@blokjs/shared 2.1.0 → 2.2.0

package/dist/WorkflowBindingContracts.js

@@ -0,0 +1,339 @@
+import { z } from "zod";
+import { ENFORCEMENT_PROFILES, EnforcementProfileSchema } from "./EnforcementProfileContracts.js";
+/** Version of the language-neutral workflow binding contract. */
+export const WORKFLOW_BINDING_CONTRACT_VERSION = "1";
+export const WORKFLOW_RUN_CONTRACT_VERSION = "1";
+export const ENFORCEMENT_OVERRIDE_EVENT_VERSION = "1";
+export const WORKFLOW_BINDING_MAX_RULES = 128;
+export const WORKFLOW_BINDING_MAX_LABELS = 128;
+export const WORKFLOW_BINDING_MAX_PATHS = 128;
+export const WORKFLOW_BINDING_MAX_ATTRIBUTES = 64;
+export const WORKFLOW_BINDING_MAX_NODES = 512;
+export const WORKFLOW_BINDING_MAX_RUNTIMES = 32;
+export const WORKFLOW_BINDING_MAX_SCOPE_ITEMS = 128;
+export const WORKFLOW_BINDING_MAX_STRING_LENGTH = 256;
+export const WORKFLOW_BINDING_MAX_CONTRACT_BYTES = 512 * 1024;
+export const WORKFLOW_SOURCE_KINDS = ["registry", "repository", "workspace"];
+export const WORKFLOW_RUNTIME_KINDS = [
+    "nodejs",
+    "bun",
+    "python3",
+    "go",
+    "java",
+    "kotlin",
+    "rust",
+    "php",
+    "csharp",
+    "ruby",
+    "swift",
+    "dart",
+    "elixir",
+    "docker",
+    "wasm",
+    "wasi",
+];
+const IDENTIFIER = /^[A-Za-z][A-Za-z0-9._:/-]{0,127}$/;
+const DIGEST = /^(sha256):[0-9a-f]{64}$|^(sha512):[0-9a-f]{128}$/i;
+const PATH = /^[^\0]{1,256}$/;
+const identifier = z.string().min(1).max(128).regex(IDENTIFIER, "must be a bounded identifier");
+const boundedString = z.string().min(1).max(WORKFLOW_BINDING_MAX_STRING_LENGTH);
+const digest = z
+    .string()
+    .max(140)
+    .regex(DIGEST, "must be a sha256: or sha512: digest with the complete hexadecimal length")
+    .transform((value) => value.toLowerCase());
+const version = boundedString;
+const finiteNumber = z.number().finite();
+const bindingScalar = z.union([boundedString, finiteNumber, z.boolean()]);
+const stringList = (limit, valueSchema = identifier) => z.array(valueSchema).min(1).max(limit);
+const scalarRecord = z
+    .record(identifier, bindingScalar)
+    .refine((value) => Object.keys(value).length <= WORKFLOW_BINDING_MAX_ATTRIBUTES, `must contain at most ${WORKFLOW_BINDING_MAX_ATTRIBUTES} attributes`);
+const repositoryIdentitySchema = z.object({
+    provider: identifier,
+    id: identifier,
+    revision: boundedString.optional(),
+});
+const actorIdentitySchema = z.object({
+    id: identifier,
+    kind: identifier,
+});
+const pathList = stringList(WORKFLOW_BINDING_MAX_PATHS, z.string().regex(PATH, "must be a bounded path"));
+const labels = stringList(WORKFLOW_BINDING_MAX_LABELS);
+export const WorkflowBindingInputsSchema = z.object({
+    repository: repositoryIdentitySchema.optional(),
+    taskType: boundedString.optional(),
+    labels: labels.optional(),
+    paths: pathList.optional(),
+    tenant: boundedString.optional(),
+    actor: actorIdentitySchema.optional(),
+    environment: boundedString.optional(),
+    attributes: scalarRecord.optional(),
+});
+export const WorkflowBindingSelectorSchema = z.object({
+    repository: repositoryIdentitySchema.optional(),
+    taskTypes: stringList(WORKFLOW_BINDING_MAX_LABELS, boundedString).optional(),
+    labels: labels.optional(),
+    paths: pathList.optional(),
+    tenant: boundedString.optional(),
+    actors: stringList(WORKFLOW_BINDING_MAX_LABELS).optional(),
+    environments: stringList(WORKFLOW_BINDING_MAX_LABELS, boundedString).optional(),
+    attributes: scalarRecord.optional(),
+});
+const trustedSourceSchema = z.object({
+    kind: z.enum(WORKFLOW_SOURCE_KINDS),
+    id: identifier,
+    digest,
+    trusted: z.literal(true),
+});
+const workflowReferenceSchema = z.object({
+    name: identifier,
+    version,
+    source: trustedSourceSchema,
+    irDigest: digest,
+});
+export const WorkflowBindingRuleSchema = z.object({
+    version: z.literal(WORKFLOW_BINDING_CONTRACT_VERSION),
+    id: identifier,
+    priority: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+    selector: WorkflowBindingSelectorSchema,
+    workflow: workflowReferenceSchema,
+    profile: EnforcementProfileSchema,
+});
+export const WorkflowBindingRulesSchema = z
+    .array(WorkflowBindingRuleSchema)
+    .min(1)
+    .max(WORKFLOW_BINDING_MAX_RULES)
+    .superRefine((value, context) => {
+    const ids = new Set();
+    for (const [index, rule] of value.entries()) {
+        if (ids.has(rule.id)) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: [index, "id"],
+                message: "rule ids must be unique",
+            });
+        }
+        ids.add(rule.id);
+    }
+});
+const pinnedNodeSchema = z.object({ id: identifier, version, digest: digest.optional() });
+const pinnedRuntimeSchema = z.object({ kind: z.enum(WORKFLOW_RUNTIME_KINDS), version });
+const pinnedCapabilityManifestSchema = z.object({ version, digest });
+const pinnedPolicySchema = z.object({ id: identifier, version, digest: digest.optional() });
+const pinnedModelSchema = z.object({ provider: identifier, id: identifier, version, configDigest: digest });
+export const PinnedWorkflowRunContractSchema = z
+    .object({
+    version: z.literal(WORKFLOW_RUN_CONTRACT_VERSION),
+    runId: identifier,
+    profile: EnforcementProfileSchema,
+    bindingRuleId: identifier,
+    boundAt: boundedString,
+    workflow: workflowReferenceSchema,
+    nodes: z.array(pinnedNodeSchema).min(1).max(WORKFLOW_BINDING_MAX_NODES),
+    runtimes: z.array(pinnedRuntimeSchema).min(1).max(WORKFLOW_BINDING_MAX_RUNTIMES),
+    capabilityManifest: pinnedCapabilityManifestSchema,
+    policy: pinnedPolicySchema,
+    model: pinnedModelSchema,
+})
+    .superRefine((value, context) => {
+    const nodeIds = new Set();
+    for (const [index, node] of value.nodes.entries()) {
+        if (nodeIds.has(node.id)) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ["nodes", index, "id"],
+                message: "node ids must be unique",
+            });
+        }
+        nodeIds.add(node.id);
+    }
+    const runtimeKinds = new Set();
+    for (const [index, runtime] of value.runtimes.entries()) {
+        if (runtimeKinds.has(runtime.kind)) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ["runtimes", index, "kind"],
+                message: "runtime kinds must be unique",
+            });
+        }
+        runtimeKinds.add(runtime.kind);
+    }
+});
+const scopeList = z.array(identifier).min(1).max(WORKFLOW_BINDING_MAX_SCOPE_ITEMS);
+export const EnforcementOverrideScopeSchema = z
+    .object({
+    stepIds: scopeList.optional(),
+    transitionIds: scopeList.optional(),
+    capabilityIds: scopeList.optional(),
+})
+    .superRefine((value, context) => {
+    if (value.stepIds === undefined && value.transitionIds === undefined && value.capabilityIds === undefined) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "scope must name at least one step, transition, or capability",
+        });
+    }
+});
+const overrideAuthorizationSchema = z.object({
+    method: z.literal("durable-interaction"),
+    interactionId: identifier,
+    decisionId: identifier,
+    status: z.literal("answered"),
+});
+export const EnforcementOverrideEventSchema = z.object({
+    version: z.literal(ENFORCEMENT_OVERRIDE_EVENT_VERSION),
+    eventType: z.literal("enforcement.override"),
+    eventId: identifier,
+    timestamp: boundedString,
+    runId: identifier,
+    profile: z.literal("guided"),
+    bindingRuleId: identifier,
+    requestedBy: actorIdentitySchema.optional(),
+    authorizedBy: actorIdentitySchema,
+    authorization: overrideAuthorizationSchema,
+    reasonCode: identifier,
+    reason: boundedString.optional(),
+    scope: EnforcementOverrideScopeSchema,
+    expiresAt: boundedString.optional(),
+});
+export class WorkflowBindingContractError extends Error {
+    issues;
+    constructor(issues) {
+        super(`Invalid workflow binding contract: ${issues.join("; ")}`);
+        this.name = "WorkflowBindingContractError";
+        this.issues = [...issues];
+    }
+}
+function sortUnique(values) {
+    return [...new Set(values)].sort((left, right) => (left < right ? -1 : left > right ? 1 : 0));
+}
+function normalizeAttributes(value) {
+    const result = {};
+    for (const key of Object.keys(value).sort((left, right) => (left < right ? -1 : left > right ? 1 : 0))) {
+        result[key] = value[key];
+    }
+    return result;
+}
+function normalizeRepository(value) {
+    return {
+        provider: value.provider,
+        id: value.id,
+        ...(value.revision === undefined ? {} : { revision: value.revision }),
+    };
+}
+function normalizeInputs(value) {
+    return {
+        ...(value.repository ? { repository: normalizeRepository(value.repository) } : {}),
+        ...(value.taskType === undefined ? {} : { taskType: value.taskType }),
+        ...(value.labels ? { labels: sortUnique(value.labels) } : {}),
+        ...(value.paths ? { paths: sortUnique(value.paths) } : {}),
+        ...(value.tenant === undefined ? {} : { tenant: value.tenant }),
+        ...(value.actor ? { actor: { ...value.actor } } : {}),
+        ...(value.environment === undefined ? {} : { environment: value.environment }),
+        ...(value.attributes ? { attributes: normalizeAttributes(value.attributes) } : {}),
+    };
+}
+function normalizeSelector(value) {
+    return {
+        ...(value.repository ? { repository: normalizeRepository(value.repository) } : {}),
+        ...(value.taskTypes ? { taskTypes: sortUnique(value.taskTypes) } : {}),
+        ...(value.labels ? { labels: sortUnique(value.labels) } : {}),
+        ...(value.paths ? { paths: sortUnique(value.paths) } : {}),
+        ...(value.tenant === undefined ? {} : { tenant: value.tenant }),
+        ...(value.actors ? { actors: sortUnique(value.actors) } : {}),
+        ...(value.environments ? { environments: sortUnique(value.environments) } : {}),
+        ...(value.attributes ? { attributes: normalizeAttributes(value.attributes) } : {}),
+    };
+}
+function parseSchema(schema, value, label) {
+    const result = schema.safeParse(value);
+    if (!result.success) {
+        throw new WorkflowBindingContractError(result.error.issues.map((issue) => `${label}${issue.path.length > 0 ? `.${issue.path.join(".")}` : ""} ${issue.message}`));
+    }
+    return result.data;
+}
+function normalizeScope(value) {
+    return {
+        ...(value.stepIds ? { stepIds: sortUnique(value.stepIds) } : {}),
+        ...(value.transitionIds ? { transitionIds: sortUnique(value.transitionIds) } : {}),
+        ...(value.capabilityIds ? { capabilityIds: sortUnique(value.capabilityIds) } : {}),
+    };
+}
+function assertContractSize(value, label) {
+    const serialized = JSON.stringify(value);
+    if (new TextEncoder().encode(serialized).byteLength > WORKFLOW_BINDING_MAX_CONTRACT_BYTES) {
+        throw new WorkflowBindingContractError([`${label} exceeds ${WORKFLOW_BINDING_MAX_CONTRACT_BYTES} bytes`]);
+    }
+    return value;
+}
+function immutable(value) {
+    const snapshot = structuredClone(value);
+    const freeze = (item) => {
+        if (item === null || typeof item !== "object" || Object.isFrozen(item))
+            return;
+        for (const child of Object.values(item))
+            freeze(child);
+        Object.freeze(item);
+    };
+    freeze(snapshot);
+    return snapshot;
+}
+/** Parse and canonicalize caller-controlled binding facts. */
+export function parseWorkflowBindingInputs(value) {
+    return immutable(normalizeInputs(parseSchema(WorkflowBindingInputsSchema, value, "workflow binding inputs")));
+}
+export function parseWorkflowBindingSelector(value) {
+    return immutable(normalizeSelector(parseSchema(WorkflowBindingSelectorSchema, value, "workflow binding selector")));
+}
+export function parseWorkflowBindingRule(value) {
+    const parsed = parseSchema(WorkflowBindingRuleSchema, value, "workflow binding rule");
+    return immutable(assertContractSize({
+        ...parsed,
+        selector: normalizeSelector(parsed.selector),
+    }, "workflow binding rule"));
+}
+export function parseWorkflowBindingRules(value) {
+    const parsed = parseSchema(WorkflowBindingRulesSchema, value, "workflow binding rules");
+    return immutable(assertContractSize(parsed
+        .map((rule) => ({ ...rule, selector: normalizeSelector(rule.selector) }))
+        .sort((left, right) => left.priority !== right.priority
+        ? right.priority - left.priority
+        : left.id < right.id
+            ? -1
+            : left.id > right.id
+                ? 1
+                : 0), "workflow binding rules"));
+}
+/** Parse a complete run contract; the returned value is safe to persist as a pin. */
+export function parsePinnedWorkflowRunContract(value) {
+    const parsed = parseSchema(PinnedWorkflowRunContractSchema, value, "pinned workflow run contract");
+    return immutable(assertContractSize({
+        ...parsed,
+        nodes: [...parsed.nodes].sort((left, right) => (left.id < right.id ? -1 : left.id > right.id ? 1 : 0)),
+        runtimes: [...parsed.runtimes].sort((left, right) => left.kind < right.kind ? -1 : left.kind > right.kind ? 1 : 0),
+    }, "pinned workflow run contract"));
+}
+/** Parse a guided authorization event; strict/advisory bypass events are invalid. */
+export function parseEnforcementOverrideEvent(value) {
+    const parsed = parseSchema(EnforcementOverrideEventSchema, value, "enforcement override event");
+    return immutable(assertContractSize({ ...parsed, scope: normalizeScope(parsed.scope) }, "enforcement override event"));
+}
+export function serializeWorkflowBindingInputs(value) {
+    return JSON.stringify(parseWorkflowBindingInputs(value));
+}
+export function serializeWorkflowBindingRule(value) {
+    return JSON.stringify(parseWorkflowBindingRule(value));
+}
+export function serializeWorkflowBindingRules(value) {
+    return JSON.stringify(parseWorkflowBindingRules(value));
+}
+export function serializePinnedWorkflowRunContract(value) {
+    return JSON.stringify(parsePinnedWorkflowRunContract(value));
+}
+export function serializeEnforcementOverrideEvent(value) {
+    return JSON.stringify(parseEnforcementOverrideEvent(value));
+}
+export function isEnforcementProfile(value) {
+    return typeof value === "string" && ENFORCEMENT_PROFILES.includes(value);
+}

package/dist/index.d.ts

@@ -6,11 +6,18 @@
  * published as a back-compat alias — existing imports keep working unchanged —
  * but new code should import from `@blokjs/core`.
  */
-import BlokError, { type BlokErrorOpts, DEFAULT_HTTP_STATUS, DEFAULT_RETRYABLE, ErrorCategory, ErrorSeverity, isNonRetryableValidationError, type NodeErrorPayload, WORKFLOW_INPUT_VALIDATION, WorkflowInputValidationError, type WorkflowInputValidationInfo, type WorkflowInputValidationIssue } from "./BlokError.js";
+import BlokError, { type BlokErrorOpts, DEFAULT_HTTP_STATUS, DEFAULT_RETRYABLE, ErrorCategory, ErrorSeverity, isNonRetryableError, isNonRetryableStepError, isNonRetryableValidationError, markNonRetryableStepError, type NodeErrorPayload, WORKFLOW_INPUT_VALIDATION, WorkflowInputValidationError, type WorkflowInputValidationInfo, type WorkflowInputValidationIssue } from "./BlokError.js";
+import { CAPABILITY_CLASSIFICATIONS, CAPABILITY_DETERMINISM, CAPABILITY_EFFECTS, CAPABILITY_IDEMPOTENCY, CAPABILITY_MANIFEST_VERSION, CAPABILITY_MATURITY, type CapabilityClassification, type CapabilityDeterminism, type CapabilityEffect, type CapabilityIdempotency, type CapabilityManifestAssessment, CapabilityManifestError, type CapabilityManifestStatus, type CapabilityManifestV1, type CapabilityMaturity, type CapabilityResourceBounds, assessCapabilityManifest, parseCapabilityManifest, requireAgentEligibleManifest, serializeCapabilityManifest } from "./CapabilityManifest.js";
+export { WASI_COMPONENT_CAPABILITIES, WASI_COMPONENT_CONTRACT_VERSION, WASI_COMPONENT_MANIFEST_VERSION, WASI_COMPONENT_MEDIA_TYPE, WASI_COMPONENT_WASI_VERSION, WASI_COMPONENT_WIT_PACKAGE, WASI_COMPONENT_WIT_VERSION, WASI_COMPONENT_WIT_WORLD, WasiComponentArtifactSchema, WasiComponentErrorSchema, WasiComponentExecutionRequestSchema, WasiComponentExecutionResponseSchema, WasiComponentLimitsSchema, WasiComponentManifestSchema, WasiComponentNodeSchema, WasiComponentWorldSchema, parseWasiComponentManifest, serializeWasiComponentManifest, } from "./WasiComponentContracts.js";
+export type { WasiComponentArtifact, WasiComponentExecutionRequest, WasiComponentExecutionResponse, WasiComponentLimits, WasiComponentManifestV1, WasiComponentNode, WasiComponentReadiness, WasiComponentWorld, } from "./WasiComponentContracts.js";
 import GlobalError from "./GlobalError.js";
 import GlobalLogger from "./GlobalLogger.js";
 import { Metrics, type MetricsType } from "./Metrics.js";
 import NodeBase from "./NodeBase.js";
+export { JAVASCRIPT_RUNTIMES, JavaScriptRuntimeSchema, JavaScriptRuntimeSelectionSchema, PackageManagerSchema, PACKAGE_MANAGERS, RUNTIME_KINDS, RuntimeCapabilityManifestSchema, RuntimeKindInputSchema, RuntimeKindSchema, normalizeJavaScriptRuntime, normalizeRuntimeKind, runtimeKindForJavaScriptRuntime, } from "./RuntimeContracts.js";
+export type { JavaScriptRuntime, JavaScriptRuntimeSelection, PackageManager, RuntimeCapabilityManifest, RuntimeDiagnostic, RuntimeKind, RuntimeKindInput, RuntimeNormalization, } from "./RuntimeContracts.js";
+export { CapabilityAuthorityError, CapabilityAuthoritySchema, CapabilityFragmentValueSchema, assertCapabilityAuthoritySubset, intersectCapabilityAuthorities, isCapabilityAuthoritySubset, parseCapabilityAuthority, } from "./PermissionAlgebra.js";
+export type { CapabilityAuthority } from "./PermissionAlgebra.js";
 import Trigger from "./Trigger.js";
 import type ConfigContext from "./types/ConfigContext.js";
 import type ConnectionContext from "./types/ConnectionContext.js";
@@ -32,4 +39,28 @@ import { MapperResolutionError } from "./utils/MapperResolutionError.js";
 import MemoryUsage from "./utils/MemoryUsage.js";
 import { NamedMissingStateError } from "./utils/NamedMissingStateError.js";
 import { type StructuralRef, type StructuralTpl, isStructuralRef, isStructuralTpl, lowerRefs } from "./utils/lowerRefs.js";
-export { NodeBase, type Context, type RequestContext, type ResponseContext, RESPOND_BRAND, type RespondEnvelope, isRespondEnvelope, type EnvContext, type ErrorContext, type LoggerContext, type ConfigContext, type ConnectionContext, type StreamContext, Trigger, type NodeConfigContext, type FunctionContext, type StateContext, type VarsContext, type Step, GlobalLogger, GlobalError, BlokError, type BlokErrorOpts, type NodeErrorPayload, ErrorCategory, ErrorSeverity, DEFAULT_HTTP_STATUS, DEFAULT_RETRYABLE, isNonRetryableValidationError, WORKFLOW_INPUT_VALIDATION, WorkflowInputValidationError, type WorkflowInputValidationInfo, type WorkflowInputValidationIssue, Metrics, MemoryUsage, type MetricsType, mapper, MapperResolutionError, NamedMissingStateError, lowerRefs, isStructuralRef, isStructuralTpl, type StructuralRef, type StructuralTpl, };
+export { AGENT_CAPABILITY_CONTRACT_VERSION, CAPABILITY_MAX_ID_LENGTH, CAPABILITY_MAX_LIST_ITEMS, CAPABILITY_MAX_OUTPUT_CHUNK_BYTES, CAPABILITY_MAX_PATH_LENGTH, CapabilityContractError, CapabilityOwnerSchema, WorkspacePathRefSchema, assertAuthorized, assertOwned, capabilityScope, parseCapabilityAuthorization, parseCapabilityOwner, parseWorkspacePathRef, } from "./CapabilityContracts.js";
+export type { CapabilityAuthorizationPort, CapabilityOwner, CapabilityRequestContext, WorkspacePathRef, } from "./CapabilityContracts.js";
+export { GIT_CAPABILITY_CONTRACT_VERSION, GIT_DESTRUCTIVE_OPERATIONS, GIT_OPERATIONS, GIT_MAX_BRANCH_NAME_LENGTH, GIT_MAX_CHANGED_FILES, assertGitOperationAllowed, assertGitOwner, assertGitPolicyAllowed, gitCapabilityScope, parseGitDiffEvidence, parseGitDirtyState, parseGitOperation, parseGitRepositoryIdentity, parseGitWorktreeCreateRequest, parseGitWorktreeIdentity, workspacePathForGit, } from "./GitCapabilityContracts.js";
+export type { GitCapability, GitCapabilityRequest, GitChangeStatus, GitDiffEvidence, GitDiffFile, GitDirtyState, GitDestructiveOperation, GitOperation, GitRepositoryIdentity, GitRevisionIdentity, GitWorktreeCreateRequest, GitWorktreeCleanupRequest, GitWorktreeIdentity, } from "./GitCapabilityContracts.js";
+export { PROCESS_CAPABILITY_CONTRACT_VERSION, PROCESS_CAPABILITY_IDS, PROCESS_DEFAULT_LIMITS, assertBoundedOutputChunk, assertProcessOwner, assertProcessPolicyAllowed, assertProcessStartResult, parseProcessCancellationRequest, parseProcessHandle, parseProcessOutput, parseProcessOutputChunk, parseProcessOrphanCleanupRequest, parseProcessResult, parseProcessSpec, processCapabilityId, processCapabilityScope, processWorkspaceCwd, } from "./ProcessCapabilityContracts.js";
+export type { ExecutableProcessSpec, NetworkDestination, ProcessCapability, ProcessCapabilityId, ProcessCancellationRequest, ProcessEnvironmentBinding, ProcessHandle, ProcessHandleRequest, ProcessLifecycleStatus, ProcessNetworkPolicy, ProcessOrphanCleanupRequest, ProcessOutputChunk, ProcessOutputSnapshot, ProcessResourceLimits, ProcessResult, ProcessStartResult, ProcessSpec, ProcessSpecBase, ProcessStartRequest, ShellStringProcessSpec, } from "./ProcessCapabilityContracts.js";
+export type { AuditEventBase, AuditRedactionState, AuditSink, ExecutionOrigin, InteractionAttribution, InteractionRequest, InteractionSuspension, InteractionSuspensionPort, PolicyContext, PolicyDecision, PolicyDecisionKind, PolicyEvaluationResult, PolicyLayer, PolicyLayerName, PolicyProvider, PolicyRequest, PolicyRuleMatch, PostExecutionAuditEvent, PreExecutionAuditEvent, PrincipalIdentity, RequestedCapabilityScope, SandboxAttestation, SessionIdentity, StepIdentity, TurnIdentity, WorkflowIdentity, } from "./PolicyContracts.js";
+export type { AgentCompletionContract, AgentStepContract, ApprovalContract, AssertionGateContract, EvidenceGateContract, EvidenceGateRequirement, OutputTrust, TrustedEvidence, } from "./EnforcementContracts.js";
+export { ENFORCEMENT_CONTRACT_VERSION, EnforcementViolationError, } from "./EnforcementContracts.js";
+export type { EnforcementProfile, EnforcementProfileContract, EnforcementProfileSemantics, } from "./EnforcementProfileContracts.js";
+export { ENFORCEMENT_PROFILE_CONTRACT_VERSION, ENFORCEMENT_PROFILE_SEMANTICS, ENFORCEMENT_PROFILES, EnforcementProfileContractError, EnforcementProfileContractSchema, EnforcementProfileSchema, enforcementProfileSemantics, parseEnforcementProfile, parseEnforcementProfileContract, serializeEnforcementProfileContract, } from "./EnforcementProfileContracts.js";
+export type { BindingActorIdentity, BindingScalar, EnforcementOverrideAuthorization, EnforcementOverrideEvent, EnforcementOverrideScope, PinnedCapabilityManifestIdentity, PinnedModelConfigurationIdentity, PinnedNodeIdentity, PinnedPolicyIdentity, PinnedRuntimeIdentity, PinnedWorkflowRunContract, RepositoryIdentity, TrustedWorkflowSource, WorkflowBindingInputs, WorkflowBindingRule, WorkflowBindingRules, WorkflowBindingSelector, WorkflowReference, WorkflowRuntimeKind, WorkflowSourceKind, } from "./WorkflowBindingContracts.js";
+export { ENFORCEMENT_OVERRIDE_EVENT_VERSION, WORKFLOW_BINDING_CONTRACT_VERSION, WORKFLOW_BINDING_MAX_ATTRIBUTES, WORKFLOW_BINDING_MAX_CONTRACT_BYTES, WORKFLOW_BINDING_MAX_LABELS, WORKFLOW_BINDING_MAX_NODES, WORKFLOW_BINDING_MAX_PATHS, WORKFLOW_BINDING_MAX_RULES, WORKFLOW_BINDING_MAX_SCOPE_ITEMS, WORKFLOW_BINDING_MAX_STRING_LENGTH, WORKFLOW_BINDING_MAX_RUNTIMES, WORKFLOW_RUN_CONTRACT_VERSION, EnforcementOverrideEventSchema, EnforcementOverrideScopeSchema, PinnedWorkflowRunContractSchema, WorkflowBindingContractError, WorkflowBindingInputsSchema, WorkflowBindingRuleSchema, WorkflowBindingRulesSchema, WorkflowBindingSelectorSchema, isEnforcementProfile, parseEnforcementOverrideEvent, parsePinnedWorkflowRunContract, parseWorkflowBindingInputs, parseWorkflowBindingRule, parseWorkflowBindingRules, parseWorkflowBindingSelector, serializeEnforcementOverrideEvent, serializePinnedWorkflowRunContract, serializeWorkflowBindingInputs, serializeWorkflowBindingRule, serializeWorkflowBindingRules, WORKFLOW_RUNTIME_KINDS, WORKFLOW_SOURCE_KINDS, } from "./WorkflowBindingContracts.js";
+export type { SecretLease, SecretRef, SecretRequest, SecretResolutionAuditEvent, SecretResolutionFailure, SecretResolver, } from "./SecretContracts.js";
+export type { InteractionPayload, InteractionAnswer, InteractionRecord, InteractionStatus, InteractionStore, } from "./InteractionContracts.js";
+export type { ApprovalRequirement, ArtifactIdentity, ArtifactVersionIdentity, CompletionContract, CompletionRequirement, EvidenceArtifactIdentity, EvidenceCheck, EvidenceCheckOutcome, EvidenceKind, EvidencePayload, EvidenceProducerIdentity, EvidenceProducerKind, EvidenceProvenanceIdentity, EvidenceRecord, EvidenceRequirement, EvidenceVerificationMethod, EvidenceVerificationResult, EvidenceVerificationStatus, EvidenceVerifierIdentity, EvidenceVerifierKind, } from "./EvidenceContracts.js";
+export { ApprovalRequirementSchema, ArtifactIdentitySchema, ArtifactVersionIdentitySchema, CompletionContractSchema, CompletionRequirementSchema, EvidenceCheckSchema, EvidenceContractError, EvidenceProducerIdentitySchema, EvidenceProvenanceIdentitySchema, EvidenceRecordSchema, EvidenceRequirementSchema, EvidencePayloadSchema, EvidenceTraceIdentitySchema, EvidenceVerificationResultSchema, EvidenceVerifierIdentitySchema, EVIDENCE_CHECK_OUTCOMES, EVIDENCE_CONTRACT_VERSION, EVIDENCE_MAX_CHECKS, EVIDENCE_MAX_PAYLOAD_DEPTH, EVIDENCE_MAX_PAYLOAD_ITEMS, EVIDENCE_MAX_RECORD_BYTES, EVIDENCE_MAX_REQUIREMENTS, EVIDENCE_MAX_STRING_LENGTH, EVIDENCE_PRODUCER_KINDS, EVIDENCE_VERIFICATION_METHODS, EVIDENCE_VERIFICATION_STATUSES, EVIDENCE_VERIFIER_KINDS, parseCompletionContract, parseEvidencePayload, parseEvidenceRecord, rejectModelEvidence, serializeCompletionContract, serializeEvidenceRecord, } from "./EvidenceContracts.js";
+export type { EffectRetryEvidence, EffectRetryEvidenceOutcome, JoinBranchObligation, JoinBranchResult, JoinBranchStatus, JoinContract, JoinJsonSchema, JoinOutputDeclaration, JoinResult, RetryResumeEffect, RetryResumeIdempotencyContract, RetryResumeIdempotencyMode, } from "./JoinContracts.js";
+export { EffectRetryEvidenceSchema, JOIN_CONTRACT_VERSION, JOIN_MAX_BRANCHES, JOIN_MAX_CONTRACT_BYTES, JOIN_MAX_OUTPUTS, JOIN_MAX_SCHEMA_DEPTH, JoinBranchObligationSchema, JoinContractError, JoinContractSchema, JoinOutputDeclarationSchema, RETRY_RESUME_IDEMPOTENCY_CONTRACT_VERSION, RETRY_RESUME_MAX_ATTEMPTS, RETRY_RESUME_MAX_EVIDENCE, RETRY_RESUME_MAX_RESUMES, RetryResumeContractError, RetryResumeIdempotencyContractSchema, assertEffectRetryEvidence, assertJoinSatisfied, parseEffectRetryEvidence, parseJoinContract, parseRetryResumeIdempotencyContract, serializeJoinContract, } from "./JoinContracts.js";
+export { INTERACTION_MAX_LINEAGE_DEPTH, INTERACTION_MAX_LINEAGE_PATH, INTERACTION_MAX_PAYLOAD_BYTES, INTERACTION_MAX_PAYLOAD_DEPTH, INTERACTION_MAX_PAYLOAD_ITEMS, INTERACTION_MAX_STRING_LENGTH, INTERACTION_REDACTED_VALUE, INTERACTION_VERSION, InteractionContractError, fingerprintInteractionPayload, immutableInteractionSnapshot, parseInteractionAnswer, parseInteractionPayload, redactInteractionDecision, redactInteractionPayload, redactInteractionRequest, redactInteractionString, } from "./InteractionContracts.js";
+export type { AuthoritativeSourceReadRequest, AuthoritativeSourceReader, AuthoritativeSourceSnapshot, GraphError, GraphErrorCategory, GraphFreshness, GraphFreshnessState, GraphFreshnessRequest, GraphImpactRequest, GraphIndexFile, GraphIndexRequest, GraphIndexResponse, GraphIndexSource, GraphLocation, GraphProvenance, GraphProvider, GraphQueryOptions, GraphQueryResponse, GraphRange, GraphRelation, GraphRelationDirection, GraphRelationKind, GraphRelationRequest, GraphRepositoryIdentity, GraphResultState, GraphResultStatus, GraphScope, GraphSearchHit, GraphSearchKind, GraphSearchRequest, GraphSymbol, GraphSymbolKind, GraphSymbolRequest, GraphWorktreeIdentity, } from "./GraphContracts.js";
+export { GRAPH_CONTRACT_VERSION, GRAPH_FRESHNESS_STATES, GRAPH_INDEX_SOURCES, GRAPH_MAX_DEPTH, GRAPH_MAX_FILES_PER_INDEX, GRAPH_MAX_INDEX_BYTES, GRAPH_MAX_ITEMS, GRAPH_MAX_PATH_LENGTH, GRAPH_MAX_RESPONSE_BYTES, GRAPH_MAX_STRING_LENGTH, GRAPH_RELATION_DIRECTIONS, GRAPH_RELATION_KINDS, GRAPH_RESULT_STATES, GRAPH_SEARCH_KINDS, GRAPH_SYMBOL_KINDS, AuthoritativeSourceReadRequestSchema, AuthoritativeSourceSnapshotSchema, GraphContractError, GraphErrorSchema, GraphFreshnessSchema, GraphFreshnessRequestSchema, GraphImpactRequestSchema, GraphIndexFileSchema, GraphIndexRequestSchema, GraphLocationSchema, GraphProvenanceSchema, GraphRangeSchema, GraphRelationSchema, GraphRelationRequestSchema, GraphRepositoryIdentitySchema, GraphResultStatusSchema, GraphScopeSchema, GraphSearchHitSchema, GraphSearchRequestSchema, GraphSymbolSchema, GraphSymbolRequestSchema, GraphWorktreeIdentitySchema, parseAuthoritativeSourceReadRequest, parseGraphImpactRequest, parseGraphFreshnessRequest, parseGraphIndexRequest, parseGraphIndexResponse, parseGraphQueryResponse, parseGraphRelationRequest, parseGraphScope, parseGraphSearchRequest, parseGraphSymbolRequest, serializeGraphContract, } from "./GraphContracts.js";
+export type { AgentSessionActorKind, AgentSessionEvent, AgentSessionEventKind, AgentSessionEventVisibility, SessionEvent, AgentSessionEventKind as SessionEventKind, AgentSessionEventVisibility as SessionEventVisibility, AgentSessionActorKind as SessionActorKind, SessionActor, SessionJsonValue, SessionEventInput, SessionCursor, SessionEventPage, CorruptSessionTail, SessionSnapshot, SessionFork, SessionMessage, SessionState, SessionFoldOptions, AppendSessionEventsInput, AppendSessionEventsResult, SessionRetentionOptions, SessionStore, ArtifactReference, } from "./AgentSessionContracts.js";
+export { AGENT_SESSION_CONTRACT_VERSION, AGENT_SESSION_SCHEMA_VERSION, AGENT_SESSION_MAX_EVENT_BYTES, AGENT_SESSION_MAX_PAYLOAD_DEPTH, AGENT_SESSION_MAX_PAYLOAD_ITEMS, AGENT_SESSION_MAX_STRING_LENGTH, AGENT_SESSION_MAX_EVENTS_PER_APPEND, AGENT_SESSION_MAX_PAGE_SIZE, AGENT_SESSION_MAX_SNAPSHOT_BYTES, AGENT_SESSION_EVENT_KINDS, AgentSessionContractError, SessionConcurrencyError, SessionCorruptTailError, ArtifactReferenceSchema, SessionJsonValueSchema, SessionActorSchema, SessionEventSchema, SessionEventInputSchema, parseArtifactReference, parseSessionEvent, parseSessionEventInput, serializeSessionEvent, parseSessionCursor, cursorForSequence, immutableSessionSnapshot, fingerprintSessionEvent, foldSessionEvents, } from "./AgentSessionContracts.js";
+export { CAPABILITY_MANIFEST_VERSION, CAPABILITY_EFFECTS, CAPABILITY_CLASSIFICATIONS, CAPABILITY_DETERMINISM, CAPABILITY_IDEMPOTENCY, CAPABILITY_MATURITY, CapabilityManifestError, parseCapabilityManifest, serializeCapabilityManifest, assessCapabilityManifest, requireAgentEligibleManifest, type CapabilityEffect, type CapabilityClassification, type CapabilityDeterminism, type CapabilityIdempotency, type CapabilityMaturity, type CapabilityResourceBounds, type CapabilityManifestV1, type CapabilityManifestStatus, type CapabilityManifestAssessment, NodeBase, type Context, type RequestContext, type ResponseContext, RESPOND_BRAND, type RespondEnvelope, isRespondEnvelope, type EnvContext, type ErrorContext, type LoggerContext, type ConfigContext, type ConnectionContext, type StreamContext, Trigger, type NodeConfigContext, type FunctionContext, type StateContext, type VarsContext, type Step, GlobalLogger, GlobalError, BlokError, type BlokErrorOpts, type NodeErrorPayload, ErrorCategory, ErrorSeverity, DEFAULT_HTTP_STATUS, DEFAULT_RETRYABLE, isNonRetryableValidationError, isNonRetryableError, markNonRetryableStepError, isNonRetryableStepError, WORKFLOW_INPUT_VALIDATION, WorkflowInputValidationError, type WorkflowInputValidationInfo, type WorkflowInputValidationIssue, Metrics, MemoryUsage, type MetricsType, mapper, MapperResolutionError, NamedMissingStateError, lowerRefs, isStructuralRef, isStructuralTpl, type StructuralRef, type StructuralTpl, };

package/dist/index.js

@@ -6,11 +6,15 @@
  * published as a back-compat alias — existing imports keep working unchanged —
  * but new code should import from `@blokjs/core`.
  */
-import BlokError, { DEFAULT_HTTP_STATUS, DEFAULT_RETRYABLE, ErrorCategory, ErrorSeverity, isNonRetryableValidationError, WORKFLOW_INPUT_VALIDATION, WorkflowInputValidationError, } from "./BlokError.js";
+import BlokError, { DEFAULT_HTTP_STATUS, DEFAULT_RETRYABLE, ErrorCategory, ErrorSeverity, isNonRetryableError, isNonRetryableStepError, isNonRetryableValidationError, markNonRetryableStepError, WORKFLOW_INPUT_VALIDATION, WorkflowInputValidationError, } from "./BlokError.js";
+import { CAPABILITY_CLASSIFICATIONS, CAPABILITY_DETERMINISM, CAPABILITY_EFFECTS, CAPABILITY_IDEMPOTENCY, CAPABILITY_MANIFEST_VERSION, CAPABILITY_MATURITY, CapabilityManifestError, assessCapabilityManifest, parseCapabilityManifest, requireAgentEligibleManifest, serializeCapabilityManifest, } from "./CapabilityManifest.js";
+export { WASI_COMPONENT_CAPABILITIES, WASI_COMPONENT_CONTRACT_VERSION, WASI_COMPONENT_MANIFEST_VERSION, WASI_COMPONENT_MEDIA_TYPE, WASI_COMPONENT_WASI_VERSION, WASI_COMPONENT_WIT_PACKAGE, WASI_COMPONENT_WIT_VERSION, WASI_COMPONENT_WIT_WORLD, WasiComponentArtifactSchema, WasiComponentErrorSchema, WasiComponentExecutionRequestSchema, WasiComponentExecutionResponseSchema, WasiComponentLimitsSchema, WasiComponentManifestSchema, WasiComponentNodeSchema, WasiComponentWorldSchema, parseWasiComponentManifest, serializeWasiComponentManifest, } from "./WasiComponentContracts.js";
 import GlobalError from "./GlobalError.js";
 import GlobalLogger from "./GlobalLogger.js";
 import { Metrics } from "./Metrics.js";
 import NodeBase from "./NodeBase.js";
+export { JAVASCRIPT_RUNTIMES, JavaScriptRuntimeSchema, JavaScriptRuntimeSelectionSchema, PackageManagerSchema, PACKAGE_MANAGERS, RUNTIME_KINDS, RuntimeCapabilityManifestSchema, RuntimeKindInputSchema, RuntimeKindSchema, normalizeJavaScriptRuntime, normalizeRuntimeKind, runtimeKindForJavaScriptRuntime, } from "./RuntimeContracts.js";
+export { CapabilityAuthorityError, CapabilityAuthoritySchema, CapabilityFragmentValueSchema, assertCapabilityAuthoritySubset, intersectCapabilityAuthorities, isCapabilityAuthoritySubset, parseCapabilityAuthority, } from "./PermissionAlgebra.js";
 import Trigger from "./Trigger.js";
 import { RESPOND_BRAND, isRespondEnvelope } from "./types/RespondEnvelope.js";
 import mapper from "./utils/Mapper.js";
@@ -18,7 +22,22 @@ import { MapperResolutionError } from "./utils/MapperResolutionError.js";
 import MemoryUsage from "./utils/MemoryUsage.js";
 import { NamedMissingStateError } from "./utils/NamedMissingStateError.js";
 import { isStructuralRef, isStructuralTpl, lowerRefs } from "./utils/lowerRefs.js";
-export { NodeBase, RESPOND_BRAND, isRespondEnvelope, Trigger, GlobalLogger, GlobalError, BlokError, ErrorCategory, ErrorSeverity, DEFAULT_HTTP_STATUS, DEFAULT_RETRYABLE, isNonRetryableValidationError, WORKFLOW_INPUT_VALIDATION, WorkflowInputValidationError, Metrics, MemoryUsage, mapper, MapperResolutionError, NamedMissingStateError, lowerRefs, 
+export { AGENT_CAPABILITY_CONTRACT_VERSION, CAPABILITY_MAX_ID_LENGTH, CAPABILITY_MAX_LIST_ITEMS, CAPABILITY_MAX_OUTPUT_CHUNK_BYTES, CAPABILITY_MAX_PATH_LENGTH, CapabilityContractError, CapabilityOwnerSchema, WorkspacePathRefSchema, assertAuthorized, assertOwned, capabilityScope, parseCapabilityAuthorization, parseCapabilityOwner, parseWorkspacePathRef, } from "./CapabilityContracts.js";
+export { GIT_CAPABILITY_CONTRACT_VERSION, GIT_DESTRUCTIVE_OPERATIONS, GIT_OPERATIONS, GIT_MAX_BRANCH_NAME_LENGTH, GIT_MAX_CHANGED_FILES, assertGitOperationAllowed, assertGitOwner, assertGitPolicyAllowed, gitCapabilityScope, parseGitDiffEvidence, parseGitDirtyState, parseGitOperation, parseGitRepositoryIdentity, parseGitWorktreeCreateRequest, parseGitWorktreeIdentity, workspacePathForGit, } from "./GitCapabilityContracts.js";
+export { PROCESS_CAPABILITY_CONTRACT_VERSION, PROCESS_CAPABILITY_IDS, PROCESS_DEFAULT_LIMITS, assertBoundedOutputChunk, assertProcessOwner, assertProcessPolicyAllowed, assertProcessStartResult, parseProcessCancellationRequest, parseProcessHandle, parseProcessOutput, parseProcessOutputChunk, parseProcessOrphanCleanupRequest, parseProcessResult, parseProcessSpec, processCapabilityId, processCapabilityScope, processWorkspaceCwd, } from "./ProcessCapabilityContracts.js";
+export { ENFORCEMENT_CONTRACT_VERSION, EnforcementViolationError, } from "./EnforcementContracts.js";
+export { ENFORCEMENT_PROFILE_CONTRACT_VERSION, ENFORCEMENT_PROFILE_SEMANTICS, ENFORCEMENT_PROFILES, EnforcementProfileContractError, EnforcementProfileContractSchema, EnforcementProfileSchema, enforcementProfileSemantics, parseEnforcementProfile, parseEnforcementProfileContract, serializeEnforcementProfileContract, } from "./EnforcementProfileContracts.js";
+export { ENFORCEMENT_OVERRIDE_EVENT_VERSION, WORKFLOW_BINDING_CONTRACT_VERSION, WORKFLOW_BINDING_MAX_ATTRIBUTES, WORKFLOW_BINDING_MAX_CONTRACT_BYTES, WORKFLOW_BINDING_MAX_LABELS, WORKFLOW_BINDING_MAX_NODES, WORKFLOW_BINDING_MAX_PATHS, WORKFLOW_BINDING_MAX_RULES, WORKFLOW_BINDING_MAX_SCOPE_ITEMS, WORKFLOW_BINDING_MAX_STRING_LENGTH, WORKFLOW_BINDING_MAX_RUNTIMES, WORKFLOW_RUN_CONTRACT_VERSION, EnforcementOverrideEventSchema, EnforcementOverrideScopeSchema, PinnedWorkflowRunContractSchema, WorkflowBindingContractError, WorkflowBindingInputsSchema, WorkflowBindingRuleSchema, WorkflowBindingRulesSchema, WorkflowBindingSelectorSchema, isEnforcementProfile, parseEnforcementOverrideEvent, parsePinnedWorkflowRunContract, parseWorkflowBindingInputs, parseWorkflowBindingRule, parseWorkflowBindingRules, parseWorkflowBindingSelector, serializeEnforcementOverrideEvent, serializePinnedWorkflowRunContract, serializeWorkflowBindingInputs, serializeWorkflowBindingRule, serializeWorkflowBindingRules, WORKFLOW_RUNTIME_KINDS, WORKFLOW_SOURCE_KINDS, } from "./WorkflowBindingContracts.js";
+export { ApprovalRequirementSchema, ArtifactIdentitySchema, ArtifactVersionIdentitySchema, CompletionContractSchema, CompletionRequirementSchema, EvidenceCheckSchema, EvidenceContractError, EvidenceProducerIdentitySchema, EvidenceProvenanceIdentitySchema, EvidenceRecordSchema, EvidenceRequirementSchema, EvidencePayloadSchema, EvidenceTraceIdentitySchema, EvidenceVerificationResultSchema, EvidenceVerifierIdentitySchema, EVIDENCE_CHECK_OUTCOMES, EVIDENCE_CONTRACT_VERSION, EVIDENCE_MAX_CHECKS, EVIDENCE_MAX_PAYLOAD_DEPTH, EVIDENCE_MAX_PAYLOAD_ITEMS, EVIDENCE_MAX_RECORD_BYTES, EVIDENCE_MAX_REQUIREMENTS, EVIDENCE_MAX_STRING_LENGTH, EVIDENCE_PRODUCER_KINDS, EVIDENCE_VERIFICATION_METHODS, EVIDENCE_VERIFICATION_STATUSES, EVIDENCE_VERIFIER_KINDS, parseCompletionContract, parseEvidencePayload, parseEvidenceRecord, rejectModelEvidence, serializeCompletionContract, serializeEvidenceRecord, } from "./EvidenceContracts.js";
+export { EffectRetryEvidenceSchema, JOIN_CONTRACT_VERSION, JOIN_MAX_BRANCHES, JOIN_MAX_CONTRACT_BYTES, JOIN_MAX_OUTPUTS, JOIN_MAX_SCHEMA_DEPTH, JoinBranchObligationSchema, JoinContractError, JoinContractSchema, JoinOutputDeclarationSchema, RETRY_RESUME_IDEMPOTENCY_CONTRACT_VERSION, RETRY_RESUME_MAX_ATTEMPTS, RETRY_RESUME_MAX_EVIDENCE, RETRY_RESUME_MAX_RESUMES, RetryResumeContractError, RetryResumeIdempotencyContractSchema, assertEffectRetryEvidence, assertJoinSatisfied, parseEffectRetryEvidence, parseJoinContract, parseRetryResumeIdempotencyContract, serializeJoinContract, } from "./JoinContracts.js";
+export { INTERACTION_MAX_LINEAGE_DEPTH, INTERACTION_MAX_LINEAGE_PATH, INTERACTION_MAX_PAYLOAD_BYTES, INTERACTION_MAX_PAYLOAD_DEPTH, INTERACTION_MAX_PAYLOAD_ITEMS, INTERACTION_MAX_STRING_LENGTH, INTERACTION_REDACTED_VALUE, INTERACTION_VERSION, InteractionContractError, fingerprintInteractionPayload, immutableInteractionSnapshot, parseInteractionAnswer, parseInteractionPayload, redactInteractionDecision, redactInteractionPayload, redactInteractionRequest, redactInteractionString, } from "./InteractionContracts.js";
+export { GRAPH_CONTRACT_VERSION, GRAPH_FRESHNESS_STATES, GRAPH_INDEX_SOURCES, GRAPH_MAX_DEPTH, GRAPH_MAX_FILES_PER_INDEX, GRAPH_MAX_INDEX_BYTES, GRAPH_MAX_ITEMS, GRAPH_MAX_PATH_LENGTH, GRAPH_MAX_RESPONSE_BYTES, GRAPH_MAX_STRING_LENGTH, GRAPH_RELATION_DIRECTIONS, GRAPH_RELATION_KINDS, GRAPH_RESULT_STATES, GRAPH_SEARCH_KINDS, GRAPH_SYMBOL_KINDS, AuthoritativeSourceReadRequestSchema, AuthoritativeSourceSnapshotSchema, GraphContractError, GraphErrorSchema, GraphFreshnessSchema, GraphFreshnessRequestSchema, GraphImpactRequestSchema, GraphIndexFileSchema, GraphIndexRequestSchema, GraphLocationSchema, GraphProvenanceSchema, GraphRangeSchema, GraphRelationSchema, GraphRelationRequestSchema, GraphRepositoryIdentitySchema, GraphResultStatusSchema, GraphScopeSchema, GraphSearchHitSchema, GraphSearchRequestSchema, GraphSymbolSchema, GraphSymbolRequestSchema, GraphWorktreeIdentitySchema, parseAuthoritativeSourceReadRequest, parseGraphImpactRequest, parseGraphFreshnessRequest, parseGraphIndexRequest, parseGraphIndexResponse, parseGraphQueryResponse, parseGraphRelationRequest, parseGraphScope, parseGraphSearchRequest, parseGraphSymbolRequest, serializeGraphContract, } from "./GraphContracts.js";
+export { AGENT_SESSION_CONTRACT_VERSION, AGENT_SESSION_SCHEMA_VERSION, AGENT_SESSION_MAX_EVENT_BYTES, AGENT_SESSION_MAX_PAYLOAD_DEPTH, AGENT_SESSION_MAX_PAYLOAD_ITEMS, AGENT_SESSION_MAX_STRING_LENGTH, AGENT_SESSION_MAX_EVENTS_PER_APPEND, AGENT_SESSION_MAX_PAGE_SIZE, AGENT_SESSION_MAX_SNAPSHOT_BYTES, AGENT_SESSION_EVENT_KINDS, AgentSessionContractError, SessionConcurrencyError, SessionCorruptTailError, ArtifactReferenceSchema, SessionJsonValueSchema, SessionActorSchema, SessionEventSchema, SessionEventInputSchema, parseArtifactReference, parseSessionEvent, parseSessionEventInput, serializeSessionEvent, parseSessionCursor, cursorForSequence, immutableSessionSnapshot, fingerprintSessionEvent, foldSessionEvents, } from "./AgentSessionContracts.js";
+export { CAPABILITY_MANIFEST_VERSION, CAPABILITY_EFFECTS, CAPABILITY_CLASSIFICATIONS, CAPABILITY_DETERMINISM, CAPABILITY_IDEMPOTENCY, CAPABILITY_MATURITY, CapabilityManifestError, parseCapabilityManifest, serializeCapabilityManifest, assessCapabilityManifest, requireAgentEligibleManifest, NodeBase, RESPOND_BRAND, isRespondEnvelope, Trigger, GlobalLogger, GlobalError, BlokError, ErrorCategory, ErrorSeverity, DEFAULT_HTTP_STATUS, DEFAULT_RETRYABLE, isNonRetryableValidationError, 
+// #679 — the ONE non-retryable matcher plus the marker the runner uses to
+// hand its verdict to the transports, so step-level and job-level retry can
+// never disagree.
+isNonRetryableError, markNonRetryableStepError, isNonRetryableStepError, WORKFLOW_INPUT_VALIDATION, WorkflowInputValidationError, Metrics, MemoryUsage, mapper, MapperResolutionError, NamedMissingStateError, lowerRefs, 
 // The lowering pass's OWN predicates — exported so the normalizer's
 // post-lowering total invariant (#707) tests the identical rule instead of
 // a second hand-written copy that could drift from what `lowerRefs` lowers.

package/dist/types/LoggerContext.d.ts

@@ -5,5 +5,12 @@ type LoggerContext = {
     getLogsAsBase64(): string;
     logLevel(level: string, message: string): void;
     error(message: string, stack: string): void;
+    /**
+     * Would a message at `level` (default `"info"`) actually be emitted? Lets a
+     * caller skip building an expensive message — the per-node config JSON in
+     * `BlokService.run` — that the logger would only drop. Optional: a logger
+     * that doesn't implement it is treated as always emitting.
+     */
+    isLevelEnabled?(level?: string): boolean;
 };
 export default LoggerContext;

package/dist/utils/Mapper.d.ts

@@ -58,6 +58,20 @@ import type ParamsDictionary from "../types/ParamsDictionary.js";
  * tests can flip the mode between cases.
  */
 export type MapperMode = "warn" | "strict" | "silent";
+/**
+ * Copy exactly what {@link Mapper.replaceObjectStrings} can mutate — the plain
+ * objects and arrays it recurses into — and SHARE everything else by reference.
+ * Resolving a copy leaves the caller's object pristine, which is what lets a
+ * step's config slice be resolved per execution (per forEach iteration, per
+ * retry) from the same unresolved source (#874).
+ *
+ * Deliberately not `_.cloneDeep`: this runs on every node execution, and a full
+ * deep clone would also walk the framework instances hanging off a flow step's
+ * slice (`steps: RunnerNode[]`) — expensive, and the mapper never touches them.
+ * Same `isPlainContainer` rule as the walker, so "cloned" and "mutable" are the
+ * same set by construction.
+ */
+export declare function cloneResolvable<T>(value: T): T;
 declare class Mapper {
     /**
      * Walk an object recursively, resolving every string value via

package/dist/utils/Mapper.js

@@ -253,6 +253,38 @@ function isPlainContainer(value) {
     const proto = Object.getPrototypeOf(value);
     return proto === Object.prototype || proto === null;
 }
+/**
+ * Copy exactly what {@link Mapper.replaceObjectStrings} can mutate — the plain
+ * objects and arrays it recurses into — and SHARE everything else by reference.
+ * Resolving a copy leaves the caller's object pristine, which is what lets a
+ * step's config slice be resolved per execution (per forEach iteration, per
+ * retry) from the same unresolved source (#874).
+ *
+ * Deliberately not `_.cloneDeep`: this runs on every node execution, and a full
+ * deep clone would also walk the framework instances hanging off a flow step's
+ * slice (`steps: RunnerNode[]`) — expensive, and the mapper never touches them.
+ * Same `isPlainContainer` rule as the walker, so "cloned" and "mutable" are the
+ * same set by construction.
+ */
+export function cloneResolvable(value) {
+    if (value === null || typeof value !== "object")
+        return value;
+    if (Array.isArray(value)) {
+        const out = new Array(value.length);
+        for (let i = 0; i < value.length; i++)
+            out[i] = cloneResolvable(value[i]);
+        return out;
+    }
+    if (!isPlainContainer(value))
+        return value;
+    const out = {};
+    for (const key in value) {
+        if (Object.prototype.hasOwnProperty.call(value, key)) {
+            out[key] = cloneResolvable(value[key]);
+        }
+    }
+    return out;
+}
 // =============================================================================
 // Mapper
 // =============================================================================

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@blokjs/shared",
-	"version": "2.1.0",
+	"version": "2.2.0",
 	"files": ["dist"],
 	"description": "Shared class, interfaces and types",
 	"type": "module",
@@ -23,7 +23,8 @@
 	},
 	"dependencies": {
 		"dayjs": "^1.11.19",
-		"lodash": "^4.17.21"
+		"lodash": "^4.17.21",
+		"zod": "^3.24.2"
 	},
 	"private": false,
 	"publishConfig": {