avantgate 1.3.0 → 1.4.0

package/dist/workflow/index.js

@@ -0,0 +1,558 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/workflow/index.ts
+var workflow_exports = {};
+__export(workflow_exports, {
+  WorkflowSagaRollbackError: () => WorkflowSagaRollbackError,
+  WorkflowValidationError: () => WorkflowValidationError,
+  defineWorkflow: () => defineWorkflow,
+  executeWorkflow: () => executeWorkflow
+});
+module.exports = __toCommonJS(workflow_exports);
+
+// src/agent/errors.ts
+var StepSuspendedError = class extends Error {
+  stepId;
+  workflowId;
+  metadata;
+  constructor(stepId, workflowId, metadata) {
+    super(`Step execution suspended for human approval: [${workflowId}::${stepId}]`);
+    this.name = "StepSuspendedError";
+    this.stepId = stepId;
+    this.workflowId = workflowId;
+    this.metadata = metadata;
+  }
+};
+var PiiLeakError = class extends Error {
+  toolName;
+  maskedCount;
+  constructor(toolName, maskedCount) {
+    super(`PII leak detected in tool output for "${toolName}" (${maskedCount} occurrences detected).`);
+    this.name = "PiiLeakError";
+    this.toolName = toolName;
+    this.maskedCount = maskedCount;
+  }
+};
+var ToolAccessDeniedError = class extends Error {
+  toolName;
+  requiredRole;
+  reason;
+  constructor(toolName, reasonOrRole) {
+    const isRole = Boolean(reasonOrRole && !reasonOrRole.includes(" "));
+    const roleMsg = isRole ? ` (requires role "${reasonOrRole}")` : "";
+    const reasonMsg = reasonOrRole && !isRole ? `: ${reasonOrRole}` : "";
+    super(`Access denied for tool "${toolName}"${roleMsg}${reasonMsg}.`);
+    this.name = "ToolAccessDeniedError";
+    this.toolName = toolName;
+    if (isRole) {
+      this.requiredRole = reasonOrRole;
+    } else {
+      this.reason = reasonOrRole;
+    }
+  }
+};
+var DtoValidationError = class extends Error {
+  toolName;
+  issues;
+  constructor(toolName, message, issues = []) {
+    super(`LLM DTO validation failed for tool "${toolName}": ${message}`);
+    this.name = "DtoValidationError";
+    this.toolName = toolName;
+    this.issues = issues;
+  }
+};
+
+// src/sanitizer.ts
+var EMAIL_REGEX = /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,7}\b/g;
+var PHONE_FR_REGEX = /\b(?:(?:\+|00)33|0)\s*[1-9](?:[\s.-]*\d{2}){4}\b/g;
+var NIR_SSN_REGEX = /\b[12]\s*\d{2}\s*(?:0[1-9]|1[0-2]|[2-9]\d)\s*(?:0[1-9]|[1-8]\d|9[0-8]|2[ABab])\s*(?!000)\d{3}\s*(?!000)\d{3}(?:\s*\d{2})?\b/g;
+var SPI_LABELLED_REGEX = /(?:(?:num[ée]ro\s+fiscal|spi|n[°o]\s*fiscal|d[ée]clarant(?: fiscal)?)\s*[:=]?\s*)\b(\d{2}(?:[\s.-]?\d{2}){5}[\s.-]?\d|\d{13})\b/gi;
+var SPI_FORMATTED_REGEX = /\b[0-3]\d(?:\s+\d{2}){5}\s+\d\b/g;
+var IBAN_REGEX = /\b[A-Z]{2}\s*[0-9]{2}(?:[\s\r\n.-]*[A-Z0-9]){11,30}\b/g;
+var BIC_LABELLED_REGEX = /(?:(?:bic|swift)\s*[:=]?\s*)\b([A-Z]{4}[A-Z]{2}[A-Z0-9]{2}(?:[A-Z0-9]{3})?)\b/gi;
+function sanitizePII(input) {
+  let count = 0;
+  let result = input;
+  result = result.replace(EMAIL_REGEX, () => {
+    count++;
+    return "[REDACTED_EMAIL]";
+  });
+  result = result.replace(PHONE_FR_REGEX, () => {
+    count++;
+    return "[REDACTED_PHONE]";
+  });
+  result = result.replace(IBAN_REGEX, (match) => {
+    const cleanChars = match.replace(/[\s\r\n.-]/g, "");
+    if (cleanChars.length >= 15 && cleanChars.length <= 34) {
+      count++;
+      return "[REDACTED_IBAN]";
+    }
+    return match;
+  });
+  result = result.replace(BIC_LABELLED_REGEX, (_, bicCode) => {
+    count++;
+    return `[REDACTED_BIC: ${bicCode.slice(0, 4)}****]`;
+  });
+  result = result.replace(SPI_LABELLED_REGEX, (fullMatch, digits) => {
+    count++;
+    return fullMatch.replace(digits, "[REDACTED_SPI]");
+  });
+  result = result.replace(NIR_SSN_REGEX, (match) => {
+    const rawDigits = match.replace(/\s+/g, "");
+    if (rawDigits.length === 13 || rawDigits.length === 15) {
+      count++;
+      return "[REDACTED_NIR]";
+    }
+    return match;
+  });
+  result = result.replace(SPI_FORMATTED_REGEX, (match) => {
+    if (!match.includes("[REDACTED")) {
+      count++;
+      return "[REDACTED_SPI]";
+    }
+    return match;
+  });
+  return { text: result, maskedCount: count };
+}
+
+// src/agent/guardrails.ts
+function sanitizeString(value) {
+  const result = sanitizePII(value);
+  return { text: result.text, count: result.maskedCount };
+}
+function sanitizeArray(items, options, visited) {
+  let totalCount = 0;
+  const sanitized = items.map((item) => {
+    const res = recursivelySanitize(item, options, visited);
+    totalCount += res.count;
+    return res.sanitized;
+  });
+  return { sanitized, count: totalCount };
+}
+function sanitizeObject(target, options, visited) {
+  let totalCount = 0;
+  const copy = {};
+  for (const [key, val] of Object.entries(target)) {
+    const res = recursivelySanitize(val, options, visited);
+    copy[key] = res.sanitized;
+    totalCount += res.count;
+  }
+  return { sanitized: copy, count: totalCount };
+}
+function recursivelySanitize(data, options, visited = /* @__PURE__ */ new WeakSet()) {
+  if (typeof data === "string") {
+    const res = sanitizeString(data);
+    return { sanitized: res.text, count: res.count };
+  }
+  if (data !== null && typeof data === "object") {
+    if (visited.has(data)) {
+      return { sanitized: "[CIRCULAR_REFERENCE]", count: 0 };
+    }
+    visited.add(data);
+    if (Array.isArray(data)) {
+      return sanitizeArray(data, options, visited);
+    }
+    return sanitizeObject(data, options, visited);
+  }
+  return { sanitized: data, count: 0 };
+}
+function auditToolResult(data, options) {
+  const { sanitized, count } = recursivelySanitize(data, options);
+  if (options.throwOnPii && count > 0) {
+    throw new PiiLeakError(options.toolName, count);
+  }
+  return {
+    sanitizedData: sanitized,
+    maskedCount: count
+  };
+}
+
+// src/agent/isolated-tool.ts
+async function verifyDataAccessGuard(guard, args, context, toolIdentifier) {
+  if (!guard) {
+    return;
+  }
+  const isAllowed = await guard(args, context);
+  if (!isAllowed) {
+    throw new ToolAccessDeniedError(toolIdentifier, "Access denied by data access guard");
+  }
+}
+async function resolveInvalidationTags(config, args, rawResult, context) {
+  if (!config.invalidationTags) {
+    return void 0;
+  }
+  const tags = typeof config.invalidationTags === "function" ? await config.invalidationTags(args, rawResult) : config.invalidationTags;
+  if (tags && tags.length > 0 && context?.onInvalidationTags) {
+    await context.onInvalidationTags(tags);
+  }
+  return tags;
+}
+async function dispatchClientData(rawResult, callback) {
+  if (!callback) {
+    return;
+  }
+  await callback(rawResult);
+}
+async function produceLlmPayload(rawResult, args, context, transformer) {
+  if (transformer) {
+    return await transformer(rawResult, args, context);
+  }
+  return rawResult;
+}
+function validateLlmDto(payload, schema, toolIdentifier) {
+  const parseResult = schema.safeParse(payload);
+  if (!parseResult.success) {
+    const issues = parseResult.error.issues ?? [];
+    const errorMessages = issues.map((issue) => `${issue.path.join(".") || "root"}: ${issue.message}`).join(", ");
+    throw new DtoValidationError(
+      toolIdentifier,
+      errorMessages,
+      issues
+    );
+  }
+  return parseResult.data;
+}
+function protectLlmPayload(payload, toolIdentifier, sanitizePii = true, throwOnPii = false) {
+  if (!sanitizePii) {
+    return { sanitized: payload, count: 0 };
+  }
+  const { sanitizedData, maskedCount } = auditToolResult(payload, {
+    toolName: toolIdentifier,
+    throwOnPii
+  });
+  return { sanitized: sanitizedData, count: maskedCount };
+}
+async function processLlmPayload(rawResult, args, context, config, toolIdentifier) {
+  let payload = await produceLlmPayload(rawResult, args, context, config.llmDto);
+  if (config.llmDtoSchema) {
+    payload = validateLlmDto(payload, config.llmDtoSchema, toolIdentifier);
+  }
+  return protectLlmPayload(
+    payload,
+    toolIdentifier,
+    config.sanitizePii !== false,
+    config.throwOnPii === true
+  );
+}
+function createIsolatedTool(config) {
+  const toolId = config.id || config.name;
+  const toolAlias = config.alias;
+  const clientCallback = config.clientDto;
+  const toolIdentifier = toolAlias || config.name;
+  const toolImpact = config.impact ?? "READ_ONLY";
+  const requireApproval = config.requireApproval ?? toolImpact === "DESTRUCTIVE";
+  const tool = {
+    description: config.description,
+    parameters: config.parameters,
+    _toolId: toolId,
+    _toolName: config.name,
+    _toolAlias: toolAlias,
+    _isIsolated: true,
+    _cacheTTL: config.cacheTTL,
+    _domain: config.domain,
+    _resource: config.resource,
+    _roles: config.roles ? Object.freeze([...config.roles]) : void 0,
+    _impact: toolImpact,
+    _requireApproval: requireApproval,
+    _lastPiiFilteredCount: 0,
+    _lastInvalidationTags: void 0,
+    async execute(args, context) {
+      const updatedContext = {
+        ...context,
+        callChain: context?.callChain ?? Object.freeze([toolId])
+      };
+      await verifyDataAccessGuard(
+        config.dataAccessGuard,
+        args,
+        updatedContext,
+        toolIdentifier
+      );
+      const rawResult = await config.execute(args, updatedContext);
+      const tags = await resolveInvalidationTags(
+        config,
+        args,
+        rawResult,
+        updatedContext
+      );
+      if (tags) {
+        tool._lastInvalidationTags = tags;
+      }
+      await dispatchClientData(rawResult, clientCallback);
+      const protection = await processLlmPayload(
+        rawResult,
+        args,
+        updatedContext,
+        config,
+        toolIdentifier
+      );
+      tool._lastPiiFilteredCount = protection.count;
+      return protection.sanitized;
+    }
+  };
+  return tool;
+}
+
+// src/workflow/errors.ts
+var WorkflowSagaRollbackError = class extends Error {
+  workflowId;
+  failedStepId;
+  originalError;
+  compensatedSteps;
+  failedCompensations;
+  constructor(params) {
+    const errorDetails = params.originalError instanceof Error ? params.originalError.message : String(params.originalError);
+    super(
+      `\xC9chec de l'\xE9tape '${params.failedStepId}' dans le workflow '${params.workflowId}'. Rollback Saga ex\xE9cut\xE9 sur [${params.compensatedSteps.join(", ")}]. Cause initiale: ${errorDetails}`
+    );
+    this.name = "WorkflowSagaRollbackError";
+    this.workflowId = params.workflowId;
+    this.failedStepId = params.failedStepId;
+    this.originalError = params.originalError;
+    this.compensatedSteps = params.compensatedSteps;
+    this.failedCompensations = params.failedCompensations ?? [];
+  }
+};
+var WorkflowValidationError = class extends Error {
+  workflowId;
+  issues;
+  constructor(workflowId, issues) {
+    super(`Validation des entr\xE9es \xE9chou\xE9e pour le workflow '${workflowId}'.`);
+    this.name = "WorkflowValidationError";
+    this.workflowId = workflowId;
+    this.issues = issues;
+  }
+};
+
+// src/workflow/engine.ts
+function generateRunId(workflowId) {
+  const timestamp = Date.now();
+  const randomSuffix = Math.random().toString(36).substring(2, 9);
+  return `run_${workflowId}_${timestamp}_${randomSuffix}`;
+}
+function validateInput(config, input) {
+  const parseResult = config.inputSchema.safeParse(input);
+  if (!parseResult.success) {
+    throw new WorkflowValidationError(config.id, parseResult.error.issues);
+  }
+  return parseResult.data;
+}
+function createStepContext(params) {
+  const { workflowId, stepId, runId, context, stepResults } = params;
+  return {
+    workflowId,
+    stepId,
+    runId,
+    tenantId: context?.tenantId,
+    userId: context?.userId,
+    services: context?.services ?? {},
+    storage: context?.storage,
+    getStepResult: (id) => stepResults[id],
+    waitForApproval: async (options) => {
+      if (context?.storage) {
+        const existing = await context.storage.getStep(workflowId, stepId);
+        if (existing && existing.status === "COMPLETED") {
+          return existing.result ?? options?.defaultResult;
+        }
+        const now = (/* @__PURE__ */ new Date()).toISOString();
+        await context.storage.saveStep({
+          workflowId,
+          stepId,
+          runId,
+          status: "WAITING_APPROVAL",
+          metadata: options?.metadata,
+          createdAt: now,
+          updatedAt: now
+        });
+      }
+      throw new StepSuspendedError(stepId, workflowId, options?.prompt);
+    }
+  };
+}
+async function rollbackSaga(params) {
+  const {
+    workflowId,
+    failedStepId,
+    originalError,
+    completedSteps,
+    input,
+    runId,
+    context,
+    stepResults
+  } = params;
+  const compensatedSteps = [];
+  const failedCompensations = [];
+  for (let i = completedSteps.length - 1; i >= 0; i--) {
+    const { step, result } = completedSteps[i];
+    if (!step.compensate) {
+      continue;
+    }
+    const stepCtx = createStepContext({
+      workflowId,
+      stepId: step.id,
+      runId,
+      context,
+      stepResults
+    });
+    try {
+      await step.compensate(result, input, stepCtx);
+      compensatedSteps.push(step.id);
+      if (context?.storage) {
+        await context.storage.updateStepStatus(workflowId, step.id, "FAILED", {
+          metadata: { compensated: true }
+        });
+      }
+    } catch (compensationError) {
+      failedCompensations.push({ stepId: step.id, error: compensationError });
+    }
+  }
+  throw new WorkflowSagaRollbackError({
+    workflowId,
+    failedStepId,
+    originalError,
+    compensatedSteps,
+    failedCompensations
+  });
+}
+async function executeWorkflow(config, rawInput, context) {
+  const input = validateInput(config, rawInput);
+  const runId = context?.runId ?? generateRunId(config.id);
+  const stepResults = {};
+  const completedSteps = [];
+  for (const step of config.steps) {
+    const stepCtx = createStepContext({
+      workflowId: config.id,
+      stepId: step.id,
+      runId,
+      context,
+      stepResults
+    });
+    try {
+      const result = await step.execute(input, stepCtx);
+      stepResults[step.id] = result;
+      completedSteps.push({ step, result });
+      if (context?.storage) {
+        await context.storage.updateStepStatus(config.id, step.id, "COMPLETED", { result });
+      }
+    } catch (error) {
+      if (error instanceof StepSuspendedError) {
+        return {
+          workflowId: config.id,
+          runId,
+          status: "WAITING_APPROVAL",
+          stepResults
+        };
+      }
+      await rollbackSaga({
+        workflowId: config.id,
+        failedStepId: step.id,
+        originalError: error,
+        completedSteps,
+        input,
+        runId,
+        context,
+        stepResults
+      });
+    }
+  }
+  const finalOutput = config.outputDto ? config.outputDto(stepResults, input) : stepResults;
+  return {
+    workflowId: config.id,
+    runId,
+    status: "COMPLETED",
+    stepResults,
+    output: finalOutput
+  };
+}
+
+// src/workflow/define-workflow.ts
+function resolveWorkflowImpact(config, options) {
+  if (options?.impact) {
+    return options.impact;
+  }
+  return config.impact ?? "MUTATIVE";
+}
+function resolveRequireApproval(impact, options) {
+  if (options?.requireApproval !== void 0) {
+    return options.requireApproval;
+  }
+  return impact === "DESTRUCTIVE";
+}
+function buildToolExecutionContext(options, toolCtx) {
+  const tenantId = typeof toolCtx?.tenantId === "string" ? toolCtx.tenantId : options?.defaultContext?.tenantId;
+  const userId = typeof toolCtx?.userId === "string" ? toolCtx.userId : options?.defaultContext?.userId;
+  return {
+    tenantId,
+    userId,
+    services: options?.defaultContext?.services ?? {},
+    storage: options?.storage ?? options?.defaultContext?.storage
+  };
+}
+function defineWorkflow(config) {
+  const workflowImpact = config.impact ?? "MUTATIVE";
+  return {
+    id: config.id,
+    name: config.name,
+    description: config.description,
+    impact: workflowImpact,
+    roles: config.roles,
+    config,
+    execute: async (input, context) => {
+      return await executeWorkflow(config, input, context);
+    },
+    asTool: (options) => {
+      const impact = resolveWorkflowImpact(config, options);
+      const requireApproval = resolveRequireApproval(impact, options);
+      const tool = createIsolatedTool({
+        name: config.id,
+        description: config.description ?? config.name,
+        roles: config.roles,
+        impact,
+        requireApproval,
+        parameters: config.inputSchema,
+        invalidationTags: typeof config.invalidationTags === "function" ? async (args, res) => {
+          const resolver = config.invalidationTags;
+          return await resolver(args, res ?? {});
+        } : config.invalidationTags,
+        execute: async (args, toolCtx) => {
+          const executionContext = buildToolExecutionContext(options, toolCtx);
+          const result = await executeWorkflow(config, args, executionContext);
+          return result.output;
+        },
+        llmDto: (result) => result
+      });
+      Object.assign(tool, {
+        _isWorkflow: true,
+        workflowId: config.id,
+        workflowConfig: {
+          totalSteps: config.steps.length,
+          impact
+        }
+      });
+      return tool;
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  WorkflowSagaRollbackError,
+  WorkflowValidationError,
+  defineWorkflow,
+  executeWorkflow
+});

package/dist/workflow/index.mjs

@@ -0,0 +1,13 @@
+import {
+  WorkflowSagaRollbackError,
+  WorkflowValidationError,
+  defineWorkflow,
+  executeWorkflow
+} from "../chunk-DTM2OLCG.mjs";
+import "../chunk-5VA3EKPJ.mjs";
+export {
+  WorkflowSagaRollbackError,
+  WorkflowValidationError,
+  defineWorkflow,
+  executeWorkflow
+};

package/dist/workflow/types.d.ts

@@ -0,0 +1,64 @@
+import type { ZodType } from "zod";
+import type { IsolatedTool, StepApprovalOptions, StepStorageAdapter, ToolImpact } from "../agent/types";
+export interface WorkflowStepContext {
+    readonly workflowId: string;
+    readonly stepId: string;
+    readonly runId?: string;
+    readonly tenantId?: string;
+    readonly userId?: string;
+    readonly services: Record<string, any>;
+    readonly storage?: StepStorageAdapter;
+    getStepResult<T = unknown>(stepId: string): T | undefined;
+    waitForApproval<T = unknown>(options?: StepApprovalOptions<T>): Promise<T>;
+}
+export interface WorkflowStepConfig<TInput = any, TOutput = any> {
+    id: string;
+    name: string;
+    description?: string;
+    impact?: ToolImpact;
+    checkpoint?: boolean;
+    execute: (input: TInput, ctx: WorkflowStepContext) => Promise<TOutput>;
+    compensate?: (stepResult: TOutput, input: TInput, ctx: WorkflowStepContext) => Promise<void>;
+}
+export interface WorkflowConfig<TInput = any, TOutput = any> {
+    id: string;
+    name: string;
+    description?: string;
+    inputSchema: ZodType<TInput>;
+    roles?: string[];
+    impact?: ToolImpact;
+    invalidationTags?: string[] | ((input: TInput, results: Record<string, any>) => string[] | Promise<string[]>);
+    steps: WorkflowStepConfig<TInput, any>[];
+    outputDto?: (results: Record<string, any>, input: TInput) => TOutput;
+}
+export interface WorkflowExecutionContext {
+    tenantId?: string;
+    userId?: string;
+    runId?: string;
+    services?: Record<string, any>;
+    storage?: StepStorageAdapter;
+}
+export interface WorkflowAsToolOptions {
+    storage?: StepStorageAdapter;
+    impact?: ToolImpact;
+    requireApproval?: boolean;
+    defaultContext?: Partial<WorkflowExecutionContext>;
+}
+export interface WorkflowExecutionResult<TOutput = any> {
+    workflowId: string;
+    runId: string;
+    status: "COMPLETED" | "FAILED" | "WAITING_APPROVAL";
+    stepResults: Record<string, any>;
+    output?: TOutput;
+}
+export interface WorkflowInstance<TInput = any, TOutput = any> {
+    readonly id: string;
+    readonly name: string;
+    readonly description?: string;
+    readonly impact: ToolImpact;
+    readonly roles?: string[];
+    readonly config: WorkflowConfig<TInput, TOutput>;
+    execute(input: TInput, context?: WorkflowExecutionContext): Promise<WorkflowExecutionResult<TOutput>>;
+    asTool(options?: WorkflowAsToolOptions): IsolatedTool<TInput, TOutput>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/workflow/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/workflow/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AACnC,OAAO,KAAK,EACV,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAClB,UAAU,EACX,MAAM,gBAAgB,CAAC;AAExB,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IACtC,aAAa,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;IAC1D,eAAe,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAC5E;AAED,MAAM,WAAW,kBAAkB,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG;IAC7D,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9F;AAED,MAAM,WAAW,cAAc,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG;IACzD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,gBAAgB,CAAC,EACb,MAAM,EAAE,GACR,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACpF,KAAK,EAAE,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;IACzC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;CACtE;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC,wBAAwB,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,uBAAuB,CAAC,OAAO,GAAG,GAAG;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,kBAAkB,CAAC;IACpD,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB,CAAC,MAAM,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG;IAC3D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjD,OAAO,CACL,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,wBAAwB,GACjC,OAAO,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7C,MAAM,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "avantgate",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Zero-infrastructure, in-process AI Application Firewall (AI-WAF) & privacy control plane for TypeScript: real-time prompt guardrails, zero-egress PII redaction, agent tool isolation, anti-IDOR defense, pre-flight token budgets, and multi-model failover.",
   "author": "Antigravity & LexTalk Team",
   "license": "MIT",
@@ -54,6 +54,11 @@
       "import": "./dist/agent/index.mjs",
       "require": "./dist/agent/index.js"
     },
+    "./workflow": {
+      "types": "./dist/workflow/index.d.ts",
+      "import": "./dist/workflow/index.mjs",
+      "require": "./dist/workflow/index.js"
+    },
     "./package.json": "./package.json"
   },
   "files": [
@@ -62,12 +67,13 @@
     "LICENSE"
   ],
   "scripts": {
-    "build": "tsup src/index.ts src/finance/index.ts src/agent/index.ts --format cjs --format esm --clean && tsc --emitDeclarationOnly --outDir dist",
-    "test": "tsx tests/avantgate.test.ts && tsx tests/preflight-budget.test.ts && tsx tests/financial-normalizer.test.ts && tsx tests/prompt-builder.test.ts && tsx tests/pii-extended.test.ts && npm run test:agent",
+    "build": "tsup src/index.ts src/finance/index.ts src/agent/index.ts src/workflow/index.ts --format cjs --format esm --clean && tsc --emitDeclarationOnly --outDir dist",
+    "test": "tsx tests/avantgate.test.ts && tsx tests/preflight-budget.test.ts && tsx tests/financial-normalizer.test.ts && tsx tests/prompt-builder.test.ts && tsx tests/pii-extended.test.ts && npm run test:agent && npm run test:workflow",
     "test:finance": "tsx tests/financial-normalizer.test.ts",
     "test:prompts": "tsx tests/prompt-builder.test.ts",
     "test:pii": "tsx tests/pii-extended.test.ts",
     "test:agent": "tsx tests/agent/step-runner.test.ts && tsx tests/agent/isolated-tool.test.ts && tsx tests/agent/dto-pattern.test.ts && tsx tests/agent/tool-patterns.test.ts && tsx tests/agent/storage-adapters.test.ts && tsx tests/agent/tool-aliasing.test.ts && tsx tests/agent/tool-chaining.test.ts && tsx tests/agent/tool-storage.test.ts && tsx tests/agent/telemetry-exporter.test.ts && tsx tests/agent/platform-adapter.test.ts && tsx tests/agent/tool-governance.test.ts && tsx tests/agent/tool-impact.test.ts",
+    "test:workflow": "tsx tests/workflow/workflow-saga.test.ts",
     "lint": "tsc --noEmit",
     "prepublishOnly": "npm run build && npm test"
   },