@nexusclawhq/cli 0.2.1

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/workforce-lock.types.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Server-generated workforce bundle lock. `workforce-bundle.lock/v1`.
+ *
+ * Frozen verbatim from executable-asset design §5.3. The lock is NEVER
+ * hand-written or edited by a model. It locks employee + code packages + Flow
+ * semantic revision key + prompt/policy + tool descriptor + runtime provider /
+ * policy + content-addressed release item set + rollback target, all in one
+ * content-addressed document. Test/approval evidence does NOT write back to the
+ * source lock; it forms a separate immutable evidence aggregate and release
+ * envelope.
+ *
+ * `sourceLockDigest` covers every field below EXCEPT itself; array sort keys
+ * are fixed as package name/version, exportId, flowApiName, bindingKey,
+ * policyKey, and (purpose, policyApiName). See design §5.3 / §10.3 for the
+ * exact digest formulas, owned by `canonical-hash.ts`.
+ */
+import { BUNDLE_LOCK_SCHEMA_VERSION } from './contract-versions';
+import type { ActionRiskLevel } from './code-action.types';
+/** SHA-256 digest, lowercase `sha256:<64 hex>`. */
+export type Sha256Digest = `sha256:${string}`;
+/**
+ * Generated source lock. `previousReleaseSetId` is optional (absent on first
+ * release). All hashes are content-addressed and derivable before any database
+ * row exists, so dry-run and stage produce identical digests (R-01.9).
+ */
+export interface WorkforceBundleSourceLockV1 {
+    readonly schemaVersion: typeof BUNDLE_LOCK_SCHEMA_VERSION;
+    readonly bundleName: string;
+    readonly bundleVersion: string;
+    readonly portableBundleDigest: Sha256Digest;
+    readonly releaseItemSetDigest: Sha256Digest;
+    readonly target: {
+        readonly orgAlias: string;
+        readonly workspaceId: string;
+        readonly workspaceContractHash: Sha256Digest;
+    };
+    readonly employee: {
+        readonly employeePackageName: string;
+        readonly agentApiName: string;
+        readonly digest: Sha256Digest;
+    };
+    readonly codePackages: ReadonlyArray<{
+        readonly packageName: string;
+        readonly packageVersion: string;
+        readonly packageDigest: Sha256Digest;
+        readonly exports: ReadonlyArray<{
+            readonly exportId: string;
+            readonly toolName: string;
+            readonly sourceHash: Sha256Digest;
+            readonly compiledHash: Sha256Digest;
+            readonly inputSchemaHash: Sha256Digest;
+            readonly outputSchemaHash: Sha256Digest;
+            readonly descriptorHash: Sha256Digest;
+            readonly publishedChecksum: Sha256Digest;
+            readonly runtimeApiVersion: 'runtime/v2';
+            readonly runtimeProviderId: 'nexusclaw-verified-isolate-v1';
+            readonly compilerVersion: string;
+            readonly compilerOptionsHash: Sha256Digest;
+            readonly sdkDeclarationHash: Sha256Digest;
+            readonly actionContractVersion: 'nexus-code-action/v1';
+        }>;
+    }>;
+    readonly flows: ReadonlyArray<{
+        readonly flowApiName: string;
+        readonly flowRevisionKey: Sha256Digest;
+        readonly definitionHash: Sha256Digest;
+    }>;
+    readonly runtimeBindings: ReadonlyArray<{
+        readonly bindingKey: string;
+        readonly kind: 'connector';
+        readonly connectorInstanceId: string;
+        readonly connectorApiName: string;
+        readonly connectorType: string;
+        readonly connectorConfigHash: Sha256Digest;
+        readonly namedCredentialId: string;
+        readonly namedCredentialApiName: string;
+        readonly credentialType: 'OAUTH2' | 'API_KEY' | 'BASIC_AUTH';
+        readonly bindingRevisionKey: Sha256Digest;
+    }>;
+    readonly aiPolicies: ReadonlyArray<{
+        readonly policyKey: string;
+        readonly policyRevisionKey: Sha256Digest;
+        readonly promptTemplateVersion: string;
+        readonly policyHash: Sha256Digest;
+    }>;
+    readonly approvalPolicies: ReadonlyArray<{
+        readonly policyApiName: string;
+        readonly purpose: 'tool_call' | 'workforce_release';
+        readonly revisionKey: Sha256Digest;
+        readonly checksum: Sha256Digest;
+    }>;
+    readonly previousReleaseSetId?: string;
+    readonly sourceLockDigest: Sha256Digest;
+}
+/** Lifted from bundle; v1 forbids L4 on Flow invocation. */
+export type FlowBindingRiskLevel = Exclude<ActionRiskLevel, 'L4'>;

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/workforce-lock.types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=workforce-lock.types.js.map

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/workforce-lock.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workforce-lock.types.js","sourceRoot":"","sources":["../../src/agent-executable-assets/workforce-lock.types.ts"],"names":[],"mappings":""}

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/workforce-release-events.types.d.ts

@@ -0,0 +1,28 @@
+import { CODE_ACTION_REVOKED_EVENT, WORKFORCE_RELEASE_HEAD_CHANGED_EVENT } from './contract-versions';
+export interface WorkforceReleaseHeadChangedEventV1 {
+    eventType: typeof WORKFORCE_RELEASE_HEAD_CHANGED_EVENT;
+    workspaceId: string;
+    agentApiName: string;
+    transition: 'promote' | 'rollback';
+    beforeReleaseSetId: string | null;
+    afterReleaseSetId: string | null;
+    beforeGeneration: number;
+    afterGeneration: number;
+    afterSourceLockDigest: `sha256:${string}` | null;
+    afterReleaseEnvelopeDigest: `sha256:${string}` | null;
+    actorId: string;
+    approvalId?: string;
+    reason?: string;
+    occurredAt: string;
+}
+export interface CodeActionRevokedEventV1 {
+    eventType: typeof CODE_ACTION_REVOKED_EVENT;
+    workspaceId: string;
+    assertedReleaseSetId: string;
+    exportId: string;
+    toolName: string;
+    publishedChecksum: `sha256:${string}`;
+    reason: string;
+    revokedBy: string;
+    revokedAt: string;
+}

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/workforce-release-events.types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=workforce-release-events.types.js.map

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/workforce-release-events.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workforce-release-events.types.js","sourceRoot":"","sources":["../../src/agent-executable-assets/workforce-release-events.types.ts"],"names":[],"mappings":""}

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/workforce-release-gate-receipt.d.ts

@@ -0,0 +1,2 @@
+import type { WorkforceReleaseGateReceiptV1 } from './release-evidence.types';
+export declare function buildWorkforceReleaseGateReceipt(input: Omit<WorkforceReleaseGateReceiptV1, 'schemaVersion' | 'receiptDigest'>): WorkforceReleaseGateReceiptV1;

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/workforce-release-gate-receipt.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildWorkforceReleaseGateReceipt = buildWorkforceReleaseGateReceipt;
+const canonical_hash_1 = require("./canonical-hash");
+function buildWorkforceReleaseGateReceipt(input) {
+    const evidenceRunIds = [...input.evidenceRunIds].sort();
+    if (!input.approvalId.trim() ||
+        !input.candidateReleaseSetId.trim() ||
+        evidenceRunIds.length === 0 ||
+        evidenceRunIds.some((id) => !id.trim()) ||
+        new Set(evidenceRunIds).size !== evidenceRunIds.length ||
+        input.decisionVersion !== (input.decision === 'pending' ? 0 : 1) ||
+        !Number.isFinite(Date.parse(input.expiresAt))) {
+        throw new Error('WORKFORCE_RELEASE_GATE_RECEIPT_INVALID');
+    }
+    const receipt = {
+        schemaVersion: 'nexusclaw.workforce-release-gate-receipt/v1',
+        ...input,
+        evidenceRunIds,
+    };
+    return {
+        ...receipt,
+        receiptDigest: (0, canonical_hash_1.canonicalJsonDigest)(receipt),
+    };
+}
+//# sourceMappingURL=workforce-release-gate-receipt.js.map

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-executable-assets/workforce-release-gate-receipt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workforce-release-gate-receipt.js","sourceRoot":"","sources":["../../src/agent-executable-assets/workforce-release-gate-receipt.ts"],"names":[],"mappings":";;AAIA,4EAyBC;AA7BD,qDAAuD;AAIvD,SAAgB,gCAAgC,CAC9C,KAA6E;IAE7E,MAAM,cAAc,GAAG,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE;QACxB,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,EAAE;QACnC,cAAc,CAAC,MAAM,KAAK,CAAC;QAC3B,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,MAAM;QACtD,KAAK,CAAC,eAAe,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAC7C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,OAAO,GAAG;QACd,aAAa,EACX,6CAAsD;QACxD,GAAG,KAAK;QACR,cAAc;KACf,CAAC;IACF,OAAO;QACL,GAAG,OAAO;QACV,aAAa,EAAE,IAAA,oCAAmB,EAAC,OAA+B,CAAC;KACpE,CAAC;AACJ,CAAC"}

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-markdown-policy/index.d.ts

@@ -0,0 +1,25 @@
+/**
+ * AI 员工身份策略 / 自然语言指令的 markdown 分段解析。
+ * 前后端共用同一份解析逻辑（design.md FD2/FD3），避免两端各写一份而漂移。
+ * 零第三方依赖：标题语法简单（#/##/###），不需要完整 markdown AST。
+ */
+export interface MarkdownSection {
+    /** 0 = 无标题（整段），1/2/3 对应 #/##/### */
+    level: number;
+    /** 无标题时为空字符串 */
+    title: string;
+    /** 该标题下的正文（不含标题行本身） */
+    content: string;
+    /** 出现顺序，从 0 开始 */
+    order: number;
+    priorityTier: 'high' | 'normal';
+}
+/** 标题命中即视为高优先级（护栏/红线类），集中维护，调整关键词只改这一处。 */
+export declare const HIGH_PRIORITY_TITLE_KEYWORDS: readonly ["红线", "禁止", "必须", "不允许", "绝不"];
+export declare function derivePriorityTier(title: string, content: string): 'high' | 'normal';
+/**
+ * 按 #/##/### 标题切分文本。无任何标题命中时，返回单个
+ * { level: 0, title: '', content: 全文 } 的 section —— 这是存量数据
+ * （无标题的纯文本）与改造前逐字节兼容的关键短路分支（design.md FD4）。
+ */
+export declare function parseMarkdownSections(text: string): MarkdownSection[];

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-markdown-policy/index.js

@@ -0,0 +1,66 @@
+"use strict";
+/**
+ * AI 员工身份策略 / 自然语言指令的 markdown 分段解析。
+ * 前后端共用同一份解析逻辑（design.md FD2/FD3），避免两端各写一份而漂移。
+ * 零第三方依赖：标题语法简单（#/##/###），不需要完整 markdown AST。
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HIGH_PRIORITY_TITLE_KEYWORDS = void 0;
+exports.derivePriorityTier = derivePriorityTier;
+exports.parseMarkdownSections = parseMarkdownSections;
+/** 标题命中即视为高优先级（护栏/红线类），集中维护，调整关键词只改这一处。 */
+exports.HIGH_PRIORITY_TITLE_KEYWORDS = ['红线', '禁止', '必须', '不允许', '绝不'];
+/** 正文中的显式标记，优先级高于关键词匹配。 */
+const EXPLICIT_HIGH_PRIORITY_MARKER = /<!--\s*priority:\s*high\s*-->/i;
+function derivePriorityTier(title, content) {
+    if (EXPLICIT_HIGH_PRIORITY_MARKER.test(content)) {
+        return 'high';
+    }
+    if (exports.HIGH_PRIORITY_TITLE_KEYWORDS.some((keyword) => title.includes(keyword))) {
+        return 'high';
+    }
+    return 'normal';
+}
+const HEADING_LINE = /^(#{1,3})\s+(.*)$/;
+/**
+ * 按 #/##/### 标题切分文本。无任何标题命中时，返回单个
+ * { level: 0, title: '', content: 全文 } 的 section —— 这是存量数据
+ * （无标题的纯文本）与改造前逐字节兼容的关键短路分支（design.md FD4）。
+ */
+function parseMarkdownSections(text) {
+    const lines = text.split('\n');
+    const headingIndexes = [];
+    lines.forEach((line, lineIndex) => {
+        const match = HEADING_LINE.exec(line);
+        if (match) {
+            const [, hashes, title] = match;
+            headingIndexes.push({ lineIndex, level: (hashes ?? '').length, title: (title ?? '').trim() });
+        }
+    });
+    if (headingIndexes.length === 0) {
+        return [
+            {
+                level: 0,
+                title: '',
+                content: text,
+                order: 0,
+                priorityTier: 'normal',
+            },
+        ];
+    }
+    const sections = [];
+    headingIndexes.forEach((heading, index) => {
+        const contentStart = heading.lineIndex + 1;
+        const contentEnd = headingIndexes[index + 1]?.lineIndex ?? lines.length;
+        const content = lines.slice(contentStart, contentEnd).join('\n').trim();
+        sections.push({
+            level: heading.level,
+            title: heading.title,
+            content,
+            order: index,
+            priorityTier: derivePriorityTier(heading.title, content),
+        });
+    });
+    return sections;
+}
+//# sourceMappingURL=index.js.map

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/agent-markdown-policy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/agent-markdown-policy/index.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAoBH,gDAQC;AASD,sDAuCC;AA9DD,2CAA2C;AAC9B,QAAA,4BAA4B,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAU,CAAC;AAErF,2BAA2B;AAC3B,MAAM,6BAA6B,GAAG,gCAAgC,CAAC;AAEvE,SAAgB,kBAAkB,CAAC,KAAa,EAAE,OAAe;IAC/D,IAAI,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,oCAA4B,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAEzC;;;;GAIG;AACH,SAAgB,qBAAqB,CAAC,IAAY;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,cAAc,GAA+D,EAAE,CAAC;IAEtF,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE;QAChC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC;YAChC,cAAc,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO;YACL;gBACE,KAAK,EAAE,CAAC;gBACR,KAAK,EAAE,EAAE;gBACT,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,CAAC;gBACR,YAAY,EAAE,QAAQ;aACvB;SACF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,cAAc,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;QACxE,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACxE,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO;YACP,KAAK,EAAE,KAAK;YACZ,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;SACzD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/nexus-cli/node_modules/@nexusclaw/shared/dist/ai-employee-cognition/cognitive-policy.schemas.d.ts

@@ -0,0 +1,38 @@
+import type { AnySchemaObject } from 'ajv';
+import { type Sha256Digest } from '../agent-executable-assets/canonical-hash';
+import type { AgentCognitivePolicyV1, EmployeeSuccessContractV1, ProactivePolicyV1 } from './cognitive-policy.types';
+export declare const COGNITION_SHA256_PATTERN = "^sha256:[0-9a-f]{64}$";
+export declare const STABLE_CODE_PATTERN = "^[a-z][a-z0-9_.-]{0,119}$";
+export declare const STABLE_EVALUATOR_CODES: readonly ["deterministic.boolean", "deterministic.numeric_threshold", "deterministic.evidence_completeness", "outcome.event_status", "human.review"];
+export interface CognitionValidationIssueV1 {
+    code: string;
+    jsonPath: string;
+    message: string;
+}
+export interface CognitionValidationResultV1<T> {
+    valid: boolean;
+    value?: T;
+    issues: CognitionValidationIssueV1[];
+}
+export declare const employeeSuccessContractSchema: AnySchemaObject;
+export declare const agentCognitivePolicySchema: AnySchemaObject;
+export declare function findForbiddenCognitionPayload(value: unknown, path?: string): CognitionValidationIssueV1[];
+export declare function cognitionDigest(value: Record<string, unknown>, excludedKeys?: readonly string[]): Sha256Digest;
+export declare function successContractDigest(contract: EmployeeSuccessContractV1): Sha256Digest;
+export declare function validateSuccessContract(value: unknown): CognitionValidationResultV1<EmployeeSuccessContractV1>;
+export declare function validateCognitivePolicy(value: unknown): CognitionValidationResultV1<AgentCognitivePolicyV1>;
+export declare function assertP0Autonomy(policy: ProactivePolicyV1): 'A0_disabled' | 'A1_recommend' | 'A2_confirm';
+export declare function policyOnlyNarrows(workspace: {
+    maximumEffectiveRisk: 'L0' | 'L1' | 'L2' | 'L3' | 'L4';
+    caps: Record<string, number>;
+    allowedActions: ReadonlySet<string>;
+}, policy: ProactivePolicyV1): boolean;
+export declare function cognitivePolicyOnlyNarrows(workspace: {
+    maximumEffectiveRisk: 'L0' | 'L1' | 'L2' | 'L3' | 'L4';
+    proactiveCaps: Record<string, number>;
+    allowedActions: ReadonlySet<string>;
+    totalInputTokenBudget: number;
+    sourceBudgets: Record<string, number>;
+    allowedMemoryCategories: ReadonlySet<string>;
+    maximumMemoryTtlDays: number;
+}, policy: AgentCognitivePolicyV1): boolean;