glirastes 0.4.0 → 0.5.0

package/dist/sync/connection-lookup.js

@@ -0,0 +1,56 @@
+import { trimTrailingSlashes } from '../contracts/url.js';
+import { z } from 'zod';
+import { RuntimeControlPlaneRequestError } from './control-plane-client.js';
+const RuntimeConnectionResponseSchema = z.object({
+    schemaVersion: z.literal(1),
+    appId: z.uuid(),
+    environmentId: z.uuid(),
+    runnerKey: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/),
+});
+// Only short, machine-readable codes are surfaced; anything else is dropped.
+const ERROR_CODE_PATTERN = /^[a-z][a-z0-9_]{0,63}$/;
+async function errorCode(response) {
+    try {
+        const body = await response.json();
+        return typeof body?.code === 'string' && ERROR_CODE_PATTERN.test(body.code)
+            ? body.code
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Asks the Platform which app, environment and runner a runtime key was
+ * issued for, so a connected app needs only `GLIRASTES_API_KEY`. Errors name
+ * the operation and status only (401 invalid key, 409
+ * `connection_key_unbound` for a key not issued by a pairing).
+ */
+export async function lookupRuntimeConnection(options) {
+    const response = await (options.fetchImpl ?? fetch)(`${trimTrailingSlashes(options.baseUrl)}/v1/runtime/connection`, {
+        method: 'GET',
+        headers: { 'x-api-key': options.apiKey, accept: 'application/json' },
+        ...(options.signal ? { signal: options.signal } : {}),
+    });
+    if (!response.ok) {
+        throw new RuntimeControlPlaneRequestError('connection', response.status, await errorCode(response));
+    }
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch {
+        body = undefined;
+    }
+    const parsed = RuntimeConnectionResponseSchema.safeParse(body);
+    if (!parsed.success) {
+        throw new Error('Glirastes Control Plane connection response is invalid');
+    }
+    return {
+        baseUrl: options.baseUrl,
+        appId: parsed.data.appId,
+        environmentId: parsed.data.environmentId,
+        runnerKey: parsed.data.runnerKey,
+    };
+}
+//# sourceMappingURL=connection-lookup.js.map

package/dist/sync/connection-lookup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-lookup.js","sourceRoot":"","sources":["../../src/sync/connection-lookup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAC;AAU5E,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE;IACf,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oCAAoC,CAAC;CAClE,CAAC,CAAC;AAEH,6EAA6E;AAC7E,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;AAEpD,KAAK,UAAU,SAAS,CAAC,QAAkB;IACzC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA+B,CAAC;QAChE,OAAO,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YACzE,CAAC,CAAC,IAAI,CAAC,IAAI;YACX,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAK7C;IACC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CACjD,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,wBAAwB,EAC/D;QACE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACpE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,+BAA+B,CACvC,YAAY,EACZ,QAAQ,CAAC,MAAM,EACf,MAAM,SAAS,CAAC,QAAQ,CAAC,CAC1B,CAAC;IACJ,CAAC;IACD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,+BAA+B,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;QACxB,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa;QACxC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;KACjC,CAAC;AACJ,CAAC"}

package/dist/sync/control-plane-client.d.ts

@@ -0,0 +1,69 @@
+import type { RuntimeSyncManager } from './sync-manager.js';
+export interface RuntimePushConnector {
+    connect(options: {
+        url: string;
+        headers: Record<string, string>;
+        signal: AbortSignal;
+        onEvent: () => void | Promise<void>;
+    }): Promise<void>;
+}
+export declare class RuntimeControlPlaneRequestError extends Error {
+    readonly operation: string;
+    readonly status: number;
+    /** A content-free error code the Platform answered with, e.g. `connection_key_unbound`. */
+    readonly code?: string;
+    constructor(operation: string, status: number, code?: string);
+}
+export declare class RuntimeControlPlaneClient {
+    private readonly options;
+    private abortController;
+    private cursor;
+    constructor(options: {
+        baseUrl: string;
+        apiKey: string;
+        appId: string;
+        environmentId: string;
+        runnerKey: string;
+        version: string;
+        /**
+         * Discovery digest of the running code. Sent with every registration so
+         * the Platform knows which capability report describes this runner.
+         */
+        discoveryDigest?: string;
+        /**
+         * Setup run of the committed artifact this build carries (P10). With it
+         * the Platform shows the capability report of exactly this build, also
+         * when another build of the same endpoint inventory reported later.
+         */
+        setupRunId?: string;
+        /**
+         * True when this runner composes signed Platform decisions with the
+         * local code report (`createLocalRuntimeSource`, or `createTurnSnapshot`
+         * with `relaxableToolIds`), so a Platform relaxation of confirmation takes
+         * effect here (D16). Registration then reports `policyRelaxations`.
+         */
+        policyRelaxations?: boolean;
+        manager: RuntimeSyncManager;
+        fetchImpl?: typeof fetch;
+        push?: RuntimePushConnector;
+        pollIntervalMs?: number;
+        onError?: (error: unknown) => void;
+    });
+    register(input?: {
+        capabilities?: Record<string, unknown>;
+        technicalMetadata?: Record<string, unknown>;
+    }): Promise<unknown>;
+    heartbeat(input: {
+        health: 'healthy' | 'degraded' | 'unhealthy';
+        validatedDeploymentId?: string;
+        lastAppliedDeploymentId?: string;
+        technicalMetadata?: Record<string, unknown>;
+    }): Promise<unknown>;
+    syncOnce(): Promise<import("./sync-manager.js").RuntimeSyncApplyResult>;
+    start(): Promise<void>;
+    stop(): void;
+    private request;
+    private runnerBaseUrl;
+    private assertTechnicalMetadata;
+    private delay;
+}

package/dist/sync/control-plane-client.js

@@ -0,0 +1,182 @@
+import { findForbiddenContentPath } from '../contracts/content-boundary.js';
+import { DISCOVERY_DIGEST_PATTERN, POLICY_RELAXATIONS_VERSION, } from './capability-report.js';
+const SETUP_RUN_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export class RuntimeControlPlaneRequestError extends Error {
+    operation;
+    status;
+    /** A content-free error code the Platform answered with, e.g. `connection_key_unbound`. */
+    code;
+    constructor(operation, status, code) {
+        super(`Glirastes Control Plane ${operation} request failed (${status})`);
+        this.name = 'RuntimeControlPlaneRequestError';
+        this.operation = operation;
+        this.status = status;
+        if (code !== undefined)
+            this.code = code;
+    }
+}
+export class RuntimeControlPlaneClient {
+    options;
+    abortController = null;
+    cursor = null;
+    constructor(options) {
+        this.options = options;
+        if (options.discoveryDigest !== undefined
+            && !DISCOVERY_DIGEST_PATTERN.test(options.discoveryDigest)) {
+            throw new Error('discoveryDigest must be a sha256 digest of the running code');
+        }
+        if (options.setupRunId !== undefined) {
+            if (options.discoveryDigest === undefined) {
+                throw new Error('setupRunId names the setup run of a discoveryDigest; pass both');
+            }
+            if (!SETUP_RUN_ID_PATTERN.test(options.setupRunId)) {
+                throw new Error('setupRunId must be the uuid of the committed setup run');
+            }
+        }
+    }
+    async register(input = {}) {
+        const capabilities = { ...input.capabilities ?? {} };
+        const digest = this.options.discoveryDigest;
+        if (digest !== undefined) {
+            if (capabilities.discoveryDigest !== undefined
+                && capabilities.discoveryDigest !== digest) {
+                throw new Error('capabilities.discoveryDigest must name the running code');
+            }
+            capabilities.discoveryDigest = digest;
+        }
+        const setupRunId = this.options.setupRunId;
+        if (capabilities.setupRunId !== undefined
+            && capabilities.setupRunId !== setupRunId) {
+            throw new Error('capabilities.setupRunId is reported from the committed setup artifact');
+        }
+        if (setupRunId !== undefined)
+            capabilities.setupRunId = setupRunId;
+        const relaxations = this.options.policyRelaxations
+            ? POLICY_RELAXATIONS_VERSION
+            : undefined;
+        if (capabilities.policyRelaxations !== undefined
+            && capabilities.policyRelaxations !== relaxations) {
+            // Claiming D16 without applying it would show relaxations as effective
+            // while the chat keeps asking, or the other way round.
+            throw new Error('capabilities.policyRelaxations is reported by the runtime');
+        }
+        if (relaxations !== undefined)
+            capabilities.policyRelaxations = relaxations;
+        this.assertTechnicalMetadata(capabilities);
+        this.assertTechnicalMetadata(input.technicalMetadata ?? {});
+        return this.request('register', {
+            method: 'POST',
+            body: JSON.stringify({
+                runnerKey: this.options.runnerKey,
+                version: this.options.version,
+                capabilities,
+                technicalMetadata: input.technicalMetadata ?? {},
+            }),
+        });
+    }
+    async heartbeat(input) {
+        this.assertTechnicalMetadata(input.technicalMetadata ?? {});
+        return this.request('heartbeat', {
+            method: 'PATCH',
+            body: JSON.stringify({
+                runnerKey: this.options.runnerKey,
+                ...input,
+                technicalMetadata: input.technicalMetadata ?? {},
+            }),
+        });
+    }
+    async syncOnce() {
+        const query = new URLSearchParams({ runnerKey: this.options.runnerKey });
+        if (this.cursor)
+            query.set('cursor', this.cursor);
+        const bundle = await this.request(`sync?${query.toString()}`, {
+            method: 'GET',
+        });
+        const result = await this.options.manager.apply(bundle);
+        if (bundle
+            && typeof bundle === 'object'
+            && 'cursor' in bundle
+            && typeof bundle.cursor === 'string') {
+            this.cursor = bundle.cursor;
+        }
+        return result;
+    }
+    async start() {
+        if (this.abortController) {
+            throw new Error('Runtime Control Plane client is already running');
+        }
+        const controller = new AbortController();
+        this.abortController = controller;
+        if (this.options.push) {
+            void this.options.push.connect({
+                url: `${this.runnerBaseUrl()}/stream`,
+                headers: { authorization: `Bearer ${this.options.apiKey}` },
+                signal: controller.signal,
+                onEvent: async () => {
+                    try {
+                        await this.syncOnce();
+                    }
+                    catch (error) {
+                        this.options.onError?.(error);
+                    }
+                },
+            }).catch((error) => {
+                if (!controller.signal.aborted)
+                    this.options.onError?.(error);
+            });
+        }
+        const interval = Math.max(1, this.options.pollIntervalMs ?? 30_000);
+        while (!controller.signal.aborted) {
+            try {
+                await this.syncOnce();
+            }
+            catch (error) {
+                this.options.onError?.(error);
+            }
+            await this.delay(interval, controller.signal);
+        }
+        if (this.abortController === controller)
+            this.abortController = null;
+    }
+    stop() {
+        this.abortController?.abort();
+    }
+    async request(path, init) {
+        const response = await (this.options.fetchImpl ?? fetch)(`${this.runnerBaseUrl()}/${path}`, {
+            ...init,
+            headers: {
+                authorization: `Bearer ${this.options.apiKey}`,
+                'content-type': 'application/json',
+                ...init.headers,
+            },
+        });
+        if (!response.ok) {
+            throw new RuntimeControlPlaneRequestError(path.split('?', 1)[0], response.status);
+        }
+        return response.json();
+    }
+    runnerBaseUrl() {
+        return `${this.options.baseUrl.replace(/\/$/, '')}`
+            + `/v1/runtime/apps/${encodeURIComponent(this.options.appId)}`
+            + `/environments/${encodeURIComponent(this.options.environmentId)}`
+            + '/runners';
+    }
+    assertTechnicalMetadata(value) {
+        const forbidden = findForbiddenContentPath(value);
+        if (forbidden) {
+            throw new Error(`Technical runtime metadata contains forbidden content at ${forbidden.join('.')}`);
+        }
+    }
+    delay(milliseconds, signal) {
+        if (signal.aborted)
+            return Promise.resolve();
+        return new Promise((resolve) => {
+            const timer = setTimeout(resolve, milliseconds);
+            signal.addEventListener('abort', () => {
+                clearTimeout(timer);
+                resolve();
+            }, { once: true });
+        });
+    }
+}
+//# sourceMappingURL=control-plane-client.js.map

package/dist/sync/control-plane-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-plane-client.js","sourceRoot":"","sources":["../../src/sync/control-plane-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EACL,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAGhC,MAAM,oBAAoB,GAAG,iEAAiE,CAAC;AAW/F,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IAC/C,SAAS,CAAS;IAClB,MAAM,CAAS;IACxB,2FAA2F;IAClF,IAAI,CAAU;IAEvB,YAAY,SAAiB,EAAE,MAAc,EAAE,IAAa;QAC1D,KAAK,CAAC,2BAA2B,SAAS,oBAAoB,MAAM,GAAG,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;QAC9C,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,OAAO,yBAAyB;IAIP;IAHrB,eAAe,GAA2B,IAAI,CAAC;IAC/C,MAAM,GAAkB,IAAI,CAAC;IAErC,YAA6B,OA8B5B;QA9B4B,YAAO,GAAP,OAAO,CA8BnC;QACC,IACE,OAAO,CAAC,eAAe,KAAK,SAAS;eAClC,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAC1D,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;YACpF,CAAC;YACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,QAGX,EAAE;QACJ,MAAM,YAAY,GAAG,EAAE,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;QAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IACE,YAAY,CAAC,eAAe,KAAK,SAAS;mBACvC,YAAY,CAAC,eAAe,KAAK,MAAM,EAC1C,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;YAC7E,CAAC;YACD,YAAY,CAAC,eAAe,GAAG,MAAM,CAAC;QACxC,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QAC3C,IACE,YAAY,CAAC,UAAU,KAAK,SAAS;eAClC,YAAY,CAAC,UAAU,KAAK,UAAU,EACzC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,UAAU,KAAK,SAAS;YAAE,YAAY,CAAC,UAAU,GAAG,UAAU,CAAC;QACnE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB;YAChD,CAAC,CAAC,0BAA0B;YAC5B,CAAC,CAAC,SAAS,CAAC;QACd,IACE,YAAY,CAAC,iBAAiB,KAAK,SAAS;eACzC,YAAY,CAAC,iBAAiB,KAAK,WAAW,EACjD,CAAC;YACD,uEAAuE;YACvE,uDAAuD;YACvD,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,WAAW,KAAK,SAAS;YAAE,YAAY,CAAC,iBAAiB,GAAG,WAAW,CAAC;QAC5E,IAAI,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE;YAC9B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;gBACjC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;gBAC7B,YAAY;gBACZ,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,EAAE;aACjD,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAKf;QACC,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE;YAC/B,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;gBACjC,GAAG,KAAK;gBACR,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,EAAE;aACjD,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QACzE,IAAI,IAAI,CAAC,MAAM;YAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,CAAC,QAAQ,EAAE,EAAE,EAAE;YAC5D,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACxD,IACE,MAAM;eACH,OAAO,MAAM,KAAK,QAAQ;eAC1B,QAAQ,IAAI,MAAM;eAClB,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EACpC,CAAC;YACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC;QAClC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACtB,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;gBAC7B,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS;gBACrC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE;gBAC3D,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,OAAO,EAAE,KAAK,IAAI,EAAE;oBAClB,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACxB,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;oBAChC,CAAC;gBACH,CAAC;aACF,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACjB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO;oBAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;YAChE,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,MAAM,CAAC,CAAC;QACpE,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;YAChC,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,IAAI,CAAC,eAAe,KAAK,UAAU;YAAE,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;IACvE,CAAC;IAED,IAAI;QACF,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,IAAiB;QACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CACtD,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,IAAI,EAAE,EACjC;YACE,GAAG,IAAI;YACP,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;gBAC9C,cAAc,EAAE,kBAAkB;gBAClC,GAAG,IAAI,CAAC,OAAO;aAChB;SACF,CACF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,+BAA+B,CACvC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,EACtB,QAAQ,CAAC,MAAM,CAChB,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAEO,aAAa;QACnB,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE;cAC/C,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;cAC5D,iBAAiB,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE;cACjE,UAAU,CAAC;IACjB,CAAC;IAEO,uBAAuB,CAAC,KAAc;QAC5C,MAAM,SAAS,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,4DAA4D,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAClF,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAoB,EAAE,MAAmB;QACrD,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC7C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YAChD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;gBACpC,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,EAAE,CAAC;YACZ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/sync/deployment-selector.d.ts

@@ -0,0 +1,9 @@
+import type { RuntimeDeploymentBundle } from '../contracts/revisions.js';
+export declare function stableCohortBucket(subjectId: string): number;
+export declare function selectRuntimeDeployment(deployments: {
+    stable: RuntimeDeploymentBundle | null;
+    canary: RuntimeDeploymentBundle | null;
+}, input: {
+    subjectId: string;
+    pinnedDeploymentId?: string;
+}): RuntimeDeploymentBundle;

package/dist/sync/deployment-selector.js

@@ -0,0 +1,26 @@
+import { createHash } from 'node:crypto';
+export function stableCohortBucket(subjectId) {
+    const digest = createHash('sha256').update(subjectId).digest();
+    return digest.readUInt32BE(0) % 100;
+}
+export function selectRuntimeDeployment(deployments, input) {
+    if (input.pinnedDeploymentId) {
+        const available = [deployments.stable, deployments.canary].filter((deployment) => deployment !== null);
+        const pinned = available.find((deployment) => (deployment.deploymentId === input.pinnedDeploymentId
+            && deployment.pinned));
+        if (!pinned) {
+            throw new Error('Pinned runtime deployment is unavailable or not pinnable');
+        }
+        return pinned;
+    }
+    if (!deployments.stable) {
+        throw new Error('No verified stable deployment is available');
+    }
+    if (deployments.canary
+        && stableCohortBucket(input.subjectId)
+            < deployments.canary.targetPercentage) {
+        return deployments.canary;
+    }
+    return deployments.stable;
+}
+//# sourceMappingURL=deployment-selector.js.map

package/dist/sync/deployment-selector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-selector.js","sourceRoot":"","sources":["../../src/sync/deployment-selector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/D,OAAO,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,WAGC,EACD,KAGC;IAED,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,MAAM,CAC/D,CAAC,UAAU,EAAyC,EAAE,CAAC,UAAU,KAAK,IAAI,CAC3E,CAAC;QACF,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAC3B,CAAC,UAAU,EAAE,EAAE,CAAC,CACd,UAAU,CAAC,YAAY,KAAK,KAAK,CAAC,kBAAkB;eACjD,UAAU,CAAC,MAAM,CACrB,CACF,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,IACE,WAAW,CAAC,MAAM;WACf,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC;cAClC,WAAW,CAAC,MAAM,CAAC,gBAAgB,EACvC,CAAC;QACD,OAAO,WAAW,CAAC,MAAM,CAAC;IAC5B,CAAC;IACD,OAAO,WAAW,CAAC,MAAM,CAAC;AAC5B,CAAC"}

package/dist/sync/fetch-sse-push.d.ts

@@ -0,0 +1,6 @@
+import type { RuntimePushConnector } from './control-plane-client.js';
+export declare class FetchSsePushConnector implements RuntimePushConnector {
+    private readonly fetchImpl;
+    constructor(fetchImpl?: typeof fetch);
+    connect(options: Parameters<RuntimePushConnector['connect']>[0]): Promise<void>;
+}

package/dist/sync/fetch-sse-push.js

@@ -0,0 +1,42 @@
+export class FetchSsePushConnector {
+    fetchImpl;
+    constructor(fetchImpl = fetch) {
+        this.fetchImpl = fetchImpl;
+    }
+    async connect(options) {
+        const response = await this.fetchImpl(options.url, {
+            headers: {
+                accept: 'text/event-stream',
+                ...options.headers,
+            },
+            signal: options.signal,
+        });
+        if (!response.ok || !response.body) {
+            throw new Error(`Runtime push stream failed (${response.status})`);
+        }
+        const reader = response.body.getReader();
+        const decoder = new TextDecoder();
+        let buffer = '';
+        try {
+            while (!options.signal.aborted) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                buffer += decoder.decode(value, { stream: true }).replace(/\r\n/g, '\n');
+                let separator = buffer.indexOf('\n\n');
+                while (separator >= 0) {
+                    const event = buffer.slice(0, separator);
+                    buffer = buffer.slice(separator + 2);
+                    if (event.split('\n').some((line) => line.startsWith('data:'))) {
+                        await options.onEvent();
+                    }
+                    separator = buffer.indexOf('\n\n');
+                }
+            }
+        }
+        finally {
+            reader.releaseLock();
+        }
+    }
+}
+//# sourceMappingURL=fetch-sse-push.js.map

package/dist/sync/fetch-sse-push.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-sse-push.js","sourceRoot":"","sources":["../../src/sync/fetch-sse-push.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,qBAAqB;IACH;IAA7B,YAA6B,YAA0B,KAAK;QAA/B,cAAS,GAAT,SAAS,CAAsB;IAAG,CAAC;IAEhE,KAAK,CAAC,OAAO,CAAC,OAAuD;QACnE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE;YACjD,OAAO,EAAE;gBACP,MAAM,EAAE,mBAAmB;gBAC3B,GAAG,OAAO,CAAC,OAAO;aACnB;YACD,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC/B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,IAAI;oBAAE,MAAM;gBAChB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACzE,IAAI,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACvC,OAAO,SAAS,IAAI,CAAC,EAAE,CAAC;oBACtB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;oBACzC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;oBACrC,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;wBAC/D,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;oBAC1B,CAAC;oBACD,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;CACF"}

package/dist/sync/index.d.ts

@@ -0,0 +1,26 @@
+export { canonicalRuntimeJson, RuntimeRevisionVerifier, RuntimeSyncVerificationError, } from './signature-verifier.js';
+export type { RuntimePublicJwk, RuntimePublicKeyProvider, } from './signature-verifier.js';
+export { FileRuntimeStateStore, MemoryRuntimeStateStore, } from './state-store.js';
+export type { RuntimeStateStore, RuntimeSyncState, } from './state-store.js';
+export { RuntimeSyncManager, } from './sync-manager.js';
+export type { RuntimeSyncApplyResult, } from './sync-manager.js';
+export { RuntimeControlPlaneClient, RuntimeControlPlaneRequestError, } from './control-plane-client.js';
+export type { RuntimePushConnector, } from './control-plane-client.js';
+export { RuntimeSetupClient } from './runtime-setup-client.js';
+export { parseLocalExecutionInventory, type LocalExecutionEvidence, type LocalExecutionInventory, } from './runtime-setup-client.js';
+export type { RouteScanUpload, RuntimeSetupImportResult, } from './runtime-setup-client.js';
+export { AppSetupClient } from './app-setup-client.js';
+export { RuntimeConnectClient } from './runtime-connect-client.js';
+export type { PollForConnectionOptions, RuntimeConnectClientOptions, } from './runtime-connect-client.js';
+export type { AppSetupRun, CreateAppSetupRun, UpdateAppSetupStatus, } from './app-setup-client.js';
+export { FetchSsePushConnector } from './fetch-sse-push.js';
+export { HttpRuntimePublicKeyProvider } from './jwks-provider.js';
+export { selectRuntimeDeployment, stableCohortBucket, } from './deployment-selector.js';
+export { materializeDeploymentRevisions } from './materialize-deployment.js';
+export type { MaterializedDeploymentRevisions } from './materialize-deployment.js';
+export { validateLocalDeploymentBindings, } from './local-deployment-validator.js';
+export type { IgnoredPlatformTool, LocalDeploymentValidation, } from './local-deployment-validator.js';
+export { createManagedRuntimeSync } from './managed-sync.js';
+export { lookupRuntimeConnection, type ResolvedRuntimeConnection, } from './connection-lookup.js';
+export { capabilityReportFrom, DISCOVERY_DIGEST_PATTERN, POLICY_RELAXATIONS_VERSION, uploadCapabilityReport, } from './capability-report.js';
+export type { CapabilityReport, CapabilityReportResult, } from './capability-report.js';

package/dist/sync/index.js

@@ -0,0 +1,17 @@
+export { canonicalRuntimeJson, RuntimeRevisionVerifier, RuntimeSyncVerificationError, } from './signature-verifier.js';
+export { FileRuntimeStateStore, MemoryRuntimeStateStore, } from './state-store.js';
+export { RuntimeSyncManager, } from './sync-manager.js';
+export { RuntimeControlPlaneClient, RuntimeControlPlaneRequestError, } from './control-plane-client.js';
+export { RuntimeSetupClient } from './runtime-setup-client.js';
+export { parseLocalExecutionInventory, } from './runtime-setup-client.js';
+export { AppSetupClient } from './app-setup-client.js';
+export { RuntimeConnectClient } from './runtime-connect-client.js';
+export { FetchSsePushConnector } from './fetch-sse-push.js';
+export { HttpRuntimePublicKeyProvider } from './jwks-provider.js';
+export { selectRuntimeDeployment, stableCohortBucket, } from './deployment-selector.js';
+export { materializeDeploymentRevisions } from './materialize-deployment.js';
+export { validateLocalDeploymentBindings, } from './local-deployment-validator.js';
+export { createManagedRuntimeSync } from './managed-sync.js';
+export { lookupRuntimeConnection, } from './connection-lookup.js';
+export { capabilityReportFrom, DISCOVERY_DIGEST_PATTERN, POLICY_RELAXATIONS_VERSION, uploadCapabilityReport, } from './capability-report.js';
+//# sourceMappingURL=index.js.map

package/dist/sync/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sync/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,yBAAyB,CAAC;AAKjC,OAAO,EACL,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EACL,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EACL,yBAAyB,EACzB,+BAA+B,GAChC,MAAM,2BAA2B,CAAC;AAInC,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EACL,4BAA4B,GAG7B,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAUnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EACL,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAE7E,OAAO,EACL,+BAA+B,GAChC,MAAM,iCAAiC,CAAC;AAKzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EACL,uBAAuB,GAExB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,wBAAwB,CAAC"}

package/dist/sync/jwks-provider.d.ts

@@ -0,0 +1,14 @@
+import type { RuntimePublicJwk, RuntimePublicKeyProvider } from './signature-verifier.js';
+export declare class HttpRuntimePublicKeyProvider implements RuntimePublicKeyProvider {
+    private readonly options;
+    private keys;
+    private expiresAt;
+    constructor(options: {
+        baseUrl: string;
+        apiKey: string;
+        fetchImpl?: typeof fetch;
+        cacheTtlMs?: number;
+    });
+    getKey(keyId: string): Promise<RuntimePublicJwk | null>;
+    private refresh;
+}

package/dist/sync/jwks-provider.js

@@ -0,0 +1,53 @@
+export class HttpRuntimePublicKeyProvider {
+    options;
+    keys = new Map();
+    expiresAt = 0;
+    constructor(options) {
+        this.options = options;
+    }
+    async getKey(keyId) {
+        if (Date.now() >= this.expiresAt)
+            await this.refresh();
+        const cached = this.keys.get(keyId);
+        if (cached)
+            return cached;
+        // A missing key may indicate rotation; refresh once even while the normal
+        // cache is still valid.
+        await this.refresh();
+        return this.keys.get(keyId) ?? null;
+    }
+    async refresh() {
+        const response = await (this.options.fetchImpl ?? fetch)(`${this.options.baseUrl.replace(/\/$/, '')}/v1/runtime-revisions/jwks`, {
+            headers: {
+                authorization: `Bearer ${this.options.apiKey}`,
+            },
+        });
+        if (!response.ok) {
+            throw new Error(`Runtime JWKS request failed (${response.status})`);
+        }
+        const payload = await response.json();
+        if (!Array.isArray(payload.keys)) {
+            throw new Error('Runtime JWKS response is invalid');
+        }
+        const next = new Map();
+        for (const raw of payload.keys) {
+            if (!raw || typeof raw !== 'object') {
+                throw new Error('Runtime JWKS contains an invalid key');
+            }
+            const key = raw;
+            if (key.d) {
+                throw new Error('Runtime JWKS must never contain private key material');
+            }
+            if (key.kty !== 'OKP'
+                || key.crv !== 'Ed25519'
+                || typeof key.x !== 'string'
+                || typeof key.kid !== 'string') {
+                throw new Error('Runtime JWKS key must be public Ed25519');
+            }
+            next.set(key.kid, key);
+        }
+        this.keys = next;
+        this.expiresAt = Date.now() + (this.options.cacheTtlMs ?? 300_000);
+    }
+}
+//# sourceMappingURL=jwks-provider.js.map

package/dist/sync/jwks-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks-provider.js","sourceRoot":"","sources":["../../src/sync/jwks-provider.ts"],"names":[],"mappings":"AAKA,MAAM,OAAO,4BAA4B;IAIV;IAHrB,IAAI,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC3C,SAAS,GAAG,CAAC,CAAC;IAEtB,YAA6B,OAK5B;QAL4B,YAAO,GAAP,OAAO,CAKnC;IAAG,CAAC;IAEL,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,0EAA0E;QAC1E,wBAAwB;QACxB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,CACtD,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,4BAA4B,EACtE;YACE,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;aAC/C;SACF,CACF,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAwB,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAA4B,CAAC;QACjD,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YAC/B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,GAAG,GAAG,GAKX,CAAC;YACF,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC1E,CAAC;YACD,IACE,GAAG,CAAC,GAAG,KAAK,KAAK;mBACd,GAAG,CAAC,GAAG,KAAK,SAAS;mBACrB,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ;mBACzB,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,EAC9B,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,CAAC;IACrE,CAAC;CACF"}

package/dist/sync/local-deployment-validator.d.ts

@@ -0,0 +1,30 @@
+import { type LocalToolBinding } from '../runtime/local-tool-bindings.js';
+import type { MaterializedDeploymentRevisions } from './materialize-deployment.js';
+export interface IgnoredPlatformTool {
+    toolId: string;
+    /**
+     * `platform-tool-not-in-code`: the deployed code has no binding (spec 4.9).
+     * `platform-tool-binding-mismatch`: the code changed the tool after the
+     * Platform last saw it; the local manifest keeps running it.
+     */
+    reason: 'platform-tool-not-in-code' | 'platform-tool-binding-mismatch';
+    /** Names of mismatched technical facts; never values or content. */
+    mismatches?: string[];
+}
+export interface LocalDeploymentValidation {
+    ignored: IgnoredPlatformTool[];
+}
+/**
+ * Accepts a Platform deployment for the deployed code. A Platform tool the
+ * code does not have, or has in a changed form, is ignored and reported
+ * instead of rejecting the whole deployment, so Platform decisions (their
+ * restrictions and pinned D16 relaxations) keep reaching the runtime while the
+ * Platform catches up with the
+ * code. Inconsistent Platform revisions still fail closed. The allowlist is
+ * checked against the reported `toolPolicies`, never against `toolOverrides`
+ * restrictions, so a tool only a Platform decision disables stays allowlisted.
+ */
+export declare function validateLocalDeploymentBindings(options: {
+    revisions: MaterializedDeploymentRevisions;
+    bindings: ReadonlyArray<LocalToolBinding>;
+}): LocalDeploymentValidation;

package/dist/sync/local-deployment-validator.js

@@ -0,0 +1,60 @@
+import { riskTier } from '../contracts/tool-policy.js';
+import { localToolBindingMismatches, } from '../runtime/local-tool-bindings.js';
+/**
+ * Accepts a Platform deployment for the deployed code. A Platform tool the
+ * code does not have, or has in a changed form, is ignored and reported
+ * instead of rejecting the whole deployment, so Platform decisions (their
+ * restrictions and pinned D16 relaxations) keep reaching the runtime while the
+ * Platform catches up with the
+ * code. Inconsistent Platform revisions still fail closed. The allowlist is
+ * checked against the reported `toolPolicies`, never against `toolOverrides`
+ * restrictions, so a tool only a Platform decision disables stays allowlisted.
+ */
+export function validateLocalDeploymentBindings(options) {
+    const bindings = uniqueIndex(options.bindings, (binding) => binding.toolId, 'local tool binding');
+    const manifestTools = uniqueIndex(options.revisions.manifestRevision.tools, (tool) => tool.toolId, 'manifest tool');
+    const policies = uniqueIndex(options.revisions.policyRevision.toolPolicies, (policy) => policy.toolId, 'runtime tool policy');
+    const allowlist = new Set();
+    const ignored = [];
+    for (const toolId of options.revisions.agentRevision.toolAllowlist) {
+        if (allowlist.has(toolId)) {
+            throw new Error(`Duplicate agent tool allowlist entry: ${toolId}`);
+        }
+        allowlist.add(toolId);
+        const manifestTool = manifestTools.get(toolId);
+        if (!manifestTool || !manifestTool.enabled || manifestTool.tombstone) {
+            throw new Error(`Unavailable manifest tool: ${toolId}`);
+        }
+        const policy = policies.get(toolId);
+        if (!policy || !policy.enabled) {
+            throw new Error(`Missing enabled runtime tool policy: ${toolId}`);
+        }
+        // A policy may raise the manifest risk, never lower it.
+        if (riskTier(policy.riskClass) < riskTier(manifestTool.riskClass)) {
+            throw new Error(`Runtime tool policy risk below manifest: ${toolId}`);
+        }
+        const binding = bindings.get(toolId);
+        if (!binding) {
+            ignored.push({ toolId, reason: 'platform-tool-not-in-code' });
+            continue;
+        }
+        const mismatches = localToolBindingMismatches(binding, manifestTool);
+        if (mismatches.length > 0) {
+            ignored.push({ toolId, reason: 'platform-tool-binding-mismatch', mismatches });
+        }
+    }
+    return {
+        ignored: ignored.sort((left, right) => (left.toolId < right.toolId ? -1 : left.toolId > right.toolId ? 1 : 0)),
+    };
+}
+function uniqueIndex(values, key, label) {
+    const indexed = new Map();
+    for (const value of values) {
+        const id = key(value);
+        if (indexed.has(id))
+            throw new Error(`Duplicate ${label}: ${id}`);
+        indexed.set(id, value);
+    }
+    return indexed;
+}
+//# sourceMappingURL=local-deployment-validator.js.map