq/cli 0.2.1

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/executable-package-validation.types.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateExecutablePackageArtifactResultSchema = exports.validateExecutablePackageArtifactInputSchema = exports.EXECUTABLE_PACKAGE_VALIDATION_RESULT_VERSION = exports.EXECUTABLE_PACKAGE_VALIDATION_INPUT_VERSION = void 0;
+exports.EXECUTABLE_PACKAGE_VALIDATION_INPUT_VERSION = 'nexusclaw.validate-executable-package-artifact-input/v1';
+exports.EXECUTABLE_PACKAGE_VALIDATION_RESULT_VERSION = 'nexusclaw.validate-executable-package-artifact-result/v1';
+const digestSchema = { type: 'string', pattern: '^sha256:[a-f0-9]{64}$' };
+/** Pure JSON Schema contract; no GraphQLJSON, filesystem path or byte field. */
+exports.validateExecutablePackageArtifactInputSchema = {
+    $id: exports.EXECUTABLE_PACKAGE_VALIDATION_INPUT_VERSION,
+    type: 'object',
+    additionalProperties: false,
+    required: [
+        'schemaVersion', 'targetWorkspaceId', 'stagedArtifactId',
+        'expectedArchiveDigest', 'expectedPackageDigest', 'contextManifestContentDigest',
+    ],
+    properties: {
+        schemaVersion: { const: exports.EXECUTABLE_PACKAGE_VALIDATION_INPUT_VERSION },
+        targetWorkspaceId: { type: 'string', minLength: 1 },
+        stagedArtifactId: { type: 'string', minLength: 1 },
+        expectedArchiveDigest: digestSchema,
+        expectedPackageDigest: digestSchema,
+        contextManifestContentDigest: digestSchema,
+    },
+};
+exports.validateExecutablePackageArtifactResultSchema = {
+    $id: exports.EXECUTABLE_PACKAGE_VALIDATION_RESULT_VERSION,
+    type: 'object',
+    additionalProperties: false,
+    required: [
+        'schemaVersion', 'valid', 'stagedArtifactId', 'archiveDigest',
+        'packageDigest', 'contextManifestContentDigest', 'diagnostics',
+    ],
+    properties: {
+        schemaVersion: { const: exports.EXECUTABLE_PACKAGE_VALIDATION_RESULT_VERSION },
+        valid: { type: 'boolean' },
+        stagedArtifactId: { type: 'string', minLength: 1 },
+        archiveDigest: digestSchema,
+        packageDigest: digestSchema,
+        contextManifestContentDigest: digestSchema,
+        diagnostics: {
+            type: 'array',
+            items: {
+                type: 'object',
+                additionalProperties: false,
+                required: ['code', 'severity', 'phase', 'message', 'retryable'],
+                properties: {
+                    code: { type: 'string' },
+                    severity: { enum: ['error', 'warning', 'info'] },
+                    phase: { type: 'string' },
+                    artifactId: { type: 'string' },
+                    file: { type: 'string' },
+                    line: { type: 'integer', minimum: 1 },
+                    column: { type: 'integer', minimum: 1 },
+                    jsonPath: { type: 'string' },
+                    ruleId: { type: 'string' },
+                    message: { type: 'string' },
+                    fixHint: { type: 'string' },
+                    retryable: { type: 'boolean' },
+                    docsRef: { type: 'string' },
+                },
+            },
+        },
+    },
+};
+//# sourceMappingURL=executable-package-validation.types.js.map

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/executable-package-validation.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executable-package-validation.types.js","sourceRoot":"","sources":["../../src/agent-executable-assets/executable-package-validation.types.ts"],"names":[],"mappings":";;;AAGa,QAAA,2CAA2C,GACtD,yDAAkE,CAAC;AACxD,QAAA,4CAA4C,GACvD,0DAAmE,CAAC;AAqBtE,MAAM,YAAY,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,uBAAuB,EAAW,CAAC;AAEnF,gFAAgF;AACnE,QAAA,4CAA4C,GAAG;IAC1D,GAAG,EAAE,mDAA2C;IAChD,IAAI,EAAE,QAAQ;IACd,oBAAoB,EAAE,KAAK;IAC3B,QAAQ,EAAE;QACR,eAAe,EAAE,mBAAmB,EAAE,kBAAkB;QACxD,uBAAuB,EAAE,uBAAuB,EAAE,8BAA8B;KACjF;IACD,UAAU,EAAE;QACV,aAAa,EAAE,EAAE,KAAK,EAAE,mDAA2C,EAAE;QACrE,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;QACnD,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;QAClD,qBAAqB,EAAE,YAAY;QACnC,qBAAqB,EAAE,YAAY;QACnC,4BAA4B,EAAE,YAAY;KAC3C;CACO,CAAC;AAEE,QAAA,6CAA6C,GAAG;IAC3D,GAAG,EAAE,oDAA4C;IACjD,IAAI,EAAE,QAAQ;IACd,oBAAoB,EAAE,KAAK;IAC3B,QAAQ,EAAE;QACR,eAAe,EAAE,OAAO,EAAE,kBAAkB,EAAE,eAAe;QAC7D,eAAe,EAAE,8BAA8B,EAAE,aAAa;KAC/D;IACD,UAAU,EAAE;QACV,aAAa,EAAE,EAAE,KAAK,EAAE,oDAA4C,EAAE;QACtE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC1B,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;QAClD,aAAa,EAAE,YAAY;QAC3B,aAAa,EAAE,YAAY;QAC3B,4BAA4B,EAAE,YAAY;QAC1C,WAAW,EAAE;YACX,IAAI,EAAE,OAAO;YACb,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,oBAAoB,EAAE,KAAK;gBAC3B,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC;gBAC/D,UAAU,EAAE;oBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACxB,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE;oBAChD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACzB,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC9B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACxB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE;oBACrC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE;oBACvC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC5B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC3B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC3B,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;oBAC9B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAC5B;aACF;SACF;KACF;CACO,CAAC"}

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/flow-payload-v2.types.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Flow payload/v2 contracts. `payload/v2`.
+ *
+ * Frozen by executable-asset design §15.1-15.4. v2 is a SEPARATE envelope — it
+ * does NOT extend the frozen `payload/v1` union. v1 stays compatible; v2 adds
+ * the `INVOKE_UNIT` engine-native ACTION setting and the `invoke_action` rule
+ * sugar that compiles to it. Real execution wiring is fixed as
+ * `FlowExecutionEngine → ActionNodeExecutor → InvokableActionNodeExecutorService
+ * → ToolRegistry` (design §3.6, R-11.13).
+ */
+import { APPROVAL_SUBJECT_DECIDED_EVENT } from './contract-versions';
+import type { JsonValue } from './json-value';
+import type { ActionRiskLevel } from './code-action.types';
+/** Frozen payload envelope discriminator. */
+export declare const FLOW_PAYLOAD_V2_VERSION: "payload/v2";
+/** Engine-native ACTION setting kind. */
+export type FlowActionTypeV2 = 'INVOKE_UNIT';
+/**
+ * ACTION setting added in v2. `actionType: INVOKE_UNIT` resolves
+ * `action:<toolName>` to an exact candidate/active descriptor — never to a
+ * function id or "current name". Input mappings are declarative context-path /
+ * literal mappings; output writes to exactly one `outputVariableName`.
+ */
+export interface FlowInvokeUnitActionSettingV2 {
+    readonly actionType: 'INVOKE_UNIT';
+    /** `action:<toolName>`; resolves to exact descriptor. */
+    readonly unitId: `action:${string}`;
+    readonly inputMappings: ReadonlyArray<FlowInputMappingV2>;
+    readonly outputVariableName: string;
+    readonly onError: 'fail' | 'fault_path';
+    readonly faultEdgeHandle?: 'fault';
+}
+/**
+ * Declarative input mapping. Canonical RFC 6901 targets; duplicate targets and
+ * ancestor/descendant overlap are rejected at compile (design §15.2, R-11.13).
+ */
+export interface FlowInputMappingV2 {
+    readonly targetJsonPointer: string;
+    readonly source: {
+        readonly kind: 'context_path';
+        readonly path: string;
+    } | {
+        readonly kind: 'literal';
+        readonly value: JsonValue;
+    };
+}
+/** Error policy: `fail` or follow exactly one explicit `fault` edge. */
+export type FlowErrorPolicyV2 = {
+    readonly kind: 'fail';
+} | {
+    readonly kind: 'fault_path';
+    readonly faultEdgeId: string;
+};
+/** Fault marker written to the step log on failure; redacted, follows one edge. */
+export interface FlowFaultMarkerV2 {
+    readonly $fault: {
+        readonly code: string;
+        readonly message: string;
+        readonly toolCallId: string | null;
+        readonly failedNodeId: string;
+    };
+}
+/** Rule-sugar action type that compiles to `INVOKE_UNIT` (design §15.3). */
+export type FlowRuleSugarActionTypeV2 = 'invoke_action';
+/**
+ * Immutable Flow revision identity. The source lock uses the content-addressed
+ * `flowRevisionKey + definitionHash`; stage materialises to the exact
+ * `WorkflowVersion.id`. Mutable version display name is NOT identity.
+ */
+export interface FlowRevisionIdentityV1 {
+    readonly flowApiName: string;
+    readonly flowRevisionKey: `sha256:${string}`;
+    readonly definitionHash: `sha256:${string}`;
+    readonly workflowVersionId?: string;
+}
+/** WorkflowVersion v2 lifecycle (design §11.5, R-11.12). */
+export type WorkflowVersionLifecycleStatus = 'DRAFT' | 'CANDIDATE' | 'RELEASED' | 'ACTIVE';
+/**
+ * Approval subject decision outbox event. Fixed as
+ * `approval.subject.decided.v1`. Approval decision/outbox event is the single
+ * resume signal for an L3 Flow ACTION WAIT checkpoint; approve creates exactly
+ * one FunctionExecution, never a second ToolCall (R-11.14).
+ */
+export interface ApprovalSubjectDecidedEventV1 {
+    readonly eventType: typeof APPROVAL_SUBJECT_DECIDED_EVENT;
+    readonly workspaceId: string;
+    readonly approvalInstanceId: string;
+    readonly subjectType: 'agent_tool' | 'flow_tool' | 'workforce_release';
+    readonly subjectId: string;
+    readonly toolCallId: string | null;
+    readonly decision: 'approved' | 'rejected' | 'expired';
+    readonly decisionVersion: number;
+    readonly governanceContextDigest: `sha256:${string}`;
+    readonly actor: {
+        readonly kind: 'human';
+        readonly userId: string;
+    } | {
+        readonly kind: 'system_expiry';
+        readonly owner: 'ApprovalExpirySweep';
+        readonly runId: string;
+    };
+    readonly decidedAt: string;
+}
+/** Flow binding risk floor (v1 forbids L4 on Flow invocation). */
+export type FlowBindingRiskLevelV2 = Exclude<ActionRiskLevel, 'L4'>;

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/flow-payload-v2.types.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FLOW_PAYLOAD_V2_VERSION = void 0;
+/**
+ * Flow payload/v2 contracts. `payload/v2`.
+ *
+ * Frozen by executable-asset design §15.1-15.4. v2 is a SEPARATE envelope — it
+ * does NOT extend the frozen `payload/v1` union. v1 stays compatible; v2 adds
+ * the `INVOKE_UNIT` engine-native ACTION setting and the `invoke_action` rule
+ * sugar that compiles to it. Real execution wiring is fixed as
+ * `FlowExecutionEngine → ActionNodeExecutor → InvokableActionNodeExecutorService
+ * → ToolRegistry` (design §3.6, R-11.13).
+ */
+const contract_versions_1 = require("./contract-versions");
+/** Frozen payload envelope discriminator. */
+exports.FLOW_PAYLOAD_V2_VERSION = contract_versions_1.FLOWS_PAYLOAD_V2;
+//# sourceMappingURL=flow-payload-v2.types.js.map

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/flow-payload-v2.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-payload-v2.types.js","sourceRoot":"","sources":["../../src/agent-executable-assets/flow-payload-v2.types.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;GASG;AACH,2DAAuF;AAIvF,6CAA6C;AAChC,QAAA,uBAAuB,GAAG,oCAAgB,CAAC"}

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/flow-v2-canonical.d.ts

@@ -0,0 +1,33 @@
+import { type JsonObject } from './json-value';
+import type { FlowInputMappingV2, FlowRevisionIdentityV1 } from './flow-payload-v2.types';
+/**
+ * The content-addressed Flow definition shape frozen by design §5.3/§10.3.
+ * Display names, database ids, timestamps and lifecycle status are excluded.
+ */
+export interface FlowRevisionDefinitionV2 {
+    readonly trigger: JsonObject | null;
+    readonly nodes: ReadonlyArray<JsonObject>;
+    readonly edges: ReadonlyArray<JsonObject>;
+}
+/** Parse and canonicalize one non-root RFC 6901 JSON Pointer. */
+export declare function canonicalizeFlowJsonPointer(pointer: string): {
+    readonly pointer: string;
+    readonly segments: ReadonlyArray<string>;
+};
+/**
+ * Normalize and sort mappings by canonical pointer UTF-8 byte order. Duplicate
+ * targets and ancestor/descendant targets are rejected after pointer unescape.
+ */
+export declare function normalizeFlowInputMappings(mappings: ReadonlyArray<FlowInputMappingV2>): FlowInputMappingV2[];
+/** Build the mapped JSON object in the same canonical order used for hashing. */
+export declare function buildCanonicalFlowMappedInput(mappings: ReadonlyArray<FlowInputMappingV2>, resolveContextPath: (path: string) => unknown): JsonObject;
+/**
+ * Normalize the immutable Flow definition. Nodes and edges are set-like at
+ * this level; explicitly ordered arrays inside settings retain their order,
+ * except INVOKE_UNIT inputMappings which have their own canonical order.
+ */
+export declare function normalizeFlowRevisionDefinition(definition: FlowRevisionDefinitionV2): FlowRevisionDefinitionV2;
+/** Compute both frozen Flow hashes from one normalized definition. */
+export declare function computeFlowRevisionIdentity(flowApiName: string, definition: FlowRevisionDefinitionV2): FlowRevisionIdentityV1 & {
+    readonly normalizedDefinition: FlowRevisionDefinitionV2;
+};

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/flow-v2-canonical.js

@@ -0,0 +1,175 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalizeFlowJsonPointer = canonicalizeFlowJsonPointer;
+exports.normalizeFlowInputMappings = normalizeFlowInputMappings;
+exports.buildCanonicalFlowMappedInput = buildCanonicalFlowMappedInput;
+exports.normalizeFlowRevisionDefinition = normalizeFlowRevisionDefinition;
+exports.computeFlowRevisionIdentity = computeFlowRevisionIdentity;
+const canonical_hash_1 = require("./canonical-hash");
+const json_value_1 = require("./json-value");
+/** Parse and canonicalize one non-root RFC 6901 JSON Pointer. */
+function canonicalizeFlowJsonPointer(pointer) {
+    if (typeof pointer !== 'string' ||
+        !pointer.startsWith('/') ||
+        pointer === '/') {
+        throw new Error('FLOW_ACTION_MAPPING_POINTER_INVALID');
+    }
+    const segments = pointer.slice(1).split('/').map((segment) => {
+        if (/~(?![01])/u.test(segment)) {
+            throw new Error('FLOW_ACTION_MAPPING_POINTER_INVALID');
+        }
+        return segment.replace(/~1/gu, '/').replace(/~0/gu, '~');
+    });
+    const canonical = `/${segments
+        .map((segment) => segment.replace(/~/gu, '~0').replace(/\//gu, '~1'))
+        .join('/')}`;
+    return { pointer: canonical, segments };
+}
+/**
+ * Normalize and sort mappings by canonical pointer UTF-8 byte order. Duplicate
+ * targets and ancestor/descendant targets are rejected after pointer unescape.
+ */
+function normalizeFlowInputMappings(mappings) {
+    const normalized = mappings.map((mapping) => {
+        const target = canonicalizeFlowJsonPointer(mapping.targetJsonPointer);
+        return {
+            mapping: {
+                targetJsonPointer: target.pointer,
+                source: (0, json_value_1.cloneJsonValue)(mapping.source),
+            },
+            segments: target.segments,
+        };
+    });
+    normalized.sort((left, right) => compareUtf8(left.mapping.targetJsonPointer, right.mapping.targetJsonPointer));
+    for (let index = 1; index < normalized.length; index += 1) {
+        const previous = normalized[index - 1].segments;
+        const current = normalized[index].segments;
+        if (isPointerPrefix(previous, current) ||
+            isPointerPrefix(current, previous)) {
+            throw new Error('FLOW_ACTION_MAPPING_TARGET_OVERLAP');
+        }
+    }
+    return normalized.map(({ mapping }) => mapping);
+}
+/** Build the mapped JSON object in the same canonical order used for hashing. */
+function buildCanonicalFlowMappedInput(mappings, resolveContextPath) {
+    const output = {};
+    for (const mapping of normalizeFlowInputMappings(mappings)) {
+        const value = mapping.source.kind === 'literal'
+            ? mapping.source.value
+            : resolveContextPath(mapping.source.path);
+        if (!(0, json_value_1.isJsonValue)(value)) {
+            throw new Error('FLOW_ACTION_MAPPING_VALUE_NOT_JSON');
+        }
+        const { segments } = canonicalizeFlowJsonPointer(mapping.targetJsonPointer);
+        setJsonPointer(output, segments, (0, json_value_1.cloneJsonValue)(value));
+    }
+    return output;
+}
+/**
+ * Normalize the immutable Flow definition. Nodes and edges are set-like at
+ * this level; explicitly ordered arrays inside settings retain their order,
+ * except INVOKE_UNIT inputMappings which have their own canonical order.
+ */
+function normalizeFlowRevisionDefinition(definition) {
+    if (!(0, json_value_1.isJsonValue)(definition)) {
+        throw new Error('FLOW_DEFINITION_NOT_JSON');
+    }
+    const nodes = definition.nodes
+        .map((node) => normalizeFlowNode(node))
+        .sort((left, right) => compareUtf8(readRequiredString(left, 'id'), readRequiredString(right, 'id')));
+    const edges = definition.edges
+        .map((edge) => (0, json_value_1.cloneJsonValue)(edge))
+        .sort(compareFlowEdges);
+    return {
+        trigger: definition.trigger === null
+            ? null
+            : (0, json_value_1.cloneJsonValue)(definition.trigger),
+        nodes,
+        edges,
+    };
+}
+/** Compute both frozen Flow hashes from one normalized definition. */
+function computeFlowRevisionIdentity(flowApiName, definition) {
+    if (typeof flowApiName !== 'string' || flowApiName.trim() === '') {
+        throw new Error('FLOW_API_NAME_REQUIRED');
+    }
+    const normalizedDefinition = normalizeFlowRevisionDefinition(definition);
+    const definitionHash = (0, canonical_hash_1.canonicalJsonDigest)(normalizedDefinition);
+    const flowRevisionKey = (0, canonical_hash_1.canonicalJsonDigest)({
+        flowApiName,
+        definitionHash,
+        normalizedDefinition,
+    });
+    return {
+        flowApiName,
+        flowRevisionKey: flowRevisionKey,
+        definitionHash: definitionHash,
+        normalizedDefinition,
+    };
+}
+function normalizeFlowNode(node) {
+    const normalized = (0, json_value_1.cloneJsonValue)(node);
+    const settings = normalized.settings;
+    if (normalized.type === 'ACTION' &&
+        settings &&
+        typeof settings === 'object' &&
+        !Array.isArray(settings) &&
+        settings.actionType === 'INVOKE_UNIT') {
+        const inputMappings = settings.inputMappings;
+        if (!Array.isArray(inputMappings)) {
+            throw new Error('FLOW_ACTION_INPUT_MAPPINGS_REQUIRED');
+        }
+        settings.inputMappings = normalizeFlowInputMappings(inputMappings);
+    }
+    return normalized;
+}
+function compareFlowEdges(left, right) {
+    for (const key of ['source', 'sourceHandle', 'target', 'targetHandle', 'id']) {
+        const comparison = compareUtf8(typeof left[key] === 'string' ? left[key] : '', typeof right[key] === 'string' ? right[key] : '');
+        if (comparison !== 0)
+            return comparison;
+    }
+    return 0;
+}
+function readRequiredString(value, key) {
+    const field = value[key];
+    if (typeof field !== 'string' || field === '') {
+        throw new Error(`FLOW_DEFINITION_${key.toUpperCase()}_REQUIRED`);
+    }
+    return field;
+}
+function isPointerPrefix(left, right) {
+    return (left.length <= right.length &&
+        left.every((segment, index) => segment === right[index]));
+}
+function setJsonPointer(target, segments, value) {
+    let current = target;
+    for (let index = 0; index < segments.length - 1; index += 1) {
+        const segment = segments[index];
+        const next = current[segment];
+        if (next === undefined) {
+            current[segment] = {};
+        }
+        else if (next === null ||
+            Array.isArray(next) ||
+            typeof next !== 'object') {
+            throw new Error('FLOW_ACTION_MAPPING_TARGET_OVERLAP');
+        }
+        current = current[segment];
+    }
+    current[segments[segments.length - 1]] = value;
+}
+function compareUtf8(left, right) {
+    const encoder = new TextEncoder();
+    const leftBytes = encoder.encode(left);
+    const rightBytes = encoder.encode(right);
+    const length = Math.min(leftBytes.length, rightBytes.length);
+    for (let index = 0; index < length; index += 1) {
+        if (leftBytes[index] !== rightBytes[index]) {
+            return leftBytes[index] - rightBytes[index];
+        }
+    }
+    return leftBytes.length - rightBytes.length;
+}
+//# sourceMappingURL=flow-v2-canonical.js.map

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/flow-v2-canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow-v2-canonical.js","sourceRoot":"","sources":["../../src/agent-executable-assets/flow-v2-canonical.ts"],"names":[],"mappings":";;AA0BA,kEAsBC;AAMD,gEA4BC;AAGD,sEAmBC;AAOD,0EAwBC;AAGD,kEAwBC;AAlKD,qDAG0B;AAC1B,6CAKsB;AAgBtB,iEAAiE;AACjE,SAAgB,2BAA2B,CAAC,OAAe;IAIzD,IACE,OAAO,OAAO,KAAK,QAAQ;QAC3B,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACxB,OAAO,KAAK,GAAG,EACf,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3D,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,QAAQ;SAC3B,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;SACpE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACf,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,SAAgB,0BAA0B,CACxC,QAA2C;IAE3C,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC1C,MAAM,MAAM,GAAG,2BAA2B,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACtE,OAAO;YACL,OAAO,EAAE;gBACP,iBAAiB,EAAE,MAAM,CAAC,OAAO;gBACjC,MAAM,EAAE,IAAA,2BAAc,EAAC,OAAO,CAAC,MAA8B,CAAC;aACzC;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC9B,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAC7E,CAAC;IACF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,QAAQ,CAAC;QACjD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAE,CAAC,QAAQ,CAAC;QAC5C,IACE,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC;YAClC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,EAClC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,iFAAiF;AACjF,SAAgB,6BAA6B,CAC3C,QAA2C,EAC3C,kBAA6C;IAE7C,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,KAAK,MAAM,OAAO,IAAI,0BAA0B,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3D,MAAM,KAAK,GACT,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;YAC/B,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK;YACtB,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAA,wBAAW,EAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,GAAG,2BAA2B,CAC9C,OAAO,CAAC,iBAAiB,CAC1B,CAAC;QACF,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAA,2BAAc,EAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAgB,+BAA+B,CAC7C,UAAoC;IAEpC,IAAI,CAAC,IAAA,wBAAW,EAAC,UAAqB,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK;SAC3B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;SACtC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,WAAW,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAC7E,CAAC;IACJ,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK;SAC3B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,2BAAc,EAAC,IAAI,CAAe,CAAC;SACjD,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAE1B,OAAO;QACL,OAAO,EACL,UAAU,CAAC,OAAO,KAAK,IAAI;YACzB,CAAC,CAAC,IAAI;YACN,CAAC,CAAE,IAAA,2BAAc,EAAC,UAAU,CAAC,OAAO,CAAgB;QACxD,KAAK;QACL,KAAK;KACN,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,SAAgB,2BAA2B,CACzC,WAAmB,EACnB,UAAoC;IAIpC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,oBAAoB,GAAG,+BAA+B,CAAC,UAAU,CAAC,CAAC;IACzE,MAAM,cAAc,GAAG,IAAA,oCAAmB,EACxC,oBAA4C,CAC7C,CAAC;IACF,MAAM,eAAe,GAAG,IAAA,oCAAmB,EAAC;QAC1C,WAAW;QACX,cAAc;QACd,oBAAoB;KACG,CAAC,CAAC;IAC3B,OAAO;QACL,WAAW;QACX,eAAe,EAAE,eAA+B;QAChD,cAAc,EAAE,cAA8B;QAC9C,oBAAoB;KACrB,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAgB;IACzC,MAAM,UAAU,GAAG,IAAA,2BAAc,EAAC,IAAI,CAAe,CAAC;IACtD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACrC,IACE,UAAU,CAAC,IAAI,KAAK,QAAQ;QAC5B,QAAQ;QACR,OAAO,QAAQ,KAAK,QAAQ;QAC5B,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QACxB,QAAQ,CAAC,UAAU,KAAK,aAAa,EACrC,CAAC;QACD,MAAM,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC;QAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,QAAQ,CAAC,aAAa,GAAG,0BAA0B,CACjD,aAAgD,CACzB,CAAC;IAC5B,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAgB,EAAE,KAAiB;IAC3D,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC;QAC7E,MAAM,UAAU,GAAG,WAAW,CAC5B,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAC9C,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CACjD,CAAC;QACF,IAAI,UAAU,KAAK,CAAC;YAAE,OAAO,UAAU,CAAC;IAC1C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAiB,EAAE,GAAW;IACxD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,mBAAmB,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CACtB,IAA2B,EAC3B,KAA4B;IAE5B,OAAO,CACL,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM;QAC3B,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,MAAkB,EAClB,QAA+B,EAC/B,KAAgB;IAEhB,IAAI,OAAO,GAAG,MAAM,CAAC;IACrB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAE,CAAC;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;aAAM,IACL,IAAI,KAAK,IAAI;YACb,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACnB,OAAO,IAAI,KAAK,QAAQ,EACxB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAe,CAAC;IAC3C,CAAC;IACD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,GAAG,KAAK,CAAC;AAClD,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC9C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC7D,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/C,IAAI,SAAS,CAAC,KAAK,CAAE,KAAK,UAAU,CAAC,KAAK,CAAE,EAAE,CAAC;YAC7C,OAAO,SAAS,CAAC,KAAK,CAAE,GAAG,UAAU,CAAC,KAAK,CAAE,CAAC;QAChD,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;AAC9C,CAAC"}

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/index.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Public contract surface for the agent-executable-assets module.
+ *
+ * This barrel is the ONLY import path for backend and CLI. Re-declaring any of
+ * these types/schemas/literals elsewhere is forbidden (design §3.1). Import
+ * surface is grouped by concern and re-exported with explicit `type` modifiers
+ * to honour `isolatedModules`.
+ */
+export * from './contract-versions';
+export { type JsonPrimitive, type JsonObject, type JsonArray, type JsonValue, type PresentJsonObject, isJsonValue, cloneJsonValue, stableStringify, } from './json-value';
+export * from './code-action.types';
+export * from './code-extension-manifest.types';
+export * from './executable-package-validation.types';
+export * from './candidate-execution-workspace-admin.types';
+export * from './workforce-release-events.types';
+export { type AiWorkforceExecutableBundleV1, type WorkforceRuntimeBindingsV1, } from './workforce-bundle.types';
+export { type WorkforceBundleSourceLockV1, type Sha256Digest, } from './workforce-lock.types';
+export { type WorkforceReleaseItemKindV1, type ReleaseSetEligibility, type ExactReleaseItemRefV1, type ReleaseEvidenceRefKindV1, type ReleaseEvidenceRefV1, type WorkforceReleaseEvidencePayloadV1, type WorkforceReleaseEnvelopeV1, type CandidateStageReceiptV1, type CodeTestSuiteSelector, type FlowTestSuiteSelector, type BundleTestSuiteKind, type CandidateTestSuiteSelectorV1, type CandidateIsolationBinding, type CandidateTestRunInputV1, type ReleaseExecutionSnapshotV1, type AgentAssetLineage, type WorkforceReleaseGateReceiptV1, } from './release-evidence.types';
+export { validateWorkforceReleaseEvidencePayload, type CandidateEvidenceExecutionIdentityV1, type WorkforceReleaseEvidenceExpectationV1, } from './release-evidence-validation';
+export { buildWorkforceReleaseGateReceipt } from './workforce-release-gate-receipt';
+export { FLOW_PAYLOAD_V2_VERSION, type FlowActionTypeV2, type FlowInvokeUnitActionSettingV2, type FlowInputMappingV2, type FlowErrorPolicyV2, type FlowFaultMarkerV2, type FlowRuleSugarActionTypeV2, type FlowRevisionIdentityV1, type WorkflowVersionLifecycleStatus, type ApprovalSubjectDecidedEventV1, type FlowBindingRiskLevelV2, } from './flow-payload-v2.types';
+export { type FlowRevisionDefinitionV2, canonicalizeFlowJsonPointer, normalizeFlowInputMappings, buildCanonicalFlowMappedInput, normalizeFlowRevisionDefinition, computeFlowRevisionIdentity, } from './flow-v2-canonical';
+export { type CliExitCode, type CliArgvSchemaMatcher, type CliArgvPredicateAtomV1, type CliArgvPredicateExprV1, type CliPermissionFactV1, type CliPermissionRuleV1, type CliPermissionProfileId, type CliEffectKind, type CliArgumentContract, type CliOptionContract, type CliExecutionModeV1, type CliCommandContractV1, type CliDiagnosticV1, type CliNextCommandV1, type CliEvidenceEntryV1, type CliResultV1, } from './cli-contract.types';
+export { type AiContextPrincipalKind, type AiContextOnlineSelector, type AiContextSurface, type AiContextSha256, type DescribeAiAuthoringContextRequestV2, type AiAuthoringCandidateReleaseStampV1, type AiAuthoringCatalogDocumentV1, type AiAuthoringContextHashesV1, type AiAuthoringContextSnapshotV2, type VerifyAiAuthoringContextFreshnessRequestV2, type SignAiAuthoringContextLockRequestV2, type AiAuthoringContextVerificationV1, type AiAuthoringContextManifestV2, type AiAuthoringContextLockV2, type AiAuthoringContextDigestSetV1, type AiContextSignatureHeaderV1, type AiContextSignaturePayloadV1, type AiContextSigningPublicJwkV1, type AiContextSigningKeySetV1, type AiContextCommonFileEntry, AI_CONTEXT_COMMON_FILES, AI_CONTEXT_SURFACE_FILES, resolveAiContextFileMatrix, resolveAiContextManifestFileMatrix, assertAiContextDeclaredPaths, } from './ai-authoring-context.types';
+export { type Sha256Digest as CanonicalSha256Digest, canonicalJsonString, canonicalJsonDigest, rawByteDigest, rawStringDigest, aiAuthoringContextDigests, unsignedAiAuthoringContextLock, releaseItemSetDigest, type ReleaseItemDigestInput, portableBundleDigest, materializedItemRefsDigest, releaseEnvelopeDigest, selfExcludingDigest, escapeJsonPointer, parseSha256, isSha256Digest, } from './canonical-hash';
+export { type AiContextSigningErrorCode, AiContextSigningError, type AiContextDetachedSigningInput, type VerifyAiContextDetachedJwsInput, assertAiContextSigningKeySet, buildAiContextDetachedSigningInput, verifyAiContextDetachedJws, } from './ai-authoring-context-signing';
+export { FROZEN_AJV_CONFIG, SCHEMA_LIMITS, DECIMAL_MONEY_PATTERN, CURRENCY_PATTERN, TOOL_NAME_PATTERN, SHA256_PATTERN, actionIoSchemaRoot, agentCodeToolExportSchema, cliResultSchema, flowInvokeUnitActionSettingSchema, workforceBundleIdentitySchema, } from './contract-schemas';
+export { EXECUTABLE_ASSET_ERROR_CODES, type ExecutableAssetErrorCode, ERROR_CODE_TO_EXIT, EXIT_PRECEDENCE, resolveExitCode, } from './error-catalog';

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/index.js

@@ -0,0 +1,100 @@
+"use strict";
+/**
+ * Public contract surface for the agent-executable-assets module.
+ *
+ * This barrel is the ONLY import path for backend and CLI. Re-declaring any of
+ * these types/schemas/literals elsewhere is forbidden (design §3.1). Import
+ * surface is grouped by concern and re-exported with explicit `type` modifiers
+ * to honour `isolatedModules`.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveExitCode = exports.EXIT_PRECEDENCE = exports.ERROR_CODE_TO_EXIT = exports.EXECUTABLE_ASSET_ERROR_CODES = exports.workforceBundleIdentitySchema = exports.flowInvokeUnitActionSettingSchema = exports.cliResultSchema = exports.agentCodeToolExportSchema = exports.actionIoSchemaRoot = exports.SHA256_PATTERN = exports.TOOL_NAME_PATTERN = exports.CURRENCY_PATTERN = exports.DECIMAL_MONEY_PATTERN = exports.SCHEMA_LIMITS = exports.FROZEN_AJV_CONFIG = exports.verifyAiContextDetachedJws = exports.buildAiContextDetachedSigningInput = exports.assertAiContextSigningKeySet = exports.AiContextSigningError = exports.isSha256Digest = exports.parseSha256 = exports.escapeJsonPointer = exports.selfExcludingDigest = exports.releaseEnvelopeDigest = exports.materializedItemRefsDigest = exports.portableBundleDigest = exports.releaseItemSetDigest = exports.unsignedAiAuthoringContextLock = exports.aiAuthoringContextDigests = exports.rawStringDigest = exports.rawByteDigest = exports.canonicalJsonDigest = exports.canonicalJsonString = exports.assertAiContextDeclaredPaths = exports.resolveAiContextManifestFileMatrix = exports.resolveAiContextFileMatrix = exports.AI_CONTEXT_SURFACE_FILES = exports.AI_CONTEXT_COMMON_FILES = exports.computeFlowRevisionIdentity = exports.normalizeFlowRevisionDefinition = exports.buildCanonicalFlowMappedInput = exports.normalizeFlowInputMappings = exports.canonicalizeFlowJsonPointer = exports.FLOW_PAYLOAD_V2_VERSION = exports.buildWorkforceReleaseGateReceipt = exports.validateWorkforceReleaseEvidencePayload = exports.stableStringify = exports.cloneJsonValue = exports.isJsonValue = void 0;
+// Frozen version literals — the single source of every schema/provider/CLI id.
+__exportStar(require("./contract-versions"), exports);
+// JSON-only value types and guards.
+var json_value_1 = require("./json-value");
+Object.defineProperty(exports, "isJsonValue", { enumerable: true, get: function () { return json_value_1.isJsonValue; } });
+Object.defineProperty(exports, "cloneJsonValue", { enumerable: true, get: function () { return json_value_1.cloneJsonValue; } });
+Object.defineProperty(exports, "stableStringify", { enumerable: true, get: function () { return json_value_1.stableStringify; } });
+// Action ABI, tool catalog descriptor, resolved descriptor, SDK contracts.
+__exportStar(require("./code-action.types"), exports);
+// Code-extension manifest v1/v2 governance + ACTION artifact entry (design §6.1).
+__exportStar(require("./code-extension-manifest.types"), exports);
+__exportStar(require("./executable-package-validation.types"), exports);
+__exportStar(require("./candidate-execution-workspace-admin.types"), exports);
+__exportStar(require("./workforce-release-events.types"), exports);
+var release_evidence_validation_1 = require("./release-evidence-validation");
+Object.defineProperty(exports, "validateWorkforceReleaseEvidencePayload", { enumerable: true, get: function () { return release_evidence_validation_1.validateWorkforceReleaseEvidencePayload; } });
+var workforce_release_gate_receipt_1 = require("./workforce-release-gate-receipt");
+Object.defineProperty(exports, "buildWorkforceReleaseGateReceipt", { enumerable: true, get: function () { return workforce_release_gate_receipt_1.buildWorkforceReleaseGateReceipt; } });
+// Flow payload/v2.
+var flow_payload_v2_types_1 = require("./flow-payload-v2.types");
+Object.defineProperty(exports, "FLOW_PAYLOAD_V2_VERSION", { enumerable: true, get: function () { return flow_payload_v2_types_1.FLOW_PAYLOAD_V2_VERSION; } });
+var flow_v2_canonical_1 = require("./flow-v2-canonical");
+Object.defineProperty(exports, "canonicalizeFlowJsonPointer", { enumerable: true, get: function () { return flow_v2_canonical_1.canonicalizeFlowJsonPointer; } });
+Object.defineProperty(exports, "normalizeFlowInputMappings", { enumerable: true, get: function () { return flow_v2_canonical_1.normalizeFlowInputMappings; } });
+Object.defineProperty(exports, "buildCanonicalFlowMappedInput", { enumerable: true, get: function () { return flow_v2_canonical_1.buildCanonicalFlowMappedInput; } });
+Object.defineProperty(exports, "normalizeFlowRevisionDefinition", { enumerable: true, get: function () { return flow_v2_canonical_1.normalizeFlowRevisionDefinition; } });
+Object.defineProperty(exports, "computeFlowRevisionIdentity", { enumerable: true, get: function () { return flow_v2_canonical_1.computeFlowRevisionIdentity; } });
+// AI authoring context pack.
+var ai_authoring_context_types_1 = require("./ai-authoring-context.types");
+Object.defineProperty(exports, "AI_CONTEXT_COMMON_FILES", { enumerable: true, get: function () { return ai_authoring_context_types_1.AI_CONTEXT_COMMON_FILES; } });
+Object.defineProperty(exports, "AI_CONTEXT_SURFACE_FILES", { enumerable: true, get: function () { return ai_authoring_context_types_1.AI_CONTEXT_SURFACE_FILES; } });
+Object.defineProperty(exports, "resolveAiContextFileMatrix", { enumerable: true, get: function () { return ai_authoring_context_types_1.resolveAiContextFileMatrix; } });
+Object.defineProperty(exports, "resolveAiContextManifestFileMatrix", { enumerable: true, get: function () { return ai_authoring_context_types_1.resolveAiContextManifestFileMatrix; } });
+Object.defineProperty(exports, "assertAiContextDeclaredPaths", { enumerable: true, get: function () { return ai_authoring_context_types_1.assertAiContextDeclaredPaths; } });
+// Canonicalization + digest helpers.
+var canonical_hash_1 = require("./canonical-hash");
+Object.defineProperty(exports, "canonicalJsonString", { enumerable: true, get: function () { return canonical_hash_1.canonicalJsonString; } });
+Object.defineProperty(exports, "canonicalJsonDigest", { enumerable: true, get: function () { return canonical_hash_1.canonicalJsonDigest; } });
+Object.defineProperty(exports, "rawByteDigest", { enumerable: true, get: function () { return canonical_hash_1.rawByteDigest; } });
+Object.defineProperty(exports, "rawStringDigest", { enumerable: true, get: function () { return canonical_hash_1.rawStringDigest; } });
+Object.defineProperty(exports, "aiAuthoringContextDigests", { enumerable: true, get: function () { return canonical_hash_1.aiAuthoringContextDigests; } });
+Object.defineProperty(exports, "unsignedAiAuthoringContextLock", { enumerable: true, get: function () { return canonical_hash_1.unsignedAiAuthoringContextLock; } });
+Object.defineProperty(exports, "releaseItemSetDigest", { enumerable: true, get: function () { return canonical_hash_1.releaseItemSetDigest; } });
+Object.defineProperty(exports, "portableBundleDigest", { enumerable: true, get: function () { return canonical_hash_1.portableBundleDigest; } });
+Object.defineProperty(exports, "materializedItemRefsDigest", { enumerable: true, get: function () { return canonical_hash_1.materializedItemRefsDigest; } });
+Object.defineProperty(exports, "releaseEnvelopeDigest", { enumerable: true, get: function () { return canonical_hash_1.releaseEnvelopeDigest; } });
+Object.defineProperty(exports, "selfExcludingDigest", { enumerable: true, get: function () { return canonical_hash_1.selfExcludingDigest; } });
+Object.defineProperty(exports, "escapeJsonPointer", { enumerable: true, get: function () { return canonical_hash_1.escapeJsonPointer; } });
+Object.defineProperty(exports, "parseSha256", { enumerable: true, get: function () { return canonical_hash_1.parseSha256; } });
+Object.defineProperty(exports, "isSha256Digest", { enumerable: true, get: function () { return canonical_hash_1.isSha256Digest; } });
+var ai_authoring_context_signing_1 = require("./ai-authoring-context-signing");
+Object.defineProperty(exports, "AiContextSigningError", { enumerable: true, get: function () { return ai_authoring_context_signing_1.AiContextSigningError; } });
+Object.defineProperty(exports, "assertAiContextSigningKeySet", { enumerable: true, get: function () { return ai_authoring_context_signing_1.assertAiContextSigningKeySet; } });
+Object.defineProperty(exports, "buildAiContextDetachedSigningInput", { enumerable: true, get: function () { return ai_authoring_context_signing_1.buildAiContextDetachedSigningInput; } });
+Object.defineProperty(exports, "verifyAiContextDetachedJws", { enumerable: true, get: function () { return ai_authoring_context_signing_1.verifyAiContextDetachedJws; } });
+// JSON Schema contracts + frozen AJV config.
+var contract_schemas_1 = require("./contract-schemas");
+Object.defineProperty(exports, "FROZEN_AJV_CONFIG", { enumerable: true, get: function () { return contract_schemas_1.FROZEN_AJV_CONFIG; } });
+Object.defineProperty(exports, "SCHEMA_LIMITS", { enumerable: true, get: function () { return contract_schemas_1.SCHEMA_LIMITS; } });
+Object.defineProperty(exports, "DECIMAL_MONEY_PATTERN", { enumerable: true, get: function () { return contract_schemas_1.DECIMAL_MONEY_PATTERN; } });
+Object.defineProperty(exports, "CURRENCY_PATTERN", { enumerable: true, get: function () { return contract_schemas_1.CURRENCY_PATTERN; } });
+Object.defineProperty(exports, "TOOL_NAME_PATTERN", { enumerable: true, get: function () { return contract_schemas_1.TOOL_NAME_PATTERN; } });
+Object.defineProperty(exports, "SHA256_PATTERN", { enumerable: true, get: function () { return contract_schemas_1.SHA256_PATTERN; } });
+Object.defineProperty(exports, "actionIoSchemaRoot", { enumerable: true, get: function () { return contract_schemas_1.actionIoSchemaRoot; } });
+Object.defineProperty(exports, "agentCodeToolExportSchema", { enumerable: true, get: function () { return contract_schemas_1.agentCodeToolExportSchema; } });
+Object.defineProperty(exports, "cliResultSchema", { enumerable: true, get: function () { return contract_schemas_1.cliResultSchema; } });
+Object.defineProperty(exports, "flowInvokeUnitActionSettingSchema", { enumerable: true, get: function () { return contract_schemas_1.flowInvokeUnitActionSettingSchema; } });
+Object.defineProperty(exports, "workforceBundleIdentitySchema", { enumerable: true, get: function () { return contract_schemas_1.workforceBundleIdentitySchema; } });
+// Frozen error catalog + exit mapping.
+var error_catalog_1 = require("./error-catalog");
+Object.defineProperty(exports, "EXECUTABLE_ASSET_ERROR_CODES", { enumerable: true, get: function () { return error_catalog_1.EXECUTABLE_ASSET_ERROR_CODES; } });
+Object.defineProperty(exports, "ERROR_CODE_TO_EXIT", { enumerable: true, get: function () { return error_catalog_1.ERROR_CODE_TO_EXIT; } });
+Object.defineProperty(exports, "EXIT_PRECEDENCE", { enumerable: true, get: function () { return error_catalog_1.EXIT_PRECEDENCE; } });
+Object.defineProperty(exports, "resolveExitCode", { enumerable: true, get: function () { return error_catalog_1.resolveExitCode; } });
+//# sourceMappingURL=index.js.map

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/agent-executable-assets/index.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;;;;;;;;;;;;AAEH,+EAA+E;AAC/E,sDAAoC;AAEpC,oCAAoC;AACpC,2CASsB;AAHpB,yGAAA,WAAW,OAAA;AACX,4GAAA,cAAc,OAAA;AACd,6GAAA,eAAe,OAAA;AAGjB,2EAA2E;AAC3E,sDAAoC;AAEpC,kFAAkF;AAClF,kEAAgD;AAChD,wEAAsD;AACtD,8EAA4D;AAC5D,mEAAiD;AAkCjD,6EAIuC;AAHrC,sJAAA,uCAAuC,OAAA;AAIzC,mFAAoF;AAA3E,kJAAA,gCAAgC,OAAA;AAEzC,mBAAmB;AACnB,iEAYiC;AAX/B,gIAAA,uBAAuB,OAAA;AAYzB,yDAO6B;AAL3B,gIAAA,2BAA2B,OAAA;AAC3B,+HAAA,0BAA0B,OAAA;AAC1B,kIAAA,6BAA6B,OAAA;AAC7B,oIAAA,+BAA+B,OAAA;AAC/B,gIAAA,2BAA2B,OAAA;AAuB7B,6BAA6B;AAC7B,2EA0BsC;AALpC,qIAAA,uBAAuB,OAAA;AACvB,sIAAA,wBAAwB,OAAA;AACxB,wIAAA,0BAA0B,OAAA;AAC1B,gJAAA,kCAAkC,OAAA;AAClC,0IAAA,4BAA4B,OAAA;AAG9B,qCAAqC;AACrC,mDAiB0B;AAfxB,qHAAA,mBAAmB,OAAA;AACnB,qHAAA,mBAAmB,OAAA;AACnB,+GAAA,aAAa,OAAA;AACb,iHAAA,eAAe,OAAA;AACf,2HAAA,yBAAyB,OAAA;AACzB,gIAAA,8BAA8B,OAAA;AAC9B,sHAAA,oBAAoB,OAAA;AAEpB,sHAAA,oBAAoB,OAAA;AACpB,4HAAA,0BAA0B,OAAA;AAC1B,uHAAA,qBAAqB,OAAA;AACrB,qHAAA,mBAAmB,OAAA;AACnB,mHAAA,iBAAiB,OAAA;AACjB,6GAAA,WAAW,OAAA;AACX,gHAAA,cAAc,OAAA;AAEhB,+EAQwC;AANtC,qIAAA,qBAAqB,OAAA;AAGrB,4IAAA,4BAA4B,OAAA;AAC5B,kJAAA,kCAAkC,OAAA;AAClC,0IAAA,0BAA0B,OAAA;AAG5B,6CAA6C;AAC7C,uDAY4B;AAX1B,qHAAA,iBAAiB,OAAA;AACjB,iHAAA,aAAa,OAAA;AACb,yHAAA,qBAAqB,OAAA;AACrB,oHAAA,gBAAgB,OAAA;AAChB,qHAAA,iBAAiB,OAAA;AACjB,kHAAA,cAAc,OAAA;AACd,sHAAA,kBAAkB,OAAA;AAClB,6HAAA,yBAAyB,OAAA;AACzB,mHAAA,eAAe,OAAA;AACf,qIAAA,iCAAiC,OAAA;AACjC,iIAAA,6BAA6B,OAAA;AAG/B,uCAAuC;AACvC,iDAMyB;AALvB,6HAAA,4BAA4B,OAAA;AAE5B,mHAAA,kBAAkB,OAAA;AAClB,gHAAA,eAAe,OAAA;AACf,gHAAA,eAAe,OAAA"}

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/json-value.d.ts

@@ -0,0 +1,48 @@
+/**
+ * JSON-only recursive types and runtime guards.
+ *
+ * The executable-workforce contracts exchange exclusively JSON-serializable
+ * values (design §8.1). These types and guards are the single owner of "what a
+ * JSON value is" for the whole surface: runtime input/output, ToolCall redacted
+ * previews, AI generate payloads, connector call bodies and context-pack files.
+ *
+ * Everything rejected here MUST stay rejected: `undefined`, `bigint`,
+ * `function`, `symbol`, `NaN`/`Infinity`, prototype-polluted objects, and
+ * cycles. `false`, `0` and `""` are LEGAL present values and must never be
+ * confused with absence (design §9 / R-04 rule 5).
+ */
+export type JsonPrimitive = string | number | boolean | null;
+export type JsonObject = {
+    [key: string]: JsonValue;
+};
+export type JsonArray = JsonValue[];
+export type JsonValue = JsonPrimitive | JsonObject | JsonArray;
+/**
+ * A present JSON value with a guaranteed own enumerable structure. Used where a
+ * contract needs a non-null object root (e.g. action input/output, AI input).
+ */
+export type PresentJsonObject = {
+    [key: string]: JsonValue;
+};
+/**
+ * Type guard: is `value` a finite, cycle-free JSON value with no forbidden
+ * primitives and no prototype-pollution keys?
+ *
+ * Detects cycles via a `WeakSet` of seen containers. Rejects:
+ * - `undefined`, `bigint`, `symbol`, `function`
+ * - `NaN`, `Infinity`, `-Infinity`
+ * - objects whose own keys include `__proto__` / `prototype` / `constructor`
+ * - arrays/objects that contain themselves (direct or transitive)
+ */
+export declare function isJsonValue(value: unknown, seen?: WeakSet<object>): value is JsonValue;
+/**
+ * Deep-clone a value that has already passed {@link isJsonValue}. Structured
+ * clone semantics for the JSON subset only; throws if non-JSON slips through.
+ */
+export declare function cloneJsonValue<T extends JsonValue>(value: T): T;
+/**
+ * Canonical string form for hashing/transport. Uses JSON.stringify with stable
+ * key ordering via a replacer; for true RFC 8785 canonicalization use
+ * {@link canonicalHash} in `canonical-hash.ts` (which owns the JCS algorithm).
+ */
+export declare function stableStringify(value: JsonValue): string;