@xyne/workflow-sdk 3.2.28 → 3.2.31

package/dist/steps/builtin/transform.step.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transform.step.js","sourceRoot":"","sources":["../../../src/steps/builtin/transform.step.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE7D,OAAO,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAEhE,iBAAiB;AAEjB,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,6CAA6C,CAAC;IAC/E,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC;CACxD,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IACtD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;CAC1D,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC;CAC1D,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC;IACtD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC;CAC1D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE;IAC1D,WAAW;IACX,cAAc;IACd,cAAc;IACd,YAAY;CACb,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,qDAAqD,CAAC;CAC9G,CAAC,CAAC;AAUH,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAEH,kBAAkB;AAElB;;;GAGG;AACH,SAAS,SAAS,CAChB,MAA+B,EAC/B,IAAY,EACZ,KAAc;IAEd,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,GAA4B,MAAM,CAAC;IAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACtB,IACE,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS;YAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI;YACrB,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,EAChC,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QACpB,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,GAAG,CAA4B,CAAC;IACpD,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,GAAG,KAAK,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CACnB,MAA+B,EAC/B,IAAY;IAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,GAA4B,MAAM,CAAC;IAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACtB,IACE,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS;YAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI;YACrB,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,EAChC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,GAAG,CAA4B,CAAC;IACpD,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IACzC,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;QACvB,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,eAAe;AAEf,MAAM,OAAO,aAAc,SAAQ,cAGlC;IACmB,IAAI,GAAG,eAAe,CAAC,SAAS,CAAC;IACjC,IAAI,GAAG,WAAW,CAAC;IACnB,WAAW,GAAG,oDAAoD,CAAC;IACnE,YAAY,GAAG,yBAAyB,CAAC;IACzC,YAAY,GAAG,yBAAyB,CAAC;IACzC,QAAQ,GAAiB,MAAM,CAAC;IAChC,IAAI,GAAG,QAAQ,CAAC;IAEzB,KAAK,CAAC,OAAO,CACpB,MAA2B,EAC3B,GAAyB;QAEzB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,8BAA8B;QAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAgC,CAAC;QAE3D,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACnC,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;gBACd,KAAK,KAAK;oBACR,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;oBACnC,OAAO,EAAE,CAAC;oBACV,MAAM;gBAER,KAAK,QAAQ,CAAC,CAAC,CAAC;oBACd,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;oBACjD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;wBACxB,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;wBAC9B,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;wBAC5B,OAAO,EAAE,CAAC;oBACZ,CAAC;oBACD,MAAM;gBACR,CAAC;gBAED,KAAK,QAAQ;oBACX,IAAI,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;wBAChC,OAAO,EAAE,CAAC;oBACZ,CAAC;oBACD,MAAM;gBAER,KAAK,MAAM,CAAC,CAAC,CAAC;oBACZ,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;oBAC/C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;wBACtB,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;wBAC5B,OAAO,EAAE,CAAC;oBACZ,CAAC;oBACD,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;CACF"}

package/dist/types/attachment.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Attachment — opaque reference to a file managed by the host's StorageAdapter.
+ *
+ * Used everywhere the framework carries a file:
+ * - Trigger inputs (uploaded via `POST /uploads`, attached to `context.trigger.attachments`)
+ * - Resume payloads (uploaded with feedback in a review-gate retry)
+ * - Step inputs (rerunFromStep with attachments in configOverrides)
+ *
+ * The framework never opens `data` — it's a host-defined reference (URL,
+ * blob ID, signed token, `mem://uuid`). Steps that need the bytes call
+ * `StorageAdapter.read()` via a service the host registers.
+ */
+export interface Attachment {
+    /** Original filename — e.g. "contract.pdf". */
+    name: string;
+    /** MIME type — e.g. "application/pdf", "image/png". */
+    mimeType: string;
+    /** Opaque host reference. Framework treats this as a string. */
+    data: string;
+    /** Size in bytes — set by storage after upload. Useful for UI display + size budgets. */
+    size?: number;
+}
+//# sourceMappingURL=attachment.d.ts.map

package/dist/types/attachment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment.d.ts","sourceRoot":"","sources":["../../src/types/attachment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,UAAU;IACzB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,yFAAyF;IACzF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf"}

package/dist/types/attachment.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=attachment.js.map

package/dist/types/attachment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment.js","sourceRoot":"","sources":["../../src/types/attachment.ts"],"names":[],"mappings":""}

package/dist/types/resume-payload.d.ts

@@ -0,0 +1,34 @@
+/**
+ * ResumePayload — the unified shape for resuming a paused execution.
+ *
+ * One contract for every pause type:
+ * - Mid-execution agent pauses (tool approval, input required, user interrupted)
+ * - Review gates (`onComplete: 'review'`)
+ *
+ * The router validates incoming bodies into this shape; persistence stores it
+ * verbatim; the executor and step `onResume` handlers consume it.
+ */
+import type { Attachment } from './attachment.js';
+/**
+ * Alias for {@link Attachment} kept for clarity at call sites that historically
+ * said "resume attachment". The shape is shared across the framework.
+ */
+export type ResumeAttachment = Attachment;
+/**
+ * What the user decided.
+ * - `approve`: continue from a mid-pause OR advance past a review gate
+ * - `retry`:   re-execute the current step with `priorState` + `feedback` (review gate)
+ * - `abort`:   cancel the execution
+ */
+export type ResumeAction = 'approve' | 'retry' | 'abort';
+/** Payload from the host when resuming a paused execution. */
+export interface ResumePayload {
+    action: ResumeAction;
+    /** User-provided text input (form feedback, instruction, additional context). */
+    feedback?: string;
+    /** Files uploaded alongside the feedback. Opaque references — host resolves. */
+    attachments?: ResumeAttachment[];
+    /** Step-specific extras from custom form fields. Opaque to the framework. */
+    data?: Record<string, unknown>;
+}
+//# sourceMappingURL=resume-payload.d.ts.map

package/dist/types/resume-payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resume-payload.d.ts","sourceRoot":"","sources":["../../src/types/resume-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;AAEzD,8DAA8D;AAC9D,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,YAAY,CAAC;IACrB,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,WAAW,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACjC,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC"}

package/dist/types/resume-payload.js

@@ -0,0 +1,12 @@
+/**
+ * ResumePayload — the unified shape for resuming a paused execution.
+ *
+ * One contract for every pause type:
+ * - Mid-execution agent pauses (tool approval, input required, user interrupted)
+ * - Review gates (`onComplete: 'review'`)
+ *
+ * The router validates incoming bodies into this shape; persistence stores it
+ * verbatim; the executor and step `onResume` handlers consume it.
+ */
+export {};
+//# sourceMappingURL=resume-payload.js.map

package/dist/types/resume-payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resume-payload.js","sourceRoot":"","sources":["../../src/types/resume-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/types/workflow-config.d.ts

@@ -121,6 +121,25 @@ export interface StepGroup {
     id: string;
     title: string;
     description?: string;
+    /**
+     * Hoist this group to the Run (top) level of the execution sidebar. Under the
+     * default display it merely lifts the group to the top while every other step
+     * still renders in place; under {@link WorkflowDisplay.onlyPinned} it doubles as
+     * the visibility whitelist — only pinned groups are shown.
+     */
+    pinned?: boolean;
+}
+/** Author-time display preferences for the execution viewer. Purely presentational —
+ *  has no effect on execution. */
+export interface WorkflowDisplay {
+    /**
+     * Whitelist mode for the execution sidebar: when `true`, ONLY steps belonging to a
+     * pinned group are shown; every non-pinned group and ungrouped step is dropped.
+     * Default `false` — all steps show and pinned groups are merely hoisted to the top.
+     * Use this to present a curated run (e.g. a single cumulative report node) while the
+     * intermediate plumbing stays reachable only via the node search palette.
+     */
+    onlyPinned?: boolean;
 }
 export declare const WorkflowSettingsSchema: z.ZodObject<{
     onError: z.ZodDefault<z.ZodEnum<["stop", "continue"]>>;
@@ -164,6 +183,8 @@ export interface WorkflowConfig {
     settings?: WorkflowSettings;
     /** Optional documentation groups referenced by step `groupId`. */
     groups?: StepGroup[];
+    /** Optional presentational preferences for the execution viewer (no effect on execution). */
+    display?: WorkflowDisplay;
     /**
      * Author-time variables — fixed values (scalars, JSON, uploaded documents)
      * defined once here and referenced by steps as `{{vars.<key>}}`. The same for

package/dist/types/workflow-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-config.d.ts","sourceRoot":"","sources":["../../src/types/workflow-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAKxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAQ/D;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,CAAC,CAAC,UAAU,EAChD,KAAK,EAAE,CAAC,GACP,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAM9B;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,CAAC,CAAC,UAAU,GACnB,CAAC,CAAC,UAAU,GAAG,IAAI,CAWrB;AAID,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,SAAS,GACjB,aAAa,GACb;IAAE,GAAG,EAAE,SAAS,EAAE,CAAA;CAAE,GACpB;IAAE,GAAG,EAAE,SAAS,EAAE,CAAA;CAAE,CAAC;AAEzB,eAAO,MAAM,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAIvD,CAAC;AAEH,eAAO,MAAM,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAMhD,CAAC;AAIF;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,QAAQ,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB,sEAAsE;IACtE,GAAG,EAAE,MAAM,CAAC;IACZ,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC7C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,2CAA2C;IAC3C,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACjC;AAED,MAAM,WAAW,qBAAsB,SAAQ,cAAc;IAC3D,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,eAAe,CAAC,WAAW,CAAC;IAClC,MAAM,EAAE;QACN,SAAS,EAAE,SAAS,CAAC;QACrB,OAAO,EAAE,kBAAkB,EAAE,CAAC;QAC9B,QAAQ,CAAC,EAAE,kBAAkB,EAAE,CAAC;KACjC,CAAC;IACF,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACjC;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,SAAS,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,kBAAkB,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC;IAC7B,MAAM,EAAE;QACN;;;WAGG;QACH,KAAK,EAAE,eAAe,EAAE,CAAC;QACzB;;;WAGG;QACH,OAAO,EAAE,kBAAkB,EAAE,CAAC;KAC/B,CAAC;IACF,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACjC;AAED,MAAM,MAAM,kBAAkB,GAC1B,gBAAgB,GAChB,qBAAqB,GACrB,gBAAgB,CAAC;AAIrB;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAID,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;EAQjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAItE;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE;QACP,IAAI,EAAE,WAAW,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACjC,CAAC;IACF,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kEAAkE;IAClE,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC;IACrB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,gBAAgB,EAAE,CAAC;CAChC;AAID;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,IAAI,EAAE,MAAM,GACX,OAAO,CAcT"}
+{"version":3,"file":"workflow-config.d.ts","sourceRoot":"","sources":["../../src/types/workflow-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAKxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAQ/D;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,CAAC,CAAC,UAAU,EAChD,KAAK,EAAE,CAAC,GACP,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAM9B;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,CAAC,CAAC,UAAU,GACnB,CAAC,CAAC,UAAU,GAAG,IAAI,CAWrB;AAID,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,SAAS,GACjB,aAAa,GACb;IAAE,GAAG,EAAE,SAAS,EAAE,CAAA;CAAE,GACpB;IAAE,GAAG,EAAE,SAAS,EAAE,CAAA;CAAE,CAAC;AAEzB,eAAO,MAAM,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAIvD,CAAC;AAEH,eAAO,MAAM,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAMhD,CAAC;AAIF;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,QAAQ,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB,sEAAsE;IACtE,GAAG,EAAE,MAAM,CAAC;IACZ,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC7C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,2CAA2C;IAC3C,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACjC;AAED,MAAM,WAAW,qBAAsB,SAAQ,cAAc;IAC3D,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,eAAe,CAAC,WAAW,CAAC;IAClC,MAAM,EAAE;QACN,SAAS,EAAE,SAAS,CAAC;QACrB,OAAO,EAAE,kBAAkB,EAAE,CAAC;QAC9B,QAAQ,CAAC,EAAE,kBAAkB,EAAE,CAAC;KACjC,CAAC;IACF,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACjC;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,SAAS,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,kBAAkB,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAiB,SAAQ,cAAc;IACtD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC;IAC7B,MAAM,EAAE;QACN;;;WAGG;QACH,KAAK,EAAE,eAAe,EAAE,CAAC;QACzB;;;WAGG;QACH,OAAO,EAAE,kBAAkB,EAAE,CAAC;KAC/B,CAAC;IACF,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACjC;AAED,MAAM,MAAM,kBAAkB,GAC1B,gBAAgB,GAChB,qBAAqB,GACrB,gBAAgB,CAAC;AAIrB;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;kCACkC;AAClC,MAAM,WAAW,eAAe;IAC9B;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAID,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;EAQjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAItE;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE;QACP,IAAI,EAAE,WAAW,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACjC,CAAC;IACF,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,kEAAkE;IAClE,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC;IACrB,6FAA6F;IAC7F,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,gBAAgB,EAAE,CAAC;CAChC;AAID;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,IAAI,EAAE,MAAM,GACX,OAAO,CAcT"}

package/dist/types/workflow-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflow-config.js","sourceRoot":"","sources":["../../src/types/workflow-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,OAAO,EACL,kBAAkB,EAClB,+BAA+B,GAChC,MAAM,yBAAyB,CAAC;AAGjC,qCAAqC;AAErC,MAAM,uBAAuB,GAAG,CAAC;KAC9B,MAAM,EAAE;KACR,KAAK,CAAC,kBAAkB,EAAE,wCAAwC,CAAC,CAAC;AAEvE;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,KAAQ;IAER,OAAO,CAAC;SACL,KAAK,CAAC,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;SACvC,QAAQ,CACP,GAAG,+BAA+B,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAChD,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAoB;IAEpB,IACE,MAAM,YAAY,CAAC,CAAC,QAAQ;QAC5B,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;QACtC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,+BAA+B,CAAC,EAC9D,CAAC;QACD,MAAM,OAAO,GAAI,MAAmD,CAAC,IAAI;aACtE,OAAO,CAAC;QACX,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC5B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAeD,MAAM,CAAC,MAAM,mBAAmB,GAA6B,CAAC,CAAC,MAAM,CAAC;IACpE,QAAQ,EAAE,uBAAuB;IACjC,QAAQ,EAAE,uBAAuB;IACjC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAyB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAC/D,CAAC,CAAC,KAAK,CAAC;IACN,mBAAmB;IACnB,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;IAC3C,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;CAC5C,CAAC,CACH,CAAC;AAgHF,4BAA4B;AAE5B,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACrD,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;KACvC,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AA+BH,kBAAkB;AAElB;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAgC,EAChC,IAAY;IAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAY,OAAO,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IACE,OAAO,KAAK,IAAI;YAChB,OAAO,KAAK,SAAS;YACrB,OAAO,OAAO,KAAK,QAAQ,EAC3B,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,GAAI,OAAmC,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"workflow-config.js","sourceRoot":"","sources":["../../src/types/workflow-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,OAAO,EACL,kBAAkB,EAClB,+BAA+B,GAChC,MAAM,yBAAyB,CAAC;AAGjC,qCAAqC;AAErC,MAAM,uBAAuB,GAAG,CAAC;KAC9B,MAAM,EAAE;KACR,KAAK,CAAC,kBAAkB,EAAE,wCAAwC,CAAC,CAAC;AAEvE;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,KAAQ;IAER,OAAO,CAAC;SACL,KAAK,CAAC,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;SACvC,QAAQ,CACP,GAAG,+BAA+B,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAChD,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAoB;IAEpB,IACE,MAAM,YAAY,CAAC,CAAC,QAAQ;QAC5B,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;QACtC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,+BAA+B,CAAC,EAC9D,CAAC;QACD,MAAM,OAAO,GAAI,MAAmD,CAAC,IAAI;aACtE,OAAO,CAAC;QACX,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC5B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAeD,MAAM,CAAC,MAAM,mBAAmB,GAA6B,CAAC,CAAC,MAAM,CAAC;IACpE,QAAQ,EAAE,uBAAuB;IACjC,QAAQ,EAAE,uBAAuB;IACjC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAyB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAC/D,CAAC,CAAC,KAAK,CAAC;IACN,mBAAmB;IACnB,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;IAC3C,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;CAC5C,CAAC,CACH,CAAC;AAoIF,4BAA4B;AAE5B,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACrD,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;KACvC,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAiCH,kBAAkB;AAElB;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAgC,EAChC,IAAY;IAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAY,OAAO,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IACE,OAAO,KAAK,IAAI;YAChB,OAAO,KAAK,SAAS;YACrB,OAAO,OAAO,KAAK,QAAQ,EAC3B,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,GAAI,OAAmC,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/util/executable-check.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Executable upload safety check.
+ *
+ * Allow-by-default with a deny-list of known dangerous types — covers the
+ * common attack surface (native binaries, scripts that auto-run, installers,
+ * macro-enabled Office docs) without forcing workflow authors to enumerate
+ * every safe MIME type.
+ *
+ * Two checks run in parallel so spoofed MIME types alone can't bypass:
+ *   1. MIME type matches the deny-list
+ *   2. Filename extension matches the deny-list
+ *
+ * Either match blocks the upload. To accept executables (e.g. a security-
+ * analysis workflow that intentionally examines binaries), the host opts
+ * in via `RuntimeOptions.allowExecutableUploads = true`.
+ */
+/**
+ * MIME types treated as executable / unsafe (lowercase — input is also
+ * lowercased before comparison).
+ */
+export declare const BLOCKED_EXECUTABLE_MIME_TYPES: ReadonlySet<string>;
+/**
+ * File extensions treated as executable / unsafe (case-insensitive, no dot).
+ * The check uses the LAST extension so `report.exe.txt` is treated as text
+ * (Windows shows the trailing extension, which is what the user actually sees).
+ */
+export declare const BLOCKED_EXECUTABLE_EXTENSIONS: ReadonlySet<string>;
+/**
+ * Extract the lowercase extension (no dot) from a filename, or '' if none.
+ * A leading dot doesn't count — `.bashrc` has no extension, not "bashrc".
+ */
+export declare function extensionOf(name: string): string;
+/**
+ * Returns a human-readable reason if the file should be blocked as
+ * executable, or `null` if it's safe.
+ *
+ * Always check both the MIME type and the filename — clients can spoof one
+ * but rarely both. This is defense-in-depth, not authoritative malware
+ * detection (run real AV at the storage layer for that).
+ */
+export declare function isExecutable(mimeType: string, name: string): string | null;
+//# sourceMappingURL=executable-check.d.ts.map

package/dist/util/executable-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executable-check.d.ts","sourceRoot":"","sources":["../../src/util/executable-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;GAGG;AACH,eAAO,MAAM,6BAA6B,EAAE,WAAW,CAAC,MAAM,CAwC5D,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAE,WAAW,CAAC,MAAM,CAmB5D,CAAC;AAEH;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIhD;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS1E"}

package/dist/util/executable-check.js

@@ -0,0 +1,115 @@
+/**
+ * Executable upload safety check.
+ *
+ * Allow-by-default with a deny-list of known dangerous types — covers the
+ * common attack surface (native binaries, scripts that auto-run, installers,
+ * macro-enabled Office docs) without forcing workflow authors to enumerate
+ * every safe MIME type.
+ *
+ * Two checks run in parallel so spoofed MIME types alone can't bypass:
+ *   1. MIME type matches the deny-list
+ *   2. Filename extension matches the deny-list
+ *
+ * Either match blocks the upload. To accept executables (e.g. a security-
+ * analysis workflow that intentionally examines binaries), the host opts
+ * in via `RuntimeOptions.allowExecutableUploads = true`.
+ */
+/**
+ * MIME types treated as executable / unsafe (lowercase — input is also
+ * lowercased before comparison).
+ */
+export const BLOCKED_EXECUTABLE_MIME_TYPES = new Set([
+    // Native binaries
+    'application/x-msdownload',
+    'application/x-msdos-program',
+    'application/x-executable',
+    'application/x-mach-binary',
+    'application/vnd.microsoft.portable-executable',
+    'application/x-msi',
+    'application/x-ms-installer',
+    // Shell + Windows scripts
+    'application/x-sh',
+    'application/x-shellscript',
+    'application/x-bat',
+    'application/x-csh',
+    'application/x-cmd',
+    'application/x-msmetafile',
+    // JavaScript / ECMAScript
+    'text/javascript',
+    'application/javascript',
+    'application/ecmascript',
+    'application/x-javascript',
+    // Java / Flash
+    'application/java-archive',
+    'application/x-java-archive',
+    'application/x-java-jnlp-file',
+    'application/x-shockwave-flash',
+    // Installer / package formats that bundle executables
+    'application/vnd.android.package-archive',
+    'application/x-debian-package',
+    'application/x-rpm',
+    // Macro-enabled Office documents (lowercased — IANA tokens are case-insensitive)
+    'application/vnd.ms-word.document.macroenabled.12',
+    'application/vnd.ms-word.template.macroenabled.12',
+    'application/vnd.ms-excel.sheet.macroenabled.12',
+    'application/vnd.ms-excel.template.macroenabled.12',
+    'application/vnd.ms-excel.addin.macroenabled.12',
+    'application/vnd.ms-excel.sheet.binary.macroenabled.12',
+    'application/vnd.ms-powerpoint.presentation.macroenabled.12',
+    'application/vnd.ms-powerpoint.template.macroenabled.12',
+    'application/vnd.ms-powerpoint.addin.macroenabled.12',
+]);
+/**
+ * File extensions treated as executable / unsafe (case-insensitive, no dot).
+ * The check uses the LAST extension so `report.exe.txt` is treated as text
+ * (Windows shows the trailing extension, which is what the user actually sees).
+ */
+export const BLOCKED_EXECUTABLE_EXTENSIONS = new Set([
+    // Windows
+    'exe', 'msi', 'com', 'scr', 'cmd', 'bat', 'ps1', 'psm1',
+    'vbs', 'vbe', 'wsf', 'wsh', 'hta', 'cpl', 'lnk',
+    'dll', 'sys', 'drv', 'ocx',
+    // macOS / Unix
+    'app', 'dmg', 'pkg',
+    'sh', 'bash', 'zsh', 'fish', 'csh', 'ksh', 'command', 'tool',
+    // Java / Flash
+    'jar', 'war', 'jnlp', 'swf',
+    // Mobile installers
+    'apk', 'ipa', 'xap',
+    // Linux installers
+    'deb', 'rpm', 'run', 'bin',
+    // JavaScript (auto-executes in browser / Node contexts)
+    'js', 'mjs', 'cjs',
+    // Macro-enabled Office
+    'docm', 'dotm', 'xlsm', 'xltm', 'xlam', 'xlsb',
+    'pptm', 'potm', 'ppam', 'ppsm', 'sldm',
+]);
+/**
+ * Extract the lowercase extension (no dot) from a filename, or '' if none.
+ * A leading dot doesn't count — `.bashrc` has no extension, not "bashrc".
+ */
+export function extensionOf(name) {
+    const dot = name.lastIndexOf('.');
+    if (dot <= 0 || dot === name.length - 1)
+        return '';
+    return name.slice(dot + 1).toLowerCase();
+}
+/**
+ * Returns a human-readable reason if the file should be blocked as
+ * executable, or `null` if it's safe.
+ *
+ * Always check both the MIME type and the filename — clients can spoof one
+ * but rarely both. This is defense-in-depth, not authoritative malware
+ * detection (run real AV at the storage layer for that).
+ */
+export function isExecutable(mimeType, name) {
+    if (BLOCKED_EXECUTABLE_MIME_TYPES.has(mimeType.toLowerCase())) {
+        return `Executable MIME type "${mimeType}" is not allowed.`;
+    }
+    const ext = extensionOf(name);
+    if (ext && BLOCKED_EXECUTABLE_EXTENSIONS.has(ext)) {
+        return `Files with .${ext} extension are not allowed.`;
+    }
+    return null;
+}
+//# sourceMappingURL=executable-check.js.map

package/dist/util/executable-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executable-check.js","sourceRoot":"","sources":["../../src/util/executable-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwB,IAAI,GAAG,CAAC;IACxE,kBAAkB;IAClB,0BAA0B;IAC1B,6BAA6B;IAC7B,0BAA0B;IAC1B,2BAA2B;IAC3B,+CAA+C;IAC/C,mBAAmB;IACnB,4BAA4B;IAC5B,0BAA0B;IAC1B,kBAAkB;IAClB,2BAA2B;IAC3B,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,0BAA0B;IAC1B,0BAA0B;IAC1B,iBAAiB;IACjB,wBAAwB;IACxB,wBAAwB;IACxB,0BAA0B;IAC1B,eAAe;IACf,0BAA0B;IAC1B,4BAA4B;IAC5B,8BAA8B;IAC9B,+BAA+B;IAC/B,sDAAsD;IACtD,yCAAyC;IACzC,8BAA8B;IAC9B,mBAAmB;IACnB,iFAAiF;IACjF,kDAAkD;IAClD,kDAAkD;IAClD,gDAAgD;IAChD,mDAAmD;IACnD,gDAAgD;IAChD,uDAAuD;IACvD,4DAA4D;IAC5D,wDAAwD;IACxD,qDAAqD;CACtD,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwB,IAAI,GAAG,CAAC;IACxE,UAAU;IACV,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;IACvD,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;IAC/C,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;IAC1B,eAAe;IACf,KAAK,EAAE,KAAK,EAAE,KAAK;IACnB,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM;IAC5D,eAAe;IACf,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK;IAC3B,oBAAoB;IACpB,KAAK,EAAE,KAAK,EAAE,KAAK;IACnB,mBAAmB;IACnB,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;IAC1B,wDAAwD;IACxD,IAAI,EAAE,KAAK,EAAE,KAAK;IAClB,uBAAuB;IACvB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC9C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CACvC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,IAAY;IACzD,IAAI,6BAA6B,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC9D,OAAO,yBAAyB,QAAQ,mBAAmB,CAAC;IAC9D,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,GAAG,IAAI,6BAA6B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,eAAe,GAAG,6BAA6B,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xyne/workflow-sdk",
-  "version": "3.2.28",
+  "version": "3.2.31",
   "description": "Workflow engine SDK — steps, triggers, executor, agents, and a framework-agnostic HTTP router.",
   "license": "UNLICENSED",
   "repository": {

package/dist/authz/principal-field.d.ts

@@ -1,23 +0,0 @@
-/**
- * Schema-authoring helpers for principal-reference fields (approval `assignee`,
- * access grants). A field marked with one of these formats is rendered by the
- * UI's host-supplied `PrincipalPicker` slot; the stored value is an opaque
- * `{ kind, id }` reference the authorizer resolves. The SDK never interprets it.
- */
-/**
- * JSON Schema `format` marker for a principal reference. Whether the field holds
- * one principal or a list is the field's own `type` (`object` vs `array`) — the
- * builder derives multi-select from that, so a single format marker suffices.
- */
-export declare const PRINCIPAL_FORMAT = "principal";
-/**
- * Stamp `format: 'principal'` onto the named properties of a config JSON Schema,
- * so the builder renders the host's `PrincipalPicker` for them. Works for both
- * single (`type: 'object'`) and list (`type: 'array'`) fields — the author
- * declares the type; this only adds the marker.
- *
- * Mirrors {@link markAttachmentFields}. Use it in a step's
- * `decorateConfigSchema` for its `assignee`-style fields.
- */
-export declare function markPrincipalFields(jsonSchema: Record<string, unknown>, fields: readonly string[]): Record<string, unknown>;
-//# sourceMappingURL=principal-field.d.ts.map

package/dist/authz/principal-field.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"principal-field.d.ts","sourceRoot":"","sources":["../../src/authz/principal-field.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAE5C;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,MAAM,EAAE,SAAS,MAAM,EAAE,GACxB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWzB"}

package/dist/authz/principal-field.js

@@ -1,34 +0,0 @@
-/**
- * Schema-authoring helpers for principal-reference fields (approval `assignee`,
- * access grants). A field marked with one of these formats is rendered by the
- * UI's host-supplied `PrincipalPicker` slot; the stored value is an opaque
- * `{ kind, id }` reference the authorizer resolves. The SDK never interprets it.
- */
-/**
- * JSON Schema `format` marker for a principal reference. Whether the field holds
- * one principal or a list is the field's own `type` (`object` vs `array`) — the
- * builder derives multi-select from that, so a single format marker suffices.
- */
-export const PRINCIPAL_FORMAT = 'principal';
-/**
- * Stamp `format: 'principal'` onto the named properties of a config JSON Schema,
- * so the builder renders the host's `PrincipalPicker` for them. Works for both
- * single (`type: 'object'`) and list (`type: 'array'`) fields — the author
- * declares the type; this only adds the marker.
- *
- * Mirrors {@link markAttachmentFields}. Use it in a step's
- * `decorateConfigSchema` for its `assignee`-style fields.
- */
-export function markPrincipalFields(jsonSchema, fields) {
-    const props = jsonSchema['properties'];
-    if (!props)
-        return jsonSchema;
-    for (const field of fields) {
-        const prop = props[field];
-        if (!prop)
-            continue;
-        props[field] = { ...prop, format: PRINCIPAL_FORMAT };
-    }
-    return jsonSchema;
-}
-//# sourceMappingURL=principal-field.js.map

package/dist/authz/principal-field.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"principal-field.js","sourceRoot":"","sources":["../../src/authz/principal-field.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAE5C;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAmC,EACnC,MAAyB;IAEzB,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAExB,CAAC;IACd,IAAI,CAAC,KAAK;QAAE,OAAO,UAAU,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}