glirastes 0.3.2 → 0.5.0

package/dist/cjs/sync/managed-sync.js

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createManagedRuntimeSync = createManagedRuntimeSync;
+const capability_report_js_1 = require("./capability-report.js");
+const fetch_sse_push_js_1 = require("./fetch-sse-push.js");
+const jwks_provider_js_1 = require("./jwks-provider.js");
+const signature_verifier_js_1 = require("./signature-verifier.js");
+const state_store_js_1 = require("./state-store.js");
+const sync_manager_js_1 = require("./sync-manager.js");
+const control_plane_client_js_1 = require("./control-plane-client.js");
+function createManagedRuntimeSync(options) {
+    const report = options.setupArtifact === undefined
+        ? undefined
+        : (0, capability_report_js_1.capabilityReportFrom)(options.setupArtifact);
+    if (report && report.artifact.appId !== options.appId) {
+        throw new Error('The setup artifact belongs to a different app');
+    }
+    const store = options.stateStore
+        ?? (options.stateFilePath
+            ? new state_store_js_1.FileRuntimeStateStore(options.stateFilePath)
+            : new state_store_js_1.MemoryRuntimeStateStore());
+    const keys = new jwks_provider_js_1.HttpRuntimePublicKeyProvider({
+        baseUrl: options.baseUrl,
+        apiKey: options.apiKey,
+        fetchImpl: options.fetchImpl,
+    });
+    const verifier = new signature_verifier_js_1.RuntimeRevisionVerifier(keys);
+    let client;
+    const manager = new sync_manager_js_1.RuntimeSyncManager({
+        environmentId: options.environmentId,
+        store,
+        verifier,
+        validateDeployment: options.validateDeployment,
+        onPending: async (deployments) => {
+            for (const deployment of deployments) {
+                await client.heartbeat({
+                    health: options.validateDeployment ? 'healthy' : 'degraded',
+                    validatedDeploymentId: deployment.deploymentId,
+                    technicalMetadata: {
+                        validationStage: options.validateDeployment
+                            ? 'signature-schema-bindings'
+                            : 'missing-local-binding-validator',
+                    },
+                });
+            }
+        },
+        onActivated: async (deployments) => {
+            for (const deployment of deployments) {
+                await client.heartbeat({
+                    health: options.validateDeployment ? 'healthy' : 'degraded',
+                    lastAppliedDeploymentId: deployment.deploymentId,
+                    technicalMetadata: {
+                        activationStage: options.validateDeployment
+                            ? 'signature-schema-bindings'
+                            : 'missing-local-binding-validator',
+                    },
+                });
+            }
+        },
+    });
+    client = new control_plane_client_js_1.RuntimeControlPlaneClient({
+        baseUrl: options.baseUrl,
+        apiKey: options.apiKey,
+        appId: options.appId,
+        environmentId: options.environmentId,
+        runnerKey: options.runnerKey,
+        version: options.version,
+        ...(report ? { discoveryDigest: report.discoveryDigest, setupRunId: report.artifact.runId } : {}),
+        policyRelaxations: report !== undefined,
+        manager,
+        fetchImpl: options.fetchImpl,
+        push: options.push === false
+            ? undefined
+            : options.push ?? new fetch_sse_push_js_1.FetchSsePushConnector(options.fetchImpl),
+        pollIntervalMs: options.pollIntervalMs,
+        onError: options.onError,
+    });
+    let reported;
+    /** Uploads the capability report once per process; undefined without one. */
+    const reportCapabilities = async () => {
+        if (!report)
+            return undefined;
+        reported ??= (0, capability_report_js_1.uploadCapabilityReport)({
+            baseUrl: options.baseUrl,
+            apiKey: options.apiKey,
+            appId: options.appId,
+            report,
+            ...(options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}),
+        }).catch((error) => {
+            reported = undefined;
+            throw error;
+        });
+        return reported;
+    };
+    return { client, manager, store, verifier, keys, reportCapabilities };
+}

package/dist/cjs/sync/materialize-deployment.d.ts

@@ -0,0 +1,7 @@
+import { type AgentRevision, type ManifestRevision, type RuntimeDeploymentBundle, type RuntimePolicyRevision } from '../contracts/revisions.js';
+export interface MaterializedDeploymentRevisions {
+    agentRevision: AgentRevision;
+    manifestRevision: ManifestRevision;
+    policyRevision: RuntimePolicyRevision;
+}
+export declare function materializeDeploymentRevisions(deployment: RuntimeDeploymentBundle): MaterializedDeploymentRevisions;

package/dist/cjs/sync/materialize-deployment.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.materializeDeploymentRevisions = materializeDeploymentRevisions;
+const revisions_js_1 = require("../contracts/revisions.js");
+function materializeDeploymentRevisions(deployment) {
+    const policyRevision = revisions_js_1.RuntimePolicyRevisionSchema.parse({
+        revisionId: deployment.policyRevision.revisionId,
+        revision: deployment.policyRevision.revision,
+        tenantId: deployment.policyRevision.tenantId,
+        environmentId: deployment.policyRevision.environmentId,
+        ...payloadObject(deployment.policyRevision),
+        publishedAt: deployment.policyRevision.publishedAt,
+        signature: deployment.policyRevision.signature,
+    });
+    return {
+        agentRevision: revisions_js_1.AgentRevisionSchema.parse({
+            revisionId: deployment.agentRevision.revisionId,
+            revision: deployment.agentRevision.revision,
+            agentId: deployment.agentRevision.subjectId,
+            tenantId: deployment.agentRevision.tenantId,
+            ...agentFields(payloadObject(deployment.agentRevision), policyRevision),
+            publishedAt: deployment.agentRevision.publishedAt,
+            signature: deployment.agentRevision.signature,
+        }),
+        manifestRevision: revisions_js_1.ManifestRevisionSchema.parse({
+            revisionId: deployment.manifestRevision.revisionId,
+            revision: deployment.manifestRevision.revision,
+            tenantId: deployment.manifestRevision.tenantId,
+            targetAppId: deployment.manifestRevision.targetAppId,
+            environmentId: deployment.manifestRevision.environmentId,
+            ...payloadObject(deployment.manifestRevision),
+            publishedAt: deployment.manifestRevision.publishedAt,
+            signature: deployment.manifestRevision.signature,
+        }),
+        policyRevision,
+    };
+}
+/**
+ * A v1 agent payload already carries every field the runtime contract needs.
+ * A v2 planner payload references a budget profile instead of a concrete
+ * budget, so its normalized form takes the budget the policy revision of the
+ * same deployment pins; any other shape falls through to the strict agent
+ * contract and fails closed there.
+ */
+function agentFields(payload, policyRevision) {
+    if (!('budgetProfileRef' in payload))
+        return payload;
+    const planner = revisions_js_1.PlannerRevisionPayloadSchema.parse(payload);
+    return {
+        name: planner.plannerId,
+        objective: `Planner ${planner.plannerId} (${planner.budgetProfileRef})`,
+        modelAlias: planner.modelBindingRef,
+        promptBindingRef: planner.promptBindingRef,
+        toolAllowlist: planner.toolAllowlist,
+        budget: policyRevision.budget,
+    };
+}
+function payloadObject(revision) {
+    if (!revision.payload
+        || typeof revision.payload !== 'object'
+        || Array.isArray(revision.payload)) {
+        throw new Error(`${revision.revisionType} revision payload must be an object`);
+    }
+    return revision.payload;
+}

package/dist/cjs/sync/runtime-connect-client.d.ts

@@ -0,0 +1,23 @@
+import { type PairingStartRequest, type PairingStartResponse, type PairingTokenResult } from '../contracts/index.js';
+export interface RuntimeConnectClientOptions {
+    baseUrl: string;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+    sleep?: (milliseconds: number, signal?: AbortSignal) => Promise<void>;
+}
+export interface PollForConnectionOptions {
+    deviceCode: string;
+    pollIntervalMs: number;
+    expiresInSeconds: number;
+    signal?: AbortSignal;
+}
+export declare class RuntimeConnectClient {
+    private readonly options;
+    private readonly baseUrl;
+    constructor(options: RuntimeConnectClientOptions);
+    startPairing(input: PairingStartRequest, signal?: AbortSignal): Promise<PairingStartResponse>;
+    pollForConnection(options: PollForConnectionOptions): Promise<PairingTokenResult>;
+    private assertActive;
+    private withDeadline;
+    private request;
+}

package/dist/cjs/sync/runtime-connect-client.js

@@ -0,0 +1,185 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RuntimeConnectClient = void 0;
+const index_js_1 = require("../contracts/index.js");
+const index_js_2 = require("../diagnostics/index.js");
+function safeControlPlaneBaseUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new index_js_2.FoundationDiagnosticError({
+            code: 'E-CONNECT-URL-INVALID',
+            operation: 'connect.client',
+            message: 'The Control Plane URL is invalid.',
+            remediation: 'configure-control-plane-url',
+        });
+    }
+    if (value.length > 2_048) {
+        throw new index_js_2.FoundationDiagnosticError({
+            code: 'E-CONNECT-URL-INVALID',
+            operation: 'connect.client',
+            message: 'The Control Plane URL exceeds the supported length.',
+            remediation: 'configure-control-plane-url',
+        });
+    }
+    if (url.username || url.password) {
+        throw new index_js_2.FoundationDiagnosticError({
+            code: 'E-CONNECT-URL-INVALID',
+            operation: 'connect.client',
+            message: 'The Control Plane URL must not contain credentials.',
+            remediation: 'remove-url-credentials',
+        });
+    }
+    const loopback = new Set(['localhost', '127.0.0.1', '[::1]']);
+    if (url.protocol !== 'https:'
+        && !(url.protocol === 'http:' && loopback.has(url.hostname))) {
+        throw new index_js_2.FoundationDiagnosticError({
+            code: 'E-CONNECT-URL-INVALID',
+            operation: 'connect.client',
+            message: 'The Control Plane URL must use HTTPS or loopback HTTP.',
+            remediation: 'use-secure-control-plane-url',
+        });
+    }
+    return value.replace(/\/$/, '');
+}
+function diagnostic(code, message, remediation) {
+    return new index_js_2.FoundationDiagnosticError({
+        code,
+        operation: 'connect.pairing',
+        message,
+        remediation,
+    });
+}
+async function defaultSleep(milliseconds, signal) {
+    if (signal?.aborted)
+        return;
+    await new Promise((resolve) => {
+        const finish = () => {
+            clearTimeout(timer);
+            signal?.removeEventListener('abort', finish);
+            resolve();
+        };
+        const timer = setTimeout(finish, milliseconds);
+        signal?.addEventListener('abort', finish, { once: true });
+    });
+}
+class RuntimeConnectClient {
+    options;
+    baseUrl;
+    constructor(options) {
+        this.options = options;
+        this.baseUrl = safeControlPlaneBaseUrl(options.baseUrl);
+    }
+    async startPairing(input, signal) {
+        const body = index_js_1.PairingStartRequestSchema.parse(input);
+        const value = await this.request('', body, signal);
+        const parsed = index_js_1.PairingStartResponseSchema.safeParse(value);
+        if (!parsed.success) {
+            throw diagnostic('E-CONNECT-RESPONSE-INVALID', 'The Control Plane returned an invalid pairing response.', 'retry-browser-pairing');
+        }
+        return parsed.data;
+    }
+    async pollForConnection(options) {
+        const startedAt = (this.options.now ?? Date.now)();
+        const deadline = startedAt + options.expiresInSeconds * 1_000;
+        let interval = options.pollIntervalMs;
+        const sleep = this.options.sleep ?? defaultSleep;
+        while (true) {
+            this.assertActive(options.signal, deadline);
+            await this.withDeadline(deadline, options.signal, (signal) => sleep(interval, signal));
+            this.assertActive(options.signal, deadline);
+            const value = await this.withDeadline(deadline, options.signal, (signal) => this.request('/token', { deviceCode: options.deviceCode }, signal));
+            const parsed = index_js_1.PairingTokenResultSchema.safeParse(value);
+            if (!parsed.success) {
+                throw diagnostic('E-CONNECT-RESPONSE-INVALID', 'The Control Plane returned an invalid pairing status.', 'retry-browser-pairing');
+            }
+            if (parsed.data.status !== 'pending')
+                return parsed.data;
+            interval = parsed.data.pollAfterMs;
+        }
+    }
+    assertActive(signal, deadline) {
+        if (signal?.aborted) {
+            throw diagnostic('E-CONNECT-CANCELLED', 'Platform pairing was cancelled.', 'restart-browser-pairing');
+        }
+        if ((this.options.now ?? Date.now)() >= deadline) {
+            throw diagnostic('E-CONNECT-TIMEOUT', 'Platform pairing timed out.', 'restart-browser-pairing');
+        }
+    }
+    async withDeadline(deadline, externalSignal, operation) {
+        this.assertActive(externalSignal, deadline);
+        const remaining = deadline - (this.options.now ?? Date.now)();
+        const controller = new AbortController();
+        let abortSource;
+        const onExternalAbort = () => {
+            if (controller.signal.aborted)
+                return;
+            abortSource = 'external';
+            controller.abort(externalSignal?.reason);
+        };
+        const onTimeout = () => {
+            if (controller.signal.aborted)
+                return;
+            abortSource = 'timeout';
+            controller.abort();
+        };
+        let rejectAborted = () => undefined;
+        const aborted = new Promise((_resolve, reject) => {
+            rejectAborted = reject;
+        });
+        const onInternalAbort = () => {
+            rejectAborted(new Error('connect operation aborted'));
+        };
+        controller.signal.addEventListener('abort', onInternalAbort, { once: true });
+        externalSignal?.addEventListener('abort', onExternalAbort, { once: true });
+        if (externalSignal?.aborted)
+            onExternalAbort();
+        const timer = setTimeout(onTimeout, remaining);
+        try {
+            return await Promise.race([operation(controller.signal), aborted]);
+        }
+        catch (error) {
+            if (abortSource === 'timeout') {
+                throw diagnostic('E-CONNECT-TIMEOUT', 'Platform pairing timed out.', 'restart-browser-pairing');
+            }
+            if (abortSource === 'external' || externalSignal?.aborted) {
+                throw diagnostic('E-CONNECT-CANCELLED', 'Platform pairing was cancelled.', 'restart-browser-pairing');
+            }
+            throw error;
+        }
+        finally {
+            clearTimeout(timer);
+            externalSignal?.removeEventListener('abort', onExternalAbort);
+            controller.signal.removeEventListener('abort', onInternalAbort);
+        }
+    }
+    async request(suffix, body, signal) {
+        let response;
+        try {
+            response = await (this.options.fetchImpl ?? fetch)(`${this.baseUrl}/v1/runtime-connect/pairings${suffix}`, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify(body),
+                signal,
+            });
+        }
+        catch {
+            if (signal?.aborted) {
+                throw diagnostic('E-CONNECT-CANCELLED', 'Platform pairing was cancelled.', 'restart-browser-pairing');
+            }
+            throw diagnostic('E-CONNECT-NETWORK', 'The Control Plane pairing request failed.', 'check-control-plane-connection');
+        }
+        if (!response.ok) {
+            throw diagnostic('E-CONNECT-REQUEST', `The Control Plane pairing request failed (${response.status}).`, 'retry-browser-pairing');
+        }
+        try {
+            return await response.json();
+        }
+        catch {
+            throw diagnostic('E-CONNECT-RESPONSE-INVALID', 'The Control Plane returned invalid pairing data.', 'retry-browser-pairing');
+        }
+    }
+}
+exports.RuntimeConnectClient = RuntimeConnectClient;

package/dist/cjs/sync/runtime-setup-client.d.ts

@@ -0,0 +1,62 @@
+import type { ScannedRouteCandidate } from '../codegen/route-scanner.js';
+export interface RouteScanUpload {
+    schemaVersion: 1;
+    generatedAt: string;
+    candidates: ScannedRouteCandidate[];
+    ignored: string[];
+    executions?: LocalExecutionEvidence[];
+}
+interface LocalExecutionEvidenceBase {
+    definitionId: string;
+    stableKey: string;
+    sourceFingerprint: string;
+    inputSchemaDigest: string;
+    outputSchemaDigest: string;
+}
+export type LocalExecutionEvidence = LocalExecutionEvidenceBase & {
+    executionKind: 'endpoint';
+    method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+    path: string;
+} | LocalExecutionEvidenceBase & {
+    executionKind: 'ui';
+    actionBindingRef: string;
+};
+export interface LocalExecutionInventory {
+    schemaVersion: 1;
+    executions: LocalExecutionEvidence[];
+}
+export interface RuntimeSetupImportResult {
+    createdDrafts: number;
+    unchanged: number;
+    bindings: Array<{
+        toolId: string;
+        stableKey: string;
+        sourceFingerprint: string;
+    }>;
+    tombstoneCandidates: Array<{
+        toolId: string;
+        stableKey: string;
+    }>;
+    interview: Array<{
+        toolId: string;
+        stableKey: string;
+        reasonCodes: string[];
+        questions: string[];
+    }>;
+}
+export declare function parseLocalExecutionInventory(value: unknown): LocalExecutionInventory;
+export declare class RuntimeSetupClient {
+    private readonly options;
+    constructor(options: {
+        baseUrl: string;
+        apiKey: string;
+        appId: string;
+        environmentId: string;
+        fetchImpl?: typeof fetch;
+    });
+    importRouteScan(scan: RouteScanUpload): Promise<RuntimeSetupImportResult>;
+    private importUrl;
+    private sanitize;
+    private matchesUpload;
+}
+export {};

package/dist/cjs/sync/runtime-setup-client.js

@@ -0,0 +1,157 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RuntimeSetupClient = void 0;
+exports.parseLocalExecutionInventory = parseLocalExecutionInventory;
+const zod_1 = require("zod");
+const fingerprintSchema = zod_1.z.string().regex(/^sha256:(?:[A-Za-z0-9_-]{43}|[A-Za-z0-9+/]{43}=)$/);
+const executionBaseSchema = zod_1.z.object({
+    definitionId: zod_1.z.string().trim().min(1).max(200),
+    stableKey: zod_1.z.string().trim().min(1).max(2_100),
+    sourceFingerprint: fingerprintSchema,
+    inputSchemaDigest: fingerprintSchema,
+    outputSchemaDigest: fingerprintSchema,
+});
+const localExecutionEvidenceSchema = zod_1.z.discriminatedUnion('executionKind', [
+    executionBaseSchema.extend({
+        executionKind: zod_1.z.literal('endpoint'),
+        method: zod_1.z.enum(['GET', 'POST', 'PUT', 'PATCH', 'DELETE']),
+        path: zod_1.z.string().startsWith('/').max(2_048),
+    }).strict(),
+    executionBaseSchema.extend({
+        executionKind: zod_1.z.literal('ui'),
+        actionBindingRef: zod_1.z.string().trim().min(1).max(200),
+    }).strict(),
+]);
+const localExecutionInventorySchema = zod_1.z.object({
+    schemaVersion: zod_1.z.literal(1),
+    executions: zod_1.z.array(localExecutionEvidenceSchema).max(5_000),
+}).strict();
+const toolIdentitySchema = zod_1.z.object({
+    toolId: zod_1.z.string().uuid(),
+    stableKey: zod_1.z.string().trim().min(1).max(2_100),
+}).strict();
+const importResultSchema = zod_1.z.object({
+    createdDrafts: zod_1.z.number().int().nonnegative(),
+    unchanged: zod_1.z.number().int().nonnegative(),
+    bindings: zod_1.z.array(toolIdentitySchema.extend({
+        sourceFingerprint: fingerprintSchema,
+    }).strict()).max(5_000),
+    tombstoneCandidates: zod_1.z.array(toolIdentitySchema).max(5_000),
+    interview: zod_1.z.array(zod_1.z.object({
+        toolId: zod_1.z.string().uuid(),
+        stableKey: zod_1.z.string().trim().min(1).max(2_100),
+        reasonCodes: zod_1.z.array(zod_1.z.string().trim().min(1).max(200)).max(100),
+        questions: zod_1.z.array(zod_1.z.string().trim().min(1).max(1_000)).max(100),
+    }).strict()).max(5_000),
+}).strict();
+function parseLocalExecutionInventory(value) {
+    return localExecutionInventorySchema.parse(value);
+}
+class RuntimeSetupClient {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    async importRouteScan(scan) {
+        const response = await (this.options.fetchImpl ?? fetch)(this.importUrl(), {
+            method: 'POST',
+            headers: {
+                authorization: `Bearer ${this.options.apiKey}`,
+                'content-type': 'application/json',
+            },
+            body: JSON.stringify(this.sanitize(scan)),
+        });
+        if (!response.ok) {
+            throw new Error(`Glirastes setup import failed (${response.status})`);
+        }
+        const parsed = importResultSchema.safeParse(await response.json());
+        if (!parsed.success || !this.matchesUpload(scan, parsed.data?.bindings)) {
+            throw new Error('Invalid Glirastes setup import response');
+        }
+        return parsed.data;
+    }
+    importUrl() {
+        return `${this.options.baseUrl.replace(/\/$/, '')}`
+            + `/v1/apps/${encodeURIComponent(this.options.appId)}`
+            + `/environments/${encodeURIComponent(this.options.environmentId)}`
+            + '/runtime-setup/scans';
+    }
+    sanitize(scan) {
+        return {
+            schemaVersion: 1,
+            generatedAt: scan.generatedAt,
+            candidates: scan.candidates.map((candidate) => ({
+                sourceFile: candidate.sourceFile,
+                sourceFingerprint: candidate.sourceFingerprint,
+                exportName: candidate.exportName,
+                method: candidate.method,
+                path: candidate.path,
+                pathParams: [...candidate.pathParams],
+                queryParams: candidate.queryParams.map((parameter) => ({
+                    name: parameter.name,
+                    repeated: parameter.repeated,
+                })),
+                schemaBindings: candidate.schemaBindings.map((binding) => ({
+                    symbol: binding.symbol,
+                    module: binding.module,
+                })),
+                authEvidence: [...candidate.authEvidence],
+                externalCallEvidence: [...candidate.externalCallEvidence],
+                riskClass: candidate.riskClass,
+                autoApprovalEligible: false,
+                reviewReasons: [...candidate.reviewReasons],
+            })),
+            ignored: [...scan.ignored],
+            ...(scan.executions
+                ? {
+                    executions: scan.executions.map((execution) => (execution.executionKind === 'endpoint'
+                        ? {
+                            definitionId: execution.definitionId,
+                            stableKey: execution.stableKey,
+                            executionKind: execution.executionKind,
+                            sourceFingerprint: execution.sourceFingerprint,
+                            inputSchemaDigest: execution.inputSchemaDigest,
+                            outputSchemaDigest: execution.outputSchemaDigest,
+                            method: execution.method,
+                            path: execution.path,
+                        }
+                        : {
+                            definitionId: execution.definitionId,
+                            stableKey: execution.stableKey,
+                            executionKind: execution.executionKind,
+                            sourceFingerprint: execution.sourceFingerprint,
+                            inputSchemaDigest: execution.inputSchemaDigest,
+                            outputSchemaDigest: execution.outputSchemaDigest,
+                            actionBindingRef: execution.actionBindingRef,
+                        })),
+                }
+                : {}),
+        };
+    }
+    matchesUpload(scan, bindings) {
+        if (!bindings)
+            return false;
+        const expected = new Map(scan.candidates.map((candidate) => [
+            `${candidate.method} ${candidate.path}`,
+            candidate.sourceFingerprint,
+        ]));
+        for (const execution of scan.executions ?? []) {
+            const existing = expected.get(execution.stableKey);
+            if (existing && existing !== execution.sourceFingerprint)
+                return false;
+            expected.set(execution.stableKey, execution.sourceFingerprint);
+        }
+        if (bindings.length !== expected.size)
+            return false;
+        const seen = new Set();
+        for (const binding of bindings) {
+            if (seen.has(binding.stableKey)
+                || expected.get(binding.stableKey) !== binding.sourceFingerprint) {
+                return false;
+            }
+            seen.add(binding.stableKey);
+        }
+        return seen.size === expected.size;
+    }
+}
+exports.RuntimeSetupClient = RuntimeSetupClient;

package/dist/cjs/sync/signature-verifier.d.ts

@@ -0,0 +1,39 @@
+import { webcrypto } from 'node:crypto';
+import type { ExecutionLease, RuntimeRevisionEnvelope, SecurityRevocation } from '../contracts/revisions.js';
+import type { PromptBundle, SignedPromptBinding } from '../contracts/prompt-bundle.js';
+export type RuntimePublicJwk = webcrypto.JsonWebKey & {
+    kid?: string;
+    alg?: string;
+    use?: string;
+};
+export interface RuntimePublicKeyProvider {
+    getKey(keyId: string): Promise<RuntimePublicJwk | null>;
+}
+export declare class RuntimeSyncVerificationError extends Error {
+    readonly code: 'content_hash_mismatch' | 'signing_key_unavailable' | 'invalid_signing_key' | 'signature_invalid';
+    constructor(message: string, code: 'content_hash_mismatch' | 'signing_key_unavailable' | 'invalid_signing_key' | 'signature_invalid');
+}
+export declare function canonicalRuntimeJson(value: unknown): string;
+export declare class RuntimeRevisionVerifier {
+    private readonly keys;
+    constructor(keys: RuntimePublicKeyProvider);
+    verifyRevision(revision: RuntimeRevisionEnvelope): Promise<void>;
+    /**
+     * A prompt bundle is content-addressed: its digest must match its canonical
+     * sections and its publisher signature must verify before anything downstream
+     * may parse or activate it.
+     */
+    verifyPromptBundle(bundle: PromptBundle): Promise<void>;
+    verifyPromptBinding(binding: SignedPromptBinding): Promise<void>;
+    /**
+     * Verify any signed object of the `{ ...unsigned, signature }` envelope
+     * shape. Used by the standalone runtime source, whose locally
+     * materialized revisions must pass the same chain as managed ones.
+     */
+    verifySignedObject(value: {
+        signature: RuntimeRevisionEnvelope['signature'];
+    } & object): Promise<void>;
+    verifyRevocation(revocation: SecurityRevocation): Promise<void>;
+    verifyExecutionLease(lease: ExecutionLease): Promise<void>;
+    private verifyEnvelope;
+}