@blokjs/shared 2.1.0 → 2.2.0

package/dist/WorkflowBindingContracts.d.ts

@@ -0,0 +1,1062 @@
+import { z } from "zod";
+import { type EnforcementProfile } from "./EnforcementProfileContracts.js";
+import type { PrincipalIdentity } from "./PolicyContracts.js";
+/** Version of the language-neutral workflow binding contract. */
+export declare const WORKFLOW_BINDING_CONTRACT_VERSION: "1";
+export declare const WORKFLOW_RUN_CONTRACT_VERSION: "1";
+export declare const ENFORCEMENT_OVERRIDE_EVENT_VERSION: "1";
+export declare const WORKFLOW_BINDING_MAX_RULES = 128;
+export declare const WORKFLOW_BINDING_MAX_LABELS = 128;
+export declare const WORKFLOW_BINDING_MAX_PATHS = 128;
+export declare const WORKFLOW_BINDING_MAX_ATTRIBUTES = 64;
+export declare const WORKFLOW_BINDING_MAX_NODES = 512;
+export declare const WORKFLOW_BINDING_MAX_RUNTIMES = 32;
+export declare const WORKFLOW_BINDING_MAX_SCOPE_ITEMS = 128;
+export declare const WORKFLOW_BINDING_MAX_STRING_LENGTH = 256;
+export declare const WORKFLOW_BINDING_MAX_CONTRACT_BYTES: number;
+export declare const WORKFLOW_SOURCE_KINDS: readonly ["registry", "repository", "workspace"];
+export declare const WORKFLOW_RUNTIME_KINDS: readonly ["nodejs", "bun", "python3", "go", "java", "kotlin", "rust", "php", "csharp", "ruby", "swift", "dart", "elixir", "docker", "wasm", "wasi"];
+export type WorkflowSourceKind = (typeof WORKFLOW_SOURCE_KINDS)[number];
+export type WorkflowRuntimeKind = (typeof WORKFLOW_RUNTIME_KINDS)[number];
+export type BindingScalar = string | number | boolean;
+export interface RepositoryIdentity {
+    readonly provider: string;
+    readonly id: string;
+    readonly revision?: string;
+}
+export interface BindingActorIdentity extends PrincipalIdentity {
+}
+/** Runtime facts used to select a binding; no payloads or secrets are allowed. */
+export interface WorkflowBindingInputs {
+    readonly repository?: RepositoryIdentity;
+    readonly taskType?: string;
+    readonly labels?: readonly string[];
+    readonly paths?: readonly string[];
+    readonly tenant?: string;
+    readonly actor?: BindingActorIdentity;
+    readonly environment?: string;
+    readonly attributes?: Readonly<Record<string, BindingScalar>>;
+}
+export interface WorkflowBindingSelector {
+    readonly repository?: RepositoryIdentity;
+    readonly taskTypes?: readonly string[];
+    /** Every listed label is required; labels are normalized as a set. */
+    readonly labels?: readonly string[];
+    /** A selector path matches by the resolver's documented path policy. */
+    readonly paths?: readonly string[];
+    readonly tenant?: string;
+    readonly actors?: readonly string[];
+    readonly environments?: readonly string[];
+    readonly attributes?: Readonly<Record<string, BindingScalar>>;
+}
+export interface TrustedWorkflowSource {
+    readonly kind: WorkflowSourceKind;
+    readonly id: string;
+    readonly digest: string;
+    readonly trusted: true;
+}
+export interface WorkflowReference {
+    readonly name: string;
+    readonly version: string;
+    readonly source: TrustedWorkflowSource;
+    readonly irDigest: string;
+}
+export interface WorkflowBindingRule {
+    readonly version: typeof WORKFLOW_BINDING_CONTRACT_VERSION;
+    readonly id: string;
+    readonly priority: number;
+    readonly selector: WorkflowBindingSelector;
+    readonly workflow: WorkflowReference;
+    readonly profile: EnforcementProfile;
+}
+export type WorkflowBindingRules = readonly WorkflowBindingRule[];
+export interface PinnedNodeIdentity {
+    readonly id: string;
+    readonly version: string;
+    readonly digest?: string;
+}
+export interface PinnedRuntimeIdentity {
+    readonly kind: WorkflowRuntimeKind;
+    readonly version: string;
+}
+export interface PinnedCapabilityManifestIdentity {
+    readonly version: string;
+    readonly digest: string;
+}
+export interface PinnedPolicyIdentity {
+    readonly id: string;
+    readonly version: string;
+    readonly digest?: string;
+}
+export interface PinnedModelConfigurationIdentity {
+    readonly provider: string;
+    readonly id: string;
+    readonly version: string;
+    readonly configDigest: string;
+}
+/** Immutable execution contract captured before a bound run starts. */
+export interface PinnedWorkflowRunContract {
+    readonly version: typeof WORKFLOW_RUN_CONTRACT_VERSION;
+    readonly runId: string;
+    readonly profile: EnforcementProfile;
+    readonly bindingRuleId: string;
+    readonly boundAt: string;
+    readonly workflow: WorkflowReference;
+    readonly nodes: readonly PinnedNodeIdentity[];
+    readonly runtimes: readonly PinnedRuntimeIdentity[];
+    readonly capabilityManifest: PinnedCapabilityManifestIdentity;
+    readonly policy: PinnedPolicyIdentity;
+    readonly model: PinnedModelConfigurationIdentity;
+}
+export interface EnforcementOverrideScope {
+    readonly stepIds?: readonly string[];
+    readonly transitionIds?: readonly string[];
+    readonly capabilityIds?: readonly string[];
+}
+export interface EnforcementOverrideAuthorization {
+    readonly method: "durable-interaction";
+    readonly interactionId: string;
+    readonly decisionId: string;
+    readonly status: "answered";
+}
+/** Append-only event authorizing one bounded deviation in guided mode. */
+export interface EnforcementOverrideEvent {
+    readonly version: typeof ENFORCEMENT_OVERRIDE_EVENT_VERSION;
+    readonly eventType: "enforcement.override";
+    readonly eventId: string;
+    readonly timestamp: string;
+    readonly runId: string;
+    readonly profile: "guided";
+    readonly bindingRuleId: string;
+    readonly requestedBy?: BindingActorIdentity;
+    readonly authorizedBy: BindingActorIdentity;
+    readonly authorization: EnforcementOverrideAuthorization;
+    readonly reasonCode: string;
+    readonly reason?: string;
+    readonly scope: EnforcementOverrideScope;
+    readonly expiresAt?: string;
+}
+export declare const WorkflowBindingInputsSchema: z.ZodObject<{
+    repository: z.ZodOptional<z.ZodObject<{
+        provider: z.ZodString;
+        id: z.ZodString;
+        revision: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        provider: string;
+        revision?: string | undefined;
+    }, {
+        id: string;
+        provider: string;
+        revision?: string | undefined;
+    }>>;
+    taskType: z.ZodOptional<z.ZodString>;
+    labels: z.ZodOptional<z.ZodArray<z.ZodType<string, z.ZodTypeDef, string>, "many">>;
+    paths: z.ZodOptional<z.ZodArray<z.ZodType<string, z.ZodTypeDef, string>, "many">>;
+    tenant: z.ZodOptional<z.ZodString>;
+    actor: z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+        kind: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        kind: string;
+    }, {
+        id: string;
+        kind: string;
+    }>>;
+    environment: z.ZodOptional<z.ZodString>;
+    attributes: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>, Record<string, string | number | boolean>, Record<string, string | number | boolean>>>;
+}, "strip", z.ZodTypeAny, {
+    actor?: {
+        id: string;
+        kind: string;
+    } | undefined;
+    repository?: {
+        id: string;
+        provider: string;
+        revision?: string | undefined;
+    } | undefined;
+    taskType?: string | undefined;
+    labels?: string[] | undefined;
+    paths?: string[] | undefined;
+    tenant?: string | undefined;
+    environment?: string | undefined;
+    attributes?: Record<string, string | number | boolean> | undefined;
+}, {
+    actor?: {
+        id: string;
+        kind: string;
+    } | undefined;
+    repository?: {
+        id: string;
+        provider: string;
+        revision?: string | undefined;
+    } | undefined;
+    taskType?: string | undefined;
+    labels?: string[] | undefined;
+    paths?: string[] | undefined;
+    tenant?: string | undefined;
+    environment?: string | undefined;
+    attributes?: Record<string, string | number | boolean> | undefined;
+}>;
+export declare const WorkflowBindingSelectorSchema: z.ZodObject<{
+    repository: z.ZodOptional<z.ZodObject<{
+        provider: z.ZodString;
+        id: z.ZodString;
+        revision: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        provider: string;
+        revision?: string | undefined;
+    }, {
+        id: string;
+        provider: string;
+        revision?: string | undefined;
+    }>>;
+    taskTypes: z.ZodOptional<z.ZodArray<z.ZodType<string, z.ZodTypeDef, string>, "many">>;
+    labels: z.ZodOptional<z.ZodArray<z.ZodType<string, z.ZodTypeDef, string>, "many">>;
+    paths: z.ZodOptional<z.ZodArray<z.ZodType<string, z.ZodTypeDef, string>, "many">>;
+    tenant: z.ZodOptional<z.ZodString>;
+    actors: z.ZodOptional<z.ZodArray<z.ZodType<string, z.ZodTypeDef, string>, "many">>;
+    environments: z.ZodOptional<z.ZodArray<z.ZodType<string, z.ZodTypeDef, string>, "many">>;
+    attributes: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>, Record<string, string | number | boolean>, Record<string, string | number | boolean>>>;
+}, "strip", z.ZodTypeAny, {
+    repository?: {
+        id: string;
+        provider: string;
+        revision?: string | undefined;
+    } | undefined;
+    labels?: string[] | undefined;
+    paths?: string[] | undefined;
+    tenant?: string | undefined;
+    attributes?: Record<string, string | number | boolean> | undefined;
+    taskTypes?: string[] | undefined;
+    actors?: string[] | undefined;
+    environments?: string[] | undefined;
+}, {
+    repository?: {
+        id: string;
+        provider: string;
+        revision?: string | undefined;
+    } | undefined;
+    labels?: string[] | undefined;
+    paths?: string[] | undefined;
+    tenant?: string | undefined;
+    attributes?: Record<string, string | number | boolean> | undefined;
+    taskTypes?: string[] | undefined;
+    actors?: string[] | undefined;
+    environments?: string[] | undefined;
+}>;
+export declare const WorkflowBindingRuleSchema: z.ZodObject<{
+    version: z.ZodLiteral<"1">;
+    id: z.ZodString;
+    priority: z.ZodNumber;
+    selector: z.ZodObject<{
+        repository: z.ZodOptional<z.ZodObject<{
+            provider: z.ZodString;
+            id: z.ZodString;
+            revision: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            id: string;
+            provider: string;
+            revision?: string | undefined;
+        }, {
+            id: string;
+            provider: string;
+            revision?: string | undefined;
+        }>>;
+        taskTypes: z.ZodOptional<z.ZodArray<z.ZodType<string, z.ZodTypeDef, string>, "many">>;
+        labels: z.ZodOptional<z.ZodArray<z.ZodType<string, z.ZodTypeDef, string>, "many">>;
+        paths: z.ZodOptional<z.ZodArray<z.ZodType<string, z.ZodTypeDef, string>, "many">>;
+        tenant: z.ZodOptional<z.ZodString>;
+        actors: z.ZodOptional<z.ZodArray<z.ZodType<string, z.ZodTypeDef, string>, "many">>;
+        environments: z.ZodOptional<z.ZodArray<z.ZodType<string, z.ZodTypeDef, string>, "many">>;
+        attributes: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>, Record<string, string | number | boolean>, Record<string, string | number | boolean>>>;
+    }, "strip", z.ZodTypeAny, {
+        repository?: {
+            id: string;
+            provider: string;
+            revision?: string | undefined;
+        } | undefined;
+        labels?: string[] | undefined;
+        paths?: string[] | undefined;
+        tenant?: string | undefined;
+        attributes?: Record<string, string | number | boolean> | undefined;
+        taskTypes?: string[] | undefined;
+        actors?: string[] | undefined;
+        environments?: string[] | undefined;
+    }, {
+        repository?: {
+            id: string;
+            provider: string;
+            revision?: string | undefined;
+        } | undefined;
+        labels?: string[] | undefined;
+        paths?: string[] | undefined;
+        tenant?: string | undefined;
+        attributes?: Record<string, string | number | boolean> | undefined;
+        taskTypes?: string[] | undefined;
+        actors?: string[] | undefined;
+        environments?: string[] | undefined;
+    }>;
+    workflow: z.ZodObject<{
+        name: z.ZodString;
+        version: z.ZodString;
+        source: z.ZodObject<{
+            kind: z.ZodEnum<["registry", "repository", "workspace"]>;
+            id: z.ZodString;
+            digest: z.ZodEffects<z.ZodString, string, string>;
+            trusted: z.ZodLiteral<true>;
+        }, "strip", z.ZodTypeAny, {
+            id: string;
+            kind: "repository" | "registry" | "workspace";
+            digest: string;
+            trusted: true;
+        }, {
+            id: string;
+            kind: "repository" | "registry" | "workspace";
+            digest: string;
+            trusted: true;
+        }>;
+        irDigest: z.ZodEffects<z.ZodString, string, string>;
+    }, "strip", z.ZodTypeAny, {
+        version: string;
+        name: string;
+        source: {
+            id: string;
+            kind: "repository" | "registry" | "workspace";
+            digest: string;
+            trusted: true;
+        };
+        irDigest: string;
+    }, {
+        version: string;
+        name: string;
+        source: {
+            id: string;
+            kind: "repository" | "registry" | "workspace";
+            digest: string;
+            trusted: true;
+        };
+        irDigest: string;
+    }>;
+    profile: z.ZodEnum<["advisory", "guided", "strict"]>;
+}, "strip", z.ZodTypeAny, {
+    workflow: {
+        version: string;
+        name: string;
+        source: {
+            id: string;
+            kind: "repository" | "registry" | "workspace";
+            digest: string;
+            trusted: true;
+        };
+        irDigest: string;
+    };
+    id: string;
+    version: "1";
+    profile: "strict" | "advisory" | "guided";
+    priority: number;
+    selector: {
+        repository?: {
+            id: string;
+            provider: string;
+            revision?: string | undefined;
+        } | undefined;
+        labels?: string[] | undefined;
+        paths?: string[] | undefined;
+        tenant?: string | undefined;
+        attributes?: Record<string, string | number | boolean> | undefined;
+        taskTypes?: string[] | undefined;
+        actors?: string[] | undefined;
+        environments?: string[] | undefined;
+    };
+}, {
+    workflow: {
+        version: string;
+        name: string;
+        source: {
+            id: string;
+            kind: "repository" | "registry" | "workspace";
+            digest: string;
+            trusted: true;
+        };
+        irDigest: string;
+    };
+    id: string;
+    version: "1";
+    profile: "strict" | "advisory" | "guided";
+    priority: number;
+    selector: {
+        repository?: {
+            id: string;
+            provider: string;
+            revision?: string | undefined;
+        } | undefined;
+        labels?: string[] | undefined;
+        paths?: string[] | undefined;
+        tenant?: string | undefined;
+        attributes?: Record<string, string | number | boolean> | undefined;
+        taskTypes?: string[] | undefined;
+        actors?: string[] | undefined;
+        environments?: string[] | undefined;
+    };
+}>;
+export declare const WorkflowBindingRulesSchema: z.ZodEffects<z.ZodArray<z.ZodObject<{
+    version: z.ZodLiteral<"1">;
+    id: z.ZodString;
+    priority: z.ZodNumber;
+    selector: z.ZodObject<{
+        repository: z.ZodOptional<z.ZodObject<{
+            provider: z.ZodString;
+            id: z.ZodString;
+            revision: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            id: string;
+            provider: string;
+            revision?: string | undefined;
+        }, {
+            id: string;
+            provider: string;
+            revision?: string | undefined;
+        }>>;
+        taskTypes: z.ZodOptional<z.ZodArray<z.ZodType<string, z.ZodTypeDef, string>, "many">>;
+        labels: z.ZodOptional<z.ZodArray<z.ZodType<string, z.ZodTypeDef, string>, "many">>;
+        paths: z.ZodOptional<z.ZodArray<z.ZodType<string, z.ZodTypeDef, string>, "many">>;
+        tenant: z.ZodOptional<z.ZodString>;
+        actors: z.ZodOptional<z.ZodArray<z.ZodType<string, z.ZodTypeDef, string>, "many">>;
+        environments: z.ZodOptional<z.ZodArray<z.ZodType<string, z.ZodTypeDef, string>, "many">>;
+        attributes: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>, Record<string, string | number | boolean>, Record<string, string | number | boolean>>>;
+    }, "strip", z.ZodTypeAny, {
+        repository?: {
+            id: string;
+            provider: string;
+            revision?: string | undefined;
+        } | undefined;
+        labels?: string[] | undefined;
+        paths?: string[] | undefined;
+        tenant?: string | undefined;
+        attributes?: Record<string, string | number | boolean> | undefined;
+        taskTypes?: string[] | undefined;
+        actors?: string[] | undefined;
+        environments?: string[] | undefined;
+    }, {
+        repository?: {
+            id: string;
+            provider: string;
+            revision?: string | undefined;
+        } | undefined;
+        labels?: string[] | undefined;
+        paths?: string[] | undefined;
+        tenant?: string | undefined;
+        attributes?: Record<string, string | number | boolean> | undefined;
+        taskTypes?: string[] | undefined;
+        actors?: string[] | undefined;
+        environments?: string[] | undefined;
+    }>;
+    workflow: z.ZodObject<{
+        name: z.ZodString;
+        version: z.ZodString;
+        source: z.ZodObject<{
+            kind: z.ZodEnum<["registry", "repository", "workspace"]>;
+            id: z.ZodString;
+            digest: z.ZodEffects<z.ZodString, string, string>;
+            trusted: z.ZodLiteral<true>;
+        }, "strip", z.ZodTypeAny, {
+            id: string;
+            kind: "repository" | "registry" | "workspace";
+            digest: string;
+            trusted: true;
+        }, {
+            id: string;
+            kind: "repository" | "registry" | "workspace";
+            digest: string;
+            trusted: true;
+        }>;
+        irDigest: z.ZodEffects<z.ZodString, string, string>;
+    }, "strip", z.ZodTypeAny, {
+        version: string;
+        name: string;
+        source: {
+            id: string;
+            kind: "repository" | "registry" | "workspace";
+            digest: string;
+            trusted: true;
+        };
+        irDigest: string;
+    }, {
+        version: string;
+        name: string;
+        source: {
+            id: string;
+            kind: "repository" | "registry" | "workspace";
+            digest: string;
+            trusted: true;
+        };
+        irDigest: string;
+    }>;
+    profile: z.ZodEnum<["advisory", "guided", "strict"]>;
+}, "strip", z.ZodTypeAny, {
+    workflow: {
+        version: string;
+        name: string;
+        source: {
+            id: string;
+            kind: "repository" | "registry" | "workspace";
+            digest: string;
+            trusted: true;
+        };
+        irDigest: string;
+    };
+    id: string;
+    version: "1";
+    profile: "strict" | "advisory" | "guided";
+    priority: number;
+    selector: {
+        repository?: {
+            id: string;
+            provider: string;
+            revision?: string | undefined;
+        } | undefined;
+        labels?: string[] | undefined;
+        paths?: string[] | undefined;
+        tenant?: string | undefined;
+        attributes?: Record<string, string | number | boolean> | undefined;
+        taskTypes?: string[] | undefined;
+        actors?: string[] | undefined;
+        environments?: string[] | undefined;
+    };
+}, {
+    workflow: {
+        version: string;
+        name: string;
+        source: {
+            id: string;
+            kind: "repository" | "registry" | "workspace";
+            digest: string;
+            trusted: true;
+        };
+        irDigest: string;
+    };
+    id: string;
+    version: "1";
+    profile: "strict" | "advisory" | "guided";
+    priority: number;
+    selector: {
+        repository?: {
+            id: string;
+            provider: string;
+            revision?: string | undefined;
+        } | undefined;
+        labels?: string[] | undefined;
+        paths?: string[] | undefined;
+        tenant?: string | undefined;
+        attributes?: Record<string, string | number | boolean> | undefined;
+        taskTypes?: string[] | undefined;
+        actors?: string[] | undefined;
+        environments?: string[] | undefined;
+    };
+}>, "many">, {
+    workflow: {
+        version: string;
+        name: string;
+        source: {
+            id: string;
+            kind: "repository" | "registry" | "workspace";
+            digest: string;
+            trusted: true;
+        };
+        irDigest: string;
+    };
+    id: string;
+    version: "1";
+    profile: "strict" | "advisory" | "guided";
+    priority: number;
+    selector: {
+        repository?: {
+            id: string;
+            provider: string;
+            revision?: string | undefined;
+        } | undefined;
+        labels?: string[] | undefined;
+        paths?: string[] | undefined;
+        tenant?: string | undefined;
+        attributes?: Record<string, string | number | boolean> | undefined;
+        taskTypes?: string[] | undefined;
+        actors?: string[] | undefined;
+        environments?: string[] | undefined;
+    };
+}[], {
+    workflow: {
+        version: string;
+        name: string;
+        source: {
+            id: string;
+            kind: "repository" | "registry" | "workspace";
+            digest: string;
+            trusted: true;
+        };
+        irDigest: string;
+    };
+    id: string;
+    version: "1";
+    profile: "strict" | "advisory" | "guided";
+    priority: number;
+    selector: {
+        repository?: {
+            id: string;
+            provider: string;
+            revision?: string | undefined;
+        } | undefined;
+        labels?: string[] | undefined;
+        paths?: string[] | undefined;
+        tenant?: string | undefined;
+        attributes?: Record<string, string | number | boolean> | undefined;
+        taskTypes?: string[] | undefined;
+        actors?: string[] | undefined;
+        environments?: string[] | undefined;
+    };
+}[]>;
+export declare const PinnedWorkflowRunContractSchema: z.ZodEffects<z.ZodObject<{
+    version: z.ZodLiteral<"1">;
+    runId: z.ZodString;
+    profile: z.ZodEnum<["advisory", "guided", "strict"]>;
+    bindingRuleId: z.ZodString;
+    boundAt: z.ZodString;
+    workflow: z.ZodObject<{
+        name: z.ZodString;
+        version: z.ZodString;
+        source: z.ZodObject<{
+            kind: z.ZodEnum<["registry", "repository", "workspace"]>;
+            id: z.ZodString;
+            digest: z.ZodEffects<z.ZodString, string, string>;
+            trusted: z.ZodLiteral<true>;
+        }, "strip", z.ZodTypeAny, {
+            id: string;
+            kind: "repository" | "registry" | "workspace";
+            digest: string;
+            trusted: true;
+        }, {
+            id: string;
+            kind: "repository" | "registry" | "workspace";
+            digest: string;
+            trusted: true;
+        }>;
+        irDigest: z.ZodEffects<z.ZodString, string, string>;
+    }, "strip", z.ZodTypeAny, {
+        version: string;
+        name: string;
+        source: {
+            id: string;
+            kind: "repository" | "registry" | "workspace";
+            digest: string;
+            trusted: true;
+        };
+        irDigest: string;
+    }, {
+        version: string;
+        name: string;
+        source: {
+            id: string;
+            kind: "repository" | "registry" | "workspace";
+            digest: string;
+            trusted: true;
+        };
+        irDigest: string;
+    }>;
+    nodes: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        version: z.ZodString;
+        digest: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        version: string;
+        digest?: string | undefined;
+    }, {
+        id: string;
+        version: string;
+        digest?: string | undefined;
+    }>, "many">;
+    runtimes: z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<["nodejs", "bun", "python3", "go", "java", "kotlin", "rust", "php", "csharp", "ruby", "swift", "dart", "elixir", "docker", "wasm", "wasi"]>;
+        version: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        kind: "nodejs" | "bun" | "python3" | "go" | "java" | "kotlin" | "rust" | "php" | "csharp" | "ruby" | "swift" | "dart" | "elixir" | "docker" | "wasm" | "wasi";
+        version: string;
+    }, {
+        kind: "nodejs" | "bun" | "python3" | "go" | "java" | "kotlin" | "rust" | "php" | "csharp" | "ruby" | "swift" | "dart" | "elixir" | "docker" | "wasm" | "wasi";
+        version: string;
+    }>, "many">;
+    capabilityManifest: z.ZodObject<{
+        version: z.ZodString;
+        digest: z.ZodEffects<z.ZodString, string, string>;
+    }, "strip", z.ZodTypeAny, {
+        version: string;
+        digest: string;
+    }, {
+        version: string;
+        digest: string;
+    }>;
+    policy: z.ZodObject<{
+        id: z.ZodString;
+        version: z.ZodString;
+        digest: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        version: string;
+        digest?: string | undefined;
+    }, {
+        id: string;
+        version: string;
+        digest?: string | undefined;
+    }>;
+    model: z.ZodObject<{
+        provider: z.ZodString;
+        id: z.ZodString;
+        version: z.ZodString;
+        configDigest: z.ZodEffects<z.ZodString, string, string>;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        version: string;
+        provider: string;
+        configDigest: string;
+    }, {
+        id: string;
+        version: string;
+        provider: string;
+        configDigest: string;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    workflow: {
+        version: string;
+        name: string;
+        source: {
+            id: string;
+            kind: "repository" | "registry" | "workspace";
+            digest: string;
+            trusted: true;
+        };
+        irDigest: string;
+    };
+    version: "1";
+    runtimes: {
+        kind: "nodejs" | "bun" | "python3" | "go" | "java" | "kotlin" | "rust" | "php" | "csharp" | "ruby" | "swift" | "dart" | "elixir" | "docker" | "wasm" | "wasi";
+        version: string;
+    }[];
+    model: {
+        id: string;
+        version: string;
+        provider: string;
+        configDigest: string;
+    };
+    profile: "strict" | "advisory" | "guided";
+    runId: string;
+    bindingRuleId: string;
+    boundAt: string;
+    nodes: {
+        id: string;
+        version: string;
+        digest?: string | undefined;
+    }[];
+    capabilityManifest: {
+        version: string;
+        digest: string;
+    };
+    policy: {
+        id: string;
+        version: string;
+        digest?: string | undefined;
+    };
+}, {
+    workflow: {
+        version: string;
+        name: string;
+        source: {
+            id: string;
+            kind: "repository" | "registry" | "workspace";
+            digest: string;
+            trusted: true;
+        };
+        irDigest: string;
+    };
+    version: "1";
+    runtimes: {
+        kind: "nodejs" | "bun" | "python3" | "go" | "java" | "kotlin" | "rust" | "php" | "csharp" | "ruby" | "swift" | "dart" | "elixir" | "docker" | "wasm" | "wasi";
+        version: string;
+    }[];
+    model: {
+        id: string;
+        version: string;
+        provider: string;
+        configDigest: string;
+    };
+    profile: "strict" | "advisory" | "guided";
+    runId: string;
+    bindingRuleId: string;
+    boundAt: string;
+    nodes: {
+        id: string;
+        version: string;
+        digest?: string | undefined;
+    }[];
+    capabilityManifest: {
+        version: string;
+        digest: string;
+    };
+    policy: {
+        id: string;
+        version: string;
+        digest?: string | undefined;
+    };
+}>, {
+    workflow: {
+        version: string;
+        name: string;
+        source: {
+            id: string;
+            kind: "repository" | "registry" | "workspace";
+            digest: string;
+            trusted: true;
+        };
+        irDigest: string;
+    };
+    version: "1";
+    runtimes: {
+        kind: "nodejs" | "bun" | "python3" | "go" | "java" | "kotlin" | "rust" | "php" | "csharp" | "ruby" | "swift" | "dart" | "elixir" | "docker" | "wasm" | "wasi";
+        version: string;
+    }[];
+    model: {
+        id: string;
+        version: string;
+        provider: string;
+        configDigest: string;
+    };
+    profile: "strict" | "advisory" | "guided";
+    runId: string;
+    bindingRuleId: string;
+    boundAt: string;
+    nodes: {
+        id: string;
+        version: string;
+        digest?: string | undefined;
+    }[];
+    capabilityManifest: {
+        version: string;
+        digest: string;
+    };
+    policy: {
+        id: string;
+        version: string;
+        digest?: string | undefined;
+    };
+}, {
+    workflow: {
+        version: string;
+        name: string;
+        source: {
+            id: string;
+            kind: "repository" | "registry" | "workspace";
+            digest: string;
+            trusted: true;
+        };
+        irDigest: string;
+    };
+    version: "1";
+    runtimes: {
+        kind: "nodejs" | "bun" | "python3" | "go" | "java" | "kotlin" | "rust" | "php" | "csharp" | "ruby" | "swift" | "dart" | "elixir" | "docker" | "wasm" | "wasi";
+        version: string;
+    }[];
+    model: {
+        id: string;
+        version: string;
+        provider: string;
+        configDigest: string;
+    };
+    profile: "strict" | "advisory" | "guided";
+    runId: string;
+    bindingRuleId: string;
+    boundAt: string;
+    nodes: {
+        id: string;
+        version: string;
+        digest?: string | undefined;
+    }[];
+    capabilityManifest: {
+        version: string;
+        digest: string;
+    };
+    policy: {
+        id: string;
+        version: string;
+        digest?: string | undefined;
+    };
+}>;
+export declare const EnforcementOverrideScopeSchema: z.ZodEffects<z.ZodObject<{
+    stepIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    transitionIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    capabilityIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    stepIds?: string[] | undefined;
+    transitionIds?: string[] | undefined;
+    capabilityIds?: string[] | undefined;
+}, {
+    stepIds?: string[] | undefined;
+    transitionIds?: string[] | undefined;
+    capabilityIds?: string[] | undefined;
+}>, {
+    stepIds?: string[] | undefined;
+    transitionIds?: string[] | undefined;
+    capabilityIds?: string[] | undefined;
+}, {
+    stepIds?: string[] | undefined;
+    transitionIds?: string[] | undefined;
+    capabilityIds?: string[] | undefined;
+}>;
+export declare const EnforcementOverrideEventSchema: z.ZodObject<{
+    version: z.ZodLiteral<"1">;
+    eventType: z.ZodLiteral<"enforcement.override">;
+    eventId: z.ZodString;
+    timestamp: z.ZodString;
+    runId: z.ZodString;
+    profile: z.ZodLiteral<"guided">;
+    bindingRuleId: z.ZodString;
+    requestedBy: z.ZodOptional<z.ZodObject<{
+        id: z.ZodString;
+        kind: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        kind: string;
+    }, {
+        id: string;
+        kind: string;
+    }>>;
+    authorizedBy: z.ZodObject<{
+        id: z.ZodString;
+        kind: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        id: string;
+        kind: string;
+    }, {
+        id: string;
+        kind: string;
+    }>;
+    authorization: z.ZodObject<{
+        method: z.ZodLiteral<"durable-interaction">;
+        interactionId: z.ZodString;
+        decisionId: z.ZodString;
+        status: z.ZodLiteral<"answered">;
+    }, "strip", z.ZodTypeAny, {
+        interactionId: string;
+        status: "answered";
+        method: "durable-interaction";
+        decisionId: string;
+    }, {
+        interactionId: string;
+        status: "answered";
+        method: "durable-interaction";
+        decisionId: string;
+    }>;
+    reasonCode: z.ZodString;
+    reason: z.ZodOptional<z.ZodString>;
+    scope: z.ZodEffects<z.ZodObject<{
+        stepIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        transitionIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        capabilityIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        stepIds?: string[] | undefined;
+        transitionIds?: string[] | undefined;
+        capabilityIds?: string[] | undefined;
+    }, {
+        stepIds?: string[] | undefined;
+        transitionIds?: string[] | undefined;
+        capabilityIds?: string[] | undefined;
+    }>, {
+        stepIds?: string[] | undefined;
+        transitionIds?: string[] | undefined;
+        capabilityIds?: string[] | undefined;
+    }, {
+        stepIds?: string[] | undefined;
+        transitionIds?: string[] | undefined;
+        capabilityIds?: string[] | undefined;
+    }>;
+    expiresAt: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    version: "1";
+    profile: "guided";
+    scope: {
+        stepIds?: string[] | undefined;
+        transitionIds?: string[] | undefined;
+        capabilityIds?: string[] | undefined;
+    };
+    runId: string;
+    reasonCode: string;
+    bindingRuleId: string;
+    eventType: "enforcement.override";
+    eventId: string;
+    timestamp: string;
+    authorizedBy: {
+        id: string;
+        kind: string;
+    };
+    authorization: {
+        interactionId: string;
+        status: "answered";
+        method: "durable-interaction";
+        decisionId: string;
+    };
+    reason?: string | undefined;
+    expiresAt?: string | undefined;
+    requestedBy?: {
+        id: string;
+        kind: string;
+    } | undefined;
+}, {
+    version: "1";
+    profile: "guided";
+    scope: {
+        stepIds?: string[] | undefined;
+        transitionIds?: string[] | undefined;
+        capabilityIds?: string[] | undefined;
+    };
+    runId: string;
+    reasonCode: string;
+    bindingRuleId: string;
+    eventType: "enforcement.override";
+    eventId: string;
+    timestamp: string;
+    authorizedBy: {
+        id: string;
+        kind: string;
+    };
+    authorization: {
+        interactionId: string;
+        status: "answered";
+        method: "durable-interaction";
+        decisionId: string;
+    };
+    reason?: string | undefined;
+    expiresAt?: string | undefined;
+    requestedBy?: {
+        id: string;
+        kind: string;
+    } | undefined;
+}>;
+export declare class WorkflowBindingContractError extends Error {
+    readonly issues: readonly string[];
+    constructor(issues: readonly string[]);
+}
+/** Parse and canonicalize caller-controlled binding facts. */
+export declare function parseWorkflowBindingInputs(value: unknown): WorkflowBindingInputs;
+export declare function parseWorkflowBindingSelector(value: unknown): WorkflowBindingSelector;
+export declare function parseWorkflowBindingRule(value: unknown): WorkflowBindingRule;
+export declare function parseWorkflowBindingRules(value: unknown): WorkflowBindingRules;
+/** Parse a complete run contract; the returned value is safe to persist as a pin. */
+export declare function parsePinnedWorkflowRunContract(value: unknown): PinnedWorkflowRunContract;
+/** Parse a guided authorization event; strict/advisory bypass events are invalid. */
+export declare function parseEnforcementOverrideEvent(value: unknown): EnforcementOverrideEvent;
+export declare function serializeWorkflowBindingInputs(value: unknown): string;
+export declare function serializeWorkflowBindingRule(value: unknown): string;
+export declare function serializeWorkflowBindingRules(value: unknown): string;
+export declare function serializePinnedWorkflowRunContract(value: unknown): string;
+export declare function serializeEnforcementOverrideEvent(value: unknown): string;
+export declare function isEnforcementProfile(value: unknown): value is EnforcementProfile;