@scoutflo/topology-contracts 0.8.0 → 0.9.0

package/dist/src/provenance/runtimeContainer.d.ts

@@ -0,0 +1,431 @@
+import { z } from 'zod';
+export declare const RUNTIME_CONTAINER_PROVENANCE_VERSION = "runtime.container-provenance.v1";
+export declare const RUNTIME_CONTAINER_PROVENANCE_LIMITS: {
+    readonly containers: 128;
+    readonly name: 253;
+    readonly image: 2048;
+    readonly imageId: 2048;
+    readonly digest: 256;
+    readonly repository: 2048;
+    readonly commitSha: 64;
+    readonly reason: 512;
+};
+export declare const runtimeContainerKindSchema: z.ZodEnum<["regular", "init", "ephemeral"]>;
+export declare const runtimeIdentityStatusSchema: z.ZodEnum<["verified", "unverified", "unavailable"]>;
+export declare const runtimeConsistencyStatusSchema: z.ZodEnum<["consistent", "inconsistent", "unknown"]>;
+export declare const claimedSourceStatusSchema: z.ZodEnum<["unverified", "unavailable"]>;
+export declare const safeSourceRepositorySchema: z.ZodEffects<z.ZodString, string, string>;
+export declare const runtimeContainerProvenanceSchema: z.ZodEffects<z.ZodObject<{
+    name: z.ZodString;
+    kind: z.ZodEnum<["regular", "init", "ephemeral"]>;
+    scope: z.ZodOptional<z.ZodObject<{
+        namespace: z.ZodOptional<z.ZodString>;
+        workload_kind: z.ZodOptional<z.ZodString>;
+        workload_name: z.ZodOptional<z.ZodString>;
+        pod_name: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        namespace?: string | undefined;
+        workload_name?: string | undefined;
+        pod_name?: string | undefined;
+        workload_kind?: string | undefined;
+    }, {
+        namespace?: string | undefined;
+        workload_name?: string | undefined;
+        pod_name?: string | undefined;
+        workload_kind?: string | undefined;
+    }>>;
+    requested_image: z.ZodOptional<z.ZodString>;
+    observed_image: z.ZodOptional<z.ZodString>;
+    observed_image_id: z.ZodOptional<z.ZodString>;
+    digest: z.ZodOptional<z.ZodString>;
+    runtime_identity_status: z.ZodEnum<["verified", "unverified", "unavailable"]>;
+    runtime_identity_reason: z.ZodOptional<z.ZodString>;
+    consistency_status: z.ZodEnum<["consistent", "inconsistent", "unknown"]>;
+    consistency_reason: z.ZodOptional<z.ZodString>;
+    claimed_source: z.ZodOptional<z.ZodObject<{
+        repository: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+        commit_sha: z.ZodOptional<z.ZodString>;
+        scope: z.ZodLiteral<"pod_metadata">;
+        status: z.ZodEnum<["unverified", "unavailable"]>;
+        reason: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        status: "unavailable" | "unverified";
+        scope: "pod_metadata";
+        reason?: string | undefined;
+        repository?: string | undefined;
+        commit_sha?: string | undefined;
+    }, {
+        status: "unavailable" | "unverified";
+        scope: "pod_metadata";
+        reason?: string | undefined;
+        repository?: string | undefined;
+        commit_sha?: string | undefined;
+    }>>;
+}, "strict", z.ZodTypeAny, {
+    kind: "regular" | "init" | "ephemeral";
+    name: string;
+    runtime_identity_status: "unavailable" | "verified" | "unverified";
+    consistency_status: "unknown" | "consistent" | "inconsistent";
+    scope?: {
+        namespace?: string | undefined;
+        workload_name?: string | undefined;
+        pod_name?: string | undefined;
+        workload_kind?: string | undefined;
+    } | undefined;
+    requested_image?: string | undefined;
+    observed_image?: string | undefined;
+    observed_image_id?: string | undefined;
+    digest?: string | undefined;
+    runtime_identity_reason?: string | undefined;
+    consistency_reason?: string | undefined;
+    claimed_source?: {
+        status: "unavailable" | "unverified";
+        scope: "pod_metadata";
+        reason?: string | undefined;
+        repository?: string | undefined;
+        commit_sha?: string | undefined;
+    } | undefined;
+}, {
+    kind: "regular" | "init" | "ephemeral";
+    name: string;
+    runtime_identity_status: "unavailable" | "verified" | "unverified";
+    consistency_status: "unknown" | "consistent" | "inconsistent";
+    scope?: {
+        namespace?: string | undefined;
+        workload_name?: string | undefined;
+        pod_name?: string | undefined;
+        workload_kind?: string | undefined;
+    } | undefined;
+    requested_image?: string | undefined;
+    observed_image?: string | undefined;
+    observed_image_id?: string | undefined;
+    digest?: string | undefined;
+    runtime_identity_reason?: string | undefined;
+    consistency_reason?: string | undefined;
+    claimed_source?: {
+        status: "unavailable" | "unverified";
+        scope: "pod_metadata";
+        reason?: string | undefined;
+        repository?: string | undefined;
+        commit_sha?: string | undefined;
+    } | undefined;
+}>, {
+    kind: "regular" | "init" | "ephemeral";
+    name: string;
+    runtime_identity_status: "unavailable" | "verified" | "unverified";
+    consistency_status: "unknown" | "consistent" | "inconsistent";
+    scope?: {
+        namespace?: string | undefined;
+        workload_name?: string | undefined;
+        pod_name?: string | undefined;
+        workload_kind?: string | undefined;
+    } | undefined;
+    requested_image?: string | undefined;
+    observed_image?: string | undefined;
+    observed_image_id?: string | undefined;
+    digest?: string | undefined;
+    runtime_identity_reason?: string | undefined;
+    consistency_reason?: string | undefined;
+    claimed_source?: {
+        status: "unavailable" | "unverified";
+        scope: "pod_metadata";
+        reason?: string | undefined;
+        repository?: string | undefined;
+        commit_sha?: string | undefined;
+    } | undefined;
+}, {
+    kind: "regular" | "init" | "ephemeral";
+    name: string;
+    runtime_identity_status: "unavailable" | "verified" | "unverified";
+    consistency_status: "unknown" | "consistent" | "inconsistent";
+    scope?: {
+        namespace?: string | undefined;
+        workload_name?: string | undefined;
+        pod_name?: string | undefined;
+        workload_kind?: string | undefined;
+    } | undefined;
+    requested_image?: string | undefined;
+    observed_image?: string | undefined;
+    observed_image_id?: string | undefined;
+    digest?: string | undefined;
+    runtime_identity_reason?: string | undefined;
+    consistency_reason?: string | undefined;
+    claimed_source?: {
+        status: "unavailable" | "unverified";
+        scope: "pod_metadata";
+        reason?: string | undefined;
+        repository?: string | undefined;
+        commit_sha?: string | undefined;
+    } | undefined;
+}>;
+export declare const runtimeWorkloadProvenanceSchema: z.ZodEffects<z.ZodObject<{
+    version: z.ZodDefault<z.ZodLiteral<"runtime.container-provenance.v1">>;
+    containers: z.ZodArray<z.ZodEffects<z.ZodObject<{
+        name: z.ZodString;
+        kind: z.ZodEnum<["regular", "init", "ephemeral"]>;
+        scope: z.ZodOptional<z.ZodObject<{
+            namespace: z.ZodOptional<z.ZodString>;
+            workload_kind: z.ZodOptional<z.ZodString>;
+            workload_name: z.ZodOptional<z.ZodString>;
+            pod_name: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            namespace?: string | undefined;
+            workload_name?: string | undefined;
+            pod_name?: string | undefined;
+            workload_kind?: string | undefined;
+        }, {
+            namespace?: string | undefined;
+            workload_name?: string | undefined;
+            pod_name?: string | undefined;
+            workload_kind?: string | undefined;
+        }>>;
+        requested_image: z.ZodOptional<z.ZodString>;
+        observed_image: z.ZodOptional<z.ZodString>;
+        observed_image_id: z.ZodOptional<z.ZodString>;
+        digest: z.ZodOptional<z.ZodString>;
+        runtime_identity_status: z.ZodEnum<["verified", "unverified", "unavailable"]>;
+        runtime_identity_reason: z.ZodOptional<z.ZodString>;
+        consistency_status: z.ZodEnum<["consistent", "inconsistent", "unknown"]>;
+        consistency_reason: z.ZodOptional<z.ZodString>;
+        claimed_source: z.ZodOptional<z.ZodObject<{
+            repository: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+            commit_sha: z.ZodOptional<z.ZodString>;
+            scope: z.ZodLiteral<"pod_metadata">;
+            status: z.ZodEnum<["unverified", "unavailable"]>;
+            reason: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            status: "unavailable" | "unverified";
+            scope: "pod_metadata";
+            reason?: string | undefined;
+            repository?: string | undefined;
+            commit_sha?: string | undefined;
+        }, {
+            status: "unavailable" | "unverified";
+            scope: "pod_metadata";
+            reason?: string | undefined;
+            repository?: string | undefined;
+            commit_sha?: string | undefined;
+        }>>;
+    }, "strict", z.ZodTypeAny, {
+        kind: "regular" | "init" | "ephemeral";
+        name: string;
+        runtime_identity_status: "unavailable" | "verified" | "unverified";
+        consistency_status: "unknown" | "consistent" | "inconsistent";
+        scope?: {
+            namespace?: string | undefined;
+            workload_name?: string | undefined;
+            pod_name?: string | undefined;
+            workload_kind?: string | undefined;
+        } | undefined;
+        requested_image?: string | undefined;
+        observed_image?: string | undefined;
+        observed_image_id?: string | undefined;
+        digest?: string | undefined;
+        runtime_identity_reason?: string | undefined;
+        consistency_reason?: string | undefined;
+        claimed_source?: {
+            status: "unavailable" | "unverified";
+            scope: "pod_metadata";
+            reason?: string | undefined;
+            repository?: string | undefined;
+            commit_sha?: string | undefined;
+        } | undefined;
+    }, {
+        kind: "regular" | "init" | "ephemeral";
+        name: string;
+        runtime_identity_status: "unavailable" | "verified" | "unverified";
+        consistency_status: "unknown" | "consistent" | "inconsistent";
+        scope?: {
+            namespace?: string | undefined;
+            workload_name?: string | undefined;
+            pod_name?: string | undefined;
+            workload_kind?: string | undefined;
+        } | undefined;
+        requested_image?: string | undefined;
+        observed_image?: string | undefined;
+        observed_image_id?: string | undefined;
+        digest?: string | undefined;
+        runtime_identity_reason?: string | undefined;
+        consistency_reason?: string | undefined;
+        claimed_source?: {
+            status: "unavailable" | "unverified";
+            scope: "pod_metadata";
+            reason?: string | undefined;
+            repository?: string | undefined;
+            commit_sha?: string | undefined;
+        } | undefined;
+    }>, {
+        kind: "regular" | "init" | "ephemeral";
+        name: string;
+        runtime_identity_status: "unavailable" | "verified" | "unverified";
+        consistency_status: "unknown" | "consistent" | "inconsistent";
+        scope?: {
+            namespace?: string | undefined;
+            workload_name?: string | undefined;
+            pod_name?: string | undefined;
+            workload_kind?: string | undefined;
+        } | undefined;
+        requested_image?: string | undefined;
+        observed_image?: string | undefined;
+        observed_image_id?: string | undefined;
+        digest?: string | undefined;
+        runtime_identity_reason?: string | undefined;
+        consistency_reason?: string | undefined;
+        claimed_source?: {
+            status: "unavailable" | "unverified";
+            scope: "pod_metadata";
+            reason?: string | undefined;
+            repository?: string | undefined;
+            commit_sha?: string | undefined;
+        } | undefined;
+    }, {
+        kind: "regular" | "init" | "ephemeral";
+        name: string;
+        runtime_identity_status: "unavailable" | "verified" | "unverified";
+        consistency_status: "unknown" | "consistent" | "inconsistent";
+        scope?: {
+            namespace?: string | undefined;
+            workload_name?: string | undefined;
+            pod_name?: string | undefined;
+            workload_kind?: string | undefined;
+        } | undefined;
+        requested_image?: string | undefined;
+        observed_image?: string | undefined;
+        observed_image_id?: string | undefined;
+        digest?: string | undefined;
+        runtime_identity_reason?: string | undefined;
+        consistency_reason?: string | undefined;
+        claimed_source?: {
+            status: "unavailable" | "unverified";
+            scope: "pod_metadata";
+            reason?: string | undefined;
+            repository?: string | undefined;
+            commit_sha?: string | undefined;
+        } | undefined;
+    }>, "many">;
+    truncated: z.ZodBoolean;
+    reason: z.ZodOptional<z.ZodLiteral<"container_limit_exceeded">>;
+    containers_omitted: z.ZodOptional<z.ZodNumber>;
+}, "strict", z.ZodTypeAny, {
+    version: "runtime.container-provenance.v1";
+    truncated: boolean;
+    containers: {
+        kind: "regular" | "init" | "ephemeral";
+        name: string;
+        runtime_identity_status: "unavailable" | "verified" | "unverified";
+        consistency_status: "unknown" | "consistent" | "inconsistent";
+        scope?: {
+            namespace?: string | undefined;
+            workload_name?: string | undefined;
+            pod_name?: string | undefined;
+            workload_kind?: string | undefined;
+        } | undefined;
+        requested_image?: string | undefined;
+        observed_image?: string | undefined;
+        observed_image_id?: string | undefined;
+        digest?: string | undefined;
+        runtime_identity_reason?: string | undefined;
+        consistency_reason?: string | undefined;
+        claimed_source?: {
+            status: "unavailable" | "unverified";
+            scope: "pod_metadata";
+            reason?: string | undefined;
+            repository?: string | undefined;
+            commit_sha?: string | undefined;
+        } | undefined;
+    }[];
+    reason?: "container_limit_exceeded" | undefined;
+    containers_omitted?: number | undefined;
+}, {
+    truncated: boolean;
+    containers: {
+        kind: "regular" | "init" | "ephemeral";
+        name: string;
+        runtime_identity_status: "unavailable" | "verified" | "unverified";
+        consistency_status: "unknown" | "consistent" | "inconsistent";
+        scope?: {
+            namespace?: string | undefined;
+            workload_name?: string | undefined;
+            pod_name?: string | undefined;
+            workload_kind?: string | undefined;
+        } | undefined;
+        requested_image?: string | undefined;
+        observed_image?: string | undefined;
+        observed_image_id?: string | undefined;
+        digest?: string | undefined;
+        runtime_identity_reason?: string | undefined;
+        consistency_reason?: string | undefined;
+        claimed_source?: {
+            status: "unavailable" | "unverified";
+            scope: "pod_metadata";
+            reason?: string | undefined;
+            repository?: string | undefined;
+            commit_sha?: string | undefined;
+        } | undefined;
+    }[];
+    version?: "runtime.container-provenance.v1" | undefined;
+    reason?: "container_limit_exceeded" | undefined;
+    containers_omitted?: number | undefined;
+}>, {
+    version: "runtime.container-provenance.v1";
+    truncated: boolean;
+    containers: {
+        kind: "regular" | "init" | "ephemeral";
+        name: string;
+        runtime_identity_status: "unavailable" | "verified" | "unverified";
+        consistency_status: "unknown" | "consistent" | "inconsistent";
+        scope?: {
+            namespace?: string | undefined;
+            workload_name?: string | undefined;
+            pod_name?: string | undefined;
+            workload_kind?: string | undefined;
+        } | undefined;
+        requested_image?: string | undefined;
+        observed_image?: string | undefined;
+        observed_image_id?: string | undefined;
+        digest?: string | undefined;
+        runtime_identity_reason?: string | undefined;
+        consistency_reason?: string | undefined;
+        claimed_source?: {
+            status: "unavailable" | "unverified";
+            scope: "pod_metadata";
+            reason?: string | undefined;
+            repository?: string | undefined;
+            commit_sha?: string | undefined;
+        } | undefined;
+    }[];
+    reason?: "container_limit_exceeded" | undefined;
+    containers_omitted?: number | undefined;
+}, {
+    truncated: boolean;
+    containers: {
+        kind: "regular" | "init" | "ephemeral";
+        name: string;
+        runtime_identity_status: "unavailable" | "verified" | "unverified";
+        consistency_status: "unknown" | "consistent" | "inconsistent";
+        scope?: {
+            namespace?: string | undefined;
+            workload_name?: string | undefined;
+            pod_name?: string | undefined;
+            workload_kind?: string | undefined;
+        } | undefined;
+        requested_image?: string | undefined;
+        observed_image?: string | undefined;
+        observed_image_id?: string | undefined;
+        digest?: string | undefined;
+        runtime_identity_reason?: string | undefined;
+        consistency_reason?: string | undefined;
+        claimed_source?: {
+            status: "unavailable" | "unverified";
+            scope: "pod_metadata";
+            reason?: string | undefined;
+            repository?: string | undefined;
+            commit_sha?: string | undefined;
+        } | undefined;
+    }[];
+    version?: "runtime.container-provenance.v1" | undefined;
+    reason?: "container_limit_exceeded" | undefined;
+    containers_omitted?: number | undefined;
+}>;
+export type RuntimeContainerProvenance = Readonly<z.infer<typeof runtimeContainerProvenanceSchema>>;
+export type RuntimeWorkloadProvenance = Readonly<z.infer<typeof runtimeWorkloadProvenanceSchema>>;

package/dist/src/provenance/runtimeContainer.js

@@ -0,0 +1,139 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runtimeWorkloadProvenanceSchema = exports.runtimeContainerProvenanceSchema = exports.safeSourceRepositorySchema = exports.claimedSourceStatusSchema = exports.runtimeConsistencyStatusSchema = exports.runtimeIdentityStatusSchema = exports.runtimeContainerKindSchema = exports.RUNTIME_CONTAINER_PROVENANCE_LIMITS = exports.RUNTIME_CONTAINER_PROVENANCE_VERSION = void 0;
+const zod_1 = require("zod");
+exports.RUNTIME_CONTAINER_PROVENANCE_VERSION = 'runtime.container-provenance.v1';
+exports.RUNTIME_CONTAINER_PROVENANCE_LIMITS = {
+    containers: 128,
+    name: 253,
+    image: 2048,
+    imageId: 2048,
+    digest: 256,
+    repository: 2048,
+    commitSha: 64,
+    reason: 512,
+};
+const optionalReasonSchema = zod_1.z.string().min(1)
+    .max(exports.RUNTIME_CONTAINER_PROVENANCE_LIMITS.reason).optional();
+const imageDigestSchema = zod_1.z.string()
+    .max(exports.RUNTIME_CONTAINER_PROVENANCE_LIMITS.digest)
+    .regex(/^(sha256:[0-9a-f]{64}|sha384:[0-9a-f]{96}|sha512:[0-9a-f]{128})$/, 'digest must be a lowercase sha256, sha384, or sha512 digest with exact length');
+exports.runtimeContainerKindSchema = zod_1.z.enum(['regular', 'init', 'ephemeral']);
+exports.runtimeIdentityStatusSchema = zod_1.z.enum(['verified', 'unverified', 'unavailable']);
+exports.runtimeConsistencyStatusSchema = zod_1.z.enum(['consistent', 'inconsistent', 'unknown']);
+exports.claimedSourceStatusSchema = zod_1.z.enum(['unverified', 'unavailable']);
+exports.safeSourceRepositorySchema = zod_1.z.string()
+    .min(1)
+    .max(exports.RUNTIME_CONTAINER_PROVENANCE_LIMITS.repository)
+    .superRefine((repository, ctx) => {
+    let parsed;
+    try {
+        parsed = new URL(repository);
+    }
+    catch {
+        ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, message: 'repository must be an absolute HTTPS URL' });
+        return;
+    }
+    const hasRepositoryPath = parsed.pathname.split('/').some((segment) => segment.length > 0);
+    if (parsed.protocol !== 'https:'
+        || !parsed.hostname
+        || parsed.username
+        || parsed.password
+        || parsed.search
+        || parsed.hash
+        || !hasRepositoryPath) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            message: 'repository must be credential-free HTTPS with a non-root path and no query or fragment',
+        });
+    }
+});
+exports.runtimeContainerProvenanceSchema = zod_1.z.object({
+    name: zod_1.z.string().min(1).max(exports.RUNTIME_CONTAINER_PROVENANCE_LIMITS.name),
+    kind: exports.runtimeContainerKindSchema,
+    scope: zod_1.z.object({
+        namespace: zod_1.z.string().min(1).max(exports.RUNTIME_CONTAINER_PROVENANCE_LIMITS.name).optional(),
+        workload_kind: zod_1.z.string().min(1).max(exports.RUNTIME_CONTAINER_PROVENANCE_LIMITS.name).optional(),
+        workload_name: zod_1.z.string().min(1).max(exports.RUNTIME_CONTAINER_PROVENANCE_LIMITS.name).optional(),
+        pod_name: zod_1.z.string().min(1).max(exports.RUNTIME_CONTAINER_PROVENANCE_LIMITS.name).optional(),
+    }).strict().optional(),
+    requested_image: zod_1.z.string().min(1).max(exports.RUNTIME_CONTAINER_PROVENANCE_LIMITS.image).optional(),
+    observed_image: zod_1.z.string().min(1).max(exports.RUNTIME_CONTAINER_PROVENANCE_LIMITS.image).optional(),
+    observed_image_id: zod_1.z.string().min(1).max(exports.RUNTIME_CONTAINER_PROVENANCE_LIMITS.imageId).optional(),
+    digest: imageDigestSchema.optional(),
+    runtime_identity_status: exports.runtimeIdentityStatusSchema,
+    runtime_identity_reason: optionalReasonSchema,
+    consistency_status: exports.runtimeConsistencyStatusSchema,
+    consistency_reason: optionalReasonSchema,
+    claimed_source: zod_1.z.object({
+        repository: exports.safeSourceRepositorySchema.optional(),
+        commit_sha: zod_1.z.string()
+            .regex(/^[0-9a-fA-F]{40}([0-9a-fA-F]{24})?$/, 'commit_sha must be a full SHA-1 or SHA-256')
+            .optional(),
+        scope: zod_1.z.literal('pod_metadata'),
+        status: exports.claimedSourceStatusSchema,
+        reason: optionalReasonSchema,
+    }).strict().optional(),
+}).strict().superRefine((container, ctx) => {
+    if (container.runtime_identity_status === 'verified' && !container.digest) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['digest'],
+            message: 'a valid digest is required when runtime_identity_status is verified',
+        });
+    }
+    if (container.runtime_identity_status !== 'verified' && !container.runtime_identity_reason) {
+        ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, path: ['runtime_identity_reason'], message: 'a reason is required when runtime identity is not verified' });
+    }
+    if (container.consistency_status !== 'consistent' && !container.consistency_reason) {
+        ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, path: ['consistency_reason'], message: 'a reason is required when consistency is not confirmed' });
+    }
+    const claim = container.claimed_source;
+    if (claim?.status === 'unverified' && (!claim.repository || !claim.commit_sha || !claim.reason)) {
+        ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, path: ['claimed_source'], message: 'unverified claimed source requires repository, full commit_sha, and reason' });
+    }
+    if (claim?.status === 'unavailable' && (claim.repository || claim.commit_sha || !claim.reason)) {
+        ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, path: ['claimed_source'], message: 'unavailable claimed source requires reason and must not contain repository or commit_sha' });
+    }
+});
+exports.runtimeWorkloadProvenanceSchema = zod_1.z.object({
+    version: zod_1.z.literal(exports.RUNTIME_CONTAINER_PROVENANCE_VERSION)
+        .default(exports.RUNTIME_CONTAINER_PROVENANCE_VERSION),
+    containers: zod_1.z.array(exports.runtimeContainerProvenanceSchema)
+        .max(exports.RUNTIME_CONTAINER_PROVENANCE_LIMITS.containers),
+    truncated: zod_1.z.boolean(),
+    reason: zod_1.z.literal('container_limit_exceeded').optional(),
+    containers_omitted: zod_1.z.number().int().min(1).optional(),
+}).strict().superRefine((provenance, ctx) => {
+    if (provenance.truncated && provenance.reason !== 'container_limit_exceeded') {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['reason'],
+            message: 'reason must be container_limit_exceeded when truncated is true',
+        });
+    }
+    if (!provenance.truncated && (provenance.reason || provenance.containers_omitted)) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['truncated'],
+            message: 'truncation metadata is only valid when truncated is true',
+        });
+    }
+    const order = { regular: 0, init: 1, ephemeral: 2 };
+    for (let index = 1; index < provenance.containers.length; index += 1) {
+        const previous = provenance.containers[index - 1];
+        const current = provenance.containers[index];
+        if (!previous || !current)
+            continue;
+        const outOfOrder = order[previous.kind] > order[current.kind]
+            || (previous.kind === current.kind && previous.name.localeCompare(current.name) > 0);
+        if (outOfOrder) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                path: ['containers', index],
+                message: 'containers must be sorted by regular/init/ephemeral kind, then name',
+            });
+        }
+    }
+});
+//# sourceMappingURL=runtimeContainer.js.map

package/dist/src/provenance/runtimeContainer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtimeContainer.js","sourceRoot":"","sources":["../../../src/provenance/runtimeContainer.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAEX,QAAA,oCAAoC,GAAG,iCAAiC,CAAC;AACzE,QAAA,mCAAmC,GAAG;IACjD,UAAU,EAAE,GAAG;IACf,IAAI,EAAE,GAAG;IACT,KAAK,EAAE,IAAI;IACX,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,GAAG;IACX,UAAU,EAAE,IAAI;IAChB,SAAS,EAAE,EAAE;IACb,MAAM,EAAE,GAAG;CACH,CAAC;AAEX,MAAM,oBAAoB,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC3C,GAAG,CAAC,2CAAmC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC9D,MAAM,iBAAiB,GAAG,OAAC,CAAC,MAAM,EAAE;KACjC,GAAG,CAAC,2CAAmC,CAAC,MAAM,CAAC;KAC/C,KAAK,CACJ,kEAAkE,EAClE,+EAA+E,CAChF,CAAC;AAES,QAAA,0BAA0B,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AACtE,QAAA,2BAA2B,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC;AAChF,QAAA,8BAA8B,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC;AACnF,QAAA,yBAAyB,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC;AAElE,QAAA,0BAA0B,GAAG,OAAC,CAAC,MAAM,EAAE;KACjD,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,2CAAmC,CAAC,UAAU,CAAC;KACnD,WAAW,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE;IAC/B,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC,CAAC;QACnG,OAAO;IACT,CAAC;IACD,MAAM,iBAAiB,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3F,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;WAC3B,CAAC,MAAM,CAAC,QAAQ;WAChB,MAAM,CAAC,QAAQ;WACf,MAAM,CAAC,QAAQ;WACf,MAAM,CAAC,MAAM;WACb,MAAM,CAAC,IAAI;WACX,CAAC,iBAAiB,EAAE,CAAC;QACxB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,wFAAwF;SAClG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEQ,QAAA,gCAAgC,GAAG,OAAC,CAAC,MAAM,CAAC;IACvD,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,2CAAmC,CAAC,IAAI,CAAC;IACrE,IAAI,EAAE,kCAA0B;IAChC,KAAK,EAAE,OAAC,CAAC,MAAM,CAAC;QACd,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,2CAAmC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;QACrF,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,2CAAmC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;QACzF,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,2CAAmC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;QACzF,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,2CAAmC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;KACrF,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtB,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,2CAAmC,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IAC5F,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,2CAAmC,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IAC3F,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,2CAAmC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;IAChG,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE;IACpC,uBAAuB,EAAE,mCAA2B;IACpD,uBAAuB,EAAE,oBAAoB;IAC7C,kBAAkB,EAAE,sCAA8B;IAClD,kBAAkB,EAAE,oBAAoB;IACxC,cAAc,EAAE,OAAC,CAAC,MAAM,CAAC;QACvB,UAAU,EAAE,kCAA0B,CAAC,QAAQ,EAAE;QACjD,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE;aACnB,KAAK,CAAC,qCAAqC,EAAE,4CAA4C,CAAC;aAC1F,QAAQ,EAAE;QACb,KAAK,EAAE,OAAC,CAAC,OAAO,CAAC,cAAc,CAAC;QAChC,MAAM,EAAE,iCAAyB;QACjC,MAAM,EAAE,oBAAoB;KAC7B,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvB,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE;IACzC,IAAI,SAAS,CAAC,uBAAuB,KAAK,UAAU,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC1E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,OAAO,EAAE,qEAAqE;SAC/E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,SAAS,CAAC,uBAAuB,KAAK,UAAU,IAAI,CAAC,SAAS,CAAC,uBAAuB,EAAE,CAAC;QAC3F,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,yBAAyB,CAAC,EAAE,OAAO,EAAE,4DAA4D,EAAE,CAAC,CAAC;IAC1J,CAAC;IACD,IAAI,SAAS,CAAC,kBAAkB,KAAK,YAAY,IAAI,CAAC,SAAS,CAAC,kBAAkB,EAAE,CAAC;QACnF,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC,CAAC;IACjJ,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,cAAc,CAAC;IACvC,IAAI,KAAK,EAAE,MAAM,KAAK,YAAY,IAAI,CAAC,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAChG,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,4EAA4E,EAAE,CAAC,CAAC;IACjK,CAAC;IACD,IAAI,KAAK,EAAE,MAAM,KAAK,aAAa,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/F,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,0FAA0F,EAAE,CAAC,CAAC;IAC/K,CAAC;AACH,CAAC,CAAC,CAAC;AAEU,QAAA,+BAA+B,GAAG,OAAC,CAAC,MAAM,CAAC;IACtD,OAAO,EAAE,OAAC,CAAC,OAAO,CAAC,4CAAoC,CAAC;SACrD,OAAO,CAAC,4CAAoC,CAAC;IAChD,UAAU,EAAE,OAAC,CAAC,KAAK,CAAC,wCAAgC,CAAC;SAClD,GAAG,CAAC,2CAAmC,CAAC,UAAU,CAAC;IACtD,SAAS,EAAE,OAAC,CAAC,OAAO,EAAE;IACtB,MAAM,EAAE,OAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,QAAQ,EAAE;IACxD,kBAAkB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE;IAC1C,IAAI,UAAU,CAAC,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,0BAA0B,EAAE,CAAC;QAC7E,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,OAAO,EAAE,gEAAgE;SAC1E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,0DAA0D;SACpE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAW,CAAC;IAC7D,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO;YAAE,SAAS;QACpC,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;eACxD,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACvF,IAAI,UAAU,EAAE,CAAC;YACf,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;gBAC3B,OAAO,EAAE,qEAAqE;aAC/E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/src/schemas/index.d.ts

@@ -4,4 +4,5 @@ export { sourceSyncCapabilitySchema, sourceSyncPartialScopeApplySchema, topology
 export { topologyCorrelationApplyPolicySchema, topologyCorrelationContractFamilySchema, topologyCorrelationContractKeySchema, topologyCorrelationContractRefSchema, topologyCorrelationContractVersionSchema, topologyCorrelationEndpointSpecSchema, topologyCorrelationRelationClassSchema, topologyCorrelationRequiredEndpointSchema, topologyCorrelationRuleMetadataSchema, topologyCorrelationDecisionSchema, topologyCorrelationCandidateSchema, topologyCorrelationSyncVersionSchema, topologyCorrelationApiDecisionSchema, topologyCorrelationApiWarningSchema, topologyCorrelationApiEvidenceRefSchema, topologyCorrelationApiEndpointSchema, topologyCorrelationApiCandidateSchema, topologyCorrelationApiFindingSchema, topologyCorrelationApiRefreshSchema, topologyCorrelationApiDiffSummarySchema, topologyCorrelationApiDiffSchema, topologyCorrelationApiInputScopeSchema, topologyCorrelationApiUnitSpecSchema, topologyCorrelationApiUnitResultSchema, topologyCorrelationDryRunUnitSchema, topologyCorrelationDryRunOptionsSchema, topologyCorrelationDryRunRequestSchema, topologyCorrelationDryRunSummarySchema, topologyCorrelationDryRunResponseSchema, topologyCorrelationApplyRequestSchema, topologyCorrelationApplyUnitSchema, topologyCorrelationApplySummarySchema, topologyCorrelationApplyResponseSchema, } from '../correlation';
 export { topologyResourceTypeSchema, topologyRelationTypeSchema, } from '../topology';
 export { credentialSourceEntityTypeSchema, credentialResolutionModeSchema, credentialSourceAccessRefSchema, credentialSourceResultItemSchema, credentialSourceSingleResponseSchema, credentialSourceBulkRequestSchema, credentialSourceBulkResponseSchema, topologyApiErrorCodeSchema, topologyApiErrorEnvelopeSchema, } from '../credential-source';
-export { diagnosticCriticalitySchema, nestedTopologyTruncationReasonSchema, nestedTopologyEvidenceSchema, nestedTopologyRelationshipSchema, nestedTopologyNodeSchema, nestedTopologyChildSchema, nestedTopologyLimitsSchema, nestedTopologyStatsSchema, nestedTopologyTruncationSchema, nestedTopologyResponseSchema, topologyReasonCodeSchema, topologyCandidateTargetSchema, topologyPrimaryAnchorSchema, topologyInitializationStateSchema, targetServiceInfoSchema, investigationResourceSchema, relatedServiceInfoSchema, topologyInvestigationContextSchema, topologyBindingHintSchema, topologyBindingHintsSchema, gatewayTopologyContextSchema, } from '../investigation';
+export { diagnosticCriticalitySchema, nestedTopologyTruncationReasonSchema, nestedTopologyEvidenceSchema, nestedTopologyRelationshipSchema, nestedTopologyLimitsSchema, nestedTopologyStatsSchema, nestedTopologyTruncationSchema, nestedTopologyResponseSchema, topologyReasonCodeSchema, topologyCandidateTargetSchema, topologyPrimaryAnchorSchema, topologyInitializationStateSchema, targetServiceInfoSchema, investigationResourceSchema, relatedServiceInfoSchema, topologyInvestigationContextSchema, topologyBindingHintSchema, topologyBindingHintsSchema, topologyProjectionCompatibilitySchema, gatewayTopologyDiagnosticsSchema, gatewayTopologyContextSchema, } from '../investigation';
+export { runtimeContainerKindSchema, runtimeIdentityStatusSchema, runtimeConsistencyStatusSchema, claimedSourceStatusSchema, safeSourceRepositorySchema, runtimeContainerProvenanceSchema, runtimeWorkloadProvenanceSchema, } from '../provenance';

package/dist/src/schemas/index.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.topologyCorrelationApiDecisionSchema = exports.topologyCorrelationSyncVersionSchema = exports.topologyCorrelationCandidateSchema = exports.topologyCorrelationDecisionSchema = exports.topologyCorrelationRuleMetadataSchema = exports.topologyCorrelationRequiredEndpointSchema = exports.topologyCorrelationRelationClassSchema = exports.topologyCorrelationEndpointSpecSchema = exports.topologyCorrelationContractVersionSchema = exports.topologyCorrelationContractRefSchema = exports.topologyCorrelationContractKeySchema = exports.topologyCorrelationContractFamilySchema = exports.topologyCorrelationApplyPolicySchema = exports.sourceSyncBatchUnitsResponseSchema = exports.sourceSyncBatchResponseSchema = exports.sourceSyncApplyResponseSchema = exports.sourceSyncApplyRequestSchema = exports.sourceSyncApplySelectionSchema = exports.sourceSyncDryRunResponseSchema = exports.sourceSyncDuplicateSchema = exports.sourceSyncErrorSchema = exports.sourceSyncDryRunSourceResultSchema = exports.sourceSyncSourceSummarySchema = exports.sourceSyncJobSchema = exports.sourceSyncRecordSchema = exports.sourceSyncCapabilitiesResponseSchema = exports.sourceSyncUnitStatusSchema = exports.topologySourceRelationshipCandidateSchema = exports.topologyExistingEntityRefSchema = exports.topologySourceNodeCandidateSchema = exports.topologyAccessRefCandidateSchema = exports.topologyEntitySourceRefCandidateSchema = exports.topologySourceRefStatusSchema = exports.topologySyncWarningSchema = exports.topologySyncWarningSeveritySchema = exports.topologySyncCompletenessSchema = exports.topologySyncCompletenessStatusSchema = exports.topologySyncScopeSchema = exports.topologySyncIntentSchema = exports.topologySyncIntentOptionsSchema = exports.topologySourceIntentSchema = exports.topologySourceIntentIncludeSchema = exports.sourceSyncPartialScopeApplySchema = exports.sourceSyncCapabilitySchema = exports.topologyFamilySchema = exports.integrationTopologyFamilySchema = exports.kubernetesTopologyFamilySchema = exports.awsTopologyFamilySchema = exports.topologyProviderInputSchema = exports.topologyProviderSchema = void 0;
-exports.topologyBindingHintSchema = exports.topologyInvestigationContextSchema = exports.relatedServiceInfoSchema = exports.investigationResourceSchema = exports.targetServiceInfoSchema = exports.topologyInitializationStateSchema = exports.topologyPrimaryAnchorSchema = exports.topologyCandidateTargetSchema = exports.topologyReasonCodeSchema = exports.nestedTopologyResponseSchema = exports.nestedTopologyTruncationSchema = exports.nestedTopologyStatsSchema = exports.nestedTopologyLimitsSchema = exports.nestedTopologyChildSchema = exports.nestedTopologyNodeSchema = exports.nestedTopologyRelationshipSchema = exports.nestedTopologyEvidenceSchema = exports.nestedTopologyTruncationReasonSchema = exports.diagnosticCriticalitySchema = exports.topologyApiErrorEnvelopeSchema = exports.topologyApiErrorCodeSchema = exports.credentialSourceBulkResponseSchema = exports.credentialSourceBulkRequestSchema = exports.credentialSourceSingleResponseSchema = exports.credentialSourceResultItemSchema = exports.credentialSourceAccessRefSchema = exports.credentialResolutionModeSchema = exports.credentialSourceEntityTypeSchema = exports.topologyRelationTypeSchema = exports.topologyResourceTypeSchema = exports.topologyCorrelationApplyResponseSchema = exports.topologyCorrelationApplySummarySchema = exports.topologyCorrelationApplyUnitSchema = exports.topologyCorrelationApplyRequestSchema = exports.topologyCorrelationDryRunResponseSchema = exports.topologyCorrelationDryRunSummarySchema = exports.topologyCorrelationDryRunRequestSchema = exports.topologyCorrelationDryRunOptionsSchema = exports.topologyCorrelationDryRunUnitSchema = exports.topologyCorrelationApiUnitResultSchema = exports.topologyCorrelationApiUnitSpecSchema = exports.topologyCorrelationApiInputScopeSchema = exports.topologyCorrelationApiDiffSchema = exports.topologyCorrelationApiDiffSummarySchema = exports.topologyCorrelationApiRefreshSchema = exports.topologyCorrelationApiFindingSchema = exports.topologyCorrelationApiCandidateSchema = exports.topologyCorrelationApiEndpointSchema = exports.topologyCorrelationApiEvidenceRefSchema = exports.topologyCorrelationApiWarningSchema = void 0;
-exports.gatewayTopologyContextSchema = exports.topologyBindingHintsSchema = void 0;
+exports.topologyProjectionCompatibilitySchema = exports.topologyBindingHintsSchema = exports.topologyBindingHintSchema = exports.topologyInvestigationContextSchema = exports.relatedServiceInfoSchema = exports.investigationResourceSchema = exports.targetServiceInfoSchema = exports.topologyInitializationStateSchema = exports.topologyPrimaryAnchorSchema = exports.topologyCandidateTargetSchema = exports.topologyReasonCodeSchema = exports.nestedTopologyResponseSchema = exports.nestedTopologyTruncationSchema = exports.nestedTopologyStatsSchema = exports.nestedTopologyLimitsSchema = exports.nestedTopologyRelationshipSchema = exports.nestedTopologyEvidenceSchema = exports.nestedTopologyTruncationReasonSchema = exports.diagnosticCriticalitySchema = exports.topologyApiErrorEnvelopeSchema = exports.topologyApiErrorCodeSchema = exports.credentialSourceBulkResponseSchema = exports.credentialSourceBulkRequestSchema = exports.credentialSourceSingleResponseSchema = exports.credentialSourceResultItemSchema = exports.credentialSourceAccessRefSchema = exports.credentialResolutionModeSchema = exports.credentialSourceEntityTypeSchema = exports.topologyRelationTypeSchema = exports.topologyResourceTypeSchema = exports.topologyCorrelationApplyResponseSchema = exports.topologyCorrelationApplySummarySchema = exports.topologyCorrelationApplyUnitSchema = exports.topologyCorrelationApplyRequestSchema = exports.topologyCorrelationDryRunResponseSchema = exports.topologyCorrelationDryRunSummarySchema = exports.topologyCorrelationDryRunRequestSchema = exports.topologyCorrelationDryRunOptionsSchema = exports.topologyCorrelationDryRunUnitSchema = exports.topologyCorrelationApiUnitResultSchema = exports.topologyCorrelationApiUnitSpecSchema = exports.topologyCorrelationApiInputScopeSchema = exports.topologyCorrelationApiDiffSchema = exports.topologyCorrelationApiDiffSummarySchema = exports.topologyCorrelationApiRefreshSchema = exports.topologyCorrelationApiFindingSchema = exports.topologyCorrelationApiCandidateSchema = exports.topologyCorrelationApiEndpointSchema = exports.topologyCorrelationApiEvidenceRefSchema = exports.topologyCorrelationApiWarningSchema = void 0;
+exports.runtimeWorkloadProvenanceSchema = exports.runtimeContainerProvenanceSchema = exports.safeSourceRepositorySchema = exports.claimedSourceStatusSchema = exports.runtimeConsistencyStatusSchema = exports.runtimeIdentityStatusSchema = exports.runtimeContainerKindSchema = exports.gatewayTopologyContextSchema = exports.gatewayTopologyDiagnosticsSchema = void 0;
 var providers_1 = require("../providers");
 Object.defineProperty(exports, "topologyProviderSchema", { enumerable: true, get: function () { return providers_1.topologyProviderSchema; } });
 Object.defineProperty(exports, "topologyProviderInputSchema", { enumerable: true, get: function () { return providers_1.topologyProviderInputSchema; } });
@@ -95,8 +95,6 @@ Object.defineProperty(exports, "diagnosticCriticalitySchema", { enumerable: true
 Object.defineProperty(exports, "nestedTopologyTruncationReasonSchema", { enumerable: true, get: function () { return investigation_1.nestedTopologyTruncationReasonSchema; } });
 Object.defineProperty(exports, "nestedTopologyEvidenceSchema", { enumerable: true, get: function () { return investigation_1.nestedTopologyEvidenceSchema; } });
 Object.defineProperty(exports, "nestedTopologyRelationshipSchema", { enumerable: true, get: function () { return investigation_1.nestedTopologyRelationshipSchema; } });
-Object.defineProperty(exports, "nestedTopologyNodeSchema", { enumerable: true, get: function () { return investigation_1.nestedTopologyNodeSchema; } });
-Object.defineProperty(exports, "nestedTopologyChildSchema", { enumerable: true, get: function () { return investigation_1.nestedTopologyChildSchema; } });
 Object.defineProperty(exports, "nestedTopologyLimitsSchema", { enumerable: true, get: function () { return investigation_1.nestedTopologyLimitsSchema; } });
 Object.defineProperty(exports, "nestedTopologyStatsSchema", { enumerable: true, get: function () { return investigation_1.nestedTopologyStatsSchema; } });
 Object.defineProperty(exports, "nestedTopologyTruncationSchema", { enumerable: true, get: function () { return investigation_1.nestedTopologyTruncationSchema; } });
@@ -111,5 +109,15 @@ Object.defineProperty(exports, "relatedServiceInfoSchema", { enumerable: true, g
 Object.defineProperty(exports, "topologyInvestigationContextSchema", { enumerable: true, get: function () { return investigation_1.topologyInvestigationContextSchema; } });
 Object.defineProperty(exports, "topologyBindingHintSchema", { enumerable: true, get: function () { return investigation_1.topologyBindingHintSchema; } });
 Object.defineProperty(exports, "topologyBindingHintsSchema", { enumerable: true, get: function () { return investigation_1.topologyBindingHintsSchema; } });
+Object.defineProperty(exports, "topologyProjectionCompatibilitySchema", { enumerable: true, get: function () { return investigation_1.topologyProjectionCompatibilitySchema; } });
+Object.defineProperty(exports, "gatewayTopologyDiagnosticsSchema", { enumerable: true, get: function () { return investigation_1.gatewayTopologyDiagnosticsSchema; } });
 Object.defineProperty(exports, "gatewayTopologyContextSchema", { enumerable: true, get: function () { return investigation_1.gatewayTopologyContextSchema; } });
+var provenance_1 = require("../provenance");
+Object.defineProperty(exports, "runtimeContainerKindSchema", { enumerable: true, get: function () { return provenance_1.runtimeContainerKindSchema; } });
+Object.defineProperty(exports, "runtimeIdentityStatusSchema", { enumerable: true, get: function () { return provenance_1.runtimeIdentityStatusSchema; } });
+Object.defineProperty(exports, "runtimeConsistencyStatusSchema", { enumerable: true, get: function () { return provenance_1.runtimeConsistencyStatusSchema; } });
+Object.defineProperty(exports, "claimedSourceStatusSchema", { enumerable: true, get: function () { return provenance_1.claimedSourceStatusSchema; } });
+Object.defineProperty(exports, "safeSourceRepositorySchema", { enumerable: true, get: function () { return provenance_1.safeSourceRepositorySchema; } });
+Object.defineProperty(exports, "runtimeContainerProvenanceSchema", { enumerable: true, get: function () { return provenance_1.runtimeContainerProvenanceSchema; } });
+Object.defineProperty(exports, "runtimeWorkloadProvenanceSchema", { enumerable: true, get: function () { return provenance_1.runtimeWorkloadProvenanceSchema; } });
 //# sourceMappingURL=index.js.map