glirastes 0.3.2 → 0.5.0

package/dist/cjs/sync/control-plane-client.d.ts

@@ -0,0 +1,69 @@
+import type { RuntimeSyncManager } from './sync-manager.js';
+export interface RuntimePushConnector {
+    connect(options: {
+        url: string;
+        headers: Record<string, string>;
+        signal: AbortSignal;
+        onEvent: () => void | Promise<void>;
+    }): Promise<void>;
+}
+export declare class RuntimeControlPlaneRequestError extends Error {
+    readonly operation: string;
+    readonly status: number;
+    /** A content-free error code the Platform answered with, e.g. `connection_key_unbound`. */
+    readonly code?: string;
+    constructor(operation: string, status: number, code?: string);
+}
+export declare class RuntimeControlPlaneClient {
+    private readonly options;
+    private abortController;
+    private cursor;
+    constructor(options: {
+        baseUrl: string;
+        apiKey: string;
+        appId: string;
+        environmentId: string;
+        runnerKey: string;
+        version: string;
+        /**
+         * Discovery digest of the running code. Sent with every registration so
+         * the Platform knows which capability report describes this runner.
+         */
+        discoveryDigest?: string;
+        /**
+         * Setup run of the committed artifact this build carries (P10). With it
+         * the Platform shows the capability report of exactly this build, also
+         * when another build of the same endpoint inventory reported later.
+         */
+        setupRunId?: string;
+        /**
+         * True when this runner composes signed Platform decisions with the
+         * local code report (`createLocalRuntimeSource`, or `createTurnSnapshot`
+         * with `relaxableToolIds`), so a Platform relaxation of confirmation takes
+         * effect here (D16). Registration then reports `policyRelaxations`.
+         */
+        policyRelaxations?: boolean;
+        manager: RuntimeSyncManager;
+        fetchImpl?: typeof fetch;
+        push?: RuntimePushConnector;
+        pollIntervalMs?: number;
+        onError?: (error: unknown) => void;
+    });
+    register(input?: {
+        capabilities?: Record<string, unknown>;
+        technicalMetadata?: Record<string, unknown>;
+    }): Promise<unknown>;
+    heartbeat(input: {
+        health: 'healthy' | 'degraded' | 'unhealthy';
+        validatedDeploymentId?: string;
+        lastAppliedDeploymentId?: string;
+        technicalMetadata?: Record<string, unknown>;
+    }): Promise<unknown>;
+    syncOnce(): Promise<import("./sync-manager.js").RuntimeSyncApplyResult>;
+    start(): Promise<void>;
+    stop(): void;
+    private request;
+    private runnerBaseUrl;
+    private assertTechnicalMetadata;
+    private delay;
+}

package/dist/cjs/sync/control-plane-client.js

@@ -0,0 +1,186 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RuntimeControlPlaneClient = exports.RuntimeControlPlaneRequestError = void 0;
+const content_boundary_js_1 = require("../contracts/content-boundary.js");
+const capability_report_js_1 = require("./capability-report.js");
+const SETUP_RUN_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+class RuntimeControlPlaneRequestError extends Error {
+    operation;
+    status;
+    /** A content-free error code the Platform answered with, e.g. `connection_key_unbound`. */
+    code;
+    constructor(operation, status, code) {
+        super(`Glirastes Control Plane ${operation} request failed (${status})`);
+        this.name = 'RuntimeControlPlaneRequestError';
+        this.operation = operation;
+        this.status = status;
+        if (code !== undefined)
+            this.code = code;
+    }
+}
+exports.RuntimeControlPlaneRequestError = RuntimeControlPlaneRequestError;
+class RuntimeControlPlaneClient {
+    options;
+    abortController = null;
+    cursor = null;
+    constructor(options) {
+        this.options = options;
+        if (options.discoveryDigest !== undefined
+            && !capability_report_js_1.DISCOVERY_DIGEST_PATTERN.test(options.discoveryDigest)) {
+            throw new Error('discoveryDigest must be a sha256 digest of the running code');
+        }
+        if (options.setupRunId !== undefined) {
+            if (options.discoveryDigest === undefined) {
+                throw new Error('setupRunId names the setup run of a discoveryDigest; pass both');
+            }
+            if (!SETUP_RUN_ID_PATTERN.test(options.setupRunId)) {
+                throw new Error('setupRunId must be the uuid of the committed setup run');
+            }
+        }
+    }
+    async register(input = {}) {
+        const capabilities = { ...input.capabilities ?? {} };
+        const digest = this.options.discoveryDigest;
+        if (digest !== undefined) {
+            if (capabilities.discoveryDigest !== undefined
+                && capabilities.discoveryDigest !== digest) {
+                throw new Error('capabilities.discoveryDigest must name the running code');
+            }
+            capabilities.discoveryDigest = digest;
+        }
+        const setupRunId = this.options.setupRunId;
+        if (capabilities.setupRunId !== undefined
+            && capabilities.setupRunId !== setupRunId) {
+            throw new Error('capabilities.setupRunId is reported from the committed setup artifact');
+        }
+        if (setupRunId !== undefined)
+            capabilities.setupRunId = setupRunId;
+        const relaxations = this.options.policyRelaxations
+            ? capability_report_js_1.POLICY_RELAXATIONS_VERSION
+            : undefined;
+        if (capabilities.policyRelaxations !== undefined
+            && capabilities.policyRelaxations !== relaxations) {
+            // Claiming D16 without applying it would show relaxations as effective
+            // while the chat keeps asking, or the other way round.
+            throw new Error('capabilities.policyRelaxations is reported by the runtime');
+        }
+        if (relaxations !== undefined)
+            capabilities.policyRelaxations = relaxations;
+        this.assertTechnicalMetadata(capabilities);
+        this.assertTechnicalMetadata(input.technicalMetadata ?? {});
+        return this.request('register', {
+            method: 'POST',
+            body: JSON.stringify({
+                runnerKey: this.options.runnerKey,
+                version: this.options.version,
+                capabilities,
+                technicalMetadata: input.technicalMetadata ?? {},
+            }),
+        });
+    }
+    async heartbeat(input) {
+        this.assertTechnicalMetadata(input.technicalMetadata ?? {});
+        return this.request('heartbeat', {
+            method: 'PATCH',
+            body: JSON.stringify({
+                runnerKey: this.options.runnerKey,
+                ...input,
+                technicalMetadata: input.technicalMetadata ?? {},
+            }),
+        });
+    }
+    async syncOnce() {
+        const query = new URLSearchParams({ runnerKey: this.options.runnerKey });
+        if (this.cursor)
+            query.set('cursor', this.cursor);
+        const bundle = await this.request(`sync?${query.toString()}`, {
+            method: 'GET',
+        });
+        const result = await this.options.manager.apply(bundle);
+        if (bundle
+            && typeof bundle === 'object'
+            && 'cursor' in bundle
+            && typeof bundle.cursor === 'string') {
+            this.cursor = bundle.cursor;
+        }
+        return result;
+    }
+    async start() {
+        if (this.abortController) {
+            throw new Error('Runtime Control Plane client is already running');
+        }
+        const controller = new AbortController();
+        this.abortController = controller;
+        if (this.options.push) {
+            void this.options.push.connect({
+                url: `${this.runnerBaseUrl()}/stream`,
+                headers: { authorization: `Bearer ${this.options.apiKey}` },
+                signal: controller.signal,
+                onEvent: async () => {
+                    try {
+                        await this.syncOnce();
+                    }
+                    catch (error) {
+                        this.options.onError?.(error);
+                    }
+                },
+            }).catch((error) => {
+                if (!controller.signal.aborted)
+                    this.options.onError?.(error);
+            });
+        }
+        const interval = Math.max(1, this.options.pollIntervalMs ?? 30_000);
+        while (!controller.signal.aborted) {
+            try {
+                await this.syncOnce();
+            }
+            catch (error) {
+                this.options.onError?.(error);
+            }
+            await this.delay(interval, controller.signal);
+        }
+        if (this.abortController === controller)
+            this.abortController = null;
+    }
+    stop() {
+        this.abortController?.abort();
+    }
+    async request(path, init) {
+        const response = await (this.options.fetchImpl ?? fetch)(`${this.runnerBaseUrl()}/${path}`, {
+            ...init,
+            headers: {
+                authorization: `Bearer ${this.options.apiKey}`,
+                'content-type': 'application/json',
+                ...init.headers,
+            },
+        });
+        if (!response.ok) {
+            throw new RuntimeControlPlaneRequestError(path.split('?', 1)[0], response.status);
+        }
+        return response.json();
+    }
+    runnerBaseUrl() {
+        return `${this.options.baseUrl.replace(/\/$/, '')}`
+            + `/v1/runtime/apps/${encodeURIComponent(this.options.appId)}`
+            + `/environments/${encodeURIComponent(this.options.environmentId)}`
+            + '/runners';
+    }
+    assertTechnicalMetadata(value) {
+        const forbidden = (0, content_boundary_js_1.findForbiddenContentPath)(value);
+        if (forbidden) {
+            throw new Error(`Technical runtime metadata contains forbidden content at ${forbidden.join('.')}`);
+        }
+    }
+    delay(milliseconds, signal) {
+        if (signal.aborted)
+            return Promise.resolve();
+        return new Promise((resolve) => {
+            const timer = setTimeout(resolve, milliseconds);
+            signal.addEventListener('abort', () => {
+                clearTimeout(timer);
+                resolve();
+            }, { once: true });
+        });
+    }
+}
+exports.RuntimeControlPlaneClient = RuntimeControlPlaneClient;

package/dist/cjs/sync/deployment-selector.d.ts

@@ -0,0 +1,9 @@
+import type { RuntimeDeploymentBundle } from '../contracts/revisions.js';
+export declare function stableCohortBucket(subjectId: string): number;
+export declare function selectRuntimeDeployment(deployments: {
+    stable: RuntimeDeploymentBundle | null;
+    canary: RuntimeDeploymentBundle | null;
+}, input: {
+    subjectId: string;
+    pinnedDeploymentId?: string;
+}): RuntimeDeploymentBundle;

package/dist/cjs/sync/deployment-selector.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stableCohortBucket = stableCohortBucket;
+exports.selectRuntimeDeployment = selectRuntimeDeployment;
+const node_crypto_1 = require("node:crypto");
+function stableCohortBucket(subjectId) {
+    const digest = (0, node_crypto_1.createHash)('sha256').update(subjectId).digest();
+    return digest.readUInt32BE(0) % 100;
+}
+function selectRuntimeDeployment(deployments, input) {
+    if (input.pinnedDeploymentId) {
+        const available = [deployments.stable, deployments.canary].filter((deployment) => deployment !== null);
+        const pinned = available.find((deployment) => (deployment.deploymentId === input.pinnedDeploymentId
+            && deployment.pinned));
+        if (!pinned) {
+            throw new Error('Pinned runtime deployment is unavailable or not pinnable');
+        }
+        return pinned;
+    }
+    if (!deployments.stable) {
+        throw new Error('No verified stable deployment is available');
+    }
+    if (deployments.canary
+        && stableCohortBucket(input.subjectId)
+            < deployments.canary.targetPercentage) {
+        return deployments.canary;
+    }
+    return deployments.stable;
+}

package/dist/cjs/sync/fetch-sse-push.d.ts

@@ -0,0 +1,6 @@
+import type { RuntimePushConnector } from './control-plane-client.js';
+export declare class FetchSsePushConnector implements RuntimePushConnector {
+    private readonly fetchImpl;
+    constructor(fetchImpl?: typeof fetch);
+    connect(options: Parameters<RuntimePushConnector['connect']>[0]): Promise<void>;
+}

package/dist/cjs/sync/fetch-sse-push.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FetchSsePushConnector = void 0;
+class FetchSsePushConnector {
+    fetchImpl;
+    constructor(fetchImpl = fetch) {
+        this.fetchImpl = fetchImpl;
+    }
+    async connect(options) {
+        const response = await this.fetchImpl(options.url, {
+            headers: {
+                accept: 'text/event-stream',
+                ...options.headers,
+            },
+            signal: options.signal,
+        });
+        if (!response.ok || !response.body) {
+            throw new Error(`Runtime push stream failed (${response.status})`);
+        }
+        const reader = response.body.getReader();
+        const decoder = new TextDecoder();
+        let buffer = '';
+        try {
+            while (!options.signal.aborted) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                buffer += decoder.decode(value, { stream: true }).replace(/\r\n/g, '\n');
+                let separator = buffer.indexOf('\n\n');
+                while (separator >= 0) {
+                    const event = buffer.slice(0, separator);
+                    buffer = buffer.slice(separator + 2);
+                    if (event.split('\n').some((line) => line.startsWith('data:'))) {
+                        await options.onEvent();
+                    }
+                    separator = buffer.indexOf('\n\n');
+                }
+            }
+        }
+        finally {
+            reader.releaseLock();
+        }
+    }
+}
+exports.FetchSsePushConnector = FetchSsePushConnector;

package/dist/cjs/sync/index.d.ts

@@ -0,0 +1,26 @@
+export { canonicalRuntimeJson, RuntimeRevisionVerifier, RuntimeSyncVerificationError, } from './signature-verifier.js';
+export type { RuntimePublicJwk, RuntimePublicKeyProvider, } from './signature-verifier.js';
+export { FileRuntimeStateStore, MemoryRuntimeStateStore, } from './state-store.js';
+export type { RuntimeStateStore, RuntimeSyncState, } from './state-store.js';
+export { RuntimeSyncManager, } from './sync-manager.js';
+export type { RuntimeSyncApplyResult, } from './sync-manager.js';
+export { RuntimeControlPlaneClient, RuntimeControlPlaneRequestError, } from './control-plane-client.js';
+export type { RuntimePushConnector, } from './control-plane-client.js';
+export { RuntimeSetupClient } from './runtime-setup-client.js';
+export { parseLocalExecutionInventory, type LocalExecutionEvidence, type LocalExecutionInventory, } from './runtime-setup-client.js';
+export type { RouteScanUpload, RuntimeSetupImportResult, } from './runtime-setup-client.js';
+export { AppSetupClient } from './app-setup-client.js';
+export { RuntimeConnectClient } from './runtime-connect-client.js';
+export type { PollForConnectionOptions, RuntimeConnectClientOptions, } from './runtime-connect-client.js';
+export type { AppSetupRun, CreateAppSetupRun, UpdateAppSetupStatus, } from './app-setup-client.js';
+export { FetchSsePushConnector } from './fetch-sse-push.js';
+export { HttpRuntimePublicKeyProvider } from './jwks-provider.js';
+export { selectRuntimeDeployment, stableCohortBucket, } from './deployment-selector.js';
+export { materializeDeploymentRevisions } from './materialize-deployment.js';
+export type { MaterializedDeploymentRevisions } from './materialize-deployment.js';
+export { validateLocalDeploymentBindings, } from './local-deployment-validator.js';
+export type { IgnoredPlatformTool, LocalDeploymentValidation, } from './local-deployment-validator.js';
+export { createManagedRuntimeSync } from './managed-sync.js';
+export { lookupRuntimeConnection, type ResolvedRuntimeConnection, } from './connection-lookup.js';
+export { capabilityReportFrom, DISCOVERY_DIGEST_PATTERN, POLICY_RELAXATIONS_VERSION, uploadCapabilityReport, } from './capability-report.js';
+export type { CapabilityReport, CapabilityReportResult, } from './capability-report.js';

package/dist/cjs/sync/index.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.uploadCapabilityReport = exports.POLICY_RELAXATIONS_VERSION = exports.DISCOVERY_DIGEST_PATTERN = exports.capabilityReportFrom = exports.lookupRuntimeConnection = exports.createManagedRuntimeSync = exports.validateLocalDeploymentBindings = exports.materializeDeploymentRevisions = exports.stableCohortBucket = exports.selectRuntimeDeployment = exports.HttpRuntimePublicKeyProvider = exports.FetchSsePushConnector = exports.RuntimeConnectClient = exports.AppSetupClient = exports.parseLocalExecutionInventory = exports.RuntimeSetupClient = exports.RuntimeControlPlaneRequestError = exports.RuntimeControlPlaneClient = exports.RuntimeSyncManager = exports.MemoryRuntimeStateStore = exports.FileRuntimeStateStore = exports.RuntimeSyncVerificationError = exports.RuntimeRevisionVerifier = exports.canonicalRuntimeJson = void 0;
+var signature_verifier_js_1 = require("./signature-verifier.js");
+Object.defineProperty(exports, "canonicalRuntimeJson", { enumerable: true, get: function () { return signature_verifier_js_1.canonicalRuntimeJson; } });
+Object.defineProperty(exports, "RuntimeRevisionVerifier", { enumerable: true, get: function () { return signature_verifier_js_1.RuntimeRevisionVerifier; } });
+Object.defineProperty(exports, "RuntimeSyncVerificationError", { enumerable: true, get: function () { return signature_verifier_js_1.RuntimeSyncVerificationError; } });
+var state_store_js_1 = require("./state-store.js");
+Object.defineProperty(exports, "FileRuntimeStateStore", { enumerable: true, get: function () { return state_store_js_1.FileRuntimeStateStore; } });
+Object.defineProperty(exports, "MemoryRuntimeStateStore", { enumerable: true, get: function () { return state_store_js_1.MemoryRuntimeStateStore; } });
+var sync_manager_js_1 = require("./sync-manager.js");
+Object.defineProperty(exports, "RuntimeSyncManager", { enumerable: true, get: function () { return sync_manager_js_1.RuntimeSyncManager; } });
+var control_plane_client_js_1 = require("./control-plane-client.js");
+Object.defineProperty(exports, "RuntimeControlPlaneClient", { enumerable: true, get: function () { return control_plane_client_js_1.RuntimeControlPlaneClient; } });
+Object.defineProperty(exports, "RuntimeControlPlaneRequestError", { enumerable: true, get: function () { return control_plane_client_js_1.RuntimeControlPlaneRequestError; } });
+var runtime_setup_client_js_1 = require("./runtime-setup-client.js");
+Object.defineProperty(exports, "RuntimeSetupClient", { enumerable: true, get: function () { return runtime_setup_client_js_1.RuntimeSetupClient; } });
+var runtime_setup_client_js_2 = require("./runtime-setup-client.js");
+Object.defineProperty(exports, "parseLocalExecutionInventory", { enumerable: true, get: function () { return runtime_setup_client_js_2.parseLocalExecutionInventory; } });
+var app_setup_client_js_1 = require("./app-setup-client.js");
+Object.defineProperty(exports, "AppSetupClient", { enumerable: true, get: function () { return app_setup_client_js_1.AppSetupClient; } });
+var runtime_connect_client_js_1 = require("./runtime-connect-client.js");
+Object.defineProperty(exports, "RuntimeConnectClient", { enumerable: true, get: function () { return runtime_connect_client_js_1.RuntimeConnectClient; } });
+var fetch_sse_push_js_1 = require("./fetch-sse-push.js");
+Object.defineProperty(exports, "FetchSsePushConnector", { enumerable: true, get: function () { return fetch_sse_push_js_1.FetchSsePushConnector; } });
+var jwks_provider_js_1 = require("./jwks-provider.js");
+Object.defineProperty(exports, "HttpRuntimePublicKeyProvider", { enumerable: true, get: function () { return jwks_provider_js_1.HttpRuntimePublicKeyProvider; } });
+var deployment_selector_js_1 = require("./deployment-selector.js");
+Object.defineProperty(exports, "selectRuntimeDeployment", { enumerable: true, get: function () { return deployment_selector_js_1.selectRuntimeDeployment; } });
+Object.defineProperty(exports, "stableCohortBucket", { enumerable: true, get: function () { return deployment_selector_js_1.stableCohortBucket; } });
+var materialize_deployment_js_1 = require("./materialize-deployment.js");
+Object.defineProperty(exports, "materializeDeploymentRevisions", { enumerable: true, get: function () { return materialize_deployment_js_1.materializeDeploymentRevisions; } });
+var local_deployment_validator_js_1 = require("./local-deployment-validator.js");
+Object.defineProperty(exports, "validateLocalDeploymentBindings", { enumerable: true, get: function () { return local_deployment_validator_js_1.validateLocalDeploymentBindings; } });
+var managed_sync_js_1 = require("./managed-sync.js");
+Object.defineProperty(exports, "createManagedRuntimeSync", { enumerable: true, get: function () { return managed_sync_js_1.createManagedRuntimeSync; } });
+var connection_lookup_js_1 = require("./connection-lookup.js");
+Object.defineProperty(exports, "lookupRuntimeConnection", { enumerable: true, get: function () { return connection_lookup_js_1.lookupRuntimeConnection; } });
+var capability_report_js_1 = require("./capability-report.js");
+Object.defineProperty(exports, "capabilityReportFrom", { enumerable: true, get: function () { return capability_report_js_1.capabilityReportFrom; } });
+Object.defineProperty(exports, "DISCOVERY_DIGEST_PATTERN", { enumerable: true, get: function () { return capability_report_js_1.DISCOVERY_DIGEST_PATTERN; } });
+Object.defineProperty(exports, "POLICY_RELAXATIONS_VERSION", { enumerable: true, get: function () { return capability_report_js_1.POLICY_RELAXATIONS_VERSION; } });
+Object.defineProperty(exports, "uploadCapabilityReport", { enumerable: true, get: function () { return capability_report_js_1.uploadCapabilityReport; } });

package/dist/cjs/sync/jwks-provider.d.ts

@@ -0,0 +1,14 @@
+import type { RuntimePublicJwk, RuntimePublicKeyProvider } from './signature-verifier.js';
+export declare class HttpRuntimePublicKeyProvider implements RuntimePublicKeyProvider {
+    private readonly options;
+    private keys;
+    private expiresAt;
+    constructor(options: {
+        baseUrl: string;
+        apiKey: string;
+        fetchImpl?: typeof fetch;
+        cacheTtlMs?: number;
+    });
+    getKey(keyId: string): Promise<RuntimePublicJwk | null>;
+    private refresh;
+}

package/dist/cjs/sync/jwks-provider.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HttpRuntimePublicKeyProvider = void 0;
+class HttpRuntimePublicKeyProvider {
+    options;
+    keys = new Map();
+    expiresAt = 0;
+    constructor(options) {
+        this.options = options;
+    }
+    async getKey(keyId) {
+        if (Date.now() >= this.expiresAt)
+            await this.refresh();
+        const cached = this.keys.get(keyId);
+        if (cached)
+            return cached;
+        // A missing key may indicate rotation; refresh once even while the normal
+        // cache is still valid.
+        await this.refresh();
+        return this.keys.get(keyId) ?? null;
+    }
+    async refresh() {
+        const response = await (this.options.fetchImpl ?? fetch)(`${this.options.baseUrl.replace(/\/$/, '')}/v1/runtime-revisions/jwks`, {
+            headers: {
+                authorization: `Bearer ${this.options.apiKey}`,
+            },
+        });
+        if (!response.ok) {
+            throw new Error(`Runtime JWKS request failed (${response.status})`);
+        }
+        const payload = await response.json();
+        if (!Array.isArray(payload.keys)) {
+            throw new Error('Runtime JWKS response is invalid');
+        }
+        const next = new Map();
+        for (const raw of payload.keys) {
+            if (!raw || typeof raw !== 'object') {
+                throw new Error('Runtime JWKS contains an invalid key');
+            }
+            const key = raw;
+            if (key.d) {
+                throw new Error('Runtime JWKS must never contain private key material');
+            }
+            if (key.kty !== 'OKP'
+                || key.crv !== 'Ed25519'
+                || typeof key.x !== 'string'
+                || typeof key.kid !== 'string') {
+                throw new Error('Runtime JWKS key must be public Ed25519');
+            }
+            next.set(key.kid, key);
+        }
+        this.keys = next;
+        this.expiresAt = Date.now() + (this.options.cacheTtlMs ?? 300_000);
+    }
+}
+exports.HttpRuntimePublicKeyProvider = HttpRuntimePublicKeyProvider;

package/dist/cjs/sync/local-deployment-validator.d.ts

@@ -0,0 +1,30 @@
+import { type LocalToolBinding } from '../runtime/local-tool-bindings.js';
+import type { MaterializedDeploymentRevisions } from './materialize-deployment.js';
+export interface IgnoredPlatformTool {
+    toolId: string;
+    /**
+     * `platform-tool-not-in-code`: the deployed code has no binding (spec 4.9).
+     * `platform-tool-binding-mismatch`: the code changed the tool after the
+     * Platform last saw it; the local manifest keeps running it.
+     */
+    reason: 'platform-tool-not-in-code' | 'platform-tool-binding-mismatch';
+    /** Names of mismatched technical facts; never values or content. */
+    mismatches?: string[];
+}
+export interface LocalDeploymentValidation {
+    ignored: IgnoredPlatformTool[];
+}
+/**
+ * Accepts a Platform deployment for the deployed code. A Platform tool the
+ * code does not have, or has in a changed form, is ignored and reported
+ * instead of rejecting the whole deployment, so Platform decisions (their
+ * restrictions and pinned D16 relaxations) keep reaching the runtime while the
+ * Platform catches up with the
+ * code. Inconsistent Platform revisions still fail closed. The allowlist is
+ * checked against the reported `toolPolicies`, never against `toolOverrides`
+ * restrictions, so a tool only a Platform decision disables stays allowlisted.
+ */
+export declare function validateLocalDeploymentBindings(options: {
+    revisions: MaterializedDeploymentRevisions;
+    bindings: ReadonlyArray<LocalToolBinding>;
+}): LocalDeploymentValidation;

package/dist/cjs/sync/local-deployment-validator.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateLocalDeploymentBindings = validateLocalDeploymentBindings;
+const tool_policy_js_1 = require("../contracts/tool-policy.js");
+const local_tool_bindings_js_1 = require("../runtime/local-tool-bindings.js");
+/**
+ * Accepts a Platform deployment for the deployed code. A Platform tool the
+ * code does not have, or has in a changed form, is ignored and reported
+ * instead of rejecting the whole deployment, so Platform decisions (their
+ * restrictions and pinned D16 relaxations) keep reaching the runtime while the
+ * Platform catches up with the
+ * code. Inconsistent Platform revisions still fail closed. The allowlist is
+ * checked against the reported `toolPolicies`, never against `toolOverrides`
+ * restrictions, so a tool only a Platform decision disables stays allowlisted.
+ */
+function validateLocalDeploymentBindings(options) {
+    const bindings = uniqueIndex(options.bindings, (binding) => binding.toolId, 'local tool binding');
+    const manifestTools = uniqueIndex(options.revisions.manifestRevision.tools, (tool) => tool.toolId, 'manifest tool');
+    const policies = uniqueIndex(options.revisions.policyRevision.toolPolicies, (policy) => policy.toolId, 'runtime tool policy');
+    const allowlist = new Set();
+    const ignored = [];
+    for (const toolId of options.revisions.agentRevision.toolAllowlist) {
+        if (allowlist.has(toolId)) {
+            throw new Error(`Duplicate agent tool allowlist entry: ${toolId}`);
+        }
+        allowlist.add(toolId);
+        const manifestTool = manifestTools.get(toolId);
+        if (!manifestTool || !manifestTool.enabled || manifestTool.tombstone) {
+            throw new Error(`Unavailable manifest tool: ${toolId}`);
+        }
+        const policy = policies.get(toolId);
+        if (!policy || !policy.enabled) {
+            throw new Error(`Missing enabled runtime tool policy: ${toolId}`);
+        }
+        // A policy may raise the manifest risk, never lower it.
+        if ((0, tool_policy_js_1.riskTier)(policy.riskClass) < (0, tool_policy_js_1.riskTier)(manifestTool.riskClass)) {
+            throw new Error(`Runtime tool policy risk below manifest: ${toolId}`);
+        }
+        const binding = bindings.get(toolId);
+        if (!binding) {
+            ignored.push({ toolId, reason: 'platform-tool-not-in-code' });
+            continue;
+        }
+        const mismatches = (0, local_tool_bindings_js_1.localToolBindingMismatches)(binding, manifestTool);
+        if (mismatches.length > 0) {
+            ignored.push({ toolId, reason: 'platform-tool-binding-mismatch', mismatches });
+        }
+    }
+    return {
+        ignored: ignored.sort((left, right) => (left.toolId < right.toolId ? -1 : left.toolId > right.toolId ? 1 : 0)),
+    };
+}
+function uniqueIndex(values, key, label) {
+    const indexed = new Map();
+    for (const value of values) {
+        const id = key(value);
+        if (indexed.has(id))
+            throw new Error(`Duplicate ${label}: ${id}`);
+        indexed.set(id, value);
+    }
+    return indexed;
+}

package/dist/cjs/sync/managed-sync.d.ts

@@ -0,0 +1,40 @@
+import { type CapabilityReportResult } from './capability-report.js';
+import { HttpRuntimePublicKeyProvider } from './jwks-provider.js';
+import { RuntimeRevisionVerifier } from './signature-verifier.js';
+import { type RuntimeStateStore } from './state-store.js';
+import { RuntimeSyncManager } from './sync-manager.js';
+import { RuntimeControlPlaneClient, type RuntimePushConnector } from './control-plane-client.js';
+import type { RuntimeDeploymentBundle } from '../contracts/revisions.js';
+import type { MaterializedDeploymentRevisions } from './materialize-deployment.js';
+export declare function createManagedRuntimeSync(options: {
+    baseUrl: string;
+    apiKey: string;
+    appId: string;
+    environmentId: string;
+    runnerKey: string;
+    version: string;
+    stateStore?: RuntimeStateStore;
+    stateFilePath?: string;
+    fetchImpl?: typeof fetch;
+    push?: RuntimePushConnector | false;
+    pollIntervalMs?: number;
+    validateDeployment?: (deployment: RuntimeDeploymentBundle, revisions: MaterializedDeploymentRevisions) => void | Promise<void>;
+    onError?: (error: unknown) => void;
+    /**
+     * The committed setup artifact of the running code, e.g. the generated
+     * module's `setupArtifact`. Its discovery digest goes into every runner
+     * registration, and `reportCapabilities()` uploads it as the capability
+     * report (spec 4.10.6). Content-free; it never enables a tool. With it the
+     * runner also reports `policyRelaxations` (D16): compose the turns from
+     * the same artifact (`createLocalRuntimeSource`, or `createTurnSnapshot`
+     * with `relaxableToolIds(setupArtifact)`).
+     */
+    setupArtifact?: unknown;
+}): {
+    client: RuntimeControlPlaneClient;
+    manager: RuntimeSyncManager;
+    store: RuntimeStateStore;
+    verifier: RuntimeRevisionVerifier;
+    keys: HttpRuntimePublicKeyProvider;
+    reportCapabilities: () => Promise<CapabilityReportResult | undefined>;
+};