@xemahq/contracts 0.1.0

package/dist/runner/lib/runner-attestation.d.ts

@@ -0,0 +1,56 @@
+import { z } from 'zod';
+import { RunnerKind } from '../../policy';
+import { RunnerJtiConsumer } from './runner-authority';
+import { RunnerTransport } from './runner-mode';
+import { RunnerDataLocality, RunnerMode } from './runner-registration';
+import { RunnerPlaneAudience, RuntimeOperatorKind } from './runtime-identity';
+import { RunnerTrustTier } from './runner';
+export declare const RUNNER_ATTESTATION_REJECTED_CLOUDEVENT_TYPE: "xema.runner.attestation.rejected.v1";
+export declare const MAX_RUNNER_ATTESTATION_RECEIPT_TTL_SECONDS = 300;
+export interface RunnerAttestationRequest {
+    runnerId: string;
+    presentedAt: string;
+    mode: RunnerMode;
+    kind: RunnerKind;
+    transport: RunnerTransport;
+    locality: RunnerDataLocality;
+    capabilityRefs: readonly string[];
+    operationalLabels: Readonly<Record<string, string>>;
+}
+export declare const RunnerAttestationRequestSchema: z.ZodType<RunnerAttestationRequest>;
+export interface RunnerAttestationReceiptClaims {
+    runnerId: string;
+    enrollmentId: string;
+    principalId: string;
+    credentialRevision: number;
+    runtimeId: string;
+    ownerOrgId: string | null;
+    operatorKind: RuntimeOperatorKind;
+    mode: RunnerMode;
+    kind: RunnerKind;
+    transport: RunnerTransport;
+    locality: RunnerDataLocality;
+    trustTier: RunnerTrustTier;
+    allowedEnvironmentIds: readonly string[];
+    capabilityRefs: readonly string[];
+    operationalLabels: Readonly<Record<string, string>>;
+    attestationRevision: number;
+    issuer: string;
+    audience: RunnerPlaneAudience.AttestationReceipt;
+    jti: string;
+    issuedAt: string;
+    notBefore: string;
+    expiresAt: string;
+}
+export declare const RunnerAttestationReceiptClaimsSchema: z.ZodType<RunnerAttestationReceiptClaims>;
+export type SignedRunnerAttestationReceipt = string & {
+    readonly __brand: 'SignedRunnerAttestationReceipt';
+};
+export declare const SignedRunnerAttestationReceiptSchema: z.ZodType<SignedRunnerAttestationReceipt>;
+export type RunnerAttestationReceiptExpectation = Omit<RunnerAttestationReceiptClaims, 'issuedAt' | 'notBefore' | 'expiresAt'> & {
+    currentTime: string;
+    signatureVerified: true;
+    jtiConsumer: RunnerJtiConsumer;
+};
+export declare function assertRunnerAttestationReceiptClaims(untrustedClaims: unknown, expectation: RunnerAttestationReceiptExpectation): Promise<RunnerAttestationReceiptClaims>;
+//# sourceMappingURL=runner-attestation.d.ts.map

package/dist/runner/lib/runner-attestation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-attestation.d.ts","sourceRoot":"","sources":["../../../src/runner/lib/runner-attestation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAoB,MAAM,cAAc,CAAC;AAE5D,OAAO,EAOL,iBAAiB,EAKlB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAEL,kBAAkB,EAElB,UAAU,EAEX,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EAEpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAE3C,eAAO,MAAM,2CAA2C,EACtD,qCAA8C,CAAC;AAGjD,eAAO,MAAM,0CAA0C,MAAM,CAAC;AAO9D,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,SAAS,EAAE,eAAe,CAAC;IAC3B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACrD;AAED,eAAO,MAAM,8BAA8B,EAsBnC,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;AAG5C,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,mBAAmB,CAAC;IAClC,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,SAAS,EAAE,eAAe,CAAC;IAC3B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,SAAS,EAAE,eAAe,CAAC;IAC3B,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,mBAAmB,CAAC,kBAAkB,CAAC;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,oCAAoC,EA6CzC,CAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;AAElD,MAAM,MAAM,8BAA8B,GAAG,MAAM,GAAG;IACpD,QAAQ,CAAC,OAAO,EAAE,gCAAgC,CAAC;CACpD,CAAC;AAEF,eAAO,MAAM,oCAAoC,EAK/B,CAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;AAE5D,MAAM,MAAM,mCAAmC,GAAG,IAAI,CACpD,8BAA8B,EAC9B,UAAU,GAAG,WAAW,GAAG,WAAW,CACvC,GAAG;IACF,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,IAAI,CAAC;IACxB,WAAW,EAAE,iBAAiB,CAAC;CAChC,CAAC;AAyBF,wBAAsB,oCAAoC,CACxD,eAAe,EAAE,OAAO,EACxB,WAAW,EAAE,mCAAmC,GAC/C,OAAO,CAAC,8BAA8B,CAAC,CAkDzC"}

package/dist/runner/lib/runner-attestation.js

@@ -0,0 +1,132 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignedRunnerAttestationReceiptSchema = exports.RunnerAttestationReceiptClaimsSchema = exports.RunnerAttestationRequestSchema = exports.MAX_RUNNER_ATTESTATION_RECEIPT_TTL_SECONDS = exports.RUNNER_ATTESTATION_REJECTED_CLOUDEVENT_TYPE = void 0;
+exports.assertRunnerAttestationReceiptClaims = assertRunnerAttestationReceiptClaims;
+const zod_1 = require("zod");
+const policy_1 = require("../../policy");
+const runner_authority_1 = require("./runner-authority");
+const runner_mode_1 = require("./runner-mode");
+const runner_registration_1 = require("./runner-registration");
+const runtime_identity_1 = require("./runtime-identity");
+const runner_1 = require("./runner");
+exports.RUNNER_ATTESTATION_REJECTED_CLOUDEVENT_TYPE = 'xema.runner.attestation.rejected.v1';
+exports.MAX_RUNNER_ATTESTATION_RECEIPT_TTL_SECONDS = 300;
+exports.RunnerAttestationRequestSchema = zod_1.z
+    .object({
+    runnerId: zod_1.z.string().min(1),
+    presentedAt: runner_authority_1.RunnerUtcDateTimeSchema,
+    mode: runner_registration_1.RunnerModeSchema,
+    kind: policy_1.RunnerKindSchema,
+    transport: zod_1.z.nativeEnum(runner_mode_1.RunnerTransport),
+    locality: runner_registration_1.RunnerDataLocalitySchema,
+    capabilityRefs: (0, runner_authority_1.runnerUniqueNonEmptyStringArraySchema)('capabilityRefs'),
+    operationalLabels: zod_1.z.record(zod_1.z.string().min(1), zod_1.z.string()),
+})
+    .strict()
+    .superRefine((request, ctx) => {
+    for (const key of Object.keys(request.operationalLabels)) {
+        if (runner_registration_1.FORBIDDEN_RUNNER_OPERATIONAL_LABEL_KEYS.has(key)) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                message: `${key} is an authority field and cannot be an operational label`,
+                path: ['operationalLabels', key],
+            });
+        }
+    }
+});
+exports.RunnerAttestationReceiptClaimsSchema = zod_1.z
+    .object({
+    runnerId: zod_1.z.string().min(1),
+    enrollmentId: zod_1.z.string().min(1),
+    principalId: zod_1.z.string().min(1),
+    credentialRevision: zod_1.z.number().int().positive(),
+    runtimeId: zod_1.z.string().min(1),
+    ownerOrgId: zod_1.z.string().min(1).nullable(),
+    operatorKind: runtime_identity_1.RuntimeOperatorKindSchema,
+    mode: runner_registration_1.RunnerModeSchema,
+    kind: policy_1.RunnerKindSchema,
+    transport: zod_1.z.nativeEnum(runner_mode_1.RunnerTransport),
+    locality: runner_registration_1.RunnerDataLocalitySchema,
+    trustTier: zod_1.z.nativeEnum(runner_1.RunnerTrustTier),
+    allowedEnvironmentIds: (0, runner_authority_1.runnerUniqueNonEmptyStringArraySchema)('allowedEnvironmentIds'),
+    capabilityRefs: (0, runner_authority_1.runnerUniqueNonEmptyStringArraySchema)('capabilityRefs'),
+    operationalLabels: zod_1.z.record(zod_1.z.string().min(1), zod_1.z.string()),
+    attestationRevision: zod_1.z.number().int().positive(),
+    ...runner_authority_1.RunnerSignedFieldsShape,
+    audience: zod_1.z.literal(runtime_identity_1.RunnerPlaneAudience.AttestationReceipt),
+    jti: zod_1.z.string().min(1),
+})
+    .strict()
+    .superRefine((receipt, ctx) => {
+    (0, runner_authority_1.addRuntimeOperatorOwnerIssues)(receipt.operatorKind, receipt.ownerOrgId, ctx);
+    (0, runner_authority_1.addRunnerClaimWindowIssues)(receipt, ctx, exports.MAX_RUNNER_ATTESTATION_RECEIPT_TTL_SECONDS);
+    for (const key of Object.keys(receipt.operationalLabels)) {
+        if (runner_registration_1.FORBIDDEN_RUNNER_OPERATIONAL_LABEL_KEYS.has(key)) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                message: `${key} is an authority field and cannot be an operational label`,
+                path: ['operationalLabels', key],
+            });
+        }
+    }
+});
+exports.SignedRunnerAttestationReceiptSchema = zod_1.z
+    .string()
+    .regex(/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/, 'attestation receipt must be a compact JWS');
+const RECEIPT_EXACT_MATCH_FIELDS = [
+    'runnerId',
+    'enrollmentId',
+    'principalId',
+    'credentialRevision',
+    'runtimeId',
+    'ownerOrgId',
+    'operatorKind',
+    'mode',
+    'kind',
+    'transport',
+    'locality',
+    'trustTier',
+    'attestationRevision',
+    'issuer',
+    'audience',
+    'jti',
+];
+async function assertRunnerAttestationReceiptClaims(untrustedClaims, expectation) {
+    if (expectation.signatureVerified !== true) {
+        throw new runner_authority_1.RunnerArtifactValidationError(runner_authority_1.RunnerArtifactValidationErrorCode.SignatureUnverified, 'attestation receipt signature must be verified before claim validation');
+    }
+    const parsed = exports.RunnerAttestationReceiptClaimsSchema.safeParse(untrustedClaims);
+    if (!parsed.success) {
+        throw new runner_authority_1.RunnerArtifactValidationError(runner_authority_1.RunnerArtifactValidationErrorCode.SchemaInvalid, `invalid attestation receipt claims: ${parsed.error.message}`);
+    }
+    for (const field of RECEIPT_EXACT_MATCH_FIELDS) {
+        if (parsed.data[field] !== expectation[field]) {
+            throw new runner_authority_1.RunnerArtifactValidationError(runner_authority_1.RunnerArtifactValidationErrorCode.AuthorityMismatch, `attestation receipt ${field} does not match enrollment`);
+        }
+    }
+    if (!sameStringSets(parsed.data.allowedEnvironmentIds, expectation.allowedEnvironmentIds) ||
+        !sameStringSets(parsed.data.capabilityRefs, expectation.capabilityRefs) ||
+        !sameStringMaps(parsed.data.operationalLabels, expectation.operationalLabels)) {
+        throw new runner_authority_1.RunnerArtifactValidationError(runner_authority_1.RunnerArtifactValidationErrorCode.AuthorityMismatch, 'attestation receipt authority sets do not match enrollment');
+    }
+    (0, runner_authority_1.assertRunnerArtifactActiveAt)(parsed.data, expectation.currentTime);
+    await (0, runner_authority_1.consumeRunnerJtiOnce)(expectation.jtiConsumer, {
+        artifactKind: runner_authority_1.RunnerReplayArtifactKind.AttestationReceipt,
+        issuer: parsed.data.issuer,
+        audience: parsed.data.audience,
+        jti: parsed.data.jti,
+        expiresAt: parsed.data.expiresAt,
+    });
+    return parsed.data;
+}
+function sameStringMaps(left, right) {
+    const leftEntries = Object.entries(left);
+    return (leftEntries.length === Object.keys(right).length &&
+        leftEntries.every(([key, value]) => right[key] === value));
+}
+function sameStringSets(left, right) {
+    const rightValues = new Set(right);
+    return (left.length === right.length &&
+        left.every((value) => rightValues.has(value)));
+}
+//# sourceMappingURL=runner-attestation.js.map

package/dist/runner/lib/runner-attestation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-attestation.js","sourceRoot":"","sources":["../../../src/runner/lib/runner-attestation.ts"],"names":[],"mappings":";;;AAiMA,oFAqDC;AAtPD,6BAAwB;AACxB,yCAA4D;AAE5D,yDAY4B;AAC5B,+CAAgD;AAChD,+DAM+B;AAC/B,yDAI4B;AAC5B,qCAA2C;AAE9B,QAAA,2CAA2C,GACtD,qCAA8C,CAAC;AAGpC,QAAA,0CAA0C,GAAG,GAAG,CAAC;AAkBjD,QAAA,8BAA8B,GAAG,OAAC;KAC5C,MAAM,CAAC;IACN,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,WAAW,EAAE,0CAAuB;IACpC,IAAI,EAAE,sCAAgB;IACtB,IAAI,EAAE,yBAAgB;IACtB,SAAS,EAAE,OAAC,CAAC,UAAU,CAAC,6BAAe,CAAC;IACxC,QAAQ,EAAE,8CAAwB;IAClC,cAAc,EAAE,IAAA,wDAAqC,EAAC,gBAAgB,CAAC;IACvE,iBAAiB,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC;CAC3D,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACzD,IAAI,6DAAuC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,GAAG,GAAG,2DAA2D;gBAC1E,IAAI,EAAE,CAAC,mBAAmB,EAAE,GAAG,CAAC;aACjC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAwC,CAAC;AA4B/B,QAAA,oCAAoC,GAAG,OAAC;KAClD,MAAM,CAAC;IACN,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,kBAAkB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/C,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,4CAAyB;IACvC,IAAI,EAAE,sCAAgB;IACtB,IAAI,EAAE,yBAAgB;IACtB,SAAS,EAAE,OAAC,CAAC,UAAU,CAAC,6BAAe,CAAC;IACxC,QAAQ,EAAE,8CAAwB;IAClC,SAAS,EAAE,OAAC,CAAC,UAAU,CAAC,wBAAe,CAAC;IACxC,qBAAqB,EAAE,IAAA,wDAAqC,EAC1D,uBAAuB,CACxB;IACD,cAAc,EAAE,IAAA,wDAAqC,EAAC,gBAAgB,CAAC;IACvE,iBAAiB,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC;IAC1D,mBAAmB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChD,GAAG,0CAAuB;IAC1B,QAAQ,EAAE,OAAC,CAAC,OAAO,CAAC,sCAAmB,CAAC,kBAAkB,CAAC;IAC3D,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACvB,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,IAAA,gDAA6B,EAC3B,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,UAAU,EAClB,GAAG,CACJ,CAAC;IACF,IAAA,6CAA0B,EACxB,OAAO,EACP,GAAG,EACH,kDAA0C,CAC3C,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACzD,IAAI,6DAAuC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,GAAG,GAAG,2DAA2D;gBAC1E,IAAI,EAAE,CAAC,mBAAmB,EAAE,GAAG,CAAC;aACjC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAA8C,CAAC;AAMrC,QAAA,oCAAoC,GAAG,OAAC;KAClD,MAAM,EAAE;KACR,KAAK,CACJ,kDAAkD,EAClD,2CAA2C,CACY,CAAC;AAW5D,MAAM,0BAA0B,GAAG;IACjC,UAAU;IACV,cAAc;IACd,aAAa;IACb,oBAAoB;IACpB,WAAW;IACX,YAAY;IACZ,cAAc;IACd,MAAM;IACN,MAAM;IACN,WAAW;IACX,UAAU;IACV,WAAW;IACX,qBAAqB;IACrB,QAAQ;IACR,UAAU;IACV,KAAK;CACG,CAAC;AAMJ,KAAK,UAAU,oCAAoC,CACxD,eAAwB,EACxB,WAAgD;IAEhD,IAAI,WAAW,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC3C,MAAM,IAAI,gDAA6B,CACrC,oDAAiC,CAAC,mBAAmB,EACrD,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GACV,4CAAoC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,gDAA6B,CACrC,oDAAiC,CAAC,aAAa,EAC/C,uCAAuC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAC9D,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,0BAA0B,EAAE,CAAC;QAC/C,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,gDAA6B,CACrC,oDAAiC,CAAC,iBAAiB,EACnD,uBAAuB,KAAK,4BAA4B,CACzD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IACE,CAAC,cAAc,CACb,MAAM,CAAC,IAAI,CAAC,qBAAqB,EACjC,WAAW,CAAC,qBAAqB,CAClC;QACD,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,cAAc,CAAC;QACvE,CAAC,cAAc,CACb,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAC7B,WAAW,CAAC,iBAAiB,CAC9B,EACD,CAAC;QACD,MAAM,IAAI,gDAA6B,CACrC,oDAAiC,CAAC,iBAAiB,EACnD,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IAED,IAAA,+CAA4B,EAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,IAAA,uCAAoB,EAAC,WAAW,CAAC,WAAW,EAAE;QAClD,YAAY,EAAE,2CAAwB,CAAC,kBAAkB;QACzD,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;QAC1B,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;QAC9B,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG;QACpB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;KACjC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,cAAc,CACrB,IAAsC,EACtC,KAAuC;IAEvC,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,CACL,WAAW,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM;QAChD,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,IAAuB,EACvB,KAAwB;IAExB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACnC,OAAO,CACL,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAC5B,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAC9C,CAAC;AACJ,CAAC"}

package/dist/runner/lib/runner-authority.d.ts

@@ -0,0 +1,100 @@
+import { z } from 'zod';
+import { RunnerPlaneAudience, RuntimeOperatorKind } from './runtime-identity';
+export declare const RunnerInputHashSchema: z.ZodString;
+export declare const RunnerUtcDateTimeSchema: z.ZodString;
+export declare function runnerUniqueNonEmptyStringArraySchema(fieldName: string): z.ZodArray<z.ZodString>;
+export declare function addRuntimeOperatorOwnerIssues(operatorKind: RuntimeOperatorKind, ownerOrgId: string | null, ctx: z.RefinementCtx): void;
+export interface RunnerJobAuthorityFields {
+    jobId: string;
+    orgId: string;
+    projectId?: string;
+    biomeId: string;
+    installationId: string;
+    bindingId: string;
+    bindingRevision: number;
+    bindingPrincipalId: string;
+    runtimeId: string;
+    runnerId: string;
+    enrollmentId: string;
+    credentialRevision: number;
+    attestationRevision: number;
+    dispatchAuthorizationId: string;
+    permissionDigest: string;
+    approvalRevision: number;
+    capabilityRef: string;
+    environmentId: string;
+    subject: string;
+    inputHash: string;
+    jti: string;
+}
+export declare const RUNNER_JOB_AUTHORITY_FIELD_NAMES: readonly ["jobId", "orgId", "projectId", "biomeId", "installationId", "bindingId", "bindingRevision", "bindingPrincipalId", "runtimeId", "runnerId", "enrollmentId", "credentialRevision", "attestationRevision", "dispatchAuthorizationId", "permissionDigest", "approvalRevision", "capabilityRef", "environmentId", "subject", "inputHash", "jti"];
+export declare const RunnerJobAuthorityFieldsShape: {
+    readonly jobId: z.ZodString;
+    readonly orgId: z.ZodString;
+    readonly projectId: z.ZodOptional<z.ZodString>;
+    readonly biomeId: z.ZodString;
+    readonly installationId: z.ZodString;
+    readonly bindingId: z.ZodString;
+    readonly bindingRevision: z.ZodNumber;
+    readonly bindingPrincipalId: z.ZodString;
+    readonly runtimeId: z.ZodString;
+    readonly runnerId: z.ZodString;
+    readonly enrollmentId: z.ZodString;
+    readonly credentialRevision: z.ZodNumber;
+    readonly attestationRevision: z.ZodNumber;
+    readonly dispatchAuthorizationId: z.ZodString;
+    readonly permissionDigest: z.ZodString;
+    readonly approvalRevision: z.ZodNumber;
+    readonly capabilityRef: z.ZodString;
+    readonly environmentId: z.ZodString;
+    readonly subject: z.ZodString;
+    readonly inputHash: z.ZodString;
+    readonly jti: z.ZodString;
+};
+export declare const RunnerJobAuthorityFieldsSchema: z.ZodType<RunnerJobAuthorityFields>;
+export interface RunnerSignedFields {
+    issuer: string;
+    audience: RunnerPlaneAudience;
+    issuedAt: string;
+    notBefore: string;
+    expiresAt: string;
+}
+export declare const RunnerSignedFieldsShape: {
+    readonly issuer: z.ZodString;
+    readonly audience: z.ZodEnum<typeof RunnerPlaneAudience>;
+    readonly issuedAt: z.ZodString;
+    readonly notBefore: z.ZodString;
+    readonly expiresAt: z.ZodString;
+};
+export declare const RunnerSignedFieldsSchema: z.ZodType<RunnerSignedFields>;
+export declare function addRunnerClaimWindowIssues(value: RunnerSignedFields, ctx: z.RefinementCtx, maxTtlSeconds: number): void;
+export declare enum RunnerArtifactValidationErrorCode {
+    SchemaInvalid = "schema_invalid",
+    SignatureUnverified = "signature_unverified",
+    AuthorityMismatch = "authority_mismatch",
+    Replay = "replay",
+    NotYetValid = "not_yet_valid",
+    Expired = "expired"
+}
+export declare enum RunnerReplayArtifactKind {
+    AttestationReceipt = "attestation_receipt",
+    JobToken = "job_token",
+    JobReport = "job_report"
+}
+export interface RunnerJtiConsumption {
+    artifactKind: RunnerReplayArtifactKind;
+    issuer: string;
+    audience: RunnerPlaneAudience;
+    jti: string;
+    expiresAt: string;
+}
+export interface RunnerJtiConsumer {
+    consumeOnce(consumption: RunnerJtiConsumption): Promise<boolean>;
+}
+export declare class RunnerArtifactValidationError extends Error {
+    readonly code: RunnerArtifactValidationErrorCode;
+    constructor(code: RunnerArtifactValidationErrorCode, message: string);
+}
+export declare function assertRunnerArtifactActiveAt(artifact: RunnerSignedFields, currentTime: string): void;
+export declare function consumeRunnerJtiOnce(consumer: RunnerJtiConsumer, consumption: RunnerJtiConsumption): Promise<void>;
+//# sourceMappingURL=runner-authority.d.ts.map

package/dist/runner/lib/runner-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-authority.d.ts","sourceRoot":"","sources":["../../../src/runner/lib/runner-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAG9E,eAAO,MAAM,qBAAqB,aAAkB,CAAC;AAGrD,eAAO,MAAM,uBAAuB,aAAyC,CAAC;AAE9E,wBAAgB,qCAAqC,CAAC,SAAS,EAAE,MAAM,2BAMtE;AAED,wBAAgB,6BAA6B,CAC3C,YAAY,EAAE,mBAAmB,EACjC,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,GAAG,EAAE,CAAC,CAAC,aAAa,GACnB,IAAI,CAiBN;AAQD,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,uBAAuB,EAAE,MAAM,CAAC;IAChC,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,eAAO,MAAM,gCAAgC,uVAsBmB,CAAC;AAEjE,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;CAsBhC,CAAC;AAEX,eAAO,MAAM,8BAA8B,EAE5B,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;AAEnD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,uBAAuB;;;;;;CAM1B,CAAC;AAEX,eAAO,MAAM,wBAAwB,EAEtB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAE7C,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,kBAAkB,EACzB,GAAG,EAAE,CAAC,CAAC,aAAa,EACpB,aAAa,EAAE,MAAM,GACpB,IAAI,CA0BN;AAED,oBAAY,iCAAiC;IAC3C,aAAa,mBAAmB;IAChC,mBAAmB,yBAAyB;IAC5C,iBAAiB,uBAAuB;IACxC,MAAM,WAAW;IACjB,WAAW,kBAAkB;IAC7B,OAAO,YAAY;CACpB;AAED,oBAAY,wBAAwB;IAClC,kBAAkB,wBAAwB;IAC1C,QAAQ,cAAc;IACtB,SAAS,eAAe;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,wBAAwB,CAAC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;CACnB;AAOD,MAAM,WAAW,iBAAiB;IAChC,WAAW,CAAC,WAAW,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAClE;AAED,qBAAa,6BAA8B,SAAQ,KAAK;aAEpC,IAAI,EAAE,iCAAiC;gBAAvC,IAAI,EAAE,iCAAiC,EACvD,OAAO,EAAE,MAAM;CAKlB;AAED,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,kBAAkB,EAC5B,WAAW,EAAE,MAAM,GAClB,IAAI,CAsBN;AAED,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,oBAAoB,GAChC,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/dist/runner/lib/runner-authority.js

@@ -0,0 +1,165 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RunnerArtifactValidationError = exports.RunnerReplayArtifactKind = exports.RunnerArtifactValidationErrorCode = exports.RunnerSignedFieldsSchema = exports.RunnerSignedFieldsShape = exports.RunnerJobAuthorityFieldsSchema = exports.RunnerJobAuthorityFieldsShape = exports.RUNNER_JOB_AUTHORITY_FIELD_NAMES = exports.RunnerUtcDateTimeSchema = exports.RunnerInputHashSchema = void 0;
+exports.runnerUniqueNonEmptyStringArraySchema = runnerUniqueNonEmptyStringArraySchema;
+exports.addRuntimeOperatorOwnerIssues = addRuntimeOperatorOwnerIssues;
+exports.addRunnerClaimWindowIssues = addRunnerClaimWindowIssues;
+exports.assertRunnerArtifactActiveAt = assertRunnerArtifactActiveAt;
+exports.consumeRunnerJtiOnce = consumeRunnerJtiOnce;
+const zod_1 = require("zod");
+const content_address_1 = require("../../content-address");
+const runtime_identity_1 = require("./runtime-identity");
+exports.RunnerInputHashSchema = content_address_1.Sha256HexSchema;
+exports.RunnerUtcDateTimeSchema = zod_1.z.string().datetime({ offset: false });
+function runnerUniqueNonEmptyStringArraySchema(fieldName) {
+    return zod_1.z
+        .array(zod_1.z.string().min(1))
+        .refine((values) => new Set(values).size === values.length, {
+        message: `${fieldName} must not contain duplicates`,
+    });
+}
+function addRuntimeOperatorOwnerIssues(operatorKind, ownerOrgId, ctx) {
+    const organizationOwned = operatorKind === runtime_identity_1.RuntimeOperatorKind.OrganizationExternal;
+    if (organizationOwned && ownerOrgId === null) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            message: 'organization_external authority requires ownerOrgId',
+            path: ['ownerOrgId'],
+        });
+    }
+    if (!organizationOwned && ownerOrgId !== null) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            message: 'platform-operated authority must have ownerOrgId=null',
+            path: ['ownerOrgId'],
+        });
+    }
+}
+exports.RUNNER_JOB_AUTHORITY_FIELD_NAMES = [
+    'jobId',
+    'orgId',
+    'projectId',
+    'biomeId',
+    'installationId',
+    'bindingId',
+    'bindingRevision',
+    'bindingPrincipalId',
+    'runtimeId',
+    'runnerId',
+    'enrollmentId',
+    'credentialRevision',
+    'attestationRevision',
+    'dispatchAuthorizationId',
+    'permissionDigest',
+    'approvalRevision',
+    'capabilityRef',
+    'environmentId',
+    'subject',
+    'inputHash',
+    'jti',
+];
+exports.RunnerJobAuthorityFieldsShape = {
+    jobId: zod_1.z.string().min(1),
+    orgId: zod_1.z.string().min(1),
+    projectId: zod_1.z.string().min(1).optional(),
+    biomeId: zod_1.z.string().min(1),
+    installationId: zod_1.z.string().min(1),
+    bindingId: zod_1.z.string().min(1),
+    bindingRevision: zod_1.z.number().int().positive(),
+    bindingPrincipalId: zod_1.z.string().min(1),
+    runtimeId: zod_1.z.string().min(1),
+    runnerId: zod_1.z.string().min(1),
+    enrollmentId: zod_1.z.string().min(1),
+    credentialRevision: zod_1.z.number().int().positive(),
+    attestationRevision: zod_1.z.number().int().positive(),
+    dispatchAuthorizationId: zod_1.z.string().min(1),
+    permissionDigest: exports.RunnerInputHashSchema,
+    approvalRevision: zod_1.z.number().int().positive(),
+    capabilityRef: zod_1.z.string().min(1),
+    environmentId: zod_1.z.string().min(1),
+    subject: zod_1.z.string().min(1),
+    inputHash: exports.RunnerInputHashSchema,
+    jti: zod_1.z.string().min(1),
+};
+exports.RunnerJobAuthorityFieldsSchema = zod_1.z
+    .object(exports.RunnerJobAuthorityFieldsShape)
+    .strict();
+exports.RunnerSignedFieldsShape = {
+    issuer: zod_1.z.string().url(),
+    audience: zod_1.z.nativeEnum(runtime_identity_1.RunnerPlaneAudience),
+    issuedAt: exports.RunnerUtcDateTimeSchema,
+    notBefore: exports.RunnerUtcDateTimeSchema,
+    expiresAt: exports.RunnerUtcDateTimeSchema,
+};
+exports.RunnerSignedFieldsSchema = zod_1.z
+    .object(exports.RunnerSignedFieldsShape)
+    .strict();
+function addRunnerClaimWindowIssues(value, ctx, maxTtlSeconds) {
+    const issuedAt = Date.parse(value.issuedAt);
+    const notBefore = Date.parse(value.notBefore);
+    const expiresAt = Date.parse(value.expiresAt);
+    if (notBefore < issuedAt) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            message: 'notBefore must be at or after issuedAt',
+            path: ['notBefore'],
+        });
+    }
+    if (expiresAt <= notBefore) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            message: 'expiresAt must be after notBefore',
+            path: ['expiresAt'],
+        });
+    }
+    if (expiresAt - issuedAt > maxTtlSeconds * 1_000) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            message: `claim lifetime must not exceed ${maxTtlSeconds} seconds`,
+            path: ['expiresAt'],
+        });
+    }
+}
+var RunnerArtifactValidationErrorCode;
+(function (RunnerArtifactValidationErrorCode) {
+    RunnerArtifactValidationErrorCode["SchemaInvalid"] = "schema_invalid";
+    RunnerArtifactValidationErrorCode["SignatureUnverified"] = "signature_unverified";
+    RunnerArtifactValidationErrorCode["AuthorityMismatch"] = "authority_mismatch";
+    RunnerArtifactValidationErrorCode["Replay"] = "replay";
+    RunnerArtifactValidationErrorCode["NotYetValid"] = "not_yet_valid";
+    RunnerArtifactValidationErrorCode["Expired"] = "expired";
+})(RunnerArtifactValidationErrorCode || (exports.RunnerArtifactValidationErrorCode = RunnerArtifactValidationErrorCode = {}));
+var RunnerReplayArtifactKind;
+(function (RunnerReplayArtifactKind) {
+    RunnerReplayArtifactKind["AttestationReceipt"] = "attestation_receipt";
+    RunnerReplayArtifactKind["JobToken"] = "job_token";
+    RunnerReplayArtifactKind["JobReport"] = "job_report";
+})(RunnerReplayArtifactKind || (exports.RunnerReplayArtifactKind = RunnerReplayArtifactKind = {}));
+class RunnerArtifactValidationError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'RunnerArtifactValidationError';
+    }
+}
+exports.RunnerArtifactValidationError = RunnerArtifactValidationError;
+function assertRunnerArtifactActiveAt(artifact, currentTime) {
+    const parsedCurrentTime = exports.RunnerUtcDateTimeSchema.safeParse(currentTime);
+    if (!parsedCurrentTime.success) {
+        throw new RunnerArtifactValidationError(RunnerArtifactValidationErrorCode.SchemaInvalid, 'currentTime must be an absolute UTC ISO-8601 timestamp');
+    }
+    const now = Date.parse(parsedCurrentTime.data);
+    if (now < Date.parse(artifact.notBefore)) {
+        throw new RunnerArtifactValidationError(RunnerArtifactValidationErrorCode.NotYetValid, 'runner artifact is not yet valid');
+    }
+    if (now >= Date.parse(artifact.expiresAt)) {
+        throw new RunnerArtifactValidationError(RunnerArtifactValidationErrorCode.Expired, 'runner artifact has expired');
+    }
+}
+async function consumeRunnerJtiOnce(consumer, consumption) {
+    if (!(await consumer.consumeOnce(consumption))) {
+        throw new RunnerArtifactValidationError(RunnerArtifactValidationErrorCode.Replay, 'runner artifact jti was already consumed');
+    }
+}
+//# sourceMappingURL=runner-authority.js.map

package/dist/runner/lib/runner-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-authority.js","sourceRoot":"","sources":["../../../src/runner/lib/runner-authority.ts"],"names":[],"mappings":";;;AAUA,sFAMC;AAED,sEAqBC;AAwGD,gEA8BC;AA4CD,oEAyBC;AAED,oDAUC;AA9PD,6BAAwB;AACxB,2DAAwD;AACxD,yDAA8E;AAGjE,QAAA,qBAAqB,GAAG,iCAAe,CAAC;AAGxC,QAAA,uBAAuB,GAAG,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAE9E,SAAgB,qCAAqC,CAAC,SAAiB;IACrE,OAAO,OAAC;SACL,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACxB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE;QAC1D,OAAO,EAAE,GAAG,SAAS,8BAA8B;KACpD,CAAC,CAAC;AACP,CAAC;AAED,SAAgB,6BAA6B,CAC3C,YAAiC,EACjC,UAAyB,EACzB,GAAoB;IAEpB,MAAM,iBAAiB,GACrB,YAAY,KAAK,sCAAmB,CAAC,oBAAoB,CAAC;IAC5D,IAAI,iBAAiB,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QAC7C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,qDAAqD;YAC9D,IAAI,EAAE,CAAC,YAAY,CAAC;SACrB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,iBAAiB,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QAC9C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,uDAAuD;YAChE,IAAI,EAAE,CAAC,YAAY,CAAC;SACrB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAgCY,QAAA,gCAAgC,GAAG;IAC9C,OAAO;IACP,OAAO;IACP,WAAW;IACX,SAAS;IACT,gBAAgB;IAChB,WAAW;IACX,iBAAiB;IACjB,oBAAoB;IACpB,WAAW;IACX,UAAU;IACV,cAAc;IACd,oBAAoB;IACpB,qBAAqB;IACrB,yBAAyB;IACzB,kBAAkB;IAClB,kBAAkB;IAClB,eAAe;IACf,eAAe;IACf,SAAS;IACT,WAAW;IACX,KAAK;CACyD,CAAC;AAEpD,QAAA,6BAA6B,GAAG;IAC3C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC5C,kBAAkB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,kBAAkB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/C,mBAAmB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChD,uBAAuB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,gBAAgB,EAAE,6BAAqB;IACvC,gBAAgB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC7C,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,SAAS,EAAE,6BAAqB;IAChC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACd,CAAC;AAEE,QAAA,8BAA8B,GAAG,OAAC;KAC5C,MAAM,CAAC,qCAA6B,CAAC;KACrC,MAAM,EAAyC,CAAC;AAUtC,QAAA,uBAAuB,GAAG;IACrC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACxB,QAAQ,EAAE,OAAC,CAAC,UAAU,CAAC,sCAAmB,CAAC;IAC3C,QAAQ,EAAE,+BAAuB;IACjC,SAAS,EAAE,+BAAuB;IAClC,SAAS,EAAE,+BAAuB;CAC1B,CAAC;AAEE,QAAA,wBAAwB,GAAG,OAAC;KACtC,MAAM,CAAC,+BAAuB,CAAC;KAC/B,MAAM,EAAmC,CAAC;AAE7C,SAAgB,0BAA0B,CACxC,KAAyB,EACzB,GAAoB,EACpB,aAAqB;IAErB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAE9C,IAAI,SAAS,GAAG,QAAQ,EAAE,CAAC;QACzB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,wCAAwC;YACjD,IAAI,EAAE,CAAC,WAAW,CAAC;SACpB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;QAC3B,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,mCAAmC;YAC5C,IAAI,EAAE,CAAC,WAAW,CAAC;SACpB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,SAAS,GAAG,QAAQ,GAAG,aAAa,GAAG,KAAK,EAAE,CAAC;QACjD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,kCAAkC,aAAa,UAAU;YAClE,IAAI,EAAE,CAAC,WAAW,CAAC;SACpB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,IAAY,iCAOX;AAPD,WAAY,iCAAiC;IAC3C,qEAAgC,CAAA;IAChC,iFAA4C,CAAA;IAC5C,6EAAwC,CAAA;IACxC,sDAAiB,CAAA;IACjB,kEAA6B,CAAA;IAC7B,wDAAmB,CAAA;AACrB,CAAC,EAPW,iCAAiC,iDAAjC,iCAAiC,QAO5C;AAED,IAAY,wBAIX;AAJD,WAAY,wBAAwB;IAClC,sEAA0C,CAAA;IAC1C,kDAAsB,CAAA;IACtB,oDAAwB,CAAA;AAC1B,CAAC,EAJW,wBAAwB,wCAAxB,wBAAwB,QAInC;AAmBD,MAAa,6BAA8B,SAAQ,KAAK;IAEpC;IADlB,YACkB,IAAuC,EACvD,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,SAAI,GAAJ,IAAI,CAAmC;QAIvD,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AARD,sEAQC;AAED,SAAgB,4BAA4B,CAC1C,QAA4B,EAC5B,WAAmB;IAEnB,MAAM,iBAAiB,GAAG,+BAAuB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACzE,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,IAAI,6BAA6B,CACrC,iCAAiC,CAAC,aAAa,EAC/C,wDAAwD,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,6BAA6B,CACrC,iCAAiC,CAAC,WAAW,EAC7C,kCAAkC,CACnC,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,6BAA6B,CACrC,iCAAiC,CAAC,OAAO,EACzC,6BAA6B,CAC9B,CAAC;IACJ,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,oBAAoB,CACxC,QAA2B,EAC3B,WAAiC;IAEjC,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,6BAA6B,CACrC,iCAAiC,CAAC,MAAM,EACxC,0CAA0C,CAC3C,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/runner/lib/runner-job.d.ts

@@ -0,0 +1,37 @@
+import { z } from 'zod';
+import { RUNNER_JOB_AUTHORITY_FIELD_NAMES, RunnerJtiConsumer, RunnerJobAuthorityFields, RunnerSignedFields } from './runner-authority';
+import { RunnerPlaneAudience } from './runtime-identity';
+export declare enum RunnerJobState {
+    Pending = "pending",
+    Dispatched = "dispatched",
+    Accepted = "accepted",
+    Running = "running",
+    Succeeded = "succeeded",
+    Failed = "failed",
+    Expired = "expired"
+}
+export declare const RunnerJobStateSchema: z.ZodEnum<typeof RunnerJobState>;
+export declare const TERMINAL_RUNNER_JOB_STATES: ReadonlySet<RunnerJobState>;
+export declare function isTerminalRunnerJobState(state: RunnerJobState): boolean;
+export declare const RUNNER_JOB_ACCEPTED_CLOUDEVENT_TYPE: "xema.runner.job.accepted.v2";
+export declare const RUNNER_JOB_PROGRESS_CLOUDEVENT_TYPE: "xema.runner.job.progress.v2";
+export declare const RUNNER_JOB_COMPLETED_CLOUDEVENT_TYPE: "xema.runner.job.completed.v2";
+export declare const MAX_RUNNER_JOB_REPORT_TTL_SECONDS = 60;
+export type RunnerReportableJobState = RunnerJobState.Accepted | RunnerJobState.Running | RunnerJobState.Succeeded | RunnerJobState.Failed;
+export interface RunnerJobReport extends RunnerJobAuthorityFields, RunnerSignedFields {
+    audience: RunnerPlaneAudience.Report;
+    reportJti: string;
+    reportSequence: number;
+    state: RunnerReportableJobState;
+    output?: unknown;
+    error?: string;
+    reportedAt: string;
+}
+export declare const RunnerJobReportSchema: z.ZodType<RunnerJobReport>;
+export type RunnerJobReportExpectation = Pick<RunnerJobReport, (typeof RUNNER_JOB_AUTHORITY_FIELD_NAMES)[number] | 'issuer' | 'audience'> & {
+    currentTime: string;
+    signatureVerified: true;
+    jtiConsumer: RunnerJtiConsumer;
+};
+export declare function assertRunnerJobReportClaims(untrustedReport: unknown, expectation: RunnerJobReportExpectation): Promise<RunnerJobReport>;
+//# sourceMappingURL=runner-job.d.ts.map

package/dist/runner/lib/runner-job.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-job.d.ts","sourceRoot":"","sources":["../../../src/runner/lib/runner-job.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAIL,gCAAgC,EAGhC,iBAAiB,EACjB,wBAAwB,EAGxB,kBAAkB,EAGnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,oBAAY,cAAc;IACxB,OAAO,YAAY;IACnB,UAAU,eAAe;IACzB,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,MAAM,WAAW;IACjB,OAAO,YAAY;CACpB;AAED,eAAO,MAAM,oBAAoB,kCAA+B,CAAC;AAEjE,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,cAAc,CAIjE,CAAC;AAEH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAEvE;AAED,eAAO,MAAM,mCAAmC,EAC9C,6BAAsC,CAAC;AACzC,eAAO,MAAM,mCAAmC,EAC9C,6BAAsC,CAAC;AACzC,eAAO,MAAM,oCAAoC,EAC/C,8BAAuC,CAAC;AAG1C,eAAO,MAAM,iCAAiC,KAAK,CAAC;AAEpD,MAAM,MAAM,wBAAwB,GAChC,cAAc,CAAC,QAAQ,GACvB,cAAc,CAAC,OAAO,GACtB,cAAc,CAAC,SAAS,GACxB,cAAc,CAAC,MAAM,CAAC;AAO1B,MAAM,WAAW,eACf,SAAQ,wBAAwB,EAC9B,kBAAkB;IACpB,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC;IAErC,SAAS,EAAE,MAAM,CAAC;IAElB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,wBAAwB,CAAC;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AASD,eAAO,MAAM,qBAAqB,EAyD1B,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;AAEnC,MAAM,MAAM,0BAA0B,GAAG,IAAI,CAC3C,eAAe,EACf,CAAC,OAAO,gCAAgC,CAAC,CAAC,MAAM,CAAC,GAAG,QAAQ,GAAG,UAAU,CAC1E,GAAG;IACF,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,IAAI,CAAC;IACxB,WAAW,EAAE,iBAAiB,CAAC;CAChC,CAAC;AAeF,wBAAsB,2BAA2B,CAC/C,eAAe,EAAE,OAAO,EACxB,WAAW,EAAE,0BAA0B,GACtC,OAAO,CAAC,eAAe,CAAC,CAiC1B"}

package/dist/runner/lib/runner-job.js

@@ -0,0 +1,120 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RunnerJobReportSchema = exports.MAX_RUNNER_JOB_REPORT_TTL_SECONDS = exports.RUNNER_JOB_COMPLETED_CLOUDEVENT_TYPE = exports.RUNNER_JOB_PROGRESS_CLOUDEVENT_TYPE = exports.RUNNER_JOB_ACCEPTED_CLOUDEVENT_TYPE = exports.TERMINAL_RUNNER_JOB_STATES = exports.RunnerJobStateSchema = exports.RunnerJobState = void 0;
+exports.isTerminalRunnerJobState = isTerminalRunnerJobState;
+exports.assertRunnerJobReportClaims = assertRunnerJobReportClaims;
+const zod_1 = require("zod");
+const runner_authority_1 = require("./runner-authority");
+const runtime_identity_1 = require("./runtime-identity");
+var RunnerJobState;
+(function (RunnerJobState) {
+    RunnerJobState["Pending"] = "pending";
+    RunnerJobState["Dispatched"] = "dispatched";
+    RunnerJobState["Accepted"] = "accepted";
+    RunnerJobState["Running"] = "running";
+    RunnerJobState["Succeeded"] = "succeeded";
+    RunnerJobState["Failed"] = "failed";
+    RunnerJobState["Expired"] = "expired";
+})(RunnerJobState || (exports.RunnerJobState = RunnerJobState = {}));
+exports.RunnerJobStateSchema = zod_1.z.nativeEnum(RunnerJobState);
+exports.TERMINAL_RUNNER_JOB_STATES = new Set([
+    RunnerJobState.Succeeded,
+    RunnerJobState.Failed,
+    RunnerJobState.Expired,
+]);
+function isTerminalRunnerJobState(state) {
+    return exports.TERMINAL_RUNNER_JOB_STATES.has(state);
+}
+exports.RUNNER_JOB_ACCEPTED_CLOUDEVENT_TYPE = 'xema.runner.job.accepted.v2';
+exports.RUNNER_JOB_PROGRESS_CLOUDEVENT_TYPE = 'xema.runner.job.progress.v2';
+exports.RUNNER_JOB_COMPLETED_CLOUDEVENT_TYPE = 'xema.runner.job.completed.v2';
+exports.MAX_RUNNER_JOB_REPORT_TTL_SECONDS = 60;
+const RunnerReportableJobStateSchema = zod_1.z.union([
+    zod_1.z.literal(RunnerJobState.Accepted),
+    zod_1.z.literal(RunnerJobState.Running),
+    zod_1.z.literal(RunnerJobState.Succeeded),
+    zod_1.z.literal(RunnerJobState.Failed),
+]);
+exports.RunnerJobReportSchema = zod_1.z
+    .object({
+    ...runner_authority_1.RunnerJobAuthorityFieldsShape,
+    ...runner_authority_1.RunnerSignedFieldsShape,
+    audience: zod_1.z.literal(runtime_identity_1.RunnerPlaneAudience.Report),
+    reportJti: zod_1.z.string().min(1),
+    reportSequence: zod_1.z.number().int().positive(),
+    state: RunnerReportableJobStateSchema,
+    output: zod_1.z.unknown().optional(),
+    error: zod_1.z.string().min(1).optional(),
+    reportedAt: runner_authority_1.RunnerUtcDateTimeSchema,
+})
+    .strict()
+    .superRefine((report, ctx) => {
+    (0, runner_authority_1.addRunnerClaimWindowIssues)(report, ctx, exports.MAX_RUNNER_JOB_REPORT_TTL_SECONDS);
+    const hasOutput = Object.prototype.hasOwnProperty.call(report, 'output');
+    if (report.state === RunnerJobState.Succeeded && !hasOutput) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            message: 'succeeded reports require output',
+            path: ['output'],
+        });
+    }
+    if (report.state !== RunnerJobState.Succeeded && hasOutput) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            message: 'output is allowed only on succeeded reports',
+            path: ['output'],
+        });
+    }
+    if (report.state === RunnerJobState.Failed && report.error === undefined) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            message: 'failed reports require error',
+            path: ['error'],
+        });
+    }
+    if (report.state !== RunnerJobState.Failed && report.error !== undefined) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            message: 'error is allowed only on failed reports',
+            path: ['error'],
+        });
+    }
+    const reportedAt = Date.parse(report.reportedAt);
+    if (reportedAt < Date.parse(report.notBefore) ||
+        reportedAt >= Date.parse(report.expiresAt)) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            message: 'reportedAt must be inside the signed validity window',
+            path: ['reportedAt'],
+        });
+    }
+});
+const REPORT_EXACT_MATCH_FIELDS = [
+    ...runner_authority_1.RUNNER_JOB_AUTHORITY_FIELD_NAMES,
+    'issuer',
+    'audience',
+];
+async function assertRunnerJobReportClaims(untrustedReport, expectation) {
+    if (expectation.signatureVerified !== true) {
+        throw new runner_authority_1.RunnerArtifactValidationError(runner_authority_1.RunnerArtifactValidationErrorCode.SignatureUnverified, 'runner job report signature must be verified before claim validation');
+    }
+    const parsed = exports.RunnerJobReportSchema.safeParse(untrustedReport);
+    if (!parsed.success) {
+        throw new runner_authority_1.RunnerArtifactValidationError(runner_authority_1.RunnerArtifactValidationErrorCode.SchemaInvalid, `invalid runner job report claims: ${parsed.error.message}`);
+    }
+    for (const field of REPORT_EXACT_MATCH_FIELDS) {
+        if (parsed.data[field] !== expectation[field]) {
+            throw new runner_authority_1.RunnerArtifactValidationError(runner_authority_1.RunnerArtifactValidationErrorCode.AuthorityMismatch, `runner job report ${field} does not match durable authority`);
+        }
+    }
+    (0, runner_authority_1.assertRunnerArtifactActiveAt)(parsed.data, expectation.currentTime);
+    await (0, runner_authority_1.consumeRunnerJtiOnce)(expectation.jtiConsumer, {
+        artifactKind: runner_authority_1.RunnerReplayArtifactKind.JobReport,
+        issuer: parsed.data.issuer,
+        audience: parsed.data.audience,
+        jti: parsed.data.reportJti,
+        expiresAt: parsed.data.expiresAt,
+    });
+    return parsed.data;
+}
+//# sourceMappingURL=runner-job.js.map