@xyne/workflow-sdk 3.2.29 → 3.2.32

package/dist/common/citation-ref.js

@@ -141,40 +141,53 @@ export const CitationRefSchema = z.discriminatedUnion('kind', [
     DerivedCitationSchema,
 ]);
 /**
- * The path segments under a step's output where a cited agent puts its answer:
- * `…output.response.value`, with the citation mirror as its sibling
- * `…output.response.citation`.
- *
- * Defined HERE, beside the schema that produces the shape, and imported by the
- * consumer that navigates it. The two used to agree only by coincidence — a
- * string literal in the UI matching what the agent step happened to emit — so a
- * rename would have broken resolution silently at runtime. Now it breaks the
- * build instead.
+ * The canonical (agent) cited-value shape and, above all, its DEPTH: a cited
+ * `{ value, citation }` pair sits directly inside a step's output envelope —
+ * `output.<envelope>.value`, three segments — with the citation mirror as its
+ * sibling `output.<envelope>.citation`.
+ *
+ * `'response'` is only the agent's envelope word; {@link splitCitedRef} matches
+ * the *shape*, not the word, so any executor's envelope qualifies (see there). The
+ * constant is retained for its LENGTH — the envelope depth every consumer floors
+ * or slices against — and as the canonical example of the shape.
  */
 export const CITED_VALUE_SEGMENTS = ['output', 'response', 'value'];
 /**
- * Split a ref at the boundary between "which cited response" and "which field
- * inside it": `a.b.output.response.value.x.y` → `{ base:'a.b', field:['x','y'] }`.
- *
- * The invariant this expresses is *relative* — a citation mirror is always the
- * value's sibling, at whatever depth the value sits. Earlier code encoded it as an
- * absolute pattern (`steps.<id>.output.response.value`), which silently stopped
- * matching the moment a step lived inside a PARALLEL and its output moved to
- * `steps.<container>.output.branches.<b>.steps.<id>.output.…`. Matching the
- * boundary wherever it occurs keeps this working at any nesting depth, so no
- * future control-flow shape can break it.
- *
- * Matched segment-wise rather than by substring, so a field genuinely named
- * `valueX` — or any path that merely contains these words — cannot false-match.
- * The LAST occurrence wins: with nesting, the innermost cited response is the one
- * that owns the field.
+ * Split a ref at the boundary between "which cited value" and "which field inside
+ * it": `a.b.output.result.value.x.y` → `{ base:'a.b', envelope:'result', field:['x','y'] }`.
+ *
+ * Two invariants, both *relative* so no control-flow shape can break them:
+ *
+ * 1. A citation mirror is always the value's sibling, at whatever depth the value
+ *    sits. Encoding this as an absolute pattern (`steps.<id>.output.response.value`)
+ *    silently stopped matching the moment a step lived inside a PARALLEL, whose
+ *    output moved to `steps.<container>.output.branches.<b>.steps.<id>.output.…`.
+ *
+ * 2. The envelope word is the PRODUCING EXECUTOR's, not a fixed literal: a
+ *    RUN_AGENT emits `output.response.value`, a CODE step (e.g. a merge that
+ *    returns `{ value, citation }`) emits `output.result.value`, and a future
+ *    executor may emit another word. So we match the SHAPE — `output.<one
+ *    segment>.value` — and report which envelope was found. Whitelisting words
+ *    (`response`, then `result`, then …) would be an endless list; keying on the
+ *    pair is the actual convention.
+ *
+ * Anchoring on `output` (rather than a bare `.value`) keeps a data field genuinely
+ * named `value` from matching. The real gate, though, is the caller: it looks up
+ * the sibling `output.<envelope>.citation` and bails when it does not resolve — so
+ * a value that isn't a cited pair self-rejects, wildcard envelope notwithstanding.
+ *
+ * Matched segment-wise, never by substring, so `valueX` cannot false-match. The
+ * LAST occurrence wins: with nesting, the innermost cited value owns the field.
  */
 export function splitCitedRef(ref) {
     const s = ref.split('.');
-    const [a, b, c] = CITED_VALUE_SEGMENTS;
     for (let i = s.length - CITED_VALUE_SEGMENTS.length; i >= 0; i--) {
-        if (s[i] === a && s[i + 1] === b && s[i + 2] === c) {
-            return { base: s.slice(0, i).join('.'), field: s.slice(i + CITED_VALUE_SEGMENTS.length) };
+        if (s[i] === 'output' && s[i + 2] === 'value') {
+            return {
+                base: s.slice(0, i).join('.'),
+                envelope: s[i + 1],
+                field: s.slice(i + CITED_VALUE_SEGMENTS.length),
+            };
         }
     }
     return undefined;

package/dist/common/citation-ref.js.map

@@ -1 +1 @@
-{"version":3,"file":"citation-ref.js","sourceRoot":"","sources":["../../src/common/citation-ref.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE;IACtD,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC;KAC3D,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;QAC9E,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,kDAAkD,CAAC;QAClF,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,8BAA8B,CAAC;KAChF,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACrD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;KACnE,CAAC;CACH,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACtB,gFAAgF;IAChF,6EAA6E;IAC7E,+EAA+E;IAC/E,EAAE;IACF,8EAA8E;IAC9E,2EAA2E;IAC3E,8EAA8E;IAC9E,4EAA4E;IAC5E,qDAAqD;IACrD,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,QAAQ,CAAC,oEAAoE,CAAC;IACjF,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;IACrF,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,wDAAwD,CAAC;IACrE,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,uDAAuD,CAAC;CACrE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IAC1D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;IACxE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;CACnF,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1B,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,yEAAyE;UACvE,0EAA0E;UAC1E,0BAA0B,CAC7B;IACH,+EAA+E;IAC/E,6EAA6E;IAC7E,gFAAgF;IAChF,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,EAAE,CAAC;SACN,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC;SAC3E,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,oEAAoE,CAAC;IACjF,sEAAsE;IACtE,oFAAoF;IACpF,6EAA6E;IAC7E,+EAA+E;IAC/E,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,wEAAwE;UACtE,yEAAyE,CAC5E;CACJ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC5D,iBAAiB;IACjB,iBAAiB;IACjB,qBAAqB;CACtB,CAAC,CAAC;AAqBH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAU,CAAC;AAE7E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,oBAAoB,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,oBAAoB,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACjE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACnD,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5F,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAA4B;IAC/D,KAAK,EAAE;QACL,qBAAqB,CAAC,iBAAiB,CAAC;QACxC,qBAAqB,CAAC,iBAAiB,CAAC;QACxC,qBAAqB,CAAC,qBAAqB,CAAC;KAC7C;CACF,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK;QAAE,OAAO,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC;IAC7D,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK;QAAE,OAAO,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC;IAC7D,gFAAgF;IAChF,gFAAgF;IAChF,yDAAyD;IACzD,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAU,CAAC"}
+{"version":3,"file":"citation-ref.js","sourceRoot":"","sources":["../../src/common/citation-ref.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE;IACtD,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC;KAC3D,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uCAAuC,CAAC;QAC9E,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,kDAAkD,CAAC;QAClF,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,8BAA8B,CAAC;KAChF,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACrD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;KACnE,CAAC;CACH,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACtB,gFAAgF;IAChF,6EAA6E;IAC7E,+EAA+E;IAC/E,EAAE;IACF,8EAA8E;IAC9E,2EAA2E;IAC3E,8EAA8E;IAC9E,4EAA4E;IAC5E,qDAAqD;IACrD,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,QAAQ,CAAC,oEAAoE,CAAC;IACjF,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;IACrF,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,wDAAwD,CAAC;IACrE,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,uDAAuD,CAAC;CACrE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;IAC1D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;IACxE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;CACnF,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1B,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,yEAAyE;UACvE,0EAA0E;UAC1E,0BAA0B,CAC7B;IACH,+EAA+E;IAC/E,6EAA6E;IAC7E,gFAAgF;IAChF,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,EAAE,CAAC;SACN,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC;SAC3E,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,oEAAoE,CAAC;IACjF,sEAAsE;IACtE,oFAAoF;IACpF,6EAA6E;IAC7E,+EAA+E;IAC/E,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,wEAAwE;UACtE,yEAAyE,CAC5E;CACJ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC5D,iBAAiB;IACjB,iBAAiB;IACjB,qBAAqB;CACtB,CAAC,CAAC;AAqBH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAU,CAAC;AAE7E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAW;IAEX,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,oBAAoB,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACjE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;YAC9C,OAAO;gBACL,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC7B,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAE;gBACnB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,oBAAoB,CAAC,MAAM,CAAC;aAChD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAA4B;IAC/D,KAAK,EAAE;QACL,qBAAqB,CAAC,iBAAiB,CAAC;QACxC,qBAAqB,CAAC,iBAAiB,CAAC;QACxC,qBAAqB,CAAC,qBAAqB,CAAC;KAC7C;CACF,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK;QAAE,OAAO,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC;IAC7D,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK;QAAE,OAAO,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC;IAC7D,gFAAgF;IAChF,gFAAgF;IAChF,yDAAyD;IACzD,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAU,CAAC"}

package/dist/common/credentials.d.ts

@@ -0,0 +1,258 @@
+import { z } from 'zod';
+import type { Action } from '../authz/types.js';
+import type { ResourceAttributes } from '../authz/attributes.js';
+export declare const CredentialStatusSchema: z.ZodEnum<["ACTIVE", "REVOKED"]>;
+export type CredentialStatus = z.infer<typeof CredentialStatusSchema>;
+export type CredentialFieldControl = 'password' | 'text' | 'url';
+export interface CredentialRegistryInputField {
+    readonly key: string;
+    readonly label: string;
+    readonly control: CredentialFieldControl;
+    /** Optional example hint shown as the input's placeholder. */
+    readonly placeholder?: string;
+}
+export type CredentialRegistryEntryField = CredentialRegistryInputField;
+interface CredentialRegistryEntryBase {
+    readonly label: string;
+    readonly fields: readonly CredentialRegistryEntryField[];
+}
+/**
+ * Bearer token values.
+ *
+ * Runtime: `Authorization: Bearer <token>` is added to the request.
+ */
+export declare const BearerValuesSchema: z.ZodObject<{
+    token: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    token: string;
+}, {
+    token: string;
+}>;
+export type BearerValues = z.infer<typeof BearerValuesSchema>;
+/**
+ * HTTP Basic authentication values.
+ *
+ * Runtime: `Authorization: Basic base64(username:password)` is added.
+ */
+export declare const BasicValuesSchema: z.ZodObject<{
+    username: z.ZodString;
+    password: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    password: string;
+    username: string;
+}, {
+    password: string;
+    username: string;
+}>;
+export type BasicValues = z.infer<typeof BasicValuesSchema>;
+/**
+ * Custom header values.
+ *
+ * Runtime: a single header `<name>: <value>` is added to the request.
+ */
+export declare const CustomHeaderValuesSchema: z.ZodObject<{
+    name: z.ZodString;
+    value: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    value: string;
+    name: string;
+}, {
+    value: string;
+    name: string;
+}>;
+export type CustomHeaderValues = z.infer<typeof CustomHeaderValuesSchema>;
+/**
+ * OAuth 2.0 client credentials values.
+ */
+export declare const OAuth2ClientCredentialsValuesSchema: z.ZodObject<{
+    tokenUrl: z.ZodString;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    tokenUrl: string;
+    clientId: string;
+    clientSecret: string;
+}, {
+    tokenUrl: string;
+    clientId: string;
+    clientSecret: string;
+}>;
+export type OAuth2ClientCredentialsValues = z.infer<typeof OAuth2ClientCredentialsValuesSchema>;
+/**
+ * Credential authentication is discriminated by `authType`, keeping each
+ * authentication type paired with its exact values shape.
+ */
+export declare const CredentialAuthSchema: z.ZodDiscriminatedUnion<"authType", [z.ZodObject<{
+    authType: z.ZodLiteral<"bearer">;
+    values: z.ZodObject<{
+        token: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        token: string;
+    }, {
+        token: string;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    values: {
+        token: string;
+    };
+    authType: "bearer";
+}, {
+    values: {
+        token: string;
+    };
+    authType: "bearer";
+}>, z.ZodObject<{
+    authType: z.ZodLiteral<"basic">;
+    values: z.ZodObject<{
+        username: z.ZodString;
+        password: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        password: string;
+        username: string;
+    }, {
+        password: string;
+        username: string;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    values: {
+        password: string;
+        username: string;
+    };
+    authType: "basic";
+}, {
+    values: {
+        password: string;
+        username: string;
+    };
+    authType: "basic";
+}>, z.ZodObject<{
+    authType: z.ZodLiteral<"custom_header">;
+    values: z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        value: string;
+        name: string;
+    }, {
+        value: string;
+        name: string;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    values: {
+        value: string;
+        name: string;
+    };
+    authType: "custom_header";
+}, {
+    values: {
+        value: string;
+        name: string;
+    };
+    authType: "custom_header";
+}>, z.ZodObject<{
+    authType: z.ZodLiteral<"oauth2_client_credentials">;
+    values: z.ZodObject<{
+        tokenUrl: z.ZodString;
+        clientId: z.ZodString;
+        clientSecret: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        tokenUrl: string;
+        clientId: string;
+        clientSecret: string;
+    }, {
+        tokenUrl: string;
+        clientId: string;
+        clientSecret: string;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    values: {
+        tokenUrl: string;
+        clientId: string;
+        clientSecret: string;
+    };
+    authType: "oauth2_client_credentials";
+}, {
+    values: {
+        tokenUrl: string;
+        clientId: string;
+        clientSecret: string;
+    };
+    authType: "oauth2_client_credentials";
+}>]>;
+export type CredentialAuth = z.infer<typeof CredentialAuthSchema>;
+export type CredentialAuthType = CredentialAuth['authType'];
+export type AuthSpecificValues = CredentialAuth['values'];
+/**
+ * Per-auth-type value schemas, extracted from the discriminated union.
+ */
+export declare const CREDENTIAL_VALUE_SCHEMAS: Record<CredentialAuthType, z.ZodTypeAny>;
+export declare function validateCredentialAuth(authType: CredentialAuthType, values: unknown): CredentialAuth;
+export declare function validateCredentialValues(authType: CredentialAuthType, values: unknown): AuthSpecificValues;
+export declare const CredentialNameSchema: z.ZodString;
+export interface CredentialSummary {
+    readonly name: string;
+    readonly authType: CredentialAuthType;
+    readonly status: CredentialStatus;
+    readonly createdAt: number;
+    readonly updatedAt: number;
+}
+export type ResolvedCredential = Readonly<{
+    name: string;
+    status: CredentialStatus;
+}> & Readonly<CredentialAuth>;
+/**
+ * Apply an already-resolved credential to HTTP request headers.
+ *
+ * Credential resolution belongs to the executor/runtime. This shared helper
+ * only translates the validated credential value into its HTTP representation,
+ * so workflow steps and server-side credential testing use identical logic.
+ */
+export declare function applyResolvedCredentialAuth(headers: Headers, credential: ResolvedCredential): void;
+export type CreateCredentialInput = Readonly<{
+    name: string;
+}> & Readonly<CredentialAuth>;
+export interface ReplaceCredentialValuesInput {
+    readonly values: AuthSpecificValues;
+}
+/**
+ * One safe credential row returned by list operations.
+ *
+ * `summary` is the SDK-owned credential shape. `attributes` is the host-owned,
+ * typed metadata carried opaquely by the SDK. `permittedActions` is projected
+ * by the runtime so UIs can gate row actions without knowing host policy.
+ */
+export interface CredentialListItem {
+    readonly summary: CredentialSummary;
+    readonly attributes?: ResourceAttributes<'credential'>;
+    readonly permittedActions?: readonly Action[];
+}
+export interface CredentialListResponse {
+    readonly credentials: CredentialListItem[];
+}
+/** Safe request shape for testing a stored credential against an HTTP endpoint. */
+export interface TestCredentialInput {
+    readonly url: string;
+    readonly method?: string;
+    readonly headers?: Record<string, string>;
+    readonly body?: string;
+}
+/** Redacted result of a server-side credential test. Secret values are never returned. */
+export interface TestCredentialResult {
+    readonly ok: boolean;
+    readonly status?: number;
+    readonly statusText?: string;
+    readonly durationMs?: number;
+    readonly headers?: Record<string, string>;
+    readonly bodyText?: string;
+    readonly error?: string;
+}
+export interface CredentialRegistryEntry extends CredentialRegistryEntryBase {
+    readonly type: CredentialAuthType;
+}
+/**
+ * Minimal registry for host-rendered credential forms. Entries and field keys
+ * are extracted from CredentialAuthSchema; Zod remains the source of truth.
+ */
+export declare const CREDENTIAL_AUTH_REGISTRY: readonly CredentialRegistryEntry[];
+export {};
+//# sourceMappingURL=credentials.d.ts.map

package/dist/common/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/common/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,eAAO,MAAM,sBAAsB,kCAAgC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,MAAM,GAAG,KAAK,CAAC;AAEjE,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;IACzC,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,4BAA4B,GAAG,4BAA4B,CAAC;AAExE,UAAU,2BAA2B;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,SAAS,4BAA4B,EAAE,CAAC;CAC1D;AAgBD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;;EAOpB,CAAC;AAEZ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;EAWnB,CAAC;AAEZ,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;EAa1B,CAAC;AAEZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;GAEG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;;;;;EAerC,CAAC;AAEZ,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CACjD,OAAO,mCAAmC,CAC3C,CAAC;AAkCF;;;GAGG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAK/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,kBAAkB,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;AAC5D,MAAM,MAAM,kBAAkB,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;AAE1D;;GAEG;AACH,eAAO,MAAM,wBAAwB,EAKrB,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;AAEzD,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,kBAAkB,EAC5B,MAAM,EAAE,OAAO,GACd,cAAc,CAEhB;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,kBAAkB,EAC5B,MAAM,EAAE,OAAO,GACd,kBAAkB,CAEpB;AAED,eAAO,MAAM,oBAAoB,aAA6B,CAAC;AAE/D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,gBAAgB,CAAC;CAC1B,CAAC,GACA,QAAQ,CAAC,cAAc,CAAC,CAAC;AAE3B;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,kBAAkB,GAC7B,IAAI,CAuBN;AAED,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GAC5D,QAAQ,CAAC,cAAc,CAAC,CAAC;AAE3B,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;CACrC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC;IACvD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,EAAE,kBAAkB,EAAE,CAAC;CAC5C;AAED,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,0FAA0F;AAC1F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,uBAAwB,SAAQ,2BAA2B;IAC1E,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;CACnC;AAcD;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,uBAAuB,EAKlE,CAAC"}

package/dist/common/credentials.js

@@ -0,0 +1,176 @@
+import { z } from 'zod';
+export const CredentialStatusSchema = z.enum(['ACTIVE', 'REVOKED']);
+const credentialFieldMetadata = new WeakMap();
+function credentialField(schema, metadata) {
+    const describedSchema = schema.describe(metadata.label);
+    credentialFieldMetadata.set(describedSchema, metadata);
+    return describedSchema;
+}
+/**
+ * Bearer token values.
+ *
+ * Runtime: `Authorization: Bearer <token>` is added to the request.
+ */
+export const BearerValuesSchema = z
+    .object({
+    token: credentialField(z.string().min(1), {
+        label: 'Token',
+        control: 'password',
+    }),
+})
+    .strict();
+/**
+ * HTTP Basic authentication values.
+ *
+ * Runtime: `Authorization: Basic base64(username:password)` is added.
+ */
+export const BasicValuesSchema = z
+    .object({
+    username: credentialField(z.string().min(1), {
+        label: 'Username',
+        control: 'text',
+    }),
+    password: credentialField(z.string().min(1), {
+        label: 'Password',
+        control: 'password',
+    }),
+})
+    .strict();
+/**
+ * Custom header values.
+ *
+ * Runtime: a single header `<name>: <value>` is added to the request.
+ */
+export const CustomHeaderValuesSchema = z
+    .object({
+    name: credentialField(z.string().min(1), {
+        label: 'Header name',
+        control: 'text',
+        placeholder: 'e.g. X-Custom-Token',
+    }),
+    value: credentialField(z.string().min(1), {
+        label: 'Header value',
+        control: 'password',
+        placeholder: 'The header value to send',
+    }),
+})
+    .strict();
+/**
+ * OAuth 2.0 client credentials values.
+ */
+export const OAuth2ClientCredentialsValuesSchema = z
+    .object({
+    tokenUrl: credentialField(z.string().url(), {
+        label: 'Token URL',
+        control: 'url',
+    }),
+    clientId: credentialField(z.string().min(1), {
+        label: 'Client ID',
+        control: 'text',
+    }),
+    clientSecret: credentialField(z.string().min(1), {
+        label: 'Client Secret',
+        control: 'password',
+    }),
+})
+    .strict();
+const BearerCredentialAuthSchema = z
+    .object({
+    authType: z.literal('bearer'),
+    values: BearerValuesSchema,
+})
+    .strict()
+    .describe('Bearer Token');
+const BasicCredentialAuthSchema = z
+    .object({
+    authType: z.literal('basic'),
+    values: BasicValuesSchema,
+})
+    .strict()
+    .describe('Basic Auth');
+const CustomHeaderCredentialAuthSchema = z
+    .object({
+    authType: z.literal('custom_header'),
+    values: CustomHeaderValuesSchema,
+})
+    .strict()
+    .describe('Custom Header');
+const OAuth2ClientCredentialsCredentialAuthSchema = z
+    .object({
+    authType: z.literal('oauth2_client_credentials'),
+    values: OAuth2ClientCredentialsValuesSchema,
+})
+    .strict()
+    .describe('OAuth 2.0 Client Credentials');
+/**
+ * Credential authentication is discriminated by `authType`, keeping each
+ * authentication type paired with its exact values shape.
+ */
+export const CredentialAuthSchema = z.discriminatedUnion('authType', [
+    BearerCredentialAuthSchema,
+    BasicCredentialAuthSchema,
+    CustomHeaderCredentialAuthSchema,
+    OAuth2ClientCredentialsCredentialAuthSchema,
+]);
+/**
+ * Per-auth-type value schemas, extracted from the discriminated union.
+ */
+export const CREDENTIAL_VALUE_SCHEMAS = Object.fromEntries(CredentialAuthSchema.options.map((option) => [
+    option.shape.authType.value,
+    option.shape.values,
+]));
+export function validateCredentialAuth(authType, values) {
+    return CredentialAuthSchema.parse({ authType, values });
+}
+export function validateCredentialValues(authType, values) {
+    return validateCredentialAuth(authType, values).values;
+}
+export const CredentialNameSchema = z.string().min(1).max(255);
+/**
+ * Apply an already-resolved credential to HTTP request headers.
+ *
+ * Credential resolution belongs to the executor/runtime. This shared helper
+ * only translates the validated credential value into its HTTP representation,
+ * so workflow steps and server-side credential testing use identical logic.
+ */
+export function applyResolvedCredentialAuth(headers, credential) {
+    switch (credential.authType) {
+        case 'bearer': {
+            const { token } = credential.values;
+            headers.set('authorization', `Bearer ${token}`);
+            break;
+        }
+        case 'basic': {
+            const { username, password } = credential.values;
+            headers.set('authorization', `Basic ${btoa(`${username}:${password}`)}`);
+            break;
+        }
+        case 'custom_header': {
+            const { name, value } = credential.values;
+            headers.set(name, value);
+            break;
+        }
+        case 'oauth2_client_credentials': {
+            throw new Error('oauth2_client_credentials is not yet supported for HTTP requests');
+        }
+    }
+}
+function extractRegistryFields(schema) {
+    return Object.entries(schema.shape).map(([key, fieldSchema]) => {
+        const metadata = credentialFieldMetadata.get(fieldSchema);
+        if (!metadata) {
+            throw new Error(`Credential field "${key}" is missing UI metadata`);
+        }
+        return { key, ...metadata };
+    });
+}
+/**
+ * Minimal registry for host-rendered credential forms. Entries and field keys
+ * are extracted from CredentialAuthSchema; Zod remains the source of truth.
+ */
+export const CREDENTIAL_AUTH_REGISTRY = CredentialAuthSchema.options.map((option) => ({
+    type: option.shape.authType.value,
+    label: option.description ?? option.shape.authType.value,
+    fields: extractRegistryFields(option.shape.values),
+}));
+//# sourceMappingURL=credentials.js.map

package/dist/common/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/common/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAoBpE,MAAM,uBAAuB,GAAG,IAAI,OAAO,EAGxC,CAAC;AAEJ,SAAS,eAAe,CACtB,MAAe,EACf,QAAmD;IAEnD,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,uBAAuB,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IACvD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QACxC,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,UAAU;KACpB,CAAC;CACH,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QAC3C,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,MAAM;KAChB,CAAC;IACF,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QAC3C,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,UAAU;KACpB,CAAC;CACH,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QACvC,KAAK,EAAE,aAAa;QACpB,OAAO,EAAE,MAAM;QACf,WAAW,EAAE,qBAAqB;KACnC,CAAC;IACF,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QACxC,KAAK,EAAE,cAAc;QACrB,OAAO,EAAE,UAAU;QACnB,WAAW,EAAE,0BAA0B;KACxC,CAAC;CACH,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC;KACjD,MAAM,CAAC;IACN,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE;QAC1C,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,KAAK;KACf,CAAC;IACF,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QAC3C,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,MAAM;KAChB,CAAC;IACF,YAAY,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QAC/C,KAAK,EAAE,eAAe;QACtB,OAAO,EAAE,UAAU;KACpB,CAAC;CACH,CAAC;KACD,MAAM,EAAE,CAAC;AAMZ,MAAM,0BAA0B,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC7B,MAAM,EAAE,kBAAkB;CAC3B,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,cAAc,CAAC,CAAC;AAE5B,MAAM,yBAAyB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC5B,MAAM,EAAE,iBAAiB;CAC1B,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,YAAY,CAAC,CAAC;AAE1B,MAAM,gCAAgC,GAAG,CAAC;KACvC,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACpC,MAAM,EAAE,wBAAwB;CACjC,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,eAAe,CAAC,CAAC;AAE7B,MAAM,2CAA2C,GAAG,CAAC;KAClD,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC;IAChD,MAAM,EAAE,mCAAmC;CAC5C,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,8BAA8B,CAAC,CAAC;AAE5C;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE;IACnE,0BAA0B;IAC1B,yBAAyB;IACzB,gCAAgC;IAChC,2CAA2C;CAC5C,CAAC,CAAC;AAMH;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,WAAW,CACxD,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAC3C,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK;IAC3B,MAAM,CAAC,KAAK,CAAC,MAAM;CACpB,CAAC,CACoD,CAAC;AAEzD,MAAM,UAAU,sBAAsB,CACpC,QAA4B,EAC5B,MAAe;IAEf,OAAO,oBAAoB,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,QAA4B,EAC5B,MAAe;IAEf,OAAO,sBAAsB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAgB/D;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAgB,EAChB,UAA8B;IAE9B,QAAQ,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC5B,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;YAChD,MAAM;QACR,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,IAAI,CAAC,GAAG,QAAQ,IAAI,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;YACzE,MAAM;QACR,CAAC;QACD,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACzB,MAAM;QACR,CAAC;QACD,KAAK,2BAA2B,CAAC,CAAC,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAiDD,SAAS,qBAAqB,CAC5B,MAAsB;IAEtB,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,EAAE;QAC7D,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,CAAC,WAA2B,CAAC,CAAC;QAC1E,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,0BAA0B,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GACnC,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK;IACjC,KAAK,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK;IACxD,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;CACnD,CAAC,CAAC,CAAC"}

package/dist/common/expression-eval.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Recomputing an agent's arithmetic, safely.
+ *
+ * A derived value (a growth rate, a ratio, a total) appears **nowhere** in the
+ * source, so there is no passage to quote and no page to open — the only honest
+ * provenance is *these inputs, combined this way*. Given both, the arithmetic
+ * stops being a claim and becomes checkable: the reader is shown a ✓ when the
+ * numbers reproduce and a ⚠ when they don't. LLM arithmetic is the least reliable
+ * step in the pipeline, and this makes it the most verified.
+ *
+ * Inputs are referenced **positionally** (`#1`, `#2`) rather than by name or cell.
+ * That is the security property, not a convenience: the grammar then contains no
+ * identifiers at all, so an expression *cannot* name anything outside the inputs
+ * array. No `eval`, no `Function`, no scope to escape into — the worst a
+ * malformed expression can do is fail to parse.
+ */
+/**
+ * Evaluate `expr` over `inputs`, or `undefined` when it cannot be evaluated
+ * with certainty.
+ *
+ * `undefined` is deliberately indistinguishable between "malformed" and
+ * "unsupported": in either case the UI shows the expression without a verdict.
+ * Showing a wrong ✓ would be worse than showing none.
+ */
+export declare function evaluateExpression(expr: string, inputs: number[]): number | undefined;
+/**
+ * Parse a number out of a cited value as it appears in a document —
+ * `"₹36,816.00"`, `"1 234,5"`, `"(1,200)"` (accounting negative), `"12%"`.
+ *
+ * Needed because an input's value arrives as source text, not a number, and a
+ * verification that only worked on already-clean numbers would rarely fire on
+ * real documents. Returns `undefined` when there is no unambiguous number.
+ */
+export declare function parseNumericValue(value: unknown): number | undefined;
+//# sourceMappingURL=expression-eval.d.ts.map

package/dist/common/expression-eval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"expression-eval.d.ts","sourceRoot":"","sources":["../../src/common/expression-eval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAwHH;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAIrF;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAyCpE"}