@stacksjs/ts-cloud 0.7.55 → 0.7.57

package/dist/release/types.d.ts

@@ -0,0 +1,103 @@
+import type { JsonValue } from '../control-plane';
+export type ReleaseDeployableKind = 'static' | 'compute' | 'serverless_zip' | 'serverless_image' | 'container' | 'compose';
+export type ReleaseStrategy = 'atomic' | 'rolling' | 'blue_green' | 'canary';
+export type ReleaseStatus = 'built' | 'awaiting_approval' | 'activating' | 'active' | 'failed' | 'rolled_back' | 'superseded';
+export interface ReleaseArtifact {
+    id: string;
+    organizationId: string;
+    digest: string;
+    kind: ReleaseDeployableKind;
+    uri: string;
+    size: number;
+    mediaType: string;
+    provenance: JsonValue;
+    attestation: JsonValue;
+    verifiedAt: string;
+    createdAt: string;
+}
+export interface ReleaseHealthGate {
+    name?: string;
+    protocol: 'http' | 'https' | 'tcp' | 'provider';
+    path?: string;
+    timeoutSeconds: number;
+    intervalSeconds: number;
+    healthyThreshold: number;
+    unhealthyThreshold: number;
+}
+export interface ReleaseHookCompatibility {
+    migrations: 'none' | 'backward_compatible' | 'forward_only' | 'irreversible';
+    preActivate: string[];
+    postActivate: string[];
+    notes?: string;
+}
+export interface ReleaseRecord {
+    id: string;
+    organizationId: string;
+    projectId: string;
+    environmentId: string;
+    resourceId: string;
+    artifactId: string;
+    kind: ReleaseDeployableKind;
+    sourceSha?: string;
+    configHash: string;
+    manifest: JsonValue;
+    provenance: JsonValue;
+    strategy: ReleaseStrategy;
+    status: ReleaseStatus;
+    healthGate?: ReleaseHealthGate;
+    hooks: ReleaseHookCompatibility;
+    drainSeconds: number;
+    graceSeconds: number;
+    automaticRollback: boolean;
+    rollbackAttempts: number;
+    previousReleaseId?: string;
+    promotedFromReleaseId?: string;
+    actorId?: string;
+    trigger: string;
+    pinned: boolean;
+    pinReason?: string;
+    activatedAt?: string;
+    failedAt?: string;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface ReleaseTransition {
+    sequence: number;
+    id: string;
+    releaseId: string;
+    fromStatus?: ReleaseStatus;
+    toStatus: ReleaseStatus;
+    trafficPercent?: number;
+    health: JsonValue;
+    message: string;
+    operationId?: string;
+    createdAt: string;
+}
+export interface ReleaseApproval {
+    id: string;
+    releaseId: string;
+    environmentId: string;
+    decision: 'approved' | 'rejected';
+    actorId: string;
+    comment?: string;
+    createdAt: string;
+}
+export interface ReleaseStrategyCapability {
+    strategy: ReleaseStrategy;
+    supported: boolean;
+    explanation: string;
+    capacityMultiplier: number;
+    costImpact: 'none' | 'temporary' | 'sustained';
+    rollback: string;
+}
+export interface ReleaseCompare {
+    artifactChanged: boolean;
+    sourceChanged: boolean;
+    configChanged: boolean;
+    manifestChanges: Array<{
+        path: string;
+        before?: unknown;
+        after?: unknown;
+    }>;
+    dataCaveat: string;
+}

package/dist/runtime/adapters/aws.d.ts

@@ -0,0 +1,5 @@
+import type { Service as EcsService, Task as EcsTask } from '../../aws/ecs';
+import type { LambdaFunctionConfiguration } from '../../aws/lambda';
+import type { RuntimeDiscoveryContext, RuntimeWorkload } from '../model';
+export declare function ecsWorkloads(services: EcsService[], tasks: EcsTask[], context: RuntimeDiscoveryContext, sourceId?: string, taskDefinitions?: any[]): RuntimeWorkload[];
+export declare function lambdaWorkloads(functions: LambdaFunctionConfiguration[], context: RuntimeDiscoveryContext, sourceId?: string): RuntimeWorkload[];

package/dist/runtime/adapters/docker.d.ts

@@ -0,0 +1,53 @@
+import type { RuntimeDiscoveryAdapter, RuntimeDiscoveryContext, RuntimeWorkload } from '../model';
+export interface DockerInspectRecord {
+    Id: string;
+    Name?: string;
+    Config?: {
+        Image?: string;
+        Labels?: Record<string, string>;
+        Env?: string[];
+    };
+    State?: {
+        Status?: string;
+        Running?: boolean;
+        StartedAt?: string;
+        FinishedAt?: string;
+        ExitCode?: number;
+        Error?: string;
+        OOMKilled?: boolean;
+        Restarting?: boolean;
+    };
+    RestartCount?: number;
+    HostConfig?: {
+        NetworkMode?: string;
+        Memory?: number;
+        NanoCpus?: number;
+    };
+    Mounts?: Array<{
+        Source?: string;
+        Destination?: string;
+        Type?: string;
+        RW?: boolean;
+    }>;
+    NetworkSettings?: {
+        Networks?: Record<string, {
+            NetworkID?: string;
+            IPAddress?: string;
+            GlobalIPv6Address?: string;
+        }>;
+        Ports?: Record<string, Array<{
+            HostIp?: string;
+            HostPort?: string;
+        }> | null>;
+    };
+    Image?: string;
+}
+export declare function parseDockerInspect(output: string): DockerInspectRecord[];
+export declare function dockerWorkloads(records: DockerInspectRecord[], context: RuntimeDiscoveryContext, sourceId?: string): RuntimeWorkload[];
+export declare class DockerDiscoveryAdapter implements RuntimeDiscoveryAdapter {
+    private readonly inspect;
+    readonly id: string;
+    readonly provider: 'docker';
+    constructor(inspect: (context: RuntimeDiscoveryContext) => Promise<string>, id?: string);
+    discover(context: RuntimeDiscoveryContext): Promise<RuntimeWorkload[]>;
+}

package/dist/runtime/adapters/systemd.d.ts

@@ -0,0 +1,26 @@
+import type { RuntimeDiscoveryAdapter, RuntimeDiscoveryContext, RuntimeWorkload } from '../model';
+export interface SystemdUnitRecord {
+    unit: string;
+    load?: string;
+    active?: string;
+    sub?: string;
+    description?: string;
+    enabled?: string;
+    pid?: number;
+    memoryBytes?: number;
+    restartCount?: number;
+    activeSince?: string;
+    fragmentPath?: string;
+    workingDirectory?: string;
+    user?: string;
+    environment?: Record<string, string>;
+}
+export declare function parseSystemdRecords(output: string): SystemdUnitRecord[];
+export declare function systemdWorkloads(records: SystemdUnitRecord[], context: RuntimeDiscoveryContext, sourceId?: string): RuntimeWorkload[];
+export declare class SystemdDiscoveryAdapter implements RuntimeDiscoveryAdapter {
+    private readonly read;
+    readonly id: string;
+    readonly provider: 'systemd';
+    constructor(read: (context: RuntimeDiscoveryContext) => Promise<string>, id?: string);
+    discover(context: RuntimeDiscoveryContext): Promise<RuntimeWorkload[]>;
+}

package/dist/runtime/index.d.ts

@@ -0,0 +1,9 @@
+export * from './model';
+export * from './normalize';
+export * from './inventory';
+export * from './service';
+export * from './operations';
+export * from './streams';
+export * from './adapters/systemd';
+export * from './adapters/docker';
+export * from './adapters/aws';

package/dist/runtime/inventory.d.ts

@@ -0,0 +1,6 @@
+import type { RuntimeDiscoveryAdapter, RuntimeDiscoveryContext, RuntimeInventory } from './model';
+export interface DiscoverInventoryOptions {
+    timeoutMs?: number;
+    staleAfterSeconds?: number;
+}
+export declare function discoverRuntimeInventory(adapters: RuntimeDiscoveryAdapter[], context?: RuntimeDiscoveryContext, options?: DiscoverInventoryOptions): Promise<RuntimeInventory>;

package/dist/runtime/model.d.ts

@@ -0,0 +1,130 @@
+export type WorkloadProvider = 'systemd' | 'docker' | 'oci' | 'ecs' | 'lambda';
+export type WorkloadKind = 'service' | 'container' | 'task' | 'function' | 'process';
+export type WorkloadStatus = 'starting' | 'running' | 'degraded' | 'stopping' | 'stopped' | 'failed' | 'unknown';
+export type LifecycleAction = 'start' | 'stop' | 'restart' | 'redeploy' | 'scale' | 'logs' | 'exec' | 'inspect' | 'files';
+export interface RuntimeLink {
+    project?: string;
+    environment?: string;
+    service?: string;
+    release?: string;
+    deployment?: string;
+    server?: string;
+    providerId?: string;
+}
+export interface RuntimeResourceUsage {
+    cpuPercent?: number;
+    memoryBytes?: number;
+    memoryLimitBytes?: number;
+    ephemeralBytes?: number;
+    ephemeralLimitBytes?: number;
+}
+export interface RuntimeNetwork {
+    id: string;
+    name?: string;
+    mode?: string;
+    addresses?: string[];
+    ports?: Array<{
+        container?: number;
+        host?: number;
+        protocol?: string;
+        address?: string;
+    }>;
+}
+export interface RuntimeMount {
+    source?: string;
+    target: string;
+    type?: string;
+    readOnly?: boolean;
+}
+export interface RuntimeContainer {
+    id: string;
+    name: string;
+    image?: string;
+    imageDigest?: string;
+    runtime?: string;
+    status: WorkloadStatus;
+    rawStatus?: string;
+    exitCode?: number;
+    reason?: string;
+    resources?: RuntimeResourceUsage;
+    networks?: RuntimeNetwork[];
+    mounts?: RuntimeMount[];
+}
+export interface RuntimeReplica {
+    id: string;
+    name?: string;
+    status: WorkloadStatus;
+    rawStatus?: string;
+    createdAt?: string;
+    startedAt?: string;
+    stoppedAt?: string;
+    restartCount?: number;
+    host?: string;
+    pid?: number;
+    containers?: RuntimeContainer[];
+    resources?: RuntimeResourceUsage;
+}
+export interface LifecycleCapability {
+    supported: boolean;
+    reason?: string;
+    requiresRecentAuth?: boolean;
+    requiresConfirmation?: boolean;
+}
+export type LifecycleCapabilities = Record<LifecycleAction, LifecycleCapability>;
+export interface RuntimeWorkload {
+    id: string;
+    provider: WorkloadProvider;
+    kind: WorkloadKind;
+    name: string;
+    displayName?: string;
+    status: WorkloadStatus;
+    rawStatus?: string;
+    health?: 'healthy' | 'unhealthy' | 'unknown';
+    desiredReplicas?: number;
+    runningReplicas?: number;
+    image?: string;
+    runtime?: string;
+    version?: string;
+    architecture?: string;
+    ageSeconds?: number;
+    restartCount?: number;
+    tags: Record<string, string>;
+    links: RuntimeLink;
+    resources?: RuntimeResourceUsage;
+    replicas: RuntimeReplica[];
+    networks: RuntimeNetwork[];
+    mounts: RuntimeMount[];
+    capabilities: LifecycleCapabilities;
+    config: Record<string, unknown>;
+    discoveredAt: string;
+    sourceId: string;
+}
+export interface RuntimeSourceStatus {
+    id: string;
+    provider: WorkloadProvider;
+    status: 'fresh' | 'stale' | 'unreachable' | 'unauthorized' | 'error';
+    discoveredAt: string;
+    staleAfterSeconds: number;
+    message?: string;
+    itemCount: number;
+}
+export interface RuntimeInventory {
+    generatedAt: string;
+    workloads: RuntimeWorkload[];
+    sources: RuntimeSourceStatus[];
+    degraded: boolean;
+}
+export interface RuntimeDiscoveryContext {
+    project?: string;
+    environment?: string;
+    server?: string;
+    now?: Date;
+}
+export interface RuntimeDiscoveryAdapter {
+    id: string;
+    provider: WorkloadProvider;
+    discover(context: RuntimeDiscoveryContext): Promise<RuntimeWorkload[]>;
+}
+export declare function runtimeId(provider: WorkloadProvider, source: string, nativeId: string): string;
+export declare function unsupportedCapabilities(reason: string): LifecycleCapabilities;
+export declare function capabilities(supported: LifecycleAction[], unsupportedReason: string, elevated?: LifecycleAction[]): LifecycleCapabilities;

package/dist/runtime/normalize.d.ts

@@ -0,0 +1,5 @@
+import type { WorkloadStatus } from './model';
+export declare function normalizeRuntimeStatus(raw: unknown): WorkloadStatus;
+export declare function redactRuntimeConfig<T>(value: T): T;
+export declare function ageSeconds(value: string | undefined, now?: Date): number | undefined;
+export declare function bytes(value: unknown): number | undefined;

package/dist/runtime/operations.d.ts

@@ -0,0 +1,113 @@
+import type { CloudConfig, CloudDriver, EnvironmentType } from '@ts-cloud/core';
+import type { CloudWatchLogsClient } from '../aws/cloudwatch-logs';
+import type { ECSClient } from '../aws/ecs';
+import type { LifecycleAction, RuntimeInventory, RuntimeWorkload } from './model';
+export interface RuntimeOperationInput {
+    workloadId: string;
+    action: LifecycleAction;
+    confirm?: string;
+    replicas?: number;
+    recentAuth?: boolean;
+}
+export interface RuntimeOperationResult {
+    ok: boolean;
+    workloadId: string;
+    action: LifecycleAction;
+    command?: string;
+    stdout?: string;
+    stderr?: string;
+    error?: string;
+    workload?: RuntimeWorkload;
+}
+export interface RuntimeLogResult {
+    workloadId: string;
+    provider: RuntimeWorkload['provider'];
+    lines: Array<{
+        timestamp?: string;
+        message: string;
+    }>;
+    nextCursor?: string;
+    truncated: boolean;
+}
+export interface RuntimeExecInput {
+    workloadId: string;
+    preset?: keyof typeof DIAGNOSTIC_PRESETS;
+    command?: string;
+    confirm?: string;
+    recentAuth?: boolean;
+}
+export interface RuntimeExecResult {
+    ok: boolean;
+    workloadId: string;
+    preset?: keyof typeof DIAGNOSTIC_PRESETS;
+    command?: string;
+    stdout?: string;
+    stderr?: string;
+    error?: string;
+}
+export interface RuntimeFileInput {
+    workloadId: string;
+    path: string;
+    confirm?: string;
+    recentAuth?: boolean;
+}
+export interface RuntimeFileReadResult {
+    ok: boolean;
+    workloadId: string;
+    path: string;
+    contentBase64?: string;
+    size?: number;
+    truncated?: boolean;
+    error?: string;
+}
+export interface RuntimeFileWriteInput extends RuntimeFileInput {
+    contentBase64: string;
+}
+interface EcsMutator extends Pick<ECSClient, 'scaleService' | 'forceNewDeployment'> {
+}
+interface LogReader extends Pick<CloudWatchLogsClient, 'filterLogEvents'> {
+}
+export interface RuntimeOperationDependencies {
+    driver?: CloudDriver;
+    ecs?: EcsMutator;
+    logs?: LogReader;
+    inventory?: () => Promise<RuntimeInventory>;
+}
+/**
+ * Permit file operations only below a service-owned root or a discovered bind/
+ * volume target. Host-sensitive trees stay forbidden even if a mount points at
+ * one. This function never follows the requested path on the dashboard host.
+ */
+export declare function authorizeRuntimePath(_workload: RuntimeWorkload, _requested: string): {
+    ok: true;
+    path: string;
+} | {
+    ok: false;
+    error: string;
+};
+export declare const DIAGNOSTIC_PRESETS: {
+    readonly process: readonly ['ps', '-eo', 'pid,ppid,user,%cpu,%mem,etime,command', '--sort=-%cpu'];
+    readonly sockets: readonly ['ss', '-lntup'];
+    readonly filesystem: readonly ['df', '-h'];
+};
+export declare class RuntimeOperationService {
+    private readonly config;
+    private readonly environment;
+    private readonly dependencies;
+    private readonly region;
+    private readonly profile?;
+    constructor(config: CloudConfig, environment: EnvironmentType, dependencies?: RuntimeOperationDependencies);
+    inventory(): Promise<RuntimeInventory>;
+    workload(id: string): Promise<RuntimeWorkload | undefined>;
+    private remote;
+    run(input: RuntimeOperationInput): Promise<RuntimeOperationResult>;
+    exec(input: RuntimeExecInput): Promise<RuntimeExecResult>;
+    readFile(input: RuntimeFileInput): Promise<RuntimeFileReadResult>;
+    writeFile(input: RuntimeFileWriteInput): Promise<RuntimeFileReadResult>;
+    private fileTarget;
+    logs(workloadId: string, input?: {
+        limit?: number;
+        since?: Date;
+    }): Promise<RuntimeLogResult>;
+}
+export {};

package/dist/runtime/service.d.ts

@@ -0,0 +1,32 @@
+import type { CloudConfig, CloudDriver, EnvironmentType } from '@ts-cloud/core';
+import type { ECSClient, LambdaClient } from '../aws';
+import type { RuntimeDiscoveryAdapter, RuntimeDiscoveryContext, RuntimeInventory } from './model';
+interface EcsReader extends Pick<ECSClient, 'listClusters' | 'listServices' | 'describeServices' | 'listTasks' | 'describeTasks'> {
+    describeTaskDefinition?: ECSClient['describeTaskDefinition'];
+}
+interface LambdaReader extends Pick<LambdaClient, 'listFunctions'> {
+}
+export interface RuntimeServiceDependencies {
+    driver?: CloudDriver;
+    ecs?: EcsReader;
+    lambda?: LambdaReader;
+}
+export declare class EcsRuntimeAdapter implements RuntimeDiscoveryAdapter {
+    private readonly client;
+    private readonly prefix;
+    readonly id = "ecs:aws";
+    readonly provider: 'ecs';
+    constructor(client: EcsReader, prefix: string);
+    discover(context: RuntimeDiscoveryContext): Promise<import('./model').RuntimeWorkload[]>;
+}
+export declare class LambdaRuntimeAdapter implements RuntimeDiscoveryAdapter {
+    private readonly client;
+    private readonly prefix;
+    readonly id = "lambda:aws";
+    readonly provider: 'lambda';
+    constructor(client: LambdaReader, prefix: string);
+    discover(context: RuntimeDiscoveryContext): Promise<import('./model').RuntimeWorkload[]>;
+}
+export declare function createRuntimeAdapters(config: CloudConfig, environment: EnvironmentType, dependencies?: RuntimeServiceDependencies): Promise<RuntimeDiscoveryAdapter[]>;
+export declare function resolveRuntimeInventory(config: CloudConfig, environment: EnvironmentType, dependencies?: RuntimeServiceDependencies): Promise<RuntimeInventory>;
+export {};

package/dist/runtime/streams.d.ts

@@ -0,0 +1,49 @@
+export type RuntimeStreamKind = 'exec' | 'logs';
+export type RuntimeStreamState = 'open' | 'complete' | 'failed' | 'cancelled';
+export interface RuntimeStreamChunk {
+    cursor: number;
+    stream: 'stdout' | 'stderr' | 'system';
+    data: string;
+    at: string;
+}
+export interface RuntimeStreamSnapshot {
+    id: string;
+    workloadId: string;
+    kind: RuntimeStreamKind;
+    state: RuntimeStreamState;
+    chunks: RuntimeStreamChunk[];
+    cursor: number;
+    reset: boolean;
+    droppedBytes: number;
+    createdAt: string;
+    updatedAt: string;
+    error?: string;
+}
+export interface RuntimeStreamRegistryOptions {
+    maxBufferBytes?: number;
+    ttlMs?: number;
+    now?: () => Date;
+}
+/**
+ * Bounded, reconnectable runtime output. Cursors are monotonically increasing
+ * chunk IDs: clients can reconnect with their last cursor, and receive a reset
+ * signal when backpressure already evicted older chunks.
+ */
+export declare class RuntimeStreamRegistry {
+    private readonly records;
+    private readonly maxBufferBytes;
+    private readonly ttlMs;
+    private readonly now;
+    constructor(options?: RuntimeStreamRegistryOptions);
+    create(kind: RuntimeStreamKind, workloadId: string): RuntimeStreamSnapshot;
+    signal(id: string): AbortSignal | undefined;
+    append(id: string, data: string, stream?: RuntimeStreamChunk['stream']): RuntimeStreamSnapshot | undefined;
+    read(id: string, workloadId: string, after?: number): RuntimeStreamSnapshot | undefined;
+    close(id: string, state?: Exclude<RuntimeStreamState, 'open'>, error?: string): RuntimeStreamSnapshot | undefined;
+    cancel(id: string, workloadId: string): RuntimeStreamSnapshot | undefined;
+    subscribe(id: string, workloadId: string, listener: (snapshot: RuntimeStreamSnapshot) => void): (() => void) | undefined;
+    sweep(): number;
+    clear(): void;
+    private snapshot;
+    private publish;
+}

package/dist/security/artifacts.d.ts

@@ -0,0 +1,105 @@
+import type { JsonValue } from '../control-plane';
+import type { SecurityPostureStore } from './posture-store';
+import type { ReleaseSecurityArtifact, SecurityPostureFinding } from './types';
+export interface CycloneDxComponent {
+    type: 'application' | 'library' | 'container';
+    name: string;
+    version: string;
+    purl?: string;
+    scope?: 'required' | 'optional' | 'excluded';
+    hashes?: Array<{
+        alg: 'SHA-256';
+        content: string;
+    }>;
+}
+export interface CycloneDxDocument {
+    bomFormat: 'CycloneDX';
+    specVersion: '1.5';
+    serialNumber: string;
+    version: 1;
+    metadata: {
+        timestamp: string;
+        component: CycloneDxComponent;
+        tools: Array<{
+            vendor: string;
+            name: string;
+            version: string;
+        }>;
+    };
+    components: CycloneDxComponent[];
+}
+export interface ReleaseProvenance {
+    _type: 'https://in-toto.io/Statement/v1';
+    subject: Array<{
+        name: string;
+        digest: {
+            sha256: string;
+        };
+    }>;
+    predicateType: 'https://slsa.dev/provenance/v1';
+    predicate: {
+        buildDefinition: {
+            buildType: string;
+            externalParameters: JsonValue;
+            internalParameters: JsonValue;
+            resolvedDependencies: JsonValue[];
+        };
+        runDetails: {
+            builder: {
+                id: string;
+            };
+            metadata: {
+                invocationId: string;
+                startedOn: string;
+                finishedOn: string;
+            };
+        };
+    };
+}
+/** Creates a deterministic local-only CycloneDX document from the release package manifest. */
+export declare function generateCycloneDxSbom(root: string, options?: {
+    now?: Date;
+    serial?: string;
+}): CycloneDxDocument;
+/** Uses a local Syft binary for full image inventory; no report or source is sent to a service. */
+export declare function generateImageSbom(imageRef: string, options?: {
+    executable?: string;
+    signal?: AbortSignal;
+}): Promise<CycloneDxDocument>;
+export declare function attachSbomToRelease(posture: SecurityPostureStore, scope: {
+    organizationId: string;
+    projectId: string;
+    environmentId?: string;
+    releaseId: string;
+}, sbom: CycloneDxDocument): ReleaseSecurityArtifact;
+export declare function attachVulnerabilitySummary(posture: SecurityPostureStore, scope: {
+    organizationId: string;
+    projectId: string;
+    environmentId?: string;
+    releaseId: string;
+}, findings: SecurityPostureFinding[]): ReleaseSecurityArtifact;
+export declare function createReleaseProvenance(input: {
+    artifactName: string;
+    artifact?: string | Uint8Array;
+    artifactSha256?: string;
+    invocationId: string;
+    startedAt: string;
+    completedAt: string;
+    externalParameters?: JsonValue;
+    resolvedDependencies?: JsonValue[];
+}): ReleaseProvenance;
+export declare function attachProvenanceToRelease(posture: SecurityPostureStore, scope: {
+    organizationId: string;
+    projectId: string;
+    environmentId?: string;
+    releaseId: string;
+}, provenance: ReleaseProvenance): ReleaseSecurityArtifact;
+export declare function verifyArtifactSignature(input: {
+    artifact: string | Uint8Array;
+    expectedSha256: string;
+    signature?: string;
+    publicKey?: string;
+}): {
+    digestValid: boolean;
+    signature: 'verified' | 'invalid' | 'not_configured';
+};

package/dist/security/artifacts.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/security/container-release.d.ts

@@ -0,0 +1,35 @@
+import type { JsonValue } from '../control-plane';
+import type { CycloneDxDocument } from './artifacts';
+import type { SecurityPostureStore } from './posture-store';
+import type { SecurityScanner } from './scanners';
+import type { SecurityScope } from './types';
+import { SecurityScannerRunner } from './scanners';
+export interface SecureContainerReleaseInput {
+    scope: SecurityScope & {
+        projectId: string;
+        environmentId: string;
+    };
+    releaseId: string;
+    imageRef: string;
+    imageSha256?: string;
+    artifactRoot: string;
+    invocationId: string;
+    startedAt: string;
+    completedAt?: string;
+    externalParameters?: JsonValue;
+    scanner?: SecurityScanner;
+    scannerTimeoutMs?: number;
+    sbomTimeoutMs?: number;
+    generateImageSbom?: (imageRef: string, options: {
+        signal?: AbortSignal;
+    }) => Promise<CycloneDxDocument>;
+}
+/**
+ * Produces the security record for a built container without sending image or
+ * source data to a hosted service. Optional local tooling may be absent: that
+ * state is persisted and a manifest SBOM is used when possible.
+ */
+export declare function secureContainerRelease(_posture: SecurityPostureStore, _input: SecureContainerReleaseInput): Promise<{
+    scan: Awaited<ReturnType<SecurityScannerRunner['run']>>;
+    sbomSource: 'image' | 'manifest' | 'unavailable';
+}>;

package/dist/security/container-release.test.d.ts

@@ -0,0 +1 @@
+export {};