cloving 0.3.20 → 1.0.1

package/dist/src/storage/effect-rows.js

@@ -0,0 +1,74 @@
+import { integer, optionalInteger, optionalText, text, } from "./domain-rows.js";
+export const budgetColumns = "run_id, effect_limit, spent, capabilities, exhausted_sequence";
+export const operationColumns = "operation_id, run_id, capability, method, target, payload, input_digest, units, lease_key, recovery_limit, status, reason, attempts, receipt, worker, result, requested_sequence, wait_sequence, settled_sequence";
+export const leaseColumns = "resource_key, operation_id, generation, expires_at, state, granted_sequence";
+export const evidenceColumns = "sequence, run_id, operation_id, disposition, reason";
+export const stopColumns = "operation_id, run_id, sequence";
+export function budgetRow(row) {
+    return {
+        runId: text(row, "run_id"),
+        effectLimit: integer(row, "effect_limit"),
+        spent: integer(row, "spent"),
+        capabilities: text(row, "capabilities"),
+        exhaustedSequence: optionalInteger(row, "exhausted_sequence"),
+    };
+}
+export function operationRow(row) {
+    return {
+        operationId: text(row, "operation_id"),
+        runId: text(row, "run_id"),
+        capability: text(row, "capability"),
+        method: text(row, "method"),
+        target: text(row, "target"),
+        payload: text(row, "payload"),
+        inputDigest: text(row, "input_digest"),
+        units: integer(row, "units"),
+        leaseKey: text(row, "lease_key"),
+        recoveryLimit: integer(row, "recovery_limit"),
+        status: text(row, "status"),
+        reason: optionalText(row, "reason"),
+        attempts: integer(row, "attempts"),
+        receipt: optionalText(row, "receipt"),
+        worker: optionalText(row, "worker"),
+        result: optionalText(row, "result"),
+        requestedSequence: integer(row, "requested_sequence"),
+        waitSequence: optionalInteger(row, "wait_sequence"),
+        settledSequence: optionalInteger(row, "settled_sequence"),
+    };
+}
+export function leaseRow(row) {
+    return {
+        resourceKey: text(row, "resource_key"),
+        operationId: text(row, "operation_id"),
+        generation: integer(row, "generation"),
+        expiresAt: text(row, "expires_at"),
+        state: text(row, "state"),
+        grantedSequence: integer(row, "granted_sequence"),
+    };
+}
+export function evidenceRow(row) {
+    return {
+        sequence: integer(row, "sequence"),
+        runId: text(row, "run_id"),
+        operationId: text(row, "operation_id"),
+        disposition: text(row, "disposition"),
+        reason: optionalText(row, "reason"),
+    };
+}
+export function stopRow(row) {
+    return {
+        operationId: text(row, "operation_id"),
+        runId: text(row, "run_id"),
+        sequence: integer(row, "sequence"),
+    };
+}
+export async function loadEffects(connection) {
+    const rows = (sql) => connection.all(sql);
+    return {
+        budgets: (await rows(`SELECT ${budgetColumns} FROM run_budgets ORDER BY run_id`)).map(budgetRow),
+        operations: (await rows(`SELECT ${operationColumns} FROM operations ORDER BY requested_sequence, operation_id`)).map(operationRow),
+        leases: (await rows(`SELECT ${leaseColumns} FROM leases ORDER BY resource_key`)).map(leaseRow),
+        evidence: (await rows(`SELECT ${evidenceColumns} FROM effect_evidence ORDER BY sequence`)).map(evidenceRow),
+        stops: (await rows(`SELECT ${stopColumns} FROM stopped_operations ORDER BY operation_id`)).map(stopRow),
+    };
+}

package/dist/src/storage/effect-schema.d.ts

@@ -0,0 +1 @@
+export declare const effectSchema = "\nCREATE TABLE run_budgets (\n  run_id TEXT PRIMARY KEY REFERENCES runs (run_id) DEFERRABLE INITIALLY DEFERRED,\n  effect_limit INTEGER NOT NULL,\n  spent INTEGER NOT NULL CHECK (spent <= effect_limit),\n  capabilities TEXT NOT NULL,\n  exhausted_sequence INTEGER REFERENCES events (sequence) DEFERRABLE INITIALLY DEFERRED\n) STRICT;\nCREATE TABLE operations (\n  operation_id TEXT PRIMARY KEY,\n  run_id TEXT NOT NULL REFERENCES runs (run_id) DEFERRABLE INITIALLY DEFERRED,\n  capability TEXT NOT NULL,\n  method TEXT NOT NULL,\n  target TEXT NOT NULL,\n  payload TEXT NOT NULL,\n  input_digest TEXT NOT NULL,\n  units INTEGER NOT NULL,\n  lease_key TEXT NOT NULL,\n  recovery_limit INTEGER NOT NULL,\n  status TEXT NOT NULL,\n  reason TEXT,\n  attempts INTEGER NOT NULL,\n  receipt TEXT,\n  worker TEXT,\n  result TEXT,\n  requested_sequence INTEGER NOT NULL REFERENCES events (sequence) DEFERRABLE INITIALLY DEFERRED,\n  wait_sequence INTEGER REFERENCES events (sequence) DEFERRABLE INITIALLY DEFERRED,\n  settled_sequence INTEGER REFERENCES events (sequence) DEFERRABLE INITIALLY DEFERRED\n) STRICT;\nCREATE INDEX operations_run ON operations (run_id);\nCREATE INDEX operations_waiting ON operations (wait_sequence) WHERE status = 'waiting';\nCREATE TABLE leases (\n  resource_key TEXT PRIMARY KEY,\n  operation_id TEXT NOT NULL REFERENCES operations (operation_id) DEFERRABLE INITIALLY DEFERRED,\n  generation INTEGER NOT NULL CHECK (generation > 0),\n  expires_at TEXT NOT NULL,\n  state TEXT NOT NULL CHECK (state IN ('held', 'expired', 'released')),\n  granted_sequence INTEGER NOT NULL REFERENCES events (sequence) DEFERRABLE INITIALLY DEFERRED\n) STRICT;\nCREATE INDEX leases_due ON leases (expires_at) WHERE state = 'held';\nCREATE TABLE effect_evidence (\n  sequence INTEGER PRIMARY KEY REFERENCES events (sequence) DEFERRABLE INITIALLY DEFERRED,\n  run_id TEXT NOT NULL,\n  operation_id TEXT NOT NULL,\n  disposition TEXT NOT NULL,\n  reason TEXT\n) STRICT;\nCREATE TABLE stopped_operations (\n  operation_id TEXT PRIMARY KEY,\n  run_id TEXT NOT NULL REFERENCES runs (run_id) DEFERRABLE INITIALLY DEFERRED,\n  sequence INTEGER NOT NULL REFERENCES events (sequence) DEFERRABLE INITIALLY DEFERRED\n) STRICT;\nCREATE TABLE dispatch_attempts (\n  effect_id TEXT PRIMARY KEY REFERENCES deliveries (effect_id) DEFERRABLE INITIALLY DEFERRED,\n  purpose TEXT NOT NULL,\n  lease_generation INTEGER,\n  authority_epoch INTEGER NOT NULL\n) STRICT;\n";

package/dist/src/storage/effect-schema.js

@@ -0,0 +1,59 @@
+export const effectSchema = `
+CREATE TABLE run_budgets (
+  run_id TEXT PRIMARY KEY REFERENCES runs (run_id) DEFERRABLE INITIALLY DEFERRED,
+  effect_limit INTEGER NOT NULL,
+  spent INTEGER NOT NULL CHECK (spent <= effect_limit),
+  capabilities TEXT NOT NULL,
+  exhausted_sequence INTEGER REFERENCES events (sequence) DEFERRABLE INITIALLY DEFERRED
+) STRICT;
+CREATE TABLE operations (
+  operation_id TEXT PRIMARY KEY,
+  run_id TEXT NOT NULL REFERENCES runs (run_id) DEFERRABLE INITIALLY DEFERRED,
+  capability TEXT NOT NULL,
+  method TEXT NOT NULL,
+  target TEXT NOT NULL,
+  payload TEXT NOT NULL,
+  input_digest TEXT NOT NULL,
+  units INTEGER NOT NULL,
+  lease_key TEXT NOT NULL,
+  recovery_limit INTEGER NOT NULL,
+  status TEXT NOT NULL,
+  reason TEXT,
+  attempts INTEGER NOT NULL,
+  receipt TEXT,
+  worker TEXT,
+  result TEXT,
+  requested_sequence INTEGER NOT NULL REFERENCES events (sequence) DEFERRABLE INITIALLY DEFERRED,
+  wait_sequence INTEGER REFERENCES events (sequence) DEFERRABLE INITIALLY DEFERRED,
+  settled_sequence INTEGER REFERENCES events (sequence) DEFERRABLE INITIALLY DEFERRED
+) STRICT;
+CREATE INDEX operations_run ON operations (run_id);
+CREATE INDEX operations_waiting ON operations (wait_sequence) WHERE status = 'waiting';
+CREATE TABLE leases (
+  resource_key TEXT PRIMARY KEY,
+  operation_id TEXT NOT NULL REFERENCES operations (operation_id) DEFERRABLE INITIALLY DEFERRED,
+  generation INTEGER NOT NULL CHECK (generation > 0),
+  expires_at TEXT NOT NULL,
+  state TEXT NOT NULL CHECK (state IN ('held', 'expired', 'released')),
+  granted_sequence INTEGER NOT NULL REFERENCES events (sequence) DEFERRABLE INITIALLY DEFERRED
+) STRICT;
+CREATE INDEX leases_due ON leases (expires_at) WHERE state = 'held';
+CREATE TABLE effect_evidence (
+  sequence INTEGER PRIMARY KEY REFERENCES events (sequence) DEFERRABLE INITIALLY DEFERRED,
+  run_id TEXT NOT NULL,
+  operation_id TEXT NOT NULL,
+  disposition TEXT NOT NULL,
+  reason TEXT
+) STRICT;
+CREATE TABLE stopped_operations (
+  operation_id TEXT PRIMARY KEY,
+  run_id TEXT NOT NULL REFERENCES runs (run_id) DEFERRABLE INITIALLY DEFERRED,
+  sequence INTEGER NOT NULL REFERENCES events (sequence) DEFERRABLE INITIALLY DEFERRED
+) STRICT;
+CREATE TABLE dispatch_attempts (
+  effect_id TEXT PRIMARY KEY REFERENCES deliveries (effect_id) DEFERRABLE INITIALLY DEFERRED,
+  purpose TEXT NOT NULL,
+  lease_generation INTEGER,
+  authority_epoch INTEGER NOT NULL
+) STRICT;
+`;

package/dist/src/storage/statements.d.ts

@@ -0,0 +1,9 @@
+export interface Statement {
+    readonly sql: string;
+    readonly parameters: readonly unknown[];
+}
+export declare function upsert(target: {
+    readonly table: string;
+    readonly names: readonly string[];
+    readonly key: number;
+}): string;

package/dist/src/storage/statements.js

@@ -0,0 +1,8 @@
+export function upsert(target) {
+    const { table, names, key } = target;
+    const updates = names
+        .slice(key)
+        .map((name) => `${name} = excluded.${name}`)
+        .join(", ");
+    return `INSERT INTO ${table} (${names.join(", ")}) VALUES (${names.map(() => "?").join(", ")}) ON CONFLICT (${names.slice(0, key).join(", ")}) DO UPDATE SET ${updates}`;
+}

package/dist/src/submission.d.ts

@@ -0,0 +1,42 @@
+import { type Fields } from "./protocol.ts";
+export type SubmissionField = {
+    readonly type: "string";
+    readonly optional?: boolean;
+} | {
+    readonly type: "boolean";
+    readonly optional?: boolean;
+} | {
+    readonly type: "integer";
+    readonly optional?: boolean;
+    readonly minimum?: number;
+    readonly maximum?: number;
+};
+export interface SubmissionContract {
+    readonly maximumBytes: number;
+    readonly fields: Readonly<Record<string, "string" | SubmissionField>>;
+}
+export type SubmissionCheck = {
+    readonly kind: "valid";
+    readonly normalized: string;
+    readonly submission: Fields;
+} | {
+    readonly kind: "rejected";
+    readonly code: string;
+    readonly detail: string;
+};
+export interface SubmissionRequest {
+    readonly workflowId: string;
+    readonly submission: unknown;
+    readonly source: unknown;
+}
+export declare function normalizedRequest(workflowId: string, submission: Fields): string;
+export declare function checkSubmission(contract: SubmissionContract, request: SubmissionRequest): SubmissionCheck;
+export type CheckedResolution = {
+    readonly kind: "resolved";
+    readonly input: string;
+} | {
+    readonly kind: "rejected";
+    readonly code: string;
+    readonly detail: string;
+};
+export declare function checkResolution(value: unknown): CheckedResolution | undefined;

package/dist/src/submission.js

@@ -0,0 +1,71 @@
+import { record } from "./protocol.js";
+function rejected(code, detail) {
+    return { kind: "rejected", code, detail };
+}
+function sorted(fields) {
+    return Object.fromEntries(Object.keys(fields)
+        .sort()
+        .map((key) => [key, fields[key]]));
+}
+function invalidField(contract, submission) {
+    const undeclared = Object.keys(submission).find((key) => !Object.hasOwn(contract.fields, key));
+    if (undeclared !== undefined)
+        return undeclared;
+    return Object.entries(contract.fields).find(([key, rule]) => {
+        if (rule !== "string" && rule.optional && !Object.hasOwn(submission, key))
+            return false;
+        return !validValue(rule, submission[key]);
+    })?.[0];
+}
+function validValue(rule, value) {
+    if (rule === "string" || rule.type === "string")
+        return typeof value === "string" && value.trim().length > 0;
+    if (rule.type === "boolean")
+        return typeof value === "boolean";
+    return (typeof value === "number" &&
+        Number.isInteger(value) &&
+        (rule.minimum === undefined || value >= rule.minimum) &&
+        (rule.maximum === undefined || value <= rule.maximum));
+}
+export function normalizedRequest(workflowId, submission) {
+    return JSON.stringify({ submission: sorted(submission), workflowId });
+}
+export function checkSubmission(contract, request) {
+    if (request.source === "prompt" && !Object.hasOwn(contract.fields, "prompt"))
+        return rejected("unsupported-prompt", "The workflow does not accept a prompt. Use --input with its fields.");
+    const submission = record(request.submission);
+    if (submission === undefined)
+        return rejected("invalid-submission", "The submission is not an object.");
+    const bytes = new TextEncoder().encode(JSON.stringify(submission)).length;
+    if (bytes > contract.maximumBytes)
+        return rejected("input-too-large", `The input has ${String(bytes)} bytes. The limit is ${String(contract.maximumBytes)}.`);
+    const field = invalidField(contract, submission);
+    if (field !== undefined)
+        return rejected("invalid-submission", `Field ${field} is not valid.`);
+    return {
+        kind: "valid",
+        normalized: normalizedRequest(request.workflowId, submission),
+        submission,
+    };
+}
+function inputText(input) {
+    try {
+        const text = JSON.stringify(input);
+        return typeof text === "string" ? text : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function checkResolution(value) {
+    const fields = record(value);
+    if (fields === undefined)
+        return undefined;
+    const { kind, code, detail } = fields;
+    if (kind === "rejected" && typeof code === "string" && code.length > 0)
+        return { kind, code, detail: typeof detail === "string" ? detail : code };
+    if (kind !== "resolved")
+        return undefined;
+    const input = inputText(fields["input"]);
+    return input === undefined ? undefined : { kind, input };
+}

package/dist/src/turn-profile.d.ts

@@ -0,0 +1,13 @@
+export interface TurnProfile {
+    readonly env?: Readonly<Record<string, string>>;
+    readonly allowedTools?: readonly string[];
+    readonly model?: string;
+    readonly permissionMode?: string;
+    readonly maxBudgetUsd?: number;
+    readonly workflows?: readonly string[];
+}
+export type TurnProfiles = Readonly<Record<string, TurnProfile>>;
+export declare function isProfilesFile(value: unknown): value is {
+    readonly profiles: TurnProfiles;
+};
+export declare function profileCommand(command: readonly string[], profile: TurnProfile): readonly string[];

package/dist/src/turn-profile.js

@@ -0,0 +1,100 @@
+const fields = [
+    "env",
+    "allowedTools",
+    "model",
+    "permissionMode",
+    "maxBudgetUsd",
+    "workflows",
+];
+const reserved = [
+    "GH_TOKEN",
+    "GITHUB_TOKEN",
+    "GH_ENTERPRISE_TOKEN",
+    "GITHUB_ENTERPRISE_TOKEN",
+    "GH_CONFIG_DIR",
+];
+function record(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function text(value) {
+    return typeof value === "string" && !value.includes("\0");
+}
+function texts(value) {
+    return Array.isArray(value) && value.every(text);
+}
+function environment(value) {
+    return (record(value) &&
+        Object.entries(value).every(([name, item]) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(name) &&
+            !reserved.includes(name) &&
+            text(item)));
+}
+function validField(name, value) {
+    if (name === "env")
+        return environment(value);
+    if (name === "allowedTools" || name === "workflows")
+        return texts(value);
+    if (name === "model" || name === "permissionMode")
+        return text(value);
+    return typeof value === "number" && Number.isFinite(value) && value > 0;
+}
+function profile(value) {
+    return (record(value) &&
+        Object.entries(value).every(([name, item]) => fields.includes(name) && validField(name, item)));
+}
+export function isProfilesFile(value) {
+    if (!record(value) ||
+        Object.keys(value).length !== 1 ||
+        !record(value["profiles"]))
+        return false;
+    return Object.entries(value["profiles"]).every(([name, item]) => /^[A-Za-z0-9_-]{1,119}$/.test(name) && profile(item));
+}
+function replacements(profile) {
+    const values = new Map();
+    if (profile.allowedTools !== undefined)
+        values.set("--allowedTools", profile.allowedTools.join(","));
+    if (profile.model !== undefined)
+        values.set("--model", profile.model);
+    if (profile.permissionMode !== undefined)
+        values.set("--permission-mode", profile.permissionMode);
+    if (profile.maxBudgetUsd !== undefined)
+        values.set("--max-budget-usd", String(profile.maxBudgetUsd));
+    return values;
+}
+function following(argumentsList, index) {
+    let next = index + 1;
+    while (next < argumentsList.length && !argumentsList[next]?.startsWith("-"))
+        next += 1;
+    return next;
+}
+function retained(argumentsList, values) {
+    const kept = [];
+    for (let index = 0; index < argumentsList.length;) {
+        const argument = argumentsList[index] ?? "";
+        const name = argument.split("=")[0] ?? "";
+        const flag = name === "--allowed-tools" ? "--allowedTools" : name;
+        if (!values.has(flag)) {
+            kept.push(argument);
+            index += 1;
+            continue;
+        }
+        if (argument.includes("=")) {
+            index += 1;
+            continue;
+        }
+        index =
+            flag === "--allowedTools" ? following(argumentsList, index) : index + 2;
+    }
+    return kept;
+}
+export function profileCommand(command, profile) {
+    const [executable = "", ...argumentsList] = command;
+    const separator = argumentsList.indexOf("--");
+    const boundary = separator === -1 ? argumentsList.length : separator;
+    const values = replacements(profile);
+    return [
+        executable,
+        ...retained(argumentsList.slice(0, boundary), values),
+        ...[...values].flat(),
+        ...argumentsList.slice(boundary),
+    ];
+}

package/dist/src/workflow-admission.d.ts

@@ -0,0 +1,45 @@
+export interface ToolchainIdentity {
+    readonly sdk: string;
+    readonly world: string;
+    readonly builder: string;
+    readonly node: string;
+    readonly dependencies: string;
+}
+export interface WorkflowRegistration {
+    readonly name: string;
+    readonly workflowId: string;
+    readonly steps: readonly string[];
+    readonly capabilities: readonly string[];
+    readonly resources: readonly string[];
+}
+export interface CompiledWorkflow {
+    readonly manifest: unknown;
+    readonly artifacts: Readonly<Record<string, string>>;
+    readonly resources: Readonly<Record<string, string>>;
+    readonly toolchain: ToolchainIdentity;
+}
+export interface AdmissionPolicy {
+    readonly toolchain: ToolchainIdentity;
+    readonly capabilities: readonly string[];
+}
+export interface ExecutionManifest {
+    readonly name: string;
+    readonly workflowId: string;
+    readonly steps: readonly string[];
+    readonly capabilities: readonly string[];
+    readonly artifacts: Readonly<Record<string, string>>;
+    readonly resources: Readonly<Record<string, string>>;
+    readonly toolchain: ToolchainIdentity;
+}
+export type AdmissionResult = {
+    readonly kind: "admitted";
+    readonly manifest: ExecutionManifest;
+} | {
+    readonly kind: "rejected";
+    readonly reason: string;
+    readonly detail: string;
+};
+export declare function admitWorkflow(proposedRegistration: unknown, admission: {
+    readonly compiled: unknown;
+    readonly policy: AdmissionPolicy;
+}): AdmissionResult;

package/dist/src/workflow-admission.js

@@ -0,0 +1,151 @@
+import { resolveResources } from "./workflow-resources.js";
+const versionedStep = /^step\/\/(?!\.)(?:@[^/@]+\/)?[^@]+@[^/@]+\/\/.+$/;
+export function admitWorkflow(proposedRegistration, admission) {
+    const { compiled: proposedCompiled, policy } = admission;
+    const registration = readRegistration(proposedRegistration);
+    if (!registration)
+        return rejected("invalid-registration", "registration");
+    const compiled = record(proposedCompiled) ?? {};
+    const toolchain = readToolchain(compiled["toolchain"]);
+    const rejection = registrationRejection(registration, policy) ??
+        toolchainRejection(toolchain, policy.toolchain) ??
+        manifestRejection(registration, compiled["manifest"]);
+    if (rejection)
+        return rejection;
+    const artifacts = readArtifacts(compiled["artifacts"]);
+    if (!artifacts)
+        return rejected("invalid-artifacts", "artifacts");
+    const resources = resolveResources(registration.resources, compiled["resources"]);
+    if (resources.kind === "inaccessible")
+        return rejected("inaccessible-resource", resources.path);
+    return {
+        kind: "admitted",
+        manifest: Object.freeze({
+            name: registration.name,
+            workflowId: registration.workflowId,
+            steps: Object.freeze([...registration.steps]),
+            capabilities: Object.freeze([...registration.capabilities]),
+            artifacts: Object.freeze(artifacts),
+            resources: Object.freeze(resources.resources),
+            toolchain: Object.freeze(toolchain),
+        }),
+    };
+}
+function readRegistration(value) {
+    const fields = record(value);
+    if (!fields)
+        return null;
+    const { name, workflowId, steps, capabilities, resources } = fields;
+    if (typeof name !== "string" ||
+        typeof workflowId !== "string" ||
+        !textList(steps) ||
+        !textList(capabilities) ||
+        !textList(resources))
+        return null;
+    return { name, workflowId, steps, capabilities, resources };
+}
+function readToolchain(value) {
+    const fields = record(value) ?? {};
+    const textField = (key) => {
+        const field = fields[key];
+        return typeof field === "string" ? field : "";
+    };
+    return {
+        sdk: textField("sdk"),
+        world: textField("world"),
+        builder: textField("builder"),
+        node: textField("node"),
+        dependencies: textField("dependencies"),
+    };
+}
+function readArtifacts(value) {
+    const entries = [];
+    for (const [name, digest] of Object.entries(record(value) ?? {})) {
+        if (typeof digest !== "string" || !/^[0-9a-f]{64}$/.test(digest))
+            return null;
+        entries.push([name, digest]);
+    }
+    return entries.length > 0 ? Object.fromEntries(entries) : null;
+}
+function textList(value) {
+    return (Array.isArray(value) && value.every((item) => typeof item === "string"));
+}
+function registrationRejection(registration, policy) {
+    if (!text(registration.name) ||
+        !text(registration.workflowId) ||
+        !distinctTexts(registration.steps) ||
+        !distinctTexts(registration.capabilities) ||
+        !distinctTexts(registration.resources))
+        return rejected("invalid-registration", "registration");
+    const unversioned = registration.steps.find((step) => !versionedStep.test(step));
+    if (unversioned !== undefined)
+        return rejected("unversioned-step", unversioned);
+    const unsupported = registration.capabilities.find((capability) => !policy.capabilities.includes(capability));
+    if (unsupported !== undefined)
+        return rejected("unsupported-capability", unsupported);
+    return null;
+}
+function toolchainRejection(compiled, accepted) {
+    const keys = ["sdk", "world", "builder", "node", "dependencies"];
+    const changed = keys.find((key) => compiled[key] !== accepted[key]);
+    if (changed !== undefined)
+        return rejected("incompatible-toolchain", changed);
+    return null;
+}
+function manifestRejection(registration, manifest) {
+    const registry = readRegistry(manifest);
+    if (!registry)
+        return rejected("invalid-manifest", "manifest");
+    const identifiers = [...registry.workflows, ...registry.steps];
+    const duplicate = identifiers.find((identifier, index) => identifiers.indexOf(identifier) !== index);
+    if (duplicate !== undefined)
+        return rejected("duplicate-registration", duplicate);
+    if (!registry.workflows.includes(registration.workflowId))
+        return rejected("unresolved-workflow", registration.workflowId);
+    const missing = registration.steps.find((step) => !registry.steps.includes(step));
+    if (missing !== undefined)
+        return rejected("unresolved-step", missing);
+    return null;
+}
+function text(value) {
+    return value.trim().length > 0;
+}
+function distinctTexts(values) {
+    return values.every(text) && new Set(values).size === values.length;
+}
+function rejected(reason, detail) {
+    return { kind: "rejected", reason, detail };
+}
+function readRegistry(manifest) {
+    const categories = record(manifest);
+    if (!categories)
+        return null;
+    const workflows = identifiers(categories["workflows"], "workflowId");
+    const steps = identifiers(categories["steps"], "stepId");
+    if (!workflows || !steps)
+        return null;
+    return { workflows, steps };
+}
+function identifiers(category, key) {
+    const files = record(category);
+    if (!files)
+        return null;
+    const found = [];
+    for (const entries of Object.values(files)) {
+        const named = record(entries);
+        if (!named)
+            return null;
+        for (const entry of Object.values(named)) {
+            const identifier = record(entry)?.[key];
+            if (typeof identifier !== "string")
+                return null;
+            found.push(identifier);
+        }
+    }
+    return found;
+}
+function record(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    return Object.fromEntries(Object.entries(value));
+}

package/dist/src/workflow-contracts.d.ts

@@ -0,0 +1,27 @@
+export interface DevelopmentInput {
+    readonly cycleId: string;
+}
+export type CycleOutcome = {
+    readonly kind: "waiting_for_decision";
+    readonly cycleId: string;
+    readonly decisionId: string;
+} | {
+    readonly kind: "blocked";
+    readonly cycleId: string;
+    readonly reason: string;
+    readonly evidenceId: string;
+} | {
+    readonly kind: "handoff_requested";
+    readonly cycleId: string;
+    readonly promotionId: string;
+};
+export type Validation<Value> = {
+    readonly kind: "valid";
+    readonly value: Value;
+} | {
+    readonly kind: "invalid";
+    readonly reason: string;
+};
+export declare function isBlockedReason(value: unknown): value is string;
+export declare function validateDevelopmentInput(value: unknown): Validation<DevelopmentInput>;
+export declare function validateCycleOutcome(value: unknown, input: DevelopmentInput): Validation<CycleOutcome>;