@rpamis/comet 0.3.9 → 0.4.0-beta.10

package/dist/domains/workflow-contract/contained-atomic-write.js

@@ -0,0 +1,235 @@
+import { randomUUID } from 'crypto';
+import { promises as fs } from 'fs';
+import path from 'path';
+import { hasComparableFileObject, sameFileObject, } from '../../platform/fs/file-identity.js';
+function isInside(parent, target) {
+    const relative = path.relative(parent, target);
+    return (relative === '' ||
+        (!path.isAbsolute(relative) && relative !== '..' && !relative.startsWith(`..${path.sep}`)));
+}
+function statsIdentity(stat) {
+    return {
+        dev: stat.dev,
+        ino: stat.ino,
+        birthtime: stat.birthtimeMs,
+    };
+}
+function sameDirectoryIdentity(identity, stat) {
+    return sameFileObject(identity, statsIdentity(stat));
+}
+function sameFileIdentity(left, right) {
+    const leftIdentity = statsIdentity(left);
+    const rightIdentity = statsIdentity(right);
+    if (hasComparableFileObject(leftIdentity, rightIdentity)) {
+        return sameFileObject(leftIdentity, rightIdentity);
+    }
+    return (sameFileObject(leftIdentity, rightIdentity) &&
+        left.birthtimeMs === right.birthtimeMs &&
+        left.ctimeMs === right.ctimeMs &&
+        left.size === right.size);
+}
+async function captureDirectoryIdentity(directory) {
+    const stat = await fs.lstat(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) {
+        throw new Error(`Contained atomic write parent must be a real directory: ${directory}`);
+    }
+    return {
+        path: directory,
+        realPath: await fs.realpath(directory),
+        ...statsIdentity(stat),
+    };
+}
+async function verifyDirectoryChain(chain) {
+    for (const identity of chain) {
+        const stat = await fs.lstat(identity.path);
+        if (!stat.isDirectory() ||
+            stat.isSymbolicLink() ||
+            !sameDirectoryIdentity(identity, stat) ||
+            (await fs.realpath(identity.path)) !== identity.realPath) {
+            throw new Error(`Contained atomic write parent changed before commit: ${identity.path}`);
+        }
+    }
+}
+async function prepareContainedDirectoryChain(root, directory) {
+    const lexicalRoot = path.resolve(root);
+    const lexicalDirectory = path.resolve(directory);
+    if (!isInside(lexicalRoot, lexicalDirectory)) {
+        throw new Error(`Contained atomic write parent is outside its managed root: ${directory}`);
+    }
+    const chain = [await captureDirectoryIdentity(lexicalRoot)];
+    const segments = path.relative(lexicalRoot, lexicalDirectory).split(path.sep).filter(Boolean);
+    let cursor = lexicalRoot;
+    for (const segment of segments) {
+        await verifyDirectoryChain(chain);
+        cursor = path.join(cursor, segment);
+        try {
+            await fs.mkdir(cursor);
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+        }
+        const identity = await captureDirectoryIdentity(cursor);
+        if (!isInside(chain[0].realPath, identity.realPath)) {
+            throw new Error(`Contained atomic write parent resolves outside its managed root: ${cursor}`);
+        }
+        chain.push(identity);
+    }
+    await verifyDirectoryChain(chain);
+    return chain;
+}
+async function captureExistingContainedDirectoryChain(root, directory) {
+    const lexicalRoot = path.resolve(root);
+    const lexicalDirectory = path.resolve(directory);
+    if (!isInside(lexicalRoot, lexicalDirectory)) {
+        throw new Error(`Contained file parent is outside its managed root: ${directory}`);
+    }
+    const chain = [await captureDirectoryIdentity(lexicalRoot)];
+    const segments = path.relative(lexicalRoot, lexicalDirectory).split(path.sep).filter(Boolean);
+    let cursor = lexicalRoot;
+    for (const segment of segments) {
+        cursor = path.join(cursor, segment);
+        try {
+            const identity = await captureDirectoryIdentity(cursor);
+            if (!isInside(chain[0].realPath, identity.realPath)) {
+                throw new Error(`Contained file parent resolves outside its managed root: ${cursor}`);
+            }
+            chain.push(identity);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return null;
+            throw error;
+        }
+    }
+    await verifyDirectoryChain(chain);
+    return chain;
+}
+async function syncDirectory(directory) {
+    let handle;
+    try {
+        handle = await fs.open(directory, 'r');
+        await handle.sync();
+    }
+    catch (error) {
+        const code = error.code;
+        if (!['EACCES', 'EBADF', 'EINVAL', 'EISDIR', 'ENOTSUP', 'EPERM'].includes(code ?? '')) {
+            throw error;
+        }
+    }
+    finally {
+        await handle?.close();
+    }
+}
+async function atomicWriteContained(file, content, options) {
+    const directory = path.dirname(file);
+    const directoryChain = await prepareContainedDirectoryChain(options.containedRoot, directory);
+    const temporary = path.join(directory, `.${path.basename(file)}.${randomUUID()}.tmp`);
+    let handle;
+    let temporaryIdentity;
+    try {
+        await options.beforeTemporaryOpen?.();
+        handle = await fs.open(temporary, 'wx');
+        temporaryIdentity = await handle.stat();
+        const [temporaryPathStat, temporaryRealPath] = await Promise.all([
+            fs.lstat(temporary),
+            fs.realpath(temporary),
+        ]);
+        await verifyDirectoryChain(directoryChain);
+        if (!temporaryPathStat.isFile() ||
+            temporaryPathStat.isSymbolicLink() ||
+            !sameFileIdentity(temporaryIdentity, temporaryPathStat) ||
+            !isInside(directoryChain[0].realPath, temporaryRealPath)) {
+            throw new Error('Contained atomic write temporary file opened outside its managed parent');
+        }
+        if (typeof content === 'string')
+            await handle.writeFile(content, 'utf8');
+        else
+            await handle.writeFile(content);
+        await handle.sync();
+        if (!sameFileIdentity(temporaryIdentity, await handle.stat())) {
+            throw new Error('Contained atomic write temporary file changed while writing');
+        }
+        await handle.close();
+        handle = undefined;
+        await options.beforeCommit?.();
+        await verifyDirectoryChain(directoryChain);
+        const temporaryStat = await fs.lstat(temporary);
+        if (!temporaryStat.isFile() ||
+            temporaryStat.isSymbolicLink() ||
+            !sameFileIdentity(temporaryStat, temporaryIdentity)) {
+            throw new Error('Contained atomic write temporary file changed before commit');
+        }
+        if (options.exclusive) {
+            await fs.link(temporary, file);
+            await fs.unlink(temporary);
+        }
+        else {
+            await fs.rename(temporary, file);
+        }
+        await syncDirectory(directory);
+    }
+    catch (error) {
+        await handle?.close();
+        try {
+            await verifyDirectoryChain(directoryChain);
+            await fs.rm(temporary, { force: true });
+        }
+        catch {
+            // The lexical path may now name an attacker-controlled parent. Leave the
+            // temporary file in the displaced managed directory for later cleanup.
+        }
+        throw error;
+    }
+}
+export async function atomicWriteContainedText(file, content, options) {
+    await atomicWriteContained(file, content, options);
+}
+export async function atomicWriteContainedBytes(file, content, options) {
+    await atomicWriteContained(file, content, options);
+}
+export async function atomicWriteContainedJson(file, value, options) {
+    await atomicWriteContainedText(file, JSON.stringify(value, null, 2) + '\n', options);
+}
+/**
+ * Remove one regular file only after checking that both its parent chain and
+ * the file identity still belong to the managed root.  This deliberately does
+ * not recurse: callers that need tree cleanup must establish their own
+ * manifest-bound ownership proof first.
+ */
+export async function removeContainedFile(file, options) {
+    const directory = path.dirname(file);
+    const directoryChain = await captureExistingContainedDirectoryChain(options.containedRoot, directory);
+    if (!directoryChain)
+        return false;
+    let identity;
+    let realPath;
+    try {
+        identity = await fs.lstat(file);
+        realPath = await fs.realpath(file);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+    if (!identity.isFile() ||
+        identity.isSymbolicLink() ||
+        !isInside(directoryChain[0].realPath, realPath)) {
+        throw new Error('Contained file removal target must be a regular file inside its managed root');
+    }
+    await options.beforeRemove?.();
+    await verifyDirectoryChain(directoryChain);
+    const [current, currentRealPath] = await Promise.all([fs.lstat(file), fs.realpath(file)]);
+    if (!current.isFile() ||
+        current.isSymbolicLink() ||
+        !sameFileIdentity(identity, current) ||
+        currentRealPath !== realPath) {
+        throw new Error('Contained file removal target changed before removal');
+    }
+    await fs.unlink(file);
+    await verifyDirectoryChain(directoryChain);
+    await syncDirectory(directory);
+    return true;
+}
+//# sourceMappingURL=contained-atomic-write.js.map

package/dist/domains/workflow-contract/contained-atomic-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contained-atomic-write.js","sourceRoot":"","sources":["../../../domains/workflow-contract/contained-atomic-write.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EACL,uBAAuB,EACvB,cAAc,GAEf,MAAM,oCAAoC,CAAC;AAmB5C,SAAS,QAAQ,CAAC,MAAc,EAAE,MAAc;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,OAAO,CACL,QAAQ,KAAK,EAAE;QACf,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAC3F,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAwB;IAC7C,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,SAAS,EAAE,IAAI,CAAC,WAAW;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,QAA2B,EAAE,IAAwB;IAClF,OAAO,cAAc,CAAC,QAAQ,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAwB,EAAE,KAAyB;IAC3E,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,uBAAuB,CAAC,YAAY,EAAE,aAAa,CAAC,EAAE,CAAC;QACzD,OAAO,cAAc,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,CACL,cAAc,CAAC,YAAY,EAAE,aAAa,CAAC;QAC3C,IAAI,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QACtC,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAC9B,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CACzB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,SAAiB;IACvD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,2DAA2D,SAAS,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;QACtC,GAAG,aAAa,CAAC,IAAI,CAAC;KACvB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,KAAmC;IACrE,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3C,IACE,CAAC,IAAI,CAAC,WAAW,EAAE;YACnB,IAAI,CAAC,cAAc,EAAE;YACrB,CAAC,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC;YACtC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,QAAQ,CAAC,QAAQ,EACxD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,IAAY,EACZ,SAAiB;IAEjB,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,8DAA8D,SAAS,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,KAAK,GAAwB,CAAC,MAAM,wBAAwB,CAAC,WAAW,CAAC,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9F,IAAI,MAAM,GAAG,WAAW,CAAC;IACzB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACtE,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,oEAAoE,MAAM,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,sCAAsC,CACnD,IAAY,EACZ,SAAiB;IAEjB,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,sDAAsD,SAAS,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,KAAK,GAAwB,CAAC,MAAM,wBAAwB,CAAC,WAAW,CAAC,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9F,IAAI,MAAM,GAAG,WAAW,CAAC;IACzB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;YACxD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,KAAK,CAAC,4DAA4D,MAAM,EAAE,CAAC,CAAC;YACxF,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACpE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,SAAiB;IAC5C,IAAI,MAAuD,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACvC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;YACtF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,IAAY,EACZ,OAA4B,EAC5B,OAAoC;IAEpC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,cAAc,GAAG,MAAM,8BAA8B,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAC9F,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,EAAE,MAAM,CAAC,CAAC;IACtF,IAAI,MAAuD,CAAC;IAC5D,IAAI,iBAAiD,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACxC,iBAAiB,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC/D,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;YACnB,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;SACvB,CAAC,CAAC;QACH,MAAM,oBAAoB,CAAC,cAAc,CAAC,CAAC;QAC3C,IACE,CAAC,iBAAiB,CAAC,MAAM,EAAE;YAC3B,iBAAiB,CAAC,cAAc,EAAE;YAClC,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;YACvD,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,iBAAiB,CAAC,EACxD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;QAC7F,CAAC;QAED,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;;YACpE,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,SAAS,CAAC;QAEnB,MAAM,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;QAC/B,MAAM,oBAAoB,CAAC,cAAc,CAAC,CAAC;QAC3C,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAChD,IACE,CAAC,aAAa,CAAC,MAAM,EAAE;YACvB,aAAa,CAAC,cAAc,EAAE;YAC9B,CAAC,gBAAgB,CAAC,aAAa,EAAE,iBAAiB,CAAC,EACnD,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YAC/B,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,oBAAoB,CAAC,cAAc,CAAC,CAAC;YAC3C,MAAM,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,uEAAuE;QACzE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAY,EACZ,OAAe,EACf,OAAoC;IAEpC,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAAY,EACZ,OAAmB,EACnB,OAAoC;IAEpC,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAY,EACZ,KAAc,EACd,OAAoC;IAEpC,MAAM,wBAAwB,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;AACvF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,OAAmC;IAEnC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,cAAc,GAAG,MAAM,sCAAsC,CACjE,OAAO,CAAC,aAAa,EACrB,SAAS,CACV,CAAC;IACF,IAAI,CAAC,cAAc;QAAE,OAAO,KAAK,CAAC;IAElC,IAAI,QAA4B,CAAC;IACjC,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACrE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IACE,CAAC,QAAQ,CAAC,MAAM,EAAE;QAClB,QAAQ,CAAC,cAAc,EAAE;QACzB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAC/C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;IAC/B,MAAM,oBAAoB,CAAC,cAAc,CAAC,CAAC;IAC3C,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1F,IACE,CAAC,OAAO,CAAC,MAAM,EAAE;QACjB,OAAO,CAAC,cAAc,EAAE;QACxB,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC;QACpC,eAAe,KAAK,QAAQ,EAC5B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,oBAAoB,CAAC,cAAc,CAAC,CAAC;IAC3C,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IAC/B,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/domains/workflow-contract/hash.d.ts

@@ -0,0 +1,3 @@
+import type { WorkflowProtocol } from './types.js';
+export declare function hashWorkflowProtocol(protocol: WorkflowProtocol): string;
+//# sourceMappingURL=hash.d.ts.map

package/dist/domains/workflow-contract/hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../../../domains/workflow-contract/hash.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAYnD,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,MAAM,CAIvE"}

package/dist/domains/workflow-contract/hash.js

@@ -0,0 +1,16 @@
+import { createHash } from 'crypto';
+function stableValue(value) {
+    if (Array.isArray(value))
+        return value.map((item) => stableValue(item));
+    if (!value || typeof value !== 'object')
+        return value;
+    return Object.fromEntries(Object.entries(value)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, item]) => [key, stableValue(item)]));
+}
+export function hashWorkflowProtocol(protocol) {
+    return createHash('sha256')
+        .update(JSON.stringify(stableValue(protocol)))
+        .digest('hex');
+}
+//# sourceMappingURL=hash.js.map

package/dist/domains/workflow-contract/hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../../../domains/workflow-contract/hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAGpC,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SAClB,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;SACpD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAClD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAA0B;IAC7D,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;SAC7C,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC"}

package/dist/domains/workflow-contract/index.d.ts

@@ -0,0 +1,16 @@
+export { builtinCometFivePhaseWorkflow, builtinCometNativeWorkflow } from './builtins.js';
+export { atomicWriteContainedBytes, atomicWriteContainedJson, atomicWriteContainedText, removeContainedFile, } from './contained-atomic-write.js';
+export type { ContainedAtomicWriteOptions, ContainedFileRemoveOptions, } from './contained-atomic-write.js';
+export { hashWorkflowProtocol } from './hash.js';
+export { normalizeWorkflowDefinition } from './normalize.js';
+export { defaultWorkflowProjectConfig, DEFAULT_WORKFLOW_NATIVE_SNAPSHOT_CONFIG, MAX_WORKFLOW_SNAPSHOT_PATTERN_LENGTH, MAX_WORKFLOW_SNAPSHOT_PATTERN_WILDCARDS, mergeWorkflowProjectConfigDocument, normalizeClassicArtifactLayout, normalizeWorkflowSnapshotPattern, normalizeWorkflowArtifactRoot, normalizeWorkflowRelativePath, parseWorkflowProjectConfigDocument, projectConfigComment, renderStructuredProjectConfig, workflowProjectConfigManagedValue, workflowProjectConfigRuntimeHelperScript, WORKFLOW_PROJECT_CONFIG_MAX_BYTES, } from './project-config.js';
+export { ensureProtectedProjectDirectory, inspectProtectedProjectPath, protectedProjectFileExists, readProtectedProjectFile, } from './protected-project-path.js';
+export { assertProjectConfigDocumentValid, readAmbientResumeEnabled, readWorkflowAmbientResumeEnabled, readWorkflowProjectConfig, readWorkflowProjectConfigDocument, readWorkflowProjectConfigIdentity, readWorkflowProjectConfigSnapshot, workflowProjectConfigIdentityEquals, WORKFLOW_PROJECT_CONFIG_PATH, } from './project-config-reader.js';
+export type { WorkflowProjectConfigIdentity, WorkflowProjectConfigSnapshot, } from './project-config-reader.js';
+export { assertWorkflowProjectConfigIdentity, writeWorkflowProjectConfig, writeWorkflowProjectConfigDocument, writeWorkflowProjectConfigSource, } from './project-config-writer.js';
+export { inspectWorkflowProjectConfigTransaction, repairWorkflowProjectConfigTransaction, } from './project-config-transaction.js';
+export type { ProjectConfigWriteTransactionInspection } from './project-config-transaction.js';
+export { validateWorkflowDefinition } from './validation.js';
+export type { ProjectConfigCommentLanguage } from './project-config.js';
+export type * from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/domains/workflow-contract/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../domains/workflow-contract/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC1F,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EACL,4BAA4B,EAC5B,uCAAuC,EACvC,oCAAoC,EACpC,uCAAuC,EACvC,kCAAkC,EAClC,8BAA8B,EAC9B,gCAAgC,EAChC,6BAA6B,EAC7B,6BAA6B,EAC7B,kCAAkC,EAClC,oBAAoB,EACpB,6BAA6B,EAC7B,iCAAiC,EACjC,wCAAwC,EACxC,iCAAiC,GAClC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,EAC3B,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,gCAAgC,EAChC,wBAAwB,EACxB,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,EACjC,iCAAiC,EACjC,iCAAiC,EACjC,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACV,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,mCAAmC,EACnC,0BAA0B,EAC1B,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,uCAAuC,EACvC,sCAAsC,GACvC,MAAM,iCAAiC,CAAC;AACzC,YAAY,EAAE,uCAAuC,EAAE,MAAM,iCAAiC,CAAC;AAC/F,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAC7D,YAAY,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACxE,mBAAmB,YAAY,CAAC"}

package/dist/domains/workflow-contract/index.js

@@ -0,0 +1,11 @@
+export { builtinCometFivePhaseWorkflow, builtinCometNativeWorkflow } from './builtins.js';
+export { atomicWriteContainedBytes, atomicWriteContainedJson, atomicWriteContainedText, removeContainedFile, } from './contained-atomic-write.js';
+export { hashWorkflowProtocol } from './hash.js';
+export { normalizeWorkflowDefinition } from './normalize.js';
+export { defaultWorkflowProjectConfig, DEFAULT_WORKFLOW_NATIVE_SNAPSHOT_CONFIG, MAX_WORKFLOW_SNAPSHOT_PATTERN_LENGTH, MAX_WORKFLOW_SNAPSHOT_PATTERN_WILDCARDS, mergeWorkflowProjectConfigDocument, normalizeClassicArtifactLayout, normalizeWorkflowSnapshotPattern, normalizeWorkflowArtifactRoot, normalizeWorkflowRelativePath, parseWorkflowProjectConfigDocument, projectConfigComment, renderStructuredProjectConfig, workflowProjectConfigManagedValue, workflowProjectConfigRuntimeHelperScript, WORKFLOW_PROJECT_CONFIG_MAX_BYTES, } from './project-config.js';
+export { ensureProtectedProjectDirectory, inspectProtectedProjectPath, protectedProjectFileExists, readProtectedProjectFile, } from './protected-project-path.js';
+export { assertProjectConfigDocumentValid, readAmbientResumeEnabled, readWorkflowAmbientResumeEnabled, readWorkflowProjectConfig, readWorkflowProjectConfigDocument, readWorkflowProjectConfigIdentity, readWorkflowProjectConfigSnapshot, workflowProjectConfigIdentityEquals, WORKFLOW_PROJECT_CONFIG_PATH, } from './project-config-reader.js';
+export { assertWorkflowProjectConfigIdentity, writeWorkflowProjectConfig, writeWorkflowProjectConfigDocument, writeWorkflowProjectConfigSource, } from './project-config-writer.js';
+export { inspectWorkflowProjectConfigTransaction, repairWorkflowProjectConfigTransaction, } from './project-config-transaction.js';
+export { validateWorkflowDefinition } from './validation.js';
+//# sourceMappingURL=index.js.map

package/dist/domains/workflow-contract/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../domains/workflow-contract/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC1F,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AAKrC,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EACL,4BAA4B,EAC5B,uCAAuC,EACvC,oCAAoC,EACpC,uCAAuC,EACvC,kCAAkC,EAClC,8BAA8B,EAC9B,gCAAgC,EAChC,6BAA6B,EAC7B,6BAA6B,EAC7B,kCAAkC,EAClC,oBAAoB,EACpB,6BAA6B,EAC7B,iCAAiC,EACjC,wCAAwC,EACxC,iCAAiC,GAClC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,EAC3B,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,gCAAgC,EAChC,wBAAwB,EACxB,gCAAgC,EAChC,yBAAyB,EACzB,iCAAiC,EACjC,iCAAiC,EACjC,iCAAiC,EACjC,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,mCAAmC,EACnC,0BAA0B,EAC1B,kCAAkC,EAClC,gCAAgC,GACjC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,uCAAuC,EACvC,sCAAsC,GACvC,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/domains/workflow-contract/normalize.d.ts

@@ -0,0 +1,3 @@
+import type { NormalizedWorkflowDefinition, WorkflowDefinitionInput } from './types.js';
+export declare function normalizeWorkflowDefinition(input: WorkflowDefinitionInput): NormalizedWorkflowDefinition;
+//# sourceMappingURL=normalize.d.ts.map

package/dist/domains/workflow-contract/normalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../domains/workflow-contract/normalize.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,4BAA4B,EAC5B,uBAAuB,EASxB,MAAM,YAAY,CAAC;AAgGpB,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,uBAAuB,GAC7B,4BAA4B,CAyF9B"}

package/dist/domains/workflow-contract/normalize.js

@@ -0,0 +1,165 @@
+import { BUILTIN_COMET_NATIVE_OUTPUT_SCHEMAS, BUILTIN_COMET_OUTPUT_SCHEMAS, COMET_FIVE_PHASE_NODES, COMET_NATIVE_NODES, } from './builtins.js';
+import { validateWorkflowDefinition } from './validation.js';
+function dedupe(values) {
+    return [...new Set(values)];
+}
+function defaultEnforcement(operation, scope) {
+    if (scope === 'handoff')
+        return 'handoff-guarded';
+    if (operation === 'require')
+        return 'guarded';
+    if (operation === 'augment')
+        return 'advisory';
+    return 'guarded';
+}
+function normalizeBinding(input, operation) {
+    const scope = input.scope ?? 'main';
+    const normalizedOperation = input.operation ?? operation;
+    return {
+        skill: input.skill,
+        operation: normalizedOperation,
+        scope,
+        enforcement: input.enforcement ?? defaultEnforcement(normalizedOperation, scope),
+        ...(input.reason ? { reason: input.reason } : {}),
+    };
+}
+function cloneTemplate(template) {
+    return {
+        ...template,
+        implementation: { ...template.implementation },
+        ...(template.requiredSkillCalls
+            ? { requiredSkillCalls: template.requiredSkillCalls.map((binding) => ({ ...binding })) }
+            : {}),
+        ...(template.augmentations
+            ? { augmentations: template.augmentations.map((binding) => ({ ...binding })) }
+            : {}),
+        ...(template.satisfies ? { satisfies: [...template.satisfies] } : {}),
+        operations: [...template.operations],
+        outputSchemas: [...template.outputSchemas],
+        guardrails: template.guardrails.map((guardrail) => ({ ...guardrail })),
+    };
+}
+function templatesFor(kind, customNodes = []) {
+    if (kind === 'comet-five-phase-overlay') {
+        return [...COMET_FIVE_PHASE_NODES.map(cloneTemplate), ...customNodes.map(cloneTemplate)];
+    }
+    if (kind === 'comet-native') {
+        return [...COMET_NATIVE_NODES.map(cloneTemplate), ...customNodes.map(cloneTemplate)];
+    }
+    return customNodes.map(cloneTemplate);
+}
+function outputSchemasFor(input) {
+    const schemas = input.kind === 'comet-five-phase-overlay'
+        ? BUILTIN_COMET_OUTPUT_SCHEMAS
+        : input.kind === 'comet-native'
+            ? BUILTIN_COMET_NATIVE_OUTPUT_SCHEMAS
+            : [];
+    const byId = new Map();
+    for (const schema of [...schemas, ...(input.outputSchemas ?? [])]) {
+        byId.set(schema.id, structuredClone(schema));
+    }
+    return [...byId.values()];
+}
+function workflowEdges(nodes) {
+    return nodes.flatMap((node, index) => [
+        {
+            from: node.id,
+            to: nodes[index + 1]?.id ?? null,
+            condition: 'success',
+        },
+        {
+            from: node.id,
+            to: node.id,
+            condition: 'failure',
+        },
+        {
+            from: node.id,
+            to: node.id,
+            condition: 'pause',
+        },
+    ]);
+}
+export function normalizeWorkflowDefinition(input) {
+    const validation = validateWorkflowDefinition(input);
+    if (!validation.valid) {
+        throw new Error(validation.findings.map((finding) => finding.message).join('\n'));
+    }
+    const patches = input.nodes ?? {};
+    const nodes = templatesFor(input.kind, input.customNodes).map((template) => {
+        const patch = patches[template.id] ?? {};
+        const implementation = patch.implementation
+            ? normalizeBinding(patch.implementation, 'override')
+            : normalizeBinding(template.implementation, 'default');
+        return {
+            ...template,
+            implementation,
+            requiredSkillCalls: [
+                ...(template.requiredSkillCalls ?? []),
+                ...(patch.requiredSkillCalls ?? []),
+            ].map((binding) => normalizeBinding(binding, 'require')),
+            augmentations: [...(template.augmentations ?? []), ...(patch.augmentations ?? [])].map((binding) => normalizeBinding(binding, 'augment')),
+            outputSchemas: dedupe([...(template.outputSchemas ?? []), ...(patch.outputSchemas ?? [])]),
+            satisfies: dedupe([...(template.satisfies ?? []), ...(patch.satisfies ?? [])]),
+            disabled: patch.disabled ?? template.disabled ?? false,
+        };
+    });
+    const outputSchemas = outputSchemasFor(input);
+    const requiredSkills = dedupe(nodes.flatMap((node) => [
+        node.implementation.skill,
+        ...node.requiredSkillCalls.map((binding) => binding.skill),
+        ...node.augmentations.map((binding) => binding.skill),
+    ]));
+    const sourceSkills = dedupe(nodes.map((node) => node.implementation.skill));
+    const protocol = {
+        schemaVersion: 1,
+        kind: input.kind,
+        name: input.name,
+        goal: input.goal,
+        nodes,
+        edges: workflowEdges(nodes),
+        outputSchemas,
+        state: input.kind === 'comet-five-phase-overlay'
+            ? {
+                kind: 'comet-overlay',
+                statePath: 'changes/*/.comet.yaml',
+                pathBase: 'classic-openspec-root',
+                currentNodeField: 'phase',
+                completedNodesField: 'completedNodes',
+                evidenceField: 'evidence',
+            }
+            : input.kind === 'comet-native'
+                ? {
+                    kind: 'native-change',
+                    statePath: 'changes/*/comet-state.yaml',
+                    pathBase: 'native-root',
+                    currentNodeField: 'phase',
+                    completedNodesField: 'runtime.completedNodes',
+                    evidenceField: 'runtime.trajectory',
+                }
+                : {
+                    kind: 'workflow-run',
+                    statePath: `.comet/runs/${input.name}/state.json`,
+                    currentNodeField: 'currentNode',
+                    completedNodesField: 'completedNodes',
+                    evidenceField: 'evidence',
+                },
+        evals: [
+            {
+                id: input.kind === 'comet-five-phase-overlay'
+                    ? 'comet-five-phase-contract'
+                    : input.kind === 'comet-native'
+                        ? 'comet-native-contract'
+                        : 'workflow-route-conformance',
+                expectedNodeOrder: nodes.filter((node) => !node.disabled).map((node) => node.id),
+                requiredOutputSchemas: dedupe(nodes.flatMap((node) => node.outputSchemas)),
+            },
+        ],
+    };
+    return {
+        input: structuredClone(input),
+        protocol,
+        requiredSkills,
+        sourceSkills,
+    };
+}
+//# sourceMappingURL=normalize.js.map

package/dist/domains/workflow-contract/normalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../../../domains/workflow-contract/normalize.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAavB,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAE7D,SAAS,MAAM,CAAC,MAAgB;IAC9B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,kBAAkB,CACzB,SAA4C,EAC5C,KAAoC;IAEpC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,iBAAiB,CAAC;IAClD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC9C,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IAC/C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAgC,EAChC,SAA4C;IAE5C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC;IACpC,MAAM,mBAAmB,GAAG,KAAK,CAAC,SAAS,IAAI,SAAS,CAAC;IACzD,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,mBAAmB;QAC9B,KAAK;QACL,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,kBAAkB,CAAC,mBAAmB,EAAE,KAAK,CAAC;QAChF,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,QAA8B;IACnD,OAAO;QACL,GAAG,QAAQ;QACX,cAAc,EAAE,EAAE,GAAG,QAAQ,CAAC,cAAc,EAAE;QAC9C,GAAG,CAAC,QAAQ,CAAC,kBAAkB;YAC7B,CAAC,CAAC,EAAE,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,EAAE;YACxF,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,QAAQ,CAAC,aAAa;YACxB,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,EAAE;YAC9E,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,UAAU,EAAE,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC;QACpC,aAAa,EAAE,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC;QAC1C,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,IAAkB,EAClB,cAAsC,EAAE;IAExC,IAAI,IAAI,KAAK,0BAA0B,EAAE,CAAC;QACxC,OAAO,CAAC,GAAG,sBAAsB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAA8B;IACtD,MAAM,OAAO,GACX,KAAK,CAAC,IAAI,KAAK,0BAA0B;QACvC,CAAC,CAAC,4BAA4B;QAC9B,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc;YAC7B,CAAC,CAAC,mCAAmC;YACrC,CAAC,CAAC,EAAE,CAAC;IACX,MAAM,IAAI,GAAG,IAAI,GAAG,EAAgC,CAAC;IACrD,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,aAAa,CAAC,KAA6B;IAClD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACpC;YACE,IAAI,EAAE,IAAI,CAAC,EAAE;YACb,EAAE,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI;YAChC,SAAS,EAAE,SAAkB;SAC9B;QACD;YACE,IAAI,EAAE,IAAI,CAAC,EAAE;YACb,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,SAAS,EAAE,SAAkB;SAC9B;QACD;YACE,IAAI,EAAE,IAAI,CAAC,EAAE;YACb,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,SAAS,EAAE,OAAgB;SAC5B;KACF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,KAA8B;IAE9B,MAAM,UAAU,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACzE,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc;YACzC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,cAAc,EAAE,UAAU,CAAC;YACpD,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QACzD,OAAO;YACL,GAAG,QAAQ;YACX,cAAc;YACd,kBAAkB,EAAE;gBAClB,GAAG,CAAC,QAAQ,CAAC,kBAAkB,IAAI,EAAE,CAAC;gBACtC,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC;aACpC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACxD,aAAa,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CACpF,CAAC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAClD;YACD,aAAa,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;YAC1F,SAAS,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;YAC9E,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,IAAI,KAAK;SACvD,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,cAAc,GAAG,MAAM,CAC3B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACtB,IAAI,CAAC,cAAc,CAAC,KAAK;QACzB,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1D,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACtD,CAAC,CACH,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAqB;QACjC,aAAa,EAAE,CAAC;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK;QACL,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC;QAC3B,aAAa;QACb,KAAK,EACH,KAAK,CAAC,IAAI,KAAK,0BAA0B;YACvC,CAAC,CAAC;gBACE,IAAI,EAAE,eAAe;gBACrB,SAAS,EAAE,uBAAuB;gBAClC,QAAQ,EAAE,uBAAuB;gBACjC,gBAAgB,EAAE,OAAO;gBACzB,mBAAmB,EAAE,gBAAgB;gBACrC,aAAa,EAAE,UAAU;aAC1B;YACH,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc;gBAC7B,CAAC,CAAC;oBACE,IAAI,EAAE,eAAe;oBACrB,SAAS,EAAE,4BAA4B;oBACvC,QAAQ,EAAE,aAAa;oBACvB,gBAAgB,EAAE,OAAO;oBACzB,mBAAmB,EAAE,wBAAwB;oBAC7C,aAAa,EAAE,oBAAoB;iBACpC;gBACH,CAAC,CAAC;oBACE,IAAI,EAAE,cAAc;oBACpB,SAAS,EAAE,eAAe,KAAK,CAAC,IAAI,aAAa;oBACjD,gBAAgB,EAAE,aAAa;oBAC/B,mBAAmB,EAAE,gBAAgB;oBACrC,aAAa,EAAE,UAAU;iBAC1B;QACT,KAAK,EAAE;YACL;gBACE,EAAE,EACA,KAAK,CAAC,IAAI,KAAK,0BAA0B;oBACvC,CAAC,CAAC,2BAA2B;oBAC7B,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc;wBAC7B,CAAC,CAAC,uBAAuB;wBACzB,CAAC,CAAC,4BAA4B;gBACpC,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChF,qBAAqB,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;aAC3E;SACF;KACF,CAAC;IACF,OAAO;QACL,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;QAC7B,QAAQ;QACR,cAAc;QACd,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/domains/workflow-contract/project-config-reader.d.ts

@@ -0,0 +1,24 @@
+import type { ParsedWorkflowProjectConfigDocument, WorkflowProjectConfig } from './types.js';
+export declare const WORKFLOW_PROJECT_CONFIG_PATH = ".comet/config.yaml";
+export interface WorkflowProjectConfigIdentity {
+    exists: boolean;
+    sha256: string | null;
+}
+export interface WorkflowProjectConfigSnapshot {
+    document: ParsedWorkflowProjectConfigDocument | null;
+    identity: WorkflowProjectConfigIdentity;
+}
+export declare function workflowProjectConfigIdentityEquals(left: WorkflowProjectConfigIdentity, right: WorkflowProjectConfigIdentity): boolean;
+export declare function readWorkflowProjectConfigDocument(projectRoot: string, options?: {
+    allowPartialProject?: boolean;
+}): Promise<ParsedWorkflowProjectConfigDocument | null>;
+export declare function readWorkflowProjectConfigIdentity(projectRoot: string): Promise<WorkflowProjectConfigIdentity>;
+export declare function readWorkflowProjectConfigSnapshot(projectRoot: string, options?: {
+    allowPartialProject?: boolean;
+}): Promise<WorkflowProjectConfigSnapshot>;
+export declare function readWorkflowProjectConfig(projectRoot: string): Promise<WorkflowProjectConfig | null>;
+export declare function assertProjectConfigDocumentValid(projectRoot: string): Promise<void>;
+export declare function readWorkflowAmbientResumeEnabled(projectRoot: string): Promise<boolean>;
+/** @deprecated Prefer readWorkflowAmbientResumeEnabled. */
+export declare const readAmbientResumeEnabled: typeof readWorkflowAmbientResumeEnabled;
+//# sourceMappingURL=project-config-reader.d.ts.map

package/dist/domains/workflow-contract/project-config-reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-config-reader.d.ts","sourceRoot":"","sources":["../../../domains/workflow-contract/project-config-reader.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mCAAmC,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE7F,eAAO,MAAM,4BAA4B,uBAAuB,CAAC;AAEjE,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,EAAE,mCAAmC,GAAG,IAAI,CAAC;IACrD,QAAQ,EAAE,6BAA6B,CAAC;CACzC;AAED,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,6BAA6B,EACnC,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAET;AAOD,wBAAsB,iCAAiC,CACrD,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE;IAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9C,OAAO,CAAC,mCAAmC,GAAG,IAAI,CAAC,CAErD;AA2BD,wBAAsB,iCAAiC,CACrD,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,6BAA6B,CAAC,CAExC;AAED,wBAAsB,iCAAiC,CACrD,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE;IAAE,mBAAmB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC9C,OAAO,CAAC,6BAA6B,CAAC,CAMxC;AAED,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAEvC;AAED,wBAAsB,gCAAgC,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzF;AAED,wBAAsB,gCAAgC,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE5F;AAED,2DAA2D;AAC3D,eAAO,MAAM,wBAAwB,yCAAmC,CAAC"}

package/dist/domains/workflow-contract/project-config-reader.js

@@ -0,0 +1,54 @@
+import { createHash } from 'crypto';
+import { parseWorkflowProjectConfigDocument, WORKFLOW_PROJECT_CONFIG_MAX_BYTES, } from './project-config.js';
+import { readProtectedProjectFile } from './protected-project-path.js';
+export const WORKFLOW_PROJECT_CONFIG_PATH = '.comet/config.yaml';
+export function workflowProjectConfigIdentityEquals(left, right) {
+    return left.exists === right.exists && left.sha256 === right.sha256;
+}
+function isMissingProjectConfig(error) {
+    const code = error?.code;
+    return code === 'ENOENT' || code === 'ENOTDIR';
+}
+export async function readWorkflowProjectConfigDocument(projectRoot, options = {}) {
+    return (await readWorkflowProjectConfigSnapshot(projectRoot, options)).document;
+}
+async function readWorkflowProjectConfigBytes(projectRoot) {
+    try {
+        return (await readProtectedProjectFile(projectRoot, WORKFLOW_PROJECT_CONFIG_PATH, WORKFLOW_PROJECT_CONFIG_MAX_BYTES, { label: WORKFLOW_PROJECT_CONFIG_PATH })).bytes;
+    }
+    catch (error) {
+        if (isMissingProjectConfig(error))
+            return null;
+        throw error;
+    }
+}
+function projectConfigIdentity(bytes) {
+    return bytes
+        ? {
+            exists: true,
+            sha256: createHash('sha256').update(bytes).digest('hex'),
+        }
+        : { exists: false, sha256: null };
+}
+export async function readWorkflowProjectConfigIdentity(projectRoot) {
+    return projectConfigIdentity(await readWorkflowProjectConfigBytes(projectRoot));
+}
+export async function readWorkflowProjectConfigSnapshot(projectRoot, options = {}) {
+    const bytes = await readWorkflowProjectConfigBytes(projectRoot);
+    return {
+        document: bytes ? parseWorkflowProjectConfigDocument(bytes.toString('utf8'), options) : null,
+        identity: projectConfigIdentity(bytes),
+    };
+}
+export async function readWorkflowProjectConfig(projectRoot) {
+    return (await readWorkflowProjectConfigDocument(projectRoot))?.config ?? null;
+}
+export async function assertProjectConfigDocumentValid(projectRoot) {
+    await readWorkflowProjectConfigDocument(projectRoot);
+}
+export async function readWorkflowAmbientResumeEnabled(projectRoot) {
+    return (await readWorkflowProjectConfigDocument(projectRoot))?.ambient_resume ?? true;
+}
+/** @deprecated Prefer readWorkflowAmbientResumeEnabled. */
+export const readAmbientResumeEnabled = readWorkflowAmbientResumeEnabled;
+//# sourceMappingURL=project-config-reader.js.map

package/dist/domains/workflow-contract/project-config-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-config-reader.js","sourceRoot":"","sources":["../../../domains/workflow-contract/project-config-reader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC,OAAO,EACL,kCAAkC,EAClC,iCAAiC,GAClC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAGvE,MAAM,CAAC,MAAM,4BAA4B,GAAG,oBAAoB,CAAC;AAYjE,MAAM,UAAU,mCAAmC,CACjD,IAAmC,EACnC,KAAoC;IAEpC,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;AACtE,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,MAAM,IAAI,GAAI,KAA2C,EAAE,IAAI,CAAC;IAChE,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,WAAmB,EACnB,UAA6C,EAAE;IAE/C,OAAO,CAAC,MAAM,iCAAiC,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,WAAmB;IAC/D,IAAI,CAAC;QACH,OAAO,CACL,MAAM,wBAAwB,CAC5B,WAAW,EACX,4BAA4B,EAC5B,iCAAiC,EACjC,EAAE,KAAK,EAAE,4BAA4B,EAAE,CACxC,CACF,CAAC,KAAK,CAAC;IACV,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,sBAAsB,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAoB;IACjD,OAAO,KAAK;QACV,CAAC,CAAC;YACE,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SACzD;QACH,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,WAAmB;IAEnB,OAAO,qBAAqB,CAAC,MAAM,8BAA8B,CAAC,WAAW,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,WAAmB,EACnB,UAA6C,EAAE;IAE/C,MAAM,KAAK,GAAG,MAAM,8BAA8B,CAAC,WAAW,CAAC,CAAC;IAChE,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,kCAAkC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;QAC5F,QAAQ,EAAE,qBAAqB,CAAC,KAAK,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,WAAmB;IAEnB,OAAO,CAAC,MAAM,iCAAiC,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;AAChF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,WAAmB;IACxE,MAAM,iCAAiC,CAAC,WAAW,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,WAAmB;IACxE,OAAO,CAAC,MAAM,iCAAiC,CAAC,WAAW,CAAC,CAAC,EAAE,cAAc,IAAI,IAAI,CAAC;AACxF,CAAC;AAED,2DAA2D;AAC3D,MAAM,CAAC,MAAM,wBAAwB,GAAG,gCAAgC,CAAC"}

package/dist/domains/workflow-contract/project-config-transaction.d.ts

@@ -0,0 +1,20 @@
+export interface ProjectConfigWriteTransactionInspection {
+    id: string;
+    stage: 'prepared' | 'config-quarantined' | 'published-cleanup-pending' | 'successor-preserved-cleanup-pending';
+    candidate: string;
+    quarantine: string;
+    allowedRepair: 'rollback-or-cleanup';
+}
+export declare function beginWorkflowProjectConfigTransaction(projectRoot: string, id: string, expectedSha256: string, outputSha256: string): Promise<{
+    candidate: string;
+    quarantine: string;
+}>;
+export declare function finishWorkflowProjectConfigTransaction(projectRoot: string, id: string): Promise<void>;
+export declare function inspectWorkflowProjectConfigTransaction(projectRoot: string): Promise<ProjectConfigWriteTransactionInspection | null>;
+export declare function repairWorkflowProjectConfigTransaction(projectRoot: string, options?: {
+    ownerId?: string;
+    testHooks?: {
+        afterOwnedFileQuarantine?: (relativePath: string, cleanupRelative: string) => void | Promise<void>;
+    };
+}): Promise<boolean>;
+//# sourceMappingURL=project-config-transaction.d.ts.map

package/dist/domains/workflow-contract/project-config-transaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-config-transaction.d.ts","sourceRoot":"","sources":["../../../domains/workflow-contract/project-config-transaction.ts"],"names":[],"mappings":"AA0BA,MAAM,WAAW,uCAAuC;IACtD,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EACD,UAAU,GACV,oBAAoB,GACpB,2BAA2B,GAC3B,qCAAqC,CAAC;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,qBAAqB,CAAC;CACtC;AA6MD,wBAAsB,qCAAqC,CACzD,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,EACV,cAAc,EAAE,MAAM,EACtB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CA8BpD;AAED,wBAAsB,sCAAsC,CAC1D,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAsB,uCAAuC,CAC3D,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,uCAAuC,GAAG,IAAI,CAAC,CAqCzD;AAED,wBAAsB,sCAAsC,CAC1D,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE;IACP,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE;QACV,wBAAwB,CAAC,EAAE,CACzB,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,MAAM,KACpB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC3B,CAAC;CACE,GACL,OAAO,CAAC,OAAO,CAAC,CAuDlB"}