@sealkeeper/schema 0.4.3 → 0.4.5

package/dist/moderation.js

@@ -0,0 +1,450 @@
+import { z } from 'zod';
+// Moderation of the names an operator chooses, the operator slug and the
+// operator display name. The API runs these checks on every write and is
+// the only enforcement. The CLI and the web run the same checks for early
+// feedback. A name another operator already holds is the API's call, since
+// only the database knows (409 name_taken).
+// ---------------------------------------------------------------------------
+// Shapes
+export const OPERATOR_SLUG_MIN = 1;
+// 39, like a GitHub login. A 39 character slug, a slash and a 39 character
+// agent name make a 79 character handle, the AgentHandle cap that published
+// CLIs bundle.
+export const OPERATOR_SLUG_MAX = 39;
+export const OPERATOR_DISPLAY_NAME_MIN = 1;
+export const OPERATOR_DISPLAY_NAME_MAX = 64;
+const SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+// The operator's slug, the first half of every handle, as in alice/claude-code.
+// Lowercase letters, digits and single hyphens, starting and ending with a
+// letter or digit. Unique across SealKeeper. Reserved words and protected
+// names are refused by moderateSlug, not by this shape.
+export const OperatorSlug = z
+    .string()
+    .min(OPERATOR_SLUG_MIN)
+    .max(OPERATOR_SLUG_MAX)
+    .regex(SLUG, 'Use lowercase letters, digits and hyphens, starting and ending with a letter or digit')
+    .refine((slug) => !slug.includes('--'), 'No double hyphen');
+// Control, format, private use, unassigned and lone surrogate characters
+// (bidi overrides, zero width joiners and the like), and the line and
+// paragraph separators, which can hide, reorder or break what a reader sees.
+const HIDDEN = /[\p{C}\p{Zl}\p{Zp}]/u;
+const LETTER_OR_DIGIT = /[\p{L}\p{N}]/u;
+// The operator's display name. Free text, no control or format characters,
+// no space at either end, and at least one letter or digit, so its
+// normalised key is never empty. Protected names are refused by
+// moderateDisplayName.
+export const OperatorDisplayName = z
+    .string()
+    .min(OPERATOR_DISPLAY_NAME_MIN)
+    .max(OPERATOR_DISPLAY_NAME_MAX)
+    .refine((name) => !HIDDEN.test(name), 'No control characters')
+    .refine((name) => name === name.trim(), 'No space at the start or end')
+    .refine((name) => LETTER_OR_DIGIT.test(name), 'Use at least one letter or digit');
+// ---------------------------------------------------------------------------
+// Normalisation
+// Letters from other scripts that read as a Latin letter, and a few Latin
+// letters NFKD does not split into a base and a mark.
+const HOMOGLYPHS = {
+    // Cyrillic
+    а: 'a',
+    в: 'b',
+    с: 'c',
+    ԁ: 'd',
+    е: 'e',
+    ё: 'e',
+    һ: 'h',
+    н: 'h',
+    і: 'i',
+    ї: 'i',
+    ј: 'j',
+    к: 'k',
+    ӏ: 'l',
+    м: 'm',
+    п: 'n',
+    о: 'o',
+    р: 'p',
+    ԛ: 'q',
+    г: 'r',
+    ѕ: 's',
+    т: 't',
+    у: 'y',
+    ш: 'w',
+    ԝ: 'w',
+    х: 'x',
+    // Greek
+    α: 'a',
+    β: 'b',
+    ϲ: 'c',
+    ε: 'e',
+    η: 'n',
+    ι: 'i',
+    κ: 'k',
+    μ: 'u',
+    ν: 'v',
+    ο: 'o',
+    ρ: 'p',
+    τ: 't',
+    υ: 'u',
+    χ: 'x',
+    ω: 'w',
+    // Latin letters without a decomposition
+    ı: 'i',
+    ȷ: 'j',
+    ł: 'l',
+    ø: 'o',
+    đ: 'd',
+    ħ: 'h',
+    ŧ: 't',
+    ß: 'ss',
+    æ: 'ae',
+    œ: 'oe',
+    ɡ: 'g',
+    ɑ: 'a',
+    // Digits and symbols used as letters
+    '0': 'o',
+    '1': 'l',
+    '3': 'e',
+    '4': 'a',
+    '5': 's',
+    '7': 't',
+    '8': 'b',
+    '@': 'a',
+    $: 's',
+    '|': 'l',
+    '!': 'l',
+};
+// i and l look alike in many fonts (GoogIe with a capital I), so both fold
+// to l. Run after HOMOGLYPHS, so a Cyrillic і, a Greek ι or a dotless ı,
+// which fold to i there, fold on to l as well.
+const I_AS_L = /i/g;
+const MARKS = /\p{M}/gu;
+const NOT_LETTER_OR_DIGIT = /[^\p{L}\p{N}]/gu;
+// The form two names are compared in. NFKC, lowercase, accents dropped,
+// homoglyphs and digit swaps folded, everything but letters and digits
+// dropped, then letter pairs that read as one letter (rn as m, vv as w)
+// folded. Open-AI, OPENAI and 0penai all give the same key. Letters of
+// scripts with no Latin lookalike are kept, so a display name in another
+// script still has a key of its own.
+export function normaliseName(text) {
+    const folded = Array.from(text.normalize('NFKC').toLowerCase().normalize('NFKD').replace(MARKS, ''), (ch) => HOMOGLYPHS[ch] ?? ch)
+        .join('')
+        .replace(I_AS_L, 'l');
+    return folded
+        .replace(NOT_LETTER_OR_DIGIT, '')
+        .replace(/rn/g, 'm')
+        .replace(/vv/g, 'w');
+}
+// The display_name_key column. Unique across operators, so two display
+// names that read the same cannot both be held.
+export const displayNameKey = normaliseName;
+// ---------------------------------------------------------------------------
+// Protected names
+// The top AI and technology companies and products. A slug or display name
+// that normalises to one of these, with or without a common suffix, is
+// refused. Written as the name reads. The list protects the distinctive
+// form only, so Stability AI protects stabilityai (and stability-ai-labs)
+// but not the plain word stability. Products that are also common first
+// names (Devin, Alexa, Siri) are left out, since a login such as devin
+// would otherwise lose its slug. Claude is the one exception.
+export const PROTECTED_NAMES = [
+    // SealKeeper itself
+    'SealKeeper',
+    'Vouched',
+    // AI labs and model makers
+    'Anthropic',
+    'Claude',
+    'OpenAI',
+    'ChatGPT',
+    'GPT',
+    'Codex',
+    'DALL-E',
+    'Google',
+    'Alphabet',
+    'DeepMind',
+    'Gemini',
+    'Microsoft',
+    'Copilot',
+    'Bing',
+    'Azure',
+    'Meta',
+    'Facebook',
+    'Instagram',
+    'WhatsApp',
+    'Llama',
+    'xAI',
+    'Grok',
+    'Twitter',
+    'Mistral',
+    'Le Chat',
+    'Cohere',
+    'DeepSeek',
+    'Qwen',
+    'Alibaba',
+    'Zhipu',
+    'Baidu',
+    'ByteDance',
+    'TikTok',
+    'Tencent',
+    'Perplexity',
+    'Character AI',
+    'Stability AI',
+    'Midjourney',
+    'ElevenLabs',
+    'Hugging Face',
+    'Scale AI',
+    'AI21',
+    'Nous Research',
+    'Together AI',
+    'Groq',
+    'Cerebras',
+    'Ollama',
+    'LangChain',
+    'LlamaIndex',
+    'CrewAI',
+    'AutoGPT',
+    'Mastra',
+    'OpenClaw',
+    // Coding agents and developer tools
+    'Cursor',
+    'Anysphere',
+    'Windsurf',
+    'Codeium',
+    'Replit',
+    'Lovable',
+    'StackBlitz',
+    'Vercel',
+    'Sourcegraph',
+    'Tabnine',
+    'JetBrains',
+    'GitHub',
+    'GitLab',
+    'Bitbucket',
+    'Atlassian',
+    'Notion',
+    'Slack',
+    'Discord',
+    'Figma',
+    'Stripe',
+    'Supabase',
+    'Cloudflare',
+    'Netlify',
+    'Docker',
+    'npm',
+    // Platforms and hardware
+    'Apple',
+    'Amazon',
+    'AWS',
+    'Nvidia',
+    'AMD',
+    'Intel',
+    'IBM',
+    'Oracle',
+    'Salesforce',
+    'Samsung',
+    'Adobe',
+    'Netflix',
+    'Uber',
+    'Palantir',
+    'Databricks',
+    'Snowflake',
+    'Zapier',
+];
+// Suffixes an impersonator adds to a protected name. Stripped one at a time
+// from the end, and the rest compared again.
+export const PROTECTED_SUFFIXES = [
+    'inc',
+    'labs',
+    'ai',
+    'hq',
+    'official',
+    'team',
+];
+// Prefixes an impersonator puts in front, as in the-real-openai. Stripped
+// from the start the same way.
+export const PROTECTED_PREFIXES = [
+    'official',
+    'real',
+    'the',
+    'team',
+];
+const PROTECTED_KEYS = new Map(PROTECTED_NAMES.map((name) => [normaliseName(name), name]));
+const SUFFIX_KEYS = PROTECTED_SUFFIXES.map(normaliseName);
+const PREFIX_KEYS = PROTECTED_PREFIXES.map(normaliseName);
+// Every form of a key a protected name could hide in. The key itself, then
+// the key with every combination of prefixes and suffixes stripped. Never
+// empty.
+function keyForms(key) {
+    const forms = new Set();
+    const queue = [key];
+    while (queue.length > 0) {
+        const form = queue.pop();
+        if (form === '' || forms.has(form))
+            continue;
+        forms.add(form);
+        for (const suffix of SUFFIX_KEYS) {
+            if (form.length > suffix.length && form.endsWith(suffix)) {
+                queue.push(form.slice(0, -suffix.length));
+            }
+        }
+        for (const prefix of PREFIX_KEYS) {
+            if (form.length > prefix.length && form.startsWith(prefix)) {
+                queue.push(form.slice(prefix.length));
+            }
+        }
+    }
+    return [...forms];
+}
+// The protected name a text impersonates, as written in PROTECTED_NAMES, or
+// null when it impersonates none.
+export function protectedNameOf(text) {
+    for (const form of keyForms(normaliseName(text))) {
+        const name = PROTECTED_KEYS.get(form);
+        if (name !== undefined)
+            return name;
+    }
+    return null;
+}
+// ---------------------------------------------------------------------------
+// Reserved words
+// Route and product words a slug would collide with or read as part of the
+// site. Slugs only, a display name is never part of a URL.
+export const RESERVED_WORDS = [
+    'about',
+    'account',
+    'accounts',
+    'admin',
+    'administrator',
+    'agent',
+    'agents',
+    'anonymous',
+    'api',
+    'app',
+    'assets',
+    'auth',
+    'avatar',
+    'avatars',
+    'badge',
+    'badges',
+    'blog',
+    'callback',
+    'check',
+    'cli',
+    'dashboard',
+    'directory',
+    'docs',
+    'feed',
+    'help',
+    'home',
+    'join',
+    'leaderboard',
+    'legal',
+    'login',
+    'logout',
+    'me',
+    'moderator',
+    'new',
+    'null',
+    'oauth',
+    'official',
+    'operator',
+    'operators',
+    'privacy',
+    'profile',
+    'prove',
+    'register',
+    'root',
+    'search',
+    'seal',
+    'seals',
+    'sealkeeper',
+    'security',
+    'settings',
+    'signin',
+    'signout',
+    'signup',
+    'staff',
+    'static',
+    'status',
+    'support',
+    'system',
+    'task',
+    'tasks',
+    'terms',
+    'undefined',
+    'v1',
+    'verify',
+    'vouched',
+    'well-known',
+    'what-is-shared',
+    'www',
+];
+// Compared in normalised form, so adm1n and a-p-i are refused as well.
+const RESERVED_KEYS = new Set(RESERVED_WORDS.map(normaliseName));
+export function isReservedWord(text) {
+    return RESERVED_KEYS.has(normaliseName(text));
+}
+function protectedRefusal(text) {
+    const name = protectedNameOf(text);
+    return name === null
+        ? null
+        : {
+            code: 'name_protected',
+            message: `${text} reads as ${name}, which is a protected name. Pick another.`,
+        };
+}
+// The refusal for an operator slug, or null when it may be used. The shape
+// is OperatorSlug's job, this checks reserved words and protected names.
+export function moderateSlug(slug) {
+    if (isReservedWord(slug)) {
+        return {
+            code: 'name_reserved',
+            message: `${slug} is reserved by SealKeeper. Pick another.`,
+        };
+    }
+    return protectedRefusal(slug);
+}
+// The refusal for an operator display name, or null when it may be used.
+// The shape is OperatorDisplayName's job. Whether another operator holds
+// the same key is the API's check against display_name_key.
+export function moderateDisplayName(name) {
+    return protectedRefusal(name);
+}
+// ---------------------------------------------------------------------------
+// Default slugs
+// A login as a slug. Lowercase, every run of characters other than a to z
+// and 0 to 9 made one hyphen, hyphens trimmed from the ends, since an old
+// GitHub login can end in one. A login is not always letters, digits and
+// hyphens (an Enterprise Managed User login ends in _shortcode), and a
+// slug must be. The same rule as sk_base in migration 0025. The API's
+// default slug for a new operator starts from it.
+export function slugBase(login) {
+    const base = login
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-|-$/g, '')
+        .slice(0, OPERATOR_SLUG_MAX)
+        .replace(/-$/, '');
+    return base === '' ? 'operator' : base;
+}
+// base with -n on the end, cut so the whole stays within the slug limit.
+export const suffixedSlug = (base, n) => `${base.slice(0, OPERATOR_SLUG_MAX - `-${n}`.length).replace(/-+$/, '')}-${n}`;
+// The reason the slug is the login's slug with a -2, -3 and so on, or null
+// when it is not. A slug the operator chose, or one left behind by a GitHub
+// login change, is not of that form and gives null. The caller also checks
+// that the slug never changed, since an operator can pick a suffixed slug.
+// reserved and protected are read from today's lists, taken is the rest.
+export function slugSuffixReason(login, slug) {
+    const base = slugBase(login);
+    const n = /-([0-9]+)$/.exec(slug)?.[1];
+    if (n === undefined || slug === base)
+        return null;
+    const k = Number(n);
+    if (k < 2 || suffixedSlug(base, k) !== slug)
+        return null;
+    const refusal = moderateSlug(base);
+    if (refusal?.code === 'name_reserved')
+        return 'reserved';
+    if (refusal?.code === 'name_protected')
+        return 'protected';
+    return 'taken';
+}

package/dist/operator-domains.d.ts

@@ -0,0 +1,104 @@
+import { z } from 'zod';
+export declare const DNS_RECORD_LABEL = "_sealkeeper";
+export declare const DNS_RECORD_PREFIX = "sealkeeper-verify=";
+export declare const DNS_IDENTITY_KIND = "https://sealkeeper.run/seal/identity/dns";
+export declare const DNS_IDENTITY_PROVIDER = "https://sealkeeper.run";
+export declare const OPERATOR_VERIFICATION: {
+    readonly graceDays: 14;
+    readonly recheckHours: 24;
+    readonly maxDomains: 5;
+};
+export declare const DomainName: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
+export type DomainName = z.infer<typeof DomainName>;
+export declare const AddDomainRequest: z.ZodObject<{
+    domain: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
+}, z.core.$strict>;
+export type AddDomainRequest = z.infer<typeof AddDomainRequest>;
+export declare const DomainParams: z.ZodObject<{
+    id: z.ZodUUID;
+}, z.core.$strict>;
+export type DomainParams = z.infer<typeof DomainParams>;
+export declare const DomainStatus: z.ZodEnum<{
+    lapsed: "lapsed";
+    lapsing: "lapsing";
+    pending: "pending";
+    verified: "verified";
+}>;
+export type DomainStatus = z.infer<typeof DomainStatus>;
+export declare const OperatorDomain: z.ZodObject<{
+    id: z.ZodUUID;
+    domain: z.ZodString;
+    record: z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+    }, z.core.$strict>;
+    status: z.ZodEnum<{
+        lapsed: "lapsed";
+        lapsing: "lapsing";
+        pending: "pending";
+        verified: "verified";
+    }>;
+    verifiedAt: z.ZodNullable<z.ZodISODateTime>;
+    lastCheckedAt: z.ZodNullable<z.ZodISODateTime>;
+    lapsedAt: z.ZodNullable<z.ZodISODateTime>;
+    graceEndsAt: z.ZodNullable<z.ZodISODateTime>;
+}, z.core.$strict>;
+export type OperatorDomain = z.infer<typeof OperatorDomain>;
+export declare const DomainsResponse: z.ZodObject<{
+    domains: z.ZodArray<z.ZodObject<{
+        id: z.ZodUUID;
+        domain: z.ZodString;
+        record: z.ZodObject<{
+            name: z.ZodString;
+            value: z.ZodString;
+        }, z.core.$strict>;
+        status: z.ZodEnum<{
+            lapsed: "lapsed";
+            lapsing: "lapsing";
+            pending: "pending";
+            verified: "verified";
+        }>;
+        verifiedAt: z.ZodNullable<z.ZodISODateTime>;
+        lastCheckedAt: z.ZodNullable<z.ZodISODateTime>;
+        lapsedAt: z.ZodNullable<z.ZodISODateTime>;
+        graceEndsAt: z.ZodNullable<z.ZodISODateTime>;
+    }, z.core.$strict>>;
+    graceDays: z.ZodInt;
+}, z.core.$strict>;
+export type DomainsResponse = z.infer<typeof DomainsResponse>;
+export declare const DomainLookup: z.ZodEnum<{
+    failed: "failed";
+    found: "found";
+    missing: "missing";
+}>;
+export type DomainLookup = z.infer<typeof DomainLookup>;
+export declare const DomainCheckResponse: z.ZodObject<{
+    domain: z.ZodObject<{
+        id: z.ZodUUID;
+        domain: z.ZodString;
+        record: z.ZodObject<{
+            name: z.ZodString;
+            value: z.ZodString;
+        }, z.core.$strict>;
+        status: z.ZodEnum<{
+            lapsed: "lapsed";
+            lapsing: "lapsing";
+            pending: "pending";
+            verified: "verified";
+        }>;
+        verifiedAt: z.ZodNullable<z.ZodISODateTime>;
+        lastCheckedAt: z.ZodNullable<z.ZodISODateTime>;
+        lapsedAt: z.ZodNullable<z.ZodISODateTime>;
+        graceEndsAt: z.ZodNullable<z.ZodISODateTime>;
+    }, z.core.$strict>;
+    lookup: z.ZodEnum<{
+        failed: "failed";
+        found: "found";
+        missing: "missing";
+    }>;
+}, z.core.$strict>;
+export type DomainCheckResponse = z.infer<typeof DomainCheckResponse>;
+export declare const domainRecord: (domain: string, token: string) => {
+    name: string;
+    value: string;
+};

package/dist/operator-domains.js

@@ -0,0 +1,85 @@
+import { z } from 'zod';
+// Operator verification by DNS TXT (VOU-185), gold's operator_verified at
+// launch. The operator adds a domain on the account page, puts a TXT
+// record at DNS_RECORD_LABEL.<domain> holding DNS_RECORD_PREFIX<token>, and
+// SealKeeper checks it. The API's routes live under /v1/me/domains.
+// The record name is this label, a dot and the domain.
+export const DNS_RECORD_LABEL = '_sealkeeper';
+// The record value is this prefix and the token.
+export const DNS_RECORD_PREFIX = 'sealkeeper-verify=';
+// The kind and provider of a DNS identity in a SEAL, SEAL standard section
+// 4a. kind is a URL, since dns is none of the four named kinds. SealKeeper
+// checked the record, so it is the provider.
+export const DNS_IDENTITY_KIND = 'https://sealkeeper.run/seal/identity/dns';
+export const DNS_IDENTITY_PROVIDER = 'https://sealkeeper.run';
+// How a verified domain lapses (26 September 2026, the grace period still
+// open). SealKeeper checks every verified domain again about every
+// recheckHours hours. A check that misses the record starts graceDays days
+// of grace, in which the operator stays verified and the goal warns, and
+// operator_verified goes false when it ends. A check that finds the record
+// again ends the grace. maxDomains is how many domains one operator may
+// add. The scoring job and the API read these, so they live here.
+export const OPERATOR_VERIFICATION = {
+    graceDays: 14,
+    recheckHours: 24,
+    maxDomains: 5,
+};
+// A host name in ASCII, lower case, at least two labels, the last starting
+// with a letter so an IP address never passes. An IDN goes in as its
+// xn-- form. A trailing dot is dropped first.
+const HOST = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+export const DomainName = z
+    .string()
+    .trim()
+    .toLowerCase()
+    .max(254)
+    .transform((d) => d.replace(/\.$/, ''))
+    .pipe(z.string().regex(HOST, 'a domain such as example.com'));
+// POST /v1/me/domains.
+export const AddDomainRequest = z.strictObject({ domain: DomainName });
+// POST /v1/me/domains/:id/check and DELETE /v1/me/domains/:id.
+export const DomainParams = z.strictObject({ id: z.uuid() });
+// pending, added and never found. verified, found at the last check.
+// lapsing, missed since lapsedAt and still verified until graceEndsAt.
+// lapsed, missed for the whole grace period and no longer verified.
+export const DomainStatus = z.enum([
+    'pending',
+    'verified',
+    'lapsing',
+    'lapsed',
+]);
+const Timestamp = z.iso.datetime();
+// One domain as its operator sees it, with the record to add. Private to
+// the signed in operator.
+export const OperatorDomain = z.strictObject({
+    id: z.uuid(),
+    domain: z.string().min(1).max(253),
+    record: z.strictObject({
+        name: z.string().min(1).max(300),
+        value: z.string().min(1).max(300),
+    }),
+    status: DomainStatus,
+    verifiedAt: Timestamp.nullable(),
+    lastCheckedAt: Timestamp.nullable(),
+    lapsedAt: Timestamp.nullable(),
+    graceEndsAt: Timestamp.nullable(),
+});
+// GET /v1/me/domains and the answer of POST /v1/me/domains.
+export const DomainsResponse = z.strictObject({
+    domains: z.array(OperatorDomain),
+    graceDays: z.int().positive(),
+});
+// What one lookup of the record found. found, the token is there. missing,
+// the name has no TXT record with it. failed, the lookup itself did not
+// answer, so nothing is known.
+export const DomainLookup = z.enum(['found', 'missing', 'failed']);
+// POST /v1/me/domains/:id/check.
+export const DomainCheckResponse = z.strictObject({
+    domain: OperatorDomain,
+    lookup: DomainLookup,
+});
+// The TXT record for a domain and a token.
+export const domainRecord = (domain, token) => ({
+    name: `${DNS_RECORD_LABEL}.${domain}`,
+    value: `${DNS_RECORD_PREFIX}${token}`,
+});

package/dist/policy.d.ts

@@ -0,0 +1,4 @@
+export declare const POLICY_VERSIONS: {
+    readonly terms: '2026-09-27';
+    readonly privacy: '2026-09-27';
+};

package/dist/policy.js

@@ -0,0 +1,10 @@
+// The versions of the terms of service and the privacy policy, as the
+// "Last updated" date each page shows, YYYY-MM-DD. The single source of
+// truth. The web renders both pages' dates from here and the API stamps them
+// on an operator when it creates the row and on an agent when it registers,
+// as what was accepted (VOU-121). The client never sends them. Change a date
+// here when the matching page changes.
+export const POLICY_VERSIONS = {
+    terms: '2026-09-27',
+    privacy: '2026-09-27',
+};

package/dist/runtime.d.ts

@@ -0,0 +1,17 @@
+import { z } from 'zod';
+export declare const RUNTIMES: readonly ['claude-code', 'codex', 'cursor', 'gemini-cli', 'openclaw', 'mastra', 'other', 'unknown'];
+export declare const Runtime: z.ZodEnum<{
+    "claude-code": "claude-code";
+    codex: "codex";
+    cursor: "cursor";
+    "gemini-cli": "gemini-cli";
+    mastra: "mastra";
+    openclaw: "openclaw";
+    other: "other";
+    unknown: "unknown";
+}>;
+export type Runtime = z.infer<typeof Runtime>;
+export declare const DEFAULT_RUNTIME: Runtime;
+export declare const RUNTIME_LABELS: Readonly<Record<Runtime, string>>;
+export declare const RUNTIME_NAMES: ReadonlySet<string>;
+export declare function isRuntimeName(name: string): boolean;