@vibesdotdev/forge 0.0.0-stage → 1.0.0-rc.4

package/dist/ci/forge-contract.js

@@ -0,0 +1,771 @@
+import * as z from 'zod/v4';
+import { DEFAULT_FORGE_ACTIONS_JOB_TIMEOUT_MINUTES, DEFAULT_FORGE_ACTIONS_RUNNER_PROFILE, ForgeRunnerProfileIdSchema, MAX_FORGE_ACTIONS_JOB_TIMEOUT_MINUTES } from "../schemas/actions.js";
+import { ForgeCiJobCachePlanSchema } from "./cache-plan.js";
+import { CiCommitShaSchema, CiExecutionLeaseRenewalRequestSchema, CiExecutionLeaseSchema } from "./runs/schemas.js";
+export const ForgeCiRunsOnSchema = z.object({
+    os: z.enum(['linux', 'macos', 'windows']),
+    arch: z.enum(['amd64', 'arm64'])
+});
+/** Provider-neutral capacity label resolved by the Forge scheduler. */
+export const ForgeCiRunnerProfileSchema = ForgeRunnerProfileIdSchema;
+/** Absolute whole-job deadline. Distinct from the legacy per-command `timeoutMs`. */
+export const ForgeCiJobTimeoutSecondsSchema = z
+    .number()
+    .int()
+    .positive()
+    .max(MAX_FORGE_ACTIONS_JOB_TIMEOUT_MINUTES * 60);
+/**
+ * Canonical, credential-free Git data-plane identity. Forge/API control-plane
+ * URLs remain HTTPS; every CI source checkout uses repository-scoped SSH.
+ */
+export const ForgeCiCloneUrlSchema = z
+    .string()
+    .url()
+    .refine((value) => {
+    const parsed = new URL(value);
+    return (parsed.protocol === 'ssh:' &&
+        parsed.username === 'git' &&
+        parsed.password === '' &&
+        parsed.hostname === 'git.vibes.dev' &&
+        parsed.port === '' &&
+        /^\/[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+\.git$/.test(parsed.pathname) &&
+        parsed.search === '' &&
+        parsed.hash === '' &&
+        value === `ssh://git@git.vibes.dev${parsed.pathname}`);
+}, 'expected canonical ssh://git@git.vibes.dev/<owner>/<repo>.git clone URL');
+export const ForgeCiReleaseSshCloneUrlSchema = ForgeCiCloneUrlSchema;
+const ForgeCiReleasePackageDirectorySchema = z
+    .string()
+    .min(1)
+    .max(240)
+    .refine((directory) => {
+    if (directory === '.')
+        return true;
+    if (directory.startsWith('/') || directory.endsWith('/'))
+        return false;
+    if (!/^[A-Za-z0-9._/-]+$/.test(directory))
+        return false;
+    const segments = directory.split('/');
+    return segments.every((segment) => segment !== '' && segment !== '.' && segment !== '..' && segment !== '.git');
+}, 'expected a normalized repository-relative package directory');
+export const ForgeCiReleasePackageSchema = z.object({
+    directory: ForgeCiReleasePackageDirectorySchema,
+    packageName: z.string().min(1),
+    version: z.string().min(1)
+});
+/** Exact non-secret owner source persisted before any credential is minted. */
+export const ForgeCiReleaseSourceSchema = z.object({
+    repositoryId: z.string().min(1),
+    cloneUrl: ForgeCiReleaseSshCloneUrlSchema,
+    sha: CiCommitShaSchema
+});
+/** A package in dependency-first build order and the exact source that owns it. */
+export const ForgeCiReleasePlanPackageSchema = ForgeCiReleasePackageSchema.extend({
+    sourceRepositoryId: z.string().min(1)
+});
+export const ForgeCiReleaseSourceCheckoutSchema = z.object({
+    sourceRepositoryId: z.string().min(1),
+    directory: ForgeCiReleasePackageDirectorySchema
+});
+/**
+ * Exact immutable Bun lock authority and the checkout layout it governs. The
+ * worker clones this source as the workspace root, verifies the digest from the
+ * sealed commit, then places each package source at its declared nested path.
+ */
+export const ForgeCiReleaseLockAuthoritySchema = z.object({
+    source: ForgeCiReleaseSourceSchema,
+    workspaceManifestPath: ForgeCiReleasePackageDirectorySchema.refine((path) => path !== '.', 'release workspace manifest must be a committed relative file path'),
+    workspaceManifestSha256: z.string().regex(/^[0-9a-f]{64}$/),
+    lockfilePath: ForgeCiReleasePackageDirectorySchema.refine((path) => path !== '.', 'release lockfile must be a committed relative file path'),
+    lockfileSha256: z.string().regex(/^[0-9a-f]{64}$/),
+    sourceCheckouts: z.array(ForgeCiReleaseSourceCheckoutSchema).min(1).max(16)
+});
+const ForgeCiReleasePlanPackagesSchema = z.array(ForgeCiReleasePlanPackageSchema).min(1).max(256);
+const ForgeCiReleaseWorkspaceFields = {
+    sources: z.array(ForgeCiReleaseSourceSchema).min(1).max(16),
+    /** Exact Registry output set eligible for release grants and outputs. */
+    packages: ForgeCiReleasePlanPackagesSchema,
+    lock: ForgeCiReleaseLockAuthoritySchema
+};
+/**
+ * Legacy release attempts had no explicit contract version and used packages
+ * as both the build plan and output set. Keep that wire readable forever; the
+ * transform is idempotent so persisted normalized attempts can be reparsed.
+ */
+const ForgeCiReleaseWorkspaceV1Schema = z
+    .object({
+    ...ForgeCiReleaseWorkspaceFields,
+    contractVersion: z.literal(1).optional(),
+    buildPackages: ForgeCiReleasePlanPackagesSchema.optional()
+})
+    .superRefine((workspace, context) => {
+    if (workspace.buildPackages !== undefined &&
+        JSON.stringify(workspace.buildPackages) !== JSON.stringify(workspace.packages)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['buildPackages'],
+            message: 'release workspace v1 buildPackages must equal packages'
+        });
+    }
+})
+    .transform((workspace) => ({
+    ...workspace,
+    contractVersion: 1,
+    buildPackages: workspace.packages
+}));
+/** V2 separates the complete dependency-first build closure from outputs. */
+const ForgeCiReleaseWorkspaceV2Schema = z.object({
+    ...ForgeCiReleaseWorkspaceFields,
+    contractVersion: z.literal(2),
+    buildPackages: ForgeCiReleasePlanPackagesSchema
+});
+export const ForgeCiReleaseWorkspaceSchema = z
+    .union([ForgeCiReleaseWorkspaceV2Schema, ForgeCiReleaseWorkspaceV1Schema])
+    .superRefine((workspace, context) => {
+    const sourceIds = new Set();
+    const cloneUrls = new Set();
+    for (const [index, source] of workspace.sources.entries()) {
+        if (sourceIds.has(source.repositoryId)) {
+            context.addIssue({
+                code: 'custom',
+                path: ['sources', index, 'repositoryId'],
+                message: 'release source repositoryId must be unique'
+            });
+        }
+        if (cloneUrls.has(source.cloneUrl)) {
+            context.addIssue({
+                code: 'custom',
+                path: ['sources', index, 'cloneUrl'],
+                message: 'release source cloneUrl must identify a unique repository'
+            });
+        }
+        sourceIds.add(source.repositoryId);
+        cloneUrls.add(source.cloneUrl);
+    }
+    const lockSourcePackage = workspace.sources.find((source) => source.repositoryId === workspace.lock.source.repositoryId);
+    const lockSourceCheckout = workspace.lock.sourceCheckouts.find((checkout) => checkout.sourceRepositoryId === workspace.lock.source.repositoryId);
+    const lockSourceOwnsRootPackage = Boolean(lockSourcePackage &&
+        lockSourcePackage.cloneUrl === workspace.lock.source.cloneUrl &&
+        lockSourcePackage.sha === workspace.lock.source.sha &&
+        lockSourceCheckout?.directory === '.');
+    if (sourceIds.has(workspace.lock.source.repositoryId) && !lockSourceOwnsRootPackage) {
+        context.addIssue({
+            code: 'custom',
+            path: ['lock', 'source', 'repositoryId'],
+            message: 'release lock authority may own a package source only at the lock workspace root'
+        });
+    }
+    if (cloneUrls.has(workspace.lock.source.cloneUrl) && !lockSourceOwnsRootPackage) {
+        context.addIssue({
+            code: 'custom',
+            path: ['lock', 'source', 'cloneUrl'],
+            message: 'release lock authority may identify a package source only at the lock workspace root'
+        });
+    }
+    if (workspace.lock.workspaceManifestPath === workspace.lock.lockfilePath) {
+        context.addIssue({
+            code: 'custom',
+            path: ['lock', 'lockfilePath'],
+            message: 'release workspace manifest and lockfile paths must be distinct'
+        });
+    }
+    const checkoutSourceIds = new Set();
+    const checkoutDirectories = [];
+    for (const [index, checkout] of workspace.lock.sourceCheckouts.entries()) {
+        if (!sourceIds.has(checkout.sourceRepositoryId)) {
+            context.addIssue({
+                code: 'custom',
+                path: ['lock', 'sourceCheckouts', index, 'sourceRepositoryId'],
+                message: 'release source checkout must reference a declared package source'
+            });
+        }
+        if (checkoutSourceIds.has(checkout.sourceRepositoryId)) {
+            context.addIssue({
+                code: 'custom',
+                path: ['lock', 'sourceCheckouts', index, 'sourceRepositoryId'],
+                message: 'release package source must have exactly one checkout location'
+            });
+        }
+        if (checkoutDirectories.some((directory) => directory === '.' ||
+            checkout.directory === '.' ||
+            directory === checkout.directory ||
+            directory.startsWith(`${checkout.directory}/`) ||
+            checkout.directory.startsWith(`${directory}/`))) {
+            context.addIssue({
+                code: 'custom',
+                path: ['lock', 'sourceCheckouts', index, 'directory'],
+                message: 'release source checkout directories must be unique and non-overlapping'
+            });
+        }
+        checkoutSourceIds.add(checkout.sourceRepositoryId);
+        checkoutDirectories.push(checkout.directory);
+    }
+    for (const sourceId of sourceIds) {
+        if (!checkoutSourceIds.has(sourceId)) {
+            context.addIssue({
+                code: 'custom',
+                path: ['lock', 'sourceCheckouts'],
+                message: `release package source ${sourceId} has no lock workspace checkout`
+            });
+        }
+    }
+    const packageKey = (releasePackage) => `${releasePackage.sourceRepositoryId}\0${releasePackage.directory}\0${releasePackage.packageName}\0${releasePackage.version}`;
+    const validatePackages = (packages, field, label) => {
+        const packageNames = new Set();
+        const packageLocations = new Set();
+        for (const [index, releasePackage] of packages.entries()) {
+            if (!sourceIds.has(releasePackage.sourceRepositoryId)) {
+                context.addIssue({
+                    code: 'custom',
+                    path: [field, index, 'sourceRepositoryId'],
+                    message: `${label} package must reference a declared source repositoryId`
+                });
+            }
+            if (packageNames.has(releasePackage.packageName)) {
+                context.addIssue({
+                    code: 'custom',
+                    path: [field, index, 'packageName'],
+                    message: `${label} packageName must be unique`
+                });
+            }
+            const location = `${releasePackage.sourceRepositoryId}\0${releasePackage.directory}`;
+            if (packageLocations.has(location)) {
+                context.addIssue({
+                    code: 'custom',
+                    path: [field, index, 'directory'],
+                    message: `${label} package source directory must be unique`
+                });
+            }
+            packageNames.add(releasePackage.packageName);
+            packageLocations.add(location);
+        }
+    };
+    validatePackages(workspace.buildPackages, 'buildPackages', 'release build');
+    validatePackages(workspace.packages, 'packages', 'release publish');
+    const buildPackageKeys = new Set(workspace.buildPackages.map(packageKey));
+    for (const [index, releasePackage] of workspace.packages.entries()) {
+        if (!buildPackageKeys.has(packageKey(releasePackage))) {
+            context.addIssue({
+                code: 'custom',
+                path: ['packages', index],
+                message: 'release publish package must be an exact member of buildPackages'
+            });
+        }
+    }
+});
+function validateReleaseProjection(input, context) {
+    const hasPackages = Boolean(input.releasePackages?.length);
+    const hasWorkspace = input.releaseWorkspace !== undefined;
+    if (hasPackages !== hasWorkspace) {
+        context.addIssue({
+            code: 'custom',
+            path: hasPackages ? ['releaseWorkspace'] : ['releasePackages'],
+            message: 'releasePackages and releaseWorkspace must be declared together'
+        });
+        return;
+    }
+    if (!input.releasePackages || !input.releaseWorkspace)
+        return;
+    const anchor = input.releaseWorkspace.sources.find((source) => source.repositoryId === input.repositoryId);
+    if (!anchor) {
+        context.addIssue({
+            code: 'custom',
+            path: ['releaseWorkspace', 'sources'],
+            message: 'release workspace must contain the execution anchor repositoryId'
+        });
+    }
+    else if (anchor.cloneUrl !== input.cloneUrl || anchor.sha !== input.sha) {
+        context.addIssue({
+            code: 'custom',
+            path: ['releaseWorkspace', 'sources'],
+            message: 'release workspace anchor source must match execution cloneUrl and sha'
+        });
+    }
+    const seenOutputs = new Set();
+    for (const [index, output] of input.releasePackages.entries()) {
+        const outputKey = `${output.directory}\0${output.packageName}\0${output.version}`;
+        if (seenOutputs.has(outputKey)) {
+            context.addIssue({
+                code: 'custom',
+                path: ['releasePackages', index],
+                message: 'release output package must be unique'
+            });
+        }
+        seenOutputs.add(outputKey);
+        const planned = input.releaseWorkspace.packages.find((candidate) => candidate.sourceRepositoryId === input.repositoryId &&
+            candidate.directory === output.directory &&
+            candidate.packageName === output.packageName &&
+            candidate.version === output.version);
+        if (!planned) {
+            context.addIssue({
+                code: 'custom',
+                path: ['releasePackages', index],
+                message: 'release output must be an exact package owned by the execution anchor source'
+            });
+        }
+    }
+}
+/**
+ * Secret-free durable input owned by the synchronous Registry release
+ * executor. The credential is materialized only at delivery; the clone URL is
+ * immutable execution authority and therefore persists with the attempt.
+ */
+export const ForgeCiReleaseDispatchPayloadSchema = z
+    .object({
+    jobId: z.literal('registry-release-package'),
+    repositoryId: z.string().min(1),
+    cloneUrl: ForgeCiReleaseSshCloneUrlSchema,
+    sha: CiCommitShaSchema,
+    releasePackages: z.array(ForgeCiReleasePackageSchema).min(1),
+    releaseWorkspace: ForgeCiReleaseWorkspaceSchema
+})
+    .superRefine(validateReleaseProjection);
+export const ForgeCiReleaseAttestationSchema = ForgeCiReleasePackageSchema.extend({
+    integrity: z.string().min(1)
+});
+/**
+ * Registry key material the Platform issuer mints at dispatch time and the
+ * execution surface materializes only inside the running attempt. Durable
+ * attempt inputs stay secret-free (see ForgeCiReleaseDispatchPayloadSchema);
+ * this wire travels the resolved-lease path (ForgeCiExecuteOptions.extras)
+ * instead. The issuer resolves REGISTRY_READ_TOKENS / REGISTRY_PUBLISH_TOKEN
+ * from the managed store; the executor converts the material into the
+ * npm-layer VIBES_REGISTRY_TOKEN env var for install/publish steps and never
+ * logs it.
+ */
+export const ForgeCiRegistryKeyMaterialSchema = z
+    .object({
+    registryUrl: z.string().url(),
+    readJwt: z.string().min(1).optional(),
+    publishJwt: z.string().min(1).optional()
+})
+    .refine((material) => material.readJwt !== undefined || material.publishJwt !== undefined, 'issued registry key material must carry at least one scoped JWT');
+export const ForgeCiStepSchema = z.object({
+    command: z.array(z.string()).min(1)
+});
+export const ForgeCiArtifactsSchema = z
+    .array(z
+    .string()
+    .min(1)
+    .max(240)
+    .refine((path) => !path.startsWith('/') &&
+    path !== '.' &&
+    !path.split('/').includes('..') &&
+    path !== '.git' &&
+    !path.startsWith('.git/') &&
+    /^[A-Za-z0-9._/-]+$/.test(path), 'expected a safe repository-relative artifact path'))
+    .max(64);
+export const ForgeCiRunRequestSchema = z
+    .object({
+    repositoryId: z.string().min(1),
+    cloneUrl: ForgeCiCloneUrlSchema,
+    jobId: z.string().min(1),
+    sha: CiCommitShaSchema,
+    steps: z.array(ForgeCiStepSchema),
+    runsOn: ForgeCiRunsOnSchema.optional(),
+    runnerProfile: ForgeCiRunnerProfileSchema.default(DEFAULT_FORGE_ACTIONS_RUNNER_PROFILE),
+    jobTimeoutSeconds: ForgeCiJobTimeoutSecondsSchema.default(DEFAULT_FORGE_ACTIONS_JOB_TIMEOUT_MINUTES * 60),
+    /** Per-command timeout retained for step-level execution policy. */
+    timeoutMs: z.number().int().positive().optional(),
+    releasePackages: z.array(ForgeCiReleasePackageSchema).min(1).optional(),
+    releaseWorkspace: ForgeCiReleaseWorkspaceSchema.optional(),
+    artifacts: ForgeCiArtifactsSchema.optional(),
+    /**
+     * Typed per-job cache plans compiled by `compileJobCaches`. Absent when
+     * the job declared no effective cache, so a caches-free request stays
+     * byte-compatible with requests built before cache support.
+     */
+    caches: z.array(ForgeCiJobCachePlanSchema).max(64).optional(),
+    prNumber: z.number().int().positive().nullable().optional(),
+    event: z.enum(['pr', 'push']).optional(),
+    ciRunId: z.string().uuid(),
+    ciAttemptId: z.string().uuid(),
+    ciAttemptVersion: z.number().int().nonnegative(),
+    ciExecutionLeaseId: z.string().uuid()
+})
+    .superRefine((request, context) => {
+    validateReleaseProjection(request, context);
+    if (request.steps.length === 0 && !request.releasePackages?.length) {
+        context.addIssue({
+            code: 'custom',
+            path: ['steps'],
+            message: 'ordinary CI requests require at least one command step'
+        });
+    }
+    if (request.artifacts?.length && request.releasePackages?.length) {
+        context.addIssue({
+            code: 'custom',
+            path: ['artifacts'],
+            message: 'release packaging requests cannot declare CI artifacts'
+        });
+    }
+    if (request.caches?.some((cache) => cache.jobId !== request.jobId)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['caches'],
+            message: 'cache plans must belong to the requested job'
+        });
+    }
+});
+/**
+ * Immutable, credential-free repository execution authorized by the durable
+ * attempt. The worker must present this exact projection when it claims a lease;
+ * the shared service credential authenticates the worker, but does not authorize
+ * caller-shaped commands.
+ */
+export const ForgeCiExecutionPayloadSchema = z
+    .object({
+    repositoryId: z.string().min(1),
+    cloneUrl: ForgeCiCloneUrlSchema,
+    jobId: z.string().min(1),
+    sha: CiCommitShaSchema,
+    steps: z.array(ForgeCiStepSchema),
+    runsOn: ForgeCiRunsOnSchema.optional(),
+    runnerProfile: ForgeCiRunnerProfileSchema.default(DEFAULT_FORGE_ACTIONS_RUNNER_PROFILE),
+    jobTimeoutSeconds: ForgeCiJobTimeoutSecondsSchema.default(DEFAULT_FORGE_ACTIONS_JOB_TIMEOUT_MINUTES * 60),
+    /** Per-command timeout retained for step-level execution policy. */
+    timeoutMs: z.number().int().positive().optional(),
+    releasePackages: z.array(ForgeCiReleasePackageSchema).min(1).optional(),
+    releaseWorkspace: ForgeCiReleaseWorkspaceSchema.optional(),
+    artifacts: ForgeCiArtifactsSchema.optional(),
+    /**
+     * Typed per-job cache plans compiled by `compileJobCaches`. Absent when
+     * the job declared no effective cache, so a caches-free payload stays
+     * byte-compatible with payloads built before cache support.
+     */
+    caches: z.array(ForgeCiJobCachePlanSchema).max(64).optional()
+})
+    .superRefine((execution, context) => {
+    validateReleaseProjection(execution, context);
+    if (execution.steps.length === 0 && !execution.releasePackages?.length) {
+        context.addIssue({
+            code: 'custom',
+            path: ['steps'],
+            message: 'ordinary CI executions require at least one command step'
+        });
+    }
+    if (execution.artifacts?.length && execution.releasePackages?.length) {
+        context.addIssue({
+            code: 'custom',
+            path: ['artifacts'],
+            message: 'release packaging executions cannot declare CI artifacts'
+        });
+    }
+    if (execution.caches?.some((cache) => cache.jobId !== execution.jobId)) {
+        context.addIssue({
+            code: 'custom',
+            path: ['caches'],
+            message: 'cache plans must belong to the execution job'
+        });
+    }
+});
+export function forgeCiExecutionPayload(request) {
+    return ForgeCiExecutionPayloadSchema.parse(request);
+}
+export function forgeCiRunIdentity(request) {
+    return `forge-ci/attempt/${request.ciAttemptId}`;
+}
+/**
+ * Where a suspended execution resumes.
+ *
+ * A queue consumer runs one CI job in slices bounded well below its wall-clock
+ * ceiling. When a slice ends with the job still live, the executor returns a
+ * non-terminal result carrying this cursor and the consumer re-enqueues it, so
+ * the next invocation continues the same execution rather than starting a
+ * second one. `slice` is how many invocations the job has already consumed —
+ * it bounds runaway continuation independently of the job deadline.
+ *
+ * The cursor stays small on purpose. Logs are not carried here: a fleet host
+ * action owns its own log on the platform, and the sandbox keeps the workspace
+ * alive across slices because the sandbox id is derived from the attempt.
+ */
+export const ForgeCiExecutionResumeSchema = z.object({
+    slice: z.number().int().positive(),
+    /**
+     * The attempt state the suspending slice held.
+     *
+     * A resumed slice must NOT re-claim: the attempt is already `running` and
+     * already holds this executor's lease, and a fresh claim presents a
+     * different `claimedAt`, which the state machine correctly rejects as two
+     * executors reusing one lease id. The claim 409s, the consumer returns
+     * without starting a heartbeat, and the lease expires with the job still
+     * running — the exact failure this whole mechanism exists to end. Carrying
+     * the version and generation forward lets the next slice renew what it
+     * already owns instead.
+     */
+    attemptVersion: z.number().int().nonnegative().optional(),
+    leaseGeneration: z.number().int().positive().optional(),
+    /** Fleet: the already-queued host action to keep polling, never re-queue. */
+    hostActionRunId: z.string().min(1).optional(),
+    /** Sandbox: the first step not yet known to have passed. */
+    fromStepIndex: z.number().int().nonnegative().optional(),
+    /**
+     * Sandbox: the workspace is checked out and the next slice must not redo it.
+     *
+     * A slice can end before bootstrap finishes — a cold container can hold the
+     * very first call for the whole invocation — and that slice leaves nothing
+     * behind. Resuming on slice number alone would skip prep and checkout and run
+     * the repository's steps against an empty directory.
+     */
+    workspaceReady: z.boolean().optional()
+});
+export const ForgeCiRunResultSchema = z.object({
+    jobId: z.string().min(1),
+    sha: CiCommitShaSchema,
+    state: z.enum(['success', 'failure', 'error', 'pending']),
+    description: z.string(),
+    output: z.string(),
+    exitCode: z.number().int().optional(),
+    retryableBootstrap: z.boolean().optional(),
+    /**
+     * Present only with `state: 'pending'`: the execution is still live and the
+     * consumer must re-enqueue it rather than terminalize the attempt.
+     */
+    resume: ForgeCiExecutionResumeSchema.optional(),
+    artifactsRef: z.string().min(1).optional(),
+    releaseAttestations: z.array(ForgeCiReleaseAttestationSchema).optional()
+});
+/**
+ * Worker claim intent. The control plane owns every timestamp: it resolves the
+ * absolute deadline from the persisted job policy and starts short liveness at
+ * claim receipt, then returns the accepted canonical lease.
+ */
+export const ForgeCiClaimRequestSchema = z
+    .object({
+    repositoryId: z.string().min(1),
+    ciRunId: z.string().uuid(),
+    ciAttemptId: z.string().uuid(),
+    ciAttemptVersion: z.number().int().nonnegative(),
+    ciExecutionLeaseId: z.string().uuid(),
+    executorId: z.string().min(1),
+    context: z.string().min(1),
+    sha: CiCommitShaSchema,
+    execution: ForgeCiExecutionPayloadSchema
+})
+    .strict();
+export const ForgeCiClaimResponseSchema = z.discriminatedUnion('claimed', [
+    z
+        .object({
+        claimed: z.literal(true),
+        attemptVersion: z.number().int().nonnegative(),
+        status: z.literal('running'),
+        lease: CiExecutionLeaseSchema
+    })
+        .strict(),
+    z
+        .object({
+        claimed: z.literal(false),
+        attemptVersion: z.number().int().nonnegative(),
+        status: z.enum(['cancelling', 'cancelled', 'terminal'])
+    })
+        .strict()
+]);
+export const ForgeCiExecutionAuthoritySchema = z.object({
+    repositoryId: z.string().min(1),
+    ciRunId: z.string().uuid(),
+    ciAttemptId: z.string().uuid(),
+    ciExecutionLeaseId: z.string().uuid()
+});
+/** Canonical worker → control-plane heartbeat for one claimed attempt. */
+export const ForgeCiExecutionLeaseRenewalRequestSchema = ForgeCiExecutionAuthoritySchema.extend({
+    ciAttemptVersion: CiExecutionLeaseRenewalRequestSchema.shape.expectedVersion,
+    executorId: CiExecutionLeaseRenewalRequestSchema.shape.executorId,
+    expectedGeneration: CiExecutionLeaseRenewalRequestSchema.shape.expectedGeneration
+}).strict();
+export const ForgeCiExecutionLeaseRenewalResponseSchema = z
+    .object({
+    renewed: z.literal(true),
+    attemptVersion: z.number().int().nonnegative(),
+    lease: CiExecutionLeaseSchema
+})
+    .strict();
+export function forgeCiExecutionAuthority(request) {
+    return ForgeCiExecutionAuthoritySchema.parse(request);
+}
+/** One immutable repository source that the claimed CI attempt may check out. */
+export const ForgeCiSshCheckoutSchema = z
+    .object({
+    role: z.enum(['lock-source', 'package-source']),
+    repositoryId: z.string().min(1).max(256),
+    cloneUrl: ForgeCiCloneUrlSchema,
+    sha: CiCommitShaSchema
+})
+    .strict();
+/**
+ * Project the sealed release workspace into the one checkout list used by both
+ * Platform lease authority and the executor. A singleton repository can own
+ * its lock and its root package bytes; that source is checked out once with
+ * lock-source authority, never cloned over itself as a second package source.
+ */
+export function forgeCiReleaseSshCheckouts(workspace) {
+    const lockSource = workspace.lock.source;
+    return [
+        { role: 'lock-source', ...lockSource },
+        ...workspace.sources
+            .filter((source) => source.repositoryId !== lockSource.repositoryId ||
+            source.cloneUrl !== lockSource.cloneUrl ||
+            source.sha !== lockSource.sha)
+            .map((source) => ({ role: 'package-source', ...source }))
+    ];
+}
+/**
+ * The durable executor asks Platform for keys only after claiming this exact
+ * run/attempt lease. Platform re-derives the checkout set from the persisted
+ * dispatch; these tuples are assertions, never caller-selected authority.
+ */
+export const ForgeCiSshLeaseRequestSchema = z
+    .object({
+    runId: z.string().uuid(),
+    attemptId: z.string().uuid(),
+    attemptLeaseId: z.string().uuid(),
+    executorId: z.string().min(1).max(128),
+    checkouts: z.array(ForgeCiSshCheckoutSchema).min(1).max(17)
+})
+    .strict();
+const ForgeCiSshPublicKeySchema = z
+    .string()
+    .min(1)
+    .max(1024)
+    .regex(/^ssh-ed25519 [A-Za-z0-9+/]+={0,2}$/);
+const ForgeCiSshFingerprintSchema = z
+    .string()
+    .max(128)
+    .regex(/^SHA256:[A-Za-z0-9+/]{43}$/);
+export const ForgeCiSshKnownHostSchema = z
+    .object({
+    hostname: z.literal('git.vibes.dev'),
+    port: z.literal(22),
+    keyType: z.literal('ssh-ed25519'),
+    publicKeyOpenSsh: ForgeCiSshPublicKeySchema,
+    fingerprint: ForgeCiSshFingerprintSchema
+})
+    .strict();
+export const ForgeCiSshKeyLeaseSchema = z
+    .object({
+    kind: z.literal('ssh-key-lease'),
+    role: z.enum(['lock-source', 'package-source']),
+    sshLeaseId: z.string().uuid(),
+    repositoryId: z.string().min(1).max(256),
+    cloneUrl: ForgeCiCloneUrlSchema,
+    privateKeyOpenSsh: z
+        .string()
+        .min(1)
+        .max(32 * 1024)
+        .regex(/^-----BEGIN OPENSSH PRIVATE KEY-----\n[A-Za-z0-9+/=\n]+\n-----END OPENSSH PRIVATE KEY-----\n$/),
+    publicKeyOpenSsh: ForgeCiSshPublicKeySchema,
+    fingerprint: ForgeCiSshFingerprintSchema,
+    scope: z.literal('repo:read'),
+    expiresAt: z.iso.datetime()
+})
+    .strict();
+export const ForgeCiSshKeyLeaseSetSchema = z
+    .object({
+    kind: z.literal('ssh-key-lease-set'),
+    leases: z.array(ForgeCiSshKeyLeaseSchema).min(1).max(17),
+    knownHost: ForgeCiSshKnownHostSchema
+})
+    .strict();
+export const ForgeCiSshLeaseCompletionSchema = z
+    .object({ outcome: z.enum(['succeeded', 'failed']) })
+    .strict();
+/**
+ * The service bearer authenticates the platform caller; this immutable tuple
+ * authorizes which already-claimed execution it may cancel.
+ */
+export const ForgeCiCancelRequestSchema = ForgeCiExecutionAuthoritySchema;
+export const ForgeCiCancellationAuthorizationResponseSchema = z.object({
+    authorized: z.literal(true)
+});
+export const ForgeCiCancelResponseSchema = z.object({
+    executorCancellationRef: z.string().min(1),
+    state: z.literal('stopped'),
+    acknowledgedAt: z.iso.datetime()
+});
+export const ForgeCiCompletionRequestSchema = z.object({
+    repositoryId: z.string().min(1),
+    ciRunId: z.string().uuid(),
+    ciAttemptId: z.string().uuid(),
+    ciAttemptVersion: z.number().int().nonnegative(),
+    ciExecutionLeaseId: z.string().uuid(),
+    state: z.enum(['success', 'failure', 'error']),
+    description: z.string(),
+    exitCode: z.number().int().optional(),
+    logsRef: z.string().min(1).optional(),
+    artifactsRef: z.string().min(1).optional(),
+    releaseAttestations: z.array(ForgeCiReleaseAttestationSchema).optional(),
+    completedAt: z.iso.datetime().optional(),
+    /**
+     * The `infra/compute-source` the attempt actually ran on.
+     *
+     * Reported by the executor rather than looked up from its descriptor,
+     * because billing must follow what really happened. An executor that fell
+     * back to a different machine than its descriptor advertises should be
+     * billed for the machine it used, not the one it was supposed to use — a
+     * static lookup would quietly invoice the wrong rate and look correct.
+     *
+     * Optional: an executor that does not report one is rated by the
+     * `unknownCostHeuristic` floor, which over-bills rather than under-bills.
+     */
+    computeSourceId: z.string().min(1).optional()
+});
+export const ForgeCiExecutionJournalSchema = z.discriminatedUnion('phase', [
+    z.object({
+        phase: z.literal('started'),
+        authority: ForgeCiExecutionAuthoritySchema,
+        deliveryAttempt: z.number().int().positive(),
+        startedAt: z.iso.datetime()
+    }),
+    z.object({
+        phase: z.literal('executing'),
+        authority: ForgeCiExecutionAuthoritySchema,
+        deliveryAttempt: z.number().int().positive(),
+        startedAt: z.iso.datetime(),
+        commandSequence: z.number().int().positive(),
+        commandStartedAt: z.iso.datetime()
+    }),
+    z.object({
+        phase: z.literal('cancelling'),
+        authority: ForgeCiExecutionAuthoritySchema,
+        requestedAt: z.iso.datetime(),
+        wasExecuting: z.boolean(),
+        commandSettled: z.boolean()
+    }),
+    z.object({
+        phase: z.literal('cancelled'),
+        authority: ForgeCiExecutionAuthoritySchema,
+        acknowledgedAt: z.iso.datetime(),
+        executorCancellationRef: z.string().min(1)
+    }),
+    z.object({
+        /**
+         * The run is live but its consumer invocation ended. Exactly one
+         * continuation is authorized, and only for the recorded cursor: a
+         * duplicate delivery carrying a different slice is refused rather than
+         * allowed to start a second execution against the same workspace.
+         */
+        phase: z.literal('suspended'),
+        authority: ForgeCiExecutionAuthoritySchema,
+        deliveryAttempt: z.number().int().positive(),
+        resume: ForgeCiExecutionResumeSchema,
+        suspendedAt: z.iso.datetime()
+    }),
+    z.object({
+        phase: z.literal('retryable-bootstrap'),
+        authority: ForgeCiExecutionAuthoritySchema,
+        nextDeliveryAttempt: z.number().int().positive(),
+        recordedAt: z.iso.datetime()
+    }),
+    z.object({
+        phase: z.literal('completed'),
+        authority: ForgeCiExecutionAuthoritySchema,
+        completion: ForgeCiCompletionRequestSchema,
+        /**
+         * Synchronous canonical executions (currently Registry packaging) retain
+         * their redacted result so a lost HTTP response can be replayed without
+         * running repository commands again.
+         */
+        result: ForgeCiRunResultSchema.optional(),
+        recordedAt: z.iso.datetime()
+    })
+]);
+//# sourceMappingURL=forge-contract.js.map