@archmax-ai/harness 0.0.0

package/dist/machine/slug.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slug.js","sourceRoot":"","sources":["../../src/machine/slug.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAEzD,6CAA6C;AAC7C,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC"}

package/dist/machine/spec-schema.d.ts

@@ -0,0 +1,662 @@
+/**
+ * The complete `workflow.yaml` schema, in Zod — the one source for every rule a
+ * single document has to satisfy. Two layers: the **shape** (`machineSpecSchema`,
+ * every object `.strict()` so a misspelled key is an error naming the key) and
+ * the **cross-references inside the document** (`refineSpec`), which run once
+ * the shape holds. `types.ts` infers its types from here; `load-spec.ts` and
+ * `validate` both parse through `parseMachineSpec`. Warnings live in `lint-spec.ts`.
+ */
+import { z } from "zod";
+/**
+ * How a state may use a mount it is given: `read` refuses writes there,
+ * `read_write` permits them where the host declared the mount writable.
+ *
+ * The host's `readOnly` posture is a **ceiling**, not a default to argue with: a
+ * mount served read-only stays read-only wherever it appears, and `read_write`
+ * on one is inert (reported by `validate`). What this key adds is the other
+ * direction — narrowing a writable mount to reads in the states that only need
+ * to read it — which is the direction every level of this schema may move.
+ */
+export declare const mountAccessSchema: z.ZodEnum<{
+    read: "read";
+    read_write: "read_write";
+}>;
+export declare const mountGrantEntrySchema: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+    mount: z.ZodString;
+    access: z.ZodOptional<z.ZodEnum<{
+        read: "read";
+        read_write: "read_write";
+    }>>;
+}, z.core.$strict>]>;
+/**
+ * @see SpecMetadata
+ *
+ * One loose, named slot for host data the runtime never reads (an authoring UI's
+ * canvas state, a node's position) — rather than a `.catchall()`, which would
+ * switch off the strictness this file exists for. Accepted at three positions:
+ * the spec root, a state, and a rubric declaration.
+ */
+export declare const specMetadataSchema: z.ZodObject<{}, z.core.$loose>;
+/**
+ * @see RubricDeclaration
+ *
+ * A grading rubric: the standard a state's exit is measured against, declared
+ * **inline on the hook that applies it**. `instructions` is the only required
+ * key — the same word a state uses for the prose telling a model what to do.
+ *
+ * There is deliberately no name: a rubric is not a first-order item a hook
+ * points at, it is part of the state's own declaration, so reading the state
+ * tells you the whole standard without a lookup. The cost is duplication when
+ * two states want the same grader, which is accepted: a state is legible on its
+ * own, and nothing silently changes what one state grades against by editing
+ * something elsewhere. There is no `title` either (nothing routes to a rubric)
+ * and no `description`; a host label goes in `metadata`.
+ */
+export declare const rubricDeclarationSchema: z.ZodObject<{
+    instructions: z.ZodString;
+    max_iterations: z.ZodOptional<z.ZodNumber>;
+    model: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
+}, z.core.$strict>;
+/**
+ * One lifecycle hook. The built-in kinds are strict; the custom-kind branch (a
+ * record of strings, for an executor registered at assembly) is fenced so it
+ * cannot rescue a malformed built-in — `{ script: <bad path> }` must fail the
+ * script branch and stay failed.
+ */
+export declare const hookSchema: z.ZodUnion<readonly [z.ZodObject<{
+    script: z.ZodString;
+    max_iterations: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>, z.ZodObject<{
+    rubric: z.ZodObject<{
+        instructions: z.ZodString;
+        max_iterations: z.ZodOptional<z.ZodNumber>;
+        model: z.ZodOptional<z.ZodString>;
+        metadata: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodRecord<z.ZodString, z.ZodString>]>;
+/** @see HookSpec */
+export declare const hookSpecSchema: z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
+    script: z.ZodString;
+    max_iterations: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>, z.ZodObject<{
+    rubric: z.ZodObject<{
+        instructions: z.ZodString;
+        max_iterations: z.ZodOptional<z.ZodNumber>;
+        model: z.ZodOptional<z.ZodString>;
+        metadata: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodRecord<z.ZodString, z.ZodString>]>, z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+    script: z.ZodString;
+    max_iterations: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>, z.ZodObject<{
+    rubric: z.ZodObject<{
+        instructions: z.ZodString;
+        max_iterations: z.ZodOptional<z.ZodNumber>;
+        model: z.ZodOptional<z.ZodString>;
+        metadata: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodRecord<z.ZodString, z.ZodString>]>>]>;
+/** @see TransitionType */
+export declare const transitionTypeSchema: z.ZodEnum<{
+    approve: "approve";
+    reject: "reject";
+    refine: "refine";
+    none: "none";
+}>;
+/** @see MachineTransition */
+export declare const machineTransitionSchema: z.ZodObject<{
+    to: z.ZodString;
+    description: z.ZodString;
+    type: z.ZodOptional<z.ZodEnum<{
+        approve: "approve";
+        reject: "reject";
+        refine: "refine";
+        none: "none";
+    }>>;
+}, z.core.$strict>;
+/** @see StateBudget */
+export declare const stateBudgetSchema: z.ZodObject<{
+    maxTurns: z.ZodOptional<z.ZodNumber>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+    maxParks: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+/** @see AllowEntry */
+export declare const allowEntrySchema: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+    tool: z.ZodString;
+    args: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
+    paths: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+    connection: z.ZodOptional<z.ZodString>;
+    source: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>]>;
+/**
+ * @see ForbidEntry
+ *
+ * The same entry grammar as {@link allowEntrySchema} — one derivation, one
+ * matcher, one guard validation — with one addition the deny side needs and the
+ * grant side must not have: the tool may be `*`, meaning **every** tool. That is
+ * how a path is denied across the board (`{ tool: "*", paths: [logs/**] }`),
+ * where a wildcard can only ever close the surface further. A `*` in an `allow`
+ * list is a document-level error (`refineSpec`): allow-only governance means an
+ * author names what a state may do.
+ */
+export declare const forbidEntrySchema: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+    tool: z.ZodString;
+    args: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
+    paths: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+    connection: z.ZodOptional<z.ZodString>;
+    source: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>]>;
+/** The tool name that denies every tool. Accepted in a forbid entry only. */
+export declare const FORBID_ANY_TOOL = "*";
+/**
+ * @see ToolsBlock — a **state's** tools block.
+ *
+ * `allow` adds to the workflow's `tools.allow_always`; `forbid` denies here,
+ * beating every grant that would otherwise reach this state — the workflow's
+ * always-on grant, this state's own `allow`, and the always-on surface alike.
+ * Deny beats allow, and no narrower level widens a denial.
+ */
+export declare const toolsBlockSchema: z.ZodObject<{
+    allow: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        tool: z.ZodString;
+        args: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
+        paths: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+        connection: z.ZodOptional<z.ZodString>;
+        source: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>]>>>;
+    forbid: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        tool: z.ZodString;
+        args: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
+        paths: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+        connection: z.ZodOptional<z.ZodString>;
+        source: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>]>>>;
+}, z.core.$strict>;
+/**
+ * @see SkillsBlock — a **state's** skills block, and only a state's: the spec
+ * root has its own shape ({@link workflowSkillsConfigSchema}), the way `tools`
+ * already splits its two positions.
+ *
+ * `allow` is optional rather than defaulted because `skills:` is itself optional:
+ * an absent list and `allow: []` mean the same thing — nothing this state adds —
+ * so the default belongs where the set is resolved
+ * (`WorkflowMachine.enabledSkills`), not in the parse, where a whole absent block
+ * would slip past it anyway.
+ */
+export declare const skillsBlockSchema: z.ZodObject<{
+    allow: z.ZodOptional<z.ZodArray<z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>>>;
+    forbid: z.ZodOptional<z.ZodArray<z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>>>;
+}, z.core.$strict>;
+/**
+ * @see MountsBlock — a **state's** mounts block, and only a state's: the spec
+ * root has its own shape ({@link workflowMountsConfigSchema}), the way `tools`
+ * and `skills` already split their two positions.
+ *
+ * The block governs the mount names the **host** declared governed
+ * (`MountSpec.governed`); an ungoverned mount is visible in every state without
+ * a grant, and `forbid` is what subtracts it. Precedence is the one rule every
+ * capability here follows: `allow` adds to the root's `allow_always`, and a
+ * denial from either level beats every grant.
+ *
+ * `allow` is optional rather than defaulted for the same reason `skills.allow`
+ * is: an absent list and `allow: []` both add nothing, so the default belongs
+ * where the set is resolved (`WorkflowMachine.enabledMounts`).
+ */
+export declare const mountsBlockSchema: z.ZodObject<{
+    allow: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        mount: z.ZodString;
+        access: z.ZodOptional<z.ZodEnum<{
+            read: "read";
+            read_write: "read_write";
+        }>>;
+    }, z.core.$strict>]>>>;
+    forbid: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+/** @see StateType */
+export declare const stateTypeSchema: z.ZodEnum<{
+    human: "human";
+    agent: "agent";
+}>;
+/**
+ * @see TriggerDeclaration
+ *
+ * Loose, not strict: a declaration is host-extensible — it may carry keys the
+ * SDK preserves without acting on, and `lint-spec.ts` warns about them. The two
+ * in {@link REFUSED_TRIGGER_KEYS} are errors instead.
+ */
+export declare const triggerDeclarationSchema: z.ZodObject<{
+    session: z.ZodOptional<z.ZodString>;
+    message: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodString]>>;
+    connection: z.ZodOptional<z.ZodString>;
+    requires: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    returns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$loose>;
+/**
+ * A state's `triggers:` — the one place a trigger is declared. The key is the
+ * trigger id, the state the mapping sits on is that trigger's entry state, and
+ * the value is the declaration. A `null` value (`manual:` with nothing under
+ * it) declares the id and nothing more.
+ */
+export declare const stateTriggersSchema: z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodObject<{
+    session: z.ZodOptional<z.ZodString>;
+    message: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodString]>>;
+    connection: z.ZodOptional<z.ZodString>;
+    requires: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    returns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$loose>>>;
+/** @see MachineState */
+export declare const machineStateSchema: z.ZodObject<{
+    type: z.ZodOptional<z.ZodEnum<{
+        human: "human";
+        agent: "agent";
+    }>>;
+    title: z.ZodOptional<z.ZodString>;
+    instructions: z.ZodOptional<z.ZodString>;
+    summary: z.ZodOptional<z.ZodString>;
+    evidence: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    approvers: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    triggers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodObject<{
+        session: z.ZodOptional<z.ZodString>;
+        message: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodString]>>;
+        connection: z.ZodOptional<z.ZodString>;
+        requires: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        returns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$loose>>>>;
+    before: z.ZodOptional<z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
+        script: z.ZodString;
+        max_iterations: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>, z.ZodObject<{
+        rubric: z.ZodObject<{
+            instructions: z.ZodString;
+            max_iterations: z.ZodOptional<z.ZodNumber>;
+            model: z.ZodOptional<z.ZodString>;
+            metadata: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodRecord<z.ZodString, z.ZodString>]>, z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        script: z.ZodString;
+        max_iterations: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>, z.ZodObject<{
+        rubric: z.ZodObject<{
+            instructions: z.ZodString;
+            max_iterations: z.ZodOptional<z.ZodNumber>;
+            model: z.ZodOptional<z.ZodString>;
+            metadata: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodRecord<z.ZodString, z.ZodString>]>>]>>;
+    after: z.ZodOptional<z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
+        script: z.ZodString;
+        max_iterations: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>, z.ZodObject<{
+        rubric: z.ZodObject<{
+            instructions: z.ZodString;
+            max_iterations: z.ZodOptional<z.ZodNumber>;
+            model: z.ZodOptional<z.ZodString>;
+            metadata: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodRecord<z.ZodString, z.ZodString>]>, z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        script: z.ZodString;
+        max_iterations: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>, z.ZodObject<{
+        rubric: z.ZodObject<{
+            instructions: z.ZodString;
+            max_iterations: z.ZodOptional<z.ZodNumber>;
+            model: z.ZodOptional<z.ZodString>;
+            metadata: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodRecord<z.ZodString, z.ZodString>]>>]>>;
+    budget: z.ZodOptional<z.ZodObject<{
+        maxTurns: z.ZodOptional<z.ZodNumber>;
+        timeoutMs: z.ZodOptional<z.ZodNumber>;
+        maxParks: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+    model: z.ZodOptional<z.ZodString>;
+    on_error: z.ZodOptional<z.ZodString>;
+    tools: z.ZodOptional<z.ZodObject<{
+        allow: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            tool: z.ZodString;
+            args: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
+            paths: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+            connection: z.ZodOptional<z.ZodString>;
+            source: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>]>>>;
+        forbid: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            tool: z.ZodString;
+            args: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
+            paths: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+            connection: z.ZodOptional<z.ZodString>;
+            source: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>]>>>;
+    }, z.core.$strict>>;
+    skills: z.ZodOptional<z.ZodObject<{
+        allow: z.ZodOptional<z.ZodArray<z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>>>;
+        forbid: z.ZodOptional<z.ZodArray<z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>>>;
+    }, z.core.$strict>>;
+    mounts: z.ZodOptional<z.ZodObject<{
+        allow: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            mount: z.ZodString;
+            access: z.ZodOptional<z.ZodEnum<{
+                read: "read";
+                read_write: "read_write";
+            }>>;
+        }, z.core.$strict>]>>>;
+        forbid: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+    requires: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    metadata: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
+    transitions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        to: z.ZodString;
+        description: z.ZodString;
+        type: z.ZodOptional<z.ZodEnum<{
+            approve: "approve";
+            reject: "reject";
+            refine: "refine";
+            none: "none";
+        }>>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+/** @see WorkflowToolsConfig */
+/**
+ * @see WorkflowToolsConfig — the spec root's tools block.
+ *
+ * `allow_always` is granted in every state; `forbid_always` is denied in every
+ * state and is **absolute** — no state grant, argument guard or consumer rule
+ * reaches past it, and a sub-workflow inherits it from every ancestor. The
+ * superseded `policy` block denies alongside it: denials union, because a denial
+ * can only ever close a surface further.
+ */
+export declare const workflowToolsConfigSchema: z.ZodObject<{
+    allow_always: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        tool: z.ZodString;
+        args: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
+        paths: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+        connection: z.ZodOptional<z.ZodString>;
+        source: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>]>>>;
+    forbid_always: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        tool: z.ZodString;
+        args: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
+        paths: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+        connection: z.ZodOptional<z.ZodString>;
+        source: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>]>>>;
+}, z.core.$strict>;
+/**
+ * @see WorkflowSkillsConfig — the spec root's skills block.
+ *
+ * `allow_always` lists the slugs enabled in **every** state; a state's
+ * `skills.allow` adds to it, exactly as `tools.allow` adds to
+ * `tools.allow_always`. `forbid_always` denies its slugs in every state and
+ * beats every grant, the way `tools.forbid_always` does. There is one model:
+ * the ceiling `allow` this key used to accept is retired, so a root `allow` is
+ * an unrecognized key.
+ */
+export declare const workflowSkillsConfigSchema: z.ZodObject<{
+    allow_always: z.ZodOptional<z.ZodArray<z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>>>;
+    forbid_always: z.ZodOptional<z.ZodArray<z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>>>;
+}, z.core.$strict>;
+/**
+ * @see WorkflowMountsConfig — the spec root's mounts block.
+ *
+ * `allow_always` lists the governed mounts enabled in **every** state; a state's
+ * `mounts.allow` adds to it, exactly as `skills.allow` adds to
+ * `skills.allow_always`. `forbid_always` denies its names in every state —
+ * governed or not — and beats every grant, and binds every descendant session.
+ * There is one model: a root `allow` is an unrecognized key.
+ */
+export declare const workflowMountsConfigSchema: z.ZodObject<{
+    allow_always: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        mount: z.ZodString;
+        access: z.ZodOptional<z.ZodEnum<{
+            read: "read";
+            read_write: "read_write";
+        }>>;
+    }, z.core.$strict>]>>>;
+    forbid_always: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+/** @see MachinePromptCacheSettings */
+export declare const machinePromptCacheSettingsSchema: z.ZodObject<{
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    ttl: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/** @see MachineSettings — delegation bounds are the dispatcher's configuration, not settings here. */
+export declare const machineSettingsSchema: z.ZodObject<{
+    model: z.ZodOptional<z.ZodString>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+    memoryLimitBytes: z.ZodOptional<z.ZodNumber>;
+    maxPtcCalls: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    maxResultChars: z.ZodOptional<z.ZodNumber>;
+    prompt_cache: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        ttl: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** @see WorkflowTestsConfig */
+export declare const workflowTestsConfigSchema: z.ZodObject<{
+    maxConcurrency: z.ZodOptional<z.ZodNumber>;
+    caseTimeoutMs: z.ZodOptional<z.ZodNumber>;
+    judge: z.ZodOptional<z.ZodObject<{
+        model: z.ZodOptional<z.ZodString>;
+        modelOptions: z.ZodOptional<z.ZodObject<{
+            temperature: z.ZodOptional<z.ZodNumber>;
+            maxTokens: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/** @see RuntimeMetadata */
+export declare const runtimeMetadataSchema: z.ZodObject<{
+    engine: z.ZodOptional<z.ZodString>;
+    version: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+}, z.core.$strict>;
+/** @see SpecExtensions */
+export declare const specExtensionsSchema: z.ZodObject<{
+    hooks: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+/** The whole of `workflow.yaml`. @see MachineSpec */
+export declare const machineSpecSchema: z.ZodObject<{
+    title: z.ZodOptional<z.ZodString>;
+    instructions: z.ZodOptional<z.ZodString>;
+    disabled: z.ZodOptional<z.ZodBoolean>;
+    runtime: z.ZodOptional<z.ZodObject<{
+        engine: z.ZodOptional<z.ZodString>;
+        version: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+    }, z.core.$strict>>;
+    settings: z.ZodOptional<z.ZodObject<{
+        model: z.ZodOptional<z.ZodString>;
+        timeoutMs: z.ZodOptional<z.ZodNumber>;
+        memoryLimitBytes: z.ZodOptional<z.ZodNumber>;
+        maxPtcCalls: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        maxResultChars: z.ZodOptional<z.ZodNumber>;
+        prompt_cache: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodBoolean>;
+            ttl: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    tools: z.ZodOptional<z.ZodObject<{
+        allow_always: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            tool: z.ZodString;
+            args: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
+            paths: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+            connection: z.ZodOptional<z.ZodString>;
+            source: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>]>>>;
+        forbid_always: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            tool: z.ZodString;
+            args: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
+            paths: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+            connection: z.ZodOptional<z.ZodString>;
+            source: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>]>>>;
+    }, z.core.$strict>>;
+    skills: z.ZodOptional<z.ZodObject<{
+        allow_always: z.ZodOptional<z.ZodArray<z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>>>;
+        forbid_always: z.ZodOptional<z.ZodArray<z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>>>;
+    }, z.core.$strict>>;
+    mounts: z.ZodOptional<z.ZodObject<{
+        allow_always: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            mount: z.ZodString;
+            access: z.ZodOptional<z.ZodEnum<{
+                read: "read";
+                read_write: "read_write";
+            }>>;
+        }, z.core.$strict>]>>>;
+        forbid_always: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+    tests: z.ZodOptional<z.ZodObject<{
+        maxConcurrency: z.ZodOptional<z.ZodNumber>;
+        caseTimeoutMs: z.ZodOptional<z.ZodNumber>;
+        judge: z.ZodOptional<z.ZodObject<{
+            model: z.ZodOptional<z.ZodString>;
+            modelOptions: z.ZodOptional<z.ZodObject<{
+                temperature: z.ZodOptional<z.ZodNumber>;
+                maxTokens: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    extensions: z.ZodOptional<z.ZodObject<{
+        hooks: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+    metadata: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
+    states: z.ZodRecord<z.ZodString, z.ZodPreprocess<z.ZodObject<{
+        type: z.ZodOptional<z.ZodEnum<{
+            human: "human";
+            agent: "agent";
+        }>>;
+        title: z.ZodOptional<z.ZodString>;
+        instructions: z.ZodOptional<z.ZodString>;
+        summary: z.ZodOptional<z.ZodString>;
+        evidence: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        approvers: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        triggers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodObject<{
+            session: z.ZodOptional<z.ZodString>;
+            message: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodString]>>;
+            connection: z.ZodOptional<z.ZodString>;
+            requires: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            returns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$loose>>>>;
+        before: z.ZodOptional<z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
+            script: z.ZodString;
+            max_iterations: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>, z.ZodObject<{
+            rubric: z.ZodObject<{
+                instructions: z.ZodString;
+                max_iterations: z.ZodOptional<z.ZodNumber>;
+                model: z.ZodOptional<z.ZodString>;
+                metadata: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodRecord<z.ZodString, z.ZodString>]>, z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+            script: z.ZodString;
+            max_iterations: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>, z.ZodObject<{
+            rubric: z.ZodObject<{
+                instructions: z.ZodString;
+                max_iterations: z.ZodOptional<z.ZodNumber>;
+                model: z.ZodOptional<z.ZodString>;
+                metadata: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodRecord<z.ZodString, z.ZodString>]>>]>>;
+        after: z.ZodOptional<z.ZodUnion<readonly [z.ZodUnion<readonly [z.ZodObject<{
+            script: z.ZodString;
+            max_iterations: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>, z.ZodObject<{
+            rubric: z.ZodObject<{
+                instructions: z.ZodString;
+                max_iterations: z.ZodOptional<z.ZodNumber>;
+                model: z.ZodOptional<z.ZodString>;
+                metadata: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodRecord<z.ZodString, z.ZodString>]>, z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+            script: z.ZodString;
+            max_iterations: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>, z.ZodObject<{
+            rubric: z.ZodObject<{
+                instructions: z.ZodString;
+                max_iterations: z.ZodOptional<z.ZodNumber>;
+                model: z.ZodOptional<z.ZodString>;
+                metadata: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodRecord<z.ZodString, z.ZodString>]>>]>>;
+        budget: z.ZodOptional<z.ZodObject<{
+            maxTurns: z.ZodOptional<z.ZodNumber>;
+            timeoutMs: z.ZodOptional<z.ZodNumber>;
+            maxParks: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>>;
+        model: z.ZodOptional<z.ZodString>;
+        on_error: z.ZodOptional<z.ZodString>;
+        tools: z.ZodOptional<z.ZodObject<{
+            allow: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+                tool: z.ZodString;
+                args: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
+                paths: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+                connection: z.ZodOptional<z.ZodString>;
+                source: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>]>>>;
+            forbid: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+                tool: z.ZodString;
+                args: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
+                paths: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+                connection: z.ZodOptional<z.ZodString>;
+                source: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>]>>>;
+        }, z.core.$strict>>;
+        skills: z.ZodOptional<z.ZodObject<{
+            allow: z.ZodOptional<z.ZodArray<z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>>>;
+            forbid: z.ZodOptional<z.ZodArray<z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>>>;
+        }, z.core.$strict>>;
+        mounts: z.ZodOptional<z.ZodObject<{
+            allow: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+                mount: z.ZodString;
+                access: z.ZodOptional<z.ZodEnum<{
+                    read: "read";
+                    read_write: "read_write";
+                }>>;
+            }, z.core.$strict>]>>>;
+            forbid: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        requires: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        metadata: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
+        transitions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            to: z.ZodString;
+            description: z.ZodString;
+            type: z.ZodOptional<z.ZodEnum<{
+                approve: "approve";
+                reject: "reject";
+                refine: "refine";
+                none: "none";
+            }>>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>, unknown>>;
+}, z.core.$strict>;
+type Spec = z.infer<typeof machineSpecSchema>;
+/**
+ * A structural problem, addressed by its key path (dotted, with array indices:
+ * `states.review.transitions.0.to`) so a diagnostic names the key an author has
+ * to find.
+ */
+export interface SpecSchemaIssue {
+    path: string;
+    message: string;
+}
+/**
+ * The rules that need the whole document and that the runtime cannot run
+ * without: every reference resolves, the start wiring is unambiguous, guards
+ * reference variables by a readable name. Runs after the shape has been
+ * accepted. Defects the runtime tolerates are `lint-spec.ts` errors instead.
+ */
+export declare function refineSpec(spec: Spec): SpecSchemaIssue[];
+/**
+ * Parse a spec through the schema, then the document-level rules, returning
+ * either the typed value or the structural issues. Total rather than throwing:
+ * the loader reports issues as warning events, the validator as diagnostics.
+ * When the shape held but a document-level rule failed, the typed `spec` is
+ * returned beside the issues so the lint can still read it.
+ */
+export declare function parseMachineSpec(value: unknown): {
+    ok: true;
+    spec: Spec;
+} | {
+    ok: false;
+    issues: SpecSchemaIssue[];
+    spec?: Spec;
+};
+export {};