botmux 2.93.1 → 2.95.0

package/dist/workflows/v3/human-gate.d.ts

@@ -0,0 +1,85 @@
+/**
+ * v3 humanGate — file-backed approval waits.
+ *
+ * Codex's v1-review blocker #4: a workflow gate is RUNTIME state, not an
+ * in-memory chat ask.  Its pending/resolved status MUST persist to the runDir
+ * so a daemon restart doesn't lose a pending approval.  The journal already
+ * records `gateDispatched` / `gateResolved` (audit truth); this module owns the
+ * materialized, mutable wait files under `runDir/waits/<waitId>.json` — the
+ * active state the Lark card layer keys off and the restart-recovery scan reads.
+ *
+ * Split of concerns:
+ *   - THIS file: the file-wait store + a gate resolver that persists
+ *     pending → resolved around an injected decision source.  Pure file IO,
+ *     bot-agnostic, testable without the daemon.
+ *   - daemon (later): supplies `awaitDecision` — posts the Lark approval card
+ *     (reusing v0.2's card-builder / card-handler UX) and resolves when the
+ *     button is clicked; on restart it re-arms pending waits via
+ *     `listPendingWaits`.
+ *
+ * The wait shape mirrors v0.2's `waitKind: 'human-gate'` lineage but is
+ * deliberately scoped to v3's gate needs: no deadline, but options /
+ * approveOptions / approvers are persisted for crash-safe card recovery.
+ */
+import { type V3HumanGate } from './dag.js';
+import type { V3RuntimeDeps } from './runtime.js';
+export type GateWaitStatus = 'pending' | 'approved' | 'rejected';
+export interface GateWait {
+    waitId: string;
+    nodeId: string;
+    /** The runtime instance this gate belongs to (`A#001`).  A revisit makes a
+     *  fresh instance + fresh gate; resolve-time validation rejects a stale card
+     *  whose instance is no longer the node's effective one (code review). */
+    instanceId?: string;
+    prompt: string;
+    options: string[];
+    approveOptions: string[];
+    approvers: string[];
+    status: GateWaitStatus;
+    createdAt: number;
+    resolvedAt?: number;
+    /** open_id (or 'system') of the resolver, once resolved. */
+    by?: string;
+    /** The concrete option selected by the reviewer. */
+    selected?: string;
+}
+/** The concrete (non-optional) shape the runtime injects as `resolveGate`. */
+export type GateResolver = NonNullable<V3RuntimeDeps['resolveGate']>;
+export declare function waitsDir(runDir: string): string;
+export declare function waitPath(runDir: string, waitId: string): string;
+/** Write the initial `pending` wait file for a gate.  Overwrites any stale
+ *  file at the same waitId (a re-dispatched gate). */
+export declare function writePendingWait(runDir: string, input: {
+    waitId: string;
+    nodeId: string;
+    prompt: string;
+} & Partial<Pick<GateWait, 'options' | 'approveOptions' | 'approvers' | 'instanceId'>>): GateWait;
+/** Read a single wait file, or `undefined` if it doesn't exist. */
+export declare function readWait(runDir: string, waitId: string): GateWait | undefined;
+/** Transition a wait to approved / rejected.  Throws if the wait is missing
+ *  (a resolution for an unknown gate is a programming error, not a no-op). */
+export declare function resolveWait(runDir: string, waitId: string, resolution: 'approved' | 'rejected', by: string, selected?: string): GateWait;
+export declare function normalizeGateWaitInput(gate: V3HumanGate): Pick<GateWait, 'prompt' | 'options' | 'approveOptions' | 'approvers'>;
+export declare function selectedResolution(wait: Pick<GateWait, 'options' | 'approveOptions'>, selected: string): 'approved' | 'rejected' | undefined;
+export declare function canResolveGateWait(wait: Pick<GateWait, 'approvers'>, by: string | undefined): boolean;
+/** All still-pending waits in the runDir — the daemon's restart-recovery scan
+ *  uses this to re-post / re-arm approval cards after a crash. */
+export declare function listPendingWaits(runDir: string): GateWait[];
+/**
+ * Build the `resolveGate` the runtime injects.  Persists the wait as `pending`,
+ * delegates to the daemon-supplied `awaitDecision` (post card + await the
+ * click), then persists the resolution — so the file store is authoritative
+ * for pending/resolved regardless of whether the in-memory decision promise
+ * survives a restart (the daemon re-arms via `listPendingWaits`).
+ *
+ * `awaitDecision` is the only daemon-coupled seam; everything else here is file
+ * IO, which is why this factory is unit-testable with a fake decision source.
+ */
+export declare function createFileGate(deps: {
+    awaitDecision: (wait: GateWait) => Promise<{
+        resolution: 'approved' | 'rejected';
+        by: string;
+        selected?: string;
+    }>;
+}): GateResolver;
+//# sourceMappingURL=human-gate.d.ts.map

package/dist/workflows/v3/human-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"human-gate.d.ts","sourceRoot":"","sources":["../../../src/workflows/v3/human-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,EAA8B,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;AAEjE,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf;;8EAE0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,cAAc,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,oDAAoD;IACpD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GAAG,WAAW,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC;AAIrE,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE/D;AAWD;sDACsD;AACtD,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACvD,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,GAAG,gBAAgB,GAAG,WAAW,GAAG,YAAY,CAAC,CAAC,GACnF,QAAQ,CAgBV;AAED,mEAAmE;AACnE,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAI7E;AAED;8EAC8E;AAC9E,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,GAAG,UAAU,EACnC,EAAE,EAAE,MAAM,EACV,QAAQ,CAAC,EAAE,MAAM,GAChB,QAAQ,CAMV;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,GAAG,SAAS,GAAG,gBAAgB,GAAG,WAAW,CAAC,CAQ/H;AAED,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,SAAS,GAAG,gBAAgB,CAAC,EAClD,QAAQ,EAAE,MAAM,GACf,UAAU,GAAG,UAAU,GAAG,SAAS,CAGrC;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAErG;AAED;kEACkE;AAClE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,EAAE,CAc3D;AAsBD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,aAAa,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC;QAAE,UAAU,EAAE,UAAU,GAAG,UAAU,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpH,GAAG,YAAY,CAOf"}

package/dist/workflows/v3/human-gate.js

@@ -0,0 +1,153 @@
+/**
+ * v3 humanGate — file-backed approval waits.
+ *
+ * Codex's v1-review blocker #4: a workflow gate is RUNTIME state, not an
+ * in-memory chat ask.  Its pending/resolved status MUST persist to the runDir
+ * so a daemon restart doesn't lose a pending approval.  The journal already
+ * records `gateDispatched` / `gateResolved` (audit truth); this module owns the
+ * materialized, mutable wait files under `runDir/waits/<waitId>.json` — the
+ * active state the Lark card layer keys off and the restart-recovery scan reads.
+ *
+ * Split of concerns:
+ *   - THIS file: the file-wait store + a gate resolver that persists
+ *     pending → resolved around an injected decision source.  Pure file IO,
+ *     bot-agnostic, testable without the daemon.
+ *   - daemon (later): supplies `awaitDecision` — posts the Lark approval card
+ *     (reusing v0.2's card-builder / card-handler UX) and resolves when the
+ *     button is clicked; on restart it re-arms pending waits via
+ *     `listPendingWaits`.
+ *
+ * The wait shape mirrors v0.2's `waitKind: 'human-gate'` lineage but is
+ * deliberately scoped to v3's gate needs: no deadline, but options /
+ * approveOptions / approvers are persisted for crash-safe card recovery.
+ */
+import { writeFileSync, readFileSync, existsSync, mkdirSync, renameSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { DEFAULT_HUMAN_GATE_OPTIONS } from './dag.js';
+// ─── File-wait store ────────────────────────────────────────────────────────
+export function waitsDir(runDir) {
+    return join(runDir, 'waits');
+}
+export function waitPath(runDir, waitId) {
+    return join(waitsDir(runDir), `${waitId}.json`);
+}
+/** Atomic JSON write (tmp + rename) so a crash never leaves a torn wait file. */
+function atomicWriteJson(path, value) {
+    const dir = join(path, '..');
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    const tmp = `${path}.tmp`;
+    writeFileSync(tmp, JSON.stringify(value, null, 2));
+    renameSync(tmp, path);
+}
+/** Write the initial `pending` wait file for a gate.  Overwrites any stale
+ *  file at the same waitId (a re-dispatched gate). */
+export function writePendingWait(runDir, input) {
+    const options = input.options ?? [...DEFAULT_HUMAN_GATE_OPTIONS];
+    const approveOptions = input.approveOptions ?? (options.includes('approve') ? ['approve'] : [options[0]]);
+    const wait = {
+        waitId: input.waitId,
+        nodeId: input.nodeId,
+        ...(input.instanceId ? { instanceId: input.instanceId } : {}),
+        prompt: input.prompt,
+        options,
+        approveOptions,
+        approvers: input.approvers ?? [],
+        status: 'pending',
+        createdAt: Date.now(),
+    };
+    atomicWriteJson(waitPath(runDir, input.waitId), wait);
+    return wait;
+}
+/** Read a single wait file, or `undefined` if it doesn't exist. */
+export function readWait(runDir, waitId) {
+    const path = waitPath(runDir, waitId);
+    if (!existsSync(path))
+        return undefined;
+    return normalizeWaitFile(JSON.parse(readFileSync(path, 'utf-8')));
+}
+/** Transition a wait to approved / rejected.  Throws if the wait is missing
+ *  (a resolution for an unknown gate is a programming error, not a no-op). */
+export function resolveWait(runDir, waitId, resolution, by, selected) {
+    const existing = readWait(runDir, waitId);
+    if (!existing)
+        throw new Error(`v3 human-gate: no pending wait "${waitId}" in ${runDir}`);
+    const resolved = { ...existing, status: resolution, resolvedAt: Date.now(), by, selected };
+    atomicWriteJson(waitPath(runDir, waitId), resolved);
+    return resolved;
+}
+export function normalizeGateWaitInput(gate) {
+    const options = gate.options ?? [...DEFAULT_HUMAN_GATE_OPTIONS];
+    return {
+        prompt: gate.prompt,
+        options,
+        approveOptions: gate.approveOptions ?? (options.includes('approve') ? ['approve'] : [options[0]]),
+        approvers: gate.approvers ?? [],
+    };
+}
+export function selectedResolution(wait, selected) {
+    if (!wait.options.includes(selected))
+        return undefined;
+    return wait.approveOptions.includes(selected) ? 'approved' : 'rejected';
+}
+export function canResolveGateWait(wait, by) {
+    return wait.approvers.length === 0 || (!!by && wait.approvers.includes(by));
+}
+/** All still-pending waits in the runDir — the daemon's restart-recovery scan
+ *  uses this to re-post / re-arm approval cards after a crash. */
+export function listPendingWaits(runDir) {
+    const dir = waitsDir(runDir);
+    if (!existsSync(dir))
+        return [];
+    const out = [];
+    for (const name of readdirSync(dir)) {
+        if (!name.endsWith('.json') || name.endsWith('.tmp'))
+            continue;
+        try {
+            const wait = normalizeWaitFile(JSON.parse(readFileSync(join(dir, name), 'utf-8')));
+            if (wait.status === 'pending')
+                out.push(wait);
+        }
+        catch {
+            // skip a torn / unparseable wait file (mid-write crash)
+        }
+    }
+    return out;
+}
+function normalizeWaitFile(raw) {
+    const options = raw.options ?? [...DEFAULT_HUMAN_GATE_OPTIONS];
+    return {
+        waitId: raw.waitId ?? '',
+        nodeId: raw.nodeId ?? '',
+        ...(raw.instanceId ? { instanceId: raw.instanceId } : {}),
+        prompt: raw.prompt ?? '',
+        options,
+        approveOptions: raw.approveOptions ?? (options.includes('approve') ? ['approve'] : [options[0]]),
+        approvers: raw.approvers ?? [],
+        status: raw.status ?? 'pending',
+        createdAt: raw.createdAt ?? 0,
+        resolvedAt: raw.resolvedAt,
+        by: raw.by,
+        selected: raw.selected,
+    };
+}
+// ─── Gate resolver (injected into the runtime) ──────────────────────────────
+/**
+ * Build the `resolveGate` the runtime injects.  Persists the wait as `pending`,
+ * delegates to the daemon-supplied `awaitDecision` (post card + await the
+ * click), then persists the resolution — so the file store is authoritative
+ * for pending/resolved regardless of whether the in-memory decision promise
+ * survives a restart (the daemon re-arms via `listPendingWaits`).
+ *
+ * `awaitDecision` is the only daemon-coupled seam; everything else here is file
+ * IO, which is why this factory is unit-testable with a fake decision source.
+ */
+export function createFileGate(deps) {
+    return async ({ nodeId, prompt, waitId, runDir }) => {
+        const wait = writePendingWait(runDir, { waitId, nodeId, prompt });
+        const { resolution, by, selected } = await deps.awaitDecision(wait);
+        resolveWait(runDir, waitId, resolution, by, selected);
+        return { resolution, by, selected };
+    };
+}
+//# sourceMappingURL=human-gate.js.map

package/dist/workflows/v3/human-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"human-gate.js","sourceRoot":"","sources":["../../../src/workflows/v3/human-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtG,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,0BAA0B,EAAoB,MAAM,UAAU,CAAC;AA4BxE,+EAA+E;AAE/E,MAAM,UAAU,QAAQ,CAAC,MAAc;IACrC,OAAO,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,MAAc;IACrD,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,OAAO,CAAC,CAAC;AAClD,CAAC;AAED,iFAAiF;AACjF,SAAS,eAAe,CAAC,IAAY,EAAE,KAAc;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;IAC1B,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACnD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC;AAED;sDACsD;AACtD,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,KACoF;IAEpF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC,GAAG,0BAA0B,CAAC,CAAC;IACjE,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;IAC3G,MAAM,IAAI,GAAa;QACrB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO;QACP,cAAc;QACd,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,EAAE;QAChC,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;IACF,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,QAAQ,CAAC,MAAc,EAAE,MAAc;IACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAsB,CAAC,CAAC;AACzF,CAAC;AAED;8EAC8E;AAC9E,MAAM,UAAU,WAAW,CACzB,MAAc,EACd,MAAc,EACd,UAAmC,EACnC,EAAU,EACV,QAAiB;IAEjB,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,QAAQ,MAAM,EAAE,CAAC,CAAC;IAC1F,MAAM,QAAQ,GAAa,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACrG,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;IACpD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAiB;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,0BAA0B,CAAC,CAAC;IAChE,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO;QACP,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC;QAClG,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE;KAChC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,IAAkD,EAClD,QAAgB;IAEhB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACvD,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAiC,EAAE,EAAsB;IAC1F,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;kEACkE;AAClE,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,SAAS;QAC/D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAsB,CAAC,CAAC;YACxG,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;gBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAsB;IAC/C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,0BAA0B,CAAC,CAAC;IAC/D,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;QACxB,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;QACxB,OAAO;QACP,cAAc,EAAE,GAAG,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC;QACjG,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE;QAC9B,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,SAAS;QAC/B,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,CAAC;QAC7B,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,QAAQ,EAAE,GAAG,CAAC,QAAQ;KACvB,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,IAE9B;IACC,OAAO,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;QAClD,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAClE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACpE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;QACtD,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACtC,CAAC,CAAC;AACJ,CAAC"}

package/dist/workflows/v3/journal.d.ts

@@ -0,0 +1,207 @@
+/**
+ * v3 journal — append-only event stream (the run's audit truth).
+ *
+ * Codex's v1-review blocker #1: v3 is NOT a "only-mutable-STATE" recoverable
+ * system.  `journal.ndjson` is the append-only source of audit truth (one JSON
+ * object per line, `ts`-stamped) from which `state.ts` materializes the STATE
+ * checkpoint.  Concurrency / retry / gate / cancel / failure-root-cause all
+ * leave an ordered trail here.
+ *
+ * Append-only + line-oriented = crash-tolerant by construction: a torn final
+ * line (process died mid-write) is skipped on read; everything before it is
+ * intact.  No locking needed for the journal itself — appends are serialized
+ * by the single runtime loop (the per-node LOCK guards worker dispatch, not
+ * the journal).
+ */
+import type { GoalAsk } from './contract.js';
+/** Why a node failed — drives fail-fast root-cause reporting + retry policy
+ *  (`classifyTerminal` maps each class to `blocked` or `failed`).
+ *  `gateRejected` / `cancelled` are user-driven; the rest are faults. */
+export type V3ErrorClass = 'workerError' | 'manifestInvalid' | 'resultInvalid' | 'timeout' | 'gateRejected' | 'cancelled';
+export type V3RunFailureReason = 'allSinksSkipped';
+/**
+ * The MVP event union.  Static DAG + fail-fast, so the lifecycle is small:
+ * run boundaries, per-node dispatch/settle, and gate dispatch/resolve.  Retry
+ * (`attempts/NNN`) is modeled by `attemptId` on dispatch/settle events — a new
+ * attempt is just another `nodeDispatched` with a fresh `attemptId`.
+ */
+/**
+ * Structured loop reference carried on body-instance dispatches.  The expanded
+ * nodeId (`repairLoop.i001.code`) is an OPAQUE key — projections/dashboards
+ * group by THIS field and never parse the id string (body ids may themselves
+ * contain dots).
+ */
+export interface V3LoopRef {
+    loopId: string;
+    iteration: number;
+    bodyNodeId: string;
+}
+export type V3Event = {
+    type: 'runStarted';
+    runId: string;
+} | {
+    type: 'nodeDispatched';
+    nodeId: string;
+    instanceId?: string;
+    attemptId: string;
+    loop?: V3LoopRef;
+} | {
+    type: 'nodeSessionReady';
+    nodeId: string;
+    instanceId?: string;
+    attemptId: string;
+    sessionInfo: {
+        sessionId: string;
+        webPort?: number;
+    };
+    ptyLogPath?: string;
+} | {
+    type: 'nodeSucceeded';
+    nodeId: string;
+    instanceId?: string;
+    attemptId: string;
+    manifestPath: string;
+} | {
+    type: 'nodeFailed';
+    nodeId: string;
+    instanceId?: string;
+    attemptId: string;
+    errorClass: V3ErrorClass;
+    errorCode?: string;
+    message?: string;
+} | {
+    type: 'nodeBlocked';
+    nodeId: string;
+    instanceId?: string;
+    attemptId: string;
+    errorClass: V3ErrorClass;
+    errorCode?: string;
+    message?: string;
+    ask?: GoalAsk;
+    revisitTo?: string;
+} | {
+    type: 'nodeRetryRequested';
+    nodeId: string;
+    instanceId?: string;
+    previousAttemptId: string;
+    nextAttemptId: string;
+    reason: 'blockedRetry';
+    previousErrorClass?: V3ErrorClass;
+    previousErrorCode?: string;
+    answer?: {
+        path: string;
+        preview: string;
+        by: string;
+    };
+} | {
+    type: 'gateDispatched';
+    nodeId: string;
+    instanceId?: string;
+    waitId: string;
+} | {
+    type: 'gateResolved';
+    nodeId: string;
+    instanceId?: string;
+    waitId: string;
+    resolution: 'approved' | 'rejected';
+    by: string;
+    selected?: string;
+} | {
+    type: 'edgeResolved';
+    from: string;
+    to: string;
+    fromInstanceId?: string;
+    toInstanceId?: string;
+    sourceAttemptId: string;
+    active: boolean;
+    detail?: string;
+} | {
+    type: 'nodeSkipped';
+    nodeId: string;
+    reason: 'triggerRuleUnsatisfied';
+    detail?: string;
+} | {
+    type: 'nodeCancelled';
+    nodeId: string;
+    instanceId?: string;
+    attemptId?: string;
+    reason: 'earlyReleaseLoser';
+    byNodeId: string;
+    detail?: string;
+} | {
+    type: 'nodeRevisitRequested';
+    nodeId: string;
+    instanceId: string;
+    attemptId: string;
+    toNodeId: string;
+    reason?: string;
+    reasonPath?: string;
+    sourceManifestPath?: string;
+    targetPreviousManifestPath?: string;
+} | {
+    type: 'nodeInstanceSuperseded';
+    nodeId: string;
+    instanceId: string;
+    byNodeId: string;
+    reason: 'refresh';
+} | {
+    type: 'revisitBudgetGranted';
+    sourceNodeId?: string;
+    toNodeId?: string;
+    by: string;
+    reason?: string;
+} | {
+    type: 'loopStarted';
+    loopId: string;
+} | {
+    type: 'loopIterationStarted';
+    loopId: string;
+    iteration: number;
+} | {
+    type: 'loopIterationDecision';
+    loopId: string;
+    iteration: number;
+    decision: 'exit' | 'continue' | 'exhausted';
+    /** Human-readable why (e.g. `result.passed=false (2/3 iterations used)`). */
+    detail?: string;
+} | {
+    type: 'loopIterationGranted';
+    loopId: string;
+    fromIteration: number;
+    by?: string;
+} | {
+    type: 'runSucceeded';
+} | {
+    type: 'runFailed';
+    failedNodeId?: string;
+    reason?: V3RunFailureReason;
+    detail?: string;
+} | {
+    type: 'runBlocked';
+    blockedNodeId: string;
+};
+/** A journal line: the event flattened with its append timestamp (flattened —
+ *  not `{ts, event}` — so `grep nodeFailed journal.ndjson` just works). */
+export type StoredEvent = V3Event & {
+    ts: number;
+};
+/**
+ * Append one event as a single NDJSON line.  Stamps `ts` (epoch ms) at write
+ * time.  Creates the parent directory if missing so the very first
+ * `runStarted` doesn't require the caller to pre-create the runDir.
+ *
+ * Synchronous on purpose: the runtime loop must observe its own writes in
+ * order, and the journal is the linearization point — an async append would
+ * open a window where `decideNext` runs against stale state.
+ */
+export declare function appendEvent(journalPath: string, event: V3Event): StoredEvent;
+/**
+ * Read every event in append order.  Tolerates a torn FINAL line (crash
+ * mid-append) but throws on any earlier unparseable line — a mid-file parse
+ * failure is real corruption, and silently dropping a middle event would
+ * desync the replayed state (e.g. a lost `nodeSucceeded` leaves the node
+ * looking pending forever), so fail loud instead (codex hardening #11).
+ * Returns `[]` if the file does not exist yet (a run that never started).
+ */
+export declare function readJournal(journalPath: string): StoredEvent[];
+//# sourceMappingURL=journal.d.ts.map

package/dist/workflows/v3/journal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"journal.d.ts","sourceRoot":"","sources":["../../../src/workflows/v3/journal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAI7C;;yEAEyE;AACzE,MAAM,MAAM,YAAY,GACpB,aAAa,GACb,iBAAiB,GACjB,eAAe,GACf,SAAS,GACT,cAAc,GACd,WAAW,CAAC;AAEhB,MAAM,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAEnD;;;;;GAKG;AACH;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,OAAO,GACf;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAQrC;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,CAAA;CAAE,GAOpG;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/J;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAGvG;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,YAAY,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAQ9I;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,YAAY,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IAK3J,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAOtB;IACE,IAAI,EAAE,oBAAoB,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IAKf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,cAAc,CAAC;IACvB,kBAAkB,CAAC,EAAE,YAAY,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAM3B,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CACxD,GAGD;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC/E;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,UAAU,GAAG,UAAU,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GASjJ;IACE,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAID;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,wBAAwB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAI1F;IACE,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAMD;IACE,IAAI,EAAE,sBAAsB,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAQhB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,0BAA0B,CAAC,EAAE,MAAM,CAAC;CACrC,GAQD;IACE,IAAI,EAAE,wBAAwB,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,SAAS,CAAC;CACnB,GAMD;IACE,IAAI,EAAE,sBAAsB,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAQD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAKnE;IACE,IAAI,EAAE,uBAAuB,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,WAAW,CAAC;IAC5C,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAID;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,GACpF;IAAE,IAAI,EAAE,cAAc,CAAA;CAAE,GACxB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAG1F;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD;2EAC2E;AAC3E,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAInD;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,WAAW,CAM5E;AAID;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,EAAE,CAuB9D"}

package/dist/workflows/v3/journal.js

@@ -0,0 +1,74 @@
+/**
+ * v3 journal — append-only event stream (the run's audit truth).
+ *
+ * Codex's v1-review blocker #1: v3 is NOT a "only-mutable-STATE" recoverable
+ * system.  `journal.ndjson` is the append-only source of audit truth (one JSON
+ * object per line, `ts`-stamped) from which `state.ts` materializes the STATE
+ * checkpoint.  Concurrency / retry / gate / cancel / failure-root-cause all
+ * leave an ordered trail here.
+ *
+ * Append-only + line-oriented = crash-tolerant by construction: a torn final
+ * line (process died mid-write) is skipped on read; everything before it is
+ * intact.  No locking needed for the journal itself — appends are serialized
+ * by the single runtime loop (the per-node LOCK guards worker dispatch, not
+ * the journal).
+ */
+import { appendFileSync, readFileSync, existsSync, mkdirSync } from 'node:fs';
+import { dirname } from 'node:path';
+// ─── Append ─────────────────────────────────────────────────────────────────
+/**
+ * Append one event as a single NDJSON line.  Stamps `ts` (epoch ms) at write
+ * time.  Creates the parent directory if missing so the very first
+ * `runStarted` doesn't require the caller to pre-create the runDir.
+ *
+ * Synchronous on purpose: the runtime loop must observe its own writes in
+ * order, and the journal is the linearization point — an async append would
+ * open a window where `decideNext` runs against stale state.
+ */
+export function appendEvent(journalPath, event) {
+    const stored = { ts: Date.now(), ...event };
+    const dir = dirname(journalPath);
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    appendFileSync(journalPath, JSON.stringify(stored) + '\n');
+    return stored;
+}
+// ─── Read / replay ────────────────────────────────────────────────────────
+/**
+ * Read every event in append order.  Tolerates a torn FINAL line (crash
+ * mid-append) but throws on any earlier unparseable line — a mid-file parse
+ * failure is real corruption, and silently dropping a middle event would
+ * desync the replayed state (e.g. a lost `nodeSucceeded` leaves the node
+ * looking pending forever), so fail loud instead (codex hardening #11).
+ * Returns `[]` if the file does not exist yet (a run that never started).
+ */
+export function readJournal(journalPath) {
+    if (!existsSync(journalPath))
+        return [];
+    const raw = readFileSync(journalPath, 'utf-8');
+    const lines = raw.split('\n');
+    // Only the last non-empty line can legitimately be a half-written append.
+    let lastNonEmpty = -1;
+    for (let i = lines.length - 1; i >= 0; i--) {
+        if (lines[i].trim()) {
+            lastNonEmpty = i;
+            break;
+        }
+    }
+    const out = [];
+    for (let i = 0; i < lines.length; i++) {
+        const trimmed = lines[i].trim();
+        if (!trimmed)
+            continue;
+        try {
+            out.push(JSON.parse(trimmed));
+        }
+        catch (err) {
+            if (i === lastNonEmpty)
+                break; // torn final line from an interrupted append — tolerate
+            throw new Error(`v3 journal corrupted at line ${i + 1} of ${journalPath}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=journal.js.map

package/dist/workflows/v3/journal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"journal.js","sourceRoot":"","sources":["../../../src/workflows/v3/journal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0NpC,+EAA+E;AAE/E;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,WAAmB,EAAE,KAAc;IAC7D,MAAM,MAAM,GAAgB,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,6EAA6E;AAE7E;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,WAAmB;IAC7C,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,EAAE,CAAC;IACxC,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC9B,0EAA0E;IAC1E,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YAAC,YAAY,GAAG,CAAC,CAAC;YAAC,MAAM;QAAC,CAAC;IACpD,CAAC;IACD,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAgB,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,YAAY;gBAAE,MAAM,CAAC,wDAAwD;YACvF,MAAM,IAAI,KAAK,CACb,gCAAgC,CAAC,GAAG,CAAC,OAAO,WAAW,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC/G,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/workflows/v3/manifest.d.ts

@@ -0,0 +1,17 @@
+/**
+ * v3 node manifest validator.
+ *
+ * Goal-mode workers write `manifest.json` at BOTMUX_GOAL_MANIFEST_PATH.
+ * The runtime treats that file as untrusted agent output: this module checks
+ * the shape, status invariants, path containment, file metadata, and hashes
+ * before downstream nodes receive any file paths.
+ */
+import { type Manifest } from './contract.js';
+export declare class ManifestValidationError extends Error {
+    readonly problems: string[];
+    constructor(problems: string[]);
+}
+export declare function readAndValidateManifest(manifestPath: string, outputDir: string): Promise<Manifest>;
+export declare function validateManifest(value: unknown, outputDir: string): Promise<Manifest>;
+export declare function resolveManifestFilePath(outputDir: string, relativePath: string): string;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/workflows/v3/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../../src/workflows/v3/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,EAML,KAAK,QAAQ,EAId,MAAM,eAAe,CAAC;AAEvB,qBAAa,uBAAwB,SAAQ,KAAK;aACpB,QAAQ,EAAE,MAAM,EAAE;gBAAlB,QAAQ,EAAE,MAAM,EAAE;CAI/C;AAED,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,QAAQ,CAAC,CAoBnB;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAkD3F;AAED,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAEvF"}