import { z } from "zod";
export declare const runnerOsSchema: z.ZodEnum<{
    linux: "linux";
    macos: "macos";
    windows: "windows";
}>;
export declare const runnerArchSchema: z.ZodEnum<{
    x64: "x64";
    arm64: "arm64";
}>;
/**
 * The wire revision this package speaks, declared on EVERY authenticated call.
 *
 * Deliberately not the package version. The compatibility floor exists because payloads change in
 * ways an older daemon cannot survive — these are `z.strictObject`s, so a field added to the claim
 * response makes an older runner reject the whole thing — and that is a property of the WIRE, not
 * of release cadence. Gating on the package version made every future bump an implicit lockout
 * decision, and gating on a version captured once at registration made upgrading unable to fix a
 * refusal at all.
 *
 * Bump ONLY when a change would break a runner that speaks the previous revision.
 *   1 — poll/claim declare the contract version; claim carries the full workspace scope.
 */
export declare const RUNNER_CONTRACT_VERSION = 1;
/**
 * What every authenticated pool call declares about the runner making it. Sent on poll AND claim:
 * poll so an incompatible runner is refused before it commits to anything, claim because the claim
 * RESPONSE is the payload an outdated runner actually chokes on.
 *
 * The control plane reads this LIVE. Nothing about a runner's compatibility is remembered between
 * calls, so upgrading a daemon fixes a refusal by itself — which is the whole point.
 */
export declare const runnerDeclarationSchema: z.ZodObject<{
    contract_version: z.ZodNumber;
    runner_version: z.ZodString;
}, z.core.$strict>;
export type RunnerDeclaration = z.infer<typeof runnerDeclarationSchema>;
/**
 * POST /runner/v1/register, authenticated by the short-lived registration token in the body —
 * the token IS the credential (single-purpose: it can register, nothing else) and it is BOUND
 * to a pool at mint, so the request names no pool.
 */
export declare const runnerRegistrationRequestSchema: z.ZodObject<{
    registration_token: z.ZodString;
    name: z.ZodString;
    labels: z.ZodDefault<z.ZodArray<z.ZodString>>;
    os: z.ZodOptional<z.ZodEnum<{
        linux: "linux";
        macos: "macos";
        windows: "windows";
    }>>;
    arch: z.ZodOptional<z.ZodEnum<{
        x64: "x64";
        arm64: "arm64";
    }>>;
    runner_version: z.ZodOptional<z.ZodString>;
}, z.core.$strict>;
export type RunnerRegistrationRequest = z.infer<typeof runnerRegistrationRequestSchema>;
export declare const runnerRegistrationResponseSchema: z.ZodObject<{
    runner_id: z.ZodString;
    pool: z.ZodString;
    runner_token: z.ZodString;
    poll: z.ZodObject<{
        url: z.ZodString;
        interval_seconds: z.ZodNumber;
    }, z.core.$strict>;
}, z.core.$strict>;
export type RunnerRegistrationResponse = z.infer<typeof runnerRegistrationResponseSchema>;
/** The matched `runs_on` selector, echoed so the runner can re-verify it should run this. */
export declare const assignmentRunsOnSchema: z.ZodUnion<readonly [z.ZodObject<{
    kind: z.ZodLiteral<"self-hosted">;
    pool: z.ZodString;
    labels: z.ZodOptional<z.ZodArray<z.ZodString>>;
}, z.core.$strict>, z.ZodString]>;
/**
 * A polled offer is CREDENTIAL-FREE by design: identity + selector only. Committing to it
 * (claim) is what mints credentials; the run's full context (manifest, program, workspace)
 * is fetched after claim through the run-token'd Runner Control API.
 */
export declare const assignmentOfferSchema: z.ZodObject<{
    assignment_id: z.ZodString;
    run_id: z.ZodString;
    org_id: z.ZodString;
    runs_on: z.ZodUnion<readonly [z.ZodObject<{
        kind: z.ZodLiteral<"self-hosted">;
        pool: z.ZodString;
        labels: z.ZodOptional<z.ZodArray<z.ZodString>>;
    }, z.core.$strict>, z.ZodString]>;
    queued_at: z.ZodNumber;
}, z.core.$strict>;
export type AssignmentOffer = z.infer<typeof assignmentOfferSchema>;
/**
 * Long-poll response: at most one offer. `action: "drain"` tells an idle runner to stop
 * claiming (deregistration/update flow) — control signals are always brokered polls, never
 * inbound connections to the runner.
 */
export declare const assignmentPollResponseSchema: z.ZodObject<{
    assignment: z.ZodNullable<z.ZodObject<{
        assignment_id: z.ZodString;
        run_id: z.ZodString;
        org_id: z.ZodString;
        runs_on: z.ZodUnion<readonly [z.ZodObject<{
            kind: z.ZodLiteral<"self-hosted">;
            pool: z.ZodString;
            labels: z.ZodOptional<z.ZodArray<z.ZodString>>;
        }, z.core.$strict>, z.ZodString]>;
        queued_at: z.ZodNumber;
    }, z.core.$strict>>;
    action: z.ZodOptional<z.ZodLiteral<"drain">>;
}, z.core.$strict>;
export type AssignmentPollResponse = z.infer<typeof assignmentPollResponseSchema>;
/**
 * One BYO inference provider, as data: the runtime calls the endpoint directly (managed-lane
 * inference stays brokered; managed providers are never listed). The auth secret resolves by
 * NAME through the control plane with the run token — the value never rides this payload.
 */
export declare const byoInferenceProviderSchema: z.ZodObject<{
    name: z.ZodString;
    source: z.ZodString;
    base_url: z.ZodNullable<z.ZodString>;
    auth_secret_name: z.ZodNullable<z.ZodString>;
}, z.core.$strict>;
export type ByoInferenceProvider = z.infer<typeof byoInferenceProviderSchema>;
/**
 * POST .../assignments/{assignment_id}/claim (runner-token authed; the bearer identifies the
 * runner, the URL the assignment — no body). First claim wins; a loser gets a conflict and
 * polls again. The response is the ONLY payload carrying per-run credentials.
 */
export declare const claimResponseSchema: z.ZodObject<{
    lease_id: z.ZodString;
    run_id: z.ZodString;
    workflow_id: z.ZodString;
    environment_id: z.ZodNullable<z.ZodString>;
    workspace_key: z.ZodNullable<z.ZodString>;
    lease_expires_at: z.ZodNumber;
    control_plane: z.ZodObject<{
        base_url: z.ZodString;
        run_token: z.ZodString;
        api_token: z.ZodString;
    }, z.core.$strict>;
    env: z.ZodRecord<z.ZodString, z.ZodString>;
    byo_providers: z.ZodArray<z.ZodObject<{
        name: z.ZodString;
        source: z.ZodString;
        base_url: z.ZodNullable<z.ZodString>;
        auth_secret_name: z.ZodNullable<z.ZodString>;
    }, z.core.$strict>>;
}, z.core.$strict>;
export type ClaimResponse = z.infer<typeof claimResponseSchema>;
export declare const heartbeatPhaseSchema: z.ZodEnum<{
    preparing: "preparing";
    running: "running";
    finalizing: "finalizing";
}>;
/** The bearer identifies the runner; the body names the held lease. */
export declare const heartbeatRequestSchema: z.ZodObject<{
    lease_id: z.ZodString;
    run_id: z.ZodString;
    phase: z.ZodEnum<{
        preparing: "preparing";
        running: "running";
        finalizing: "finalizing";
    }>;
}, z.core.$strict>;
export type HeartbeatRequest = z.infer<typeof heartbeatRequestSchema>;
/**
 * The heartbeat response is the control channel: cancellation and drain arrive HERE (a
 * brokered poll), never as an inbound connection to the runner.
 */
export declare const heartbeatResponseSchema: z.ZodObject<{
    lease_expires_at: z.ZodNumber;
    action: z.ZodEnum<{
        drain: "drain";
        continue: "continue";
        cancel: "cancel";
    }>;
}, z.core.$strict>;
export type HeartbeatResponse = z.infer<typeof heartbeatResponseSchema>;
/** Thrown when a contract payload fails validation. */
export declare class ContractValidationError extends Error {
    constructor(message: string);
}
/** Parse with a readable multi-issue error (the schemas are strict — unknown fields fail). */
export declare function parseContract<T>(schema: z.ZodType<T>, payload: unknown, what: string): T;