@skillstech/thunderlang 0.1.6

package/src/guard.mjs

@@ -0,0 +1,105 @@
+// Runtime enforcement (intent-guard-v1) , turn intent into a guard that runs IN the application
+// and actually blocks a forbidden action, so intent is load-bearing, not advisory. Deterministic,
+// no AI. Pure ESM (parse + the pure runtime), so it is browser-safe , the same guard runs in a
+// Node service or a browser app.
+//
+// Two things are deterministically enforceable at runtime, and this compiles both:
+//   1. Decisions ARE policy. `assertAllowed(name, inputs)` runs the declared decision and throws
+//      if its result denies the action , the intent's rules become a hard gate in production.
+//   2. Secrets must not leak. `redact(obj)` masks every field the intent declares secret (a
+//      Secret/Password/Token type, a pii/sensitive data element, or a secret-looking name), so
+//      wrapping a logger or a response with it enforces "never expose the token" at runtime.
+
+import { parseIntent } from './parse.mjs';
+import { evaluateDecision } from './runtime.mjs';
+
+export const GUARD_SCHEMA = 'intent-guard-v1';
+
+const SECRET_TYPES = new Set(['secret', 'password', 'passwd', 'jwt', 'token', 'apikey', 'api_key', 'privatekey', 'private_key', 'credential', 'cvv']);
+const SENSITIVE_NAME = /^(.*[._-])?(pass(word|wd)?|secret|token|jwt|ssn|api[-_]?key|apikey|credential|cvv|private[-_]?key|card(number)?|cvc)([._-].*)?$/i;
+// Decision results that mean "block" when the caller has not specified an explicit deny set.
+const DENY_RE = /^(deny|denied|block|blocked|refuse|refused|reject|rejected|forbid|forbidden|escalate|escalated|review|needsreview|no)$/i;
+
+/**
+ * Compile an intent AST into a runtime guard.
+ * @param {object} ast
+ * @param {{ denyResults?: string[], mask?: string }} [opts] explicit deny-list + mask token
+ */
+export function buildGuard(ast, { denyResults, mask = '[redacted]' } = {}) {
+  const secretFields = new Set();
+  const consider = (f) => {
+    if (!f || !f.name) return;
+    if (SECRET_TYPES.has(String(f.type || '').toLowerCase()) || SENSITIVE_NAME.test(f.name)) secretFields.add(f.name);
+  };
+  for (const f of ast.inputs || []) consider(f);
+  for (const f of ast.outputs || []) consider(f);
+  for (const ev of ast.events || []) for (const f of ev.payload || []) consider(f);
+  for (const d of ast.dataElements || []) {
+    if (/pii|sensitive/i.test(d.classification || '')) {
+      const leaf = String(d.path || '').split('.').pop();
+      if (leaf) secretFields.add(leaf);
+    }
+  }
+
+  const denySet = denyResults ? new Set(denyResults.map(String)) : null;
+  const isDenied = (result) => (denySet ? denySet.has(String(result)) : DENY_RE.test(String(result ?? '').replace(/[^A-Za-z]/g, '')));
+  const isSecretKey = (k) => secretFields.has(k) || SENSITIVE_NAME.test(k);
+  const decisions = new Map((ast.decisions || []).map((d) => [d.name, d]));
+
+  // Deep-mask any field the intent declares secret. Cycle-safe AND depth-bounded: this runs in
+  // production (wrapping a logger), so it must never throw. Beyond MAX_DEPTH it stops descending
+  // rather than overflowing the stack on a pathologically deep object.
+  const MAX_DEPTH = 100;
+  function redact(value, seen = new WeakSet(), depth = 0) {
+    if (depth > MAX_DEPTH) return value;
+    if (Array.isArray(value)) return value.map((v) => redact(v, seen, depth + 1));
+    if (value && typeof value === 'object') {
+      if (seen.has(value)) return value;
+      seen.add(value);
+      const out = {};
+      for (const [k, v] of Object.entries(value)) out[k] = isSecretKey(k) ? mask : redact(v, seen, depth + 1);
+      return out;
+    }
+    return value;
+  }
+
+  function decide(name, inputs) {
+    const d = decisions.get(name);
+    if (!d) throw new Error(`intent guard: no decision "${name}"`);
+    const r = evaluateDecision(d, inputs || {});
+    return { ...r, allowed: !isDenied(r.result) };
+  }
+
+  function assertAllowed(name, inputs) {
+    const r = decide(name, inputs);
+    if (!r.allowed) {
+      const e = new Error(`intent guard: decision "${name}" denied the action (result: ${r.result})`);
+      e.code = 'INTENT_GUARD_DENIED';
+      e.decision = name;
+      e.result = r.result;
+      throw e;
+    }
+    return r;
+  }
+
+  return {
+    schema: GUARD_SCHEMA,
+    secretFields: [...secretFields],
+    decisions: [...decisions.keys()],
+    neverRules: (ast.neverRules || []).map((n) => n.statement),
+    redact,
+    decide,
+    assertAllowed,
+  };
+}
+
+/** Compile intent SOURCE into a runtime guard. */
+export function compileGuard(intentText, opts) {
+  return buildGuard(parseIntent(String(intentText ?? '')), opts);
+}
+
+/** A JSON-able summary of what a guard would enforce (for `intent guard` / audits). */
+export function guardSummary(ast) {
+  const g = buildGuard(ast);
+  return { schema: GUARD_SCHEMA, redactsFields: g.secretFields, enforcesDecisions: g.decisions, neverRules: g.neverRules };
+}

package/src/guardian.mjs

@@ -0,0 +1,98 @@
+// Intent Guardian (intent-guardian-v1) , continuous drift detection between an approved intent and
+// the evolving one. Given a BEFORE and AFTER state, it answers the directive's question: "what
+// changed, what intent could it affect, what risk did it introduce, what must be reverified, and
+// what learning content should be refreshed?" Deterministic, no AI. It composes the shared spine:
+// the semantic diff (diffGraphs) + the Intent Scanner (findings) over Intent IR. Pure ESM.
+//
+//   guardianReport(beforeFiles, afterFiles) -> a drift report
+//   where each is [{ file, source }] (a single-file change is a one-element array).
+
+import { diffGraphs } from './semantic-diff.mjs';
+import { scanProject } from './scan.mjs';
+import { parseIntent } from './parse.mjs';
+import { buildIntentGraph } from './intent-graph.mjs';
+
+export const GUARDIAN_SCHEMA = 'intent-guardian-v1';
+
+// Merge a project's files into ONE graph keyed by mission-based node ids (NOT file paths), so a
+// before/after comparison aligns by logical identity even across a rename. First id wins on dupes.
+function mergedGraph(files) {
+  const nodes = []; const relationships = []; const seen = new Set();
+  for (const { source } of files || []) {
+    const g = buildIntentGraph(parseIntent(String(source ?? '')));
+    for (const n of g.nodes) if (!seen.has(n.id)) { seen.add(n.id); nodes.push(n); }
+    relationships.push(...g.relationships);
+  }
+  return { nodes, relationships };
+}
+const dedupeById = (arr) => { const seen = new Set(); return arr.filter((x) => x && x.id && !seen.has(x.id) && seen.add(x.id)); };
+
+const findingKey = (f) => `${f.ruleId}|${f.detected}`;
+// Node types whose change invalidates verification / needs a human to re-confirm.
+const REVERIFY_TYPES = new Set(['Guarantee', 'Never', 'VerificationRule', 'VerificationResult', 'OutcomeContract', 'Decision', 'Rule']);
+const LEARNABLE_MISSION = (n) => n.type === 'Mission';
+
+/**
+ * Compare two project states and report the drift a change introduced.
+ * @param {Array<{file:string, source:string}>} beforeFiles
+ * @param {Array<{file:string, source:string}>} afterFiles
+ */
+export function guardianReport(beforeFiles, afterFiles) {
+  const before = scanProject(beforeFiles || []);
+  const after = scanProject(afterFiles || []);
+  // Diff by mission-based identity (not file-prefixed scan ids) so before/after align logically.
+  const diff = diffGraphs(mergedGraph(beforeFiles), mergedGraph(afterFiles));
+
+  // Risk delta: findings present after but not before were introduced by the change; vice versa.
+  const beforeKeys = new Set(before.findings.map(findingKey));
+  const afterKeys = new Set(after.findings.map(findingKey));
+  const introducedRisk = after.findings.filter((f) => !beforeKeys.has(findingKey(f)));
+  const resolvedRisk = before.findings.filter((f) => !afterKeys.has(findingKey(f)));
+
+  // What changed at the node level (added/removed/changed), and which of those need re-verification.
+  const changedNodeIds = new Set([...diff.addedNodes.map((n) => n.id), ...diff.removedNodes.map((n) => n.id), ...diff.changedNodes.map((c) => c.id)]);
+  const touched = dedupeById([...diff.addedNodes, ...diff.removedNodes, ...diff.changedNodes.map((c) => c.after || c.before)]);
+  const mustReverify = touched
+    .filter((n) => REVERIFY_TYPES.has(n.type))
+    .map((n) => ({ id: n.id, type: n.type, title: n.title || null, reason: 'contract element changed , its verification no longer holds' }));
+  for (const ap of diff.invalidatedApprovals || []) mustReverify.push({ id: ap, type: 'Approval', reason: 'the mission contract changed , this approval is invalidated' });
+
+  // Learning freshness: any mission whose intent changed has lessons to refresh (Part 6). A mission
+  // is affected if its own node changed OR any node under it (a guarantee/never/...) changed.
+  const affectedMissions = dedupeById(touched.filter(LEARNABLE_MISSION));
+  const nonMissionChanged = touched.some((n) => !LEARNABLE_MISSION(n));
+  const missionTitles = affectedMissions.length ? affectedMissions : (nonMissionChanged ? after.ir.nodes.filter(LEARNABLE_MISSION).map((n) => ({ id: n.id, title: n.title })) : []);
+  const staleLearning = dedupeById(missionTitles).map((m) => ({ scope: m.title || m.id, reason: 'a governing intent artifact changed , lessons for it may be stale' }));
+
+  const introducedBlockers = introducedRisk.filter((f) => f.severity === 'blocker' || f.severity === 'error').length;
+  // needs-attention only when the change INTRODUCED blocking risk (an improvement that merely adds
+  // verification is `review`, not an alarm); `review` when anything changed; else `clear`.
+  const verdict = introducedBlockers > 0 ? 'needs-attention'
+    : (changedNodeIds.size > 0 || mustReverify.length > 0 || introducedRisk.length > 0) ? 'review' : 'clear';
+
+  return {
+    schema: GUARDIAN_SCHEMA,
+    verdict,
+    changed: {
+      nodesAdded: diff.addedNodes.length,
+      nodesRemoved: diff.removedNodes.length,
+      nodesChanged: diff.changedNodes.length,
+      relationshipsAdded: diff.addedRelationships.length,
+      relationshipsRemoved: diff.removedRelationships.length,
+    },
+    affectedIntent: dedupeById(missionTitles).map((n) => ({ id: n.id, title: n.title || null })),
+    introducedRisk,
+    resolvedRisk,
+    mustReverify,
+    invalidatedApprovals: diff.invalidatedApprovals || [],
+    staleLearning,
+    summary: {
+      verdict,
+      introduced: introducedRisk.length,
+      introducedBlocking: introducedBlockers,
+      resolved: resolvedRisk.length,
+      mustReverify: mustReverify.length,
+      staleLearning: staleLearning.length,
+    },
+  };
+}

package/src/hash.mjs

@@ -0,0 +1,89 @@
+// Pure, dependency-free SHA-256 (sync) , the single hash used across the whole compiler.
+// It exists so the analysis layer has NO Node.js dependency: the same code runs in Node
+// (CLI, OpenThunder server), in a browser bundle (SkillsTech Studio, Repo Mastery web), and
+// in React Native (SkillsTech Mobile). Output is byte-identical to node:crypto's
+// createHash('sha256'), so every existing proof hash, ledger hash, and test stays valid.
+//
+// This is the keystone of "one compiler, five consumers": with it, `@skillstech/thunderlang`
+// and `@skillstech/thunderlang/core` are the same source of truth everywhere.
+
+const K = new Uint32Array([
+  0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+  0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+  0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+  0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+  0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+  0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+  0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+  0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]);
+
+// UTF-8 encode a string to bytes with ZERO global dependencies (no TextEncoder, no Buffer),
+// so it runs in any JS engine , Node, browsers, and Hermes/React Native, where TextEncoder is
+// not guaranteed. Handles the full BMP + surrogate pairs; output matches TextEncoder exactly.
+function utf8(str) {
+  const s = String(str);
+  const out = [];
+  for (let i = 0; i < s.length; i += 1) {
+    let cp = s.charCodeAt(i);
+    // combine a high+low surrogate pair into a single code point
+    if (cp >= 0xd800 && cp <= 0xdbff && i + 1 < s.length) {
+      const lo = s.charCodeAt(i + 1);
+      if (lo >= 0xdc00 && lo <= 0xdfff) { cp = 0x10000 + ((cp - 0xd800) << 10) + (lo - 0xdc00); i += 1; }
+    }
+    if (cp < 0x80) out.push(cp);
+    else if (cp < 0x800) out.push(0xc0 | (cp >> 6), 0x80 | (cp & 0x3f));
+    else if (cp < 0x10000) out.push(0xe0 | (cp >> 12), 0x80 | ((cp >> 6) & 0x3f), 0x80 | (cp & 0x3f));
+    else out.push(0xf0 | (cp >> 18), 0x80 | ((cp >> 12) & 0x3f), 0x80 | ((cp >> 6) & 0x3f), 0x80 | (cp & 0x3f));
+  }
+  return Uint8Array.from(out);
+}
+
+/** Lowercase hex SHA-256 digest of a string (no prefix). Deterministic, sync, Node-free. */
+export function sha256hex(input) {
+  const msg = typeof input === 'string' ? utf8(input) : input;
+  const l = msg.length;
+  // padded length: message + 0x80 + zeros + 8-byte length, rounded up to a 64-byte block.
+  const withOne = l + 1;
+  const k = (56 - (withOne % 64) + 64) % 64;
+  const total = withOne + k + 8;
+  const buf = new Uint8Array(total);
+  buf.set(msg, 0);
+  buf[l] = 0x80;
+  const bitLenHi = Math.floor((l / 0x20000000)); // (l*8) high 32 bits
+  const bitLenLo = (l << 3) >>> 0;
+  const dv = new DataView(buf.buffer);
+  dv.setUint32(total - 8, bitLenHi >>> 0, false);
+  dv.setUint32(total - 4, bitLenLo, false);
+
+  let h0 = 0x6a09e667, h1 = 0xbb67ae85, h2 = 0x3c6ef372, h3 = 0xa54ff53a;
+  let h4 = 0x510e527f, h5 = 0x9b05688c, h6 = 0x1f83d9ab, h7 = 0x5be0cd19;
+  const w = new Uint32Array(64);
+  const rotr = (x, n) => (x >>> n) | (x << (32 - n));
+
+  for (let off = 0; off < total; off += 64) {
+    for (let i = 0; i < 16; i += 1) w[i] = dv.getUint32(off + i * 4, false);
+    for (let i = 16; i < 64; i += 1) {
+      const s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ (w[i - 15] >>> 3);
+      const s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ (w[i - 2] >>> 10);
+      w[i] = (w[i - 16] + s0 + w[i - 7] + s1) >>> 0;
+    }
+    let a = h0, b = h1, c = h2, d = h3, e = h4, f = h5, g = h6, hh = h7;
+    for (let i = 0; i < 64; i += 1) {
+      const S1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+      const ch = (e & f) ^ (~e & g);
+      const t1 = (hh + S1 + ch + K[i] + w[i]) >>> 0;
+      const S0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
+      const maj = (a & b) ^ (a & c) ^ (b & c);
+      const t2 = (S0 + maj) >>> 0;
+      hh = g; g = f; f = e; e = (d + t1) >>> 0; d = c; c = b; b = a; a = (t1 + t2) >>> 0;
+    }
+    h0 = (h0 + a) >>> 0; h1 = (h1 + b) >>> 0; h2 = (h2 + c) >>> 0; h3 = (h3 + d) >>> 0;
+    h4 = (h4 + e) >>> 0; h5 = (h5 + f) >>> 0; h6 = (h6 + g) >>> 0; h7 = (h7 + hh) >>> 0;
+  }
+  const hex = (x) => x.toString(16).padStart(8, '0');
+  return hex(h0) + hex(h1) + hex(h2) + hex(h3) + hex(h4) + hex(h5) + hex(h6) + hex(h7);
+}
+
+/** The canonical hash the ecosystem uses: `sha256:<hex>`. */
+export const sha256 = (s) => `sha256:${sha256hex(String(s))}`;

package/src/importers.mjs

@@ -0,0 +1,194 @@
+// Round-trip IMPORT adapters , the inverse of exporters.mjs. Lift an external DMN decision
+// table or BPMN process back into ThunderLang source, so intent can come FROM the tools teams
+// already use, not only go to them. Deterministic and pure. The design contract is
+// round-trip fidelity: fromDMN(toDMN(ast)) and fromBPMN(toBPMN(ast)) reconstruct source that
+// BEHAVES identically (same decisions, same lifecycle walks), even if cosmetic names differ.
+
+import { parseXml, findAll, find, childrenNamed, localName } from './xml.mjs';
+
+export const IMPORT_FORMATS = ['dmn', 'bpmn'];
+export const IMPORT_SCHEMA = 'intent-import-v1';
+
+// A no-op warning collector, so the source-only public functions carry no cost.
+const NOOP_WARN = () => {};
+
+const textOf = (node) => (node ? (find(node, 'text')?.text ?? node.text ?? '').trim() : '');
+const stripQuotes = (s) => String(s ?? '').trim().replace(/^["'](.*)["']$/s, '$1');
+// A safe ThunderLang identifier from arbitrary text.
+const idish = (s, fb = 'x') => {
+  const v = String(s ?? '').trim();
+  return v || fb;
+};
+
+/** Detect the format of an XML document ('dmn' | 'bpmn' | null). */
+export function detectFormat(xml) {
+  const s = String(xml ?? '');
+  if (/<(\w+:)?definitions[^>]*DMN/i.test(s) || /<(\w+:)?decision\b/i.test(s)) return 'dmn';
+  if (/<(\w+:)?definitions[^>]*BPMN/i.test(s) || /<(\w+:)?process\b/i.test(s)) return 'bpmn';
+  return null;
+}
+
+// Reconstruct a `when` expression from a DMN rule's input entries. Handles BOTH the way we
+// export (the whole boolean expression dumped in one cell) and proper DMN unary tests
+// (an operator or bare value relative to the input expression).
+function ruleWhen(inputExprs, entries) {
+  const parts = [];
+  for (let i = 0; i < entries.length; i++) {
+    const t = (entries[i] || '').trim();
+    if (t === '' || t === '-') continue;
+    const expr = (inputExprs[i] || '').trim();
+    if (/[A-Za-z_][\w.]*\s*(>=|<=|==|!=|>|<|=|\band\b|\bor\b|\bin\b)/.test(t)) {
+      parts.push(t); // already a full boolean expression (our export, or a rich cell)
+    } else if (/^(>=|<=|==|!=|>|<)/.test(t)) {
+      parts.push(`${expr} ${t}`.trim()); // unary test: "age" + ">= 18"
+    } else {
+      parts.push(`${expr} == ${stripQuotes(t)}`.trim()); // bare value: "region" == "US"
+    }
+  }
+  return parts.join(' and ');
+}
+
+// DMN -> intent source. `warn(code, message, subject)` collects what could not be faithfully
+// represented, so callers can surface the fidelity loss (via importReport).
+function dmnToIntent(xml, warn = NOOP_WARN) {
+  const doc = parseXml(xml);
+  const defs = find(doc, 'definitions') || doc;
+  const mission = idish(defs.attrs.name, 'ImportedDecision');
+  const lines = [`mission ${mission.replace(/\s+/g, '')}`, ''];
+  let decisions = 0;
+  let rules = 0;
+
+  for (const dec of findAll(doc, 'decision')) {
+    const dname = idish(dec.attrs.name || dec.attrs.id, 'Decision').replace(/\s+/g, '');
+    const table = find(dec, 'decisionTable');
+    if (!table) { warn('IL-IMP-DMN-001', `Decision "${dname}" has no decisionTable and was skipped.`, dname); continue; }
+    decisions += 1;
+
+    const hitPolicy = (table.attrs.hitPolicy || 'UNIQUE').toUpperCase();
+    if (!['FIRST', 'UNIQUE', 'ANY', ''].includes(hitPolicy)) {
+      warn('IL-IMP-DMN-002', `Decision "${dname}" uses hit policy ${hitPolicy}; ThunderLang evaluates first-match, so semantics may differ.`, dname);
+    }
+
+    const inputEls = childrenNamed(table, 'input');
+    const inputExprs = inputEls.map((inp) => textOf(find(inp, 'inputExpression')) || inp.attrs.label || '');
+    const inputNames = inputExprs.map((e, i) => (e || `in${i + 1}`).replace(/\s+/g, ''));
+    if (childrenNamed(table, 'output').length > 1) warn('IL-IMP-DMN-004', `Decision "${dname}" has multiple output columns; only the first is imported.`, dname);
+
+    lines.push(`decision ${dname}`);
+    if (inputNames.length) {
+      lines.push('  inputs');
+      for (const n of inputNames) lines.push(`    ${n}`);
+    }
+
+    let defaultReturn = null;
+    let ruleN = 0;
+    for (const rule of childrenNamed(table, 'rule')) {
+      const entries = childrenNamed(rule, 'inputEntry').map((e) => textOf(e));
+      const out = stripQuotes(textOf(childrenNamed(rule, 'outputEntry')[0]));
+      const when = ruleWhen(inputExprs, entries);
+      if (!when) { defaultReturn = out || defaultReturn; continue; } // all-dash rule = default
+      if (!out) warn('IL-IMP-DMN-003', `A rule in "${dname}" has a condition but no result; imported with an empty return.`, dname);
+      ruleN += 1; rules += 1;
+      lines.push(`  rule r${ruleN}`);
+      lines.push(`    when ${when}`);
+      lines.push(`    return ${out}`);
+    }
+    if (defaultReturn != null) {
+      lines.push('  default');
+      lines.push(`    return ${defaultReturn}`);
+    }
+    lines.push('');
+  }
+  return { source: lines.join('\n'), stats: { decisions, rules } };
+}
+
+// BPMN -> intent source, with warnings for constructs a lifecycle cannot model.
+function bpmnToIntent(xml, warn = NOOP_WARN) {
+  const doc = parseXml(xml);
+  const defs = find(doc, 'definitions') || doc;
+  const mission = idish(defs.attrs.name || 'ImportedProcess', 'ImportedProcess');
+  const lines = [`mission ${mission.replace(/\s+/g, '')}`, ''];
+  let processes = 0;
+  let statesTotal = 0;
+  let transitionsTotal = 0;
+
+  for (const proc of findAll(doc, 'process')) {
+    processes += 1;
+    const pname = idish(proc.attrs.name || proc.attrs.id, 'Process').replace(/\s+/g, '');
+    const taskEls = (proc.children || []).filter((c) => /task$/i.test(localName(c.name)) || localName(c.name) === 'subProcess');
+    const startIds = new Set(findAll(proc, 'startEvent').map((e) => e.attrs.id));
+    const endIds = new Set(findAll(proc, 'endEvent').map((e) => e.attrs.id));
+    const nameById = {};
+    for (const t of taskEls) nameById[t.attrs.id] = idish(t.attrs.name || t.attrs.id, 'State').replace(/\s+/g, '');
+
+    // Constructs a state machine cannot represent.
+    const gateways = (proc.children || []).filter((c) => /gateway$/i.test(localName(c.name)));
+    if (gateways.length) warn('IL-IMP-BPMN-001', `Process "${pname}" has ${gateways.length} gateway(s); branching is flattened into direct transitions.`, pname);
+    const intermediates = (proc.children || []).filter((c) => /^intermediate/i.test(localName(c.name)));
+    if (intermediates.length) warn('IL-IMP-BPMN-004', `Process "${pname}" has ${intermediates.length} intermediate event(s); not modeled as lifecycle states.`, pname);
+    if (taskEls.length === 0) warn('IL-IMP-BPMN-005', `Process "${pname}" has no tasks; the lifecycle has no states.`, pname);
+
+    const states = taskEls.map((t) => nameById[t.attrs.id]);
+    const transitions = [];
+    const terminals = new Set();
+    for (const flow of childrenNamed(proc, 'sequenceFlow')) {
+      const src = flow.attrs.sourceRef;
+      const tgt = flow.attrs.targetRef;
+      if (find(flow, 'conditionExpression')) warn('IL-IMP-BPMN-002', `A sequence flow in "${pname}" carries a condition; ThunderLang transitions have no guards, so the condition is dropped.`, pname);
+      if (startIds.has(src)) continue; // start -> initial (IL infers initial from no inbound)
+      if (endIds.has(tgt)) { if (nameById[src]) terminals.add(nameById[src]); continue; }
+      if (nameById[src] && nameById[tgt]) {
+        transitions.push({ name: idish(flow.attrs.name, `t${transitions.length + 1}`).replace(/\s+/g, ''), from: nameById[src], to: nameById[tgt] });
+      } else {
+        warn('IL-IMP-BPMN-003', `A sequence flow in "${pname}" references a non-task node (a gateway or event) and was dropped.`, pname);
+      }
+    }
+
+    statesTotal += states.length; transitionsTotal += transitions.length;
+    lines.push(`lifecycle ${pname}`);
+    for (const s of states) lines.push(`  state ${s}`);
+    for (const tr of transitions) {
+      lines.push(`  transition ${tr.name}`);
+      lines.push(`    from ${tr.from}`);
+      lines.push(`    to ${tr.to}`);
+    }
+    if (terminals.size) lines.push(`  terminal ${[...terminals].join(', ')}`);
+    lines.push('');
+  }
+  return { source: lines.join('\n'), stats: { processes, states: statesTotal, transitions: transitionsTotal } };
+}
+
+/** Import a DMN 1.3 document into ThunderLang source (one `decision` block per DMN decision). */
+export function fromDMN(xml) {
+  return dmnToIntent(xml).source;
+}
+
+/** Import a BPMN 2.0 document into ThunderLang source (one `lifecycle` block per process). */
+export function fromBPMN(xml) {
+  return bpmnToIntent(xml).source;
+}
+
+/** Dispatch by format (or auto-detect when format is omitted). Returns ThunderLang source, or null. */
+export function importIntent(xml, format) {
+  const fmt = format || detectFormat(xml);
+  if (fmt === 'dmn') return fromDMN(xml);
+  if (fmt === 'bpmn') return fromBPMN(xml);
+  return null;
+}
+
+/**
+ * Import WITH a fidelity report , the same source, plus the warnings for everything the
+ * source format expressed that ThunderLang could not faithfully represent, plus stats.
+ * This is what Studio surfaces so a user knows exactly what an import dropped.
+ * @returns {{schema, format, source, warnings, stats, ok} | null}
+ */
+export function importReport(xml, format) {
+  const fmt = format || detectFormat(xml);
+  const warnings = [];
+  const warn = (code, message, subject) => warnings.push({ code, message, ...(subject ? { subject } : {}) });
+  let result;
+  if (fmt === 'dmn') result = dmnToIntent(xml, warn);
+  else if (fmt === 'bpmn') result = bpmnToIntent(xml, warn);
+  else return null;
+  return { schema: IMPORT_SCHEMA, format: fmt, source: result.source, warnings, stats: result.stats, ok: warnings.length === 0 };
+}