@xemahq/kernel-contracts 0.1.0

package/src/object/lib/xema-object-ref.ts

@@ -0,0 +1,233 @@
+import { z } from 'zod';
+import { SpaceRef, SpaceKind, spaceRefToPath } from '../../space';
+import { XemaObjectKind, XemaObjectKindSchema } from './xema-object-kind';
+
+/**
+ * Stable wire shape for every XemaObject address (XSI plane 1, §3.1 +
+ * §6.1 of the plan-of-record). The grammar is:
+ *
+ *   `xema://<scope-path>/<kind>/<slug>[@<version>]`
+ *
+ * Examples:
+ *   `xema://system/capability/kb.page.read@1`
+ *   `xema://orgs/acme/projects/main/agent/code-reviewer@3.0.0`
+ *   `xema://biomes/document-buddy/skill/doc-editor`
+ *   `xema://users/u_123/skill/scratch-notes`
+ *   `xema://store/biome/document-buddy@1.4.2`
+ */
+export type XemaObjectRef = `xema://${string}`;
+
+const XEMA_OBJECT_REF_PREFIX = 'xema://';
+
+export const XemaObjectRefSchema = z
+  .string()
+  .refine(
+    (value): value is XemaObjectRef => value.startsWith(XEMA_OBJECT_REF_PREFIX),
+    { message: `XemaObjectRef must start with "${XEMA_OBJECT_REF_PREFIX}"` },
+  );
+
+/**
+ * Structured error raised by `parseXemaObjectRef`. Carries a stable
+ * code so callers can fail-fast and surface a typed error to clients
+ * (per the engineering constitution: no silent fallbacks).
+ */
+export class XemaObjectRefParseError extends Error {
+  public readonly code = 'XEMA_OBJECT_REF_INVALID';
+  public readonly ref: string;
+  public readonly reason: string;
+
+  public constructor(ref: string, reason: string) {
+    super(`Invalid XemaObjectRef "${ref}": ${reason}`);
+    this.name = 'XemaObjectRefParseError';
+    this.ref = ref;
+    this.reason = reason;
+  }
+}
+
+/**
+ * Parts of a parsed XemaObjectRef. `version` is `undefined` when the
+ * input omitted the `@<version>` suffix — callers MUST treat the
+ * absent case explicitly (e.g. fall through to the resolver's
+ * "latest published" pin) rather than substitute a default here.
+ */
+export interface XemaObjectRefParts {
+  scope: SpaceRef;
+  kind: XemaObjectKind;
+  slug: string;
+  version?: string;
+}
+
+const SLUG_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/;
+const VERSION_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_.+-]*$/;
+
+interface ScopeParse {
+  scope: SpaceRef;
+  consumed: number;
+}
+
+function requireSegment(
+  segments: string[],
+  index: number,
+  ref: string,
+  label: string,
+): string {
+  const value = segments[index];
+  if (value === undefined || value.length === 0) {
+    throw new XemaObjectRefParseError(ref, `missing ${label} segment`);
+  }
+  return value;
+}
+
+function parseScope(segments: string[], ref: string): ScopeParse {
+  const head = requireSegment(segments, 0, ref, 'scope');
+  switch (head) {
+    case 'system':
+      return { scope: { tier: SpaceKind.System }, consumed: 1 };
+    case 'biomes': {
+      const biomeId = requireSegment(segments, 1, ref, 'biomeId');
+      return {
+        scope: { tier: SpaceKind.Biome, biomeId },
+        consumed: 2,
+      };
+    }
+    case 'users': {
+      const userId = requireSegment(segments, 1, ref, 'userId');
+      return {
+        scope: { tier: SpaceKind.User, userId },
+        consumed: 2,
+      };
+    }
+    case 'orgs': {
+      const orgId = requireSegment(segments, 1, ref, 'orgId');
+      if (segments.length >= 4 && segments[2] === 'projects') {
+        const projectId = requireSegment(segments, 3, ref, 'projectId');
+        return {
+          scope: {
+            tier: SpaceKind.Project,
+            orgId,
+            projectId,
+          },
+          consumed: 4,
+        };
+      }
+      return {
+        scope: { tier: SpaceKind.Org, orgId },
+        consumed: 2,
+      };
+    }
+    default:
+      throw new XemaObjectRefParseError(
+        ref,
+        `unknown scope head "${head}" (expected one of: system, biomes, orgs, users)`,
+      );
+  }
+}
+
+/**
+ * Parse a `XemaObjectRef` into structured parts. Fail-fast on every
+ * malformed input (no silent coercion). When the `@<version>` suffix
+ * is absent, `version` is `undefined`; downstream resolvers decide
+ * how to pin (typically "latest published"), this function does not.
+ */
+export function parseXemaObjectRef(ref: string): XemaObjectRefParts {
+  if (!ref.startsWith(XEMA_OBJECT_REF_PREFIX)) {
+    throw new XemaObjectRefParseError(
+      ref,
+      `must start with "${XEMA_OBJECT_REF_PREFIX}"`,
+    );
+  }
+  const body = ref.slice(XEMA_OBJECT_REF_PREFIX.length);
+  if (body.length === 0) {
+    throw new XemaObjectRefParseError(ref, 'empty body after scheme');
+  }
+
+  // Split off `@<version>` from the LAST segment only (slugs may not
+  // contain `@`, but scope segments and the kind never carry it).
+  let version: string | undefined;
+  let pathBody = body;
+  const atIndex = body.lastIndexOf('@');
+  const lastSlash = body.lastIndexOf('/');
+  if (atIndex > lastSlash) {
+    version = body.slice(atIndex + 1);
+    pathBody = body.slice(0, atIndex);
+    if (version.length === 0) {
+      throw new XemaObjectRefParseError(ref, 'empty version suffix after "@"');
+    }
+    if (!VERSION_PATTERN.test(version)) {
+      throw new XemaObjectRefParseError(
+        ref,
+        `version "${version}" contains invalid characters`,
+      );
+    }
+  }
+
+  const segments = pathBody.split('/').filter((segment) => segment.length > 0);
+  if (segments.length < 3) {
+    throw new XemaObjectRefParseError(
+      ref,
+      'must contain at least <scope>/<kind>/<slug>',
+    );
+  }
+
+  const { scope, consumed } = parseScope(segments, ref);
+  const remaining = segments.slice(consumed);
+  if (remaining.length < 2) {
+    throw new XemaObjectRefParseError(
+      ref,
+      'missing <kind>/<slug> after scope segments',
+    );
+  }
+  if (remaining.length > 2) {
+    throw new XemaObjectRefParseError(
+      ref,
+      `unexpected trailing path segments after <kind>/<slug>: ${remaining.slice(2).join('/')}`,
+    );
+  }
+
+  const kindRaw = requireSegment(remaining, 0, ref, 'kind');
+  const slug = requireSegment(remaining, 1, ref, 'slug');
+
+  const kindParsed = XemaObjectKindSchema.safeParse(kindRaw);
+  if (!kindParsed.success) {
+    throw new XemaObjectRefParseError(
+      ref,
+      `unknown XemaObjectKind "${kindRaw}"`,
+    );
+  }
+
+  if (!SLUG_PATTERN.test(slug)) {
+    throw new XemaObjectRefParseError(
+      ref,
+      `slug "${slug}" must match ${SLUG_PATTERN}`,
+    );
+  }
+
+  return version === undefined
+    ? { scope, kind: kindParsed.data, slug }
+    : { scope, kind: kindParsed.data, slug, version };
+}
+
+/**
+ * Inverse of `parseXemaObjectRef`. Composes scope/kind/slug/version
+ * back into the canonical wire string. The scope path is rendered by
+ * `spaceRefToPath` so the round-trip is exact.
+ */
+export function formatXemaObjectRef(parts: XemaObjectRefParts): XemaObjectRef {
+  if (!SLUG_PATTERN.test(parts.slug)) {
+    throw new XemaObjectRefParseError(
+      `<unformatted>`,
+      `slug "${parts.slug}" must match ${SLUG_PATTERN}`,
+    );
+  }
+  if (parts.version !== undefined && !VERSION_PATTERN.test(parts.version)) {
+    throw new XemaObjectRefParseError(
+      `<unformatted>`,
+      `version "${parts.version}" contains invalid characters`,
+    );
+  }
+  // spaceRefToPath returns a leading "/"; we want the same shape as the
+  // grammar (scheme + slash-separated segments) so we trim it.
+  const scopePath = spaceRefToPath(parts.scope).replace(/^\//, '');
+  const versionSuffix = parts.version ? `@${parts.version}` : '';
+  return `${XEMA_OBJECT_REF_PREFIX}${scopePath}/${parts.kind}/${parts.slug}${versionSuffix}` as XemaObjectRef;
+}

package/src/object/lib/xema-object.ts

@@ -0,0 +1,81 @@
+import { z, ZodTypeAny } from 'zod';
+import { ObjectLifecycle, ObjectLifecycleSchema } from './object-lifecycle';
+import { SpaceRef, SpaceRefSchema } from '../../space';
+import { XemaObjectKind } from './xema-object-kind';
+import { XemaObjectRef, XemaObjectRefSchema } from './xema-object-ref';
+
+/**
+ * Subject reference re-declared locally so this leaf package keeps a
+ * zero-edge dependency graph (no import from `@xemahq/capability-contracts`).
+ * The richer typed subject model lives in `capability-contracts`; here
+ * we only need the wire shape `{ kind, ref }` to populate
+ * `XemaObject.owner`.
+ *
+ * `kind` is a free-form string here on purpose — XSI plane 1 does NOT
+ * own the closed enum of subject kinds (that lives in
+ * `@xemahq/capability-contracts`). Plane-1 consumers carry the value
+ * through; plane-3 (Capability) is the validation point.
+ */
+export interface SubjectRef {
+  kind: string;
+  ref: string;
+}
+
+export const SubjectRefSchema = z.object({
+  kind: z.string().min(1),
+  ref: z.string().min(1),
+});
+
+/**
+ * The generic XSI plane-1 envelope. Every addressable thing in Xema
+ * (agents, skills, biomes, workflows, capabilities, sessions, …) is a
+ * `XemaObject<TKind, TPayload>`. The shape is identical across kinds;
+ * only `payload` varies.
+ *
+ * - `ref` is the wire-stable address (`XemaObjectRef`).
+ * - `kind` is the closed `XemaObjectKind` enum value.
+ * - `scope` is the 5-tier ownership reference (single ownership model
+ *   shared with `SkillSpace` / `CompositionSpace`).
+ * - `owner` is the subject that owns the object.
+ * - `version` is a semver string. Resolution serves only `Published`
+ *   versions per `ObjectLifecycle` semantics.
+ * - `lifecycle` mirrors `CompositionLifecycle` (draft/published/archived).
+ * - `payload` is kind-specific; the resolved schema is supplied by the
+ *   owning domain contract package.
+ */
+export interface XemaObject<
+  TKind extends XemaObjectKind = XemaObjectKind,
+  TPayload = unknown,
+> {
+  ref: XemaObjectRef;
+  kind: TKind;
+  scope: SpaceRef;
+  owner: SubjectRef;
+  version: string;
+  lifecycle: ObjectLifecycle;
+  payload: TPayload;
+}
+
+/**
+ * Build a Zod schema for a concrete `XemaObject<TKind, TPayload>` by
+ * pairing a kind-literal schema with a payload schema. The owning
+ * domain package (e.g. `@xemahq/agent-composition-contracts`) calls
+ * this factory once per kind/payload pair.
+ */
+export function xemaObjectSchema<
+  TKind extends XemaObjectKind,
+  TPayloadSchema extends ZodTypeAny,
+>(
+  kindSchema: z.ZodType<TKind>,
+  payloadSchema: TPayloadSchema,
+): z.ZodType<XemaObject<TKind, z.infer<TPayloadSchema>>> {
+  return z.object({
+    ref: XemaObjectRefSchema,
+    kind: kindSchema,
+    scope: SpaceRefSchema,
+    owner: SubjectRefSchema,
+    version: z.string().min(1),
+    lifecycle: ObjectLifecycleSchema,
+    payload: payloadSchema,
+  }) as unknown as z.ZodType<XemaObject<TKind, z.infer<TPayloadSchema>>>;
+}

package/src/policy/index.ts

@@ -0,0 +1,3 @@
+export * from './lib/obligations';
+export * from './lib/route-hints';
+export * from './lib/policy';

package/src/policy/lib/obligations.ts

@@ -0,0 +1,155 @@
+import { z } from 'zod';
+import { DataClassificationSchema } from '../../space';
+
+/**
+ * Closed obligation taxonomy (plan v4.3 §A.4).
+ *
+ * Every `PolicyObligation` carries one of these `kind` discriminants;
+ * the wire payload is a discriminated union (see `PolicyObligation`).
+ * Policy MUST NOT emit an obligation outside this set — the boundary
+ * check rejects unknown discriminators at runtime.
+ */
+export enum PolicyObligationKind {
+  Audit = 'audit',
+  RedactSecrets = 'redact-secrets',
+  RequireRunnerKind = 'require-runner-kind',
+  RequireHumanApproval = 'require-human-approval',
+  MaxDurationSeconds = 'max-duration-seconds',
+  MaxCostUsd = 'max-cost-usd',
+  RestrictOutputClassification = 'restrict-output-classification',
+  DataResidency = 'data-residency',
+}
+
+export const PolicyObligationKindSchema = z.nativeEnum(PolicyObligationKind);
+
+/**
+ * Closed runner-kind set referenced by `PolicyObligation`
+ * (`require-runner-kind`) and by `RouteHint.preferredRunnerKind` (plan
+ * v4.3 §2 / §A.4).
+ *
+ * This is the POLICY view of a runner — the dimension policy selects on
+ * to route an invocation. Phase F will unify this with the transport-
+ * level `RunnerKind` in `@xemahq/runner-contracts`
+ * (Embedded/LocalModule/Remote/McpExternal); for Phase A this enum lives
+ * inline in `@xemahq/policy-contracts` per the plan.
+ */
+export enum RunnerKind {
+  Local = 'local',
+  Cloud = 'cloud',
+  CustomerEdge = 'customer-edge',
+  GPU = 'gpu',
+  Sandbox = 'sandbox',
+  CI = 'ci',
+  /**
+   * Phase H.3 — external MCP server bridged through `mcp-gateway-api`'s
+   * external-bridge. The router resolves capability refs of the form
+   * `<provider-slug>:<tool-name>@1` to this runner kind, then forwards
+   * the invoke envelope to the bridge which translates back to an MCP
+   * `tools/call` against the originating `OrgMcpServer`.
+   */
+  McpExternal = 'mcp-external',
+}
+
+export const RunnerKindSchema = z.nativeEnum(RunnerKind);
+
+/**
+ * Closed data-residency tag set referenced by `PolicyObligation`
+ * (`data-residency`) (plan v4.3 §A.4).
+ *
+ * `customer-private` is the customer-edge tenancy class used when the
+ * org runs its own runner in a private network. Add new regions by
+ * extending the enum + the OPA bundle in lockstep — never accept a
+ * free-form string at this layer.
+ */
+export enum DataResidency {
+  Eu = 'eu',
+  Us = 'us',
+  CustomerPrivate = 'customer-private',
+}
+
+export const DataResidencySchema = z.nativeEnum(DataResidency);
+
+// ── Per-variant payload schemas ─────────────────────────────────────────
+//
+// Each schema is left as a raw `ZodObject` (no `as z.ZodType<...>` cast)
+// so `z.discriminatedUnion('kind', [...])` can introspect the literal
+// `kind` field of every variant at type-check time. The exported
+// TypeScript interfaces are derived via `z.infer<>` to guarantee the
+// schema and the type cannot drift.
+
+export const AuditObligationSchema = z.object({
+  kind: z.literal(PolicyObligationKind.Audit),
+});
+export type AuditObligation = z.infer<typeof AuditObligationSchema>;
+
+export const RedactSecretsObligationSchema = z.object({
+  kind: z.literal(PolicyObligationKind.RedactSecrets),
+});
+export type RedactSecretsObligation = z.infer<typeof RedactSecretsObligationSchema>;
+
+export const RequireRunnerKindObligationSchema = z.object({
+  kind: z.literal(PolicyObligationKind.RequireRunnerKind),
+  runnerKind: RunnerKindSchema,
+});
+export type RequireRunnerKindObligation = z.infer<
+  typeof RequireRunnerKindObligationSchema
+>;
+
+export const RequireHumanApprovalObligationSchema = z.object({
+  kind: z.literal(PolicyObligationKind.RequireHumanApproval),
+  /** Closed approver-role string owned by `authorization-api`; opaque here. */
+  approverRole: z.string().min(1).optional(),
+});
+export type RequireHumanApprovalObligation = z.infer<
+  typeof RequireHumanApprovalObligationSchema
+>;
+
+export const MaxDurationSecondsObligationSchema = z.object({
+  kind: z.literal(PolicyObligationKind.MaxDurationSeconds),
+  maxDurationSeconds: z.number().int().positive(),
+});
+export type MaxDurationSecondsObligation = z.infer<
+  typeof MaxDurationSecondsObligationSchema
+>;
+
+export const MaxCostUsdObligationSchema = z.object({
+  kind: z.literal(PolicyObligationKind.MaxCostUsd),
+  maxCostUsd: z.number().positive(),
+});
+export type MaxCostUsdObligation = z.infer<typeof MaxCostUsdObligationSchema>;
+
+export const RestrictOutputClassificationObligationSchema = z.object({
+  kind: z.literal(PolicyObligationKind.RestrictOutputClassification),
+  maxClassification: DataClassificationSchema,
+});
+export type RestrictOutputClassificationObligation = z.infer<
+  typeof RestrictOutputClassificationObligationSchema
+>;
+
+export const DataResidencyObligationSchema = z.object({
+  kind: z.literal(PolicyObligationKind.DataResidency),
+  residency: DataResidencySchema,
+});
+export type DataResidencyObligation = z.infer<
+  typeof DataResidencyObligationSchema
+>;
+
+/**
+ * `PolicyObligation` — closed discriminated union (plan v4.3 §A.4).
+ *
+ * Producers MUST construct one of the typed variants above; consumers
+ * MUST switch on `kind` and handle every variant explicitly. The kernel
+ * never accepts a free-form record at the obligation boundary.
+ */
+export const PolicyObligationSchema = z.discriminatedUnion('kind', [
+  AuditObligationSchema,
+  RedactSecretsObligationSchema,
+  RequireRunnerKindObligationSchema,
+  RequireHumanApprovalObligationSchema,
+  MaxDurationSecondsObligationSchema,
+  MaxCostUsdObligationSchema,
+  RestrictOutputClassificationObligationSchema,
+  DataResidencyObligationSchema,
+]);
+
+export type PolicyObligation = z.infer<typeof PolicyObligationSchema>;

package/src/policy/lib/policy.ts

@@ -0,0 +1,104 @@
+import { z } from 'zod';
+import {
+  ExecutionContextSchema,
+  type ExecutionContext,
+} from '../../execution-context';
+import {
+  PolicyObligationSchema,
+  type PolicyObligation,
+} from './obligations';
+import { RouteHintSchema, type RouteHint } from './route-hints';
+
+/**
+ * Closed decision set (plan v4.3 §A.4).
+ *
+ * `needs_approval` is its own outcome — never collapsed into `allow`
+ * with an obligation; the router suspends the invocation when it sees
+ * this kind and emits `approval.requested.v1` (plan §A.5).
+ */
+export enum PolicyDecisionKind {
+  Allow = 'allow',
+  Deny = 'deny',
+  NeedsApproval = 'needs_approval',
+}
+
+export const PolicyDecisionKindSchema = z.nativeEnum(PolicyDecisionKind);
+
+/**
+ * Which precedence tier supplied the `credentialBindingId` on an `allow`
+ * decision (plan §W4 / Pillar 3.2). Closed set — the PDP applies a fixed
+ * priority ladder and records the winning tier so the Studio debugger (and
+ * audit) can explain WHY a given binding was selected, without re-deriving it.
+ *
+ * Priority, highest wins:
+ *   `explicit` (a grant names the binding) > `capability_default`
+ *   (the descriptor's `defaultCredentialBindingRef`) > `project_default` >
+ *   `org_default`. No match ⇒ the PDP emits NO binding and denies with
+ *   `MISSING_CREDENTIAL_BINDING` (never a silent fallback).
+ */
+export enum CredentialPrecedenceSource {
+  Explicit = 'explicit',
+  CapabilityDefault = 'capability_default',
+  ProjectDefault = 'project_default',
+  OrgDefault = 'org_default',
+}
+
+export const CredentialPrecedenceSourceSchema = z.nativeEnum(
+  CredentialPrecedenceSource,
+);
+
+/**
+ * `PolicyRequest` — the input shape `authorization-api.policyCheck`
+ * accepts (plan v4.3 §A.4).
+ *
+ * Currently a type alias for `ExecutionContext` because every field
+ * policy needs is already on the envelope. Kept as a separate name so a
+ * future v2 split (e.g. pre-resolved subject roles) does not churn every
+ * call site.
+ */
+export type PolicyRequest = ExecutionContext;
+
+export const PolicyRequestSchema: z.ZodType<PolicyRequest> =
+  ExecutionContextSchema;
+
+/**
+ * `PolicyDecision` — the output shape `authorization-api.policyCheck`
+ * returns (plan v4.3 §A.4).
+ *
+ * `kind` is the verdict; `obligations` is a CLOSED discriminated union
+ * (see `PolicyObligation`); `routeHints` carries runner-selection
+ * guidance the router applies after `allow`. `reason` is a stable wire
+ * code from the OPA bundle (free-form here, closed by the bundle).
+ */
+export interface PolicyDecision {
+  kind: PolicyDecisionKind;
+  reason?: string;
+  obligations?: PolicyObligation[];
+  routeHints?: RouteHint;
+  /**
+   * The credential binding the executing gateway MUST use to resolve the
+   * external credential for this invocation (plan §W4 / Pillar 3.2). Present
+   * ONLY on an `allow` decision for a capability that declares an
+   * `externalServiceRef`. The PDP is the single authority that selects it via
+   * the deterministic precedence ladder; the router passes ONLY this opaque id
+   * downstream (never a secret), and the broker re-validates it before reading
+   * custody. Absent here ⇒ the capability needs no external credential, OR the
+   * decision is a `deny`/`needs_approval`.
+   */
+  credentialBindingId?: string;
+  /**
+   * Which precedence tier supplied `credentialBindingId`. Populated iff
+   * `credentialBindingId` is present, so the Studio debugger and audit can
+   * explain the selection. See `CredentialPrecedenceSource`.
+   */
+  credentialPrecedenceApplied?: CredentialPrecedenceSource;
+}
+
+export const PolicyDecisionSchema = z.object({
+  kind: PolicyDecisionKindSchema,
+  reason: z.string().min(1).optional(),
+  obligations: z.array(PolicyObligationSchema).optional(),
+  routeHints: RouteHintSchema.optional(),
+  credentialBindingId: z.string().min(1).optional(),
+  credentialPrecedenceApplied: CredentialPrecedenceSourceSchema.optional(),
+}) as z.ZodType<PolicyDecision>;

package/src/policy/lib/route-hints.ts

@@ -0,0 +1,51 @@
+import { z } from 'zod';
+import { RunnerKind, RunnerKindSchema } from './obligations';
+
+/**
+ * `RouteHint` — runner-selection guidance emitted alongside a
+ * `PolicyDecision` (plan v4.3 §A.4).
+ *
+ * The capability router consults this AFTER policy returns `allow`, to
+ * pick a runner that satisfies all hints. Hints are PREFERENCES unless
+ * an obligation pins them (e.g. `require-runner-kind`); the router
+ * fails-fast when a required hint cannot be satisfied.
+ */
+export interface RouteHint {
+  /**
+   * Labels every candidate runner MUST advertise on its `RunnerDescriptor`
+   * — e.g. `{ region: 'eu-west', dataLocality: 'customer-private' }`. AND
+   * semantics (all keys must match).
+   */
+  requiredRunnerLabels?: Record<string, string>;
+
+  /**
+   * Soft preference for a `RunnerKind` (Local / Cloud / CustomerEdge /
+   * GPU / Sandbox / CI). The router MAY fall back to another kind if the
+   * preferred kind is unavailable — UNLESS a `require-runner-kind`
+   * obligation hard-pins it.
+   */
+  preferredRunnerKind?: RunnerKind;
+
+  /**
+   * Required region for the dispatched runner. The router refuses to
+   * dispatch if no candidate matches.
+   */
+  requiredRegion?: string;
+
+  /**
+   * Hard constraint: only customer-edge runners may handle this
+   * invocation. Equivalent to `data-residency=customer-private`
+   * obligation but expressed at the routing layer; the router MUST
+   * respect both.
+   */
+  requireCustomerEdge?: boolean;
+}
+
+export const RouteHintSchema = z.object({
+  requiredRunnerLabels: z.record(z.string().min(1), z.string().min(1)).optional(),
+  preferredRunnerKind: RunnerKindSchema.optional(),
+  requiredRegion: z.string().min(1).optional(),
+  requireCustomerEdge: z.boolean().optional(),
+}) as z.ZodType<RouteHint>;
+
+export { RunnerKind, RunnerKindSchema } from './obligations';

package/src/runner/index.ts

@@ -0,0 +1,11 @@
+export * from './lib/runner';
+export * from './lib/runner-attestation';
+export * from './lib/job-token';
+export * from './lib/runner-mode';
+export * from './lib/runner-kind';
+export * from './lib/runtime-isolation';
+export * from './lib/runner-registration';
+export * from './lib/runner-plane';
+export * from './lib/runner-job';
+export * from './lib/dispatch';
+export * from './lib/input-hash';