@oxygen-agent/cli 1.1014.620 → 1.1014.773

package/node_modules/@oxygen/workflows/dist/graph/expression.js

@@ -3,7 +3,7 @@
 // scheduler, the linter, and the visual editor's preview pane.
 //
 // This module must stay BROWSER-SAFE. Its only imports are @oxygen/formula (itself
-// dependency-free and node-free) and ./types.js — never ../index.js, which pulls
+// host-free and node-free), condition comparison, and ./types.js — never ../index.js, which pulls
 // node:vm and node:crypto.
 //
 // Two invariants hold everywhere below:
@@ -14,6 +14,8 @@
 //     only, and the segments that reach JavaScript object internals
 //     (__proto__ / constructor / prototype) are rejected outright.
 import { analyzeFormulaDependencies, evaluateFormulaInScope, formulaExpressionError, isRecord, } from "@oxygen/formula";
+import { compareWorkflowConditionValues } from "../refactor-internals/condition-comparison.js";
+export { compileConditionPattern } from "../refactor-internals/condition-comparison.js";
 /** A deterministic authoring/data error; retrying the same revision cannot repair it. */
 export class WorkflowValueCoercionError extends Error {
     coercion;
@@ -656,229 +658,7 @@ export function evaluateCondition(condition, scope) {
     }
     const left = resolveValueRef(condition.left, scope);
     const right = condition.right === undefined ? undefined : resolveValueRef(condition.right, scope);
-    return compareValues(left, condition.op, right);
-}
-function compareValues(left, op, right) {
-    switch (op) {
-        case "eq":
-            return valuesEqual(left, right);
-        case "neq":
-            return !valuesEqual(left, right);
-        case "gt":
-            return orderingOf(left, right) > 0;
-        case "gte":
-            return orderingOf(left, right) >= 0;
-        case "lt":
-            return orderingOf(left, right) < 0;
-        case "lte":
-            return orderingOf(left, right) <= 0;
-        case "contains":
-            return containsValue(left, right);
-        case "not_contains":
-            return !containsValue(left, right);
-        case "starts_with":
-            return textOf(left).startsWith(textOf(right));
-        case "ends_with":
-            return textOf(left).endsWith(textOf(right));
-        case "is_empty":
-            return isEmptyValue(left);
-        case "is_not_empty":
-            return !isEmptyValue(left);
-        case "in":
-            return containsValue(right, left);
-        case "not_in":
-            return !containsValue(right, left);
-        case "matches":
-            return matchesPattern(left, right);
-    }
-}
-/**
- * Numeric when both sides read as numbers, otherwise strict identity with
- * null/undefined treated as one blank. Deliberately NOT the formula language's
- * `formulaValuesEqual`, which throws on non-numeric input: a condition gates
- * routing, and a run must not fail because a provider returned an object where
- * the author expected a string.
- */
-function valuesEqual(left, right) {
-    if (left === right)
-        return true;
-    if (left === null || left === undefined)
-        return right === null || right === undefined;
-    if (right === null || right === undefined)
-        return false;
-    const leftNumber = numberOf(left);
-    const rightNumber = numberOf(right);
-    if (leftNumber !== null && rightNumber !== null)
-        return leftNumber === rightNumber;
-    if (Array.isArray(left) && Array.isArray(right)) {
-        return left.length === right.length
-            && left.every((entry, index) => valuesEqual(entry, right[index]));
-    }
-    return false;
-}
-/**
- * Ordering for the relational operators. Incomparable operands sort as 0, so
- * `gt`/`lt` are false and `gte`/`lte` are true — the same shape JavaScript gives
- * for equal values, and never an exception.
- */
-function orderingOf(left, right) {
-    const leftNumber = numberOf(left);
-    const rightNumber = numberOf(right);
-    if (leftNumber !== null && rightNumber !== null) {
-        if (leftNumber === rightNumber)
-            return 0;
-        return leftNumber < rightNumber ? -1 : 1;
-    }
-    if (typeof left === "string" && typeof right === "string") {
-        return left.localeCompare(right);
-    }
-    return 0;
-}
-function numberOf(value) {
-    if (typeof value === "number")
-        return Number.isFinite(value) ? value : null;
-    if (typeof value === "string" && value.trim()) {
-        const parsed = Number(value);
-        return Number.isFinite(parsed) ? parsed : null;
-    }
-    return null;
-}
-/** Membership for arrays, case-sensitive substring for text. */
-function containsValue(haystack, needle) {
-    if (Array.isArray(haystack))
-        return haystack.some((entry) => valuesEqual(entry, needle));
-    if (haystack === null || haystack === undefined)
-        return false;
-    if (needle === null || needle === undefined)
-        return false;
-    return textOf(haystack).includes(textOf(needle));
-}
-function isEmptyValue(value) {
-    if (value === null || value === undefined)
-        return true;
-    if (typeof value === "string")
-        return value.trim().length === 0;
-    if (Array.isArray(value))
-        return value.length === 0;
-    // 0 and false are values an author chose, not emptiness.
-    if (typeof value === "object")
-        return Object.keys(value).length === 0;
-    return false;
-}
-function textOf(value) {
-    if (value === null || value === undefined)
-        return "";
-    if (typeof value === "string")
-        return value;
-    if (typeof value === "number" || typeof value === "boolean")
-        return String(value);
-    try {
-        return JSON.stringify(value) ?? "";
-    }
-    catch {
-        return "";
-    }
-}
-// ---------------------------------------------------------------------------
-// `matches`
-// ---------------------------------------------------------------------------
-const MAX_CONDITION_PATTERN_LENGTH = 200;
-/**
- * Compile a `matches` pattern, or return null when it is unsafe or invalid.
- *
- * Choice: conservative STATIC REJECTION rather than a linear (Thompson NFA)
- * matcher. A linear engine would be several hundred lines of new, security-load-
- * bearing code in a module the browser also bundles, whereas the patterns real
- * GTM authors write (domain suffixes, job-title keywords, ID formats) never need
- * the constructs rejected here. Rejected: sources over 200 characters,
- * lookaround, backreferences, and a quantified group whose body itself contains
- * an unbounded quantifier — the `(a+)+` family that drives catastrophic
- * backtracking. Everything else compiles as a normal RegExp.
- *
- * The linter calls this at authoring time and reports `invalid_condition`, so a
- * rejected pattern is a lint error the author sees, not a silent run-time false.
- */
-export function compileConditionPattern(pattern) {
-    if (!isSafeRegExpSource(pattern))
-        return null;
-    try {
-        return new RegExp(pattern);
-    }
-    catch {
-        return null;
-    }
-}
-function isSafeRegExpSource(source) {
-    if (!source || source.length > MAX_CONDITION_PATTERN_LENGTH)
-        return false;
-    if (/\(\?<?[=!]/.test(source))
-        return false; // lookahead / lookbehind
-    if (/\\[1-9]/.test(source))
-        return false; // backreference
-    return !hasNestedQuantifier(source);
-}
-function isUnboundedQuantifier(char) {
-    // `?` alone is bounded and cannot blow up; `*`, `+` and `{n,m}` can.
-    return char === "*" || char === "+" || char === "{";
-}
-function hasNestedQuantifier(source) {
-    // One frame per open group, plus a base frame for the top level. A frame is
-    // "quantified" once anything inside it repeats.
-    const stack = [{ quantified: false }];
-    let inCharacterClass = false;
-    let index = 0;
-    while (index < source.length) {
-        const char = source[index] ?? "";
-        if (char === "\\") {
-            index += 2;
-            continue;
-        }
-        if (inCharacterClass) {
-            if (char === "]")
-                inCharacterClass = false;
-            index += 1;
-            continue;
-        }
-        if (char === "[") {
-            inCharacterClass = true;
-            index += 1;
-            continue;
-        }
-        if (char === "(") {
-            stack.push({ quantified: false });
-            index += 1;
-            continue;
-        }
-        if (char === ")") {
-            index += 1;
-            // Unbalanced ")" — leave it to RegExp construction to reject.
-            if (stack.length === 1)
-                continue;
-            const frame = stack.pop();
-            const repeated = isUnboundedQuantifier(source[index] ?? "");
-            if (repeated && frame?.quantified === true)
-                return true;
-            const parent = stack[stack.length - 1];
-            if (parent && (repeated || frame?.quantified === true))
-                parent.quantified = true;
-            continue;
-        }
-        if (isUnboundedQuantifier(char)) {
-            const top = stack[stack.length - 1];
-            if (top)
-                top.quantified = true;
-        }
-        index += 1;
-    }
-    return false;
-}
-function matchesPattern(value, pattern) {
-    if (typeof pattern !== "string")
-        return false;
-    const regex = compileConditionPattern(pattern);
-    if (!regex)
-        return false;
-    return regex.test(textOf(value));
+    return compareWorkflowConditionValues(left, condition.op, right);
 }
 // ---------------------------------------------------------------------------
 // Static analysis

package/node_modules/@oxygen/workflows/dist/graph/types.d.ts

@@ -1,3 +1,5 @@
+import type { WorkflowCompareOp } from "../refactor-internals/condition-comparison.js";
+export type { WorkflowCompareOp } from "../refactor-internals/condition-comparison.js";
 import type { JsonSchema, RecipeManifest, WorkflowMode, WorkflowStatus, WorkflowStepEffect, WorkflowTriggerManifest } from "../index.js";
 export declare const WORKFLOW_GRAPH_MANIFEST_VERSION = 2;
 export declare const WORKFLOW_GRAPH_COMPILER_VERSION = "oxygen-workflows-v2";
@@ -220,7 +222,6 @@ export type WorkflowCodeV1 = {
         max_output_bytes: number;
     };
 };
-export type WorkflowCompareOp = "eq" | "neq" | "gt" | "gte" | "lt" | "lte" | "contains" | "not_contains" | "starts_with" | "ends_with" | "is_empty" | "is_not_empty" | "in" | "not_in" | "matches";
 /**
  * A structured (never source-code) predicate, so the editor can render it and the
  * runtime can evaluate it without a sandbox.
@@ -489,4 +490,3 @@ export declare function isTriggerNode(node: WorkflowGraphNode): node is Workflow
 export declare function isToolNode(node: WorkflowGraphNode): node is WorkflowGraphNodeOfKind<"tool">;
 export declare function isSwitchNode(node: WorkflowGraphNode): node is WorkflowGraphNodeOfKind<"switch">;
 export declare function isLoopNode(node: WorkflowGraphNode): node is WorkflowGraphNodeOfKind<"loop">;
-export {};

package/node_modules/@oxygen/workflows/dist/index.d.ts

@@ -7,6 +7,7 @@ export * from "./graph/index.js";
 export * from "./graph/lint.js";
 export * from "./portable.js";
 export { RECIPE_TIMESTAMP_MILLIS_SOURCE } from "./recipe-timestamp.js";
+export * from "./refactor-internals/execution-policy.js";
 export declare const WORKFLOW_MANIFEST_VERSION = 1;
 export declare const WORKFLOW_COMPILER_VERSION = "oxygen-workflows-v1";
 export declare const DURABLE_RECIPE_COMPILER_VERSION = "oxygen-recipes-v2";
@@ -1048,66 +1049,3 @@ value: unknown, path: string, add: (path: string, code: string, message: string)
 export declare function validatePureFunctionSource(source: string, path: string, add: (path: string, code: string, message: string) => void): void;
 export declare function isWorkflowToolRejected(toolId: string): boolean;
 export declare function computeWorkflowPlanHash(input: Record<string, unknown>): string;
-export declare const WORKFLOW_MAX_CREDITS_EXCEEDED_ERROR_CODE = "max_credits_exceeded";
-export declare function readWorkflowRunMaxCredits(metadata: Record<string, unknown> | null | undefined): number | null;
-export declare const WORKFLOW_STANDING_AUTHORIZATION_METADATA_KEY = "standing_authorization";
-export declare const WORKFLOW_STANDING_AUTHORIZATION_POLICY_METADATA_KEY = "standing_authorization_policy";
-export declare const WORKFLOW_STANDING_AUTHORIZATION_POLICY_REVISION_BOUND_V1 = "revision_bound_v1";
-export declare const WORKFLOW_STANDING_AUTHORIZATION_REQUIRED_ERROR_CODE = "workflow_standing_authorization_required";
-export declare const WORKFLOW_STANDING_AUTHORIZATION_REQUIRED_MESSAGE = "This autonomous workflow can call tools and needs standing authorization for its current revision. Re-enable it with approved=true; pass a positive max_credits per delivery or omit it to use the plan default.";
-type WorkflowStandingAuthorizationBase = {
-    approved: true;
-    revisionId: string;
-    authorizedByActorId: string;
-    authorizedAt: string;
-};
-export type WorkflowStandingAuthorization = WorkflowStandingAuthorizationBase & ({
-    capPolicy: "explicit";
-    maxCredits: number;
-} | {
-    capPolicy: "plan_default";
-    maxCredits: null;
-});
-export declare function isAutonomousWorkflowTriggerType(value: unknown): value is "cron" | "webhook" | "event";
-/**
- * Whether this manifest can cross into a tool at runtime. Hosted workflows are
- * explicit in `steps`; oxygen-workflows-v2 graphs are explicit in `nodes`;
- * durable recipes declare the complete allowlist in `tools_used`. Keeping this
- * predicate structural means legacy revisions can be checked before execution
- * without trusting trigger metadata.
- *
- * The v2 branch is load-bearing, not cosmetic: this predicate is the ONLY input
- * to workflowRequiresStandingAuthorization, so a graph it does not recognise arms
- * a cron / webhook / event trigger with no standing authorization and therefore
- * no per-delivery credit ceiling. A `workflow` (sub-graph) node counts as well —
- * a child run can invoke tools of its own, and the gate must fail closed.
- */
-export declare function workflowManifestCanInvokeTool(manifest: unknown): boolean;
-/** The single apply/enable/runtime gate for standing autonomous authority. */
-export declare function workflowRequiresStandingAuthorization(manifest: unknown, triggerType?: unknown): boolean;
-/**
- * Runtime enforcement marker for triggers created or explicitly re-armed after
- * revision-bound standing authority shipped. Legacy active triggers have no
- * marker and stay runnable during the default-ceiling compatibility rollout;
- * every new/re-armed tool trigger carries this marker and fails closed if its
- * matching authorization is missing or stale.
- */
-export declare function workflowStandingAuthorizationPolicyIsEnforced(metadata: Record<string, unknown> | null | undefined, triggerDefaultCapsMode?: unknown): boolean;
-/**
- * Read the standing authority for one autonomous trigger revision. A null
- * result is fail-closed for policy-marked triggers. Legacy active rows
- * are distinguished by the separate policy marker so they can continue under
- * the fire-time default-ceiling compatibility rollout.
- */
-export declare function readWorkflowStandingAuthorization(metadata: Record<string, unknown> | null | undefined, revisionId: string): WorkflowStandingAuthorization | null;
-export declare function readWorkflowRunPreApprovedLabels(metadata: Record<string, unknown> | null | undefined): string[];
-export declare function readManagedToolRunCredits(output: unknown): number;
-export type WorkflowSpendCapDecision = {
-    allowed: boolean;
-    projectedCredits: number;
-};
-export declare function evaluateWorkflowRunSpendCap(input: {
-    maxCredits: number;
-    creditsUsed: number;
-    estimatedCredits?: number | null;
-}): WorkflowSpendCapDecision;

package/node_modules/@oxygen/workflows/dist/index.js

@@ -14,6 +14,7 @@ export * from "./graph/index.js";
 export * from "./graph/lint.js";
 export * from "./portable.js";
 export { RECIPE_TIMESTAMP_MILLIS_SOURCE } from "./recipe-timestamp.js";
+export * from "./refactor-internals/execution-policy.js";
 export const WORKFLOW_MANIFEST_VERSION = 1;
 export const WORKFLOW_COMPILER_VERSION = "oxygen-workflows-v1";
 export const DURABLE_RECIPE_COMPILER_VERSION = "oxygen-recipes-v2";
@@ -2025,199 +2026,6 @@ function isNonEmptyString(value) {
 // (OXYGEN_INTERNAL_WORKFLOW_TOOL_IDS). Both the worker's runtime registry and the
 // web's lint allowlist derive from it, so re-declaring it here would recreate
 // exactly the drift that broke crm-sync.
-// Live `workflows call` requests carry an approved max_credits spend cap in
-// the run's metadata (R-E.22(c)). These pure helpers are the single source of
-// truth for reading that cap and deciding whether the next paid tool step may
-// run; the worker's step loop and the durable-recipe runtime wrap the refusal
-// in an OxygenError with this code so the stop is visible as run/step state.
-export const WORKFLOW_MAX_CREDITS_EXCEEDED_ERROR_CODE = "max_credits_exceeded";
-// Matches the soft-ceiling epsilon used by table action runs so float drift
-// never refuses a run that is exactly at its cap.
-const WORKFLOW_SPEND_CAP_EPSILON = 0.000001;
-export function readWorkflowRunMaxCredits(metadata) {
-    if (!isRecord(metadata))
-        return null;
-    const raw = metadata.max_credits ?? metadata.maxCredits;
-    const parsed = typeof raw === "number"
-        ? raw
-        : typeof raw === "string" && raw.trim()
-            ? Number(raw)
-            : Number.NaN;
-    if (!Number.isFinite(parsed) || parsed <= 0)
-        return null;
-    return parsed;
-}
-export const WORKFLOW_STANDING_AUTHORIZATION_METADATA_KEY = "standing_authorization";
-export const WORKFLOW_STANDING_AUTHORIZATION_POLICY_METADATA_KEY = "standing_authorization_policy";
-export const WORKFLOW_STANDING_AUTHORIZATION_POLICY_REVISION_BOUND_V1 = "revision_bound_v1";
-export const WORKFLOW_STANDING_AUTHORIZATION_REQUIRED_ERROR_CODE = "workflow_standing_authorization_required";
-export const WORKFLOW_STANDING_AUTHORIZATION_REQUIRED_MESSAGE = "This autonomous workflow can call tools and needs standing authorization for its current revision. Re-enable it with approved=true; pass a positive max_credits per delivery or omit it to use the plan default.";
-export function isAutonomousWorkflowTriggerType(value) {
-    return value === "cron" || value === "webhook" || value === "event";
-}
-/**
- * Whether this manifest can cross into a tool at runtime. Hosted workflows are
- * explicit in `steps`; oxygen-workflows-v2 graphs are explicit in `nodes`;
- * durable recipes declare the complete allowlist in `tools_used`. Keeping this
- * predicate structural means legacy revisions can be checked before execution
- * without trusting trigger metadata.
- *
- * The v2 branch is load-bearing, not cosmetic: this predicate is the ONLY input
- * to workflowRequiresStandingAuthorization, so a graph it does not recognise arms
- * a cron / webhook / event trigger with no standing authorization and therefore
- * no per-delivery credit ceiling. A `workflow` (sub-graph) node counts as well —
- * a child run can invoke tools of its own, and the gate must fail closed.
- */
-export function workflowManifestCanInvokeTool(manifest) {
-    if (!isRecord(manifest))
-        return false;
-    // EVERY shape is checked and the results OR'd — deliberately not a chain of
-    // early returns dispatching on which field is present.
-    //
-    // The chain was a bypass: `tools_used` was tested first and returned from that
-    // branch, so a v2 graph manifest carrying an extra `tools_used: []` never
-    // reached the `nodes` check and reported "cannot invoke a tool". That is this
-    // predicate's ONLY input, so apply then skipped the standing-authorization gate
-    // for a cron-triggered graph full of tool nodes, left the trigger unmarked so
-    // the fire-time check was fooled too, and resolved a delivery cap of null — no
-    // ceiling at all. The graph linter accepts the extra key, so nothing else
-    // objected either.
-    //
-    // A manifest that carries a tool node CAN invoke a tool no matter what other
-    // fields it also carries, so the honest form is a union that fails closed.
-    const viaRecipe = Array.isArray(manifest.tools_used)
-        && manifest.tools_used.some((toolId) => isNonEmptyString(toolId));
-    const viaGraph = Array.isArray(manifest.nodes)
-        && manifest.nodes.some((node) => isRecord(node) && (node.kind === "tool"
-            || (isRecord(node.recipe)
-                && Array.isArray(node.recipe.tools_used)
-                && node.recipe.tools_used.some((toolId) => isNonEmptyString(toolId)))));
-    const viaSteps = Array.isArray(manifest.steps)
-        && manifest.steps.some((step) => isRecord(step) && step.kind === "tool");
-    return viaRecipe || viaGraph || viaSteps;
-}
-/** The single apply/enable/runtime gate for standing autonomous authority. */
-export function workflowRequiresStandingAuthorization(manifest, triggerType) {
-    const manifestTriggerType = isRecord(manifest)
-        && isRecord(manifest.trigger)
-        ? manifest.trigger.type
-        : "api";
-    return isAutonomousWorkflowTriggerType(triggerType ?? manifestTriggerType)
-        && workflowManifestCanInvokeTool(manifest);
-}
-/**
- * Runtime enforcement marker for triggers created or explicitly re-armed after
- * revision-bound standing authority shipped. Legacy active triggers have no
- * marker and stay runnable during the default-ceiling compatibility rollout;
- * every new/re-armed tool trigger carries this marker and fails closed if its
- * matching authorization is missing or stale.
- */
-export function workflowStandingAuthorizationPolicyIsEnforced(metadata, triggerDefaultCapsMode) {
-    return triggerDefaultCapsMode === "enforce"
-        || (isRecord(metadata)
-            && metadata[WORKFLOW_STANDING_AUTHORIZATION_POLICY_METADATA_KEY]
-                === WORKFLOW_STANDING_AUTHORIZATION_POLICY_REVISION_BOUND_V1);
-}
-/**
- * Read the standing authority for one autonomous trigger revision. A null
- * result is fail-closed for policy-marked triggers. Legacy active rows
- * are distinguished by the separate policy marker so they can continue under
- * the fire-time default-ceiling compatibility rollout.
- */
-export function readWorkflowStandingAuthorization(metadata, revisionId) {
-    if (!isRecord(metadata))
-        return null;
-    const raw = metadata[WORKFLOW_STANDING_AUTHORIZATION_METADATA_KEY];
-    if (!isRecord(raw) || raw.approved !== true)
-        return null;
-    const maxCredits = typeof raw.max_credits === "number"
-        ? raw.max_credits
-        : Number(raw.max_credits);
-    const capPolicy = raw.cap_policy === "plan_default"
-        ? "plan_default"
-        : raw.cap_policy === "explicit" || raw.cap_policy === undefined
-            ? "explicit"
-            : null;
-    const authorizedAt = typeof raw.authorized_at === "string" ? raw.authorized_at.trim() : "";
-    const authorizedByActorId = typeof raw.authorized_by_actor_id === "string"
-        ? raw.authorized_by_actor_id.trim()
-        : "";
-    if (!capPolicy
-        || (capPolicy === "explicit" && (!Number.isFinite(maxCredits) || maxCredits <= 0))
-        || raw.revision_id !== revisionId
-        || !authorizedByActorId
-        || !authorizedAt
-        || Number.isNaN(Date.parse(authorizedAt))) {
-        return null;
-    }
-    const base = {
-        approved: true,
-        revisionId,
-        authorizedByActorId,
-        authorizedAt,
-    };
-    return capPolicy === "explicit"
-        ? { ...base, capPolicy, maxCredits }
-        : { ...base, capPolicy, maxCredits: null };
-}
-// Approval labels the run's enqueue route already collected SYNCHRONOUS human
-// approval for (a CLI/MCP `approved=true` gate before the run was created), and
-// recorded in run metadata as `preapproved_labels`. A live ctx.approvals.require()
-// call whose `label` is in this set is honored immediately by both recipe
-// executors instead of creating and parking on a durable decision row. Every
-// other label goes through the same host-mediated durable gate under both local
-// and sandbox executors, and the max_credits spend cap is
-// enforced separately per paid tool step, so a pre-approved label never widens
-// spend. Only trusted server code (the enqueue route) sets this — it is read
-// from run metadata, never from user-suppliable workflow input.
-export function readWorkflowRunPreApprovedLabels(metadata) {
-    if (!isRecord(metadata))
-        return [];
-    const raw = metadata.preapproved_labels ?? metadata.preApprovedLabels;
-    if (!Array.isArray(raw))
-        return [];
-    const labels = raw
-        .filter((entry) => typeof entry === "string")
-        .map((entry) => entry.trim())
-        .filter((entry) => entry.length > 0);
-    return Array.from(new Set(labels));
-}
-// Completed tool runs attach their captured OXYGEN charge in `meta.billing`.
-// Managed provider credits and own-key platform fees both count toward an
-// approved workflow ceiling; user OAuth calls carry neither charge.
-export function readManagedToolRunCredits(output) {
-    if (!isRecord(output))
-        return 0;
-    const meta = output.meta;
-    if (!isRecord(meta))
-        return 0;
-    const billing = meta.billing;
-    if (!isRecord(billing))
-        return 0;
-    const credits = billing.credential_mode === "managed"
-        ? billing.managed_credit_estimate
-        : billing.credential_mode === "byok"
-            ? billing.byok_platform_fee_credits
-            : null;
-    if (typeof credits !== "number" || !Number.isFinite(credits) || credits <= 0)
-        return 0;
-    return credits;
-}
-// `estimatedCredits` is null when the next tool has no managed-credit price
-// (free, BYOK, or unknown catalog entry): such a step is only refused when
-// the cap is already breached, never pre-emptively.
-export function evaluateWorkflowRunSpendCap(input) {
-    const estimated = typeof input.estimatedCredits === "number"
-        && Number.isFinite(input.estimatedCredits)
-        && input.estimatedCredits > 0
-        ? input.estimatedCredits
-        : 0;
-    const projectedCredits = input.creditsUsed + estimated;
-    return {
-        allowed: projectedCredits <= input.maxCredits + WORKFLOW_SPEND_CAP_EPSILON,
-        projectedCredits,
-    };
-}
 function escapeRegExp(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }

package/node_modules/@oxygen/workflows/dist/refactor-internals/condition-comparison.d.ts

@@ -0,0 +1,18 @@
+export type WorkflowCompareOp = "eq" | "neq" | "gt" | "gte" | "lt" | "lte" | "contains" | "not_contains" | "starts_with" | "ends_with" | "is_empty" | "is_not_empty" | "in" | "not_in" | "matches";
+export declare function compareWorkflowConditionValues(left: unknown, op: WorkflowCompareOp, right: unknown): boolean;
+/**
+ * Compile a `matches` pattern, or return null when it is unsafe or invalid.
+ *
+ * Choice: conservative STATIC REJECTION rather than a linear (Thompson NFA)
+ * matcher. A linear engine would be several hundred lines of new, security-load-
+ * bearing code in a module the browser also bundles, whereas the patterns real
+ * GTM authors write (domain suffixes, job-title keywords, ID formats) never need
+ * the constructs rejected here. Rejected: sources over 200 characters,
+ * lookaround, backreferences, and a quantified group whose body itself contains
+ * an unbounded quantifier — the `(a+)+` family that drives catastrophic
+ * backtracking. Everything else compiles as a normal RegExp.
+ *
+ * The linter calls this at authoring time and reports `invalid_condition`, so a
+ * rejected pattern is a lint error the author sees, not a silent run-time false.
+ */
+export declare function compileConditionPattern(pattern: string): RegExp | null;