@vm0/runner 2.3.0 → 2.3.2

package/index.js

@@ -4996,6 +4996,33 @@ var composesVersionsContract = c.router({
     summary: "Resolve version specifier to full version ID"
   }
 });
+var composeListItemSchema = z4.object({
+  name: z4.string(),
+  headVersionId: z4.string().nullable(),
+  updatedAt: z4.string()
+});
+var composesListContract = c.router({
+  /**
+   * GET /api/agent/composes/list?scope={scope}
+   * List all agent composes for a scope
+   * If scope is not provided, uses the authenticated user's default scope
+   */
+  list: {
+    method: "GET",
+    path: "/api/agent/composes/list",
+    query: z4.object({
+      scope: z4.string().optional()
+    }),
+    responses: {
+      200: z4.object({
+        composes: z4.array(composeListItemSchema)
+      }),
+      400: apiErrorSchema,
+      401: apiErrorSchema
+    },
+    summary: "List all agent composes for a scope"
+  }
+});
 
 // ../../packages/core/src/contracts/runs.ts
 import { z as z5 } from "zod";
@@ -6183,6 +6210,919 @@ var runnersJobClaimContract = c10.router({
   }
 });
 
+// ../../packages/core/src/contracts/public/common.ts
+import { z as z15 } from "zod";
+var publicApiErrorTypeSchema = z15.enum([
+  "api_error",
+  // Internal server error (5xx)
+  "invalid_request_error",
+  // Bad parameters (400)
+  "authentication_error",
+  // Auth failure (401)
+  "not_found_error",
+  // Resource missing (404)
+  "conflict_error"
+  // Resource conflict (409)
+]);
+var publicApiErrorSchema = z15.object({
+  error: z15.object({
+    type: publicApiErrorTypeSchema,
+    code: z15.string(),
+    message: z15.string(),
+    param: z15.string().optional(),
+    doc_url: z15.string().url().optional()
+  })
+});
+var paginationSchema = z15.object({
+  has_more: z15.boolean(),
+  next_cursor: z15.string().nullable()
+});
+function createPaginatedResponseSchema(dataSchema) {
+  return z15.object({
+    data: z15.array(dataSchema),
+    pagination: paginationSchema
+  });
+}
+var listQuerySchema = z15.object({
+  cursor: z15.string().optional(),
+  limit: z15.coerce.number().min(1).max(100).default(20)
+});
+var requestIdSchema = z15.string().uuid();
+var timestampSchema = z15.string().datetime();
+
+// ../../packages/core/src/contracts/public/agents.ts
+import { z as z16 } from "zod";
+var c11 = initContract();
+var publicAgentSchema = z16.object({
+  id: z16.string(),
+  name: z16.string(),
+  current_version_id: z16.string().nullable(),
+  created_at: timestampSchema,
+  updated_at: timestampSchema
+});
+var agentVersionSchema = z16.object({
+  id: z16.string(),
+  agent_id: z16.string(),
+  version_number: z16.number(),
+  config: z16.unknown(),
+  // Agent YAML configuration
+  created_at: timestampSchema
+});
+var publicAgentDetailSchema = publicAgentSchema.extend({
+  config: z16.unknown().optional()
+});
+var paginatedAgentsSchema = createPaginatedResponseSchema(publicAgentSchema);
+var paginatedAgentVersionsSchema = createPaginatedResponseSchema(agentVersionSchema);
+var createAgentRequestSchema = z16.object({
+  name: z16.string().min(1).max(100).regex(
+    /^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]$/,
+    "Name must be lowercase alphanumeric with hyphens, not starting or ending with hyphen"
+  ),
+  config: z16.unknown()
+  // Agent YAML configuration
+});
+var updateAgentRequestSchema = z16.object({
+  config: z16.unknown()
+  // New agent configuration (creates new version)
+});
+var publicAgentsListContract = c11.router({
+  list: {
+    method: "GET",
+    path: "/v1/agents",
+    query: listQuerySchema,
+    responses: {
+      200: paginatedAgentsSchema,
+      401: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "List agents",
+    description: "List all agents in the current scope with pagination"
+  },
+  create: {
+    method: "POST",
+    path: "/v1/agents",
+    body: createAgentRequestSchema,
+    responses: {
+      201: publicAgentDetailSchema,
+      400: publicApiErrorSchema,
+      401: publicApiErrorSchema,
+      409: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "Create agent",
+    description: "Create a new agent with the given configuration"
+  }
+});
+var publicAgentByIdContract = c11.router({
+  get: {
+    method: "GET",
+    path: "/v1/agents/:id",
+    pathParams: z16.object({
+      id: z16.string().min(1, "Agent ID is required")
+    }),
+    responses: {
+      200: publicAgentDetailSchema,
+      401: publicApiErrorSchema,
+      404: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "Get agent",
+    description: "Get agent details by ID"
+  },
+  update: {
+    method: "PUT",
+    path: "/v1/agents/:id",
+    pathParams: z16.object({
+      id: z16.string().min(1, "Agent ID is required")
+    }),
+    body: updateAgentRequestSchema,
+    responses: {
+      200: publicAgentDetailSchema,
+      400: publicApiErrorSchema,
+      401: publicApiErrorSchema,
+      404: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "Update agent",
+    description: "Update agent configuration. Creates a new version if config changes."
+  },
+  delete: {
+    method: "DELETE",
+    path: "/v1/agents/:id",
+    pathParams: z16.object({
+      id: z16.string().min(1, "Agent ID is required")
+    }),
+    body: z16.undefined(),
+    responses: {
+      204: z16.undefined(),
+      401: publicApiErrorSchema,
+      404: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "Delete agent",
+    description: "Archive an agent (soft delete)"
+  }
+});
+var publicAgentVersionsContract = c11.router({
+  list: {
+    method: "GET",
+    path: "/v1/agents/:id/versions",
+    pathParams: z16.object({
+      id: z16.string().min(1, "Agent ID is required")
+    }),
+    query: listQuerySchema,
+    responses: {
+      200: paginatedAgentVersionsSchema,
+      401: publicApiErrorSchema,
+      404: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "List agent versions",
+    description: "List all versions of an agent with pagination"
+  }
+});
+
+// ../../packages/core/src/contracts/public/runs.ts
+import { z as z17 } from "zod";
+var c12 = initContract();
+var publicRunStatusSchema = z17.enum([
+  "pending",
+  "running",
+  "completed",
+  "failed",
+  "timeout",
+  "cancelled"
+]);
+var publicRunSchema = z17.object({
+  id: z17.string(),
+  agent_id: z17.string(),
+  agent_name: z17.string(),
+  status: publicRunStatusSchema,
+  prompt: z17.string(),
+  created_at: timestampSchema,
+  started_at: timestampSchema.nullable(),
+  completed_at: timestampSchema.nullable()
+});
+var publicRunDetailSchema = publicRunSchema.extend({
+  output: z17.string().nullable(),
+  error: z17.string().nullable(),
+  execution_time_ms: z17.number().nullable(),
+  checkpoint_id: z17.string().nullable(),
+  session_id: z17.string().nullable(),
+  artifacts: z17.record(z17.string(), z17.string()).optional(),
+  volumes: z17.record(z17.string(), z17.string()).optional()
+});
+var paginatedRunsSchema = createPaginatedResponseSchema(publicRunSchema);
+var createRunRequestSchema = z17.object({
+  // Agent identification (one of: agent, agent_id, session_id, checkpoint_id)
+  agent: z17.string().optional(),
+  // Agent name
+  agent_id: z17.string().optional(),
+  // Agent ID
+  agent_version: z17.string().optional(),
+  // Version specifier (e.g., "latest", "v1", specific ID)
+  // Continue session
+  session_id: z17.string().optional(),
+  // Resume from checkpoint
+  checkpoint_id: z17.string().optional(),
+  // Required
+  prompt: z17.string().min(1, "Prompt is required"),
+  // Optional configuration
+  variables: z17.record(z17.string(), z17.string()).optional(),
+  secrets: z17.record(z17.string(), z17.string()).optional(),
+  artifacts: z17.record(z17.string(), z17.string()).optional(),
+  // artifact_name -> version
+  volumes: z17.record(z17.string(), z17.string()).optional()
+  // volume_name -> version
+});
+var runListQuerySchema = listQuerySchema.extend({
+  agent_id: z17.string().optional(),
+  status: publicRunStatusSchema.optional(),
+  since: timestampSchema.optional()
+});
+var publicRunsListContract = c12.router({
+  list: {
+    method: "GET",
+    path: "/v1/runs",
+    query: runListQuerySchema,
+    responses: {
+      200: paginatedRunsSchema,
+      401: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "List runs",
+    description: "List runs with optional filtering by agent, status, and time"
+  },
+  create: {
+    method: "POST",
+    path: "/v1/runs",
+    body: createRunRequestSchema,
+    responses: {
+      202: publicRunDetailSchema,
+      // Async operation
+      400: publicApiErrorSchema,
+      401: publicApiErrorSchema,
+      404: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "Create run",
+    description: "Create and execute a new agent run. Returns 202 Accepted as runs execute asynchronously."
+  }
+});
+var publicRunByIdContract = c12.router({
+  get: {
+    method: "GET",
+    path: "/v1/runs/:id",
+    pathParams: z17.object({
+      id: z17.string().min(1, "Run ID is required")
+    }),
+    responses: {
+      200: publicRunDetailSchema,
+      401: publicApiErrorSchema,
+      404: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "Get run",
+    description: "Get run details by ID"
+  }
+});
+var publicRunCancelContract = c12.router({
+  cancel: {
+    method: "POST",
+    path: "/v1/runs/:id/cancel",
+    pathParams: z17.object({
+      id: z17.string().min(1, "Run ID is required")
+    }),
+    body: z17.undefined(),
+    responses: {
+      200: publicRunDetailSchema,
+      400: publicApiErrorSchema,
+      // Run not in cancellable state
+      401: publicApiErrorSchema,
+      404: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "Cancel run",
+    description: "Cancel a pending or running execution"
+  }
+});
+var logEntrySchema = z17.object({
+  timestamp: timestampSchema,
+  type: z17.enum(["agent", "system", "network"]),
+  level: z17.enum(["debug", "info", "warn", "error"]),
+  message: z17.string(),
+  metadata: z17.record(z17.string(), z17.unknown()).optional()
+});
+var paginatedLogsSchema = createPaginatedResponseSchema(logEntrySchema);
+var logsQuerySchema = listQuerySchema.extend({
+  type: z17.enum(["agent", "system", "network", "all"]).default("all"),
+  since: timestampSchema.optional(),
+  until: timestampSchema.optional(),
+  order: z17.enum(["asc", "desc"]).default("asc")
+});
+var publicRunLogsContract = c12.router({
+  getLogs: {
+    method: "GET",
+    path: "/v1/runs/:id/logs",
+    pathParams: z17.object({
+      id: z17.string().min(1, "Run ID is required")
+    }),
+    query: logsQuerySchema,
+    responses: {
+      200: paginatedLogsSchema,
+      401: publicApiErrorSchema,
+      404: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "Get run logs",
+    description: "Get unified logs for a run. Combines agent, system, and network logs."
+  }
+});
+var metricPointSchema = z17.object({
+  timestamp: timestampSchema,
+  cpu_percent: z17.number(),
+  memory_used_mb: z17.number(),
+  memory_total_mb: z17.number(),
+  disk_used_mb: z17.number(),
+  disk_total_mb: z17.number()
+});
+var metricsSummarySchema = z17.object({
+  avg_cpu_percent: z17.number(),
+  max_memory_used_mb: z17.number(),
+  total_duration_ms: z17.number().nullable()
+});
+var metricsResponseSchema2 = z17.object({
+  data: z17.array(metricPointSchema),
+  summary: metricsSummarySchema
+});
+var publicRunMetricsContract = c12.router({
+  getMetrics: {
+    method: "GET",
+    path: "/v1/runs/:id/metrics",
+    pathParams: z17.object({
+      id: z17.string().min(1, "Run ID is required")
+    }),
+    responses: {
+      200: metricsResponseSchema2,
+      401: publicApiErrorSchema,
+      404: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "Get run metrics",
+    description: "Get CPU, memory, and disk metrics for a run"
+  }
+});
+var sseEventTypeSchema = z17.enum([
+  "status",
+  // Run status change
+  "output",
+  // Agent output
+  "error",
+  // Error occurred
+  "complete",
+  // Run completed
+  "heartbeat"
+  // Keep-alive
+]);
+var sseEventSchema = z17.object({
+  event: sseEventTypeSchema,
+  data: z17.unknown(),
+  id: z17.string().optional()
+  // For Last-Event-ID reconnection
+});
+var publicRunEventsContract = c12.router({
+  streamEvents: {
+    method: "GET",
+    path: "/v1/runs/:id/events",
+    pathParams: z17.object({
+      id: z17.string().min(1, "Run ID is required")
+    }),
+    query: z17.object({
+      last_event_id: z17.string().optional()
+      // For reconnection
+    }),
+    responses: {
+      200: z17.any(),
+      // SSE stream - actual content is text/event-stream
+      401: publicApiErrorSchema,
+      404: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "Stream run events",
+    description: "Stream real-time events for a run using Server-Sent Events (SSE). Set Accept: text/event-stream header."
+  }
+});
+
+// ../../packages/core/src/contracts/public/artifacts.ts
+import { z as z18 } from "zod";
+var c13 = initContract();
+var publicArtifactSchema = z18.object({
+  id: z18.string(),
+  name: z18.string(),
+  current_version_id: z18.string().nullable(),
+  size: z18.number(),
+  // Total size in bytes
+  file_count: z18.number(),
+  created_at: timestampSchema,
+  updated_at: timestampSchema
+});
+var artifactVersionSchema = z18.object({
+  id: z18.string(),
+  // SHA-256 content hash
+  artifact_id: z18.string(),
+  size: z18.number(),
+  // Size in bytes
+  file_count: z18.number(),
+  message: z18.string().nullable(),
+  // Optional commit message
+  created_by: z18.string(),
+  created_at: timestampSchema
+});
+var publicArtifactDetailSchema = publicArtifactSchema.extend({
+  current_version: artifactVersionSchema.nullable()
+});
+var paginatedArtifactsSchema = createPaginatedResponseSchema(publicArtifactSchema);
+var paginatedArtifactVersionsSchema = createPaginatedResponseSchema(
+  artifactVersionSchema
+);
+var createArtifactRequestSchema = z18.object({
+  name: z18.string().min(1).max(100).regex(
+    /^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]$/,
+    "Name must be lowercase alphanumeric with hyphens, not starting or ending with hyphen"
+  )
+});
+var fileEntrySchema = z18.object({
+  path: z18.string(),
+  size: z18.number(),
+  hash: z18.string().optional()
+  // SHA-256 hash of file content
+});
+var prepareUploadRequestSchema = z18.object({
+  files: z18.array(fileEntrySchema),
+  message: z18.string().optional()
+  // Optional commit message
+});
+var presignedUploadSchema2 = z18.object({
+  path: z18.string(),
+  upload_url: z18.string(),
+  // Presigned S3 URL
+  upload_id: z18.string()
+  // For multi-part uploads
+});
+var prepareUploadResponseSchema = z18.object({
+  upload_session_id: z18.string(),
+  files: z18.array(presignedUploadSchema2),
+  expires_at: timestampSchema
+});
+var commitUploadRequestSchema = z18.object({
+  upload_session_id: z18.string(),
+  message: z18.string().optional()
+});
+var downloadResponseSchema = z18.object({
+  version_id: z18.string(),
+  files: z18.array(
+    z18.object({
+      path: z18.string(),
+      size: z18.number(),
+      download_url: z18.string()
+      // Presigned S3 URL
+    })
+  ),
+  expires_at: timestampSchema
+});
+var publicArtifactsListContract = c13.router({
+  list: {
+    method: "GET",
+    path: "/v1/artifacts",
+    query: listQuerySchema,
+    responses: {
+      200: paginatedArtifactsSchema,
+      401: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "List artifacts",
+    description: "List all artifacts in the current scope with pagination"
+  },
+  create: {
+    method: "POST",
+    path: "/v1/artifacts",
+    body: createArtifactRequestSchema,
+    responses: {
+      201: publicArtifactDetailSchema,
+      400: publicApiErrorSchema,
+      401: publicApiErrorSchema,
+      409: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "Create artifact",
+    description: "Create a new empty artifact container"
+  }
+});
+var publicArtifactByIdContract = c13.router({
+  get: {
+    method: "GET",
+    path: "/v1/artifacts/:id",
+    pathParams: z18.object({
+      id: z18.string().min(1, "Artifact ID is required")
+    }),
+    responses: {
+      200: publicArtifactDetailSchema,
+      401: publicApiErrorSchema,
+      404: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "Get artifact",
+    description: "Get artifact details by ID"
+  },
+  delete: {
+    method: "DELETE",
+    path: "/v1/artifacts/:id",
+    pathParams: z18.object({
+      id: z18.string().min(1, "Artifact ID is required")
+    }),
+    body: z18.undefined(),
+    responses: {
+      204: z18.undefined(),
+      401: publicApiErrorSchema,
+      404: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "Delete artifact",
+    description: "Delete an artifact and all its versions"
+  }
+});
+var publicArtifactVersionsContract = c13.router({
+  list: {
+    method: "GET",
+    path: "/v1/artifacts/:id/versions",
+    pathParams: z18.object({
+      id: z18.string().min(1, "Artifact ID is required")
+    }),
+    query: listQuerySchema,
+    responses: {
+      200: paginatedArtifactVersionsSchema,
+      401: publicApiErrorSchema,
+      404: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "List artifact versions",
+    description: "List all versions of an artifact with pagination"
+  }
+});
+var publicArtifactUploadContract = c13.router({
+  prepareUpload: {
+    method: "POST",
+    path: "/v1/artifacts/:id/upload",
+    pathParams: z18.object({
+      id: z18.string().min(1, "Artifact ID is required")
+    }),
+    body: prepareUploadRequestSchema,
+    responses: {
+      200: prepareUploadResponseSchema,
+      400: publicApiErrorSchema,
+      401: publicApiErrorSchema,
+      404: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "Prepare artifact upload",
+    description: "Get presigned URLs for direct S3 upload. Returns upload URLs for each file."
+  }
+});
+var publicArtifactCommitContract = c13.router({
+  commitUpload: {
+    method: "POST",
+    path: "/v1/artifacts/:id/commit",
+    pathParams: z18.object({
+      id: z18.string().min(1, "Artifact ID is required")
+    }),
+    body: commitUploadRequestSchema,
+    responses: {
+      200: artifactVersionSchema,
+      400: publicApiErrorSchema,
+      401: publicApiErrorSchema,
+      404: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "Commit artifact upload",
+    description: "Finalize an upload session and create a new artifact version."
+  }
+});
+var publicArtifactDownloadContract = c13.router({
+  download: {
+    method: "GET",
+    path: "/v1/artifacts/:id/download",
+    pathParams: z18.object({
+      id: z18.string().min(1, "Artifact ID is required")
+    }),
+    query: z18.object({
+      version_id: z18.string().optional()
+      // Defaults to current version
+    }),
+    responses: {
+      200: downloadResponseSchema,
+      401: publicApiErrorSchema,
+      404: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "Download artifact",
+    description: "Get presigned URLs for downloading artifact files. Defaults to current version."
+  }
+});
+
+// ../../packages/core/src/contracts/public/volumes.ts
+import { z as z19 } from "zod";
+var c14 = initContract();
+var publicVolumeSchema = z19.object({
+  id: z19.string(),
+  name: z19.string(),
+  current_version_id: z19.string().nullable(),
+  size: z19.number(),
+  // Total size in bytes
+  file_count: z19.number(),
+  created_at: timestampSchema,
+  updated_at: timestampSchema
+});
+var volumeVersionSchema = z19.object({
+  id: z19.string(),
+  // SHA-256 content hash
+  volume_id: z19.string(),
+  size: z19.number(),
+  // Size in bytes
+  file_count: z19.number(),
+  message: z19.string().nullable(),
+  // Optional commit message
+  created_by: z19.string(),
+  created_at: timestampSchema
+});
+var publicVolumeDetailSchema = publicVolumeSchema.extend({
+  current_version: volumeVersionSchema.nullable()
+});
+var paginatedVolumesSchema = createPaginatedResponseSchema(publicVolumeSchema);
+var paginatedVolumeVersionsSchema = createPaginatedResponseSchema(volumeVersionSchema);
+var createVolumeRequestSchema = z19.object({
+  name: z19.string().min(1).max(100).regex(
+    /^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]$/,
+    "Name must be lowercase alphanumeric with hyphens, not starting or ending with hyphen"
+  )
+});
+var fileEntrySchema2 = z19.object({
+  path: z19.string(),
+  size: z19.number(),
+  hash: z19.string().optional()
+  // SHA-256 hash of file content
+});
+var prepareUploadRequestSchema2 = z19.object({
+  files: z19.array(fileEntrySchema2),
+  message: z19.string().optional()
+  // Optional commit message
+});
+var presignedUploadSchema3 = z19.object({
+  path: z19.string(),
+  upload_url: z19.string(),
+  // Presigned S3 URL
+  upload_id: z19.string()
+  // For multi-part uploads
+});
+var prepareUploadResponseSchema2 = z19.object({
+  upload_session_id: z19.string(),
+  files: z19.array(presignedUploadSchema3),
+  expires_at: timestampSchema
+});
+var commitUploadRequestSchema2 = z19.object({
+  upload_session_id: z19.string(),
+  message: z19.string().optional()
+});
+var downloadResponseSchema2 = z19.object({
+  version_id: z19.string(),
+  files: z19.array(
+    z19.object({
+      path: z19.string(),
+      size: z19.number(),
+      download_url: z19.string()
+      // Presigned S3 URL
+    })
+  ),
+  expires_at: timestampSchema
+});
+var publicVolumesListContract = c14.router({
+  list: {
+    method: "GET",
+    path: "/v1/volumes",
+    query: listQuerySchema,
+    responses: {
+      200: paginatedVolumesSchema,
+      401: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "List volumes",
+    description: "List all volumes in the current scope with pagination"
+  },
+  create: {
+    method: "POST",
+    path: "/v1/volumes",
+    body: createVolumeRequestSchema,
+    responses: {
+      201: publicVolumeDetailSchema,
+      400: publicApiErrorSchema,
+      401: publicApiErrorSchema,
+      409: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "Create volume",
+    description: "Create a new empty volume container"
+  }
+});
+var publicVolumeByIdContract = c14.router({
+  get: {
+    method: "GET",
+    path: "/v1/volumes/:id",
+    pathParams: z19.object({
+      id: z19.string().min(1, "Volume ID is required")
+    }),
+    responses: {
+      200: publicVolumeDetailSchema,
+      401: publicApiErrorSchema,
+      404: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "Get volume",
+    description: "Get volume details by ID"
+  },
+  delete: {
+    method: "DELETE",
+    path: "/v1/volumes/:id",
+    pathParams: z19.object({
+      id: z19.string().min(1, "Volume ID is required")
+    }),
+    body: z19.undefined(),
+    responses: {
+      204: z19.undefined(),
+      401: publicApiErrorSchema,
+      404: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "Delete volume",
+    description: "Delete a volume and all its versions"
+  }
+});
+var publicVolumeVersionsContract = c14.router({
+  list: {
+    method: "GET",
+    path: "/v1/volumes/:id/versions",
+    pathParams: z19.object({
+      id: z19.string().min(1, "Volume ID is required")
+    }),
+    query: listQuerySchema,
+    responses: {
+      200: paginatedVolumeVersionsSchema,
+      401: publicApiErrorSchema,
+      404: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "List volume versions",
+    description: "List all versions of a volume with pagination"
+  }
+});
+var publicVolumeUploadContract = c14.router({
+  prepareUpload: {
+    method: "POST",
+    path: "/v1/volumes/:id/upload",
+    pathParams: z19.object({
+      id: z19.string().min(1, "Volume ID is required")
+    }),
+    body: prepareUploadRequestSchema2,
+    responses: {
+      200: prepareUploadResponseSchema2,
+      400: publicApiErrorSchema,
+      401: publicApiErrorSchema,
+      404: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "Prepare volume upload",
+    description: "Get presigned URLs for direct S3 upload. Returns upload URLs for each file."
+  }
+});
+var publicVolumeCommitContract = c14.router({
+  commitUpload: {
+    method: "POST",
+    path: "/v1/volumes/:id/commit",
+    pathParams: z19.object({
+      id: z19.string().min(1, "Volume ID is required")
+    }),
+    body: commitUploadRequestSchema2,
+    responses: {
+      200: volumeVersionSchema,
+      400: publicApiErrorSchema,
+      401: publicApiErrorSchema,
+      404: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "Commit volume upload",
+    description: "Finalize an upload session and create a new volume version."
+  }
+});
+var publicVolumeDownloadContract = c14.router({
+  download: {
+    method: "GET",
+    path: "/v1/volumes/:id/download",
+    pathParams: z19.object({
+      id: z19.string().min(1, "Volume ID is required")
+    }),
+    query: z19.object({
+      version_id: z19.string().optional()
+      // Defaults to current version
+    }),
+    responses: {
+      200: downloadResponseSchema2,
+      401: publicApiErrorSchema,
+      404: publicApiErrorSchema,
+      500: publicApiErrorSchema
+    },
+    summary: "Download volume",
+    description: "Get presigned URLs for downloading volume files. Defaults to current version."
+  }
+});
+
+// ../../packages/core/src/contracts/public/tokens.ts
+import { z as z20 } from "zod";
+var c15 = initContract();
+var publicTokenSchema = z20.object({
+  id: z20.string(),
+  name: z20.string(),
+  token_prefix: z20.string(),
+  // First 12 chars for identification (e.g., "vm0_live_abc")
+  last_used_at: timestampSchema.nullable(),
+  expires_at: timestampSchema,
+  created_at: timestampSchema
+});
+var publicTokenDetailSchema = publicTokenSchema.extend({
+  token: z20.string().optional()
+  // Full token value, only returned on creation
+});
+var paginatedTokensSchema = createPaginatedResponseSchema(publicTokenSchema);
+var createTokenRequestSchema = z20.object({
+  name: z20.string().min(1, "Name is required").max(100, "Name too long"),
+  expires_in_days: z20.number().min(1).max(365).optional()
+  // null for no expiry (default 90 days)
+});
+var publicTokensListContract = c15.router({
+  list: {
+    method: "GET",
+    path: "/v1/tokens",
+    query: listQuerySchema,
+    responses: {
+      200: paginatedTokensSchema,
+      401: publicApiErrorSchema
+    },
+    summary: "List API tokens",
+    description: "List all API tokens for the authenticated user"
+  },
+  create: {
+    method: "POST",
+    path: "/v1/tokens",
+    body: createTokenRequestSchema,
+    responses: {
+      201: publicTokenDetailSchema,
+      // Includes full token value
+      400: publicApiErrorSchema,
+      401: publicApiErrorSchema
+    },
+    summary: "Create API token",
+    description: "Create a new API token. The token value is only returned once on creation."
+  }
+});
+var publicTokenByIdContract = c15.router({
+  get: {
+    method: "GET",
+    path: "/v1/tokens/:id",
+    pathParams: z20.object({
+      id: z20.string()
+    }),
+    responses: {
+      200: publicTokenSchema,
+      // Does NOT include token value
+      401: publicApiErrorSchema,
+      404: publicApiErrorSchema
+    },
+    summary: "Get API token",
+    description: "Get details of an API token (does not include the token value)"
+  },
+  delete: {
+    method: "DELETE",
+    path: "/v1/tokens/:id",
+    pathParams: z20.object({
+      id: z20.string()
+    }),
+    responses: {
+      204: z20.undefined(),
+      401: publicApiErrorSchema,
+      404: publicApiErrorSchema
+    },
+    summary: "Revoke API token",
+    description: "Permanently revoke an API token. This action cannot be undone."
+  }
+});
+
 // ../../packages/core/src/sandbox/scripts/lib/__init__.py.ts
 var INIT_SCRIPT = `#!/usr/bin/env python3
 """
@@ -9147,6 +10087,9 @@ function buildEnvironmentVariables(context, apiUrl) {
       envVars[key] = value;
     }
   }
+  if (context.experimentalNetworkSecurity) {
+    envVars.NODE_EXTRA_CA_CERTS = "/usr/local/share/ca-certificates/vm0-proxy-ca.crt";
+  }
   return envVars;
 }
 var ENV_JSON_PATH = "/tmp/vm0-env.json";
@@ -9644,7 +10587,7 @@ var statusCommand = new Command2("status").description("Check runner connectivit
 });
 
 // src/index.ts
-var version = true ? "2.3.0" : "0.1.0";
+var version = true ? "2.3.2" : "0.1.0";
 program.name("vm0-runner").version(version).description("Self-hosted runner for VM0 agents");
 program.addCommand(startCommand);
 program.addCommand(statusCommand);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vm0/runner",
-  "version": "2.3.0",
+  "version": "2.3.2",
   "description": "Self-hosted runner for VM0 agents",
   "repository": {
     "type": "git",