anantham-v2 2.0.0-alpha.1

package/dist/workflow/workflow-registry.js

@@ -0,0 +1,157 @@
+import { randomUUID } from "node:crypto";
+import { WorkflowRunSchema, } from "../domain/workflow.js";
+import { EventTypes } from "../domain/event.js";
+import { WorkflowValidator } from "./workflow-validator.js";
+/**
+ * Scoped Workflow Registry & Run Version Pinning Manager.
+ * Resolves workflows with strict precedence: project > profile > global > built-in.
+ * PRD Part 2 Section 111 & 112.
+ */
+export class WorkflowRegistry {
+    workflowRepo;
+    eventStore;
+    validator;
+    constructor(options) {
+        this.workflowRepo = options.workflowRepo;
+        this.eventStore = options.eventStore;
+        this.validator = options.validator ?? new WorkflowValidator();
+    }
+    /**
+     * Register and durably persist a validated workflow definition.
+     */
+    register(workflow) {
+        // 1. Deep Validation
+        const report = this.validator.validate(workflow);
+        if (!report.valid) {
+            return {
+                success: false,
+                validationReport: report,
+                errorMessage: `Workflow validation failed: ${report.errors.join("; ")}`,
+            };
+        }
+        // 2. Durably persist to SQLite
+        this.workflowRepo.saveWorkflow(workflow);
+        // 3. Emit Audit Event
+        if (this.eventStore) {
+            this.eventStore.append({
+                id: randomUUID(),
+                schemaVersion: 1,
+                actor: "system",
+                timestamp: new Date().toISOString(),
+                type: EventTypes.WORKFLOW_REGISTERED,
+                projectId: workflow.projectId,
+                payload: {
+                    workflowId: workflow.id,
+                    name: workflow.name,
+                    version: workflow.version,
+                    scope: workflow.scope,
+                    taskCount: workflow.tasks.length,
+                },
+            });
+        }
+        return {
+            success: true,
+            workflow,
+            validationReport: report,
+        };
+    }
+    /**
+     * Resolves a workflow definition by name and optional version, obeying scope precedence:
+     * project > profile > global > built-in.
+     */
+    resolve(name, options) {
+        const allWorkflows = this.workflowRepo.listWorkflows(options?.projectId);
+        // Filter by name and version if specified
+        const matching = allWorkflows.filter((w) => {
+            if (w.name !== name)
+                return false;
+            if (options?.version && w.version !== options.version)
+                return false;
+            return true;
+        });
+        if (matching.length === 0)
+            return null;
+        // Sort by scope precedence: project (1) > profile (2) > global (3) > built-in (4)
+        const scopeRank = {
+            project: 1,
+            profile: 2,
+            global: 3,
+            "built-in": 4,
+        };
+        matching.sort((a, b) => {
+            const rankA = scopeRank[a.scope] || 99;
+            const rankB = scopeRank[b.scope] || 99;
+            if (rankA !== rankB)
+                return rankA - rankB;
+            // Secondary: higher SemVer
+            return b.version.localeCompare(a.version, undefined, { numeric: true });
+        });
+        return matching[0] ?? null;
+    }
+    /**
+     * Pin active run configuration snapshot.
+     * PRD Part 2 Section 112: "A workflow run must pin workflow version, plugin versions, skill versions, agent versions, model profile."
+     */
+    createPinnedVersions(workflow, environmentContext) {
+        return {
+            workflowVersion: workflow.version,
+            pluginVersions: environmentContext?.pluginVersions ?? {},
+            skillVersions: environmentContext?.skillVersions ?? {},
+            agentVersions: environmentContext?.agentVersions ?? {},
+            modelProfile: environmentContext?.modelProfile,
+        };
+    }
+    /**
+     * Initialize and persist an active workflow run instance.
+     */
+    createWorkflowRun(workflow, sessionId, environmentContext) {
+        const pinned = this.createPinnedVersions(workflow, environmentContext);
+        const now = new Date().toISOString();
+        const run = WorkflowRunSchema.parse({
+            id: `run_${randomUUID()}`,
+            workflowId: workflow.id,
+            projectId: workflow.projectId,
+            sessionId,
+            status: "QUEUED",
+            currentStepIndex: 0,
+            completedTasks: [],
+            failedTasks: [],
+            runningTasks: [],
+            taskResults: {},
+            pinnedVersions: pinned,
+            startedAt: now,
+        });
+        this.workflowRepo.saveWorkflowRun(run);
+        if (this.eventStore) {
+            this.eventStore.append({
+                id: randomUUID(),
+                schemaVersion: 1,
+                actor: "system",
+                timestamp: now,
+                type: EventTypes.WORKFLOW_STARTED,
+                projectId: workflow.projectId,
+                sessionId,
+                payload: {
+                    runId: run.id,
+                    workflowId: workflow.id,
+                    workflowName: workflow.name,
+                    workflowVersion: workflow.version,
+                },
+            });
+        }
+        return run;
+    }
+    /**
+     * Retrieve a workflow by ID.
+     */
+    getById(id) {
+        return this.workflowRepo.findWorkflowById(id);
+    }
+    /**
+     * List all workflows for a project (including global/built-in).
+     */
+    list(projectId) {
+        return this.workflowRepo.listWorkflows(projectId);
+    }
+}
+//# sourceMappingURL=workflow-registry.js.map

package/dist/workflow/workflow-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-registry.js","sourceRoot":"","sources":["../../src/workflow/workflow-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAKL,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGhD,OAAO,EAAE,iBAAiB,EAAiC,MAAM,yBAAyB,CAAC;AAe3F;;;;GAIG;AACH,MAAM,OAAO,gBAAgB;IACV,YAAY,CAAqB;IACjC,UAAU,CAAc;IACxB,SAAS,CAAoB;IAE9C,YAAY,OAAgC;QAC1C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,iBAAiB,EAAE,CAAC;IAChE,CAAC;IAED;;OAEG;IACI,QAAQ,CAAC,QAA4B;QAC1C,qBAAqB;QACrB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,gBAAgB,EAAE,MAAM;gBACxB,YAAY,EAAE,+BAA+B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aACxE,CAAC;QACJ,CAAC;QAED,+BAA+B;QAC/B,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAEzC,sBAAsB;QACtB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;gBACrB,EAAE,EAAE,UAAU,EAAE;gBAChB,aAAa,EAAE,CAAC;gBAChB,KAAK,EAAE,QAAQ;gBACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,IAAI,EAAE,UAAU,CAAC,mBAAmB;gBACpC,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,OAAO,EAAE;oBACP,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;iBACjC;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ;YACR,gBAAgB,EAAE,MAAM;SACzB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,OAAO,CACZ,IAAY,EACZ,OAIC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAEzE,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACzC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YAClC,IAAI,OAAO,EAAE,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO;gBAAE,OAAO,KAAK,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEvC,kFAAkF;QAClF,MAAM,SAAS,GAAkC;YAC/C,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,CAAC;YACT,UAAU,EAAE,CAAC;SACd,CAAC;QAEF,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACrB,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACvC,IAAI,KAAK,KAAK,KAAK;gBAAE,OAAO,KAAK,GAAG,KAAK,CAAC;YAC1C,2BAA2B;YAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACI,oBAAoB,CACzB,QAA4B,EAC5B,kBAKC;QAED,OAAO;YACL,eAAe,EAAE,QAAQ,CAAC,OAAO;YACjC,cAAc,EAAE,kBAAkB,EAAE,cAAc,IAAI,EAAE;YACxD,aAAa,EAAE,kBAAkB,EAAE,aAAa,IAAI,EAAE;YACtD,aAAa,EAAE,kBAAkB,EAAE,aAAa,IAAI,EAAE;YACtD,YAAY,EAAE,kBAAkB,EAAE,YAAY;SAC/C,CAAC;IACJ,CAAC;IAED;;OAEG;IACI,iBAAiB,CACtB,QAA4B,EAC5B,SAAiB,EACjB,kBAKC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAErC,MAAM,GAAG,GAAgB,iBAAiB,CAAC,KAAK,CAAC;YAC/C,EAAE,EAAE,OAAO,UAAU,EAAE,EAAE;YACzB,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,SAAS;YACT,MAAM,EAAE,QAAQ;YAChB,gBAAgB,EAAE,CAAC;YACnB,cAAc,EAAE,EAAE;YAClB,WAAW,EAAE,EAAE;YACf,YAAY,EAAE,EAAE;YAChB,WAAW,EAAE,EAAE;YACf,cAAc,EAAE,MAAM;YACtB,SAAS,EAAE,GAAG;SACf,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QAEvC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;gBACrB,EAAE,EAAE,UAAU,EAAE;gBAChB,aAAa,EAAE,CAAC;gBAChB,KAAK,EAAE,QAAQ;gBACf,SAAS,EAAE,GAAG;gBACd,IAAI,EAAE,UAAU,CAAC,gBAAgB;gBACjC,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,SAAS;gBACT,OAAO,EAAE;oBACP,KAAK,EAAE,GAAG,CAAC,EAAE;oBACb,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,YAAY,EAAE,QAAQ,CAAC,IAAI;oBAC3B,eAAe,EAAE,QAAQ,CAAC,OAAO;iBAClC;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;OAEG;IACI,OAAO,CAAC,EAAU;QACvB,OAAO,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACI,IAAI,CAAC,SAAkB;QAC5B,OAAO,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF"}

package/dist/workflow/workflow-retry-handler.d.ts

@@ -0,0 +1,22 @@
+export type FailureClassification = "POLICY_DENIAL" | "PERMISSION_DENIED" | "INVALID_SCHEMA" | "PERMANENT_CAPABILITY_FAILURE" | "RATE_LIMIT" | "TIMEOUT" | "NETWORK_ERROR" | "TRANSIENT_TOOL_ERROR" | "UNKNOWN";
+export interface WorkflowRetryDecision {
+    shouldRetry: boolean;
+    classification: FailureClassification;
+    backoffMs: number;
+    reason: string;
+}
+/**
+ * Classified Failure & Bounded Retry Decision Handler for Workflows.
+ * PRD Part 2 Section 110 & Playbook Section 14.
+ */
+export declare class WorkflowRetryHandler {
+    /**
+     * Classifies an error into retryable vs non-retryable categories.
+     */
+    classifyError(error: unknown): FailureClassification;
+    /**
+     * Evaluates whether a failed node/task attempt should be retried.
+     */
+    evaluateRetry(error: unknown, currentAttempt: number, maxRetries?: number): WorkflowRetryDecision;
+}
+//# sourceMappingURL=workflow-retry-handler.d.ts.map

package/dist/workflow/workflow-retry-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-retry-handler.d.ts","sourceRoot":"","sources":["../../src/workflow/workflow-retry-handler.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,qBAAqB,GAC7B,eAAe,GACf,mBAAmB,GACnB,gBAAgB,GAChB,8BAA8B,GAC9B,YAAY,GACZ,SAAS,GACT,eAAe,GACf,sBAAsB,GACtB,SAAS,CAAC;AAEd,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,qBAAqB,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,qBAAa,oBAAoB;IAC/B;;OAEG;IACI,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB;IAmC3D;;OAEG;IACI,aAAa,CAClB,KAAK,EAAE,OAAO,EACd,cAAc,EAAE,MAAM,EACtB,UAAU,SAAI,GACb,qBAAqB;CAuCzB"}

package/dist/workflow/workflow-retry-handler.js

@@ -0,0 +1,78 @@
+/**
+ * Classified Failure & Bounded Retry Decision Handler for Workflows.
+ * PRD Part 2 Section 110 & Playbook Section 14.
+ */
+export class WorkflowRetryHandler {
+    /**
+     * Classifies an error into retryable vs non-retryable categories.
+     */
+    classifyError(error) {
+        if (!error)
+            return "UNKNOWN";
+        const msg = (error instanceof Error ? error.message : String(error)).toLowerCase();
+        // 1. Non-Retryable Policy / Security / Schema Denials
+        if (msg.includes("policy denial") || msg.includes("policy denied") || msg.includes("blocked by policy")) {
+            return "POLICY_DENIAL";
+        }
+        if (msg.includes("permission denied") || msg.includes("unauthorized") || msg.includes("forbidden")) {
+            return "PERMISSION_DENIED";
+        }
+        if (msg.includes("invalid schema") || msg.includes("validation error") || msg.includes("zoderror")) {
+            return "INVALID_SCHEMA";
+        }
+        if (msg.includes("unsupported capability") || msg.includes("capability mismatch")) {
+            return "PERMANENT_CAPABILITY_FAILURE";
+        }
+        // 2. Retryable Errors
+        if (msg.includes("rate limit") || msg.includes("429") || msg.includes("too many requests")) {
+            return "RATE_LIMIT";
+        }
+        if (msg.includes("timed out") || msg.includes("timeout") || msg.includes("etimedout")) {
+            return "TIMEOUT";
+        }
+        if (msg.includes("econnreset") || msg.includes("enotfound") || msg.includes("network error") || msg.includes("fetch failed")) {
+            return "NETWORK_ERROR";
+        }
+        if (msg.includes("transient") || msg.includes("busy") || msg.includes("locked")) {
+            return "TRANSIENT_TOOL_ERROR";
+        }
+        return "UNKNOWN";
+    }
+    /**
+     * Evaluates whether a failed node/task attempt should be retried.
+     */
+    evaluateRetry(error, currentAttempt, maxRetries = 3) {
+        const classification = this.classifyError(error);
+        // Non-retryable classes fail closed immediately
+        if (classification === "POLICY_DENIAL" ||
+            classification === "PERMISSION_DENIED" ||
+            classification === "INVALID_SCHEMA" ||
+            classification === "PERMANENT_CAPABILITY_FAILURE") {
+            return {
+                shouldRetry: false,
+                classification,
+                backoffMs: 0,
+                reason: `Failure classification "${classification}" is non-retryable. Failing closed immediately.`,
+            };
+        }
+        // Bounded retries check
+        if (currentAttempt >= maxRetries) {
+            return {
+                shouldRetry: false,
+                classification,
+                backoffMs: 0,
+                reason: `Maximum retry attempts reached (${currentAttempt}/${maxRetries}).`,
+            };
+        }
+        // Compute exponential backoff with base 100ms
+        const baseMs = 100;
+        const backoffMs = Math.min(baseMs * Math.pow(2, currentAttempt), 5000);
+        return {
+            shouldRetry: true,
+            classification,
+            backoffMs,
+            reason: `Transient failure "${classification}". Retrying attempt ${currentAttempt + 1}/${maxRetries} after ${backoffMs}ms backoff.`,
+        };
+    }
+}
+//# sourceMappingURL=workflow-retry-handler.js.map

package/dist/workflow/workflow-retry-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-retry-handler.js","sourceRoot":"","sources":["../../src/workflow/workflow-retry-handler.ts"],"names":[],"mappings":"AAkBA;;;GAGG;AACH,MAAM,OAAO,oBAAoB;IAC/B;;OAEG;IACI,aAAa,CAAC,KAAc;QACjC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,GAAG,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAEnF,sDAAsD;QACtD,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACxG,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACnG,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACnG,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,CAAC,wBAAwB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAClF,OAAO,8BAA8B,CAAC;QACxC,CAAC;QAED,sBAAsB;QACtB,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAC3F,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACtF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC7H,OAAO,eAAe,CAAC;QACzB,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChF,OAAO,sBAAsB,CAAC;QAChC,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACI,aAAa,CAClB,KAAc,EACd,cAAsB,EACtB,UAAU,GAAG,CAAC;QAEd,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAEjD,gDAAgD;QAChD,IACE,cAAc,KAAK,eAAe;YAClC,cAAc,KAAK,mBAAmB;YACtC,cAAc,KAAK,gBAAgB;YACnC,cAAc,KAAK,8BAA8B,EACjD,CAAC;YACD,OAAO;gBACL,WAAW,EAAE,KAAK;gBAClB,cAAc;gBACd,SAAS,EAAE,CAAC;gBACZ,MAAM,EAAE,2BAA2B,cAAc,iDAAiD;aACnG,CAAC;QACJ,CAAC;QAED,wBAAwB;QACxB,IAAI,cAAc,IAAI,UAAU,EAAE,CAAC;YACjC,OAAO;gBACL,WAAW,EAAE,KAAK;gBAClB,cAAc;gBACd,SAAS,EAAE,CAAC;gBACZ,MAAM,EAAE,mCAAmC,cAAc,IAAI,UAAU,IAAI;aAC5E,CAAC;QACJ,CAAC;QAED,8CAA8C;QAC9C,MAAM,MAAM,GAAG,GAAG,CAAC;QACnB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;QAEvE,OAAO;YACL,WAAW,EAAE,IAAI;YACjB,cAAc;YACd,SAAS;YACT,MAAM,EAAE,sBAAsB,cAAc,uBAAuB,cAAc,GAAG,CAAC,IAAI,UAAU,UAAU,SAAS,aAAa;SACpI,CAAC;IACJ,CAAC;CACF"}

package/dist/workflow/workflow-validator.d.ts

@@ -0,0 +1,22 @@
+import { DAGEngine, type DAGValidationResult } from "./dag-engine.js";
+export interface WorkflowValidationReport {
+    valid: boolean;
+    errors: string[];
+    warnings: string[];
+    dagValidation?: DAGValidationResult;
+}
+/**
+ * Deep Workflow Validator & Security Guard.
+ * Enforces structural schema integrity, cycle elimination, path security,
+ * and trust boundary constraints.
+ * PRD Part 2 Section 109, 115, 116.
+ */
+export declare class WorkflowValidator {
+    private readonly dagEngine;
+    constructor(dagEngine?: DAGEngine);
+    /**
+     * Validate a WorkflowDefinition completely.
+     */
+    validate(workflow: unknown): WorkflowValidationReport;
+}
+//# sourceMappingURL=workflow-validator.d.ts.map

package/dist/workflow/workflow-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-validator.d.ts","sourceRoot":"","sources":["../../src/workflow/workflow-validator.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,SAAS,EAAE,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtE,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,aAAa,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAED;;;;;GAKG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;gBAE1B,SAAS,CAAC,EAAE,SAAS;IAIjC;;OAEG;IACI,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,wBAAwB;CA6G7D"}

package/dist/workflow/workflow-validator.js

@@ -0,0 +1,110 @@
+import { WorkflowDefinitionSchema, } from "../domain/workflow.js";
+import { DAGEngine } from "./dag-engine.js";
+/**
+ * Deep Workflow Validator & Security Guard.
+ * Enforces structural schema integrity, cycle elimination, path security,
+ * and trust boundary constraints.
+ * PRD Part 2 Section 109, 115, 116.
+ */
+export class WorkflowValidator {
+    dagEngine;
+    constructor(dagEngine) {
+        this.dagEngine = dagEngine ?? new DAGEngine();
+    }
+    /**
+     * Validate a WorkflowDefinition completely.
+     */
+    validate(workflow) {
+        const errors = [];
+        const warnings = [];
+        // 1. Zod Schema Validation
+        const parsed = WorkflowDefinitionSchema.safeParse(workflow);
+        if (!parsed.success) {
+            for (const issue of parsed.error.issues) {
+                errors.push(`[Schema] ${issue.path.join(".")}: ${issue.message}`);
+            }
+            return { valid: false, errors, warnings };
+        }
+        const def = parsed.data;
+        // 2. DAG & Cycle Validation
+        const dagRes = this.dagEngine.validateDAG(def);
+        if (!dagRes.valid) {
+            errors.push(...dagRes.errors);
+        }
+        // 3. Node-Level Structural & Security Verification
+        const seenNodeIds = new Set();
+        for (const node of def.tasks) {
+            if (seenNodeIds.has(node.id)) {
+                errors.push(`Duplicate node ID "${node.id}".`);
+            }
+            seenNodeIds.add(node.id);
+            switch (node.kind) {
+                case "task": {
+                    // Path traversal security check
+                    for (const file of [...node.targetFiles, ...node.readOnlyFiles]) {
+                        if (file.includes("..") || file.startsWith("/") || /^[a-zA-Z]:\\/.test(file)) {
+                            errors.push(`Security violation: Task "${node.id}" contains unsafe absolute or path traversal path "${file}".`);
+                        }
+                    }
+                    break;
+                }
+                case "parallel": {
+                    if (node.tasks.length === 0) {
+                        errors.push(`Parallel node "${node.id}" must contain at least one task.`);
+                    }
+                    const parallelIds = new Set();
+                    for (const t of node.tasks) {
+                        if (parallelIds.has(t.id)) {
+                            errors.push(`Duplicate sub-task ID "${t.id}" inside parallel node "${node.id}".`);
+                        }
+                        parallelIds.add(t.id);
+                    }
+                    break;
+                }
+                case "foreach": {
+                    if (!node.collection || node.collection.trim() === "") {
+                        errors.push(`Foreach node "${node.id}" must specify a collection.`);
+                    }
+                    if (!node.iteratorVariable || node.iteratorVariable.trim() === "") {
+                        errors.push(`Foreach node "${node.id}" must specify an iterator variable.`);
+                    }
+                    break;
+                }
+                case "verify": {
+                    if (node.assertions.length === 0) {
+                        errors.push(`Verify node "${node.id}" must contain at least one assertion.`);
+                    }
+                    break;
+                }
+                case "approve": {
+                    if (!node.message || node.message.trim() === "") {
+                        errors.push(`Approve node "${node.id}" must specify an approval message.`);
+                    }
+                    break;
+                }
+            }
+        }
+        // 4. Budget & Concurrency Sanity Checks
+        if (def.concurrency.maxAgents <= 0) {
+            errors.push(`concurrency.maxAgents must be greater than 0.`);
+        }
+        if (def.concurrency.maxParallelTasks <= 0) {
+            errors.push(`concurrency.maxParallelTasks must be greater than 0.`);
+        }
+        if (def.budget) {
+            if (def.budget.maxTokens && def.budget.maxTokens <= 0) {
+                errors.push(`budget.maxTokens must be positive.`);
+            }
+            if (def.budget.maxCostUsd && def.budget.maxCostUsd <= 0) {
+                errors.push(`budget.maxCostUsd must be positive.`);
+            }
+        }
+        return {
+            valid: errors.length === 0,
+            errors,
+            warnings,
+            dagValidation: dagRes,
+        };
+    }
+}
+//# sourceMappingURL=workflow-validator.js.map

package/dist/workflow/workflow-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-validator.js","sourceRoot":"","sources":["../../src/workflow/workflow-validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,SAAS,EAA4B,MAAM,iBAAiB,CAAC;AAStE;;;;;GAKG;AACH,MAAM,OAAO,iBAAiB;IACX,SAAS,CAAY;IAEtC,YAAY,SAAqB;QAC/B,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,IAAI,SAAS,EAAE,CAAC;IAChD,CAAC;IAED;;OAEG;IACI,QAAQ,CAAC,QAAiB;QAC/B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,2BAA2B;QAC3B,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC5C,CAAC;QAED,MAAM,GAAG,GAAuB,MAAM,CAAC,IAAI,CAAC;QAE5C,4BAA4B;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAED,mDAAmD;QACnD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QAEtC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC7B,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;YACjD,CAAC;YACD,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAEzB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;gBAClB,KAAK,MAAM,CAAC,CAAC,CAAC;oBACZ,gCAAgC;oBAChC,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;wBAChE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;4BAC7E,MAAM,CAAC,IAAI,CACT,6BAA6B,IAAI,CAAC,EAAE,sDAAsD,IAAI,IAAI,CACnG,CAAC;wBACJ,CAAC;oBACH,CAAC;oBACD,MAAM;gBACR,CAAC;gBAED,KAAK,UAAU,CAAC,CAAC,CAAC;oBAChB,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBAC5B,MAAM,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,EAAE,mCAAmC,CAAC,CAAC;oBAC5E,CAAC;oBACD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;oBACtC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;wBAC3B,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;4BAC1B,MAAM,CAAC,IAAI,CACT,0BAA0B,CAAC,CAAC,EAAE,2BAA2B,IAAI,CAAC,EAAE,IAAI,CACrE,CAAC;wBACJ,CAAC;wBACD,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACxB,CAAC;oBACD,MAAM;gBACR,CAAC;gBAED,KAAK,SAAS,CAAC,CAAC,CAAC;oBACf,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;wBACtD,MAAM,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,EAAE,8BAA8B,CAAC,CAAC;oBACtE,CAAC;oBACD,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;wBAClE,MAAM,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,EAAE,sCAAsC,CAAC,CAAC;oBAC9E,CAAC;oBACD,MAAM;gBACR,CAAC;gBAED,KAAK,QAAQ,CAAC,CAAC,CAAC;oBACd,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBACjC,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,EAAE,wCAAwC,CAAC,CAAC;oBAC/E,CAAC;oBACD,MAAM;gBACR,CAAC;gBAED,KAAK,SAAS,CAAC,CAAC,CAAC;oBACf,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;wBAChD,MAAM,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,EAAE,qCAAqC,CAAC,CAAC;oBAC7E,CAAC;oBACD,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,IAAI,GAAG,CAAC,WAAW,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,GAAG,CAAC,WAAW,CAAC,gBAAgB,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;gBACtD,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YACpD,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;gBACxD,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAED,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;YAC1B,MAAM;YACN,QAAQ;YACR,aAAa,EAAE,MAAM;SACtB,CAAC;IACJ,CAAC;CACF"}

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "anantham-v2",
+  "version": "2.0.0-alpha.1",
+  "description": "Anantham V2 — Programmable AI Agent Operating Environment",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "anantham": "./dist/bin/anantham.js"
+  },
+  "files": [
+    "dist",
+    "!dist/release",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "test": "node --max-old-space-size=8192 ./node_modules/vitest/vitest.mjs run",
+    "test:watch": "vitest",
+    "release:build": "node scripts/release-engineering.mjs build",
+    "release:audit": "node scripts/release-engineering.mjs audit",
+    "release:verify": "node scripts/release-engineering.mjs verify",
+    "verify": "powershell -ExecutionPolicy Bypass -File scripts/verify-all.ps1",
+    "scorecard": "powershell -ExecutionPolicy Bypass -File scripts/certification-scorecard.ps1",
+    "sync-state": "powershell -ExecutionPolicy Bypass -File scripts/sync-state.ps1",
+    "sync:all": "powershell -ExecutionPolicy Bypass -File scripts/post-task-sync.ps1",
+    "sync:codegraph": "powershell -ExecutionPolicy Bypass -File scripts/sync-codegraph.ps1",
+    "sync:graphify": "powershell -ExecutionPolicy Bypass -File scripts/sync-graphify.ps1",
+    "sync:neo4j": "powershell -ExecutionPolicy Bypass -File scripts/sync-neo4j.ps1",
+    "sync:graphiti": "node scripts/sync-graphiti.mjs",
+    "sync:git": "powershell -ExecutionPolicy Bypass -File scripts/sync-git.ps1",
+    "verdict": "node scripts/generate-verdict.mjs"
+  },
+  "keywords": [
+    "ai",
+    "agents",
+    "runtime",
+    "durable",
+    "event-sourced",
+    "mcp",
+    "anantham"
+  ],
+  "author": "Anantham Engineering Team",
+  "license": "Apache-2.0",
+  "engines": {
+    "node": ">=22.5.0"
+  },
+  "dependencies": {
+    "zod": "^3.24.2"
+  },
+  "devDependencies": {
+    "@types/node": "^22.13.5",
+    "typescript": "^5.7.3",
+    "vitest": "^3.0.7"
+  }
+}