cool-workflow 0.1.97 → 0.2.0

package/dist/orchestrator/app-operations.js

@@ -1,211 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.loadWorkflowFiles = loadWorkflowFiles;
-exports.loadAppManifestFiles = loadAppManifestFiles;
-exports.loadWorkflowApps = loadWorkflowApps;
-exports.loadWorkflowAppById = loadWorkflowAppById;
-exports.loadWorkflowAppTarget = loadWorkflowAppTarget;
-exports.listWorkflows = listWorkflows;
-exports.listApps = listApps;
-exports.showApp = showApp;
-exports.validateApp = validateApp;
-exports.initApp = initApp;
-exports.packageApp = packageApp;
-// Workflow-app management domain operations (v0.1.40 self-audit router pattern).
-// Carved out of CoolWorkflowRunner; pure functions (no instance state). Behavior
-// is identical to the inline versions — the runner-owned calls (resolveFromBase,
-// validateApp) are passed as callbacks so the bodies stay byte-identical.
-const node_fs_1 = __importDefault(require("node:fs"));
-const node_path_1 = __importDefault(require("node:path"));
-const workflow_api_1 = require("../workflow-api");
-const state_1 = require("../state");
-const workflow_app_framework_1 = require("../workflow-app-framework");
-const cli_options_1 = require("./cli-options");
-function loadWorkflowFiles(workflowsDir) {
-    if (!node_fs_1.default.existsSync(workflowsDir))
-        return [];
-    return node_fs_1.default
-        .readdirSync(workflowsDir)
-        .filter((file) => file.endsWith(".workflow.js"))
-        .sort()
-        .map((file) => node_path_1.default.join(workflowsDir, file));
-}
-function loadAppManifestFiles(appsDir) {
-    if (!node_fs_1.default.existsSync(appsDir))
-        return [];
-    return node_fs_1.default
-        .readdirSync(appsDir, { withFileTypes: true })
-        .filter((entry) => entry.isDirectory())
-        .map((entry) => node_path_1.default.join(appsDir, entry.name, "app.json"))
-        .filter((file) => node_fs_1.default.existsSync(file))
-        .sort();
-}
-function loadWorkflowApps(workflowsDir, appsDir) {
-    const records = [
-        ...loadWorkflowFiles(workflowsDir).map((file) => (0, workflow_app_framework_1.loadWorkflowAppFromEntrypoint)(file)),
-        ...loadAppManifestFiles(appsDir).map((file) => (0, workflow_app_framework_1.loadWorkflowAppFromManifest)(file))
-    ].sort((left, right) => {
-        const byId = left.app.id.localeCompare(right.app.id);
-        if (byId)
-            return byId;
-        return (left.source.manifestPath || left.source.entrypointPath || left.source.path)
-            .localeCompare(right.source.manifestPath || right.source.entrypointPath || right.source.path);
-    });
-    const seen = new Map();
-    for (const record of records) {
-        const previous = seen.get(record.app.id);
-        if (previous) {
-            throw new Error(`Duplicate workflow app id ${record.app.id}: ${previous.source.manifestPath || previous.source.entrypointPath || previous.source.path} and ${record.source.manifestPath || record.source.entrypointPath || record.source.path}`);
-        }
-        seen.set(record.app.id, record);
-    }
-    return records;
-}
-function loadWorkflowAppById(workflowsDir, appsDir, appId) {
-    const record = loadWorkflowApps(workflowsDir, appsDir).find((candidate) => candidate.app.id === appId);
-    if (!record)
-        throw new Error(`Workflow app not found: ${appId}`);
-    return record;
-}
-// The runner pre-resolves `target` via resolveFromBase and passes the resolved
-// path; the original `target` is still used for the id-fallback lookup.
-function loadWorkflowAppTarget(workflowsDir, appsDir, resolved, target) {
-    if (!target)
-        throw new Error("Missing workflow app path or id");
-    if (node_fs_1.default.existsSync(resolved)) {
-        const stat = node_fs_1.default.statSync(resolved);
-        if (stat.isDirectory())
-            return (0, workflow_app_framework_1.loadWorkflowAppFromManifest)(node_path_1.default.join(resolved, "app.json"));
-        if (node_path_1.default.basename(resolved) === "app.json" || resolved.endsWith(".json"))
-            return (0, workflow_app_framework_1.loadWorkflowAppFromManifest)(resolved);
-        return (0, workflow_app_framework_1.loadWorkflowAppFromEntrypoint)(resolved);
-    }
-    return loadWorkflowAppById(workflowsDir, appsDir, target);
-}
-function listWorkflows(workflowsDir, appsDir) {
-    return loadWorkflowApps(workflowsDir, appsDir).map((record) => {
-        const summary = (0, workflow_app_framework_1.summarizeWorkflowApp)(record);
-        return {
-            id: summary.id,
-            title: summary.title,
-            summary: summary.summary,
-            file: summary.file
-        };
-    });
-}
-function listApps(workflowsDir, appsDir) {
-    return loadWorkflowApps(workflowsDir, appsDir).map((record) => (0, workflow_app_framework_1.summarizeWorkflowApp)(record));
-}
-function showApp(workflowsDir, appsDir, appId) {
-    const record = loadWorkflowAppById(workflowsDir, appsDir, appId);
-    const summary = (0, workflow_app_framework_1.summarizeWorkflowApp)(record);
-    return {
-        ...summary,
-        source: record.source,
-        app: {
-            schemaVersion: record.app.schemaVersion,
-            id: record.app.id,
-            title: record.app.title,
-            summary: record.app.summary || "",
-            version: record.app.version,
-            author: record.app.author,
-            inputs: record.app.inputs || record.app.workflow.inputs,
-            sandboxProfiles: record.app.sandboxProfiles || record.app.workflow.sandboxProfiles || [],
-            compatibility: record.app.compatibility,
-            metadata: record.app.metadata || {}
-        },
-        workflow: {
-            id: record.app.workflow.id,
-            title: record.app.workflow.title,
-            summary: record.app.workflow.summary || "",
-            limits: record.app.workflow.limits,
-            inputs: record.app.workflow.inputs,
-            sandboxProfiles: record.app.workflow.sandboxProfiles || [],
-            phases: record.app.workflow.phases.map((phase) => ({
-                id: phase.id,
-                name: phase.name,
-                status: phase.status,
-                tasks: phase.tasks.map((task) => ({
-                    id: task.id,
-                    kind: task.kind,
-                    requiresEvidence: Boolean(task.requiresEvidence),
-                    sandboxProfileId: task.sandboxProfileId
-                }))
-            }))
-        }
-    };
-}
-// The runner pre-resolves `target` via resolveFromBase and passes the resolved
-// path; both the try-loader and the catch-branch appPath use resolvedTarget.
-function validateApp(workflowsDir, appsDir, target, resolvedTarget) {
-    try {
-        const record = loadWorkflowAppTarget(workflowsDir, appsDir, resolvedTarget, target);
-        const result = (0, workflow_app_framework_1.validateWorkflowApp)(record.app, {
-            appPath: record.source.manifestPath || record.source.entrypointPath || record.source.path
-        });
-        return {
-            ...result,
-            summary: (0, workflow_app_framework_1.summarizeWorkflowApp)(record)
-        };
-    }
-    catch (error) {
-        const issues = (0, cli_options_1.validationIssuesFromError)(error);
-        return {
-            valid: false,
-            appId: target,
-            appPath: resolvedTarget,
-            issues
-        };
-    }
-}
-// resolveFromBase and validateApp are passed as callbacks so the body stays
-// byte-identical to the runner method (resolveFromBase(...) and validateApp(manifestPath)).
-function initApp(appsDir, appId, options, resolveFromBase, validateApp) {
-    const id = (0, workflow_api_1.slugify)(appId);
-    if (!id)
-        throw new Error("App id must include at least one letter or digit");
-    const title = String(options.title || titleize(id));
-    const destinationDir = resolveFromBase(String(options.directory || options.output || node_path_1.default.join(appsDir, id)));
-    // Reject writes to system-owned directories. The operator may provide any
-    // output path, but writing to /etc, /bin, /usr etc. is never valid.
-    const sysDirs = /^\/(etc|bin|sbin|usr|Library|System|Applications|boot|dev|proc|sys|root|var\/log|var\/run)\//;
-    if (sysDirs.test(node_path_1.default.resolve(destinationDir))) {
-        throw new Error(`Refusing to create app in a system directory: ${destinationDir}`);
-    }
-    const manifestPath = node_path_1.default.join(destinationDir, "app.json");
-    const entrypointPath = node_path_1.default.join(destinationDir, "workflow.js");
-    if (!options.force && (node_fs_1.default.existsSync(manifestPath) || node_fs_1.default.existsSync(entrypointPath))) {
-        throw new Error(`Refusing to overwrite existing workflow app: ${destinationDir}`);
-    }
-    node_fs_1.default.mkdirSync(destinationDir, { recursive: true });
-    node_fs_1.default.writeFileSync(manifestPath, (0, workflow_app_framework_1.renderWorkflowAppManifestTemplate)(id, title), "utf8");
-    node_fs_1.default.writeFileSync(entrypointPath, (0, workflow_app_framework_1.renderWorkflowAppEntrypointTemplate)(id, title), "utf8");
-    const validation = validateApp(manifestPath);
-    if (!validation.valid) {
-        throw new workflow_app_framework_1.WorkflowAppValidationError("Generated workflow app is invalid", validation.issues);
-    }
-    return { id, manifestPath, entrypointPath };
-}
-// resolveFromBase is passed as a callback so the body stays byte-identical.
-function packageApp(workflowsDir, appsDir, appId, options, resolveFromBase) {
-    const record = loadWorkflowAppById(workflowsDir, appsDir, appId);
-    const destination = resolveFromBase(String(options.output || node_path_1.default.join(".cw", "packages", `${record.app.id}-${record.app.version}.cwapp.json`)));
-    node_fs_1.default.mkdirSync(node_path_1.default.dirname(destination), { recursive: true });
-    (0, state_1.writeJson)(destination, {
-        schemaVersion: 1,
-        app: (0, workflow_app_framework_1.workflowAppRunMetadata)(record),
-        workflow: record.app.workflow,
-        packagedAt: new Date().toISOString()
-    });
-    return { id: record.app.id, version: record.app.version, path: destination };
-}
-function titleize(value) {
-    return value
-        .split("-")
-        .filter(Boolean)
-        .map((part) => part.charAt(0).toUpperCase() + part.slice(1))
-        .join(" ");
-}

package/dist/orchestrator/audit-operations.js

@@ -1,182 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.auditSummary = auditSummary;
-exports.auditMultiAgent = auditMultiAgent;
-exports.auditPolicy = auditPolicy;
-exports.auditRole = auditRole;
-exports.auditBlackboard = auditBlackboard;
-exports.auditJudge = auditJudge;
-exports.workerAudit = workerAudit;
-exports.auditEvidenceProvenance = auditEvidenceProvenance;
-exports.recordAuditAttestation = recordAuditAttestation;
-exports.recordAuditDecision = recordAuditDecision;
-// Audit domain operations (v0.1.40 self-audit P3 maintainability).
-//
-// Carved out of the CoolWorkflowRunner god-object as the first domain in the
-// router pattern: every function here takes an already-loaded WorkflowRun and
-// returns a value (mutating ops persist via the run), so the runner method is a
-// thin `loadRun -> delegate` wrapper. Behavior is identical to the inline
-// implementations these replaced; only the location changed.
-const node_path_1 = __importDefault(require("node:path"));
-const state_1 = require("../state");
-const report_1 = require("./report");
-const cli_options_1 = require("./cli-options");
-const worker_isolation_1 = require("../worker-isolation");
-const sandbox_profile_1 = require("../sandbox-profile");
-const trust_audit_1 = require("../trust-audit");
-const multi_agent_trust_1 = require("../multi-agent-trust");
-function auditSummary(run) {
-    return (0, trust_audit_1.summarizeTrustAudit)(run);
-}
-function auditMultiAgent(run) {
-    return (0, multi_agent_trust_1.summarizeMultiAgentTrust)(run);
-}
-function auditPolicy(run) {
-    const summary = (0, multi_agent_trust_1.summarizeMultiAgentTrust)(run);
-    return {
-        schemaVersion: 1,
-        runId: run.id,
-        rolePolicies: summary.rolePolicies,
-        permissionDecisions: summary.permissionDecisions,
-        policyViolations: summary.policyViolations,
-        nextAction: summary.nextAction
-    };
-}
-function auditRole(run, roleId) {
-    const summary = (0, multi_agent_trust_1.summarizeMultiAgentTrust)(run);
-    const events = (0, trust_audit_1.listTrustAuditEvents)(run).filter((event) => event.agentRoleId === roleId);
-    return {
-        schemaVersion: 1,
-        runId: run.id,
-        roleId,
-        role: run.multiAgent?.roles.find((entry) => entry.id === roleId),
-        rolePolicies: summary.rolePolicies.filter((entry) => entry.subjectId === roleId),
-        permissionDecisions: events.filter((event) => event.kind === "multi-agent.permission"),
-        blackboardWrites: events.filter((event) => event.kind === "blackboard.write"),
-        messageProvenance: events.filter((event) => event.kind === "blackboard.message-provenance"),
-        judgeRationales: events.filter((event) => event.kind === "judge.rationale"),
-        panelDecisions: events.filter((event) => event.kind === "judge.panel-decision"),
-        policyViolations: events.filter((event) => event.kind === "policy.violation"),
-        events,
-        nextAction: `node scripts/cw.js audit multi-agent ${run.id} --json`
-    };
-}
-function auditBlackboard(run) {
-    const summary = (0, multi_agent_trust_1.summarizeMultiAgentTrust)(run);
-    return {
-        schemaVersion: 1,
-        runId: run.id,
-        blackboardWrites: summary.blackboardWrites,
-        messageProvenance: summary.messageProvenance,
-        policyViolations: summary.policyViolations.filter((event) => event.blackboardId),
-        nextAction: summary.nextAction
-    };
-}
-function auditJudge(run) {
-    const summary = (0, multi_agent_trust_1.summarizeMultiAgentTrust)(run);
-    return {
-        schemaVersion: 1,
-        runId: run.id,
-        judgeRationales: summary.judgeRationales,
-        panelDecisions: summary.panelDecisions,
-        permissionDecisions: summary.permissionDecisions.filter((event) => String(event.metadata?.operation || "").startsWith("judge.")),
-        policyViolations: summary.policyViolations.filter((event) => String(event.metadata?.operation || "").startsWith("judge.")),
-        nextAction: summary.nextAction
-    };
-}
-function workerAudit(run, workerId) {
-    return (0, trust_audit_1.workerTrustAudit)(run, workerId);
-}
-function auditEvidenceProvenance(run, options = {}) {
-    return (0, trust_audit_1.evidenceProvenance)(run, {
-        workerId: (0, cli_options_1.stringOption)(options.worker || options.workerId),
-        candidateId: (0, cli_options_1.stringOption)(options.candidate || options.candidateId),
-        commitId: (0, cli_options_1.stringOption)(options.commit || options.commitId)
-    });
-}
-function recordAuditAttestation(run, options = {}) {
-    const workerId = (0, cli_options_1.stringOption)(options.worker || options.workerId);
-    const worker = workerId ? (0, worker_isolation_1.getWorkerScope)(run, workerId) : undefined;
-    const event = (0, trust_audit_1.recordHostAttestation)(run, {
-        actor: (0, cli_options_1.stringOption)(options.actor) || "host",
-        workerId,
-        taskId: worker?.taskId || (0, cli_options_1.stringOption)(options.task || options.taskId),
-        sandboxProfileId: worker?.sandboxProfileId || (0, cli_options_1.stringOption)(options.sandboxProfileId),
-        policySnapshot: worker?.sandboxPolicy,
-        command: (0, cli_options_1.stringOption)(options.command),
-        networkTarget: (0, cli_options_1.stringOption)(options.network || options.networkTarget),
-        envVars: (0, cli_options_1.valuesOption)(options.env || options.envVar || options.envVars),
-        metadata: {
-            note: (0, cli_options_1.stringOption)(options.note || options.message),
-            hostEnforced: options.hostEnforced === undefined ? undefined : Boolean(options.hostEnforced)
-        }
-    });
-    (0, state_1.saveCheckpoint)(run);
-    return event;
-}
-function recordAuditDecision(run, workerId, options = {}) {
-    const worker = (0, worker_isolation_1.getWorkerScope)(run, workerId);
-    if (!worker)
-        throw new Error(`Unknown worker id for run ${run.id}: ${workerId}`);
-    const kind = (0, cli_options_1.stringOption)(options.kind) || (0, cli_options_1.inferAuditDecisionKind)(options);
-    const target = (0, cli_options_1.stringOption)(options.path || options.command || options.network || options.networkTarget || options.env || options.envVar);
-    if (!target)
-        throw new Error("Missing audit decision target: provide --path, --command, --network, or --env");
-    const policy = worker.sandboxPolicy;
-    let denied = null;
-    if (kind === "sandbox.command") {
-        denied = policy ? (0, sandbox_profile_1.validateSandboxCommand)(policy, target, workerId) : null;
-    }
-    else if (kind === "sandbox.network") {
-        denied = policy ? (0, sandbox_profile_1.validateSandboxNetwork)(policy, target, workerId) : null;
-    }
-    else if (kind === "sandbox.env") {
-        const name = target.includes("=") ? target.split("=")[0] : target;
-        const allowed = Boolean(policy?.env.inherit || policy?.env.expose.includes(name));
-        denied = allowed ? null : { code: "sandbox-env-denied", message: `Worker ${workerId} env var is outside sandbox profile ${policy?.id || "unknown"}: ${name}` };
-    }
-    else {
-        denied = (0, worker_isolation_1.validateWorkerBoundary)(run, workerId, { path: target });
-    }
-    const feedbackIds = [];
-    if (denied) {
-        const failure = (0, worker_isolation_1.recordWorkerFailure)(run, workerId, {
-            code: denied.code,
-            message: denied.message,
-            at: new Date().toISOString(),
-            path: denied.path || (kind === "sandbox.path" ? node_path_1.default.resolve(target) : undefined),
-            retryable: false
-        }, { persist: false });
-        feedbackIds.push(...(failure.feedbackIds || []));
-    }
-    const event = kind === "sandbox.path"
-        ? (0, trust_audit_1.recordSandboxPathDecision)(run, {
-            workerId,
-            taskId: worker.taskId,
-            sandboxProfileId: worker.sandboxProfileId,
-            policySnapshot: policy,
-            target,
-            decision: denied ? "denied" : "allowed",
-            feedbackIds,
-            metadata: { code: denied?.code }
-        })
-        : (0, trust_audit_1.recordSandboxPolicyDecision)(run, {
-            kind,
-            decision: denied ? "denied" : "allowed",
-            workerId,
-            taskId: worker.taskId,
-            sandboxProfileId: worker.sandboxProfileId,
-            policySnapshot: policy,
-            command: kind === "sandbox.command" ? target : undefined,
-            networkTarget: kind === "sandbox.network" ? target : undefined,
-            envVars: kind === "sandbox.env" ? [target.includes("=") ? target.split("=")[0] : target] : undefined,
-            feedbackIds,
-            metadata: { code: denied?.code }
-        });
-    (0, report_1.writeReport)(run);
-    (0, state_1.saveCheckpoint)(run);
-    return event;
-}

package/dist/orchestrator/candidate-operations.js

@@ -1,117 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.listCandidates = listCandidates;
-exports.showCandidate = showCandidate;
-exports.registerCandidate = registerCandidate;
-exports.scoreCandidate = scoreCandidate;
-exports.rankCandidates = rankCandidates;
-exports.selectCandidate = selectCandidate;
-exports.rejectCandidate = rejectCandidate;
-// Candidate domain operations (v0.1.40 self-audit P3 router pattern).
-// Carved out of CoolWorkflowRunner; each function takes a loaded run. Behavior is
-// identical to the inline implementations — only the location changed.
-const node_path_1 = __importDefault(require("node:path"));
-const state_1 = require("../state");
-const report_1 = require("./report");
-const cli_options_1 = require("./cli-options");
-const worker_isolation_1 = require("../worker-isolation");
-const candidate_scoring_1 = require("../candidate-scoring");
-function listCandidates(run, options = {}) {
-    return (0, candidate_scoring_1.listCandidates)(run, {
-        status: options.status ? String(options.status) : undefined,
-        kind: options.kind ? String(options.kind) : undefined
-    });
-}
-function showCandidate(run, candidateId) {
-    const candidate = (0, candidate_scoring_1.getCandidate)(run, candidateId);
-    if (!candidate)
-        throw new Error(`Unknown candidate id for run ${run.id}: ${candidateId}`);
-    return candidate;
-}
-function registerCandidate(run, options = {}) {
-    const workerId = options.worker ? String(options.worker) : undefined;
-    const worker = workerId ? (0, worker_isolation_1.getWorkerScope)(run, workerId) : undefined;
-    if (workerId && !worker)
-        throw new Error(`Unknown worker id for run ${run.id}: ${workerId}`);
-    const task = worker ? run.tasks.find((candidate) => candidate.id === worker.taskId) : undefined;
-    const resultNodeId = (0, cli_options_1.stringOption)(options.resultNode) || worker?.resultNodeId || task?.resultNodeId;
-    const verifierNodeId = (0, cli_options_1.stringOption)(options.verifierNode) || worker?.output?.verifierNodeId || task?.verifierNodeId;
-    const resultPath = (0, cli_options_1.stringOption)(options.resultPath) || worker?.output?.resultPath || task?.resultPath;
-    const resultNode = resultNodeId ? run.nodes?.find((node) => node.id === resultNodeId) : undefined;
-    const verifierNode = verifierNodeId ? run.nodes?.find((node) => node.id === verifierNodeId) : undefined;
-    const candidate = (0, candidate_scoring_1.registerCandidate)(run, {
-        id: (0, cli_options_1.stringOption)(options.id),
-        kind: (0, cli_options_1.stringOption)(options.kind),
-        workerId,
-        taskId: (0, cli_options_1.stringOption)(options.task) || worker?.taskId,
-        resultNodeId,
-        verifierNodeId,
-        resultPath,
-        artifacts: [
-            ...(resultPath ? [{ id: "result", kind: "markdown", path: node_path_1.default.resolve(resultPath) }] : []),
-            ...(worker ? [{ id: "worker", kind: "json", path: node_path_1.default.join(worker.workerDir, "worker.json") }] : [])
-        ],
-        evidence: (0, cli_options_1.mergeEvidence)(resultNode?.evidence || [], verifierNode?.evidence || []),
-        metadata: {
-            source: worker ? "worker" : "manual",
-            workerDir: worker?.workerDir
-        }
-    }, { persist: false });
-    (0, report_1.writeReport)(run);
-    (0, state_1.saveCheckpoint)(run);
-    return candidate;
-}
-function scoreCandidate(run, candidateId, options = {}) {
-    const score = (0, candidate_scoring_1.scoreCandidate)(run, candidateId, {
-        id: (0, cli_options_1.stringOption)(options.id),
-        scorer: (0, cli_options_1.stringOption)(options.scorer),
-        criteria: (0, cli_options_1.parseCriteria)(options),
-        maxTotal: (0, cli_options_1.numberOption)(options.maxTotal || options.max),
-        verdict: (0, cli_options_1.stringOption)(options.verdict),
-        evidence: (0, cli_options_1.parseEvidence)(options.evidence),
-        notes: (0, cli_options_1.stringOption)(options.notes)
-    }, { persist: false });
-    (0, report_1.writeReport)(run);
-    (0, state_1.saveCheckpoint)(run);
-    return score;
-}
-function rankCandidates(run, options = {}) {
-    const ranking = (0, candidate_scoring_1.rankCandidates)(run, {
-        includeRejected: Boolean(options.includeRejected),
-        policy: {
-            minNormalized: (0, cli_options_1.numberOption)(options.minNormalized),
-            requireEvidence: options.requireEvidence === undefined ? undefined : Boolean(options.requireEvidence),
-            requireVerifierGate: options.requireVerifierGate === undefined ? undefined : Boolean(options.requireVerifierGate),
-            tieBreaker: (0, cli_options_1.stringOption)(options.tieBreaker)
-        }
-    });
-    (0, report_1.writeReport)(run);
-    (0, state_1.saveCheckpoint)(run);
-    return ranking;
-}
-function selectCandidate(run, candidateId, options = {}) {
-    const selection = (0, candidate_scoring_1.selectCandidate)(run, candidateId, {
-        selectedBy: (0, cli_options_1.stringOption)(options.by) || (0, cli_options_1.stringOption)(options.selectedBy),
-        reason: (0, cli_options_1.stringOption)(options.reason),
-        scoreId: (0, cli_options_1.stringOption)(options.score),
-        allowUnverified: Boolean(options.allowUnverified)
-    }, {
-        persist: false,
-        policy: {
-            minNormalized: (0, cli_options_1.numberOption)(options.minNormalized),
-            requireVerifierGate: options.requireVerifierGate === undefined ? undefined : Boolean(options.requireVerifierGate)
-        }
-    });
-    (0, report_1.writeReport)(run);
-    (0, state_1.saveCheckpoint)(run);
-    return selection;
-}
-function rejectCandidate(run, candidateId, reason) {
-    const candidate = (0, candidate_scoring_1.rejectCandidate)(run, candidateId, reason, { persist: false });
-    (0, report_1.writeReport)(run);
-    (0, state_1.saveCheckpoint)(run);
-    return candidate;
-}