@oxygen-agent/cli 1.365.3 → 1.575.19

package/node_modules/@oxygen/workflows/dist/graph/types.d.ts

@@ -0,0 +1,270 @@
+import type { JsonSchema, WorkflowMode, WorkflowStatus, WorkflowStepEffect, WorkflowTriggerManifest } from "../index.js";
+export declare const WORKFLOW_GRAPH_MANIFEST_VERSION = 2;
+export declare const WORKFLOW_GRAPH_COMPILER_VERSION = "oxygen-workflows-v2";
+export declare const RESERVED_NODE_IDS: ReadonlySet<string>;
+export declare const LOOP_BODY_HANDLE = "loop_body";
+export declare const LOOP_DONE_HANDLE = "loop_done";
+export declare const ERROR_HANDLE = "error";
+export declare const RESERVED_EDGE_HANDLES: ReadonlySet<string>;
+/**
+ * Hard ceiling on the iterations a single `loop` node may run, independent of the
+ * node's declared `max_iterations`.
+ *
+ * ONE constant, shared by three consumers that must agree or the billing gates
+ * lie: the linter (an authored `max_iterations` above this is refused, so nobody
+ * authors a bound the runtime will silently ignore), the usage estimator (the
+ * per-run action floor multiplies by the declared cap, which therefore must be a
+ * cap the runtime honours), and the worker interpreter (which clamps every loop
+ * to this regardless of what the manifest says, so one run cannot monopolise a
+ * tenant tick).
+ */
+export declare const MAX_WORKFLOW_LOOP_ITERATIONS = 1000;
+/**
+ * Node kinds a v2 run bills an automation action for.
+ *
+ * The rest of the graph — trigger, filter, switch, loop, merge, set, wait, code —
+ * is in-process control flow that crosses no boundary and draws nothing. This set
+ * is the SINGLE definition of that contract: the worker interpreter records an
+ * automation action exactly for these kinds, the usage estimator prices exactly
+ * these kinds, and the run-allowance preflight subtracts settled rows of exactly
+ * these kinds. When the three disagree, the pre-write allowance gate reserves
+ * less than the run draws and a capped workspace strands partial writes — which
+ * is precisely what having one exported set prevents.
+ *
+ * `code` is deliberately free even though its v1 cousin (a `transform` step)
+ * bills: a v2 graph decomposes what was one v1 step into several nodes, and
+ * billing each of them would make the same motion cost several times more on the
+ * visual builder than in the CLI.
+ */
+export declare const BILLABLE_WORKFLOW_GRAPH_NODE_KINDS: ReadonlySet<string>;
+/** Whether a v2 node of this kind draws an automation action when it executes. */
+export declare function workflowGraphNodeKindBills(kind: string): boolean;
+/**
+ * How a node input is bound to a value at run time. A deliberate sibling of
+ * tenant-db's ColumnValueRef so Tables and Workflows share one binding
+ * vocabulary — a user who learned column bindings already knows node bindings.
+ */
+export type WorkflowValueRef = 
+/** Use `value` verbatim. */
+{
+    type: "literal";
+    value: unknown;
+}
+/** Interpolated string, e.g. "Hi {{ nodes.find_person.output.first_name }}". */
+ | {
+    type: "template";
+    value: string;
+}
+/** A single scope path: "trigger.input.x" | "steps.<id>.output.y" | "loop.<id>.item.z". */
+ | {
+    type: "ref";
+    path: string;
+}
+/** An OXYGEN formula-language expression (packages/formula). */
+ | {
+    type: "formula";
+    expression: string;
+}
+/** Knowledge-layer company profile, optionally a path inside it. */
+ | {
+    type: "context_profile";
+    path?: string;
+}
+/** A specific Knowledge-layer asset, optionally a path inside it. */
+ | {
+    type: "context_asset";
+    assetId: string;
+    path?: string;
+};
+export type WorkflowValueRefType = WorkflowValueRef["type"];
+export type WorkflowCompareOp = "eq" | "neq" | "gt" | "gte" | "lt" | "lte" | "contains" | "not_contains" | "starts_with" | "ends_with" | "is_empty" | "is_not_empty" | "in" | "not_in" | "matches";
+/**
+ * A structured (never source-code) predicate, so the editor can render it and the
+ * runtime can evaluate it without a sandbox.
+ *
+ * `right` is omitted for the unary operators (`is_empty` / `is_not_empty`).
+ */
+export type WorkflowCondition = {
+    type: "group";
+    op: "all" | "any";
+    not?: boolean;
+    children: WorkflowCondition[];
+} | {
+    type: "compare";
+    left: WorkflowValueRef;
+    op: WorkflowCompareOp;
+    right?: WorkflowValueRef;
+};
+type WorkflowGraphNodeBase = {
+    id: string;
+    name: string;
+    description?: string;
+    /** Canvas position. Presentation only — it never affects execution order. */
+    ui: {
+        x: number;
+        y: number;
+    };
+    /** Kept in the graph but skipped at run time. */
+    disabled?: boolean;
+    /** Route failures to the "error" handle instead of failing the run. */
+    continue_on_error?: boolean;
+    /**
+     * Per-node retry, for a provider that fails transiently — a rate limit, a flaky
+     * upstream. n8n, Make and Zapier all expose this per step; without it "retry
+     * this enrichment twice with a pause" has to be hand-built from wait + switch.
+     *
+     * It can only ever NARROW. The worker consults it AFTER
+     * isRetryableWorkflowStepError has already permitted a retry, so it bounds
+     * attempts and sets the pause but can never authorize one the safety rules
+     * refuse. A live `external_write` is still never auto-retried whatever this
+     * says: an ambiguous network error may have LANDED, and no replay cache makes a
+     * second call a no-op.
+     */
+    retry?: {
+        /** Attempts for THIS node, counting the first. */
+        max_attempts: number;
+        /** Fixed pause between attempts. Omitted means the run's usual backoff. */
+        wait_seconds?: number;
+    };
+};
+/** Bounds on a node's own retry budget. */
+export declare const MAX_WORKFLOW_NODE_RETRY_ATTEMPTS = 5;
+export declare const MAX_WORKFLOW_NODE_RETRY_WAIT_SECONDS = 3600;
+export type WorkflowGraphNode = 
+/** The run's entry point. Its output is the trigger payload. */
+(WorkflowGraphNodeBase & {
+    kind: "trigger";
+}) | (WorkflowGraphNodeBase & {
+    kind: "tool";
+    tool: string;
+    effect: WorkflowStepEffect;
+    mode?: WorkflowMode;
+    /** Per-node managed-credit ceiling, same semantics as v1 tool steps. */
+    max_credits?: number;
+    params: Record<string, WorkflowValueRef>;
+})
+/** Passes execution on only when `when` holds. */
+ | (WorkflowGraphNodeBase & {
+    kind: "filter";
+    when: WorkflowCondition;
+})
+/**
+ * Multi-way branch. Each case owns an outgoing handle named by its `id`;
+ * `fallthrough` allows every matching case to fire instead of only the first.
+ */
+ | (WorkflowGraphNodeBase & {
+    kind: "switch";
+    cases: Array<{
+        id: string;
+        label: string;
+        when: WorkflowCondition;
+    }>;
+    fallthrough?: boolean;
+})
+/**
+ * Iterates `over`. The "loop_body" handle enters the body; the body's last node
+ * edges back to this node (the one legal back-edge); "loop_done" continues after.
+ */
+ | (WorkflowGraphNodeBase & {
+    kind: "loop";
+    over: WorkflowValueRef;
+    item_name?: string;
+    max_iterations?: number;
+    concurrency?: number;
+})
+/** Joins several inbound edges back into one. */
+ | (WorkflowGraphNodeBase & {
+    kind: "merge";
+    strategy: "append" | "first" | "wait_all";
+})
+/** Builds a plain object output from bound fields. */
+ | (WorkflowGraphNodeBase & {
+    kind: "set";
+    fields: Array<{
+        key: string;
+        value: WorkflowValueRef;
+    }>;
+    keep_input?: boolean;
+})
+/** Delays for a fixed duration, or until `until` evaluates truthy. */
+ | (WorkflowGraphNodeBase & {
+    kind: "wait";
+    duration_seconds?: number;
+    until?: WorkflowValueRef;
+})
+/**
+ * Blocks the run until a human approves. The one node kind whose output is a
+ * decision rather than data: on approval execution continues out the default
+ * handle; on rejection the run ends terminally, because "proceed anyway" is
+ * exactly what an approval gate exists to prevent (the primitive's
+ * "approvals block, never advise" invariant).
+ *
+ * `reason` and `request` are for the person deciding — they are resolved and
+ * stored on the approval row, so the approver sees why they were asked and
+ * what is about to happen instead of only a node id. Non-live modes pass
+ * through without asking: a dry run has no side effect to authorize, and
+ * blocking a preview on a human would make previews unusable.
+ */
+ | (WorkflowGraphNodeBase & {
+    kind: "approval";
+    reason?: WorkflowValueRef;
+    request?: Record<string, WorkflowValueRef>;
+})
+/** Sandboxed transform source, the v2 spelling of a v1 transform step. */
+ | (WorkflowGraphNodeBase & {
+    kind: "code";
+    run_source: string;
+})
+/** Calls another workflow as a child run. */
+ | (WorkflowGraphNodeBase & {
+    kind: "workflow";
+    workflow_id: string;
+    input: Record<string, WorkflowValueRef>;
+});
+export type WorkflowGraphNodeKind = WorkflowGraphNode["kind"];
+/** Narrow a node union member by its `kind` discriminant. */
+export type WorkflowGraphNodeOfKind<K extends WorkflowGraphNodeKind> = Extract<WorkflowGraphNode, {
+    kind: K;
+}>;
+/**
+ * A directed execution edge.
+ *
+ * `source_handle` names which output of the source node this edge leaves from:
+ * a `switch` case id, "loop_body", "loop_done", "error", or undefined for the
+ * node's default output.
+ */
+export type WorkflowGraphEdge = {
+    id: string;
+    source: string;
+    source_handle?: string;
+    target: string;
+};
+export type WorkflowGraphManifest = {
+    manifest_version: typeof WORKFLOW_GRAPH_MANIFEST_VERSION;
+    workflow: {
+        id: string;
+        name: string;
+        status?: WorkflowStatus;
+    };
+    specification?: string;
+    trigger?: WorkflowTriggerManifest;
+    input_schema?: JsonSchema;
+    nodes: WorkflowGraphNode[];
+    edges: WorkflowGraphEdge[];
+    /** Per-RUN managed-credit ceiling, same semantics as WorkflowManifest.max_credits. */
+    max_credits?: number;
+    source_hash: string;
+    compiler_version: typeof WORKFLOW_GRAPH_COMPILER_VERSION;
+    created_at: string;
+};
+/**
+ * Shape gate only — enough to route a manifest to the v2 code path. Full
+ * structural validation is the linter's job, not this guard's.
+ */
+export declare function isWorkflowGraphManifest(value: unknown): value is WorkflowGraphManifest;
+export declare function isTriggerNode(node: WorkflowGraphNode): node is WorkflowGraphNodeOfKind<"trigger">;
+export declare function isToolNode(node: WorkflowGraphNode): node is WorkflowGraphNodeOfKind<"tool">;
+export declare function isSwitchNode(node: WorkflowGraphNode): node is WorkflowGraphNodeOfKind<"switch">;
+export declare function isLoopNode(node: WorkflowGraphNode): node is WorkflowGraphNodeOfKind<"loop">;
+export declare function isWorkflowSubgraphNode(node: WorkflowGraphNode): node is WorkflowGraphNodeOfKind<"workflow">;
+export {};

package/node_modules/@oxygen/workflows/dist/graph/types.js

@@ -0,0 +1,93 @@
+export const WORKFLOW_GRAPH_MANIFEST_VERSION = 2;
+export const WORKFLOW_GRAPH_COMPILER_VERSION = "oxygen-workflows-v2";
+// Node ids become keys on the runtime scope object (`steps.<id>.output`), exactly
+// as v1 step ids become keys on ctx.steps. The same JavaScript-internals collision
+// applies: a node named `__proto__` would silently lose its output.
+export const RESERVED_NODE_IDS = new Set([
+    "__proto__",
+    "constructor",
+    "prototype",
+]);
+// Reserved edge source handles. Anything else in `source_handle` must name a
+// case id on a `switch` node.
+export const LOOP_BODY_HANDLE = "loop_body";
+export const LOOP_DONE_HANDLE = "loop_done";
+export const ERROR_HANDLE = "error";
+export const RESERVED_EDGE_HANDLES = new Set([
+    LOOP_BODY_HANDLE,
+    LOOP_DONE_HANDLE,
+    ERROR_HANDLE,
+]);
+/**
+ * Hard ceiling on the iterations a single `loop` node may run, independent of the
+ * node's declared `max_iterations`.
+ *
+ * ONE constant, shared by three consumers that must agree or the billing gates
+ * lie: the linter (an authored `max_iterations` above this is refused, so nobody
+ * authors a bound the runtime will silently ignore), the usage estimator (the
+ * per-run action floor multiplies by the declared cap, which therefore must be a
+ * cap the runtime honours), and the worker interpreter (which clamps every loop
+ * to this regardless of what the manifest says, so one run cannot monopolise a
+ * tenant tick).
+ */
+export const MAX_WORKFLOW_LOOP_ITERATIONS = 1_000;
+/**
+ * Node kinds a v2 run bills an automation action for.
+ *
+ * The rest of the graph — trigger, filter, switch, loop, merge, set, wait, code —
+ * is in-process control flow that crosses no boundary and draws nothing. This set
+ * is the SINGLE definition of that contract: the worker interpreter records an
+ * automation action exactly for these kinds, the usage estimator prices exactly
+ * these kinds, and the run-allowance preflight subtracts settled rows of exactly
+ * these kinds. When the three disagree, the pre-write allowance gate reserves
+ * less than the run draws and a capped workspace strands partial writes — which
+ * is precisely what having one exported set prevents.
+ *
+ * `code` is deliberately free even though its v1 cousin (a `transform` step)
+ * bills: a v2 graph decomposes what was one v1 step into several nodes, and
+ * billing each of them would make the same motion cost several times more on the
+ * visual builder than in the CLI.
+ */
+export const BILLABLE_WORKFLOW_GRAPH_NODE_KINDS = new Set([
+    "tool",
+    "workflow",
+]);
+/** Whether a v2 node of this kind draws an automation action when it executes. */
+export function workflowGraphNodeKindBills(kind) {
+    return BILLABLE_WORKFLOW_GRAPH_NODE_KINDS.has(kind);
+}
+/** Bounds on a node's own retry budget. */
+export const MAX_WORKFLOW_NODE_RETRY_ATTEMPTS = 5;
+export const MAX_WORKFLOW_NODE_RETRY_WAIT_SECONDS = 3_600;
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * Shape gate only — enough to route a manifest to the v2 code path. Full
+ * structural validation is the linter's job, not this guard's.
+ */
+export function isWorkflowGraphManifest(value) {
+    return isRecord(value)
+        && value.manifest_version === WORKFLOW_GRAPH_MANIFEST_VERSION
+        && value.compiler_version === WORKFLOW_GRAPH_COMPILER_VERSION
+        && Array.isArray(value.nodes)
+        && Array.isArray(value.edges);
+}
+function isNodeOfKind(node, kind) {
+    return node.kind === kind;
+}
+export function isTriggerNode(node) {
+    return isNodeOfKind(node, "trigger");
+}
+export function isToolNode(node) {
+    return isNodeOfKind(node, "tool");
+}
+export function isSwitchNode(node) {
+    return isNodeOfKind(node, "switch");
+}
+export function isLoopNode(node) {
+    return isNodeOfKind(node, "loop");
+}
+export function isWorkflowSubgraphNode(node) {
+    return isNodeOfKind(node, "workflow");
+}

package/node_modules/@oxygen/workflows/dist/index.d.ts

@@ -1,4 +1,10 @@
+import { type WorkflowGraphManifest } from "./graph/types.js";
+import type { ToolParamFields, ToolParamSpec } from "./graph/params.js";
 export * from "./usage-estimate.js";
+export * from "./event-dispatch.js";
+export type { CanonicalWorkflowToolEffect } from "./tool-effects.js";
+export * from "./graph/index.js";
+export * from "./graph/lint.js";
 export declare const WORKFLOW_MANIFEST_VERSION = 1;
 export declare const WORKFLOW_COMPILER_VERSION = "oxygen-workflows-v1";
 export declare const DURABLE_RECIPE_COMPILER_VERSION = "oxygen-recipes-v2";
@@ -148,7 +154,7 @@ export type RecipeManifest = {
     compiler_version: typeof DURABLE_RECIPE_COMPILER_VERSION;
     created_at: string;
 };
-export type AnyWorkflowManifest = WorkflowManifest | RecipeManifest;
+export type AnyWorkflowManifest = WorkflowManifest | RecipeManifest | WorkflowGraphManifest;
 export type BlueprintColumnInput = {
     key?: string;
     label: string;
@@ -269,6 +275,23 @@ export type WorkflowLintResult = {
 export type JsonSchemaValidationIssue = WorkflowLintIssue;
 export type WorkflowManifestValidationOptions = {
     isToolAllowed?: (toolId: string) => boolean;
+    /**
+     * A tool's input fields, so lint can tell whether a node is actually filled in.
+     *
+     * Injected exactly like resolveToolEffect and for the same reason: the field
+     * list lives in @oxygen/tools / @oxygen/mcp-server, which the CLI and the
+     * browser bundle cannot carry. Omitting it SKIPS the check rather than
+     * refusing — but every SERVER lint path must inject it, because without it the
+     * editor blocks a node that `apply` then accepts, which is precisely the
+     * GUI-only guarantee this option exists to end.
+     */
+    /**
+     * Accepts a bare field list or a `{ fields, closed }` pair. The union is
+     * deliberate: it widens the contract for callers that can report whether the
+     * schema is closed without touching the ones that cannot.
+     */
+    resolveToolParamFields?: (toolId: string) => readonly ToolParamSpec[] | ToolParamFields | null;
+    resolveToolEffect?: (toolId: string) => WorkflowStepEffect | null;
 };
 export declare function defineWorkflow(input: {
     id: string;
@@ -345,6 +368,13 @@ export declare function branchStep(input: {
 export declare function isWorkflowDefinition(value: unknown): value is WorkflowDefinition;
 export declare function isWorkflowManifest(value: unknown): value is WorkflowManifest;
 export declare function isRecipeManifest(value: unknown): value is RecipeManifest;
+/**
+ * Every manifest shape the platform can store and run: v1 hosted steps, durable
+ * recipes, and oxygen-workflows-v2 graphs. This is the gate `workflows apply`
+ * and the CLI loader route through, so a shape listed here must already have a
+ * linter and a worker execution path — accepting a manifest we cannot run would
+ * cut a revision that fails at run time instead of at authoring time.
+ */
 export declare function isAnyWorkflowManifest(value: unknown): value is AnyWorkflowManifest;
 export declare function compileWorkflowDefinition(// skipcq: JS-R1005 -- compiler validates workflow metadata, trigger, steps, branch targets, and defaults together.
 definition: WorkflowDefinition, options?: {
@@ -365,6 +395,7 @@ export declare function buildRecipeManifest(input: {
     sourceHash?: string;
     createdAt?: Date;
 }): RecipeManifest;
+export declare function validateOptionalMaxCredits(value: unknown, path: string, add: (path: string, code: string, message: string) => void): void;
 export declare function lintWorkflowManifest(// skipcq: JS-R1005
 value: unknown, options?: WorkflowManifestValidationOptions): WorkflowLintResult;
 export declare function lintRecipeManifest(// skipcq: JS-R1005
@@ -411,6 +442,15 @@ export declare const workflowApplySchema: {
         readonly manifest: {
             readonly $ref: "#/$defs/manifest";
         };
+        readonly approved: {
+            readonly type: "boolean";
+            readonly description: "Standing tool authorization for this exact autonomous revision.";
+        };
+        readonly max_credits: {
+            readonly type: "number";
+            readonly exclusiveMinimum: 0;
+            readonly description: "Hard credit ceiling for each autonomous delivery.";
+        };
     };
     readonly required: readonly ["manifest"];
     readonly $defs: {
@@ -553,6 +593,15 @@ export declare function getWorkflowSchema(subject?: "apply" | "call" | "event" |
         readonly manifest: {
             readonly $ref: "#/$defs/manifest";
         };
+        readonly approved: {
+            readonly type: "boolean";
+            readonly description: "Standing tool authorization for this exact autonomous revision.";
+        };
+        readonly max_credits: {
+            readonly type: "number";
+            readonly exclusiveMinimum: 0;
+            readonly description: "Hard credit ceiling for each autonomous delivery.";
+        };
     };
     readonly required: readonly ["manifest"];
     readonly $defs: {
@@ -692,6 +741,15 @@ export declare function getWorkflowSchema(subject?: "apply" | "call" | "event" |
                 readonly manifest: {
                     readonly $ref: "#/$defs/manifest";
                 };
+                readonly approved: {
+                    readonly type: "boolean";
+                    readonly description: "Standing tool authorization for this exact autonomous revision.";
+                };
+                readonly max_credits: {
+                    readonly type: "number";
+                    readonly exclusiveMinimum: 0;
+                    readonly description: "Hard credit ceiling for each autonomous delivery.";
+                };
             };
             readonly required: readonly ["manifest"];
             readonly $defs: {
@@ -827,9 +885,63 @@ export declare function getWorkflowSchema(subject?: "apply" | "call" | "event" |
         };
     };
 };
+export declare function validateTrigger(// skipcq: JS-R1005
+value: unknown, path: string, add: (path: string, code: string, message: string) => void): void;
+export declare function validatePureFunctionSource(source: string, path: string, add: (path: string, code: string, message: string) => void): void;
+export declare function isWorkflowToolRejected(toolId: string): boolean;
 export declare function computeWorkflowPlanHash(input: Record<string, unknown>): string;
 export declare const WORKFLOW_MAX_CREDITS_EXCEEDED_ERROR_CODE = "max_credits_exceeded";
 export declare function readWorkflowRunMaxCredits(metadata: Record<string, unknown> | null | undefined): number | null;
+export declare const WORKFLOW_STANDING_AUTHORIZATION_METADATA_KEY = "standing_authorization";
+export declare const WORKFLOW_STANDING_AUTHORIZATION_POLICY_METADATA_KEY = "standing_authorization_policy";
+export declare const WORKFLOW_STANDING_AUTHORIZATION_POLICY_REVISION_BOUND_V1 = "revision_bound_v1";
+export declare const WORKFLOW_STANDING_AUTHORIZATION_REQUIRED_ERROR_CODE = "workflow_standing_authorization_required";
+export declare const WORKFLOW_STANDING_AUTHORIZATION_REQUIRED_MESSAGE = "This autonomous workflow can call tools and needs standing authorization for its current revision. Re-enable it with approved=true; pass a positive max_credits per delivery or omit it to use the plan default.";
+type WorkflowStandingAuthorizationBase = {
+    approved: true;
+    revisionId: string;
+    authorizedByActorId: string;
+    authorizedAt: string;
+};
+export type WorkflowStandingAuthorization = WorkflowStandingAuthorizationBase & ({
+    capPolicy: "explicit";
+    maxCredits: number;
+} | {
+    capPolicy: "plan_default";
+    maxCredits: null;
+});
+export declare function isAutonomousWorkflowTriggerType(value: unknown): value is "cron" | "webhook" | "event";
+/**
+ * Whether this manifest can cross into a tool at runtime. Hosted workflows are
+ * explicit in `steps`; oxygen-workflows-v2 graphs are explicit in `nodes`;
+ * durable recipes declare the complete allowlist in `tools_used`. Keeping this
+ * predicate structural means legacy revisions can be checked before execution
+ * without trusting trigger metadata.
+ *
+ * The v2 branch is load-bearing, not cosmetic: this predicate is the ONLY input
+ * to workflowRequiresStandingAuthorization, so a graph it does not recognise arms
+ * a cron / webhook / event trigger with no standing authorization and therefore
+ * no per-delivery credit ceiling. A `workflow` (sub-graph) node counts as well —
+ * a child run can invoke tools of its own, and the gate must fail closed.
+ */
+export declare function workflowManifestCanInvokeTool(manifest: unknown): boolean;
+/** The single apply/enable/runtime gate for standing autonomous authority. */
+export declare function workflowRequiresStandingAuthorization(manifest: unknown, triggerType?: unknown): boolean;
+/**
+ * Runtime enforcement marker for triggers created or explicitly re-armed after
+ * revision-bound standing authority shipped. Legacy active triggers have no
+ * marker and stay runnable during the default-ceiling compatibility rollout;
+ * every new/re-armed tool trigger carries this marker and fails closed if its
+ * matching authorization is missing or stale.
+ */
+export declare function workflowStandingAuthorizationPolicyIsEnforced(metadata: Record<string, unknown> | null | undefined, triggerDefaultCapsMode?: unknown): boolean;
+/**
+ * Read the standing authority for one autonomous trigger revision. A null
+ * result is fail-closed for policy-marked triggers. Legacy active rows
+ * are distinguished by the separate policy marker so they can continue under
+ * the fire-time default-ceiling compatibility rollout.
+ */
+export declare function readWorkflowStandingAuthorization(metadata: Record<string, unknown> | null | undefined, revisionId: string): WorkflowStandingAuthorization | null;
 export declare function readWorkflowRunPreApprovedLabels(metadata: Record<string, unknown> | null | undefined): string[];
 export declare function readManagedToolRunCredits(output: unknown): number;
 export type WorkflowSpendCapDecision = {