hammerkit 1.22.0 → 1.24.0

package/dist/server/oauth.js

@@ -0,0 +1,226 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenVerifier = exports.quote = exports.TokenError = void 0;
+const crypto_1 = require("crypto");
+// The reason is for the operator's log, never for the caller.
+class TokenError extends Error {
+}
+exports.TokenError = TokenError;
+// Values from a token are written to the operator's log before the signature
+// is checked, so they are quoted and cut: they can't start a log line of their own.
+function quote(value) {
+    return JSON.stringify(String(value).slice(0, 80));
+}
+exports.quote = quote;
+// Asymmetric algorithms only: there is no shared secret, and `none` and HS*
+// are never accepted.
+const ALGORITHMS = {
+    RS256: { hash: 'sha256', kty: 'RSA' },
+    RS384: { hash: 'sha384', kty: 'RSA' },
+    RS512: { hash: 'sha512', kty: 'RSA' },
+    PS256: { hash: 'sha256', kty: 'RSA', pss: true },
+    ES256: { hash: 'sha256', kty: 'EC', crv: 'P-256' },
+    ES384: { hash: 'sha384', kty: 'EC', crv: 'P-384' },
+    ES512: { hash: 'sha512', kty: 'EC', crv: 'P-521' },
+};
+const CLOCK_SKEW_SECONDS = 60;
+const KEYS_TTL_MS = 10 * 60 * 1000;
+// an unknown kid refreshes the keys, but not more often than this
+const REFRESH_COOLDOWN_MS = 60 * 1000;
+const FETCH_TIMEOUT_MS = 5000;
+// after a failed load the issuer is left alone for this long, instead of being hit by every request
+const FAILURE_BACKOFF_MS = 10 * 1000;
+// keys that could not be refreshed are still used for this long past their TTL, so a short IdP outage does not lock everyone out
+const STALE_KEYS_MS = 60 * 60 * 1000;
+class TokenVerifier {
+    constructor(issuers, options = {}) {
+        this.issuers = issuers;
+        this.keys = new Map();
+        this.loading = new Map();
+        this.failures = new Map();
+        const fetcher = options.fetch ?? fetch;
+        this.now = options.now ?? Date.now;
+        this.fetchJson = async (url) => {
+            const response = await fetcher(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+            if (!response.ok) {
+                throw new TokenError(`${url} answered ${response.status}`);
+            }
+            return response.json();
+        };
+    }
+    async verify(token) {
+        const parts = token.split('.');
+        if (parts.length !== 3 || parts.some((part) => part.length === 0)) {
+            throw new TokenError('not a signed JWT');
+        }
+        const header = decodeObject(parts[0], 'header');
+        const payload = decodeObject(parts[1], 'payload');
+        const algorithm = typeof header.alg === 'string' ? ALGORITHMS[header.alg] : undefined;
+        if (!algorithm) {
+            throw new TokenError(`algorithm ${quote(header.alg)} is not accepted`);
+        }
+        const issuer = this.issuers.find((i) => i.issuer === payload.iss);
+        if (!issuer) {
+            throw new TokenError(`issuer ${quote(payload.iss)} is not accepted`);
+        }
+        const jwk = await this.findKey(issuer, algorithm, typeof header.kid === 'string' ? header.kid : undefined);
+        const signature = Buffer.from(parts[2], 'base64url');
+        const data = Buffer.from(`${parts[0]}.${parts[1]}`);
+        const key = (0, crypto_1.createPublicKey)({ key: jwk, format: 'jwk' });
+        if (!verifySignature(algorithm, data, key, signature)) {
+            throw new TokenError('signature does not match');
+        }
+        return this.readClaims(issuer, payload);
+    }
+    readClaims(issuer, payload) {
+        const now = this.now() / 1000;
+        if (typeof payload.exp !== 'number') {
+            throw new TokenError('token has no expiry');
+        }
+        if (payload.exp + CLOCK_SKEW_SECONDS < now) {
+            throw new TokenError('token expired');
+        }
+        if (typeof payload.nbf === 'number' && payload.nbf - CLOCK_SKEW_SECONDS > now) {
+            throw new TokenError('token not valid yet');
+        }
+        const audiences = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
+        if (!audiences.includes(issuer.audience)) {
+            throw new TokenError(`token is not meant for ${issuer.audience}`);
+        }
+        if (typeof payload.sub !== 'string' || payload.sub.length === 0) {
+            throw new TokenError('token has no subject');
+        }
+        const groups = payload[issuer.groupsClaim];
+        const claims = {};
+        for (const [name, value] of Object.entries(payload)) {
+            if (typeof value === 'string') {
+                claims[name] = value;
+            }
+        }
+        return {
+            iss: issuer.issuer,
+            sub: payload.sub,
+            groups: Array.isArray(groups)
+                ? groups.filter((g) => typeof g === 'string')
+                : typeof groups === 'string'
+                    ? [groups]
+                    : [],
+            claims,
+        };
+    }
+    async findKey(issuer, algorithm, kid) {
+        const known = this.keys.get(issuer.issuer);
+        const stale = !known || this.now() - known.loadedAt > KEYS_TTL_MS;
+        let loaded;
+        if (stale) {
+            try {
+                loaded = await this.loadKeys(issuer);
+            }
+            catch (e) {
+                if (!known || this.now() - known.loadedAt > KEYS_TTL_MS + STALE_KEYS_MS) {
+                    throw e;
+                }
+                loaded = known;
+            }
+        }
+        else {
+            loaded = known;
+        }
+        let jwk = pickKey(loaded.keys, algorithm, kid);
+        if (!jwk && !stale && this.now() - loaded.loadedAt > REFRESH_COOLDOWN_MS) {
+            // the issuer may have rotated its keys since they were cached
+            try {
+                loaded = await this.loadKeys(issuer);
+                jwk = pickKey(loaded.keys, algorithm, kid);
+            }
+            catch {
+                // keep the cached keys: the token simply has no key we know
+            }
+        }
+        if (!jwk) {
+            throw new TokenError(`issuer has no ${algorithm.kty} key${kid ? ` ${quote(kid)}` : ''}`);
+        }
+        return jwk;
+    }
+    // One load per issuer at a time, and none right after a failed one.
+    loadKeys(issuer) {
+        const running = this.loading.get(issuer.issuer);
+        if (running) {
+            return running;
+        }
+        const failure = this.failures.get(issuer.issuer);
+        if (failure && this.now() - failure.at < FAILURE_BACKOFF_MS) {
+            return Promise.reject(failure.error);
+        }
+        const load = this.fetchKeys(issuer)
+            .then((loaded) => {
+            this.failures.delete(issuer.issuer);
+            return loaded;
+        })
+            .catch((error) => {
+            this.failures.set(issuer.issuer, { at: this.now(), error });
+            throw error;
+        })
+            .finally(() => this.loading.delete(issuer.issuer));
+        this.loading.set(issuer.issuer, load);
+        return load;
+    }
+    async fetchKeys(issuer) {
+        const base = issuer.issuer.replace(/\/+$/, '');
+        const metadata = (await this.fetchJson(`${base}/.well-known/openid-configuration`));
+        if (metadata.issuer !== issuer.issuer) {
+            throw new TokenError(`issuer metadata names ${quote(metadata.issuer)}`);
+        }
+        const jwksUri = typeof metadata.jwks_uri === 'string' ? metadata.jwks_uri : '';
+        if (!isSecureUrl(jwksUri)) {
+            throw new TokenError(`jwks_uri ${quote(jwksUri)} is not https`);
+        }
+        const jwks = (await this.fetchJson(jwksUri));
+        const loaded = { keys: Array.isArray(jwks.keys) ? jwks.keys : [], loadedAt: this.now() };
+        this.keys.set(issuer.issuer, loaded);
+        return loaded;
+    }
+}
+exports.TokenVerifier = TokenVerifier;
+function pickKey(keys, algorithm, kid) {
+    const candidates = keys.filter((jwk) => jwk.kty === algorithm.kty &&
+        jwk.use !== 'enc' &&
+        (algorithm.crv === undefined || jwk.crv === algorithm.crv));
+    if (kid !== undefined) {
+        return candidates.find((jwk) => jwk.kid === kid);
+    }
+    // a token without kid is only unambiguous when the issuer has one such key
+    return candidates.length === 1 ? candidates[0] : undefined;
+}
+function verifySignature(algorithm, data, key, signature) {
+    if (algorithm.kty === 'EC') {
+        return (0, crypto_1.verify)(algorithm.hash, data, { key, dsaEncoding: 'ieee-p1363' }, signature);
+    }
+    if (algorithm.pss) {
+        return (0, crypto_1.verify)(algorithm.hash, data, { key, padding: crypto_1.constants.RSA_PKCS1_PSS_PADDING, saltLength: crypto_1.constants.RSA_PSS_SALTLEN_DIGEST }, signature);
+    }
+    return (0, crypto_1.verify)(algorithm.hash, data, key, signature);
+}
+function decodeObject(part, what) {
+    try {
+        const value = JSON.parse(Buffer.from(part, 'base64url').toString('utf8'));
+        if (value && typeof value === 'object' && !Array.isArray(value)) {
+            return value;
+        }
+    }
+    catch {
+        // reported below
+    }
+    throw new TokenError(`token ${what} is not a JSON object`);
+}
+function isSecureUrl(value) {
+    try {
+        const url = new URL(value);
+        return (url.protocol === 'https:' ||
+            (url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname)));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=oauth.js.map

package/dist/server/policy.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getGrant = exports.isAdmin = exports.maySeeDefinitions = exports.mayPropose = exports.mayPublish = exports.matches = void 0;
+function matches(entitlement, principal) {
+    if (entitlement.subject) {
+        return entitlement.subject.iss === principal.iss && entitlement.subject.sub === principal.sub;
+    }
+    if (entitlement.group) {
+        return entitlement.group.iss === principal.iss && principal.groups.includes(entitlement.group.name);
+    }
+    if (entitlement.claims) {
+        return (entitlement.claims.iss === principal.iss &&
+            Object.entries(entitlement.claims.match).every(([name, value]) => principal.claims[name] === value));
+    }
+    return false;
+}
+exports.matches = matches;
+function mayPublish(grant, name) {
+    return grant.publish.includes('*') || grant.publish.includes(name);
+}
+exports.mayPublish = mayPublish;
+function mayPropose(grant, name) {
+    return grant.propose.includes('*') || grant.propose.includes(name);
+}
+exports.mayPropose = mayPropose;
+// A caller who can neither run nor publish anything sees nothing of the server's
+// build files either. Admins see them, they have to know what they approve.
+function maySeeDefinitions(grant) {
+    return grant.accounts.length > 0 || grant.request.length > 0 || grant.publish.length > 0 || grant.propose.length > 0;
+}
+exports.maySeeDefinitions = maySeeDefinitions;
+// Admin of an account decides about the runs on it.
+function isAdmin(grant, account) {
+    return account !== null && grant.accounts.includes(account);
+}
+exports.isAdmin = isAdmin;
+// Default deny: a caller without a matching entitlement gets no account.
+function getGrant(entitlements, principal) {
+    const matched = [];
+    const accounts = [];
+    const requested = [];
+    const publish = [];
+    const propose = [];
+    let defaultAccount = null;
+    let source = null;
+    entitlements.forEach((entitlement, index) => {
+        if (!matches(entitlement, principal)) {
+            return;
+        }
+        matched.push(index);
+        for (const account of entitlement.accounts) {
+            if (!accounts.includes(account)) {
+                accounts.push(account);
+            }
+        }
+        for (const account of entitlement.request ?? []) {
+            if (!requested.includes(account)) {
+                requested.push(account);
+            }
+        }
+        for (const name of entitlement.publish ?? []) {
+            if (!publish.includes(name)) {
+                publish.push(name);
+            }
+        }
+        for (const name of entitlement.propose ?? []) {
+            if (!propose.includes(name)) {
+                propose.push(name);
+            }
+        }
+        defaultAccount = defaultAccount ?? entitlement.default ?? null;
+        if (entitlement.source) {
+            source = source ? source.filter((s) => entitlement.source?.includes(s)) : [...entitlement.source];
+        }
+    });
+    // admin wins over request when two entitlements give both
+    const request = requested.filter((account) => !accounts.includes(account));
+    const usable = [...accounts, ...request];
+    return {
+        accounts,
+        request,
+        publish,
+        propose,
+        default: defaultAccount ?? (usable.length === 1 ? usable[0] : null),
+        source: source ?? ['upload', 'ref'],
+        matched,
+    };
+}
+exports.getGrant = getGrant;
+//# sourceMappingURL=policy.js.map

package/dist/server/proposals-api.js

@@ -0,0 +1,123 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleProposals = void 0;
+const zod_1 = require("zod");
+const bundle_1 = require("../remote/bundle");
+const definitions_1 = require("./definitions");
+const http_1 = require("./http");
+const oauth_1 = require("./oauth");
+const policy_1 = require("./policy");
+const server_config_1 = require("./server-config");
+const decisionSchema = zod_1.z.object({ reason: zod_1.z.string().max(500).optional() }).strict();
+const same = (a, b) => a.iss === b.iss && a.sub === b.sub;
+// What the caller is shown of a proposal: what it is, who proposed it and the
+// version it would replace, so the files can be compared.
+function toView(store, proposal, principal, grant) {
+    return {
+        ...proposal,
+        base: store.find(proposal.name, 'latest')?.hash ?? null,
+        mine: same(proposal.proposedBy, principal),
+        // approving needs the permission to publish the name, and somebody else's proposal
+        canDecide: proposal.state === 'waiting' && (0, policy_1.mayPublish)(grant, proposal.name) && !same(proposal.proposedBy, principal),
+    };
+}
+/**
+ * New versions of build files that wait for an approval. Whoever may only
+ * propose a version (`propose` on an entitlement) puts one here; someone who may
+ * `publish` that name approves it, and it is published then.
+ *
+ *   GET  /v1/proposals                          the ones the caller proposed or may decide
+ *   GET  /v1/proposals/<name>/<hash>            one of them
+ *   GET  /v1/proposals/<name>/<hash>/files      its files, for who decides
+ *   POST /v1/proposals/<name>/<hash>/approve    publish it (body: optional {reason})
+ *   POST /v1/proposals/<name>/<hash>/reject     drop it
+ */
+async function handleProposals(config, store, proposals, log, principal, req, res, url) {
+    const match = /^\/v1\/proposals(?:\/([^/]+)\/([^/]+)(?:\/(files|approve|reject))?)?$/.exec(url.pathname);
+    if (!match) {
+        return false;
+    }
+    const [, name, hash, action] = match;
+    const grant = (0, policy_1.getGrant)(config.entitlements, principal);
+    // what the caller neither proposed nor may decide does not exist for them
+    const visible = (proposal) => same(proposal.proposedBy, principal) || (0, policy_1.mayPublish)(grant, proposal.name);
+    if (name === undefined) {
+        if (req.method !== 'GET') {
+            (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: 'GET' });
+            return true;
+        }
+        (0, http_1.send)(res, 200, {
+            proposals: proposals
+                .all()
+                .filter(visible)
+                .map((proposal) => toView(store, proposal, principal, grant)),
+        });
+        return true;
+    }
+    if (!server_config_1.definitionName.safeParse(name).success || !bundle_1.HASH_PATTERN.test(hash)) {
+        (0, http_1.send)(res, 404, { error: 'not found' });
+        return true;
+    }
+    const proposal = proposals.get(name, hash);
+    if (!action) {
+        if (req.method !== 'GET') {
+            (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: 'GET' });
+            return true;
+        }
+        proposal && visible(proposal)
+            ? (0, http_1.send)(res, 200, toView(store, proposal, principal, grant))
+            : (0, http_1.send)(res, 404, { error: 'not found' });
+        return true;
+    }
+    if (action === 'files') {
+        if (req.method !== 'GET') {
+            (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: 'GET' });
+            return true;
+        }
+        // the files are for who decides, and for who wrote them
+        const bundle = proposal && visible(proposal) ? proposals.bundle(name, hash) : undefined;
+        bundle ? (0, http_1.send)(res, 200, bundle) : (0, http_1.send)(res, 404, { error: 'not found' });
+        return true;
+    }
+    if (req.method !== 'POST') {
+        (0, http_1.send)(res, 405, { error: 'method not allowed' }, { allow: 'POST' });
+        return true;
+    }
+    const body = decisionSchema.safeParse(req.headers['content-type'] ? await (0, http_1.readJson)(req) : {});
+    if (!body.success) {
+        const issue = body.error.issues[0];
+        (0, http_1.send)(res, 400, { error: `${issue.path.join('.') || 'request'}: ${issue.message}` });
+        return true;
+    }
+    const outcome = action === 'approve' ? 'approved' : 'rejected';
+    try {
+        const result = await proposals.decide(principal, name, hash, outcome, (n) => (0, policy_1.mayPublish)(grant, n), async (bundle) => {
+            const proposed = proposals.get(name, hash);
+            await store.publish(name, bundle, proposed?.proposedBy ?? principal, principal);
+        }, body.data.reason);
+        log(`${action} proposal=${name}@${hash} iss=${principal.iss} sub=${principal.sub} result=${result.status}${body.data.reason ? ` reason=${(0, oauth_1.quote)(body.data.reason)}` : ''}`);
+        switch (result.status) {
+            case 'ok':
+                (0, http_1.send)(res, 200, toView(store, result.proposal, principal, grant));
+                break;
+            case 'own-proposal':
+                (0, http_1.send)(res, 403, { error: 'a version is approved by somebody else than who proposed it' });
+                break;
+            case 'not-waiting':
+                (0, http_1.send)(res, 409, { error: `the proposal is ${result.state}, it does not wait for an approval` });
+                break;
+            default:
+                (0, http_1.send)(res, 404, { error: 'not found' });
+        }
+    }
+    catch (e) {
+        if (e instanceof definitions_1.DefinitionError) {
+            (0, http_1.send)(res, 400, { error: `the build file does not load: ${e.message}` });
+            return true;
+        }
+        throw e;
+    }
+    return true;
+}
+exports.handleProposals = handleProposals;
+//# sourceMappingURL=proposals-api.js.map

package/dist/server/proposals.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProposalRegistry = exports.ProposalError = void 0;
+class ProposalError extends Error {
+}
+exports.ProposalError = ProposalError;
+// The proposals of the server, in memory: a restart forgets what waits, and
+// whoever proposed it proposes it again. Nothing in here is runnable.
+class ProposalRegistry {
+    constructor(options = {}) {
+        this.entries = new Map();
+        this.closed = false;
+        this.maxWaiting = options.maxWaiting ?? 100;
+        this.timeout = options.timeout ?? 60 * 60 * 1000;
+        this.keep = options.keep ?? 100;
+        this.now = options.now ?? Date.now;
+    }
+    // Proposing what already waits is not an error and changes nothing.
+    propose(version, bundle, proposer) {
+        if (this.closed) {
+            throw new ProposalError('the server is shutting down');
+        }
+        const key = this.key(version.name, version.hash);
+        const existing = this.entries.get(key);
+        if (existing && existing.proposal.state === 'waiting') {
+            return { proposal: { ...existing.proposal }, created: false };
+        }
+        if (this.waiting().length >= this.maxWaiting) {
+            throw new ProposalError('too many build file versions are waiting for an approval');
+        }
+        const proposal = {
+            name: version.name,
+            hash: version.hash,
+            entry: version.entry,
+            tasks: version.tasks,
+            services: version.services,
+            proposedBy: { iss: proposer.iss, sub: proposer.sub },
+            createdAt: new Date(this.now()).toISOString(),
+            expiresAt: new Date(this.now() + this.timeout).toISOString(),
+            state: 'waiting',
+        };
+        const entry = { proposal, bundle };
+        entry.timer = setTimeout(() => this.settle(entry, 'expired'), this.timeout);
+        entry.timer.unref();
+        this.entries.delete(key);
+        this.entries.set(key, entry);
+        this.evict();
+        return { proposal: { ...proposal }, created: true };
+    }
+    waiting() {
+        return [...this.entries.values()].filter((e) => e.proposal.state === 'waiting').map((e) => ({ ...e.proposal }));
+    }
+    // Everything kept, newest first.
+    all() {
+        return [...this.entries.values()].map((e) => ({ ...e.proposal })).reverse();
+    }
+    get(name, hash) {
+        const entry = this.entries.get(this.key(name, hash));
+        return entry ? { ...entry.proposal } : undefined;
+    }
+    // The files of one that still waits, for whoever decides on it.
+    bundle(name, hash) {
+        return this.entries.get(this.key(name, hash))?.bundle;
+    }
+    // An approval publishes the files first (`publish`), and only then is the
+    // proposal approved, so it never claims a version that is not there. Nobody
+    // decides on their own proposal.
+    async decide(decider, name, hash, outcome, mayDecide, publish, reason) {
+        const entry = this.entries.get(this.key(name, hash));
+        if (!entry || !mayDecide(name)) {
+            return { status: 'not-found' };
+        }
+        if (entry.proposal.proposedBy.iss === decider.iss && entry.proposal.proposedBy.sub === decider.sub) {
+            return { status: 'own-proposal' };
+        }
+        if (entry.proposal.state !== 'waiting' || !entry.bundle) {
+            return { status: 'not-waiting', state: entry.proposal.state };
+        }
+        if (outcome === 'approved') {
+            await publish(entry.bundle);
+            if (entry.proposal.state !== 'waiting') {
+                return { status: 'not-waiting', state: entry.proposal.state };
+            }
+        }
+        this.settle(entry, outcome, { iss: decider.iss, sub: decider.sub }, reason);
+        return { status: 'ok', proposal: { ...entry.proposal } };
+    }
+    close() {
+        this.closed = true;
+        for (const entry of this.entries.values()) {
+            if (entry.timer) {
+                clearTimeout(entry.timer);
+                entry.timer = undefined;
+            }
+        }
+    }
+    settle(entry, state, by, reason) {
+        if (entry.proposal.state !== 'waiting') {
+            return;
+        }
+        if (entry.timer) {
+            clearTimeout(entry.timer);
+            entry.timer = undefined;
+        }
+        entry.proposal.state = state;
+        entry.proposal.decidedAt = new Date(this.now()).toISOString();
+        if (by) {
+            entry.proposal.decidedBy = by;
+        }
+        if (reason) {
+            entry.proposal.reason = reason;
+        }
+        entry.bundle = undefined;
+    }
+    evict() {
+        const decided = [...this.entries.entries()].filter(([, e]) => e.proposal.state !== 'waiting');
+        for (const [key] of decided.slice(0, Math.max(0, decided.length - this.keep))) {
+            this.entries.delete(key);
+        }
+    }
+    key(name, hash) {
+        return `${name}@${hash}`;
+    }
+}
+exports.ProposalRegistry = ProposalRegistry;
+//# sourceMappingURL=proposals.js.map

package/dist/server/run-request.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runRequestSchema = exports.runOptionsSchema = void 0;
+const zod_1 = require("zod");
+const units_1 = require("../utils/units");
+const bundle_1 = require("../remote/bundle");
+const server_config_1 = require("./server-config");
+const name = zod_1.z.string().min(1).max(200);
+// What `POST /v1/runs` takes. Who is asking, which accounts they may use and
+// where code may come from is decided from the token, never from this body.
+const duration = zod_1.z.string().refine((value) => {
+    try {
+        (0, units_1.parseDuration)(value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}, 'expected a duration like 30s, 5m or 1h30m');
+// The settings of `hammerkit run` that make sense for a run on a server. What
+// the server limits itself (workers, resources) and what only a terminal
+// needs (watch, log mode) are left out.
+exports.runOptionsSchema = zod_1.z
+    .object({
+    // as --env
+    env: name.optional(),
+    // as --filter and --exclude: labels
+    filter: zod_1.z.array(name).max(20).optional(),
+    exclude: zod_1.z.array(name).max(20).optional(),
+    // as --cache
+    cache: zod_1.z.enum(['checksum', 'modify-date', 'none']).optional(),
+    // as --cache-read-only
+    cacheReadOnly: zod_1.z.boolean().optional(),
+    // as --timeout
+    timeout: duration.optional(),
+    // as --no-skip-deps when false
+    skipDeps: zod_1.z.boolean().optional(),
+})
+    .strict();
+exports.runRequestSchema = zod_1.z
+    .object({
+    // the published build file to run, and the version of it: a hash, or the
+    // latest when left out. The server answers with the hash it chose.
+    definition: zod_1.z
+        .object({
+        name: server_config_1.definitionName,
+        hash: zod_1.z.union([zod_1.z.literal('latest'), zod_1.z.string().regex(bundle_1.HASH_PATTERN)]).default('latest'),
+    })
+        .strict(),
+    // tasks by their name in the build file, as on the command line; labels in
+    // the options can select tasks instead
+    tasks: zod_1.z.array(name).max(100).default([]),
+    // the service account to use; the caller's default when left out
+    account: name.optional(),
+    source: zod_1.z.discriminatedUnion('type', [
+        zod_1.z.object({ type: zod_1.z.literal('ref'), ref: name }).strict(),
+        // the name of a tree announced with POST /v1/sources
+        zod_1.z.object({ type: zod_1.z.literal('upload'), snapshot: zod_1.z.string().regex(bundle_1.HASH_PATTERN) }).strict(),
+    ]),
+    options: exports.runOptionsSchema.default({}),
+})
+    .strict()
+    .refine((request) => request.tasks.length > 0 || (request.options.filter ?? []).length > 0, {
+    message: 'name at least one task, or filter by labels',
+    path: ['tasks'],
+});
+//# sourceMappingURL=run-request.js.map