@sensigo/realm 0.12.1 → 0.14.0

package/dist/manifest/secret-refs.js

@@ -0,0 +1,126 @@
+// Secret-reference grammar for the deployment manifest (v0.14): `${secret:NAME}`.
+//
+// Pure string/tree functions — core owns the GRAMMAR only. Reading secret sources
+// (dotenv files, process.env) and resolving values is the CLI's job.
+//
+// Grammar:
+//   - a reference is exactly `${secret:NAME}` with NAME = [A-Z0-9_]+
+//   - references are legal ONLY inside string values under `config` trees
+//   - composite/embedded references are allowed: "${secret:A}:${secret:B}"
+//   - `$$` escapes a literal `$` (so `$${secret:X}` interpolates to the literal text
+//     `${secret:X}`); any other `${secret:` occurrence that does not match the full
+//     grammar is MALFORMED and must be rejected loudly (typos never pass silently).
+const REF_PATTERN = /^\$\{secret:([A-Z0-9_]+)\}/;
+/**
+ * Scans a string left-to-right honoring the `$$` escape. Well-formed references are
+ * collected; anything starting like a reference but not matching the grammar is malformed.
+ */
+export function scanSecretString(value) {
+    const refs = [];
+    const malformed = [];
+    let i = 0;
+    while (i < value.length) {
+        if (value[i] === '$') {
+            if (value[i + 1] === '$') {
+                i += 2; // escaped literal '$'
+                continue;
+            }
+            const rest = value.slice(i);
+            const match = REF_PATTERN.exec(rest);
+            if (match !== null) {
+                refs.push(match[1]);
+                i += match[0].length;
+                continue;
+            }
+            if (rest.startsWith('${secret:') || rest.startsWith('${secret')) {
+                // Looks like a reference but is not one — surface the fragment for the error.
+                const end = rest.indexOf('}');
+                malformed.push(end === -1 ? rest.slice(0, 24) : rest.slice(0, end + 1));
+                i += end === -1 ? rest.length : end + 1;
+                continue;
+            }
+        }
+        i += 1;
+    }
+    return { refs, malformed };
+}
+/** True when the string contains at least one well-formed secret reference. */
+export function stringHasSecretRefs(value) {
+    return scanSecretString(value).refs.length > 0;
+}
+/**
+ * Interpolates a string: well-formed references are replaced via `resolve(name)`,
+ * `$$` becomes a literal `$`. The caller guarantees every referenced name resolves
+ * (the CLI aggregates unresolved references into one loud error BEFORE interpolating).
+ */
+export function interpolateSecretString(value, resolve) {
+    let out = '';
+    let i = 0;
+    while (i < value.length) {
+        if (value[i] === '$') {
+            if (value[i + 1] === '$') {
+                out += '$';
+                i += 2;
+                continue;
+            }
+            const match = REF_PATTERN.exec(value.slice(i));
+            if (match !== null) {
+                out += resolve(match[1]);
+                i += match[0].length;
+                continue;
+            }
+        }
+        out += value[i];
+        i += 1;
+    }
+    return out;
+}
+/**
+ * Walks a config tree (objects/arrays/strings) collecting every well-formed secret
+ * reference with its binding site. Malformed fragments are collected separately.
+ */
+export function findSecretRefSites(node, basePath) {
+    const sites = [];
+    const malformed = [];
+    const walk = (value, path) => {
+        if (typeof value === 'string') {
+            const scan = scanSecretString(value);
+            for (const name of scan.refs)
+                sites.push({ name, path });
+            for (const fragment of scan.malformed)
+                malformed.push({ path, fragment });
+            return;
+        }
+        if (Array.isArray(value)) {
+            value.forEach((item, idx) => walk(item, `${path}[${idx}]`));
+            return;
+        }
+        if (typeof value === 'object' && value !== null) {
+            for (const [key, child] of Object.entries(value))
+                walk(child, `${path}.${key}`);
+        }
+    };
+    walk(node, basePath);
+    return { sites, malformed };
+}
+/**
+ * Interpolates every string inside a config tree, returning a deep copy.
+ * Non-string leaves pass through untouched.
+ */
+export function interpolateConfigTree(node, resolve) {
+    if (typeof node === 'string') {
+        return interpolateSecretString(node, resolve);
+    }
+    if (Array.isArray(node)) {
+        return node.map((item) => interpolateConfigTree(item, resolve));
+    }
+    if (typeof node === 'object' && node !== null) {
+        const out = {};
+        for (const [key, child] of Object.entries(node)) {
+            out[key] = interpolateConfigTree(child, resolve);
+        }
+        return out;
+    }
+    return node;
+}
+//# sourceMappingURL=secret-refs.js.map

package/dist/manifest/secret-refs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-refs.js","sourceRoot":"","sources":["../../src/manifest/secret-refs.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,EAAE;AACF,kFAAkF;AAClF,qEAAqE;AACrE,EAAE;AACF,WAAW;AACX,qEAAqE;AACrE,0EAA0E;AAC1E,2EAA2E;AAC3E,qFAAqF;AACrF,oFAAoF;AACpF,oFAAoF;AAEpF,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAUjD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACzB,CAAC,IAAI,CAAC,CAAC,CAAC,sBAAsB;gBAC9B,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;gBACrB,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBACrB,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChE,8EAA8E;gBAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC9B,SAAS,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;gBACxE,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;gBACxC,SAAS;YACX,CAAC;QACH,CAAC;QACD,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC7B,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,OAAiC;IACtF,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACzB,GAAG,IAAI,GAAG,CAAC;gBACX,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;gBAC1B,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBACrB,SAAS;YACX,CAAC;QACH,CAAC;QACD,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;QAChB,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAUD;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAa,EACb,QAAgB;IAEhB,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,MAAM,SAAS,GAA8C,EAAE,CAAC;IAChE,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,IAAY,EAAQ,EAAE;QAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACrC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS;gBAAE,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC1E,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAI,IAAO,EAAE,OAAiC;IACjF,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAiB,CAAC;IAChE,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAiB,CAAC;IAClF,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,GAAG,CAAC,GAAG,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,GAAmB,CAAC;IAC7B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/types/extension-identity.d.ts

@@ -0,0 +1,74 @@
+/** One loaded extension module's identity. */
+export interface ExtensionIdentityModule {
+    /** The authored path (workflow.yaml `extensions:` entry or the --extensions-module value). */
+    declared: string;
+    /** Absolute realpath-resolved module path that was imported. */
+    resolved: string;
+    /** sha256 hex of the entry module file's bytes at load time. */
+    entry_hash: string;
+    /** How the module was loaded. Descriptive metadata — not part of the drift comparison. */
+    format: 'esm' | 'cjs' | 'ts-jiti';
+}
+/** Versioned deterministic directory-tree fingerprint over the module roots. */
+export interface ExtensionIdentityTree {
+    /** Deduped, sorted parent directories of the resolved entry modules. */
+    roots: string[];
+    /** The sweep rule string the fingerprint was computed under (governs recomputation). */
+    rules: string;
+    /** Number of files included in the fingerprint. */
+    file_count: number;
+    /** Total bytes of the included files. */
+    total_bytes: number;
+    /** sha256 hex over the sorted `relpath\0filehash` lines. */
+    tree_hash: string;
+    /** True when the sweep hit its caps — the fingerprint covers a deterministic prefix only. */
+    truncated: boolean;
+}
+/** Labeled advisory signals — each independently fail-soft; never part of the comparison. */
+export interface ExtensionIdentitySignals {
+    /** `version` from the trust root's package.json, when readable. */
+    package_version?: string;
+    /** Commit hash from .git/HEAD (one ref-file dereference; no child processes), when readable. */
+    git_head?: string;
+}
+/**
+ * One point-in-time identity of the extension code executing a run. Appended to
+ * `RunRecord.extension_identity` on change (history, newest last). The shape is
+ * load-bearing evidence — never collapsible to a boolean.
+ */
+export interface ExtensionIdentityEntry {
+    /** ISO timestamp of module-LOAD-time capture (what was in memory), not of the append. */
+    captured_at: string;
+    /** PID of the capturing process. */
+    pid?: number;
+    modules: ExtensionIdentityModule[];
+    tree: ExtensionIdentityTree;
+    signals?: ExtensionIdentitySignals;
+    /** Coverage label of the sweep rules — never 'complete'. */
+    coverage: 'dir_tree_v1';
+    /**
+     * Deployment-manifest identity: the manifest file's path and its raw-bytes sha256
+     * (placeholders included — an edited binding IS drift; a rotated secret VALUE is not).
+     * The manifest file never contributes a sweep root — only this content hash.
+     */
+    manifest?: {
+        path: string;
+        content_hash: string;
+    };
+    /**
+     * Secret NAMES referenced by the manifest at load time. Recorded, never compared —
+     * and never values or value hashes.
+     */
+    secret_names?: string[];
+    /** Present when --extensions-module replaced the declared modules — omitting it would lie. */
+    override_active?: true;
+    /** Present when capture (or the extension load itself) failed — the failure is itself a record. */
+    error?: string;
+}
+/**
+ * Returns true when two identity entries denote DIFFERENT extension code:
+ * tree_hash, the per-module entry hashes (as an ordered resolved→hash list), or the
+ * override flag differ. Signals, timestamps, and pid are advisory — never compared.
+ */
+export declare function extensionIdentityDiffers(a: ExtensionIdentityEntry, b: ExtensionIdentityEntry): boolean;
+//# sourceMappingURL=extension-identity.d.ts.map

package/dist/types/extension-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension-identity.d.ts","sourceRoot":"","sources":["../../src/types/extension-identity.ts"],"names":[],"mappings":"AASA,8CAA8C;AAC9C,MAAM,WAAW,uBAAuB;IACtC,8FAA8F;IAC9F,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAC;IACnB,0FAA0F;IAC1F,MAAM,EAAE,KAAK,GAAG,KAAK,GAAG,SAAS,CAAC;CACnC;AAED,gFAAgF;AAChF,MAAM,WAAW,qBAAqB;IACpC,wEAAwE;IACxE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,wFAAwF;IACxF,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,UAAU,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,6FAA6F;IAC7F,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,6FAA6F;AAC7F,MAAM,WAAW,wBAAwB;IACvC,mEAAmE;IACnE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gGAAgG;IAChG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,yFAAyF;IACzF,WAAW,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,uBAAuB,EAAE,CAAC;IACnC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,CAAC,EAAE,wBAAwB,CAAC;IACnC,4DAA4D;IAC5D,QAAQ,EAAE,aAAa,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,8FAA8F;IAC9F,eAAe,CAAC,EAAE,IAAI,CAAC;IACvB,mGAAmG;IACnG,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,CAAC,EAAE,sBAAsB,EACzB,CAAC,EAAE,sBAAsB,GACxB,OAAO,CAST"}

package/dist/types/extension-identity.js

@@ -0,0 +1,28 @@
+// Extension-code drift evidence types (issue #119) — pure data shapes carried on RunRecord.
+//
+// An ExtensionIdentityEntry records the identity of the project extension code that was in
+// memory when a run executed: per-module entry hashes plus a versioned deterministic
+// directory-tree fingerprint (dir_tree_v1). Core only defines and compares these shapes —
+// identity is COMPUTED by the CLI (extension-identity.ts, pure fs+crypto) at module-load
+// time, attached to the ExtensionRegistry, and appended to the run by the execution loop's
+// lazy append-on-change site. Never a gate; advisory evidence only.
+/**
+ * Returns true when two identity entries denote DIFFERENT extension code:
+ * tree_hash, the per-module entry hashes (as an ordered resolved→hash list), or the
+ * override flag differ. Signals, timestamps, and pid are advisory — never compared.
+ */
+export function extensionIdentityDiffers(a, b) {
+    if (a.tree.tree_hash !== b.tree.tree_hash)
+        return true;
+    if (a.manifest?.content_hash !== b.manifest?.content_hash)
+        return true;
+    if ((a.override_active === true) !== (b.override_active === true))
+        return true;
+    if (a.modules.length !== b.modules.length)
+        return true;
+    const key = (m) => `${m.resolved}\u0000${m.entry_hash}`;
+    const aModules = a.modules.map(key).sort();
+    const bModules = b.modules.map(key).sort();
+    return aModules.some((line, i) => line !== bModules[i]);
+}
+//# sourceMappingURL=extension-identity.js.map

package/dist/types/extension-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension-identity.js","sourceRoot":"","sources":["../../src/types/extension-identity.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,EAAE;AACF,2FAA2F;AAC3F,qFAAqF;AACrF,0FAA0F;AAC1F,yFAAyF;AACzF,2FAA2F;AAC3F,oEAAoE;AAsEpE;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,CAAyB,EACzB,CAAyB;IAEzB,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,CAAC,CAAC,QAAQ,EAAE,YAAY,KAAK,CAAC,CAAC,QAAQ,EAAE,YAAY;QAAE,OAAO,IAAI,CAAC;IACvE,IAAI,CAAC,CAAC,CAAC,eAAe,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,GAAG,GAAG,CAAC,CAA0B,EAAU,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,SAAS,CAAC,CAAC,UAAU,EAAE,CAAC;IACzF,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC"}

package/dist/types/run-record.d.ts

@@ -1,4 +1,5 @@
 import type { ToolCallRecord } from './mcp-types.js';
+import type { ExtensionIdentityEntry } from './extension-identity.js';
 /**
  * A single trace entry submitted by the agent. Submitted as-is; the engine
  * canonicalizes and assigns seq before persisting.
@@ -183,6 +184,14 @@ export interface RunRecord {
      * Keyed by entry name. Separate from step evidence — not in evidence[].
      */
     workflow_context_snapshots?: Record<string, WorkflowContextSnapshot>;
+    /**
+     * Append-on-change history of the project-extension code identity that executed this run
+     * (issue #119). Each entry is captured at module-LOAD time by the CLI and appended lazily
+     * by the execution loop when it differs from the last recorded entry. Advisory evidence —
+     * WARN-never-gate. Absent for extension-free runs. JSON-file-store-only until external
+     * stores round-trip unknown optional RunRecord fields through update().
+     */
+    extension_identity?: ExtensionIdentityEntry[];
     /**
      * PID of the agent process spawned by 'realm listen' for this run.
      * Set after a successful spawn. Absent for runs not started by a webhook trigger.

package/dist/types/run-record.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-record.d.ts","sourceRoot":"","sources":["../../src/types/run-record.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAErD;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC;CACrE;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;CACzD;AAED,0EAA0E;AAC1E,MAAM,WAAW,yBAAyB;IACxC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gCAAgC,EAAE,MAAM,CAAC;IACzC,0BAA0B,EAAE,MAAM,CAAC;IACnC,SAAS,EAAE,OAAO,CAAC;IACnB,iBAAiB,CAAC,EAAE,aAAa,GAAG,YAAY,CAAC;IACjD,4EAA4E;IAC5E,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,mGAAmG;IACnG,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,gHAAgH;IAChH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,8EAA8E;IAC9E,oBAAoB,EAAE,MAAM,CAAC;IAC7B,+FAA+F;IAC/F,kBAAkB,EAAE,KAAK,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,OAAO,CAAC;QAChB,cAAc,EAAE,OAAO,CAAC;KACzB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qGAAqG;IACrG,IAAI,CAAC,EAAE,WAAW,GAAG,eAAe,CAAC;IACrC;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gGAAgG;IAChG,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oDAAoD;IACpD,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;IAC9B;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,aAAa,CAAC,EAAE,yBAAyB,CAAC;CAC3C;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9C;AAED;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAChB,SAAS,GACT,cAAc,GACd,WAAW,GACX,QAAQ,GACR,WAAW,GACX,SAAS,CAAC;AAEd,sEAAsE;AACtE,MAAM,WAAW,uBAAuB;IACtC,+CAA+C;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAGzB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,sFAAsF;IACtF,aAAa,EAAE,MAAM,EAAE,CAAC;IAExB;;;OAGG;IACH,SAAS,EAAE,QAAQ,CAAC;IAEpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACrE;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B;;;;OAIG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,KAAK,CAAC;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,cAAc,EAAE,OAAO,CAAC;YAAC,MAAM,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;QACpF,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB"}
+{"version":3,"file":"run-record.d.ts","sourceRoot":"","sources":["../../src/types/run-record.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEtE;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC;CACrE;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;CACzD;AAED,0EAA0E;AAC1E,MAAM,WAAW,yBAAyB;IACxC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gCAAgC,EAAE,MAAM,CAAC;IACzC,0BAA0B,EAAE,MAAM,CAAC;IACnC,SAAS,EAAE,OAAO,CAAC;IACnB,iBAAiB,CAAC,EAAE,aAAa,GAAG,YAAY,CAAC;IACjD,4EAA4E;IAC5E,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,mGAAmG;IACnG,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,gHAAgH;IAChH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,8EAA8E;IAC9E,oBAAoB,EAAE,MAAM,CAAC;IAC7B,+FAA+F;IAC/F,kBAAkB,EAAE,KAAK,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,OAAO,CAAC;QAChB,cAAc,EAAE,OAAO,CAAC;KACzB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qGAAqG;IACrG,IAAI,CAAC,EAAE,WAAW,GAAG,eAAe,CAAC;IACrC;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gGAAgG;IAChG,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oDAAoD;IACpD,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;IAC9B;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,aAAa,CAAC,EAAE,yBAAyB,CAAC;CAC3C;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9C;AAED;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAChB,SAAS,GACT,cAAc,GACd,WAAW,GACX,QAAQ,GACR,WAAW,GACX,SAAS,CAAC;AAEd,sEAAsE;AACtE,MAAM,WAAW,uBAAuB;IACtC,+CAA+C;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAGzB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,sFAAsF;IACtF,aAAa,EAAE,MAAM,EAAE,CAAC;IAExB;;;OAGG;IACH,SAAS,EAAE,QAAQ,CAAC;IAEpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IACrE;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAC9C;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B;;;;OAIG;IACH,UAAU,CAAC,EAAE;QACX,OAAO,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,KAAK,CAAC;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,cAAc,EAAE,OAAO,CAAC;YAAC,MAAM,EAAE,OAAO,CAAA;SAAE,CAAC,CAAC;QACpF,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB"}

package/dist/types/workflow-definition.d.ts

@@ -42,9 +42,6 @@ export interface RateLimitConfig {
 }
 export interface ServiceDefinition {
     adapter: string;
-    auth?: {
-        token_from: string;
-    };
     trust: ServiceTrust;
     rate_limit?: RateLimitConfig;
 }
@@ -287,6 +284,29 @@ export interface WorkflowDefinition {
      *  Resolved relative to the workflow YAML file at load time.
      *  Falls back to <workflow-dir>/profiles/ if omitted. */
     profiles_dir?: string;
+    /**
+     * Optional project extension module path(s) — RELATIVE to the workflow directory.
+     * Authored as `string | string[]`; loadWorkflowFromFile normalizes to `string[]` and the
+     * authored relative paths are stored untouched. Absolute paths and empty strings/arrays
+     * are rejected at load time. Requires file-based loading — loadWorkflowFromString rejects
+     * a declared `extensions` key (no directory context). Core resolves and stores PATHS only;
+     * module loading lives in the CLI composition layer (loadProjectExtensions).
+     */
+    extensions?: string | string[];
+    /**
+     * Absolutized workflow directory, stamped by loadWorkflowFromFile when `extensions` is
+     * declared (precedent: workflow_context path absolutization). Extension paths resolve
+     * against this directory. Runtime-only — never write to workflow YAML.
+     */
+    source_dir?: string;
+    /**
+     * Containment root for extension resolution: nearest ancestor of source_dir (inclusive)
+     * containing package.json or .git; fallback source_dir itself. Stamped at registration
+     * time from an operator-given path — this is NOT execution-time discovery-walking.
+     * The loader refuses any extension module resolving outside this root (realpath-compared).
+     * Runtime-only — never write to workflow YAML.
+     */
+    trust_root?: string;
     /**
      * Map of resolved profile content keyed by profile name.
      * Populated by loadWorkflowFromFile — absent when loaded from string.

package/dist/types/workflow-definition.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-definition.d.ts","sourceRoot":"","sources":["../../src/types/workflow-definition.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAEvD,MAAM,WAAW,cAAc;IAC7B,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,gBAAgB,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;AAE1F,MAAM,MAAM,YAAY,GAAG,kBAAkB,GAAG,gBAAgB,GAAG,gBAAgB,CAAC;AAEpF,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACxC,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,4EAA4E;IAC5E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,KAAK,EAAE,YAAY,CAAC;IACpB,UAAU,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED,oDAAoD;AACpD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACvC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,OAAO,CAAC;IAC7C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uFAAuF;IACvF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,MAAM,WAAW,GACnB,aAAa,GACb,YAAY,GACZ,UAAU,GACV,YAAY,GACZ,aAAa,GACb,aAAa,CAAC;AAElB;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC;AAChD,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,WAAW,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAAA;CAAE,CAAC;AAElF,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,aAAa,CAAC;IACzB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;OAEG;IACH,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B;;;;;;;;;;;;;;OAcG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACzB;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC1D;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,UAAU,CAAC;IAC3B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB;;;;;WAKG;QACH,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;;;;;WAOG;QACH,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB;;;;;;;;WAQG;QACH,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAC9C,CAAC;IACF,uFAAuF;IACvF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,UAAU,CAAC;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC7C,kFAAkF;IAClF,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;IAChC,uFAAuF;IACvF,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC/C,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACtC;;6DAEyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9E;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACxD;;;;OAIG;IACH,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IAC3B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED,4DAA4D;AAC5D,MAAM,WAAW,oBAAoB;IACnC,sFAAsF;IACtF,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACzB,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,iFAAiF;AACjF,MAAM,MAAM,oBAAoB,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,CAAC;AAO/D,iGAAiG;AACjG,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,eAAe,CAAC;IACtB,4FAA4F;IAC5F,MAAM,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,0EAA0E;AAC1E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACzC,wDAAwD;IACxD,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC5B,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,6GAA6G;AAC7G,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,WAAW,GAAG,gBAAgB,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAG3F,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAAE,CAAC;AAE/C,8FAA8F;AAC9F,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,eAAe,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B;;iGAE6F;IAC7F,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,SAAS,CAAC;IAChB,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,WAAW,CAAC;IAClB,+FAA+F;IAC/F,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,sCAAsC;IACtC,KAAK,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAC5B,mGAAmG;IACnG,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED,MAAM,MAAM,iBAAiB,GAAG,cAAc,CAAC"}
+{"version":3,"file":"workflow-definition.d.ts","sourceRoot":"","sources":["../../src/types/workflow-definition.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAEvD,MAAM,WAAW,cAAc;IAC7B,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,gBAAgB,GAAG,iBAAiB,GAAG,gBAAgB,CAAC;AAE1F,MAAM,MAAM,YAAY,GAAG,kBAAkB,GAAG,gBAAgB,GAAG,gBAAgB,CAAC;AAEpF,MAAM,WAAW,UAAU;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACxC,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,4EAA4E;IAC5E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,YAAY,CAAC;IACpB,UAAU,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED,oDAAoD;AACpD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACvC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,QAAQ,GAAG,aAAa,GAAG,OAAO,CAAC;IAC7C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uFAAuF;IACvF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,MAAM,WAAW,GACnB,aAAa,GACb,YAAY,GACZ,UAAU,GACV,YAAY,GACZ,aAAa,GACb,aAAa,CAAC;AAElB;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC;AAChD,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,WAAW,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAAA;CAAE,CAAC;AAElF,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,aAAa,CAAC;IACzB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;OAEG;IACH,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B;;;;;;;;;;;;;;OAcG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACzB;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC1D;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;;;;;;;;;;;OAcG;IACH,aAAa,CAAC,EAAE,UAAU,CAAC;IAC3B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,IAAI,CAAC,EAAE;QACL,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB;;;;;WAKG;QACH,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;;;;;WAOG;QACH,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB;;;;;;;;WAQG;QACH,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAC9C,CAAC;IACF,uFAAuF;IACvF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,UAAU,CAAC;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC7C,kFAAkF;IAClF,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;IAChC,uFAAuF;IACvF,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC/C,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACtC;;6DAEyD;IACzD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC/B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9E;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACxD;;;;OAIG;IACH,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IAC3B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED,4DAA4D;AAC5D,MAAM,WAAW,oBAAoB;IACnC,sFAAsF;IACtF,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACzB,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,iFAAiF;AACjF,MAAM,MAAM,oBAAoB,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,CAAC;AAO/D,iGAAiG;AACjG,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,eAAe,CAAC;IACtB,4FAA4F;IAC5F,MAAM,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,4EAA4E;AAC5E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,0EAA0E;AAC1E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,qFAAqF;AACrF,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACzC,wDAAwD;IACxD,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC5B,4EAA4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,6GAA6G;AAC7G,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,WAAW,GAAG,gBAAgB,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAG3F,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAAE,CAAC;AAE/C,8FAA8F;AAC9F,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,eAAe,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B;;iGAE6F;IAC7F,OAAO,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,SAAS,CAAC;IAChB,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,WAAW,CAAC;IAClB,+FAA+F;IAC/F,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,sCAAsC;IACtC,KAAK,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAC5B,mGAAmG;IACnG,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAED,MAAM,MAAM,iBAAiB,GAAG,cAAc,CAAC"}

package/dist/workflow/yaml-loader.d.ts

@@ -10,6 +10,8 @@ export declare function loadWorkflowFromFile(filePath: string, registry?: Extens
 /**
  * Loads a WorkflowDefinition from a YAML string.
  * Validates structure and DAG dependency references.
+ * A declared `extensions` key is a hard load error — extensions require file-based loading
+ * (no directory context exists to resolve relative extension module paths against).
  * @throws WorkflowError on parse failure or structural validation errors.
  */
 export declare function loadWorkflowFromString(content: string, registry?: ExtensionRegistry): WorkflowDefinition;

package/dist/workflow/yaml-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"yaml-loader.d.ts","sourceRoot":"","sources":["../../src/workflow/yaml-loader.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,kBAAkB,EAGnB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AA6FnE,iFAAiF;AACjF,eAAO,MAAM,+BAA+B,IAAI,CAAC;AAajD;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,kBAAkB,CA+HpB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,kBAAkB,CAohBpB"}
+{"version":3,"file":"yaml-loader.d.ts","sourceRoot":"","sources":["../../src/workflow/yaml-loader.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,kBAAkB,EAGnB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AA6FnE,iFAAiF;AACjF,eAAO,MAAM,+BAA+B,IAAI,CAAC;AAuFjD;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,kBAAkB,CA0IpB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,iBAAiB,GAC3B,kBAAkB,CAEpB"}

package/dist/workflow/yaml-loader.js

@@ -1,6 +1,6 @@
 // Workflow YAML loader — parses workflow.yaml files into typed WorkflowDefinition objects.
 import { readFileSync, existsSync } from 'node:fs';
-import { dirname, resolve, join } from 'node:path';
+import { dirname, resolve, join, isAbsolute } from 'node:path';
 import { createHash } from 'node:crypto';
 import { load } from 'js-yaml';
 import { Ajv } from 'ajv';
@@ -71,6 +71,22 @@ function validateWhenReference(path, stepName, dependsOn, errors) {
 }
 /** Bumped on every breaking change to WorkflowDefinition's serialized format. */
 export const CURRENT_WORKFLOW_SCHEMA_VERSION = 1;
+/**
+ * Ajv-strict schema for one `services:` entry — CLOSED key set (`adapter`, `trust`,
+ * `rate_limit`). `auth`/`token_from` get a targeted migration rejection BEFORE this schema
+ * runs (removed in v0.14.0 — credentials bind in the deployment manifest). rate_limit's
+ * field-level numeric rules keep their existing dedicated checks below.
+ */
+const SERVICE_ENTRY_JSON_SCHEMA = {
+    type: 'object',
+    additionalProperties: false,
+    required: ['adapter'],
+    properties: {
+        adapter: { type: 'string', minLength: 1 },
+        trust: { enum: ['engine_delivered', 'engine_managed', 'agent_provided'] },
+        rate_limit: { type: 'object' },
+    },
+};
 const VALID_EXECUTIONS = new Set(['auto', 'agent', 'guard']);
 const VALID_SERVICE_METHODS = new Set(['fetch', 'create', 'update', 'delete']);
 const VALID_TRIGGER_RULES = new Set([
@@ -81,6 +97,58 @@ const VALID_TRIGGER_RULES = new Set([
     'one_success',
     'none_failed',
 ]);
+/**
+ * JSON Schema (Ajv strict) for the top-level `extensions` key: a non-empty module path or a
+ * non-empty array of them. Relative-path enforcement is a separate explicit check (isAbsolute)
+ * so the error message can be actionable.
+ */
+const EXTENSIONS_JSON_SCHEMA = {
+    anyOf: [
+        { type: 'string', minLength: 1 },
+        { type: 'array', minItems: 1, items: { type: 'string', minLength: 1 } },
+    ],
+};
+/**
+ * Validates the authored `extensions` value: `string | string[]`, every entry a non-empty
+ * RELATIVE path. Returns actionable error strings (empty = valid).
+ */
+function validateExtensionsDeclaration(rawExtensions) {
+    const errors = [];
+    const ajv = new Ajv({ strict: true });
+    if (!ajv.validate(EXTENSIONS_JSON_SCHEMA, rawExtensions)) {
+        errors.push(`'extensions' must be a non-empty module path or a non-empty array of module paths ` +
+            `(e.g. extensions: ./dist/registry.js)`);
+        return errors;
+    }
+    const entries = typeof rawExtensions === 'string' ? [rawExtensions] : rawExtensions;
+    for (const entry of entries) {
+        if (entry.trim() === '') {
+            errors.push(`'extensions' entries must be non-empty module paths`);
+        }
+        else if (isAbsolute(entry)) {
+            errors.push(`'extensions' entry '${entry}' is an absolute path — extension modules must be declared ` +
+                `RELATIVE to the workflow directory (e.g. ../dist/registry.js)`);
+        }
+    }
+    return errors;
+}
+/**
+ * Finds the trust root for extension resolution: the nearest ancestor of `dir` (inclusive)
+ * containing `package.json` or `.git`; falls back to `dir` itself when no such ancestor exists.
+ * Derived once, at registration time, from an operator-given path — never at execution time.
+ */
+function findTrustRoot(dir) {
+    let current = dir;
+    for (;;) {
+        if (existsSync(join(current, 'package.json')) || existsSync(join(current, '.git'))) {
+            return current;
+        }
+        const parent = dirname(current);
+        if (parent === current)
+            return dir;
+        current = parent;
+    }
+}
 /**
  * Loads a WorkflowDefinition from a YAML file on disk.
  * @throws WorkflowError on read failure or structural validation errors.
@@ -99,7 +167,7 @@ export function loadWorkflowFromFile(filePath, registry) {
             retryable: false,
         });
     }
-    const definition = loadWorkflowFromString(content, registry);
+    const definition = parseWorkflowString(content, registry, { allowExtensions: true });
     // Resolve agent profiles — only possible when we have a file path.
     const workflowDir = dirname(resolve(filePath));
     const profilesDir = definition.profiles_dir !== undefined
@@ -190,15 +258,36 @@ export function loadWorkflowFromFile(filePath, registry) {
             description: 'Auto-registered schema.json from workflow directory',
         };
     }
+    // Resolution metadata: stamped for EVERY file-loaded definition (v0.14) — trust_root is
+    // the deployment-manifest anchor (`<trust_root>/realm.yaml`), needed by extension-free
+    // workflows that consume manifest-constructed adapters by name. Core resolves/stores
+    // PATHS only — it never imports modules or reads the manifest; that is the CLI's job.
+    definition.source_dir = workflowDir;
+    definition.trust_root = findTrustRoot(workflowDir);
+    if (definition.extensions !== undefined) {
+        definition.extensions =
+            typeof definition.extensions === 'string' ? [definition.extensions] : definition.extensions;
+    }
     definition.origin = 'human';
     return definition;
 }
 /**
  * Loads a WorkflowDefinition from a YAML string.
  * Validates structure and DAG dependency references.
+ * A declared `extensions` key is a hard load error — extensions require file-based loading
+ * (no directory context exists to resolve relative extension module paths against).
  * @throws WorkflowError on parse failure or structural validation errors.
  */
 export function loadWorkflowFromString(content, registry) {
+    return parseWorkflowString(content, registry, { allowExtensions: false });
+}
+/**
+ * Shared YAML → WorkflowDefinition parser. `allowExtensions` distinguishes file-based loading
+ * (extensions permitted — a directory context exists) from string-based loading (hard error,
+ * fired before any other processing).
+ * @throws WorkflowError on parse failure or structural validation errors.
+ */
+function parseWorkflowString(content, registry, opts) {
     // Step 1: Parse YAML
     let raw;
     try {
@@ -223,6 +312,21 @@ export function loadWorkflowFromString(content, registry) {
         });
     }
     const doc = raw;
+    // Project extensions: hard error for string-based loading (fires before any other
+    // processing); shape validation (string | string[], relative-only) for file-based loading.
+    if ('extensions' in doc && doc['extensions'] !== undefined) {
+        if (!opts.allowExtensions) {
+            throw new WorkflowError(`Invalid workflow: 'extensions' requires file-based loading — no directory context is ` +
+                `available to resolve extension module paths. Register this workflow from its YAML ` +
+                `file (realm workflow register <path>).`, {
+                code: 'VALIDATION_WORKFLOW_SCHEMA',
+                category: 'VALIDATION',
+                agentAction: 'report_to_user',
+                retryable: false,
+            });
+        }
+        errors.push(...validateExtensionsDeclaration(doc['extensions']));
+    }
     const REQUIRED_TOP_LEVEL = ['id', 'name', 'version', 'steps'];
     for (const field of REQUIRED_TOP_LEVEL) {
         if (!(field in doc)) {
@@ -565,12 +669,28 @@ export function loadWorkflowFromString(content, registry) {
             seen.add(server.id);
         }
     }
-    // Validate services: rate_limit fields.
+    // Validate services: Ajv-strict entry schema (closed key set) + rate_limit fields.
     if (typeof doc['services'] === 'object' && doc['services'] !== null) {
         for (const [serviceName, serviceRaw] of Object.entries(doc['services'])) {
             if (typeof serviceRaw !== 'object' || serviceRaw === null)
                 continue;
             const service = serviceRaw;
+            // PERMANENT targeted rejection — must win over the generic unknown-key error.
+            if ('auth' in service || 'token_from' in service) {
+                errors.push(`Service '${serviceName}': 'auth.token_from' was removed in v0.14.0 — bind ` +
+                    `credentials in your deployment manifest (realm.yaml); see the migration note.`);
+            }
+            else {
+                const serviceAjv = new Ajv({ strict: true, allErrors: true });
+                if (!serviceAjv.validate(SERVICE_ENTRY_JSON_SCHEMA, service)) {
+                    for (const err of serviceAjv.errors ?? []) {
+                        const detail = err.keyword === 'additionalProperties'
+                            ? `unknown key '${String(err.params.additionalProperty)}'`
+                            : `${err.instancePath.replace(/^\//, '').replace(/\//g, '.') || 'entry'} ${err.message ?? 'invalid'}`;
+                        errors.push(`Service '${serviceName}': ${detail}`);
+                    }
+                }
+            }
             const rateLimit = service['rate_limit'];
             if (rateLimit === undefined)
                 continue;