@sequenceholdings/managed-functions 0.4.0 → 0.4.2

package/dist/workflow-source-contract.d.ts

@@ -0,0 +1,524 @@
+import { z } from 'zod';
+export declare const FUNCTION_WORKFLOW_TOKEN_HEADER = "x-sequence-workflow-service-token";
+export declare const FUNCTION_WORKFLOW_EVIDENCE_TOKEN_HEADER = "x-sequence-workflow-evidence-token";
+export declare const FUNCTION_WORKFLOW_CAPTURE_PATH = "/api/managed-functions/workflows/capture";
+export declare const FUNCTION_WORKFLOW_EVIDENCE_PATH = "/api/managed-functions/workflows/evidence";
+export declare const functionWorkflowSourceRootSchema: z.ZodObject<{
+    id: z.ZodString;
+    runId: z.ZodString;
+    identity: z.ZodObject<{
+        id: z.ZodString;
+        version: z.ZodString;
+        definitionSha256: z.ZodString;
+    }, z.core.$strict>;
+    branches: z.ZodArray<z.ZodObject<{
+        nodeId: z.ZodString;
+        nodeRunId: z.ZodString;
+        attempt: z.ZodNumber;
+        agentId: z.ZodString;
+        runId: z.ZodNullable<z.ZodString>;
+        status: z.ZodEnum<{
+            completed: "completed";
+            failed: "failed";
+            cancelled: "cancelled";
+            skipped: "skipped";
+        }>;
+        identity: z.ZodObject<{
+            id: z.ZodString;
+            version: z.ZodString;
+            definitionSha256: z.ZodString;
+        }, z.core.$strict>;
+        completedAt: z.ZodNullable<z.ZodISODateTime>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const functionWorkflowSourceExecutionSchema: z.ZodObject<{
+    run: z.ZodObject<{
+        id: z.ZodString;
+        processId: z.ZodString;
+        processVersion: z.ZodString;
+        bundleHash: z.ZodString;
+        entity: z.ZodNullable<z.ZodObject<{
+            type: z.ZodString;
+            id: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    step: z.ZodObject<{
+        id: z.ZodString;
+        nodeId: z.ZodString;
+        attempt: z.ZodNumber;
+    }, z.core.$strict>;
+    workflow: z.ZodObject<{
+        id: z.ZodString;
+        runId: z.ZodString;
+        identity: z.ZodObject<{
+            id: z.ZodString;
+            version: z.ZodString;
+            definitionSha256: z.ZodString;
+        }, z.core.$strict>;
+        branches: z.ZodArray<z.ZodObject<{
+            nodeId: z.ZodString;
+            nodeRunId: z.ZodString;
+            attempt: z.ZodNumber;
+            agentId: z.ZodString;
+            runId: z.ZodNullable<z.ZodString>;
+            status: z.ZodEnum<{
+                completed: "completed";
+                failed: "failed";
+                cancelled: "cancelled";
+                skipped: "skipped";
+            }>;
+            identity: z.ZodObject<{
+                id: z.ZodString;
+                version: z.ZodString;
+                definitionSha256: z.ZodString;
+            }, z.core.$strict>;
+            completedAt: z.ZodNullable<z.ZodISODateTime>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type FunctionWorkflowSourceExecution = z.infer<typeof functionWorkflowSourceExecutionSchema>;
+export declare const functionWorkflowCompletedRunQuerySchema: z.ZodObject<{
+    workflow: z.ZodString;
+    runId: z.ZodString;
+}, z.core.$strict>;
+export type FunctionWorkflowCompletedRunQuery = z.infer<typeof functionWorkflowCompletedRunQuerySchema>;
+export declare const functionWorkflowCompletedRunSchema: z.ZodObject<{
+    workflow: z.ZodString;
+    runId: z.ZodString;
+    status: z.ZodLiteral<"completed">;
+    output: z.ZodJSONSchema;
+}, z.core.$strict>;
+export type FunctionWorkflowCompletedRun = z.infer<typeof functionWorkflowCompletedRunSchema>;
+export declare const functionWorkflowSourceCaptureSchema: z.ZodObject<{
+    response: z.ZodObject<{
+        workflow: z.ZodString;
+        runId: z.ZodString;
+        status: z.ZodLiteral<"completed">;
+        output: z.ZodJSONSchema;
+    }, z.core.$strict>;
+    responseHash: z.ZodString;
+    sourceReceipt: z.ZodString;
+}, z.core.$strict>;
+export type FunctionWorkflowSourceCapture = z.infer<typeof functionWorkflowSourceCaptureSchema>;
+export declare const functionWorkflowManagedFunctionSourceClaimsSchema: z.ZodObject<{
+    actualServiceAccountSub: z.ZodString;
+    sourceReceiver: z.ZodObject<{
+        functionId: z.ZodUUID;
+        versionId: z.ZodUUID;
+        invocationId: z.ZodUUID;
+        serviceAccountId: z.ZodUUID;
+        org: z.ZodString;
+    }, z.core.$strict>;
+    sourceExecution: z.ZodObject<{
+        run: z.ZodObject<{
+            id: z.ZodString;
+            processId: z.ZodString;
+            processVersion: z.ZodString;
+            bundleHash: z.ZodString;
+            entity: z.ZodNullable<z.ZodObject<{
+                type: z.ZodString;
+                id: z.ZodString;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+        step: z.ZodObject<{
+            id: z.ZodString;
+            nodeId: z.ZodString;
+            attempt: z.ZodNumber;
+        }, z.core.$strict>;
+        workflow: z.ZodObject<{
+            id: z.ZodString;
+            runId: z.ZodString;
+            identity: z.ZodObject<{
+                id: z.ZodString;
+                version: z.ZodString;
+                definitionSha256: z.ZodString;
+            }, z.core.$strict>;
+            branches: z.ZodArray<z.ZodObject<{
+                nodeId: z.ZodString;
+                nodeRunId: z.ZodString;
+                attempt: z.ZodNumber;
+                agentId: z.ZodString;
+                runId: z.ZodNullable<z.ZodString>;
+                status: z.ZodEnum<{
+                    completed: "completed";
+                    failed: "failed";
+                    cancelled: "cancelled";
+                    skipped: "skipped";
+                }>;
+                identity: z.ZodObject<{
+                    id: z.ZodString;
+                    version: z.ZodString;
+                    definitionSha256: z.ZodString;
+                }, z.core.$strict>;
+                completedAt: z.ZodNullable<z.ZodISODateTime>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    environment: z.ZodString;
+    org: z.ZodString;
+    workflowId: z.ZodString;
+    runId: z.ZodString;
+    cutoffAt: z.ZodISODateTime;
+    outputHash: z.ZodString;
+    responseHash: z.ZodString;
+    jobAdmission: z.ZodNullable<z.ZodObject<{
+        idempotencyKey: z.ZodString;
+        requestHash: z.ZodString;
+        kind: z.ZodEnum<{
+            workflow: "workflow";
+            agent: "agent";
+        }>;
+        resourceId: z.ZodString;
+        actorSub: z.ZodString;
+        runId: z.ZodString;
+        executionSnapshotId: z.ZodUUID;
+    }, z.core.$strict>>;
+    sourceKind: z.ZodLiteral<"managed_function">;
+    projection: z.ZodLiteral<"workflow-completed-v1">;
+    audience: z.ZodLiteral<"atlas-managed-function-workflow-source-evidence">;
+}, z.core.$strict>;
+export declare const functionWorkflowHumanSourceClaimsSchema: z.ZodObject<{
+    sourceKind: z.ZodLiteral<"human">;
+    projection: z.ZodLiteral<"workflow-completed-v1">;
+    audience: z.ZodLiteral<"atlas-workflow-source-evidence">;
+    actualUserSub: z.ZodString;
+    sourceExecution: z.ZodNull;
+    workflowSource: z.ZodObject<{
+        id: z.ZodString;
+        runId: z.ZodString;
+        identity: z.ZodObject<{
+            id: z.ZodString;
+            version: z.ZodString;
+            definitionSha256: z.ZodString;
+        }, z.core.$strict>;
+        branches: z.ZodArray<z.ZodObject<{
+            nodeId: z.ZodString;
+            nodeRunId: z.ZodString;
+            attempt: z.ZodNumber;
+            agentId: z.ZodString;
+            runId: z.ZodNullable<z.ZodString>;
+            status: z.ZodEnum<{
+                completed: "completed";
+                failed: "failed";
+                cancelled: "cancelled";
+                skipped: "skipped";
+            }>;
+            identity: z.ZodObject<{
+                id: z.ZodString;
+                version: z.ZodString;
+                definitionSha256: z.ZodString;
+            }, z.core.$strict>;
+            completedAt: z.ZodNullable<z.ZodISODateTime>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    environment: z.ZodString;
+    org: z.ZodString;
+    workflowId: z.ZodString;
+    runId: z.ZodString;
+    cutoffAt: z.ZodISODateTime;
+    outputHash: z.ZodString;
+    responseHash: z.ZodString;
+    jobAdmission: z.ZodNullable<z.ZodObject<{
+        idempotencyKey: z.ZodString;
+        requestHash: z.ZodString;
+        kind: z.ZodEnum<{
+            workflow: "workflow";
+            agent: "agent";
+        }>;
+        resourceId: z.ZodString;
+        actorSub: z.ZodString;
+        runId: z.ZodString;
+        executionSnapshotId: z.ZodUUID;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const functionWorkflowSourceClaimsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    actualServiceAccountSub: z.ZodString;
+    sourceReceiver: z.ZodObject<{
+        functionId: z.ZodUUID;
+        versionId: z.ZodUUID;
+        invocationId: z.ZodUUID;
+        serviceAccountId: z.ZodUUID;
+        org: z.ZodString;
+    }, z.core.$strict>;
+    sourceExecution: z.ZodObject<{
+        run: z.ZodObject<{
+            id: z.ZodString;
+            processId: z.ZodString;
+            processVersion: z.ZodString;
+            bundleHash: z.ZodString;
+            entity: z.ZodNullable<z.ZodObject<{
+                type: z.ZodString;
+                id: z.ZodString;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+        step: z.ZodObject<{
+            id: z.ZodString;
+            nodeId: z.ZodString;
+            attempt: z.ZodNumber;
+        }, z.core.$strict>;
+        workflow: z.ZodObject<{
+            id: z.ZodString;
+            runId: z.ZodString;
+            identity: z.ZodObject<{
+                id: z.ZodString;
+                version: z.ZodString;
+                definitionSha256: z.ZodString;
+            }, z.core.$strict>;
+            branches: z.ZodArray<z.ZodObject<{
+                nodeId: z.ZodString;
+                nodeRunId: z.ZodString;
+                attempt: z.ZodNumber;
+                agentId: z.ZodString;
+                runId: z.ZodNullable<z.ZodString>;
+                status: z.ZodEnum<{
+                    completed: "completed";
+                    failed: "failed";
+                    cancelled: "cancelled";
+                    skipped: "skipped";
+                }>;
+                identity: z.ZodObject<{
+                    id: z.ZodString;
+                    version: z.ZodString;
+                    definitionSha256: z.ZodString;
+                }, z.core.$strict>;
+                completedAt: z.ZodNullable<z.ZodISODateTime>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    environment: z.ZodString;
+    org: z.ZodString;
+    workflowId: z.ZodString;
+    runId: z.ZodString;
+    cutoffAt: z.ZodISODateTime;
+    outputHash: z.ZodString;
+    responseHash: z.ZodString;
+    jobAdmission: z.ZodNullable<z.ZodObject<{
+        idempotencyKey: z.ZodString;
+        requestHash: z.ZodString;
+        kind: z.ZodEnum<{
+            workflow: "workflow";
+            agent: "agent";
+        }>;
+        resourceId: z.ZodString;
+        actorSub: z.ZodString;
+        runId: z.ZodString;
+        executionSnapshotId: z.ZodUUID;
+    }, z.core.$strict>>;
+    sourceKind: z.ZodLiteral<"managed_function">;
+    projection: z.ZodLiteral<"workflow-completed-v1">;
+    audience: z.ZodLiteral<"atlas-managed-function-workflow-source-evidence">;
+}, z.core.$strict>, z.ZodObject<{
+    sourceKind: z.ZodLiteral<"human">;
+    projection: z.ZodLiteral<"workflow-completed-v1">;
+    audience: z.ZodLiteral<"atlas-workflow-source-evidence">;
+    actualUserSub: z.ZodString;
+    sourceExecution: z.ZodNull;
+    workflowSource: z.ZodObject<{
+        id: z.ZodString;
+        runId: z.ZodString;
+        identity: z.ZodObject<{
+            id: z.ZodString;
+            version: z.ZodString;
+            definitionSha256: z.ZodString;
+        }, z.core.$strict>;
+        branches: z.ZodArray<z.ZodObject<{
+            nodeId: z.ZodString;
+            nodeRunId: z.ZodString;
+            attempt: z.ZodNumber;
+            agentId: z.ZodString;
+            runId: z.ZodNullable<z.ZodString>;
+            status: z.ZodEnum<{
+                completed: "completed";
+                failed: "failed";
+                cancelled: "cancelled";
+                skipped: "skipped";
+            }>;
+            identity: z.ZodObject<{
+                id: z.ZodString;
+                version: z.ZodString;
+                definitionSha256: z.ZodString;
+            }, z.core.$strict>;
+            completedAt: z.ZodNullable<z.ZodISODateTime>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    environment: z.ZodString;
+    org: z.ZodString;
+    workflowId: z.ZodString;
+    runId: z.ZodString;
+    cutoffAt: z.ZodISODateTime;
+    outputHash: z.ZodString;
+    responseHash: z.ZodString;
+    jobAdmission: z.ZodNullable<z.ZodObject<{
+        idempotencyKey: z.ZodString;
+        requestHash: z.ZodString;
+        kind: z.ZodEnum<{
+            workflow: "workflow";
+            agent: "agent";
+        }>;
+        resourceId: z.ZodString;
+        actorSub: z.ZodString;
+        runId: z.ZodString;
+        executionSnapshotId: z.ZodUUID;
+    }, z.core.$strict>>;
+}, z.core.$strict>], "sourceKind">;
+export type FunctionWorkflowSourceClaims = z.infer<typeof functionWorkflowSourceClaimsSchema>;
+export declare const functionWorkflowSourceEvidenceRequestSchema: z.ZodObject<{
+    workflow: z.ZodString;
+    runId: z.ZodString;
+    operation: z.ZodLiteral<"verifySourceEvidence">;
+    response: z.ZodObject<{
+        workflow: z.ZodString;
+        runId: z.ZodString;
+        status: z.ZodLiteral<"completed">;
+        output: z.ZodJSONSchema;
+    }, z.core.$strict>;
+    responseHash: z.ZodString;
+    sourceReceipt: z.ZodString;
+}, z.core.$strict>;
+export type FunctionWorkflowSourceEvidenceRequest = z.infer<typeof functionWorkflowSourceEvidenceRequestSchema>;
+export declare const functionWorkflowSourceVerificationSchema: z.ZodObject<{
+    source: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        actualServiceAccountSub: z.ZodString;
+        sourceReceiver: z.ZodObject<{
+            functionId: z.ZodUUID;
+            versionId: z.ZodUUID;
+            invocationId: z.ZodUUID;
+            serviceAccountId: z.ZodUUID;
+            org: z.ZodString;
+        }, z.core.$strict>;
+        sourceExecution: z.ZodObject<{
+            run: z.ZodObject<{
+                id: z.ZodString;
+                processId: z.ZodString;
+                processVersion: z.ZodString;
+                bundleHash: z.ZodString;
+                entity: z.ZodNullable<z.ZodObject<{
+                    type: z.ZodString;
+                    id: z.ZodString;
+                }, z.core.$strict>>;
+            }, z.core.$strict>;
+            step: z.ZodObject<{
+                id: z.ZodString;
+                nodeId: z.ZodString;
+                attempt: z.ZodNumber;
+            }, z.core.$strict>;
+            workflow: z.ZodObject<{
+                id: z.ZodString;
+                runId: z.ZodString;
+                identity: z.ZodObject<{
+                    id: z.ZodString;
+                    version: z.ZodString;
+                    definitionSha256: z.ZodString;
+                }, z.core.$strict>;
+                branches: z.ZodArray<z.ZodObject<{
+                    nodeId: z.ZodString;
+                    nodeRunId: z.ZodString;
+                    attempt: z.ZodNumber;
+                    agentId: z.ZodString;
+                    runId: z.ZodNullable<z.ZodString>;
+                    status: z.ZodEnum<{
+                        completed: "completed";
+                        failed: "failed";
+                        cancelled: "cancelled";
+                        skipped: "skipped";
+                    }>;
+                    identity: z.ZodObject<{
+                        id: z.ZodString;
+                        version: z.ZodString;
+                        definitionSha256: z.ZodString;
+                    }, z.core.$strict>;
+                    completedAt: z.ZodNullable<z.ZodISODateTime>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>;
+        }, z.core.$strict>;
+        environment: z.ZodString;
+        org: z.ZodString;
+        workflowId: z.ZodString;
+        runId: z.ZodString;
+        cutoffAt: z.ZodISODateTime;
+        outputHash: z.ZodString;
+        responseHash: z.ZodString;
+        jobAdmission: z.ZodNullable<z.ZodObject<{
+            idempotencyKey: z.ZodString;
+            requestHash: z.ZodString;
+            kind: z.ZodEnum<{
+                workflow: "workflow";
+                agent: "agent";
+            }>;
+            resourceId: z.ZodString;
+            actorSub: z.ZodString;
+            runId: z.ZodString;
+            executionSnapshotId: z.ZodUUID;
+        }, z.core.$strict>>;
+        sourceKind: z.ZodLiteral<"managed_function">;
+        projection: z.ZodLiteral<"workflow-completed-v1">;
+        audience: z.ZodLiteral<"atlas-managed-function-workflow-source-evidence">;
+    }, z.core.$strict>, z.ZodObject<{
+        sourceKind: z.ZodLiteral<"human">;
+        projection: z.ZodLiteral<"workflow-completed-v1">;
+        audience: z.ZodLiteral<"atlas-workflow-source-evidence">;
+        actualUserSub: z.ZodString;
+        sourceExecution: z.ZodNull;
+        workflowSource: z.ZodObject<{
+            id: z.ZodString;
+            runId: z.ZodString;
+            identity: z.ZodObject<{
+                id: z.ZodString;
+                version: z.ZodString;
+                definitionSha256: z.ZodString;
+            }, z.core.$strict>;
+            branches: z.ZodArray<z.ZodObject<{
+                nodeId: z.ZodString;
+                nodeRunId: z.ZodString;
+                attempt: z.ZodNumber;
+                agentId: z.ZodString;
+                runId: z.ZodNullable<z.ZodString>;
+                status: z.ZodEnum<{
+                    completed: "completed";
+                    failed: "failed";
+                    cancelled: "cancelled";
+                    skipped: "skipped";
+                }>;
+                identity: z.ZodObject<{
+                    id: z.ZodString;
+                    version: z.ZodString;
+                    definitionSha256: z.ZodString;
+                }, z.core.$strict>;
+                completedAt: z.ZodNullable<z.ZodISODateTime>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+        environment: z.ZodString;
+        org: z.ZodString;
+        workflowId: z.ZodString;
+        runId: z.ZodString;
+        cutoffAt: z.ZodISODateTime;
+        outputHash: z.ZodString;
+        responseHash: z.ZodString;
+        jobAdmission: z.ZodNullable<z.ZodObject<{
+            idempotencyKey: z.ZodString;
+            requestHash: z.ZodString;
+            kind: z.ZodEnum<{
+                workflow: "workflow";
+                agent: "agent";
+            }>;
+            resourceId: z.ZodString;
+            actorSub: z.ZodString;
+            runId: z.ZodString;
+            executionSnapshotId: z.ZodUUID;
+        }, z.core.$strict>>;
+    }, z.core.$strict>], "sourceKind">;
+    receiver: z.ZodObject<{
+        functionId: z.ZodUUID;
+        versionId: z.ZodUUID;
+        invocationId: z.ZodUUID;
+        serviceAccountId: z.ZodUUID;
+        org: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type FunctionWorkflowSourceVerification = z.infer<typeof functionWorkflowSourceVerificationSchema>;
+export declare class FunctionWorkflowReadError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly name = "FunctionWorkflowReadError";
+    constructor(status: number, code: string, message: string);
+}

package/dist/workflow-source-contract.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FunctionWorkflowReadError = exports.functionWorkflowSourceVerificationSchema = exports.functionWorkflowSourceEvidenceRequestSchema = exports.functionWorkflowSourceClaimsSchema = exports.functionWorkflowHumanSourceClaimsSchema = exports.functionWorkflowManagedFunctionSourceClaimsSchema = exports.functionWorkflowSourceCaptureSchema = exports.functionWorkflowCompletedRunSchema = exports.functionWorkflowCompletedRunQuerySchema = exports.functionWorkflowSourceExecutionSchema = exports.functionWorkflowSourceRootSchema = exports.FUNCTION_WORKFLOW_EVIDENCE_PATH = exports.FUNCTION_WORKFLOW_CAPTURE_PATH = exports.FUNCTION_WORKFLOW_EVIDENCE_TOKEN_HEADER = exports.FUNCTION_WORKFLOW_TOKEN_HEADER = void 0;
+const zod_1 = require("zod");
+const agent_source_evidence_contract_1 = require("./agent-source-evidence-contract");
+exports.FUNCTION_WORKFLOW_TOKEN_HEADER = 'x-sequence-workflow-service-token';
+exports.FUNCTION_WORKFLOW_EVIDENCE_TOKEN_HEADER = 'x-sequence-workflow-evidence-token';
+exports.FUNCTION_WORKFLOW_CAPTURE_PATH = '/api/managed-functions/workflows/capture';
+exports.FUNCTION_WORKFLOW_EVIDENCE_PATH = '/api/managed-functions/workflows/evidence';
+const id = zod_1.z.string().min(1).max(255).regex(/^[A-Za-z0-9._-]+$/);
+const hash = zod_1.z.string().regex(/^[a-f0-9]{64}$/);
+const identity = zod_1.z.strictObject({ id, version: id, definitionSha256: hash });
+exports.functionWorkflowSourceRootSchema = zod_1.z.strictObject({
+    id, runId: id, identity,
+    branches: zod_1.z.array(zod_1.z.strictObject({
+        nodeId: id, nodeRunId: id, attempt: zod_1.z.number().int().positive(), agentId: id,
+        runId: id.nullable(), status: zod_1.z.enum(['completed', 'failed', 'cancelled', 'skipped']), identity,
+        completedAt: zod_1.z.iso.datetime({ offset: true }).nullable(),
+    }).refine((branch) => branch.agentId === branch.identity.id && (branch.status !== 'completed' || (branch.runId !== null && branch.completedAt !== null)), 'Completed branches require actual completed source records')).max(64),
+}).refine((workflow) => workflow.id === workflow.identity.id, 'The workflow must match its private identity');
+exports.functionWorkflowSourceExecutionSchema = zod_1.z.strictObject({
+    run: agent_source_evidence_contract_1.functionAgentSourceExecutionSchema.shape.run,
+    step: agent_source_evidence_contract_1.functionAgentSourceExecutionSchema.shape.step,
+    workflow: exports.functionWorkflowSourceRootSchema,
+});
+exports.functionWorkflowCompletedRunQuerySchema = zod_1.z.strictObject({ workflow: id, runId: id });
+exports.functionWorkflowCompletedRunSchema = zod_1.z.strictObject({ workflow: id, runId: id, status: zod_1.z.literal('completed'), output: zod_1.z.json() });
+exports.functionWorkflowSourceCaptureSchema = zod_1.z.strictObject({ response: exports.functionWorkflowCompletedRunSchema, responseHash: hash, sourceReceipt: zod_1.z.string().min(1).max(16_384) });
+const receiver = zod_1.z.strictObject({ functionId: zod_1.z.uuid(), versionId: zod_1.z.uuid(), invocationId: zod_1.z.uuid(), serviceAccountId: zod_1.z.uuid(), org: zod_1.z.string().min(1).max(255) });
+const sourceFields = {
+    environment: zod_1.z.string(), org: zod_1.z.string().min(1).max(255),
+    workflowId: id, runId: id, cutoffAt: zod_1.z.iso.datetime({ offset: true }), outputHash: hash, responseHash: hash,
+    jobAdmission: agent_source_evidence_contract_1.functionSourceJobAdmissionSchema.nullable(),
+};
+exports.functionWorkflowManagedFunctionSourceClaimsSchema = zod_1.z.strictObject({
+    sourceKind: zod_1.z.literal('managed_function'), projection: zod_1.z.literal('workflow-completed-v1'), audience: zod_1.z.literal('atlas-managed-function-workflow-source-evidence'),
+    ...sourceFields, actualServiceAccountSub: zod_1.z.string().min(1).max(512), sourceReceiver: receiver,
+    sourceExecution: exports.functionWorkflowSourceExecutionSchema,
+}).refine((source) => source.actualServiceAccountSub === `service-account|${source.sourceReceiver.serviceAccountId}` && source.org === source.sourceReceiver.org && source.workflowId === source.sourceExecution.workflow.id && source.runId === source.sourceExecution.workflow.runId, 'The workflow source must match its actual identity and execution');
+exports.functionWorkflowHumanSourceClaimsSchema = zod_1.z.strictObject({
+    ...sourceFields, sourceKind: zod_1.z.literal('human'), projection: zod_1.z.literal('workflow-completed-v1'), audience: zod_1.z.literal('atlas-workflow-source-evidence'),
+    actualUserSub: zod_1.z.string().min(1).max(512).refine((sub) => !sub.startsWith('service-account|'), 'Human workflow evidence requires an actual user'),
+    sourceExecution: zod_1.z.null(), workflowSource: exports.functionWorkflowSourceRootSchema,
+}).refine((source) => source.workflowId === source.workflowSource.id && source.runId === source.workflowSource.runId && source.jobAdmission !== null, 'A standalone human workflow source requires its actual job admission');
+exports.functionWorkflowSourceClaimsSchema = zod_1.z.discriminatedUnion('sourceKind', [exports.functionWorkflowManagedFunctionSourceClaimsSchema, exports.functionWorkflowHumanSourceClaimsSchema])
+    .refine((source) => source.jobAdmission === null || (source.jobAdmission.kind === 'workflow' && source.jobAdmission.runId === source.runId && source.jobAdmission.resourceId === source.workflowId && (source.sourceKind === 'human' || source.jobAdmission.actorSub === source.actualServiceAccountSub)), 'The job admission must match the workflow source');
+exports.functionWorkflowSourceEvidenceRequestSchema = exports.functionWorkflowCompletedRunQuerySchema.extend({ operation: zod_1.z.literal('verifySourceEvidence'), response: exports.functionWorkflowCompletedRunSchema, responseHash: hash, sourceReceipt: zod_1.z.string().min(1).max(16_384) });
+exports.functionWorkflowSourceVerificationSchema = zod_1.z.strictObject({ source: exports.functionWorkflowSourceClaimsSchema, receiver });
+class FunctionWorkflowReadError extends Error {
+    status;
+    code;
+    name = 'FunctionWorkflowReadError';
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+    }
+}
+exports.FunctionWorkflowReadError = FunctionWorkflowReadError;

package/dist/workflow-source.d.ts

@@ -0,0 +1,12 @@
+import type { FunctionServiceAgentsOptions } from './agents';
+import { type FunctionWorkflowCompletedRunQuery, type FunctionWorkflowSourceCapture, type FunctionWorkflowSourceEvidenceRequest, type FunctionWorkflowSourceVerification } from './workflow-source-contract';
+export type FunctionServiceWorkflowsOptions = FunctionServiceAgentsOptions;
+export interface FunctionServiceWorkflowsClient {
+    captureCompletedRun(query: FunctionWorkflowCompletedRunQuery): Promise<FunctionWorkflowSourceCapture>;
+}
+export type FunctionWorkflowSourceEvidenceInput = Omit<FunctionWorkflowSourceEvidenceRequest, 'operation'>;
+export interface FunctionWorkflowEvidenceClient {
+    verifySourceEvidence(input: FunctionWorkflowSourceEvidenceInput): Promise<FunctionWorkflowSourceVerification>;
+}
+export declare function createFunctionServiceWorkflowsClient(options: FunctionServiceWorkflowsOptions): FunctionServiceWorkflowsClient;
+export declare function createFunctionWorkflowEvidenceClient(options: FunctionServiceWorkflowsOptions): FunctionWorkflowEvidenceClient;