@roarpeng/graphflow 1.12.2 → 1.14.0

package/dist/security/secure-store.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encryptString = encryptString;
+exports.decryptString = decryptString;
+exports.encryptJson = encryptJson;
+exports.decryptJson = decryptJson;
+const node_crypto_1 = require("node:crypto");
+function keyFromPassphrase(passphrase, salt) {
+    return (0, node_crypto_1.scryptSync)(passphrase, salt, 32, { N: 16384, r: 8, p: 1 });
+}
+function encryptString(plaintext, passphrase) {
+    const salt = (0, node_crypto_1.randomBytes)(16);
+    const iv = (0, node_crypto_1.randomBytes)(12);
+    const cipher = (0, node_crypto_1.createCipheriv)("aes-256-gcm", keyFromPassphrase(passphrase, salt), iv);
+    const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+    return {
+        v: 1,
+        alg: "aes-256-gcm",
+        salt: salt.toString("base64"),
+        iv: iv.toString("base64"),
+        tag: cipher.getAuthTag().toString("base64"),
+        ciphertext: ciphertext.toString("base64"),
+    };
+}
+function decryptString(envelope, passphrase) {
+    if (envelope.alg !== "aes-256-gcm" || envelope.v !== 1) {
+        throw new Error("unsupported encrypted envelope");
+    }
+    const decipher = (0, node_crypto_1.createDecipheriv)(envelope.alg, keyFromPassphrase(passphrase, Buffer.from(envelope.salt, "base64")), Buffer.from(envelope.iv, "base64"));
+    decipher.setAuthTag(Buffer.from(envelope.tag, "base64"));
+    return Buffer.concat([
+        decipher.update(Buffer.from(envelope.ciphertext, "base64")),
+        decipher.final(),
+    ]).toString("utf8");
+}
+function encryptJson(value, passphrase) {
+    return encryptString(JSON.stringify(value), passphrase);
+}
+function decryptJson(envelope, passphrase) {
+    return JSON.parse(decryptString(envelope, passphrase));
+}
+//# sourceMappingURL=secure-store.js.map

package/dist/security/secure-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-store.js","sourceRoot":"","sources":["../../src/security/secure-store.ts"],"names":[],"mappings":";;AAeA,sCAaC;AAED,sCAcC;AAED,kCAEC;AAED,kCAEC;AApDD,6CAAwF;AAWxF,SAAS,iBAAiB,CAAC,UAAkB,EAAE,IAAY;IACzD,OAAO,IAAA,wBAAU,EAAC,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,SAAgB,aAAa,CAAC,SAAiB,EAAE,UAAkB;IACjE,MAAM,IAAI,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,EAAE,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,aAAa,EAAE,iBAAiB,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACtF,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACrF,OAAO;QACL,CAAC,EAAE,CAAC;QACJ,GAAG,EAAE,aAAa;QAClB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7B,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3C,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,SAAgB,aAAa,CAAC,QAA2B,EAAE,UAAkB;IAC3E,IAAI,QAAQ,CAAC,GAAG,KAAK,aAAa,IAAI,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,QAAQ,GAAG,IAAA,8BAAgB,EAC/B,QAAQ,CAAC,GAAG,EACZ,iBAAiB,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,EACnE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CACnC,CAAC;IACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC3D,QAAQ,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,SAAgB,WAAW,CAAC,KAAc,EAAE,UAAkB;IAC5D,OAAO,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC;AAC1D,CAAC;AAED,SAAgB,WAAW,CAAI,QAA2B,EAAE,UAAkB;IAC5E,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAM,CAAC;AAC9D,CAAC"}

package/dist/security/token-auth.d.ts

@@ -0,0 +1,23 @@
+export interface TokenAuthConfig {
+    /** Shared-secret bearer tokens for local/team deployments. */
+    bearerTokens?: readonly string[];
+    /** HS256 JWT secret. */
+    jwtSecret?: string;
+    /** RS256/ES256 public key PEM for OIDC providers. */
+    publicKeyPem?: string;
+    issuer?: string;
+    audience?: string;
+    requiredScope?: string;
+}
+export declare function verifyAccessToken(authorizationHeader: string | undefined, config: TokenAuthConfig): Promise<{
+    authenticated: boolean;
+    subject?: string;
+    reason?: string;
+}>;
+export declare function issueLocalJwt(subject: string, secret: string, options?: {
+    issuer?: string;
+    audience?: string;
+    scope?: string;
+    ttlSeconds?: number;
+}): string;
+//# sourceMappingURL=token-auth.d.ts.map

package/dist/security/token-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-auth.d.ts","sourceRoot":"","sources":["../../src/security/token-auth.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAwCD,wBAAsB,iBAAiB,CACrC,mBAAmB,EAAE,MAAM,GAAG,SAAS,EACvC,MAAM,EAAE,eAAe,GACtB,OAAO,CAAC;IAAE,aAAa,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAkDxE;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,GACxF,MAAM,CAeR"}

package/dist/security/token-auth.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyAccessToken = verifyAccessToken;
+exports.issueLocalJwt = issueLocalJwt;
+const node_crypto_1 = require("node:crypto");
+function splitToken(token) {
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        return undefined;
+    try {
+        return {
+            header: JSON.parse(Buffer.from(parts[0], "base64url").toString("utf8")),
+            payload: JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8")),
+            signature: Buffer.from(parts[2], "base64url"),
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+function secureEquals(left, right) {
+    const a = Buffer.from(left);
+    const b = Buffer.from(right);
+    return a.length === b.length && (0, node_crypto_1.timingSafeEqual)(a, b);
+}
+async function verifyAccessToken(authorizationHeader, config) {
+    if (!authorizationHeader?.startsWith("Bearer ")) {
+        return { authenticated: false, reason: "missing bearer token" };
+    }
+    const token = authorizationHeader.slice(7).trim();
+    for (const expected of config.bearerTokens ?? []) {
+        if (expected && secureEquals(token, expected)) {
+            return { authenticated: true, subject: "bearer" };
+        }
+    }
+    const jwt = splitToken(token);
+    if (!jwt || typeof jwt.payload !== "object" || jwt.payload === null) {
+        return { authenticated: false, reason: "invalid token" };
+    }
+    const signed = `${token.split(".")[0]}.${token.split(".")[1]}`;
+    let verified = false;
+    if (jwt.header?.alg === "HS256" && config.jwtSecret) {
+        const expected = (0, node_crypto_1.createHmac)("sha256", config.jwtSecret).update(signed).digest();
+        verified = expected.length === jwt.signature.length && (0, node_crypto_1.timingSafeEqual)(expected, jwt.signature);
+    }
+    else if ((jwt.header?.alg === "RS256" || jwt.header?.alg === "ES256") &&
+        config.publicKeyPem) {
+        try {
+            verified = (0, node_crypto_1.verify)(jwt.header.alg, Buffer.from(signed), (0, node_crypto_1.createPublicKey)(config.publicKeyPem), jwt.signature);
+        }
+        catch {
+            verified = false;
+        }
+    }
+    if (!verified)
+        return { authenticated: false, reason: "signature rejected" };
+    if (config.issuer && jwt.payload.iss !== config.issuer) {
+        return { authenticated: false, reason: "issuer rejected" };
+    }
+    const audience = Array.isArray(jwt.payload.aud) ? jwt.payload.aud : [jwt.payload.aud];
+    if (config.audience && !audience.includes(config.audience)) {
+        return { authenticated: false, reason: "audience rejected" };
+    }
+    const scopes = typeof jwt.payload.scope === "string" ? jwt.payload.scope.split(/\s+/) : [];
+    if (config.requiredScope && !scopes.includes(config.requiredScope)) {
+        return { authenticated: false, reason: "scope rejected" };
+    }
+    return { authenticated: true, subject: typeof jwt.payload.sub === "string" ? jwt.payload.sub : "jwt" };
+}
+function issueLocalJwt(subject, secret, options = {}) {
+    const encode = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
+    const now = Math.floor(Date.now() / 1000);
+    const header = encode({ alg: "HS256", typ: "JWT" });
+    const payload = encode({
+        sub: subject,
+        ...(options.issuer ? { iss: options.issuer } : {}),
+        ...(options.audience ? { aud: options.audience } : {}),
+        ...(options.scope ? { scope: options.scope } : {}),
+        iat: now,
+        exp: now + (options.ttlSeconds ?? 3600),
+    });
+    const data = `${header}.${payload}`;
+    const signature = (0, node_crypto_1.createHmac)("sha256", secret).update(data).digest("base64url");
+    return `${data}.${signature}`;
+}
+//# sourceMappingURL=token-auth.js.map

package/dist/security/token-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-auth.js","sourceRoot":"","sources":["../../src/security/token-auth.ts"],"names":[],"mappings":";;AAoDA,8CAqDC;AAED,sCAmBC;AA9HD,6CAAmG;AAgCnG,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,CAAC;QACH,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAc;YACrF,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAc;YACtF,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC;SAC/C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,KAAa;IAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAEM,KAAK,UAAU,iBAAiB,CACrC,mBAAuC,EACvC,MAAuB;IAEvB,IAAI,CAAC,mBAAmB,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAElD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QACjD,IAAI,QAAQ,IAAI,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QACpD,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACpE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC3D,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,GAAG,CAAC,MAAM,EAAE,GAAG,KAAK,OAAO,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;QAChF,QAAQ,GAAG,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IAClG,CAAC;SAAM,IACL,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,KAAK,OAAO,IAAI,GAAG,CAAC,MAAM,EAAE,GAAG,KAAK,OAAO,CAAC;QAC5D,MAAM,CAAC,YAAY,EACnB,CAAC;QACD,IAAI,CAAC;YACH,QAAQ,GAAG,IAAA,oBAAY,EACrB,GAAG,CAAC,MAAM,CAAC,GAAG,EACd,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACnB,IAAA,6BAAe,EAAC,MAAM,CAAC,YAAY,CAAC,EACpC,GAAG,CAAC,SAAS,CACd,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAE7E,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QACvD,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC7D,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtF,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;AACzG,CAAC;AAED,SAAgB,aAAa,CAC3B,OAAe,EACf,MAAc,EACd,UAAuF,EAAE;IAEzF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3F,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC;QACrB,GAAG,EAAE,OAAO;QACZ,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;KACxC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAChF,OAAO,GAAG,IAAI,IAAI,SAAS,EAAE,CAAC;AAChC,CAAC"}

package/dist/surfaces/cli/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+const node_fs_1 = require("node:fs");
 const runtime_1 = require("./runtime");
 const loader_js_1 = require("../../config/loader.js");
 const episodic_memory_1 = require("../../learning/episodic-memory");
@@ -102,7 +103,7 @@ async function executeCommand(command, args, configPath) {
         const episodeId = args[1]?.trim();
         const success = (0, output_1.parseCliSuccess)(args[2]);
         if (!episodeId || success === undefined) {
-            console.log("Usage: graphflow outcome report <episodeId> <success> [--lesson <text>]... [--deviation <none|misread-requirement|scope-creep|tech-drift>] [--requirement-id <id>]... [--concept-id <id>]... [--code-hint <hint>]...");
+            console.log("Usage: graphflow outcome report <episodeId> <success> [--lesson <text>]... [--commit <sha>] [--diff <diff>] [--test-command <cmd>] [--test-result pass|fail|unknown] [--user-confirmed] ...");
             process.exitCode = 1;
             return undefined;
         }
@@ -112,6 +113,26 @@ async function executeCommand(command, args, configPath) {
         const requirementIds = (0, output_1.collectCliFlagValues)(args, "--requirement-id");
         const conceptIds = (0, output_1.collectCliFlagValues)(args, "--concept-id");
         const codeHints = (0, output_1.collectCliFlagValues)(args, "--code-hint");
+        const commit = (0, output_1.readCliFlagValue)(args, "--commit");
+        const diff = (0, output_1.readCliFlagValue)(args, "--diff");
+        const testCommand = (0, output_1.readCliFlagValue)(args, "--test-command");
+        const testResultRaw = (0, output_1.readCliFlagValue)(args, "--test-result");
+        const evidenceSourceRaw = (0, output_1.readCliFlagValue)(args, "--evidence-source");
+        const repository = (0, output_1.readCliFlagValue)(args, "--repository");
+        const evidence = commit || testCommand ? {
+            ...(repository ? { repository } : {}),
+            ...(commit ? { commit } : {}),
+            ...(diff ? { diff } : {}),
+            ...(testCommand ? { testCommand } : {}),
+            testResult: testResultRaw === "pass" || testResultRaw === "fail" || testResultRaw === "unknown"
+                ? testResultRaw
+                : "unknown",
+            artifacts: (0, output_1.collectCliFlagValues)(args, "--artifact"),
+            userConfirmed: args.includes("--user-confirmed"),
+            source: evidenceSourceRaw === "ci" || evidenceSourceRaw === "agent" || evidenceSourceRaw === "hook"
+                ? evidenceSourceRaw
+                : "manual",
+        } : undefined;
         const hasEngHints = requirementIds.length > 0 || conceptIds.length > 0 || codeHints.length > 0;
         const data = await (0, runtime_1.reportOutcome)(episodeId, success, lessons, configPath, deviation, hasEngHints
             ? {
@@ -119,7 +140,7 @@ async function executeCommand(command, args, configPath) {
                 ...(conceptIds.length > 0 ? { conceptIds } : {}),
                 ...(codeHints.length > 0 ? { codeHints } : {}),
             }
-            : undefined);
+            : undefined, evidence);
         return {
             command: "outcome-report",
             data,
@@ -130,6 +151,215 @@ async function executeCommand(command, args, configPath) {
                 : `ok=false; reason=${data.reason ?? "unknown"}`,
         };
     }
+    if (command === "outcome" && args[0] === "backfill") {
+        const evidencePath = (0, output_1.readCliFlagValue)(args, "--evidence");
+        const journalPath = (0, output_1.readCliFlagValue)(args, "--journal");
+        const auditPath = (0, output_1.readCliFlagValue)(args, "--audit");
+        const actor = (0, output_1.readCliFlagValue)(args, "--actor");
+        if (!evidencePath) {
+            console.log("Usage: graphflow outcome backfill --evidence <entries.json|jsonl> [--journal <path>] [--dry-run]");
+            process.exitCode = 1;
+            return undefined;
+        }
+        const data = await (0, runtime_1.backfillOutcomeEvidence)({
+            evidencePath,
+            ...(journalPath ? { journalPath } : {}),
+            ...(configPath ? { configPath } : {}),
+            ...(auditPath ? { auditPath } : {}),
+            ...(actor ? { actor } : {}),
+            dryRun: args.includes("--dry-run"),
+        });
+        return {
+            command: "outcome-backfill",
+            data,
+            legacyText: `total=${data.total}; closed=${data.closed}; failed=${data.failed}; skipped=${data.skipped}`,
+        };
+    }
+    if (command === "governance") {
+        const subcommand = args[0];
+        if (subcommand === "knowledge-upsert") {
+            const kind = (0, output_1.readCliFlagValue)(args, "--kind");
+            const key = (0, output_1.readCliFlagValue)(args, "--key");
+            const title = (0, output_1.readCliFlagValue)(args, "--title");
+            if (!kind || !key || !title) {
+                console.log("Usage: graphflow governance knowledge-upsert --kind <adr|invariant|api-contract|test> --key <key> --title <title> --content <text>");
+                process.exitCode = 1;
+                return undefined;
+            }
+            const versionRaw = (0, output_1.readCliFlagValue)(args, "--version");
+            const statusRaw = (0, output_1.readCliFlagValue)(args, "--status");
+            const requirementId = (0, output_1.readCliFlagValue)(args, "--requirement-id");
+            const data = await (0, runtime_1.upsertKnowledge)(configPath, {
+                kind,
+                key,
+                title,
+                content: (0, output_1.readCliFlagValue)(args, "--content") ?? "",
+                ...(statusRaw === "draft" || statusRaw === "in_review" || statusRaw === "approved"
+                    ? { status: statusRaw }
+                    : {}),
+                ...(versionRaw ? { version: Number.parseInt(versionRaw, 10) } : {}),
+                sourceIds: (0, output_1.collectCliFlagValues)(args, "--source-id"),
+                ...(requirementId ? { requirementId } : {}),
+            });
+            return { command: "governance-knowledge", data, legacyText: `${data.nodeId}; status=${data.record.status}` };
+        }
+        if (subcommand === "review-queue") {
+            const data = await (0, runtime_1.listKnowledgeQueue)(configPath);
+            return { command: "governance-review-queue", data, legacyText: `items=${data.length}` };
+        }
+        if (subcommand === "review") {
+            const nodeId = (0, output_1.readCliFlagValue)(args, "--node-id");
+            const decisionRaw = (0, output_1.readCliFlagValue)(args, "--decision");
+            if (!nodeId || !decisionRaw) {
+                console.log("Usage: graphflow governance review --node-id <id> --decision <approved|rejected> --role <role> --reason <text>");
+                process.exitCode = 1;
+                return undefined;
+            }
+            const data = await (0, runtime_1.reviewKnowledge)(configPath, nodeId, (0, output_1.readCliFlagValue)(args, "--role") ?? "admin", decisionRaw, (0, output_1.readCliFlagValue)(args, "--reason"));
+            return { command: "governance-review", data, legacyText: `updated=${data.updated}` };
+        }
+        if (subcommand === "trace") {
+            const requirementId = (0, output_1.readCliFlagValue)(args, "--requirement-id");
+            if (!requirementId) {
+                console.log("Usage: graphflow governance trace --requirement-id <id>");
+                process.exitCode = 1;
+                return undefined;
+            }
+            const data = await (0, runtime_1.traceRequirement)(configPath, requirementId);
+            return {
+                command: "governance-trace",
+                data,
+                legacyText: `code=${data.code.length}; tests=${data.tests.length}; governance=${data.governance.length}; episodes=${data.episodes.length}`,
+            };
+        }
+        if (subcommand === "merge-artifacts") {
+            const base = (0, output_1.readCliFlagValue)(args, "--base");
+            const local = (0, output_1.readCliFlagValue)(args, "--local");
+            const remote = (0, output_1.readCliFlagValue)(args, "--remote");
+            const output = (0, output_1.readCliFlagValue)(args, "--output");
+            if (!base || !local || !remote || !output) {
+                console.log("Usage: graphflow governance merge-artifacts --base <json> --local <json> --remote <json> --output <json>");
+                process.exitCode = 1;
+                return undefined;
+            }
+            const result = (0, runtime_1.mergeArtifactFiles)(base, local, remote);
+            (0, runtime_1.writeMergedArtifact)(output, result.merged);
+            return {
+                command: "governance-merge",
+                data: { output, conflicts: result.conflicts },
+                legacyText: `nodes=${result.merged.nodes.length}; edges=${result.merged.edges.length}; conflicts=${result.conflicts.length}`,
+            };
+        }
+        if (subcommand === "sign-artifact") {
+            const input = (0, output_1.readCliFlagValue)(args, "--input");
+            const secret = (0, output_1.readCliFlagValue)(args, "--secret");
+            if (!input || !secret) {
+                console.log("Usage: graphflow governance sign-artifact --input <artifact.json> --secret <passphrase> --output <signature.json>");
+                process.exitCode = 1;
+                return undefined;
+            }
+            const signature = (0, runtime_1.signArtifactFile)(input, secret);
+            const outputPath = (0, output_1.readCliFlagValue)(args, "--output") ?? `${input}.sig.json`;
+            (0, runtime_1.writeMergedArtifact)(outputPath, signature);
+            return { command: "governance-sign", data: { outputPath, signature }, legacyText: `algorithm=${signature.algorithm}` };
+        }
+        if (subcommand === "encrypted-artifact-export") {
+            const output = (0, output_1.readCliFlagValue)(args, "--output");
+            const passphrase = (0, output_1.readCliFlagValue)(args, "--passphrase");
+            if (!output || !passphrase) {
+                console.log("Usage: graphflow governance encrypted-artifact-export --output <artifact.enc.json> --passphrase <secret>");
+                process.exitCode = 1;
+                return undefined;
+            }
+            const data = (0, runtime_1.createSignedArtifactFile)(configPath, output, passphrase);
+            return { command: "governance-encrypted-export", data, legacyText: `path=${data.path}; nodes=${data.nodeCount}` };
+        }
+        if (subcommand === "encrypted-artifact-import") {
+            const input = (0, output_1.readCliFlagValue)(args, "--input");
+            const passphrase = (0, output_1.readCliFlagValue)(args, "--passphrase");
+            if (!input || !passphrase) {
+                console.log("Usage: graphflow governance encrypted-artifact-import --input <artifact.enc.json> --passphrase <secret>");
+                process.exitCode = 1;
+                return undefined;
+            }
+            const data = await (0, runtime_1.importSignedArtifactFile)(configPath, input, passphrase);
+            return { command: "governance-encrypted-import", data, legacyText: `nodes=${data.nodeCount}; edges=${data.edgeCount}` };
+        }
+        if (subcommand === "verify-artifact-signature") {
+            const input = (0, output_1.readCliFlagValue)(args, "--input");
+            const signaturePath = (0, output_1.readCliFlagValue)(args, "--signature");
+            const secret = (0, output_1.readCliFlagValue)(args, "--secret");
+            if (!input || !signaturePath || !secret) {
+                console.log("Usage: graphflow governance verify-artifact-signature --input <artifact.json> --signature <sig.json> --secret <passphrase>");
+                process.exitCode = 1;
+                return undefined;
+            }
+            const payload = JSON.parse((0, node_fs_1.readFileSync)(input, "utf8"));
+            const expected = (0, runtime_1.signArtifactFile)(input, secret);
+            const supplied = JSON.parse((0, node_fs_1.readFileSync)(signaturePath, "utf8"));
+            const valid = (0, runtime_1.verifyArtifactSignature)(payload, supplied.signature ?? "", secret) &&
+                expected.signature === supplied.signature;
+            return { command: "governance-verify", data: { valid }, legacyText: `valid=${valid}` };
+        }
+        if (subcommand === "quarantine") {
+            const ids = (0, output_1.collectCliFlagValues)(args, "--id");
+            if (ids.length === 0) {
+                console.log("Usage: graphflow governance quarantine --id <node-id>... [--reason <text>] [--audit <path>]");
+                process.exitCode = 1;
+                return undefined;
+            }
+            const actor = (0, output_1.readCliFlagValue)(args, "--actor");
+            const auditPath = (0, output_1.readCliFlagValue)(args, "--audit");
+            const reason = (0, output_1.readCliFlagValue)(args, "--reason");
+            const data = await (0, runtime_1.quarantineNodes)(configPath, ids, {
+                ...(actor ? { actor } : {}),
+                ...(auditPath ? { auditPath } : {}),
+                ...(reason ? { reason } : {}),
+            });
+            return { command: "governance-quarantine", data, legacyText: `quarantined=${data.quarantined.length}; auditValid=${data.auditValid}` };
+        }
+        if (subcommand === "retention") {
+            const data = (0, runtime_1.retentionSummary)(configPath);
+            return { command: "governance-retention", data, legacyText: `retained=${data.retained.length}; expired=${data.expired.length}` };
+        }
+        if (subcommand === "profiles") {
+            const outputDir = (0, output_1.readCliFlagValue)(args, "--output-dir") ?? "graphflow-out/memory-profiles";
+            const httpUrl = (0, output_1.readCliFlagValue)(args, "--http-url");
+            const packageSpec = (0, output_1.readCliFlagValue)(args, "--package-spec");
+            const files = (0, runtime_1.exportMemoryProfiles)({
+                outputDir,
+                ...(httpUrl ? { httpUrl } : {}),
+                stateful: args.includes("--stateful"),
+                ...(packageSpec ? { packageSpec } : {}),
+            });
+            return { command: "governance-profiles", data: files, legacyText: Object.keys(files).join(",") };
+        }
+        if (subcommand === "release-gate") {
+            const minProvenSkills = Number.parseInt((0, output_1.readCliFlagValue)(args, "--min-proven-skills") ?? "1", 10);
+            const minFidelitySamples = Number.parseInt((0, output_1.readCliFlagValue)(args, "--min-fidelity-samples") ?? "1", 10);
+            const maxPendingRatio = Number.parseFloat((0, output_1.readCliFlagValue)(args, "--max-pending-ratio") ?? "0.5");
+            try {
+                const data = (0, runtime_1.releaseGate)(configPath, {
+                    minProvenSkills,
+                    minFidelitySamples,
+                    maxPendingRatio,
+                });
+                return {
+                    command: "governance-release-gate",
+                    data,
+                    legacyText: "release gates passed",
+                };
+            }
+            catch (error) {
+                console.error(error instanceof Error ? error.message : String(error));
+                process.exitCode = 1;
+                return undefined;
+            }
+        }
+        console.log("Usage: graphflow governance <knowledge-upsert|review-queue|review|trace|merge-artifacts|sign-artifact|verify-artifact-signature|quarantine|retention|profiles|release-gate>");
+        process.exitCode = 1;
+        return undefined;
+    }
     if (command === "insight" && args[0] === "submit") {
         const task = (0, output_1.readCliFlagValue)(args, "--task") ??
             (0, output_1.readCliFlagValue)(args, "--task-text");
@@ -647,10 +877,22 @@ async function executeCommand(command, args, configPath) {
         const limitRaw = (0, output_1.readCliFlagValue)(args, "--limit");
         const limit = limitRaw ? Number(limitRaw) : undefined;
         if (limit !== undefined && (!Number.isInteger(limit) || limit <= 0)) {
-            console.log("Usage: graphflow dialogue list [--session <name|id>] [--limit N] [--json] [--config <path>]");
+            console.log("Usage: graphflow dialogue list [--session <name|id>] [--limit N] [--path <turnId>] [--json] [--config <path>]");
             process.exitCode = 1;
             return undefined;
         }
+        const pathTurnId = (0, output_1.readCliFlagValue)(args, "--path");
+        if (pathTurnId) {
+            const steps = await (0, runtime_1.dialoguePathRuntime)(pathTurnId, {
+                ...(configPath ? { configPath } : {}),
+                ...(limit !== undefined ? { limit } : {}),
+            });
+            return {
+                command: "dialogue-path",
+                data: steps,
+                legacyText: formatDialoguePath(steps),
+            };
+        }
         const sessionId = (0, output_1.readCliFlagValue)(args, "--session");
         const data = await (0, runtime_1.listDialogueTurnsRuntime)(configPath, {
             ...(sessionId ? { sessionId } : {}),
@@ -662,6 +904,61 @@ async function executeCommand(command, args, configPath) {
             legacyText: formatDialogueList(data),
         };
     }
+    if (command === "dialogue" && args[0] === "fork") {
+        const fromTurnId = (0, output_1.readCliFlagValue)(args, "--from");
+        if (!fromTurnId) {
+            console.log("Usage: graphflow dialogue fork --from <turnId> [--name <sessionName>] [--json] [--config <path>]");
+            process.exitCode = 1;
+            return undefined;
+        }
+        const forkName = (0, output_1.readCliFlagValue)(args, "--name");
+        const data = await (0, runtime_1.forkDialogueSessionRuntime)(fromTurnId, {
+            ...(configPath ? { configPath } : {}),
+            ...(forkName ? { forkName } : {}),
+        });
+        return {
+            command: "dialogue-fork",
+            data,
+            legacyText: data
+                ? `forkedSession=${data.forkedSessionName}; sourceTurn=${data.sourceTurnId}; copiedTurns=${data.copiedTurns}`
+                : "not-found",
+        };
+    }
+    if (command === "dialogue" && args[0] === "traces") {
+        const limitRaw = (0, output_1.readCliFlagValue)(args, "--limit");
+        const limit = limitRaw ? Number(limitRaw) : undefined;
+        const sessionId = (0, output_1.readCliFlagValue)(args, "--session");
+        const data = await (0, runtime_1.listDialogueTracesRuntime)(configPath, {
+            ...(sessionId ? { sessionId } : {}),
+            ...(limit !== undefined ? { limit } : {}),
+        });
+        return {
+            command: "dialogue-traces",
+            data,
+            legacyText: formatDialogueTraces(data),
+        };
+    }
+    if (command === "dialogue" && args[0] === "search") {
+        const query = (0, output_1.readCliFlagValue)(args, "--query")
+            ?? args.slice(1).filter((part) => part !== "--include-superseded" && !part.startsWith("--")).join(" ").trim();
+        if (!query) {
+            console.log('Usage: graphflow dialogue search "<query>" [--limit N] [--include-superseded] [--json] [--config <path>]');
+            process.exitCode = 1;
+            return undefined;
+        }
+        const limitRaw = (0, output_1.readCliFlagValue)(args, "--limit");
+        const limit = limitRaw ? Number(limitRaw) : undefined;
+        const data = await (0, runtime_1.searchDialogueTurnsRuntime)(query, {
+            ...(configPath ? { configPath } : {}),
+            ...(limit !== undefined ? { limit } : {}),
+            ...(args.includes("--include-superseded") ? { includeSuperseded: true } : {}),
+        });
+        return {
+            command: "dialogue-search",
+            data,
+            legacyText: formatDialogueSearch(data),
+        };
+    }
     if (command === "dialogue" && args[0] === "record") {
         const input = (0, runtime_1.resolveDialogueRecordInput)(args);
         const query = input.query;
@@ -700,9 +997,11 @@ async function executeCommand(command, args, configPath) {
     }
     if (command === "dialogue" && args[0] === "distill") {
         const all = args.includes("--all");
+        const useLlm = args.includes("--llm");
         const sessionId = (0, output_1.readCliFlagValue)(args, "--session");
         const data = await (0, runtime_1.distillDialogueTurnsRuntime)(configPath, {
             ...(all ? { all: true } : {}),
+            ...(useLlm ? { useLlm: true } : {}),
             ...(sessionId ? { sessionId } : {}),
         });
         return {
@@ -742,6 +1041,37 @@ function formatDialogueList(items) {
 function formatDialogueDistill(data) {
     return `updated=${data.updated}; unchanged=${data.unchanged}; total=${data.total}`;
 }
+function formatDialoguePath(steps) {
+    const lines = [`steps=${steps.length}`];
+    for (const step of steps) {
+        const fork = step.forkBoundary ? " [fork]" : "";
+        const jump = step.jumped ? " jump" : "";
+        const stale = step.invalidAt !== undefined ? " (superseded)" : "";
+        lines.push(`seq=${step.seq}${fork}${jump}${stale}; q=${step.userQuery}; a=${step.assistantReply || "(pending)"}`);
+    }
+    return lines.join("\n");
+}
+function formatDialogueTraces(traces) {
+    const lines = [`count=${traces.length}`];
+    for (const trace of traces) {
+        lines.push(`turn#${trace.turnSeq} ${trace.agentKind}:${trace.status} ${trace.label}; at=${new Date(trace.createdAt).toISOString()}`);
+    }
+    return lines.join("\n");
+}
+function formatDialogueSearch(hits) {
+    const lines = [`hits=${hits.length}`];
+    for (const hit of hits) {
+        const stale = hit.superseded ? " (superseded)" : "";
+        lines.push(`seq=${hit.seq}${stale}; q=${hit.userQuery}`);
+        if (hit.title)
+            lines.push(`  title=${hit.title}`);
+        if (hit.summary)
+            lines.push(`  a=${hit.summary}`);
+        if (hit.correctionLine)
+            lines.push(`  ${hit.correctionLine}`);
+    }
+    return lines.join("\n");
+}
 function formatValidationResult(data) {
     const lines = [
         `configPath=${data.configPath}`,