harnery 0.11.0 → 0.12.1

package/dist/core/policy/index.js

@@ -0,0 +1,3 @@
+export { evaluatePolicy, normalizePolicy, PolicyDeniedError, policyDigest, summarizePolicyRequest, } from "./evaluate.js";
+export { loadPolicyFile } from "./file.js";
+export { POLICY_SCHEMA_VERSION } from "./types.js";

package/dist/core/policy/types.d.ts

@@ -0,0 +1,91 @@
+export declare const POLICY_SCHEMA_VERSION: 1;
+export type PolicyVerdict = "allow" | "ask" | "deny";
+export type PolicyPhase = "dispatch" | "external_mutation";
+export type PolicyIsolation = "shared" | "worktree" | "sandbox" | "remote";
+export type PolicyNetworkAccess = "enabled" | "disabled" | "unknown";
+/** Host-owned policy document. Workflow metadata cannot supply this value. */
+export interface PolicySpec {
+    schema_version?: typeof POLICY_SCHEMA_VERSION;
+    name?: string;
+    max_cost_usd?: number;
+    /** Applied when a cost ceiling exists but the host cannot price a dispatch. */
+    unknown_cost?: Exclude<PolicyVerdict, "allow">;
+    allowed_harnesses?: readonly string[];
+    allowed_models?: readonly string[];
+    /** Absolute paths, or paths relative to the policy file. */
+    allowed_paths?: readonly string[];
+    network?: PolicyVerdict;
+    external_actions?: PolicyVerdict;
+    /** Allowed host-declared execution boundaries. No strength ordering is inferred. */
+    allowed_isolation?: readonly PolicyIsolation[];
+}
+export interface NormalizedPolicy {
+    schema_version: typeof POLICY_SCHEMA_VERSION;
+    name: string;
+    max_cost_usd?: number;
+    unknown_cost: Exclude<PolicyVerdict, "allow">;
+    allowed_harnesses?: readonly string[];
+    allowed_models?: readonly string[];
+    allowed_paths?: readonly string[];
+    network: PolicyVerdict;
+    external_actions: PolicyVerdict;
+    allowed_isolation?: readonly PolicyIsolation[];
+}
+export interface PolicyRequest {
+    phase: PolicyPhase;
+    action: string;
+    path?: string;
+    harness?: string;
+    model?: string;
+    effort?: string;
+    max_attempts?: number;
+    max_turns?: number;
+    timeout_ms?: number;
+    /** Prompt size for host estimation. Prompt content is never included. */
+    prompt_bytes?: number;
+    isolation: PolicyIsolation;
+    network_access: PolicyNetworkAccess;
+    service?: string;
+    target?: string;
+    current_cost_usd?: number;
+    projected_cost_usd?: number | null;
+}
+export type PolicyRequestSummary = PolicyRequest;
+export interface PolicyRuleResult {
+    code: string;
+    verdict: PolicyVerdict;
+    reason: string;
+}
+export interface PolicyEvaluation {
+    verdict: PolicyVerdict;
+    reason: string;
+    rules: PolicyRuleResult[];
+}
+export interface PolicyAskResolution {
+    verdict: "allow" | "deny";
+    reason?: string;
+}
+export type PolicyAskResolver = (request: Readonly<PolicyRequestSummary>, evaluation: Readonly<PolicyEvaluation>) => Promise<PolicyAskResolution> | PolicyAskResolution;
+export interface PolicyDecision {
+    id: string;
+    checked_at: string;
+    policy: string;
+    phase: PolicyPhase;
+    initial_verdict: PolicyVerdict;
+    verdict: "allow" | "deny";
+    resolved_by: "policy" | "host" | "fail_closed";
+    reason: string;
+    rule_codes: string[];
+    request: PolicyRequestSummary;
+}
+export interface ExternalMutationRequest {
+    /** Short verb phrase, for example "publish release" or "write report". */
+    action: string;
+    path?: string;
+    network?: boolean;
+    service?: string;
+    /** Bounded destination descriptor. Do not include credentials or payloads. */
+    target?: string;
+}
+export type DispatchCostEstimator = (request: Readonly<PolicyRequestSummary>) => Promise<number | null> | number | null;
+//# sourceMappingURL=types.d.ts.map

package/dist/core/policy/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/policy/types.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,qBAAqB,EAAG,CAAU,CAAC;AAEhD,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AACrD,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,mBAAmB,CAAC;AAC3D,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;AAC3E,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAErE,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,cAAc,CAAC,EAAE,OAAO,qBAAqB,CAAC;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC/C,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,4DAA4D;IAC5D,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,gBAAgB,CAAC,EAAE,aAAa,CAAC;IACjC,oFAAoF;IACpF,iBAAiB,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CAChD;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc,EAAE,OAAO,qBAAqB,CAAC;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC9C,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,OAAO,EAAE,aAAa,CAAC;IACvB,gBAAgB,EAAE,aAAa,CAAC;IAChC,iBAAiB,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CAChD;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,WAAW,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,eAAe,CAAC;IAC3B,cAAc,EAAE,mBAAmB,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,MAAM,oBAAoB,GAAG,aAAa,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,gBAAgB,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,iBAAiB,GAAG,CAC9B,OAAO,EAAE,QAAQ,CAAC,oBAAoB,CAAC,EACvC,UAAU,EAAE,QAAQ,CAAC,gBAAgB,CAAC,KACnC,OAAO,CAAC,mBAAmB,CAAC,GAAG,mBAAmB,CAAC;AAExD,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,WAAW,CAAC;IACnB,eAAe,EAAE,aAAa,CAAC;IAC/B,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;IAC1B,WAAW,EAAE,QAAQ,GAAG,MAAM,GAAG,aAAa,CAAC;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,OAAO,EAAE,oBAAoB,CAAC;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,QAAQ,CAAC,oBAAoB,CAAC,KACpC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC"}

package/dist/core/policy/types.js

@@ -0,0 +1 @@
+export const POLICY_SCHEMA_VERSION = 1;

package/dist/core/scratch/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/scratch/index.ts"],"names":[],"mappings":"AAcA;;;;;;;;;;;;GAYG;AAEH,eAAO,MAAM,kBAAkB,iFAQrB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAElE,eAAO,MAAM,iBAAiB,QAAY,CAAC;AAC3C,eAAO,MAAM,kBAAkB,QAAY,CAAC;AAC5C,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,6DAA6D;AAC7D,eAAO,MAAM,eAAe,QACyF,CAAC;AAEtH,mFAAmF;AACnF,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAE/D,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,eAAe,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;CACf;AAID,wBAAgB,UAAU,IAAI,MAAM,CAMnC;AAED,wBAAgB,UAAU,IAAI,MAAM,CAInC;AAED,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEtD;AAeD,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,CAAC,GAAE,IAAiB,GAAG,MAAM,CAW1D;AAID,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,CA+DtE;AAED,+CAA+C;AAC/C,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAkBxD;AAmBD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,SAAoB,GAAG,SAAS,EAAE,CA2DrF;AAID,wBAAgB,WAAW,CACzB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE,MAAM,GACX,UAAU,CAgEZ;AAID,wGAAwG;AACxG,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOhE;AAED,iEAAiE;AACjE,wBAAgB,aAAa,CAAC,IAAI,SAAyB,GAAG,MAAM,CAkBnE;AAED,uFAAuF;AACvF,wBAAgB,sBAAsB,IAAI,MAAM,EAAE,CAajD;AAED,qDAAqD;AACrD,wBAAgB,YAAY,IAAI;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf,EAAE,CAWF;AAID,wBAAgB,mBAAmB,IAAI,MAAM,CAM5C;AAED,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAIjE;AAED,2FAA2F;AAC3F,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAoB9D"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/scratch/index.ts"],"names":[],"mappings":"AAmBA;;;;;;;;;;;;GAYG;AAEH,eAAO,MAAM,kBAAkB,iFAQrB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAElE,eAAO,MAAM,iBAAiB,QAAY,CAAC;AAC3C,eAAO,MAAM,kBAAkB,QAAY,CAAC;AAC5C,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,6DAA6D;AAC7D,eAAO,MAAM,eAAe,QACyF,CAAC;AAEtH,mFAAmF;AACnF,eAAO,MAAM,wBAAwB,yBAAyB,CAAC;AAE/D,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,eAAe,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;CACf;AAID,wBAAgB,UAAU,IAAI,MAAM,CAMnC;AAED,wBAAgB,UAAU,IAAI,MAAM,CAInC;AAED,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAGtD;AAeD,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,CAAC,GAAE,IAAiB,GAAG,MAAM,CAW1D;AAID,wEAAwE;AACxE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,CAwEtE;AAED,+CAA+C;AAC/C,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAkBxD;AAmBD,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,SAAoB,GAAG,SAAS,EAAE,CA2DrF;AAID,wBAAgB,WAAW,CACzB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE,MAAM,GACX,UAAU,CAgEZ;AAID,wGAAwG;AACxG,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQhE;AAED,iEAAiE;AACjE,wBAAgB,aAAa,CAAC,IAAI,SAAyB,GAAG,MAAM,CAkBnE;AAED,uFAAuF;AACvF,wBAAgB,sBAAsB,IAAI,MAAM,EAAE,CAajD;AAED,qDAAqD;AACrD,wBAAgB,YAAY,IAAI;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf,EAAE,CAWF;AAID,wBAAgB,mBAAmB,IAAI,MAAM,CAM5C;AAED,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAIjE;AAED,2FAA2F;AAC3F,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAoB9D"}

package/dist/core/scratch/index.js

@@ -1,7 +1,7 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { resolveMachineLabel } from "../../lib/machine.js";
-import { monorepoRoot, readHeartbeat, resolveOwner } from "../agents/index.js";
+import { assertSafeInstanceId, monorepoRoot, readHeartbeat, resolveOwner, } from "../agents/index.js";
 /**
  * Agent scratchpad: per-agent markdown journal at `.harnery/scratch/<instance_id>.md`.
  *
@@ -46,6 +46,7 @@ export function archiveDir() {
     return dir;
 }
 export function scratchPath(instanceId) {
+    assertSafeInstanceId(instanceId);
     return resolve(scratchDir(), `${instanceId}.md`);
 }
 // ─── Chicago time formatting ──────────────────────────────────────────────
@@ -96,9 +97,17 @@ export function parseScratch(path, content) {
             i++;
             break;
         }
-        const m = line.match(/^(session_id|machine|started|last_updated):\s*(.+?)\s*$/);
-        if (m) {
-            header[m[1]] = m[2].trim();
+        const separator = line.indexOf(":");
+        if (separator > 0) {
+            const key = line.slice(0, separator);
+            if (key === "session_id" ||
+                key === "machine" ||
+                key === "started" ||
+                key === "last_updated") {
+                const value = line.slice(separator + 1).trim();
+                if (value)
+                    header[key] = value;
+            }
         }
     }
     // ── entries ──
@@ -293,6 +302,7 @@ export function appendEntry(instanceId, category, body) {
 // ─── Archive lifecycle ────────────────────────────────────────────────────
 /** Move `<owner>.md` → `archived/<owner>-<ts>.md`. No-op if missing. Returns archive path (or null). */
 export function archiveScratch(instanceId) {
+    assertSafeInstanceId(instanceId);
     const src = scratchPath(instanceId);
     if (!existsSync(src))
         return null;

package/dist/core/workflow/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAeH,OAAO,KAAK,EAEV,UAAU,EAEV,SAAS,EAOV,MAAM,YAAY,CAAC;AAUpB,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAM/E;AAED,wBAAsB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAqa1F"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAuBH,OAAO,KAAK,EAEV,UAAU,EAEV,SAAS,EAOV,MAAM,YAAY,CAAC;AAYpB,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAM/E;AAED,wBAAsB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAsmB1F"}

package/dist/core/workflow/engine.js

@@ -29,6 +29,7 @@ import { appendFileSync, existsSync, mkdirSync, readFileSync, statSync } from "n
 import { isAbsolute, join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { snapshotRepo } from "../context/index.js";
+import { evaluatePolicy, normalizePolicy, PolicyDeniedError, policyDigest, summarizePolicyRequest, } from "../policy/index.js";
 import { probeBilling } from "./billing.js";
 import { buildWorkflowProof, createEvidenceRecord, digestResult, normalizeWorkflowMeta, writeWorkflowProof, } from "./proof.js";
 import { WORKFLOW_PROOF_SCHEMA_VERSION } from "./types.js";
@@ -38,6 +39,8 @@ const DEFAULT_CONCURRENCY = 4;
 const DEFAULT_MAX_ATTEMPTS = 2;
 const DEFAULT_TIMEOUT_MS = 300_000;
 const DEFAULT_MAX_TURNS = 25;
+const DEFAULT_POLICY_ASK_TIMEOUT_MS = 60_000;
+const MAX_POLICY_DECISIONS = 50;
 export class WorkflowRunError extends Error {
     runId;
     proofPath;
@@ -67,6 +70,9 @@ export async function runWorkflow(scriptPath, opts) {
     const cwd = opts.cwd ?? opts.coordRoot;
     const log = opts.onLog ?? ((line) => process.stderr.write(`${line}\n`));
     const defaultHarness = opts.defaultHarness ?? "claude-code";
+    const isolation = opts.isolation ?? "shared";
+    const networkAccess = opts.networkAccess ?? "unknown";
+    const policy = opts.policy ? normalizePolicy(opts.policy, { baseDir: cwd }) : undefined;
     const repoBefore = snapshotRepo(cwd);
     // Per-child fixed context overhead: children spawn in `cwd` and load its
     // repo-instructions file into their system prompt, cache-writing it once
@@ -83,12 +89,15 @@ export async function runWorkflow(scriptPath, opts) {
     let agentsSpawned = 0;
     let agentsCached = 0;
     let costUsd = 0;
+    let reservedCostUsd = 0;
     let currentStage = "";
     let agentSeq = 0;
     let evidenceSeq = 0;
+    let policySeq = 0;
     const billingProbed = new Map();
     const agentProofs = new Map();
     const evidenceRecords = [];
+    const policyDecisions = [];
     const acceptanceIds = new Set(meta.acceptance.map((criterion) => criterion.id));
     const journal = (event, data) => {
         const line = JSON.stringify({
@@ -118,7 +127,90 @@ export async function runWorkflow(scriptPath, opts) {
         inFlight--;
         waiters.shift()?.();
     };
+    // Policy checks that affect the shared cost reservation ledger serialize.
+    // Spawns still run concurrently after authorization; only the last-moment
+    // check-and-reserve section is exclusive.
+    let policyGate = Promise.resolve();
+    const withDispatchPolicyGate = async (work) => {
+        const previous = policyGate;
+        let open;
+        policyGate = new Promise((resolveGate) => {
+            open = resolveGate;
+        });
+        await previous;
+        try {
+            return await work();
+        }
+        finally {
+            open();
+        }
+    };
+    const authorizePolicyRequest = async (rawRequest) => {
+        if (!policy) {
+            throw new Error("external mutation authorization requires a host policy");
+        }
+        if (policyDecisions.length >= MAX_POLICY_DECISIONS) {
+            throw new Error(`workflow policy decision cap reached (${MAX_POLICY_DECISIONS}); split the workflow or reduce protected actions`);
+        }
+        const request = summarizePolicyRequest(rawRequest);
+        const evaluation = evaluatePolicy(policy, request);
+        const id = `p${++policySeq}`;
+        const checkedAt = new Date().toISOString();
+        journal("policy.check", {
+            id,
+            policy: policy.name,
+            policy_sha256: policyDigest(policy),
+            request,
+            verdict: evaluation.verdict,
+            rules: evaluation.rules,
+        });
+        let verdict = evaluation.verdict === "allow" ? "allow" : "deny";
+        let resolvedBy = "policy";
+        let reason = evaluation.reason;
+        if (evaluation.verdict === "ask") {
+            resolvedBy = "fail_closed";
+            if (!opts.resolvePolicyAsk) {
+                reason = `${evaluation.reason}; no host approval resolver is configured`;
+            }
+            else {
+                try {
+                    const resolution = await withTimeout(Promise.resolve(opts.resolvePolicyAsk(request, evaluation)), opts.policyAskTimeoutMs ?? DEFAULT_POLICY_ASK_TIMEOUT_MS);
+                    if (!resolution || (resolution.verdict !== "allow" && resolution.verdict !== "deny")) {
+                        reason = `${evaluation.reason}; host returned an invalid approval resolution`;
+                    }
+                    else {
+                        verdict = resolution.verdict;
+                        resolvedBy = "host";
+                        reason = boundedPolicyReason(resolution.reason ?? evaluation.reason);
+                    }
+                }
+                catch (error) {
+                    reason = `${evaluation.reason}; approval failed closed: ${error.message}`;
+                }
+            }
+        }
+        const decision = {
+            id,
+            checked_at: checkedAt,
+            policy: policy.name,
+            phase: request.phase,
+            initial_verdict: evaluation.verdict,
+            verdict,
+            resolved_by: resolvedBy,
+            reason: boundedPolicyReason(reason),
+            rule_codes: evaluation.rules.map((rule) => rule.code),
+            request,
+        };
+        policyDecisions.push(decision);
+        journal("policy.resolve", { ...decision });
+        if (decision.verdict === "deny") {
+            throw new PolicyDeniedError(`policy ${JSON.stringify(policy.name)} denied ${request.phase} ${JSON.stringify(request.action)}: ${decision.reason}`, decision.id);
+        }
+        return decision;
+    };
     const agent = async (prompt, agentOpts = {}) => {
+        let reservedForDispatch = 0;
+        let spawnCountClaimed = false;
         const harness = agentOpts.harness ?? defaultHarness;
         const spawner = opts.spawners[harness];
         if (!spawner) {
@@ -158,50 +250,125 @@ export async function runWorkflow(scriptPath, opts) {
             log(`[${name}] ${currentStage || "(no stage)"} → ${id} ${label} (cached from ${opts.resumeFrom})`);
             return cached.value;
         }
-        // Billing safeguard: on a harness's FIRST spawn this run, classify which
-        // auth its children will use and refuse the silent-override state (an
-        // exported API key shadowing a stored subscription login) unless the
-        // caller explicitly opted into API billing. Cached agents never reach
-        // this — no spawn, no billing.
-        if (!billingProbed.has(harness)) {
-            const probe = (opts.probeBilling ?? probeBilling)(harness);
-            billingProbed.set(harness, probe);
-            journal("billing.probe", {
+        if (policy) {
+            const estimateRequest = summarizePolicyRequest({
+                phase: "dispatch",
+                action: "spawn agent",
+                path: cwd,
                 harness,
-                mode: opts.subscriptionOnly ? "subscription" : probe.mode,
-                api_key_source: probe.apiKeySource,
-                login: probe.login,
-                subscription_only: Boolean(opts.subscriptionOnly),
+                model: agentOpts.model,
+                effort: agentOpts.effort,
+                max_attempts: maxAttempts,
+                max_turns: agentOpts.maxTurns ?? DEFAULT_MAX_TURNS,
+                timeout_ms: agentOpts.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+                prompt_bytes: Buffer.byteLength(prompt),
+                isolation,
+                network_access: networkAccess,
+                current_cost_usd: round4(costUsd + reservedCostUsd),
+                projected_cost_usd: null,
             });
-            if (opts.subscriptionOnly) {
-                if (probe.login === "absent") {
-                    throw new Error(`subscription-only: no stored login detected for ${harness}; ` +
-                        `log the harness CLI in (or drop --subscription-only for a key-only host)`);
+            let projectedCost = null;
+            if (policy.max_cost_usd !== undefined && opts.estimateDispatchCost) {
+                try {
+                    const candidate = await opts.estimateDispatchCost(estimateRequest);
+                    if (candidate !== null && (!Number.isFinite(candidate) || candidate < 0)) {
+                        throw new Error("cost estimator returned a non-finite or negative value");
+                    }
+                    projectedCost = candidate;
+                }
+                catch (error) {
+                    journal("policy.cost_estimate_failed", {
+                        harness,
+                        model: agentOpts.model ?? null,
+                        error: boundedPolicyReason(error.message),
+                    });
                 }
-                log(`[billing] ${harness}: subscription-only (API-key vars scrubbed from child env)`);
             }
-            else if (probe.mode === "api-key-override" && !opts.allowApiBilling) {
-                throw new Error(`${probe.apiKeySource} is set AND a stored ${harness} login exists — the key silently ` +
-                    `overrides your subscription auth, so children would bill per-token API rates. ` +
-                    `Either unset ${probe.apiKeySource}, run with --subscription-only to scrub it from ` +
-                    `child envs, or pass --allow-api-billing if API billing is intended`);
+            try {
+                await withDispatchPolicyGate(async () => {
+                    assertAgentCapacity(agentsSpawned, maxAgents);
+                    const dispatchRequest = {
+                        ...estimateRequest,
+                        current_cost_usd: round4(costUsd + reservedCostUsd),
+                        projected_cost_usd: projectedCost,
+                    };
+                    await authorizePolicyRequest(dispatchRequest);
+                    if (policy.max_cost_usd !== undefined) {
+                        reservedForDispatch =
+                            projectedCost ?? Math.max(0, policy.max_cost_usd - dispatchRequest.current_cost_usd);
+                        reservedCostUsd += reservedForDispatch;
+                    }
+                    agentsSpawned++;
+                    spawnCountClaimed = true;
+                });
             }
-            else if (probe.mode === "api-key") {
-                log(`[billing] ${harness}: API-key billing (${probe.apiKeySource}; no stored login detected) — ` +
-                    `children bill per-token rates`);
+            catch (error) {
+                agentProof.error = error.message;
+                throw error;
             }
-            else if (probe.mode === "api-key-override") {
-                log(`[billing] ${harness}: API-key billing (--allow-api-billing; key overrides stored login)`);
+        }
+        else {
+            try {
+                assertAgentCapacity(agentsSpawned, maxAgents);
             }
-            else {
-                log(`[billing] ${harness}: subscription login`);
+            catch (error) {
+                agentProof.error = error.message;
+                throw error;
             }
         }
-        if (agentsSpawned >= maxAgents) {
-            agentProof.error = `workflow agent cap reached (${maxAgents})`;
-            throw new Error(`workflow agent cap reached (${maxAgents}); raise --max-agents deliberately if the fan-out is intended`);
+        // Billing safeguard: on a harness's FIRST spawn this run, classify which
+        // auth its children will use and refuse the silent-override state (an
+        // exported API key shadowing a stored subscription login) unless the
+        // caller explicitly opted into API billing. Cached agents never reach
+        // this — no spawn, no billing.
+        try {
+            if (!billingProbed.has(harness)) {
+                const probe = (opts.probeBilling ?? probeBilling)(harness);
+                billingProbed.set(harness, probe);
+                journal("billing.probe", {
+                    harness,
+                    mode: opts.subscriptionOnly ? "subscription" : probe.mode,
+                    api_key_source: probe.apiKeySource,
+                    login: probe.login,
+                    subscription_only: Boolean(opts.subscriptionOnly),
+                });
+                if (opts.subscriptionOnly) {
+                    if (probe.login === "absent") {
+                        throw new Error(`subscription-only: no stored login detected for ${harness}; ` +
+                            `log the harness CLI in (or drop --subscription-only for a key-only host)`);
+                    }
+                    log(`[billing] ${harness}: subscription-only (API-key vars scrubbed from child env)`);
+                }
+                else if (probe.mode === "api-key-override" && !opts.allowApiBilling) {
+                    throw new Error(`${probe.apiKeySource} is set AND a stored ${harness} login exists — the key silently ` +
+                        `overrides your subscription auth, so children would bill per-token API rates. ` +
+                        `Either unset ${probe.apiKeySource}, run with --subscription-only to scrub it from ` +
+                        `child envs, or pass --allow-api-billing if API billing is intended`);
+                }
+                else if (probe.mode === "api-key") {
+                    log(`[billing] ${harness}: API-key billing (${probe.apiKeySource}; no stored login detected) — ` +
+                        `children bill per-token rates`);
+                }
+                else if (probe.mode === "api-key-override") {
+                    log(`[billing] ${harness}: API-key billing (--allow-api-billing; key overrides stored login)`);
+                }
+                else {
+                    log(`[billing] ${harness}: subscription login`);
+                }
+            }
         }
-        agentsSpawned++;
+        catch (error) {
+            reservedCostUsd = Math.max(0, reservedCostUsd - reservedForDispatch);
+            reservedForDispatch = 0;
+            if (spawnCountClaimed) {
+                agentsSpawned--;
+                spawnCountClaimed = false;
+            }
+            agentProof.error = error.message;
+            throw error;
+        }
+        if (!spawnCountClaimed)
+            agentsSpawned++;
         await acquire();
         try {
             journal("agent.start", {
@@ -298,6 +465,7 @@ export async function runWorkflow(scriptPath, opts) {
             throw error;
         }
         finally {
+            reservedCostUsd = Math.max(0, reservedCostUsd - reservedForDispatch);
             release();
         }
     };
@@ -327,7 +495,22 @@ export async function runWorkflow(scriptPath, opts) {
         journal("evidence.recorded", { ...record });
         return record.id;
     };
-    const ctx = { agent, parallel, stage, log, evidence };
+    const authorize = async (input) => {
+        const network = input.network === true || input.service !== undefined || input.target !== undefined
+            ? "enabled"
+            : "disabled";
+        return authorizePolicyRequest({
+            phase: "external_mutation",
+            action: input.action,
+            path: input.path ? resolve(cwd, input.path) : undefined,
+            isolation,
+            network_access: network,
+            service: input.service,
+            target: input.target,
+            current_cost_usd: round4(costUsd),
+        });
+    };
+    const ctx = { agent, parallel, stage, log, evidence, authorize };
     const t0 = Date.now();
     const startedAt = new Date(t0).toISOString();
     journal("run.start", {
@@ -337,6 +520,9 @@ export async function runWorkflow(scriptPath, opts) {
         acceptance: meta.acceptance,
         max_agents: maxAgents,
         concurrency,
+        policy: policy ? { name: policy.name, sha256: policyDigest(policy) } : null,
+        isolation,
+        network_access: networkAccess,
     });
     try {
         const result = await mod.default(ctx);
@@ -364,6 +550,9 @@ export async function runWorkflow(scriptPath, opts) {
                 agents: Array.from(agentProofs.values()),
                 evidence: evidenceRecords,
                 harnessEvidence: opts.harnessEvidence,
+                policy: policy
+                    ? { config: policy, decisions: policyDecisions, isolation, networkAccess }
+                    : undefined,
                 result,
             });
             writeWorkflowProof(proofPath, proof);
@@ -387,6 +576,7 @@ export async function runWorkflow(scriptPath, opts) {
                 harness: p.harness,
                 mode: opts.subscriptionOnly ? "subscription" : p.mode,
             })),
+            policy: proof.policy?.summary,
         };
         return report;
     }
@@ -417,6 +607,9 @@ export async function runWorkflow(scriptPath, opts) {
                 agents: Array.from(agentProofs.values()),
                 evidence: evidenceRecords,
                 harnessEvidence: opts.harnessEvidence,
+                policy: policy
+                    ? { config: policy, decisions: policyDecisions, isolation, networkAccess }
+                    : undefined,
                 error: err.message,
             });
             writeWorkflowProof(proofPath, proof);
@@ -486,3 +679,36 @@ function loadResumeCache(coordRoot, resumeFrom) {
 function round4(n) {
     return Math.round(n * 10_000) / 10_000;
 }
+function assertAgentCapacity(agentsSpawned, maxAgents) {
+    if (agentsSpawned >= maxAgents) {
+        throw new Error(`workflow agent cap reached (${maxAgents}); raise --max-agents deliberately if the fan-out is intended`);
+    }
+}
+function boundedPolicyReason(value) {
+    const normalized = Array.from(value, (character) => {
+        const code = character.charCodeAt(0);
+        return code < 32 || code === 127 ? " " : character;
+    })
+        .join("")
+        .replace(/\s+/g, " ")
+        .trim();
+    return normalized.length > 2_000 ? `${normalized.slice(0, 1_999)}…` : normalized;
+}
+async function withTimeout(promise, timeoutMs) {
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+        throw new Error("policyAskTimeoutMs must be a positive finite number");
+    }
+    let timer;
+    try {
+        return await Promise.race([
+            promise,
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error(`approval timed out after ${timeoutMs}ms`)), timeoutMs);
+            }),
+        ]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}

package/dist/core/workflow/index.d.ts

@@ -1,5 +1,5 @@
 export { runWorkflow, WorkflowRunError } from "./engine.js";
 export { buildWorkflowProof, createEvidenceRecord, digestResult, normalizeWorkflowMeta, readWorkflowProof, renderWorkflowProof, rollupAcceptance, writeWorkflowProof, } from "./proof.js";
-export type { AcceptanceCriterion, AcceptanceResult, AcceptanceStatus, AcceptanceSummary, AgentOpts, EngineOpts, EvidenceKind, EvidenceSource, EvidenceStatus, HarnessEvidenceCapability, HarnessEvidenceCoverage, HarnessName, ResultDigest, RunReport, Spawner, SpawnRequest, SpawnResult, StageSchema, WorkflowAgentProof, WorkflowContext, WorkflowEvidenceInput, WorkflowEvidenceRecord, WorkflowMeta, WorkflowModule, WorkflowProof, WorkflowProofUnknown, WorkflowRepoEvidence, WorkflowRepoSnapshot, WorkflowRunStatus, } from "./types.js";
+export type { AcceptanceCriterion, AcceptanceResult, AcceptanceStatus, AcceptanceSummary, AgentOpts, EngineOpts, EvidenceKind, EvidenceSource, EvidenceStatus, HarnessEvidenceCapability, HarnessEvidenceCoverage, HarnessName, ResultDigest, RunReport, Spawner, SpawnRequest, SpawnResult, StageSchema, WorkflowAgentProof, WorkflowContext, WorkflowEvidenceInput, WorkflowEvidenceRecord, WorkflowMeta, WorkflowModule, WorkflowPolicyProof, WorkflowProof, WorkflowProofUnknown, WorkflowRepoEvidence, WorkflowRepoSnapshot, WorkflowRunStatus, } from "./types.js";
 export { WORKFLOW_PROOF_SCHEMA_VERSION } from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/core/workflow/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,YAAY,EACZ,cAAc,EACd,cAAc,EACd,yBAAyB,EACzB,uBAAuB,EACvB,WAAW,EACX,YAAY,EACZ,SAAS,EACT,OAAO,EACP,YAAY,EACZ,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,6BAA6B,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,YAAY,EACZ,cAAc,EACd,cAAc,EACd,yBAAyB,EACzB,uBAAuB,EACvB,WAAW,EACX,YAAY,EACZ,SAAS,EACT,OAAO,EACP,YAAY,EACZ,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,6BAA6B,EAAE,MAAM,YAAY,CAAC"}

package/dist/core/workflow/proof.d.ts

@@ -1,4 +1,5 @@
 import type { RepoSnapshot } from "../context/index.js";
+import type { NormalizedPolicy, PolicyDecision, PolicyIsolation, PolicyNetworkAccess } from "../policy/index.js";
 import type { AcceptanceCriterion, AcceptanceResult, AcceptanceSummary, HarnessEvidenceCapability, ResultDigest, WorkflowAgentProof, WorkflowEvidenceInput, WorkflowEvidenceRecord, WorkflowMeta, WorkflowProof } from "./types.js";
 export interface NormalizedWorkflowMeta {
     name: string;
@@ -19,6 +20,12 @@ export interface BuildWorkflowProofInput {
     agents: WorkflowAgentProof[];
     evidence: WorkflowEvidenceRecord[];
     harnessEvidence?: Readonly<Record<string, HarnessEvidenceCapability | undefined>>;
+    policy?: {
+        config: Readonly<NormalizedPolicy>;
+        decisions: readonly PolicyDecision[];
+        isolation: PolicyIsolation;
+        networkAccess: PolicyNetworkAccess;
+    };
     result?: unknown;
     error?: string;
 }

package/dist/core/workflow/proof.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/proof.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,yBAAyB,EAEzB,YAAY,EACZ,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EACZ,aAAa,EAId,MAAM,YAAY,CAAC;AAepB,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,sBAAsB,CAAC;IAC7B,MAAM,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,GAAG,SAAS,CAAC,CAAC,CAAC;IAClF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,YAAY,GAAG,SAAS,EAC9B,YAAY,EAAE,MAAM,GACnB,sBAAsB,CAqCxB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,KAAK,EAAE,qBAAqB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,sBAAsB,CA6BzB;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,QAAQ,EAAE,sBAAsB,EAAE,GACjC;IAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,CAuB9D;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,YAAY,CAQjF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,aAAa,CAwChF;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI,CAe3E;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CAkBjF;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CA8BhE"}
+{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../../../src/core/workflow/proof.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,mBAAmB,EACpB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EACV,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,yBAAyB,EAEzB,YAAY,EACZ,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,YAAY,EAEZ,aAAa,EAId,MAAM,YAAY,CAAC;AAepB,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,sBAAsB,CAAC;IAC7B,MAAM,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,QAAQ,EAAE,sBAAsB,EAAE,CAAC;IACnC,eAAe,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,yBAAyB,GAAG,SAAS,CAAC,CAAC,CAAC;IAClF,MAAM,CAAC,EAAE;QACP,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACnC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;QACrC,SAAS,EAAE,eAAe,CAAC;QAC3B,aAAa,EAAE,mBAAmB,CAAC;KACpC,CAAC;IACF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,YAAY,GAAG,SAAS,EAC9B,YAAY,EAAE,MAAM,GACnB,sBAAsB,CAqCxB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,KAAK,EAAE,qBAAqB,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,sBAAsB,CA6BzB;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,QAAQ,EAAE,sBAAsB,EAAE,GACjC;IAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,CAuB9D;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,YAAY,CAQjF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,aAAa,CAyChF;AAgCD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,IAAI,CAe3E;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,CAkBjF;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAoChE"}