@kitman-sh/sdk 0.10.82 → 0.10.83

package/types/packages/core/src/run-file.d.ts

@@ -0,0 +1,190 @@
+import * as Schema from 'effect/Schema';
+import { type JsonObject, type JsonValue } from './runtime-type';
+export declare const RunFileRefusalReasons: readonly ['type', 'too_large', 'too_many', 'quota', 'name_taken'];
+export type RunFileRefusalReason = (typeof RunFileRefusalReasons)[number];
+export declare const isRunFileRefusalReason: (reason: string) => reason is RunFileRefusalReason;
+/** Why Kitman refused a file, in the words every reader shows. */
+export declare const runFileRefusalWords: (refusal: {
+    readonly reason: RunFileRefusalReason;
+    readonly limit?: number;
+    readonly actual?: number;
+}) => string;
+declare const RunFileRefused_base: Schema.Class<RunFileRefused, Schema.TaggedStruct<"RunFileRefused", {
+    readonly reason: Schema.Literals<readonly ["type", "too_large", "too_many", "quota", "name_taken"]>;
+    readonly limit: Schema.optionalKey<Schema.Int>;
+    readonly actual: Schema.optionalKey<Schema.Int>;
+}>, import("effect/Cause").YieldableError>;
+/** A file Kitman would not keep, with the limit it hit and the number that hit it. */
+export declare class RunFileRefused extends RunFileRefused_base {
+    get message(): string;
+}
+export declare const runFileContentType: (name: string) => string;
+export declare const RunFileKinds: readonly ['image', 'video', 'html', 'text', 'other'];
+export declare const RunFileStatuses: readonly ['uploading', 'available', 'rejected', 'refused', 'removing', 'removed', 'expired'];
+/** A Run File as its maker sees it; its key stays in Kitman. */
+export declare const RunFileRecord: Schema.Struct<{
+    readonly id: Schema.String;
+    readonly runId: Schema.String;
+    readonly step: Schema.String;
+    readonly name: Schema.String;
+    readonly caption: Schema.optionalKey<Schema.String>;
+    readonly contentType: Schema.String;
+    readonly kind: Schema.Literals<readonly ["image", "video", "html", "text", "other"]>;
+    readonly byteSize: Schema.Int;
+    readonly sha256: Schema.String;
+    readonly status: Schema.Literals<readonly ["uploading", "available", "rejected", "refused", "removing", "removed", "expired"]>;
+}>;
+export type RunFileRecord = typeof RunFileRecord.Type;
+export declare const RunFileMakers: readonly ['program', 'agent', 'check'];
+/** A Run File as people and Loops read it; its key stays in Kitman. */
+export declare const RunFileView: Schema.Struct<{
+    readonly id: Schema.String;
+    readonly runId: Schema.String;
+    readonly step: Schema.String;
+    readonly stepAttemptId: Schema.optionalKey<Schema.String>;
+    readonly verificationId: Schema.optionalKey<Schema.String>;
+    readonly madeBy: Schema.Literals<readonly ["program", "agent", "check"]>;
+    readonly name: Schema.String;
+    readonly caption: Schema.optionalKey<Schema.String>;
+    readonly kind: Schema.Literals<readonly ["image", "video", "html", "text", "other"]>;
+    readonly contentType: Schema.String;
+    readonly byteSize: Schema.Int;
+    readonly sha256: Schema.String;
+    readonly status: Schema.Literals<readonly ["uploading", "available", "rejected", "refused", "removing", "removed", "expired"]>;
+    readonly reason: Schema.optionalKey<Schema.String>;
+    /** A refused file's limit and the number that passed it, as `RunFileRefused` gave them. */
+    readonly limit: Schema.optionalKey<Schema.Int>;
+    readonly actual: Schema.optionalKey<Schema.Int>;
+    readonly removedBy: Schema.optionalKey<Schema.String>;
+    readonly removedAt: Schema.optionalKey<Schema.String>;
+    readonly createdAt: Schema.String;
+}>;
+export type RunFileView = typeof RunFileView.Type;
+/** Without access to the content of the Run's repositories, only how many files it kept. */
+export declare const RunFileList: Schema.Union<readonly [Schema.Struct<{
+    readonly files: Schema.$Array<Schema.Struct<{
+        readonly id: Schema.String;
+        readonly runId: Schema.String;
+        readonly step: Schema.String;
+        readonly stepAttemptId: Schema.optionalKey<Schema.String>;
+        readonly verificationId: Schema.optionalKey<Schema.String>;
+        readonly madeBy: Schema.Literals<readonly ["program", "agent", "check"]>;
+        readonly name: Schema.String;
+        readonly caption: Schema.optionalKey<Schema.String>;
+        readonly kind: Schema.Literals<readonly ["image", "video", "html", "text", "other"]>;
+        readonly contentType: Schema.String;
+        readonly byteSize: Schema.Int;
+        readonly sha256: Schema.String;
+        readonly status: Schema.Literals<readonly ["uploading", "available", "rejected", "refused", "removing", "removed", "expired"]>;
+        readonly reason: Schema.optionalKey<Schema.String>;
+        /** A refused file's limit and the number that passed it, as `RunFileRefused` gave them. */
+        readonly limit: Schema.optionalKey<Schema.Int>;
+        readonly actual: Schema.optionalKey<Schema.Int>;
+        readonly removedBy: Schema.optionalKey<Schema.String>;
+        readonly removedAt: Schema.optionalKey<Schema.String>;
+        readonly createdAt: Schema.String;
+    }>>;
+}>, Schema.Struct<{
+    readonly count: Schema.Int;
+}>]>;
+export type RunFileList = typeof RunFileList.Type;
+export declare const RunFileUrlsRequest: Schema.Struct<{
+    readonly ids: Schema.$Array<Schema.String>;
+    readonly use: Schema.Literals<readonly ["view", "download"]>;
+}>;
+export type RunFileUrlsRequest = typeof RunFileUrlsRequest.Type;
+/** Why a person removed a file, for the note the Run keeps. */
+export declare const RunFileRemoveRequest: Schema.Struct<{
+    readonly note: Schema.optionalKey<Schema.String>;
+}>;
+export type RunFileRemoveRequest = typeof RunFileRemoveRequest.Type;
+export declare const RunFileUrl: Schema.Struct<{
+    readonly id: Schema.String;
+    readonly url: Schema.String;
+    readonly expiresAt: Schema.String;
+}>;
+export declare const RunFileUrls: Schema.Struct<{
+    readonly urls: Schema.$Array<Schema.Struct<{
+        readonly id: Schema.String;
+        readonly url: Schema.String;
+        readonly expiresAt: Schema.String;
+    }>>;
+}>;
+export type RunFileUrls = typeof RunFileUrls.Type;
+export declare const RunFilePartUrl: Schema.Struct<{
+    readonly url: Schema.String;
+    readonly headers: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+    readonly expiresAt: Schema.String;
+    readonly partNumber: Schema.Int;
+}>;
+/** Where a maker PUTs a file's bytes: one URL, or one per part of `partSize` bytes. */
+export declare const RunFileUpload: Schema.Union<readonly [Schema.Struct<{
+    readonly url: Schema.String;
+    readonly headers: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+    readonly expiresAt: Schema.String;
+    readonly kind: Schema.Literal<"single">;
+}>, Schema.Struct<{
+    readonly kind: Schema.Literal<"multipart">;
+    readonly partSize: Schema.Int;
+    readonly parts: Schema.$Array<Schema.Struct<{
+        readonly url: Schema.String;
+        readonly headers: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+        readonly expiresAt: Schema.String;
+        readonly partNumber: Schema.Int;
+    }>>;
+}>]>;
+export type RunFileUpload = typeof RunFileUpload.Type;
+export declare const UploadedRunFilePart: Schema.Struct<{
+    readonly partNumber: Schema.Int;
+    readonly etag: Schema.String;
+}>;
+/** A Run File an Output cites, as Kitman holds it. */
+export type CitedRunFile = {
+    readonly id: string;
+    readonly runId: string;
+    readonly status: (typeof RunFileStatuses)[number];
+    readonly purpose: 'evidence' | 'checkpoint';
+};
+/** The Run Files an Output cites, by the field its schema places each in. */
+export declare function runFileReferences(schema: JsonObject, output: JsonValue): readonly {
+    readonly field: string;
+    readonly id: string;
+}[];
+/** A file a Step's agent keeps on the Run; Kitman names its Step and attempt. */
+export declare const StepRunFileRequest: Schema.Struct<{
+    readonly name: Schema.String;
+    readonly caption: Schema.optionalKey<Schema.String>;
+    readonly contentType: Schema.String;
+    readonly byteSize: Schema.Int;
+    readonly sha256: Schema.String;
+}>;
+export declare const RunFileSlotted: Schema.Struct<{
+    readonly file: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly runId: Schema.String;
+        readonly step: Schema.String;
+        readonly name: Schema.String;
+        readonly caption: Schema.optionalKey<Schema.String>;
+        readonly contentType: Schema.String;
+        readonly kind: Schema.Literals<readonly ["image", "video", "html", "text", "other"]>;
+        readonly byteSize: Schema.Int;
+        readonly sha256: Schema.String;
+        readonly status: Schema.Literals<readonly ["uploading", "available", "rejected", "refused", "removing", "removed", "expired"]>;
+    }>;
+    readonly upload: Schema.optionalKey<Schema.Union<readonly [Schema.Struct<{
+        readonly url: Schema.String;
+        readonly headers: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+        readonly expiresAt: Schema.String;
+        readonly kind: Schema.Literal<"single">;
+    }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"multipart">;
+        readonly partSize: Schema.Int;
+        readonly parts: Schema.$Array<Schema.Struct<{
+            readonly url: Schema.String;
+            readonly headers: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+            readonly expiresAt: Schema.String;
+            readonly partNumber: Schema.Int;
+        }>>;
+    }>]>>;
+}>;
+export {};

package/types/packages/core/src/run-graph.d.ts

@@ -0,0 +1,67 @@
+import type { Question, Run, RunDisplayState, RunGraph, RunGraphNode, StepAttempt } from './loop';
+type Reached = {
+    readonly id: string;
+    readonly name: string;
+    /** When the journal recorded its launch. */
+    readonly startedAt: string;
+    /** When the journal recorded its deferred resolved, and whether with success. */
+    readonly resolved?: {
+        readonly at: string;
+        readonly ok: boolean;
+    };
+};
+/** What the journal and its records say of one Step a Run reached. */
+export type RunGraphStep = (Reached & {
+    readonly kind: 'agent';
+    readonly attempts: readonly {
+        readonly id: string;
+        readonly attempt: number;
+        readonly status: StepAttempt['status'];
+        /** A Runner holds it. */
+        readonly leased: boolean;
+        readonly failureSummary?: string;
+    }[];
+    readonly agent?: RunGraphNode['agent'];
+}) | (Reached & {
+    readonly kind: 'check';
+    readonly verification?: {
+        readonly id: string;
+        readonly attempt: number;
+        readonly status: 'waiting' | 'completed' | 'failed' | 'canceled';
+        readonly leased: boolean;
+        readonly failureSummary?: string;
+    };
+    /** Every check passed or already failed on the baseline. */
+    readonly passed?: boolean;
+}) | (Reached & {
+    readonly kind: 'question';
+    readonly question?: Question['status'];
+}) | (Reached & {
+    readonly kind: 'child';
+    readonly child?: RunGraphNode['child'];
+}) | (Reached & {
+    readonly kind: 'wait';
+}) | {
+    readonly kind: 'activity';
+    readonly id: string;
+    readonly name: string;
+    readonly recordedAt: string;
+    readonly ok: boolean;
+};
+/**
+ * Groups nodes into columns in order of start: a node starts a new column when it starts after every node in the
+ * current column has ended, and otherwise joins it.
+ */
+export declare const runGraphColumns: <Node extends {
+    readonly startedAt: string;
+    readonly endedAt?: string;
+}>(nodes: readonly Node[]) => Node[][];
+export type TaskBlock = {
+    readonly blocking: string;
+    readonly blocked: string;
+};
+/** The Run graph: every Step the Run reached, in columns, and which Child Runs need which (ADR-0072). */
+export declare const runGraph: (run: Pick<Run, 'status'>, steps: readonly RunGraphStep[], blocks?: readonly TaskBlock[]) => RunGraph;
+/** One status per column, the worst in it, for a Run row's mini graph (ADR-0072). */
+export declare const runMiniGraph: (graph: Pick<RunGraph, 'columns'>) => RunDisplayState[];
+export {};

package/types/packages/core/src/run-journal.d.ts

@@ -0,0 +1,28 @@
+import * as Effect from 'effect/Effect';
+import * as Exit from 'effect/Exit';
+import * as Schema from 'effect/Schema';
+/** The largest encoded journal entry Kitman stores; larger content belongs in a Run artifact. */
+export declare const journalEntryMaxBytes: number;
+export declare const encodeJournalExit: (exit: Exit.Exit<unknown, unknown>) => Effect.Effect<Schema.Json, Schema.SchemaError, never>;
+export declare const decodeJournalExit: (input: unknown, options?: import("effect/SchemaAST").ParseOptions) => Effect.Effect<Exit.Exit<Schema.Json, Schema.Json>, Schema.SchemaError, never>;
+/** How a deferred resolved by Kitman (an answer, a fired clock) is written to the journal. */
+export declare const journalSuccess: (value: Schema.Json) => Schema.Json;
+/** The SDK's Step failure as the journal holds it, for a Step Kitman fails on a program's behalf. */
+export declare const JournalStepFailed: Schema.TaggedStruct<"StepFailed", {
+    readonly step: Schema.String;
+    readonly reason: Schema.String;
+}>;
+/** The SDK's Child Run failure as the journal holds it. */
+export declare const JournalChildFailed: Schema.TaggedStruct<"ChildFailed", {
+    readonly step: Schema.String;
+    readonly loop: Schema.String;
+    readonly reason: Schema.String;
+}>;
+/** The SDK's `waitFor` timeout as the journal holds it. */
+export declare const JournalWaitTimedOut: Schema.TaggedStruct<"WaitTimedOut", {
+    readonly step: Schema.String;
+    readonly event: Schema.String;
+}>;
+/** A deferred Kitman fails, with the deferred's error already encoded as JSON. */
+export declare const journalFailure: (error: Schema.Json) => Schema.Json;
+export declare const journalEntryBytes: (entry: Schema.Json) => number;

package/types/packages/core/src/run-launch.d.ts

@@ -0,0 +1,82 @@
+import type { JsonObject } from './runtime-type';
+export type LaunchOutcome = 'feature' | 'bug' | 'refactor' | 'investigation' | 'docs' | 'migration' | 'performance';
+/** Where and how a developer launched: their checkout, and the words they typed. */
+export type LaunchContext = {
+    /** The Team the request names; it wins over the repository's. */
+    readonly teamId?: string;
+    readonly remoteUrl?: string;
+    /** A repository chosen outright, as the web's New run form does. */
+    readonly repoBindingId?: string;
+    readonly branch?: string;
+    readonly words?: string;
+    /** A Task key in the words is text, as New run from words means them. */
+    readonly plainWords?: boolean;
+};
+/** What the control plane knows that a launch may point at. */
+export type LaunchCandidates = {
+    readonly repositories: readonly {
+        readonly repoBindingId: string;
+        readonly teamId: string | null;
+        readonly repositoryUrl: string;
+    }[];
+    /** Open ChangeRequests in those repositories. */
+    readonly changeRequests: readonly {
+        readonly id: string;
+        readonly repoBindingId: string;
+        readonly number?: number;
+        readonly sourceBranch?: string;
+    }[];
+};
+/** A Task's open ChangeRequest, as a launch names it to a person. */
+export type LaunchChangeRequest = {
+    readonly id: string;
+    readonly title: string;
+    readonly url: string;
+    readonly repoBindingId: string;
+};
+export type LaunchTask = {
+    readonly kind: 'tracker';
+    readonly key: string;
+} | {
+    readonly kind: 'words';
+    readonly words: string;
+};
+export type InferredLaunch = {
+    readonly teamId?: string;
+    readonly repoBindingId?: string;
+    readonly branch?: string;
+    readonly changeRequestId?: string;
+    /** The Task's open ChangeRequests, when the Loop needs one and only a person can say which. */
+    readonly changeRequestChoices?: readonly LaunchChangeRequest[];
+    readonly trackerKeys: readonly string[];
+    readonly task?: LaunchTask;
+    readonly outcome?: LaunchOutcome;
+    /** Loop Input fields; `taskId` is left to whoever makes the Task. */
+    readonly input: JsonObject;
+    /** Required Loop Input fields nothing filled. */
+    readonly missing: readonly string[];
+};
+/** host/owner/name of a git remote, so SSH and HTTPS remotes of one repository match. */
+export declare const repositoryKey: (url: string) => string;
+/** A Loop Input JSON Schema's top-level fields, behind a `$ref` if it has one. */
+export declare const launchInputSchema: (schema: JsonObject) => {
+    properties: JsonObject;
+    required: any[];
+};
+/**
+ * What a launch means: the Team, repository, branch, open ChangeRequest, Task and Outcome its context points at,
+ * and the Loop Input they fill. The words fill a `words` field, or else the one required text field left other than
+ * `taskId` and `changeRequestId`. A Loop that requires a ChangeRequest the launch does not point at takes the Task's
+ * only open one.
+ */
+export declare const inferLaunch: (launch: {
+    readonly context: LaunchContext;
+    readonly loop: {
+        readonly input: JsonObject;
+        readonly outcome?: LaunchOutcome;
+    };
+    readonly candidates: LaunchCandidates;
+    /** The open ChangeRequests of the Task the launch is for. */
+    readonly taskChangeRequests?: readonly LaunchChangeRequest[];
+    readonly given?: JsonObject;
+}) => InferredLaunch;

package/types/packages/core/src/runner-eligibility.d.ts

@@ -0,0 +1,62 @@
+import type { HarnessHoldReason, SkippedChoice } from './loop';
+import type { AgentChoice } from './loop-layers';
+import { type Runner, type RunnerCapabilities } from './runner';
+import type { RunnerExecutionRouting } from './runner-routing';
+export declare const RunnerEligibilityReasonCodes: readonly ['workspace_mismatch', 'team_access_denied', 'personal_owner_attribution_required', 'personal_owner_team_access_denied', 'agent_identity_authority_missing', 'foreground_target_required', 'foreground_target_mismatch', 'foreground_target_not_personal', 'runner_requirements_mismatch', 'runner_replica_unavailable'];
+export type RunnerEligibilityReasonCode = (typeof RunnerEligibilityReasonCodes)[number];
+export type RunnerSchedulingAuthority = {
+    readonly kind: 'direct_human';
+    readonly userId: string;
+} | {
+    readonly kind: 'durable_delegation';
+    readonly ownerUserId: string;
+    readonly delegationId: string;
+} | {
+    readonly kind: 'agent';
+    readonly agentIdentityId: string;
+} | {
+    readonly kind: 'system';
+};
+export interface RunnerEligibilityInput {
+    readonly runner: Runner;
+    readonly workspaceId: string;
+    readonly teamId: string;
+    readonly schedulingAuthority: RunnerSchedulingAuthority;
+    readonly routing?: RunnerExecutionRouting;
+    readonly ownerHasTeamAccess: boolean;
+    readonly agentIdentityAuthorized: boolean;
+    readonly requirementsMatch: boolean;
+    readonly replicaReady: boolean;
+}
+export interface RunnerEligibilityResult {
+    readonly eligible: boolean;
+    readonly reasons: readonly RunnerEligibilityReasonCode[];
+}
+/**
+ * The only scope/authority predicate used by runner admission callers.
+ * Inputs such as labels, claimed Team IDs, or runner metadata are
+ * deliberately absent; callers must resolve them from trusted control-plane
+ * state before invoking this function.
+ */
+export declare function evaluateRunnerEligibility(input: RunnerEligibilityInput): RunnerEligibilityResult;
+/** A (harness, model) this Runner cannot run until `until`, or, with no `until`, that this Step passes over. */
+export type RunnerHarnessHold = {
+    readonly harness: string;
+    readonly model: string;
+    readonly reason: HarnessHoldReason;
+    readonly until?: string;
+};
+/** The owner's choice while the Runner offers it, else the first offered of Pi, Claude Code and Codex. */
+export declare function runnerDefaultHarness(harnesses: readonly string[], chosen: string | undefined): string | undefined;
+/**
+ * The first choice this Runner offers, with its Harness resolved, and the choices before it as skipped; undefined when
+ * it offers none, so the Step is not this Runner's.
+ */
+export declare function offeredChoice(capabilities: Pick<RunnerCapabilities, 'harnesses' | 'defaultHarness'>, choices: readonly AgentChoice[], 
+/** The Runner's live Harness Holds; a held choice is skipped. `model` is `''` for the Harness's own. */
+holds?: readonly RunnerHarnessHold[]): {
+    readonly choice: AgentChoice & {
+        readonly harness: string;
+    };
+    readonly skipped: readonly SkippedChoice[];
+} | undefined;

package/types/packages/core/src/runner-routing.d.ts

@@ -0,0 +1,11 @@
+import * as Schema from 'effect/Schema';
+export declare const RunnerExecutionRouting: Schema.Union<readonly [Schema.Struct<{
+    readonly mode: Schema.Literal<"background">;
+    readonly requestedByUserId: Schema.optionalKey<Schema.String>;
+}>, Schema.Struct<{
+    readonly mode: Schema.Literal<"foreground">;
+    readonly requestedByUserId: Schema.String;
+    readonly targetPersonalRunnerId: Schema.String;
+    readonly interaction: Schema.Literal<"observable">;
+}>]>;
+export type RunnerExecutionRouting = (typeof RunnerExecutionRouting)['Type'];

package/types/packages/core/src/runner-trust.d.ts

@@ -0,0 +1,67 @@
+export declare const RunnerArchitecture: readonly ['amd64', 'arm64'];
+export type RunnerArchitecture = (typeof RunnerArchitecture)[number];
+declare const RunnerArtifactKinds: readonly ['host_package', 'oci_image'];
+type RunnerArtifactKind = (typeof RunnerArtifactKinds)[number];
+declare const RunnerArtifactTrustErrorCodes: readonly ['artifact_signature_invalid', 'artifact_sbom_invalid', 'artifact_provenance_invalid', 'artifact_expired', 'artifact_signed_in_future', 'artifact_architecture_mismatch', 'artifact_digest_not_allowed', 'artifact_profile_mismatch', 'artifact_sbom_mismatch', 'artifact_provenance_mismatch', 'artifact_metadata_rollback', 'artifact_metadata_expired', 'artifact_subject_mismatch', 'artifact_index_invalid'];
+type RunnerArtifactTrustErrorCode = (typeof RunnerArtifactTrustErrorCodes)[number];
+declare const RunnerArtifactTrustError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "RunnerArtifactTrustError";
+} & Readonly<A>;
+export declare class RunnerArtifactTrustError extends RunnerArtifactTrustError_base<{
+    readonly code: RunnerArtifactTrustErrorCode;
+    readonly message: string;
+}> {
+    constructor(code: RunnerArtifactTrustErrorCode);
+}
+export type RunnerArtifactManifest = {
+    readonly contractVersion: 'runner-trust-distribution.v1';
+    readonly artifactId: string;
+    readonly kind: RunnerArtifactKind;
+    readonly version: string;
+    readonly channel: string;
+    readonly architecture: RunnerArchitecture;
+    readonly platform: 'linux';
+    readonly subjectDigest: string;
+    readonly subjectLength: number;
+    readonly profileDigest: string;
+    readonly certificationDigest: string;
+    readonly sbomDigest: string;
+    readonly provenanceDigest: string;
+    readonly metadataVersion: number;
+    readonly rollbackFloor: number;
+    readonly signedAt: string;
+    readonly expiresAt: string;
+};
+type RunnerArtifactManifestInput = Omit<RunnerArtifactManifest, 'contractVersion' | 'kind' | 'platform' | 'signedAt' | 'expiresAt'> & {
+    readonly kind?: RunnerArtifactKind;
+    readonly platform?: 'linux';
+    readonly signedAt: Date | string;
+    readonly expiresAt: Date | string;
+};
+type RunnerArtifactVerificationResult = {
+    readonly ok: boolean;
+    readonly reasons: readonly RunnerArtifactTrustErrorCode[];
+};
+type RunnerOciManifest = {
+    readonly digest: string;
+    readonly size: number;
+    readonly platform: {
+        readonly os: 'linux';
+        readonly architecture: RunnerArchitecture;
+    };
+    readonly artifactDigest: string;
+};
+export type RunnerOciIndex = {
+    readonly schemaVersion: 2;
+    readonly mediaType: 'application/vnd.oci.image.index.v1+json';
+    readonly indexDigest: string;
+    readonly manifests: readonly RunnerOciManifest[];
+};
+export declare function createRunnerArtifactManifest(input: RunnerArtifactManifestInput): RunnerArtifactManifest;
+export declare function verifyRunnerOciIndex(index: RunnerOciIndex): RunnerArtifactVerificationResult;
+export declare function createRunnerOciIndex(artifacts: readonly RunnerArtifactManifest[], options?: {
+    readonly digest?: string;
+}): RunnerOciIndex;
+export declare function runnerCanonicalJson<ValueType>(value: ValueType): string;
+export declare function sha256(value: string): string;
+export {};