@xemahq/contracts 0.1.0

package/dist/runner/lib/runner-job.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-job.js","sourceRoot":"","sources":["../../../src/runner/lib/runner-job.ts"],"names":[],"mappings":";;;AAqCA,4DAEC;AA6HD,kEAoCC;AAxMD,6BAAwB;AAExB,yDAc4B;AAC5B,yDAAyD;AAEzD,IAAY,cAQX;AARD,WAAY,cAAc;IACxB,qCAAmB,CAAA;IACnB,2CAAyB,CAAA;IACzB,uCAAqB,CAAA;IACrB,qCAAmB,CAAA;IACnB,yCAAuB,CAAA;IACvB,mCAAiB,CAAA;IACjB,qCAAmB,CAAA;AACrB,CAAC,EARW,cAAc,8BAAd,cAAc,QAQzB;AAEY,QAAA,oBAAoB,GAAG,OAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AAEpD,QAAA,0BAA0B,GAAgC,IAAI,GAAG,CAAC;IAC7E,cAAc,CAAC,SAAS;IACxB,cAAc,CAAC,MAAM;IACrB,cAAc,CAAC,OAAO;CACvB,CAAC,CAAC;AAEH,SAAgB,wBAAwB,CAAC,KAAqB;IAC5D,OAAO,kCAA0B,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAEY,QAAA,mCAAmC,GAC9C,6BAAsC,CAAC;AAC5B,QAAA,mCAAmC,GAC9C,6BAAsC,CAAC;AAC5B,QAAA,oCAAoC,GAC/C,8BAAuC,CAAC;AAG7B,QAAA,iCAAiC,GAAG,EAAE,CAAC;AA2BpD,MAAM,8BAA8B,GAAG,OAAC,CAAC,KAAK,CAAC;IAC7C,OAAC,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC;IAClC,OAAC,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC;IACjC,OAAC,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC;IACnC,OAAC,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC;CACjC,CAAC,CAAC;AAEU,QAAA,qBAAqB,GAAG,OAAC;KACnC,MAAM,CAAC;IACN,GAAG,gDAA6B;IAChC,GAAG,0CAAuB;IAC1B,QAAQ,EAAE,OAAC,CAAC,OAAO,CAAC,sCAAmB,CAAC,MAAM,CAAC;IAC/C,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,8BAA8B;IACrC,MAAM,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC9B,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,0CAAuB;CACpC,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,IAAA,6CAA0B,EAAC,MAAM,EAAE,GAAG,EAAE,yCAAiC,CAAC,CAAC;IAE3E,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,KAAK,KAAK,cAAc,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5D,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,kCAAkC;YAC3C,IAAI,EAAE,CAAC,QAAQ,CAAC;SACjB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,cAAc,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC;QAC3D,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,6CAA6C;YACtD,IAAI,EAAE,CAAC,QAAQ,CAAC;SACjB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,cAAc,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACzE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,8BAA8B;YACvC,IAAI,EAAE,CAAC,OAAO,CAAC;SAChB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,cAAc,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACzE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,yCAAyC;YAClD,IAAI,EAAE,CAAC,OAAO,CAAC;SAChB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACjD,IACE,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC;QACzC,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAC1C,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,sDAAsD;YAC/D,IAAI,EAAE,CAAC,YAAY,CAAC;SACrB,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAA+B,CAAC;AAWnC,MAAM,yBAAyB,GAAG;IAChC,GAAG,mDAAgC;IACnC,QAAQ;IACR,UAAU;CACF,CAAC;AASJ,KAAK,UAAU,2BAA2B,CAC/C,eAAwB,EACxB,WAAuC;IAEvC,IAAI,WAAW,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC3C,MAAM,IAAI,gDAA6B,CACrC,oDAAiC,CAAC,mBAAmB,EACrD,sEAAsE,CACvE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,6BAAqB,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,gDAA6B,CACrC,oDAAiC,CAAC,aAAa,EAC/C,qCAAqC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAC5D,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,yBAAyB,EAAE,CAAC;QAC9C,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,gDAA6B,CACrC,oDAAiC,CAAC,iBAAiB,EACnD,qBAAqB,KAAK,mCAAmC,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAA,+CAA4B,EAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,IAAA,uCAAoB,EAAC,WAAW,CAAC,WAAW,EAAE;QAClD,YAAY,EAAE,2CAAwB,CAAC,SAAS;QAChD,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;QAC1B,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;QAC9B,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;QAC1B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;KACjC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}

package/dist/runner/lib/runner-kind.d.ts

@@ -0,0 +1,2 @@
+export { RunnerKind, RunnerKindSchema } from '../../policy';
+//# sourceMappingURL=runner-kind.d.ts.map

package/dist/runner/lib/runner-kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-kind.d.ts","sourceRoot":"","sources":["../../../src/runner/lib/runner-kind.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC"}

package/dist/runner/lib/runner-kind.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RunnerKindSchema = exports.RunnerKind = void 0;
+var policy_1 = require("../../policy");
+Object.defineProperty(exports, "RunnerKind", { enumerable: true, get: function () { return policy_1.RunnerKind; } });
+Object.defineProperty(exports, "RunnerKindSchema", { enumerable: true, get: function () { return policy_1.RunnerKindSchema; } });
+//# sourceMappingURL=runner-kind.js.map

package/dist/runner/lib/runner-kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-kind.js","sourceRoot":"","sources":["../../../src/runner/lib/runner-kind.ts"],"names":[],"mappings":";;;AASA,uCAA4D;AAAnD,oGAAA,UAAU,OAAA;AAAE,0GAAA,gBAAgB,OAAA"}

package/dist/runner/lib/runner-lease-store.d.ts

@@ -0,0 +1,37 @@
+import { z } from 'zod';
+import { type SignedRunnerAttestationReceipt } from './runner-attestation';
+import { type RunnerLease } from './runner-registration';
+export declare const RUNNER_LEASE_RECORD_VERSION: 2;
+export declare const RUNNER_LEASE_KEY_PREFIX: "/xema/runners/leases/v2/";
+export declare function runnerLeaseKey(runnerId: string): string;
+export interface RunnerLeaseRecord {
+    readonly version: typeof RUNNER_LEASE_RECORD_VERSION;
+    readonly attestationRevision: number;
+    readonly lease: RunnerLease;
+    readonly attestationReceipt: SignedRunnerAttestationReceipt;
+    readonly publishedAt: string;
+}
+export declare const RunnerLeaseRecordSchema: z.ZodType<RunnerLeaseRecord>;
+export interface RunnerLeasePublication {
+    readonly record: RunnerLeaseRecord;
+    readonly expectedRevision: number;
+    readonly ttlSeconds: number;
+}
+export interface RunnerLeaseStore {
+    get(runnerId: string): Promise<{
+        readonly record: RunnerLeaseRecord;
+        readonly revision: number;
+    } | null>;
+    list(): Promise<ReadonlyArray<{
+        readonly record: RunnerLeaseRecord;
+        readonly revision: number;
+    }>>;
+    publish(publication: RunnerLeasePublication): Promise<void>;
+    revoke(args: {
+        readonly runnerId: string;
+        readonly attestationRevision: number;
+        readonly expectedRevision: number;
+        readonly revokedAt: string;
+    }): Promise<void>;
+}
+//# sourceMappingURL=runner-lease-store.d.ts.map

package/dist/runner/lib/runner-lease-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-lease-store.d.ts","sourceRoot":"","sources":["../../../src/runner/lib/runner-lease-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAEL,KAAK,8BAA8B,EACpC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAG5E,eAAO,MAAM,2BAA2B,EAAG,CAAU,CAAC;AAQtD,eAAO,MAAM,uBAAuB,4BAC8B,CAAC;AAEnE,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAMvD;AAOD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,2BAA2B,CAAC;IACrD,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,kBAAkB,EAAE,8BAA8B,CAAC;IAC5D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,eAAO,MAAM,uBAAuB,EAwB5B,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAErC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAKnC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAElC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAC7B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;QACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC3B,GAAG,IAAI,CAAC,CAAC;IACV,IAAI,IAAI,OAAO,CACb,aAAa,CAAC;QACZ,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;QACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC3B,CAAC,CACH,CAAC;IACF,OAAO,CAAC,WAAW,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,CAAC,IAAI,EAAE;QACX,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;QACrC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnB"}

package/dist/runner/lib/runner-lease-store.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RunnerLeaseRecordSchema = exports.RUNNER_LEASE_KEY_PREFIX = exports.RUNNER_LEASE_RECORD_VERSION = void 0;
+exports.runnerLeaseKey = runnerLeaseKey;
+const zod_1 = require("zod");
+const runner_attestation_1 = require("./runner-attestation");
+const runner_registration_1 = require("./runner-registration");
+exports.RUNNER_LEASE_RECORD_VERSION = 2;
+exports.RUNNER_LEASE_KEY_PREFIX = `/xema/runners/leases/v${exports.RUNNER_LEASE_RECORD_VERSION}/`;
+function runnerLeaseKey(runnerId) {
+    const normalized = runnerId.trim();
+    if (normalized === '') {
+        throw new Error('runnerId is required for a RunnerLease key');
+    }
+    return `${exports.RUNNER_LEASE_KEY_PREFIX}${encodeURIComponent(normalized)}`;
+}
+exports.RunnerLeaseRecordSchema = zod_1.z
+    .object({
+    version: zod_1.z.literal(exports.RUNNER_LEASE_RECORD_VERSION),
+    attestationRevision: zod_1.z.number().int().positive(),
+    lease: runner_registration_1.RunnerLeaseSchema,
+    attestationReceipt: runner_attestation_1.SignedRunnerAttestationReceiptSchema,
+    publishedAt: zod_1.z.string().datetime({ offset: false }),
+})
+    .strict()
+    .superRefine((record, ctx) => {
+    if (record.attestationRevision !== record.lease.attestationRevision) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['attestationRevision'],
+            message: 'record and lease attestation revisions must match',
+        });
+    }
+    if (Date.parse(record.publishedAt) < Date.parse(record.lease.issuedAt)) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['publishedAt'],
+            message: 'publishedAt must not precede lease issuance',
+        });
+    }
+});
+//# sourceMappingURL=runner-lease-store.js.map

package/dist/runner/lib/runner-lease-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-lease-store.js","sourceRoot":"","sources":["../../../src/runner/lib/runner-lease-store.ts"],"names":[],"mappings":";;;AAoBA,wCAMC;AA1BD,6BAAwB;AAExB,6DAG8B;AAC9B,+DAA4E;AAG/D,QAAA,2BAA2B,GAAG,CAAU,CAAC;AAQzC,QAAA,uBAAuB,GAClC,yBAAyB,mCAA2B,GAAY,CAAC;AAEnE,SAAgB,cAAc,CAAC,QAAgB;IAC7C,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,GAAG,+BAAuB,GAAG,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC;AACvE,CAAC;AAeY,QAAA,uBAAuB,GAAG,OAAC;KACrC,MAAM,CAAC;IACN,OAAO,EAAE,OAAC,CAAC,OAAO,CAAC,mCAA2B,CAAC;IAC/C,mBAAmB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChD,KAAK,EAAE,uCAAiB;IACxB,kBAAkB,EAAE,yDAAoC;IACxD,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;CACpD,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,IAAI,MAAM,CAAC,mBAAmB,KAAK,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;QACpE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,qBAAqB,CAAC;YAC7B,OAAO,EAAE,mDAAmD;SAC7D,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EAAE,6CAA6C;SACvD,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAiC,CAAC"}

package/dist/runner/lib/runner-mode.d.ts

@@ -0,0 +1,5 @@
+export declare enum RunnerTransport {
+    Push = "push",
+    Pull = "pull"
+}
+//# sourceMappingURL=runner-mode.d.ts.map

package/dist/runner/lib/runner-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-mode.d.ts","sourceRoot":"","sources":["../../../src/runner/lib/runner-mode.ts"],"names":[],"mappings":"AAYA,oBAAY,eAAe;IACzB,IAAI,SAAS;IACb,IAAI,SAAS;CACd"}

package/dist/runner/lib/runner-mode.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RunnerTransport = void 0;
+var RunnerTransport;
+(function (RunnerTransport) {
+    RunnerTransport["Push"] = "push";
+    RunnerTransport["Pull"] = "pull";
+})(RunnerTransport || (exports.RunnerTransport = RunnerTransport = {}));
+//# sourceMappingURL=runner-mode.js.map

package/dist/runner/lib/runner-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-mode.js","sourceRoot":"","sources":["../../../src/runner/lib/runner-mode.ts"],"names":[],"mappings":";;;AAYA,IAAY,eAGX;AAHD,WAAY,eAAe;IACzB,gCAAa,CAAA;IACb,gCAAa,CAAA;AACf,CAAC,EAHW,eAAe,+BAAf,eAAe,QAG1B"}

package/dist/runner/lib/runner-plane.d.ts

@@ -0,0 +1,2 @@
+export declare const RUNNER_PLANE_SERVICE_NAME: "xema-runner-plane";
+//# sourceMappingURL=runner-plane.d.ts.map

package/dist/runner/lib/runner-plane.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-plane.d.ts","sourceRoot":"","sources":["../../../src/runner/lib/runner-plane.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,yBAAyB,EAAG,mBAA4B,CAAC"}

package/dist/runner/lib/runner-plane.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RUNNER_PLANE_SERVICE_NAME = void 0;
+exports.RUNNER_PLANE_SERVICE_NAME = 'xema-runner-plane';
+//# sourceMappingURL=runner-plane.js.map

package/dist/runner/lib/runner-plane.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-plane.js","sourceRoot":"","sources":["../../../src/runner/lib/runner-plane.ts"],"names":[],"mappings":";;;AAaa,QAAA,yBAAyB,GAAG,mBAA4B,CAAC"}

package/dist/runner/lib/runner-registration.d.ts

@@ -0,0 +1,41 @@
+import { z } from 'zod';
+import { RunnerKind } from '../../policy';
+import { RunnerTransport } from './runner-mode';
+import { RunnerLeaseState, RuntimeOperatorKind } from './runtime-identity';
+import { RunnerTrustTier } from './runner';
+export declare enum RunnerMode {
+    Embedded = "embedded",
+    LocalModule = "local-module",
+    Remote = "remote"
+}
+export declare const RunnerModeSchema: z.ZodEnum<typeof RunnerMode>;
+export declare enum RunnerDataLocality {
+    Cloud = "cloud",
+    CustomerPrivate = "customer-private",
+    Gpu = "gpu"
+}
+export declare const RunnerDataLocalitySchema: z.ZodEnum<typeof RunnerDataLocality>;
+export declare const FORBIDDEN_RUNNER_OPERATIONAL_LABEL_KEYS: ReadonlySet<string>;
+export interface RunnerLease {
+    runnerId: string;
+    enrollmentId: string;
+    principalId: string;
+    credentialRevision: number;
+    runtimeId: string;
+    ownerOrgId: string | null;
+    operatorKind: RuntimeOperatorKind;
+    mode: RunnerMode;
+    kind: RunnerKind;
+    transport: RunnerTransport;
+    locality: RunnerDataLocality;
+    trustTier: RunnerTrustTier;
+    allowedEnvironmentIds: readonly string[];
+    capabilityRefs: readonly string[];
+    operationalLabels: Readonly<Record<string, string>>;
+    attestationRevision: number;
+    issuedAt: string;
+    expiresAt: string;
+    state: RunnerLeaseState;
+}
+export declare const RunnerLeaseSchema: z.ZodType<RunnerLease>;
+//# sourceMappingURL=runner-registration.d.ts.map

package/dist/runner/lib/runner-registration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-registration.d.ts","sourceRoot":"","sources":["../../../src/runner/lib/runner-registration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAoB,MAAM,cAAc,CAAC;AAE5D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAMhD,OAAO,EACL,gBAAgB,EAEhB,mBAAmB,EAEpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAG3C,oBAAY,UAAU;IACpB,QAAQ,aAAa;IACrB,WAAW,iBAAiB;IAC5B,MAAM,WAAW;CAClB;AAED,eAAO,MAAM,gBAAgB,8BAA2B,CAAC;AAMzD,oBAAY,kBAAkB;IAC5B,KAAK,UAAU;IACf,eAAe,qBAAqB;IACpC,GAAG,QAAQ;CACZ;AAED,eAAO,MAAM,wBAAwB,sCAAmC,CAAC;AAMzE,eAAO,MAAM,uCAAuC,EAAE,WAAW,CAAC,MAAM,CAapE,CAAC;AAML,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,mBAAmB,CAAC;IAClC,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,SAAS,EAAE,eAAe,CAAC;IAC3B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,SAAS,EAAE,eAAe,CAAC;IAC3B,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,gBAAgB,CAAC;CACzB;AAED,eAAO,MAAM,iBAAiB,EA2CtB,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC"}

package/dist/runner/lib/runner-registration.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RunnerLeaseSchema = exports.FORBIDDEN_RUNNER_OPERATIONAL_LABEL_KEYS = exports.RunnerDataLocalitySchema = exports.RunnerDataLocality = exports.RunnerModeSchema = exports.RunnerMode = void 0;
+const zod_1 = require("zod");
+const policy_1 = require("../../policy");
+const runner_mode_1 = require("./runner-mode");
+const runner_authority_1 = require("./runner-authority");
+const runtime_identity_1 = require("./runtime-identity");
+const runner_1 = require("./runner");
+var RunnerMode;
+(function (RunnerMode) {
+    RunnerMode["Embedded"] = "embedded";
+    RunnerMode["LocalModule"] = "local-module";
+    RunnerMode["Remote"] = "remote";
+})(RunnerMode || (exports.RunnerMode = RunnerMode = {}));
+exports.RunnerModeSchema = zod_1.z.nativeEnum(RunnerMode);
+var RunnerDataLocality;
+(function (RunnerDataLocality) {
+    RunnerDataLocality["Cloud"] = "cloud";
+    RunnerDataLocality["CustomerPrivate"] = "customer-private";
+    RunnerDataLocality["Gpu"] = "gpu";
+})(RunnerDataLocality || (exports.RunnerDataLocality = RunnerDataLocality = {}));
+exports.RunnerDataLocalitySchema = zod_1.z.nativeEnum(RunnerDataLocality);
+exports.FORBIDDEN_RUNNER_OPERATIONAL_LABEL_KEYS = new Set([
+    'xema.runner/kind',
+    'xema.runner/mode',
+    'xema.runner/transport',
+    'xema.runner/data-locality',
+    'xema.runner/trust-tier',
+    'xema.runner/runtime-id',
+    'xema.runner/owner-org-id',
+    'xema.runner/enrollment-id',
+    'xema.runner/principal-id',
+    'xema.runner/credential-revision',
+    'xema.runner/attestation-revision',
+]);
+exports.RunnerLeaseSchema = zod_1.z
+    .object({
+    runnerId: zod_1.z.string().min(1),
+    enrollmentId: zod_1.z.string().min(1),
+    principalId: zod_1.z.string().min(1),
+    credentialRevision: zod_1.z.number().int().positive(),
+    runtimeId: zod_1.z.string().min(1),
+    ownerOrgId: zod_1.z.string().min(1).nullable(),
+    operatorKind: runtime_identity_1.RuntimeOperatorKindSchema,
+    mode: exports.RunnerModeSchema,
+    kind: policy_1.RunnerKindSchema,
+    transport: zod_1.z.nativeEnum(runner_mode_1.RunnerTransport),
+    locality: exports.RunnerDataLocalitySchema,
+    trustTier: zod_1.z.nativeEnum(runner_1.RunnerTrustTier),
+    allowedEnvironmentIds: (0, runner_authority_1.runnerUniqueNonEmptyStringArraySchema)('allowedEnvironmentIds'),
+    capabilityRefs: (0, runner_authority_1.runnerUniqueNonEmptyStringArraySchema)('capabilityRefs'),
+    operationalLabels: zod_1.z.record(zod_1.z.string().min(1), zod_1.z.string()),
+    attestationRevision: zod_1.z.number().int().positive(),
+    issuedAt: runner_authority_1.RunnerUtcDateTimeSchema,
+    expiresAt: runner_authority_1.RunnerUtcDateTimeSchema,
+    state: runtime_identity_1.RunnerLeaseStateSchema,
+})
+    .strict()
+    .superRefine((lease, ctx) => {
+    (0, runner_authority_1.addRuntimeOperatorOwnerIssues)(lease.operatorKind, lease.ownerOrgId, ctx);
+    if (Date.parse(lease.expiresAt) <= Date.parse(lease.issuedAt)) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            message: 'expiresAt must be after issuedAt',
+            path: ['expiresAt'],
+        });
+    }
+    for (const key of Object.keys(lease.operationalLabels)) {
+        if (exports.FORBIDDEN_RUNNER_OPERATIONAL_LABEL_KEYS.has(key)) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                message: `${key} is an authority field and cannot be an operational label`,
+                path: ['operationalLabels', key],
+            });
+        }
+    }
+});
+//# sourceMappingURL=runner-registration.js.map

package/dist/runner/lib/runner-registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-registration.js","sourceRoot":"","sources":["../../../src/runner/lib/runner-registration.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AACxB,yCAA4D;AAE5D,+CAAgD;AAChD,yDAI4B;AAC5B,yDAK4B;AAC5B,qCAA2C;AAG3C,IAAY,UAIX;AAJD,WAAY,UAAU;IACpB,mCAAqB,CAAA;IACrB,0CAA4B,CAAA;IAC5B,+BAAiB,CAAA;AACnB,CAAC,EAJW,UAAU,0BAAV,UAAU,QAIrB;AAEY,QAAA,gBAAgB,GAAG,OAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AAMzD,IAAY,kBAIX;AAJD,WAAY,kBAAkB;IAC5B,qCAAe,CAAA;IACf,0DAAoC,CAAA;IACpC,iCAAW,CAAA;AACb,CAAC,EAJW,kBAAkB,kCAAlB,kBAAkB,QAI7B;AAEY,QAAA,wBAAwB,GAAG,OAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AAM5D,QAAA,uCAAuC,GAClD,IAAI,GAAG,CAAC;IACN,kBAAkB;IAClB,kBAAkB;IAClB,uBAAuB;IACvB,2BAA2B;IAC3B,wBAAwB;IACxB,wBAAwB;IACxB,0BAA0B;IAC1B,2BAA2B;IAC3B,0BAA0B;IAC1B,iCAAiC;IACjC,kCAAkC;CACnC,CAAC,CAAC;AA4BQ,QAAA,iBAAiB,GAAG,OAAC;KAC/B,MAAM,CAAC;IACN,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,kBAAkB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC/C,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,4CAAyB;IACvC,IAAI,EAAE,wBAAgB;IACtB,IAAI,EAAE,yBAAgB;IACtB,SAAS,EAAE,OAAC,CAAC,UAAU,CAAC,6BAAe,CAAC;IACxC,QAAQ,EAAE,gCAAwB;IAClC,SAAS,EAAE,OAAC,CAAC,UAAU,CAAC,wBAAe,CAAC;IACxC,qBAAqB,EAAE,IAAA,wDAAqC,EAC1D,uBAAuB,CACxB;IACD,cAAc,EAAE,IAAA,wDAAqC,EAAC,gBAAgB,CAAC;IACvE,iBAAiB,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC;IAC1D,mBAAmB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChD,QAAQ,EAAE,0CAAuB;IACjC,SAAS,EAAE,0CAAuB;IAClC,KAAK,EAAE,yCAAsB;CAC9B,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAA,gDAA6B,EAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACzE,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,kCAAkC;YAC3C,IAAI,EAAE,CAAC,WAAW,CAAC;SACpB,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACvD,IAAI,+CAAuC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,GAAG,GAAG,2DAA2D;gBAC1E,IAAI,EAAE,CAAC,mBAAmB,EAAE,GAAG,CAAC;aACjC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAA2B,CAAC"}

package/dist/runner/lib/runner.d.ts

@@ -0,0 +1,13 @@
+export declare enum RunnerTrustTier {
+    Untrusted = "untrusted",
+    Verified = "verified",
+    Trusted = "trusted",
+    System = "system"
+}
+export declare const RUNNER_TRUST_TIER_RANK: Record<RunnerTrustTier, number>;
+export declare function runnerTrustTierMeets(actual: RunnerTrustTier, minimum: RunnerTrustTier): boolean;
+export declare function isRunnerTrustTier(value: unknown): value is RunnerTrustTier;
+export type RunnerId = string & {
+    readonly __brand: 'RunnerId';
+};
+//# sourceMappingURL=runner.d.ts.map

package/dist/runner/lib/runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../../src/runner/lib/runner.ts"],"names":[],"mappings":"AAoBA,oBAAY,eAAe;IACzB,SAAS,cAAc;IACvB,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,MAAM,WAAW;CAClB;AAUD,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAKlE,CAAC;AAOF,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,eAAe,GACvB,OAAO,CAET;AAGD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAK1E;AAQD,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAA;CAAE,CAAC"}

package/dist/runner/lib/runner.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RUNNER_TRUST_TIER_RANK = exports.RunnerTrustTier = void 0;
+exports.runnerTrustTierMeets = runnerTrustTierMeets;
+exports.isRunnerTrustTier = isRunnerTrustTier;
+var RunnerTrustTier;
+(function (RunnerTrustTier) {
+    RunnerTrustTier["Untrusted"] = "untrusted";
+    RunnerTrustTier["Verified"] = "verified";
+    RunnerTrustTier["Trusted"] = "trusted";
+    RunnerTrustTier["System"] = "system";
+})(RunnerTrustTier || (exports.RunnerTrustTier = RunnerTrustTier = {}));
+exports.RUNNER_TRUST_TIER_RANK = {
+    [RunnerTrustTier.Untrusted]: 0,
+    [RunnerTrustTier.Verified]: 1,
+    [RunnerTrustTier.Trusted]: 2,
+    [RunnerTrustTier.System]: 3,
+};
+function runnerTrustTierMeets(actual, minimum) {
+    return exports.RUNNER_TRUST_TIER_RANK[actual] >= exports.RUNNER_TRUST_TIER_RANK[minimum];
+}
+function isRunnerTrustTier(value) {
+    return (typeof value === 'string' &&
+        Object.values(RunnerTrustTier).includes(value));
+}
+//# sourceMappingURL=runner.js.map

package/dist/runner/lib/runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../../src/runner/lib/runner.ts"],"names":[],"mappings":";;;AA+CA,oDAKC;AAGD,8CAKC;AAxCD,IAAY,eAKX;AALD,WAAY,eAAe;IACzB,0CAAuB,CAAA;IACvB,wCAAqB,CAAA;IACrB,sCAAmB,CAAA;IACnB,oCAAiB,CAAA;AACnB,CAAC,EALW,eAAe,+BAAf,eAAe,QAK1B;AAUY,QAAA,sBAAsB,GAAoC;IACrE,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;IAC9B,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC7B,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5B,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;CAC5B,CAAC;AAOF,SAAgB,oBAAoB,CAClC,MAAuB,EACvB,OAAwB;IAExB,OAAO,8BAAsB,CAAC,MAAM,CAAC,IAAI,8BAAsB,CAAC,OAAO,CAAC,CAAC;AAC3E,CAAC;AAGD,SAAgB,iBAAiB,CAAC,KAAc;IAC9C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACxB,MAAM,CAAC,MAAM,CAAC,eAAe,CAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC7D,CAAC;AACJ,CAAC"}

package/dist/runner/lib/runtime-identity.d.ts

@@ -0,0 +1,54 @@
+import { z } from 'zod';
+export declare enum RuntimeOperatorKind {
+    PlatformManaged = "platform_managed",
+    PlatformExternal = "platform_external",
+    OrganizationExternal = "organization_external"
+}
+export declare const RuntimeOperatorKindSchema: z.ZodEnum<typeof RuntimeOperatorKind>;
+export declare enum CredentialDeliveryKind {
+    PlatformCustody = "platform_custody",
+    OneTimeExchange = "one_time_exchange",
+    TokenOnly = "token_only"
+}
+export declare const CredentialDeliveryKindSchema: z.ZodEnum<typeof CredentialDeliveryKind>;
+export declare enum RunnerEnrollmentDesiredState {
+    Active = "active",
+    Revoked = "revoked"
+}
+export declare const RunnerEnrollmentDesiredStateSchema: z.ZodEnum<typeof RunnerEnrollmentDesiredState>;
+export declare enum RunnerEnrollmentObservedState {
+    Requested = "requested",
+    Provisioning = "provisioning",
+    PendingClaim = "pending_claim",
+    Active = "active",
+    Rotating = "rotating",
+    Draining = "draining",
+    Revoking = "revoking",
+    Revoked = "revoked",
+    Failed = "failed"
+}
+export declare const RunnerEnrollmentObservedStateSchema: z.ZodEnum<typeof RunnerEnrollmentObservedState>;
+export declare enum RunnerLeaseState {
+    Active = "active",
+    Draining = "draining",
+    Revoked = "revoked",
+    Expired = "expired"
+}
+export declare const RunnerLeaseStateSchema: z.ZodEnum<typeof RunnerLeaseState>;
+export declare enum InFlightRevocationPolicy {
+    Cancel = "cancel",
+    AllowCurrent = "allow_current"
+}
+export declare const InFlightRevocationPolicySchema: z.ZodEnum<typeof InFlightRevocationPolicy>;
+export declare enum RunnerPlaneAudience {
+    Enrollment = "xema.runner-plane.enrollment.v1",
+    Attestation = "xema.runner-plane.attestation.v1",
+    AttestationReceipt = "xema.runner-plane.attestation-receipt.v1",
+    JobTokenMint = "xema.runner-plane.job-token.mint.v1",
+    Pull = "xema.runner-plane.pull.v1",
+    Report = "xema.runner-plane.report.v1",
+    Dispatch = "xema.runner-plane.dispatch.v1",
+    Job = "xema.runner-plane.job.v1"
+}
+export declare const RunnerPlaneAudienceSchema: z.ZodEnum<typeof RunnerPlaneAudience>;
+//# sourceMappingURL=runtime-identity.d.ts.map

package/dist/runner/lib/runtime-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-identity.d.ts","sourceRoot":"","sources":["../../../src/runner/lib/runtime-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,oBAAY,mBAAmB;IAC7B,eAAe,qBAAqB;IACpC,gBAAgB,sBAAsB;IACtC,oBAAoB,0BAA0B;CAC/C;AAED,eAAO,MAAM,yBAAyB,uCAAoC,CAAC;AAG3E,oBAAY,sBAAsB;IAChC,eAAe,qBAAqB;IACpC,eAAe,sBAAsB;IACrC,SAAS,eAAe;CACzB;AAED,eAAO,MAAM,4BAA4B,0CAExC,CAAC;AAGF,oBAAY,4BAA4B;IACtC,MAAM,WAAW;IACjB,OAAO,YAAY;CACpB;AAED,eAAO,MAAM,kCAAkC,gDAE9C,CAAC;AAGF,oBAAY,6BAA6B;IACvC,SAAS,cAAc;IACvB,YAAY,iBAAiB;IAC7B,YAAY,kBAAkB;IAC9B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,QAAQ,aAAa;IACrB,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,MAAM,WAAW;CAClB;AAED,eAAO,MAAM,mCAAmC,iDAE/C,CAAC;AAGF,oBAAY,gBAAgB;IAC1B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,OAAO,YAAY;CACpB;AAED,eAAO,MAAM,sBAAsB,oCAAiC,CAAC;AAGrE,oBAAY,wBAAwB;IAClC,MAAM,WAAW;IACjB,YAAY,kBAAkB;CAC/B;AAED,eAAO,MAAM,8BAA8B,4CAE1C,CAAC;AAMF,oBAAY,mBAAmB;IAC7B,UAAU,oCAAoC;IAC9C,WAAW,qCAAqC;IAChD,kBAAkB,6CAA6C;IAC/D,YAAY,wCAAwC;IACpD,IAAI,8BAA8B;IAClC,MAAM,gCAAgC;IACtC,QAAQ,kCAAkC;IAC1C,GAAG,6BAA6B;CACjC;AAED,eAAO,MAAM,yBAAyB,uCAAoC,CAAC"}

package/dist/runner/lib/runtime-identity.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RunnerPlaneAudienceSchema = exports.RunnerPlaneAudience = exports.InFlightRevocationPolicySchema = exports.InFlightRevocationPolicy = exports.RunnerLeaseStateSchema = exports.RunnerLeaseState = exports.RunnerEnrollmentObservedStateSchema = exports.RunnerEnrollmentObservedState = exports.RunnerEnrollmentDesiredStateSchema = exports.RunnerEnrollmentDesiredState = exports.CredentialDeliveryKindSchema = exports.CredentialDeliveryKind = exports.RuntimeOperatorKindSchema = exports.RuntimeOperatorKind = void 0;
+const zod_1 = require("zod");
+var RuntimeOperatorKind;
+(function (RuntimeOperatorKind) {
+    RuntimeOperatorKind["PlatformManaged"] = "platform_managed";
+    RuntimeOperatorKind["PlatformExternal"] = "platform_external";
+    RuntimeOperatorKind["OrganizationExternal"] = "organization_external";
+})(RuntimeOperatorKind || (exports.RuntimeOperatorKind = RuntimeOperatorKind = {}));
+exports.RuntimeOperatorKindSchema = zod_1.z.nativeEnum(RuntimeOperatorKind);
+var CredentialDeliveryKind;
+(function (CredentialDeliveryKind) {
+    CredentialDeliveryKind["PlatformCustody"] = "platform_custody";
+    CredentialDeliveryKind["OneTimeExchange"] = "one_time_exchange";
+    CredentialDeliveryKind["TokenOnly"] = "token_only";
+})(CredentialDeliveryKind || (exports.CredentialDeliveryKind = CredentialDeliveryKind = {}));
+exports.CredentialDeliveryKindSchema = zod_1.z.nativeEnum(CredentialDeliveryKind);
+var RunnerEnrollmentDesiredState;
+(function (RunnerEnrollmentDesiredState) {
+    RunnerEnrollmentDesiredState["Active"] = "active";
+    RunnerEnrollmentDesiredState["Revoked"] = "revoked";
+})(RunnerEnrollmentDesiredState || (exports.RunnerEnrollmentDesiredState = RunnerEnrollmentDesiredState = {}));
+exports.RunnerEnrollmentDesiredStateSchema = zod_1.z.nativeEnum(RunnerEnrollmentDesiredState);
+var RunnerEnrollmentObservedState;
+(function (RunnerEnrollmentObservedState) {
+    RunnerEnrollmentObservedState["Requested"] = "requested";
+    RunnerEnrollmentObservedState["Provisioning"] = "provisioning";
+    RunnerEnrollmentObservedState["PendingClaim"] = "pending_claim";
+    RunnerEnrollmentObservedState["Active"] = "active";
+    RunnerEnrollmentObservedState["Rotating"] = "rotating";
+    RunnerEnrollmentObservedState["Draining"] = "draining";
+    RunnerEnrollmentObservedState["Revoking"] = "revoking";
+    RunnerEnrollmentObservedState["Revoked"] = "revoked";
+    RunnerEnrollmentObservedState["Failed"] = "failed";
+})(RunnerEnrollmentObservedState || (exports.RunnerEnrollmentObservedState = RunnerEnrollmentObservedState = {}));
+exports.RunnerEnrollmentObservedStateSchema = zod_1.z.nativeEnum(RunnerEnrollmentObservedState);
+var RunnerLeaseState;
+(function (RunnerLeaseState) {
+    RunnerLeaseState["Active"] = "active";
+    RunnerLeaseState["Draining"] = "draining";
+    RunnerLeaseState["Revoked"] = "revoked";
+    RunnerLeaseState["Expired"] = "expired";
+})(RunnerLeaseState || (exports.RunnerLeaseState = RunnerLeaseState = {}));
+exports.RunnerLeaseStateSchema = zod_1.z.nativeEnum(RunnerLeaseState);
+var InFlightRevocationPolicy;
+(function (InFlightRevocationPolicy) {
+    InFlightRevocationPolicy["Cancel"] = "cancel";
+    InFlightRevocationPolicy["AllowCurrent"] = "allow_current";
+})(InFlightRevocationPolicy || (exports.InFlightRevocationPolicy = InFlightRevocationPolicy = {}));
+exports.InFlightRevocationPolicySchema = zod_1.z.nativeEnum(InFlightRevocationPolicy);
+var RunnerPlaneAudience;
+(function (RunnerPlaneAudience) {
+    RunnerPlaneAudience["Enrollment"] = "xema.runner-plane.enrollment.v1";
+    RunnerPlaneAudience["Attestation"] = "xema.runner-plane.attestation.v1";
+    RunnerPlaneAudience["AttestationReceipt"] = "xema.runner-plane.attestation-receipt.v1";
+    RunnerPlaneAudience["JobTokenMint"] = "xema.runner-plane.job-token.mint.v1";
+    RunnerPlaneAudience["Pull"] = "xema.runner-plane.pull.v1";
+    RunnerPlaneAudience["Report"] = "xema.runner-plane.report.v1";
+    RunnerPlaneAudience["Dispatch"] = "xema.runner-plane.dispatch.v1";
+    RunnerPlaneAudience["Job"] = "xema.runner-plane.job.v1";
+})(RunnerPlaneAudience || (exports.RunnerPlaneAudience = RunnerPlaneAudience = {}));
+exports.RunnerPlaneAudienceSchema = zod_1.z.nativeEnum(RunnerPlaneAudience);
+//# sourceMappingURL=runtime-identity.js.map

package/dist/runner/lib/runtime-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-identity.js","sourceRoot":"","sources":["../../../src/runner/lib/runtime-identity.ts"],"names":[],"mappings":";;;AAAA,6BAAwB;AAGxB,IAAY,mBAIX;AAJD,WAAY,mBAAmB;IAC7B,2DAAoC,CAAA;IACpC,6DAAsC,CAAA;IACtC,qEAA8C,CAAA;AAChD,CAAC,EAJW,mBAAmB,mCAAnB,mBAAmB,QAI9B;AAEY,QAAA,yBAAyB,GAAG,OAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;AAG3E,IAAY,sBAIX;AAJD,WAAY,sBAAsB;IAChC,8DAAoC,CAAA;IACpC,+DAAqC,CAAA;IACrC,kDAAwB,CAAA;AAC1B,CAAC,EAJW,sBAAsB,sCAAtB,sBAAsB,QAIjC;AAEY,QAAA,4BAA4B,GAAG,OAAC,CAAC,UAAU,CACtD,sBAAsB,CACvB,CAAC;AAGF,IAAY,4BAGX;AAHD,WAAY,4BAA4B;IACtC,iDAAiB,CAAA;IACjB,mDAAmB,CAAA;AACrB,CAAC,EAHW,4BAA4B,4CAA5B,4BAA4B,QAGvC;AAEY,QAAA,kCAAkC,GAAG,OAAC,CAAC,UAAU,CAC5D,4BAA4B,CAC7B,CAAC;AAGF,IAAY,6BAUX;AAVD,WAAY,6BAA6B;IACvC,wDAAuB,CAAA;IACvB,8DAA6B,CAAA;IAC7B,+DAA8B,CAAA;IAC9B,kDAAiB,CAAA;IACjB,sDAAqB,CAAA;IACrB,sDAAqB,CAAA;IACrB,sDAAqB,CAAA;IACrB,oDAAmB,CAAA;IACnB,kDAAiB,CAAA;AACnB,CAAC,EAVW,6BAA6B,6CAA7B,6BAA6B,QAUxC;AAEY,QAAA,mCAAmC,GAAG,OAAC,CAAC,UAAU,CAC7D,6BAA6B,CAC9B,CAAC;AAGF,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,qCAAiB,CAAA;IACjB,yCAAqB,CAAA;IACrB,uCAAmB,CAAA;IACnB,uCAAmB,CAAA;AACrB,CAAC,EALW,gBAAgB,gCAAhB,gBAAgB,QAK3B;AAEY,QAAA,sBAAsB,GAAG,OAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;AAGrE,IAAY,wBAGX;AAHD,WAAY,wBAAwB;IAClC,6CAAiB,CAAA;IACjB,0DAA8B,CAAA;AAChC,CAAC,EAHW,wBAAwB,wCAAxB,wBAAwB,QAGnC;AAEY,QAAA,8BAA8B,GAAG,OAAC,CAAC,UAAU,CACxD,wBAAwB,CACzB,CAAC;AAMF,IAAY,mBASX;AATD,WAAY,mBAAmB;IAC7B,qEAA8C,CAAA;IAC9C,uEAAgD,CAAA;IAChD,sFAA+D,CAAA;IAC/D,2EAAoD,CAAA;IACpD,yDAAkC,CAAA;IAClC,6DAAsC,CAAA;IACtC,iEAA0C,CAAA;IAC1C,uDAAgC,CAAA;AAClC,CAAC,EATW,mBAAmB,mCAAnB,mBAAmB,QAS9B;AAEY,QAAA,yBAAyB,GAAG,OAAC,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC"}

package/dist/runner/lib/runtime-isolation.d.ts

@@ -0,0 +1,10 @@
+import { z } from 'zod';
+export declare enum RuntimeIsolationLevel {
+    None = "none",
+    Process = "process",
+    Container = "container",
+    Vm = "vm"
+}
+export declare const RuntimeIsolationLevelSchema: z.ZodEnum<typeof RuntimeIsolationLevel>;
+export declare function runtimeIsolationMeets(actual: RuntimeIsolationLevel, minimum: RuntimeIsolationLevel): boolean;
+//# sourceMappingURL=runtime-isolation.d.ts.map

package/dist/runner/lib/runtime-isolation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-isolation.d.ts","sourceRoot":"","sources":["../../../src/runner/lib/runtime-isolation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkBxB,oBAAY,qBAAqB;IAE/B,IAAI,SAAS;IAEb,OAAO,YAAY;IAEnB,SAAS,cAAc;IAEvB,EAAE,OAAO;CACV;AAED,eAAO,MAAM,2BAA2B,yCAAsC,CAAC;AAiB/E,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,qBAAqB,EAC7B,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAET"}

package/dist/runner/lib/runtime-isolation.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RuntimeIsolationLevelSchema = exports.RuntimeIsolationLevel = void 0;
+exports.runtimeIsolationMeets = runtimeIsolationMeets;
+const zod_1 = require("zod");
+var RuntimeIsolationLevel;
+(function (RuntimeIsolationLevel) {
+    RuntimeIsolationLevel["None"] = "none";
+    RuntimeIsolationLevel["Process"] = "process";
+    RuntimeIsolationLevel["Container"] = "container";
+    RuntimeIsolationLevel["Vm"] = "vm";
+})(RuntimeIsolationLevel || (exports.RuntimeIsolationLevel = RuntimeIsolationLevel = {}));
+exports.RuntimeIsolationLevelSchema = zod_1.z.nativeEnum(RuntimeIsolationLevel);
+const ISOLATION_RANK = [
+    RuntimeIsolationLevel.None,
+    RuntimeIsolationLevel.Process,
+    RuntimeIsolationLevel.Container,
+    RuntimeIsolationLevel.Vm,
+];
+function runtimeIsolationMeets(actual, minimum) {
+    return ISOLATION_RANK.indexOf(actual) >= ISOLATION_RANK.indexOf(minimum);
+}
+//# sourceMappingURL=runtime-isolation.js.map

package/dist/runner/lib/runtime-isolation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-isolation.js","sourceRoot":"","sources":["../../../src/runner/lib/runtime-isolation.ts"],"names":[],"mappings":";;;AA8CA,sDAKC;AAnDD,6BAAwB;AAkBxB,IAAY,qBASX;AATD,WAAY,qBAAqB;IAE/B,sCAAa,CAAA;IAEb,4CAAmB,CAAA;IAEnB,gDAAuB,CAAA;IAEvB,kCAAS,CAAA;AACX,CAAC,EATW,qBAAqB,qCAArB,qBAAqB,QAShC;AAEY,QAAA,2BAA2B,GAAG,OAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;AAM/E,MAAM,cAAc,GAAqC;IACvD,qBAAqB,CAAC,IAAI;IAC1B,qBAAqB,CAAC,OAAO;IAC7B,qBAAqB,CAAC,SAAS;IAC/B,qBAAqB,CAAC,EAAE;CACzB,CAAC;AAMF,SAAgB,qBAAqB,CACnC,MAA6B,EAC7B,OAA8B;IAE9B,OAAO,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAC3E,CAAC"}

package/dist/runner-input-hash/index.d.ts

@@ -0,0 +1,2 @@
+export * from './lib/input-hash';
+//# sourceMappingURL=index.d.ts.map

package/dist/runner-input-hash/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/runner-input-hash/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC"}

package/dist/runner-input-hash/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./lib/input-hash"), exports);
+//# sourceMappingURL=index.js.map

package/dist/runner-input-hash/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/runner-input-hash/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,mDAAiC"}

package/dist/runner-input-hash/lib/input-hash.d.ts

@@ -0,0 +1,2 @@
+export declare function canonicalCapabilityInputHash(input: unknown): string;
+//# sourceMappingURL=input-hash.d.ts.map

package/dist/runner-input-hash/lib/input-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-hash.d.ts","sourceRoot":"","sources":["../../../src/runner-input-hash/lib/input-hash.ts"],"names":[],"mappings":"AAuCA,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEnE"}

package/dist/runner-input-hash/lib/input-hash.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalCapabilityInputHash = canonicalCapabilityInputHash;
+const server_1 = require("../../content-address/server");
+function canonicalCapabilityInputHash(input) {
+    return (0, server_1.canonicalJsonSha256)(input === undefined ? {} : input);
+}
+//# sourceMappingURL=input-hash.js.map

package/dist/runner-input-hash/lib/input-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-hash.js","sourceRoot":"","sources":["../../../src/runner-input-hash/lib/input-hash.ts"],"names":[],"mappings":";;AAuCA,oEAEC;AAzCD,yDAAmE;AAuCnE,SAAgB,4BAA4B,CAAC,KAAc;IACzD,OAAO,IAAA,4BAAmB,EAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC"}

package/dist/search/index.d.ts

@@ -0,0 +1,3 @@
+export * from './lib/route-template';
+export * from './lib/search-contribution';
+//# sourceMappingURL=index.d.ts.map

package/dist/search/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/search/index.ts"],"names":[],"mappings":"AAkBA,cAAc,sBAAsB,CAAC;AACrC,cAAc,2BAA2B,CAAC"}

package/dist/search/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./lib/route-template"), exports);
+__exportStar(require("./lib/search-contribution"), exports);
+//# sourceMappingURL=index.js.map

package/dist/search/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/search/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAkBA,uDAAqC;AACrC,4DAA0C"}