clinkx 1.1.0 → 1.1.2

package/clinkx-workflows/dist/workflow-verification-contract.d.ts

@@ -0,0 +1,539 @@
+import { z } from "zod";
+export declare const WORKFLOW_VERIFICATION_VERSION = "clinkx-workflow-verification-v1";
+export declare const MAX_WORKFLOW_VERIFICATIONS = 16;
+export declare const MAX_WORKFLOW_VERIFICATION_BYTES: number;
+export declare const MAX_WORKFLOW_VERIFICATION_HISTORY_BYTES: number;
+export declare const WorkflowVerificationBindingSchema: z.ZodObject<{
+    run_id: z.ZodString;
+    generation: z.ZodString;
+    started_at: z.ZodString;
+    workflow_sha256: z.ZodString;
+    inputs_sha256: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    started_at: string;
+    run_id: string;
+    generation: string;
+    workflow_sha256: string;
+    inputs_sha256: string;
+}, {
+    started_at: string;
+    run_id: string;
+    generation: string;
+    workflow_sha256: string;
+    inputs_sha256: string;
+}>;
+export declare const WorkflowVerificationRecordSchema: z.ZodEffects<z.ZodObject<{
+    schema_version: z.ZodLiteral<"clinkx-workflow-verification-v1">;
+    inspection_id: z.ZodString;
+    inspected_at: z.ZodString;
+    binding: z.ZodObject<{
+        run_id: z.ZodString;
+        generation: z.ZodString;
+        started_at: z.ZodString;
+        workflow_sha256: z.ZodString;
+        inputs_sha256: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        started_at: string;
+        run_id: string;
+        generation: string;
+        workflow_sha256: string;
+        inputs_sha256: string;
+    }, {
+        started_at: string;
+        run_id: string;
+        generation: string;
+        workflow_sha256: string;
+        inputs_sha256: string;
+    }>;
+    expectations_sha256: z.ZodString;
+    identity: z.ZodNullable<z.ZodObject<{
+        source_sha256: z.ZodString;
+        build_sha256: z.ZodString;
+        procedure_sha256: z.ZodString;
+        boundary: z.ZodEnum<["workflow-handoff-fixture", "project-command-v1"]>;
+    }, "strict", z.ZodTypeAny, {
+        source_sha256: string;
+        build_sha256: string;
+        procedure_sha256: string;
+        boundary: "workflow-handoff-fixture" | "project-command-v1";
+    }, {
+        source_sha256: string;
+        build_sha256: string;
+        procedure_sha256: string;
+        boundary: "workflow-handoff-fixture" | "project-command-v1";
+    }>>;
+    required_checks: z.ZodNullable<z.ZodNumber>;
+    evidence_directory: z.ZodEffects<z.ZodString, string, string>;
+    coverage: z.ZodObject<{
+        status: z.ZodEnum<["complete", "incomplete", "inapplicable", "failed"]>;
+        checks: z.ZodArray<z.ZodObject<{
+            check_id: z.ZodString;
+            status: z.ZodEnum<["complete", "incomplete", "inapplicable", "failed"]>;
+            reasons: z.ZodArray<z.ZodObject<{
+                code: z.ZodString;
+                check_id: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                code: string;
+                check_id: string;
+            }, {
+                code: string;
+                check_id: string;
+            }>, "many">;
+        }, "strict", z.ZodTypeAny, {
+            status: "failed" | "complete" | "incomplete" | "inapplicable";
+            check_id: string;
+            reasons: {
+                code: string;
+                check_id: string;
+            }[];
+        }, {
+            status: "failed" | "complete" | "incomplete" | "inapplicable";
+            check_id: string;
+            reasons: {
+                code: string;
+                check_id: string;
+            }[];
+        }>, "many">;
+        reasons: z.ZodArray<z.ZodObject<{
+            code: z.ZodString;
+            check_id: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            code: string;
+            check_id: string;
+        }, {
+            code: string;
+            check_id: string;
+        }>, "many">;
+    }, "strict", z.ZodTypeAny, {
+        status: "failed" | "complete" | "incomplete" | "inapplicable";
+        checks: {
+            status: "failed" | "complete" | "incomplete" | "inapplicable";
+            check_id: string;
+            reasons: {
+                code: string;
+                check_id: string;
+            }[];
+        }[];
+        reasons: {
+            code: string;
+            check_id: string;
+        }[];
+    }, {
+        status: "failed" | "complete" | "incomplete" | "inapplicable";
+        checks: {
+            status: "failed" | "complete" | "incomplete" | "inapplicable";
+            check_id: string;
+            reasons: {
+                code: string;
+                check_id: string;
+            }[];
+        }[];
+        reasons: {
+            code: string;
+            check_id: string;
+        }[];
+    }>;
+    scope: z.ZodLiteral<"inspected_at">;
+    owner_acceptance: z.ZodLiteral<"not_recorded">;
+}, "strict", z.ZodTypeAny, {
+    schema_version: "clinkx-workflow-verification-v1";
+    coverage: {
+        status: "failed" | "complete" | "incomplete" | "inapplicable";
+        checks: {
+            status: "failed" | "complete" | "incomplete" | "inapplicable";
+            check_id: string;
+            reasons: {
+                code: string;
+                check_id: string;
+            }[];
+        }[];
+        reasons: {
+            code: string;
+            check_id: string;
+        }[];
+    };
+    binding: {
+        started_at: string;
+        run_id: string;
+        generation: string;
+        workflow_sha256: string;
+        inputs_sha256: string;
+    };
+    owner_acceptance: "not_recorded";
+    evidence_directory: string;
+    expectations_sha256: string;
+    scope: "inspected_at";
+    identity: {
+        source_sha256: string;
+        build_sha256: string;
+        procedure_sha256: string;
+        boundary: "workflow-handoff-fixture" | "project-command-v1";
+    } | null;
+    inspection_id: string;
+    inspected_at: string;
+    required_checks: number | null;
+}, {
+    schema_version: "clinkx-workflow-verification-v1";
+    coverage: {
+        status: "failed" | "complete" | "incomplete" | "inapplicable";
+        checks: {
+            status: "failed" | "complete" | "incomplete" | "inapplicable";
+            check_id: string;
+            reasons: {
+                code: string;
+                check_id: string;
+            }[];
+        }[];
+        reasons: {
+            code: string;
+            check_id: string;
+        }[];
+    };
+    binding: {
+        started_at: string;
+        run_id: string;
+        generation: string;
+        workflow_sha256: string;
+        inputs_sha256: string;
+    };
+    owner_acceptance: "not_recorded";
+    evidence_directory: string;
+    expectations_sha256: string;
+    scope: "inspected_at";
+    identity: {
+        source_sha256: string;
+        build_sha256: string;
+        procedure_sha256: string;
+        boundary: "workflow-handoff-fixture" | "project-command-v1";
+    } | null;
+    inspection_id: string;
+    inspected_at: string;
+    required_checks: number | null;
+}>, {
+    schema_version: "clinkx-workflow-verification-v1";
+    coverage: {
+        status: "failed" | "complete" | "incomplete" | "inapplicable";
+        checks: {
+            status: "failed" | "complete" | "incomplete" | "inapplicable";
+            check_id: string;
+            reasons: {
+                code: string;
+                check_id: string;
+            }[];
+        }[];
+        reasons: {
+            code: string;
+            check_id: string;
+        }[];
+    };
+    binding: {
+        started_at: string;
+        run_id: string;
+        generation: string;
+        workflow_sha256: string;
+        inputs_sha256: string;
+    };
+    owner_acceptance: "not_recorded";
+    evidence_directory: string;
+    expectations_sha256: string;
+    scope: "inspected_at";
+    identity: {
+        source_sha256: string;
+        build_sha256: string;
+        procedure_sha256: string;
+        boundary: "workflow-handoff-fixture" | "project-command-v1";
+    } | null;
+    inspection_id: string;
+    inspected_at: string;
+    required_checks: number | null;
+}, {
+    schema_version: "clinkx-workflow-verification-v1";
+    coverage: {
+        status: "failed" | "complete" | "incomplete" | "inapplicable";
+        checks: {
+            status: "failed" | "complete" | "incomplete" | "inapplicable";
+            check_id: string;
+            reasons: {
+                code: string;
+                check_id: string;
+            }[];
+        }[];
+        reasons: {
+            code: string;
+            check_id: string;
+        }[];
+    };
+    binding: {
+        started_at: string;
+        run_id: string;
+        generation: string;
+        workflow_sha256: string;
+        inputs_sha256: string;
+    };
+    owner_acceptance: "not_recorded";
+    evidence_directory: string;
+    expectations_sha256: string;
+    scope: "inspected_at";
+    identity: {
+        source_sha256: string;
+        build_sha256: string;
+        procedure_sha256: string;
+        boundary: "workflow-handoff-fixture" | "project-command-v1";
+    } | null;
+    inspection_id: string;
+    inspected_at: string;
+    required_checks: number | null;
+}>;
+export type WorkflowVerificationRecord = z.infer<typeof WorkflowVerificationRecordSchema>;
+export declare const WorkflowVerificationProjectionSchema: z.ZodObject<{
+    schema_version: z.ZodLiteral<"clinkx-workflow-verification-v1">;
+    availability: z.ZodEnum<["unrecorded", "available", "unavailable"]>;
+    reason: z.ZodOptional<z.ZodEnum<["invalid_record", "identity_mismatch", "too_many_records", "unreadable"]>>;
+    inspections: z.ZodArray<z.ZodObject<{
+        inspection_id: z.ZodString;
+        inspected_at: z.ZodString;
+        expectations_sha256: z.ZodString;
+        identity: z.ZodNullable<z.ZodObject<{
+            source_sha256: z.ZodString;
+            build_sha256: z.ZodString;
+            procedure_sha256: z.ZodString;
+            boundary: z.ZodEnum<["workflow-handoff-fixture", "project-command-v1"]>;
+        }, "strict", z.ZodTypeAny, {
+            source_sha256: string;
+            build_sha256: string;
+            procedure_sha256: string;
+            boundary: "workflow-handoff-fixture" | "project-command-v1";
+        }, {
+            source_sha256: string;
+            build_sha256: string;
+            procedure_sha256: string;
+            boundary: "workflow-handoff-fixture" | "project-command-v1";
+        }>>;
+        required_checks: z.ZodNullable<z.ZodNumber>;
+        coverage: z.ZodObject<{
+            status: z.ZodEnum<["complete", "incomplete", "inapplicable", "failed"]>;
+            checks: z.ZodArray<z.ZodObject<{
+                check_id: z.ZodString;
+                status: z.ZodEnum<["complete", "incomplete", "inapplicable", "failed"]>;
+                reasons: z.ZodArray<z.ZodObject<{
+                    code: z.ZodString;
+                    check_id: z.ZodString;
+                }, "strict", z.ZodTypeAny, {
+                    code: string;
+                    check_id: string;
+                }, {
+                    code: string;
+                    check_id: string;
+                }>, "many">;
+            }, "strict", z.ZodTypeAny, {
+                status: "failed" | "complete" | "incomplete" | "inapplicable";
+                check_id: string;
+                reasons: {
+                    code: string;
+                    check_id: string;
+                }[];
+            }, {
+                status: "failed" | "complete" | "incomplete" | "inapplicable";
+                check_id: string;
+                reasons: {
+                    code: string;
+                    check_id: string;
+                }[];
+            }>, "many">;
+            reasons: z.ZodArray<z.ZodObject<{
+                code: z.ZodString;
+                check_id: z.ZodString;
+            }, "strict", z.ZodTypeAny, {
+                code: string;
+                check_id: string;
+            }, {
+                code: string;
+                check_id: string;
+            }>, "many">;
+        }, "strict", z.ZodTypeAny, {
+            status: "failed" | "complete" | "incomplete" | "inapplicable";
+            checks: {
+                status: "failed" | "complete" | "incomplete" | "inapplicable";
+                check_id: string;
+                reasons: {
+                    code: string;
+                    check_id: string;
+                }[];
+            }[];
+            reasons: {
+                code: string;
+                check_id: string;
+            }[];
+        }, {
+            status: "failed" | "complete" | "incomplete" | "inapplicable";
+            checks: {
+                status: "failed" | "complete" | "incomplete" | "inapplicable";
+                check_id: string;
+                reasons: {
+                    code: string;
+                    check_id: string;
+                }[];
+            }[];
+            reasons: {
+                code: string;
+                check_id: string;
+            }[];
+        }>;
+        retention: z.ZodEnum<["unknown", "outside_mount", "present", "missing", "unavailable"]>;
+        evidence_ref: z.ZodObject<{
+            kind: z.ZodLiteral<"expectations_sha256">;
+            sha256: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            sha256: string;
+            kind: "expectations_sha256";
+        }, {
+            sha256: string;
+            kind: "expectations_sha256";
+        }>;
+        scope: z.ZodLiteral<"inspected_at">;
+        owner_acceptance: z.ZodLiteral<"not_recorded">;
+    }, "strict", z.ZodTypeAny, {
+        coverage: {
+            status: "failed" | "complete" | "incomplete" | "inapplicable";
+            checks: {
+                status: "failed" | "complete" | "incomplete" | "inapplicable";
+                check_id: string;
+                reasons: {
+                    code: string;
+                    check_id: string;
+                }[];
+            }[];
+            reasons: {
+                code: string;
+                check_id: string;
+            }[];
+        };
+        owner_acceptance: "not_recorded";
+        expectations_sha256: string;
+        scope: "inspected_at";
+        identity: {
+            source_sha256: string;
+            build_sha256: string;
+            procedure_sha256: string;
+            boundary: "workflow-handoff-fixture" | "project-command-v1";
+        } | null;
+        inspection_id: string;
+        inspected_at: string;
+        required_checks: number | null;
+        retention: "unknown" | "missing" | "unavailable" | "outside_mount" | "present";
+        evidence_ref: {
+            sha256: string;
+            kind: "expectations_sha256";
+        };
+    }, {
+        coverage: {
+            status: "failed" | "complete" | "incomplete" | "inapplicable";
+            checks: {
+                status: "failed" | "complete" | "incomplete" | "inapplicable";
+                check_id: string;
+                reasons: {
+                    code: string;
+                    check_id: string;
+                }[];
+            }[];
+            reasons: {
+                code: string;
+                check_id: string;
+            }[];
+        };
+        owner_acceptance: "not_recorded";
+        expectations_sha256: string;
+        scope: "inspected_at";
+        identity: {
+            source_sha256: string;
+            build_sha256: string;
+            procedure_sha256: string;
+            boundary: "workflow-handoff-fixture" | "project-command-v1";
+        } | null;
+        inspection_id: string;
+        inspected_at: string;
+        required_checks: number | null;
+        retention: "unknown" | "missing" | "unavailable" | "outside_mount" | "present";
+        evidence_ref: {
+            sha256: string;
+            kind: "expectations_sha256";
+        };
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    schema_version: "clinkx-workflow-verification-v1";
+    availability: "available" | "unavailable" | "unrecorded";
+    inspections: {
+        coverage: {
+            status: "failed" | "complete" | "incomplete" | "inapplicable";
+            checks: {
+                status: "failed" | "complete" | "incomplete" | "inapplicable";
+                check_id: string;
+                reasons: {
+                    code: string;
+                    check_id: string;
+                }[];
+            }[];
+            reasons: {
+                code: string;
+                check_id: string;
+            }[];
+        };
+        owner_acceptance: "not_recorded";
+        expectations_sha256: string;
+        scope: "inspected_at";
+        identity: {
+            source_sha256: string;
+            build_sha256: string;
+            procedure_sha256: string;
+            boundary: "workflow-handoff-fixture" | "project-command-v1";
+        } | null;
+        inspection_id: string;
+        inspected_at: string;
+        required_checks: number | null;
+        retention: "unknown" | "missing" | "unavailable" | "outside_mount" | "present";
+        evidence_ref: {
+            sha256: string;
+            kind: "expectations_sha256";
+        };
+    }[];
+    reason?: "unreadable" | "identity_mismatch" | "invalid_record" | "too_many_records" | undefined;
+}, {
+    schema_version: "clinkx-workflow-verification-v1";
+    availability: "available" | "unavailable" | "unrecorded";
+    inspections: {
+        coverage: {
+            status: "failed" | "complete" | "incomplete" | "inapplicable";
+            checks: {
+                status: "failed" | "complete" | "incomplete" | "inapplicable";
+                check_id: string;
+                reasons: {
+                    code: string;
+                    check_id: string;
+                }[];
+            }[];
+            reasons: {
+                code: string;
+                check_id: string;
+            }[];
+        };
+        owner_acceptance: "not_recorded";
+        expectations_sha256: string;
+        scope: "inspected_at";
+        identity: {
+            source_sha256: string;
+            build_sha256: string;
+            procedure_sha256: string;
+            boundary: "workflow-handoff-fixture" | "project-command-v1";
+        } | null;
+        inspection_id: string;
+        inspected_at: string;
+        required_checks: number | null;
+        retention: "unknown" | "missing" | "unavailable" | "outside_mount" | "present";
+        evidence_ref: {
+            sha256: string;
+            kind: "expectations_sha256";
+        };
+    }[];
+    reason?: "unreadable" | "identity_mismatch" | "invalid_record" | "too_many_records" | undefined;
+}>;
+export type WorkflowVerificationProjection = z.infer<typeof WorkflowVerificationProjectionSchema>;

package/clinkx-workflows/dist/workflow-verification-contract.js

@@ -0,0 +1,52 @@
+import { z } from "zod";
+import { VerificationIdentitySchema } from "./verification-proof.js";
+export const WORKFLOW_VERIFICATION_VERSION = "clinkx-workflow-verification-v1";
+export const MAX_WORKFLOW_VERIFICATIONS = 16;
+export const MAX_WORKFLOW_VERIFICATION_BYTES = 128 * 1024;
+export const MAX_WORKFLOW_VERIFICATION_HISTORY_BYTES = 160 * 1024;
+const Digest = z.string().regex(/^[a-f0-9]{64}$/);
+const Status = z.enum(["complete", "incomplete", "inapplicable", "failed"]);
+const Reason = z.object({ code: z.string().regex(/^[a-z0-9_]{1,128}$/), check_id: z.string().max(128) }).strict();
+const Coverage = z.object({
+    status: Status,
+    checks: z.array(z.object({ check_id: z.string().min(1).max(128), status: Status,
+        reasons: z.array(Reason).max(1000) }).strict()).max(100),
+    reasons: z.array(Reason).max(1000),
+}).strict();
+export const WorkflowVerificationBindingSchema = z.object({ run_id: z.string().regex(/^[A-Za-z0-9_-]{1,64}$/),
+    generation: z.string().regex(/^[A-Za-z0-9_-]{43}$/), started_at: z.string().datetime(),
+    workflow_sha256: Digest, inputs_sha256: Digest }).strict();
+export const WorkflowVerificationRecordSchema = z.object({
+    schema_version: z.literal(WORKFLOW_VERIFICATION_VERSION),
+    inspection_id: z.string().uuid(), inspected_at: z.string().datetime(),
+    binding: WorkflowVerificationBindingSchema, expectations_sha256: Digest,
+    identity: VerificationIdentitySchema.nullable(),
+    required_checks: z.number().int().min(1).max(100).nullable(),
+    evidence_directory: z.string().min(1).max(4096).refine((value) => value.startsWith("/") && !value.includes("\0")),
+    coverage: Coverage,
+    scope: z.literal("inspected_at"), owner_acceptance: z.literal("not_recorded"),
+}).strict().superRefine((record, context) => {
+    if ((record.identity === null) !== (record.required_checks === null))
+        context.addIssue({ code: z.ZodIssueCode.custom, message: "identity and required coverage must both be authenticated or unknown" });
+    if (new Set(record.coverage.checks.map((check) => check.check_id)).size !== record.coverage.checks.length)
+        context.addIssue({ code: z.ZodIssueCode.custom, message: "duplicate required check" });
+    if (record.coverage.status === "complete" && (record.identity === null || record.required_checks !== record.coverage.checks.length
+        || record.coverage.reasons.length !== 0 || record.coverage.checks.some((check) => check.status !== "complete" || check.reasons.length !== 0))) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: "complete coverage requires authenticated, complete required checks" });
+    }
+});
+const Retention = z.enum(["unknown", "outside_mount", "present", "missing", "unavailable"]);
+export const WorkflowVerificationProjectionSchema = z.object({
+    schema_version: z.literal(WORKFLOW_VERIFICATION_VERSION),
+    availability: z.enum(["unrecorded", "available", "unavailable"]),
+    reason: z.enum(["invalid_record", "identity_mismatch", "too_many_records", "unreadable"]).optional(),
+    inspections: z.array(z.object({
+        inspection_id: z.string().uuid(), inspected_at: z.string().datetime(),
+        expectations_sha256: Digest, identity: VerificationIdentitySchema.nullable(),
+        required_checks: z.number().int().min(1).max(100).nullable(),
+        coverage: Coverage, retention: Retention,
+        evidence_ref: z.object({ kind: z.literal("expectations_sha256"), sha256: Digest }).strict(),
+        scope: z.literal("inspected_at"), owner_acceptance: z.literal("not_recorded"),
+    }).strict()).max(MAX_WORKFLOW_VERIFICATIONS),
+}).strict();
+//# sourceMappingURL=workflow-verification-contract.js.map

package/clinkx-workflows/dist/workflow-verification-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-verification-contract.js","sourceRoot":"","sources":["../src/workflow-verification-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAErE,MAAM,CAAC,MAAM,6BAA6B,GAAG,iCAAiC,CAAC;AAC/E,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAC7C,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,GAAG,IAAI,CAAC;AAC1D,MAAM,CAAC,MAAM,uCAAuC,GAAG,GAAG,GAAG,IAAI,CAAC;AAClE,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AAClD,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC5E,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAClH,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM;QAC7E,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1D,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;CACnC,CAAC,CAAC,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;IAC3G,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtF,eAAe,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC7D,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrE,OAAO,EAAE,iCAAiC,EAAE,mBAAmB,EAAE,MAAM;IACvE,QAAQ,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAC/C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC5D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjH,QAAQ,EAAE,QAAQ;IAClB,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;CAC9E,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;IAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,KAAK,IAAI,CAAC;QAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,sEAAsE,EAAE,CAAC,CAAC;IACzM,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;IAClM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,eAAe,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM;WAC7H,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,UAAU,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAChJ,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,oEAAoE,EAAE,CAAC,CAAC;IACnI,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;AAC5F,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC;IACxD,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;IAChE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpG,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC5B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrE,mBAAmB,EAAE,MAAM,EAAE,QAAQ,EAAE,0BAA0B,CAAC,QAAQ,EAAE;QAC5E,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAC5D,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;QACxC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAC3F,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;KAC9E,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC;CAC7C,CAAC,CAAC,MAAM,EAAE,CAAC"}

package/clinkx-workflows/dist/workflow-verification.d.ts

@@ -0,0 +1,15 @@
+import { type WorkflowVerificationProjection } from "./workflow-verification-contract.js";
+export * from "./workflow-verification-contract.js";
+export declare function attachWorkflowVerification(input: {
+    runsRoot: string;
+    runId: string;
+    requestId: string;
+    pin: string;
+    evidence: string;
+    coverage: unknown;
+    identity: unknown | null;
+    requiredChecks: number | null;
+    signal?: AbortSignal;
+}): Promise<WorkflowVerificationProjection>;
+/** Historical inspection only: current source applicability and acceptance are never inferred. */
+export declare function readWorkflowVerification(runsRoot: string, runId: string, retentionRoots?: readonly string[]): Promise<WorkflowVerificationProjection>;