@archmax-ai/harness 0.0.0

package/dist/machine/types.d.ts

@@ -0,0 +1,186 @@
+/**
+ * The `workflow.yaml` shape, as types.
+ *
+ * Every type here is inferred from `machine/spec-schema.ts` — the schema *is*
+ * the spec, and these aliases exist so call sites read as domain vocabulary
+ * (`MachineState`) rather than as `z.infer<typeof machineStateSchema>`.
+ */
+import type { z } from "zod";
+import type { allowEntrySchema, hookSchema, forbidEntrySchema, hookSpecSchema, machinePromptCacheSettingsSchema, machineSettingsSchema, machineSpecSchema, machineStateSchema, machineTransitionSchema, stateTypeSchema, runtimeMetadataSchema, skillsBlockSchema, mountsBlockSchema, mountAccessSchema, mountGrantEntrySchema, specExtensionsSchema, rubricDeclarationSchema, specMetadataSchema, stateBudgetSchema, toolsBlockSchema, transitionTypeSchema, triggerDeclarationSchema, workflowTestsConfigSchema, workflowSkillsConfigSchema, workflowMountsConfigSchema, workflowToolsConfigSchema } from "./spec-schema.js";
+/**
+ * Semantic classification of an outgoing edge, primarily for **human states**: a
+ * UI can render `approve`/`reject`/`refine` as distinct decision buttons, and
+ * `none` (the default) is an ordinary route. A human state declares at most one
+ * transition of each labeled type. Metadata only on agent states.
+ */
+export type TransitionType = z.infer<typeof transitionTypeSchema>;
+/**
+ * One outgoing edge of a state. `description` is **required and non-empty**: the
+ * agent is disclosed the active state's edges and nothing else of the graph, so
+ * this is the whole of what it routes on — write it for a reader standing in the
+ * source state, which knows nothing of the target ("Refunds over $50", never "go
+ * to refund-review"). At a human state it is also the decision's button label.
+ */
+export type MachineTransition = z.infer<typeof machineTransitionSchema>;
+/**
+ * A single lifecycle hook: a tagged object whose single key names its **kind**
+ * (`script`, `rubric`, or a custom kind an executor is registered for) and
+ * whose value is the kind's target, optionally beside the reserved
+ * `max_iterations` sidecar (the bounded grade-and-retry budget of an `after`
+ * hook). A rubric's grading criteria are its `instructions` in the spec's
+ * `rubrics:` block, never a hook attribute.
+ */
+export type Hook = z.infer<typeof hookSchema>;
+/** A `before`/`after` field: one hook or an ordered list run in sequence. */
+export type HookSpec = z.infer<typeof hookSpecSchema>;
+/**
+ * Per-state execution budget. `maxTurns` bounds the model iterations of the
+ * turn's agent loop; `timeoutMs` aborts the turn when exceeded; `maxParks` bounds
+ * how many times the state may park itself with `archmax_wait`. Any exhaustion
+ * is a turn failure subject to `on_error`.
+ */
+export type StateBudget = z.infer<typeof stateBudgetSchema>;
+/** One entry of a `tools.allow` list: a bare tool name, or a constrained shape. */
+export type AllowEntry = z.infer<typeof allowEntrySchema>;
+/**
+ * Per-state tool governance. Allow-only: a state with `allow` permits exactly the
+ * listed tools/arg-shapes (plus workflow-level `allow_always` grants and the
+ * essential surface); a state without one gets the essential surface only.
+ */
+export type ToolsBlock = z.infer<typeof toolsBlockSchema>;
+/**
+ * A denial entry: the same grammar as {@link AllowEntry}, plus the tool `*`
+ * meaning every tool. Deny beats allow, and no narrower level widens a denial —
+ * so a wildcard is safe here and a document-level error in an `allow` list.
+ */
+export type ForbidEntry = z.infer<typeof forbidEntrySchema>;
+/**
+ * A **state's** skill governance by slug: what this state adds to the workflow's
+ * always-on grant. A skill is enabled only where a list names it — an absent
+ * block adds nothing, exactly as `allow: []` does, and exactly as an absent
+ * `tools.allow` grants no tool.
+ */
+export type SkillsBlock = z.infer<typeof skillsBlockSchema>;
+/**
+ * A **state's** mount governance by name: what this state adds to the
+ * workflow's always-on grant, and what it subtracts. A mount the host declared
+ * governed is enabled only where a list names it; an ungoverned mount is
+ * visible in every state and `forbid` is what takes it away.
+ */
+/**
+ * How a state may use a mount it is given: `read` refuses writes there,
+ * `read_write` permits them where the host declared the mount writable. The
+ * host's posture is the ceiling — `read_write` cannot open a read-only mount —
+ * so this key's real work is narrowing a writable mount in the states that only
+ * read it.
+ */
+export type MountAccess = z.infer<typeof mountAccessSchema>;
+/**
+ * One entry of a mounts grant list: a bare mount name, taking the write posture
+ * the host declared, or `{ mount, access }` naming the access this level gives.
+ * Normalized to one shape by `normalizeMountGrants` (`machine/mount-grants.ts`).
+ */
+export type MountGrantEntry = z.infer<typeof mountGrantEntrySchema>;
+export type MountsBlock = z.infer<typeof mountsBlockSchema>;
+/**
+ * The kind of a state: `agent` (default) runs a Deep Agent turn that picks a
+ * transition with `archmax_advance`; `human` parks the session and a person picks
+ * the outgoing edge.
+ */
+export type StateType = z.infer<typeof stateTypeSchema>;
+/**
+ * One state of the graph, keyed in {@link MachineSpec.states} by its **slug** —
+ * its sole identity. Every reference to a state (`to`, `on_error`, the `to` the
+ * agent passes to `archmax_advance`, events, artifacts, test assertions) is a
+ * slug.
+ *
+ * `model` names the model id this state's turns run on — an id only, resolved
+ * over the endpoint and credentials the assembly is already configured with. It
+ * is the most specific position of the chain state → {@link MachineSettings}
+ * `model` → the assembly's default, read once through `WorkflowMachine.modelFor`.
+ */
+export type MachineState = z.infer<typeof machineStateSchema>;
+/** Workflow-level tool grants. */
+export type WorkflowToolsConfig = z.infer<typeof workflowToolsConfigSchema>;
+/**
+ * Workflow-level skill governance: `allow_always` is enabled in every state and
+ * a state's `skills.allow` adds to it; `forbid_always` denies in every state and
+ * beats every grant. See {@link SkillsBlock} for the state's half.
+ */
+export type WorkflowSkillsConfig = z.infer<typeof workflowSkillsConfigSchema>;
+/**
+ * Workflow-level mount governance: `allow_always` enables its governed mounts
+ * in every state and a state's `mounts.allow` adds to it; `forbid_always`
+ * denies in every state, beats every grant, and binds every descendant session.
+ * See {@link MountsBlock} for the state's half.
+ */
+export type WorkflowMountsConfig = z.infer<typeof workflowMountsConfigSchema>;
+/** Workflow-declared provider prompt-cache settings. */
+export type MachinePromptCacheSettings = z.infer<typeof machinePromptCacheSettingsSchema>;
+/**
+ * Sandbox and prompt-cache knobs declared at the spec root, plus `model`: the
+ * model id every state of this workflow runs on unless the state names its own.
+ * An id only — the endpoint, credentials and sampling stay the assembly's
+ * configuration — and it overrides `ARCHMAX_MODEL`, not a host's explicit `model`.
+ */
+export type MachineSettings = z.infer<typeof machineSettingsSchema>;
+/** Offline-test suite configuration declared at the spec root. */
+export type WorkflowTestsConfig = z.infer<typeof workflowTestsConfigSchema>;
+/**
+ * Optional runtime contract declaration: the authoring/runtime semantics a
+ * workspace expects, independent of the installed npm version.
+ */
+export type RuntimeMetadata = z.infer<typeof runtimeMetadataSchema>;
+/**
+ * One trigger's declaration, under the `triggers:` of the state it enters: how
+ * its firings map to a session, and the run's signature. The state it sits on
+ * is its entry state and the key it sits under is its id, so neither is a key
+ * of the declaration.
+ */
+export type TriggerDeclaration = z.infer<typeof triggerDeclarationSchema>;
+/** Workspace-declared expectations the runtime cannot verify from the spec alone. */
+export type SpecExtensions = z.infer<typeof specExtensionsSchema>;
+/**
+ * Host data, accepted at three positions: the spec root (an authoring UI's canvas
+ * state), a state (a node's position), and a rubric (a display label). Preserved
+ * across a load, never read by the runtime, and dropped before the spec is
+ * hashed.
+ */
+export type SpecMetadata = z.infer<typeof specMetadataSchema>;
+/**
+ * One grading rubric: the standard a state's exit is measured against, declared
+ * in the same document as the state whose hook names it. `instructions` carries
+ * the criteria and the verdict to return; `max_iterations` bounds the
+ * grade-and-retry loop (a hook's own sidecar wins over it); `model` names the id
+ * the grader runs on. A rubric is authoring-plane content: the agent it grades
+ * can neither read it nor dispatch it.
+ */
+export type RubricDeclaration = z.infer<typeof rubricDeclarationSchema>;
+/** The whole of `workflow.yaml`. */
+export type MachineSpec = z.infer<typeof machineSpecSchema>;
+/** Runtime knobs derived from `settings`, consumed by the harness. */
+export interface HarnessSettings {
+    timeoutMs: number;
+    memoryLimitBytes?: number;
+    maxPtcCalls?: number | null;
+    maxResultChars?: number;
+    /** Prompt-cache declaration, when present. */
+    promptCache?: {
+        enabled?: boolean;
+        ttl?: string;
+    };
+}
+export interface LifecycleHook {
+    /** Normalized ordered `before` hooks (single spec wrapped in a list). */
+    before?: Hook[];
+    /** Normalized ordered `after` hooks (single spec wrapped in a list). */
+    after?: Hook[];
+}
+/**
+ * Whether a spec declares itself out of service — the single interpretation
+ * point for {@link MachineSpec.disabled}; a function because some callers hold a
+ * spec that cannot build a machine. Read fail-closed: set unless the value is
+ * absent, `null`, or boolean `false`, so a mis-authored truthy value stops the
+ * workflow rather than running it.
+ */
+export declare function specDisabled(spec: MachineSpec | null | undefined): boolean;

package/dist/machine/types.js

@@ -0,0 +1,12 @@
+/**
+ * Whether a spec declares itself out of service — the single interpretation
+ * point for {@link MachineSpec.disabled}; a function because some callers hold a
+ * spec that cannot build a machine. Read fail-closed: set unless the value is
+ * absent, `null`, or boolean `false`, so a mis-authored truthy value stops the
+ * workflow rather than running it.
+ */
+export function specDisabled(spec) {
+    const declared = spec?.disabled;
+    return declared !== undefined && declared !== null && declared !== false;
+}
+//# sourceMappingURL=types.js.map

package/dist/machine/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/machine/types.ts"],"names":[],"mappings":"AAuOA;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAoC;IAC/D,MAAM,QAAQ,GAAI,IAAkD,EAAE,QAAQ,CAAC;IAC/E,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,KAAK,CAAC;AAC3E,CAAC"}

package/dist/machine/validate-spec.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Everything that can be said about a `workflow.yaml` **from the document
+ * alone**: the shape (`machineSpecSchema`), the document-level cross-references
+ * (`refineSpec`) and the advisories (`lintSpec`), as one list of diagnostics.
+ *
+ * Pure — no workspace, no backend, no machine — so an editor can show the same
+ * findings inline that `archmax validate` prints, and the loader reports exactly
+ * these. What needs more than the document (hook scripts on disk, sibling
+ * workflows, the skill registry, kernel probes) is `validate/validate.ts`.
+ */
+import type { Diagnostic } from "./diagnostic.js";
+import { type SpecSchemaIssue } from "./spec-schema.js";
+import type { MachineSpec } from "./types.js";
+/** What {@link validateSpec} found. */
+export interface SpecValidation {
+    /**
+     * Whether the shape and the document rules held — the spec can be compiled
+     * into a machine. An advisory (`lint`) never clears this, even at severity
+     * `error`: the runtime tolerates what the lint reports and `validate` fails on it.
+     */
+    ok: boolean;
+    /**
+     * The typed spec, when the shape held — also beside a document-level error
+     * (a dangling target), so the lint could read it and a caller can too.
+     */
+    spec?: MachineSpec;
+    /** The shape and document-rule findings, each an `error` addressed by its `field`. */
+    schema: Diagnostic[];
+    /** The advisory findings, warnings and the errors the runtime tolerates. */
+    lint: Diagnostic[];
+    /** `schema` then `lint`, for a caller that wants one list. */
+    diagnostics: Diagnostic[];
+}
+/** A structural issue as a diagnostic: an error at the key an author has to find. */
+export declare function schemaIssueDiagnostic(issue: SpecSchemaIssue): Diagnostic;
+/**
+ * Validate a parsed `workflow.yaml` mapping. Total: never throws, and a document
+ * the schema refuses still yields every issue the schema found, so an editor
+ * can show a blank transition `description` or a misspelled state key inline
+ * rather than as one refusal. `file` is left to the caller.
+ */
+export declare function validateSpec(value: unknown): SpecValidation;

package/dist/machine/validate-spec.js

@@ -0,0 +1,29 @@
+import { lintSpec } from "./lint-spec.js";
+import { parseMachineSpec } from "./spec-schema.js";
+/** A structural issue as a diagnostic: an error at the key an author has to find. */
+export function schemaIssueDiagnostic(issue) {
+    return {
+        severity: "error",
+        message: issue.message,
+        ...(issue.path ? { field: issue.path } : {}),
+    };
+}
+/**
+ * Validate a parsed `workflow.yaml` mapping. Total: never throws, and a document
+ * the schema refuses still yields every issue the schema found, so an editor
+ * can show a blank transition `description` or a misspelled state key inline
+ * rather than as one refusal. `file` is left to the caller.
+ */
+export function validateSpec(value) {
+    const parsed = parseMachineSpec(value);
+    const schema = parsed.ok ? [] : parsed.issues.map(schemaIssueDiagnostic);
+    const lint = parsed.spec ? lintSpec(parsed.spec) : [];
+    return {
+        ok: parsed.ok,
+        ...(parsed.spec ? { spec: parsed.spec } : {}),
+        schema,
+        lint,
+        diagnostics: [...schema, ...lint],
+    };
+}
+//# sourceMappingURL=validate-spec.js.map

package/dist/machine/validate-spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-spec.js","sourceRoot":"","sources":["../../src/machine/validate-spec.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAwB,MAAM,kBAAkB,CAAC;AAwB1E,qFAAqF;AACrF,MAAM,UAAU,qBAAqB,CAAC,KAAsB;IAC1D,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM;QACN,IAAI;QACJ,WAAW,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;KAClC,CAAC;AACJ,CAAC"}

package/dist/machine/variables.d.ts

@@ -0,0 +1,196 @@
+/**
+ * Run-variable references — `${{name}}` and `${{name.dotted.path}}` — in guards,
+ * prompts and the arguments the agent writes. One resolver serves the kernel,
+ * disclosure, validation and substitution, so a reference means one thing.
+ *
+ * Three invariants carry the feature's safety: a substituted value is
+ * glob-escaped where the output is a *pattern* and verbatim where it is a
+ * *value*; resolution fails closed (never the literal `${{…}}` text, never `*`);
+ * and traversal reads own properties only (`resolvePath`), so `tags.length` and
+ * `constructor` never resolve.
+ */
+import type { WorkflowMachine } from "./machine.js";
+/** The shape a run-variable name must take: a snake_case identifier, never dotted. */
+export declare const VARIABLE_NAME_PATTERN: RegExp;
+/**
+ * The built-in variable holding the run's trigger id. Reserved: it is set by the
+ * harness at run start, locked, and needs no seed — so a guard may reference
+ * `${{trigger}}` without anything supplying it.
+ */
+export declare const TRIGGER_VARIABLE = "trigger";
+/**
+ * The built-in variable holding a short label for the task the run is doing.
+ * Agent-owned, unlike `trigger`: nothing sets it until the agent does. Two rules
+ * follow it everywhere it is written — it is **never locked** (a seed stores it
+ * unlocked; `set_variables` refuses `lock: true`), and it is **shape-checked on
+ * write** ({@link titleWriteError}). Unrelated to the spec's static `title`
+ * fields.
+ */
+export declare const TITLE_VARIABLE = "title";
+/**
+ * The longest a title may be. A bound, not a style guide — the system prompt asks
+ * for something short, and this only stops something unusable from being stored.
+ */
+export declare const TITLE_MAX_LENGTH = 200;
+/**
+ * Check a value destined for {@link TITLE_VARIABLE}, returning the refusal reason
+ * or `undefined` when it passes. Shared by both write routes (a seed throws, the
+ * agent's `set_variables` is refused). Refuses rather than coerces; trimming is
+ * the one coercion allowed.
+ */
+export declare function titleWriteError(value: unknown): string | undefined;
+/**
+ * The value to store for a title that has passed {@link titleWriteError} — the
+ * trimmed string. Separate from the check so a caller cannot store the untrimmed
+ * original by forgetting to.
+ */
+export declare function normalizeTitle(value: string): string;
+/** Thrown when a seeded (or written) variable name is not a valid identifier. */
+export declare class InvalidVariableNameError extends Error {
+    readonly variable: string;
+    /** Where the name came from, for a message that points at the fix. */
+    readonly source: string;
+    constructor(variable: string, 
+    /** Where the name came from, for a message that points at the fix. */
+    source?: string);
+}
+/**
+ * Thrown when a seeded `title` is not a usable label — a throw rather than the
+ * agent's string refusal, because a bad seed is a host defect that should
+ * surface at assembly.
+ */
+export declare class InvalidTitleError extends Error {
+    /** The shape problem, in the same words the agent's refusal uses. */
+    readonly detail: string;
+    /** Where the value came from, for a message that points at the fix. */
+    readonly source: string;
+    constructor(
+    /** The shape problem, in the same words the agent's refusal uses. */
+    detail: string, 
+    /** Where the value came from, for a message that points at the fix. */
+    source?: string);
+}
+/** A run variable as stored in checkpointed state. */
+export interface VariableEntry {
+    value: unknown;
+    locked: boolean;
+    /**
+     * Set only by a **host seeding boundary** (a delivery into a wait-parked
+     * session, the start of a turn): the host is re-establishing the session's
+     * facts, so this replaces even a settled *locked* value. Everywhere else the
+     * merge is first-lock-wins. The variable tools never set it, so no
+     * agent-reachable path can bypass a lock.
+     */
+    reseed?: boolean;
+}
+/** The checkpointed variable store, keyed by name. */
+export type VariableStore = Record<string, VariableEntry>;
+/**
+ * Turn a caller's seeds into locked variable entries — the one way a run's
+ * opening facts are established, whether by a host's `variables` option, a
+ * delivery's seeds, or the arguments a delegation hands a sub-run. Locked because
+ * a `${{name}}` guard bound to a seed is worthless if the agent can rewrite it.
+ */
+export declare function buildSeededVariables(seeds: Record<string, unknown> | undefined, 
+/** Where the names came from, for a message that points at the fix. */
+source?: string): VariableStore;
+/** One `${{…}}` reference found in a glob, with its span for substitution. */
+export interface VariableReference {
+    /** The full matched text, e.g. `${{order.items.0.sku}}`. */
+    raw: string;
+    /** The variable name (first segment). */
+    name: string;
+    /** Path segments after the name; empty for a whole-variable reference. */
+    path: string[];
+    /** Index of `raw` within the glob it was found in. */
+    index: number;
+}
+/** Why a reference could not be resolved. Each is a fail-closed outcome. */
+export type UnresolvedReason = "malformed" | "invalid-name" | "unset" | "path-missing" | "non-scalar";
+export interface ResolvedGlob {
+    ok: true;
+    /** The glob with every reference substituted and glob-escaped. */
+    pattern: string;
+}
+export interface UnresolvedGlob {
+    ok: false;
+    reason: UnresolvedReason;
+    /** The reference that could not be resolved (its raw `${{…}}` text). */
+    reference: string;
+    /** Human-readable explanation, suitable for a governance block reason. */
+    detail: string;
+}
+export type GlobResolution = ResolvedGlob | UnresolvedGlob;
+/**
+ * Whether a glob contains reference **syntax** — a `${{…}}` reference or an
+ * escaped `$${{…}}` literal. Callers use this to skip resolution entirely for the
+ * common reference-free glob, so an escape has to answer `true` here: it resolves
+ * nothing, but it still needs the pass that turns `$${{x}}` into `${{x}}`.
+ */
+export declare function hasVariableReference(glob: string): boolean;
+/**
+ * Every `${{…}}` reference in a glob, in order. A syntactically malformed
+ * reference still appears here (with an empty `name`), so callers can report it
+ * rather than skip it. An escaped `$${{…}}` is omitted — it is literal text, and
+ * reporting it as a reference would make `validate` warn about a variable the
+ * author deliberately spelled out.
+ */
+export declare function parseReferences(glob: string): VariableReference[];
+/** Whether a reference is structurally usable (name shape, no empty segments). */
+export declare function referenceError(ref: VariableReference): UnresolvedReason | undefined;
+/**
+ * Resolve a dotted path against a value, reading own properties only. Returns
+ * `undefined` when any segment misses — indistinguishable from a stored
+ * `undefined`, which is fine: both are unresolvable for a guard.
+ */
+export declare function resolvePath(value: unknown, path: string[]): unknown;
+/**
+ * Escape every picomatch metacharacter so a substituted value is matched as
+ * literal text; without it a variable holding `*` or `{a,b}` widens the guard.
+ */
+export declare function escapeGlobLiteral(value: string): string;
+/**
+ * Substitute every reference in a glob against the run's variables. Returns the
+ * resolved pattern, or the first unresolved reference and why — a glob with an
+ * unresolved reference matches nothing at all, so the caller must not fall back
+ * to the original text.
+ */
+export declare function resolveGlob(glob: string, variables: VariableStore): GlobResolution;
+/**
+ * Substitute every reference in a piece of **prose** (a sub-workflow prompt)
+ * verbatim: a prompt is text a model reads, where glob-escaping would teach it
+ * to emit backslashes. Failure is still closed — a literal `${{…}}` reaching a
+ * model is an instruction it cannot follow.
+ */
+export declare function resolveText(text: string, variables: VariableStore): GlobResolution;
+/**
+ * A resolved tool-call argument structure, or the first reference that stopped
+ * it. The failure side is the same `UnresolvedGlob` every other consumer reports.
+ */
+export type ArgumentResolution = {
+    ok: true;
+    args: Record<string, unknown>;
+} | UnresolvedGlob;
+/**
+ * Substitute every reference in the **arguments the agent wrote**, verbatim.
+ * Walks deep (non-string leaves pass through), fails first-wins and totally (the
+ * tool never receives a half-resolved structure), and only reports. Objects are
+ * rebuilt with `Object.fromEntries`, which *defines* each key, so a model-emitted
+ * `__proto__` becomes a property rather than a prototype.
+ */
+export declare function resolveArguments(args: Record<string, unknown>, variables: VariableStore): ArgumentResolution;
+/**
+ * Render a guard glob for the model: the resolved pattern when it resolves, or a
+ * short unresolved marker naming the reference. The model is told a constraint
+ * exists and what it is waiting on, rather than being shown a placeholder it
+ * might try to pass literally into a call that would end the run.
+ */
+export declare function describeGlob(glob: string, variables: VariableStore): string;
+/**
+ * Warn about every `${{…}}` guard reference the assembly cannot *guarantee* is
+ * set — named by neither the host's seeds, any state's `requires`, nor the
+ * built-in `trigger`. A warning, not a throw: `archmax_set_variables` can create
+ * any name at runtime, so an upstream state may legitimately establish it; the
+ * enforcement is the runtime failure when the guard cannot resolve.
+ */
+export declare function unguaranteedReferenceWarnings(machine: Pick<WorkflowMachine, "spec">, seededVariables: VariableStore): string[];