spawnfile 0.1.12 → 0.1.14

package/dist/manifest/teamNetworkServerSchemas.d.ts

@@ -0,0 +1,150 @@
+import { z } from "zod";
+export declare const teamNetworkStoreSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    path: z.ZodOptional<z.ZodString>;
+    persistence: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodEnum<{
+            durable: "durable";
+            ephemeral: "ephemeral";
+        }>;
+        mount: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    kind: z.ZodLiteral<"sqlite">;
+}, z.core.$strict>, z.ZodObject<{
+    path: z.ZodOptional<z.ZodString>;
+    persistence: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodEnum<{
+            durable: "durable";
+            ephemeral: "ephemeral";
+        }>;
+        mount: z.ZodOptional<z.ZodString>;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    kind: z.ZodLiteral<"json">;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"postgres">;
+    dsn_secret: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"memory">;
+}, z.core.$strict>], "kind">;
+export declare const teamNetworkServerSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    allowed_origins: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    auth: z.ZodObject<{
+        agent_registration: z.ZodOptional<z.ZodEnum<{
+            token: "token";
+            disabled: "disabled";
+            open: "open";
+        }>>;
+        client: z.ZodOptional<z.ZodObject<{
+            static_token: z.ZodOptional<z.ZodBoolean>;
+            token_env: z.ZodOptional<z.ZodString>;
+            token_id: z.ZodOptional<z.ZodString>;
+            token_path: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        mode: z.ZodEnum<{
+            none: "none";
+            bearer: "bearer";
+            open: "open";
+        }>;
+        public_read: z.ZodOptional<z.ZodBoolean>;
+        tokens: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            agents: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            id: z.ZodString;
+            secret: z.ZodString;
+            scopes: z.ZodArray<z.ZodEnum<{
+                observe: "observe";
+                write: "write";
+                admin: "admin";
+                attach: "attach";
+                pair: "pair";
+            }>>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>;
+    console: z.ZodOptional<z.ZodObject<{
+        analytics: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            provider: z.ZodLiteral<"google">;
+            measurement_id: z.ZodString;
+        }, z.core.$strict>], "provider">>;
+    }, z.core.$strict>>;
+    debug_events: z.ZodOptional<z.ZodBoolean>;
+    direct_messages: z.ZodOptional<z.ZodBoolean>;
+    human_ingress: z.ZodOptional<z.ZodBoolean>;
+    listen: z.ZodObject<{
+        bind: z.ZodString;
+        port: z.ZodNumber;
+    }, z.core.$strict>;
+    mode: z.ZodLiteral<"managed">;
+    pairings: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        remote_base_url: z.ZodString;
+        remote_network_id: z.ZodString;
+        remote_network_name: z.ZodString;
+        token_secret: z.ZodString;
+    }, z.core.$strict>>>;
+    store: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        path: z.ZodOptional<z.ZodString>;
+        persistence: z.ZodOptional<z.ZodObject<{
+            mode: z.ZodEnum<{
+                durable: "durable";
+                ephemeral: "ephemeral";
+            }>;
+            mount: z.ZodOptional<z.ZodString>;
+            name: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        kind: z.ZodLiteral<"sqlite">;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodOptional<z.ZodString>;
+        persistence: z.ZodOptional<z.ZodObject<{
+            mode: z.ZodEnum<{
+                durable: "durable";
+                ephemeral: "ephemeral";
+            }>;
+            mount: z.ZodOptional<z.ZodString>;
+            name: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        kind: z.ZodLiteral<"json">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"postgres">;
+        dsn_secret: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"memory">;
+    }, z.core.$strict>], "kind">;
+    trust_forwarded_proto: z.ZodOptional<z.ZodBoolean>;
+    url: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    auth: z.ZodObject<{
+        agent_registration: z.ZodOptional<z.ZodEnum<{
+            token: "token";
+            disabled: "disabled";
+            open: "open";
+        }>>;
+        client: z.ZodOptional<z.ZodObject<{
+            static_token: z.ZodOptional<z.ZodBoolean>;
+            token_env: z.ZodOptional<z.ZodString>;
+            token_id: z.ZodOptional<z.ZodString>;
+            token_path: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+        mode: z.ZodEnum<{
+            none: "none";
+            bearer: "bearer";
+            open: "open";
+        }>;
+        public_read: z.ZodOptional<z.ZodBoolean>;
+        tokens: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            agents: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            id: z.ZodString;
+            secret: z.ZodString;
+            scopes: z.ZodArray<z.ZodEnum<{
+                observe: "observe";
+                write: "write";
+                admin: "admin";
+                attach: "attach";
+                pair: "pair";
+            }>>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>;
+    mode: z.ZodLiteral<"external">;
+    url: z.ZodString;
+}, z.core.$strict>], "mode">;
+export type TeamNetworkServer = z.infer<typeof teamNetworkServerSchema>;
+export type TeamNetworkStore = z.infer<typeof teamNetworkStoreSchema>;

package/dist/manifest/teamNetworkServerSchemas.js

@@ -0,0 +1,199 @@
+import { z } from "zod";
+import { teamNetworkConsoleSchema } from "./teamNetworkConsoleSchemas.js";
+import { countTruthy, isTopologyOperatorToken, teamNetworkAuthSchema } from "./teamNetworkAuthSchemas.js";
+const absolutePosixPathSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .refine((value) => value.startsWith("/"), {
+    message: "path must be an absolute POSIX path"
+});
+const normalizePosixPath = (value) => value.replace(/\/+/g, "/").replace(/\/+$/u, "") || "/";
+const pathIsInsideMount = (filePath, mountPath) => {
+    const normalizedPath = normalizePosixPath(filePath);
+    const normalizedMount = normalizePosixPath(mountPath);
+    return normalizedPath.startsWith(`${normalizedMount}/`);
+};
+const teamNetworkStorePersistenceSchema = z
+    .object({
+    mode: z.enum(["durable", "ephemeral"]),
+    mount: absolutePosixPathSchema.optional(),
+    name: z.string().trim().min(1).optional()
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.mode === "ephemeral" && (value.mount || value.name)) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "ephemeral persistence must not declare mount or name"
+        });
+    }
+});
+const teamNetworkFileStoreSchema = z
+    .object({
+    path: absolutePosixPathSchema.optional(),
+    persistence: teamNetworkStorePersistenceSchema.optional()
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.path && value.persistence?.mount && !pathIsInsideMount(value.path, value.persistence.mount)) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "store.path must be inside persistence.mount"
+        });
+    }
+});
+const teamNetworkStoreSqliteSchema = teamNetworkFileStoreSchema.extend({ kind: z.literal("sqlite") });
+const teamNetworkStoreJsonSchema = teamNetworkFileStoreSchema.extend({ kind: z.literal("json") });
+const teamNetworkStorePostgresSchema = z
+    .object({ kind: z.literal("postgres"), dsn_secret: z.string().trim().min(1) })
+    .strict();
+const teamNetworkStoreMemorySchema = z.object({ kind: z.literal("memory") }).strict();
+export const teamNetworkStoreSchema = z.discriminatedUnion("kind", [
+    teamNetworkStoreSqliteSchema,
+    teamNetworkStoreJsonSchema,
+    teamNetworkStorePostgresSchema,
+    teamNetworkStoreMemorySchema
+]);
+const teamNetworkListenSchema = z
+    .object({
+    bind: z.string().trim().min(1).superRefine((value, context) => {
+        if (value.startsWith("[") || value.endsWith("]") || /\[.*\]/.test(value)) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "listen.bind must be unbracketed"
+            });
+        }
+    }),
+    port: z.number().int().min(1).max(65535)
+})
+    .strict();
+const teamNetworkPairingSchema = z
+    .object({
+    id: z.string().trim().min(1),
+    remote_base_url: z.string().trim().min(1),
+    remote_network_id: z.string().trim().min(1),
+    remote_network_name: z.string().trim().min(1),
+    token_secret: z.string().trim().min(1)
+})
+    .strict();
+const teamNetworkManagedServerSchema = z
+    .object({
+    allowed_origins: z.array(z.string().trim().min(1)).optional(),
+    auth: teamNetworkAuthSchema,
+    console: teamNetworkConsoleSchema.optional(),
+    debug_events: z.boolean().optional(),
+    direct_messages: z.boolean().optional(),
+    human_ingress: z.boolean().optional(),
+    listen: teamNetworkListenSchema,
+    mode: z.literal("managed"),
+    pairings: z.array(teamNetworkPairingSchema).optional(),
+    store: teamNetworkStoreSchema,
+    trust_forwarded_proto: z.boolean().optional(),
+    url: z.string().trim().optional()
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.auth.mode === "bearer") {
+        if (!value.auth.tokens || value.auth.tokens.length === 0) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "managed server with auth.mode bearer requires at least one auth token"
+            });
+        }
+        if (value.auth.client && !value.auth.client.token_id) {
+            context.addIssue({ code: z.ZodIssueCode.custom, message: "managed bearer auth requires auth.client.token_id" });
+        }
+        if (value.auth.client && (value.auth.client.token_env || value.auth.client.token_path)) {
+            context.addIssue({ code: z.ZodIssueCode.custom, message: "managed bearer auth requires auth.client.token_id" });
+        }
+        if (value.auth.client?.token_id && value.auth.tokens) {
+            const tokenById = new Map(value.auth.tokens.map((token) => [token.id, token]));
+            const selected = tokenById.get(value.auth.client.token_id);
+            if (!selected) {
+                context.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    message: `managed bearer auth references unknown token: ${value.auth.client.token_id}`
+                });
+            }
+            else if ((!selected.scopes.includes("write") ||
+                !(selected.scopes.includes("attach") || selected.scopes.includes("observe"))) &&
+                !isTopologyOperatorToken(selected)) {
+                context.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    message: "managed bearer auth.client.token_id must reference a write token with attach or observe scope"
+                });
+            }
+        }
+    }
+    if (value.auth.mode === "open" && value.auth.client) {
+        if (!value.auth.client.token_id) {
+            context.addIssue({ code: z.ZodIssueCode.custom, message: "managed open auth requires auth.client.token_id" });
+        }
+        if (value.auth.client.token_env || value.auth.client.token_path) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "managed open auth client token source must be token_id"
+            });
+        }
+        if (value.auth.client.token_id && !value.auth.tokens?.some((token) => token.id === value.auth.client?.token_id)) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: `managed open auth references unknown token: ${value.auth.client.token_id}`
+            });
+        }
+    }
+});
+const teamNetworkExternalServerSchema = z
+    .object({
+    auth: teamNetworkAuthSchema,
+    mode: z.literal("external"),
+    url: z.string().trim().min(1)
+})
+    .strict()
+    .superRefine((value, context) => {
+    if (value.auth.tokens && value.auth.tokens.length > 0) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: "external server does not accept auth.tokens" });
+    }
+    if (value.auth.mode === "none" && value.auth.client) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: "auth.mode none must not declare client" });
+    }
+    if (!value.auth.client)
+        return;
+    if (value.auth.client.token_id) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "auth.client.token_id is only valid for managed servers"
+        });
+    }
+    if (value.auth.mode === "open" && value.auth.client.static_token !== true) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "open auth with auth.client requires static_token: true"
+        });
+    }
+    if (value.auth.mode === "open" &&
+        countTruthy([value.auth.client.token_env, value.auth.client.token_path]) !== 1) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "external open auth requires token_env or token_path"
+        });
+    }
+    if (value.auth.mode === "bearer" && value.auth.client) {
+        const sourceCount = countTruthy([
+            value.auth.client.token_id,
+            value.auth.client.token_env,
+            value.auth.client.token_path
+        ]);
+        if (sourceCount !== 1 || !value.auth.client.token_env && !value.auth.client.token_path) {
+            context.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: "external bearer auth requires exactly one external token source"
+            });
+        }
+    }
+});
+export const teamNetworkServerSchema = z.discriminatedUnion("mode", [
+    teamNetworkManagedServerSchema,
+    teamNetworkExternalServerSchema
+]);

package/dist/ownership/siblingBuildFreshness.d.ts

@@ -0,0 +1,20 @@
+export type SiblingFileFact = {
+    path: string;
+    mtimeMs: number;
+};
+export type SiblingBuildFacts = {
+    packageName: string;
+    packageDirectory: string;
+    hasSourceDirectory: boolean;
+    sourceFiles: SiblingFileFact[];
+    outputFiles: SiblingFileFact[];
+};
+export type SiblingBuildFreshness = {
+    packageName: string;
+    linked: boolean;
+    sourcesScanned: number;
+    outputsScanned: number;
+    ok: boolean;
+    message?: string;
+};
+export declare function checkSiblingBuildFreshness(facts: SiblingBuildFacts): SiblingBuildFreshness;

package/dist/ownership/siblingBuildFreshness.js

@@ -0,0 +1,20 @@
+const excludedSource = /(?:\.test\.ts|\.test-helper\.ts|\.d\.ts)$/u;
+export function checkSiblingBuildFreshness(facts) {
+    if (!facts.hasSourceDirectory)
+        return { packageName: facts.packageName, linked: false, sourcesScanned: 0, outputsScanned: 0, ok: true };
+    const sourceFiles = facts.sourceFiles.filter(({ path }) => !excludedSource.test(path));
+    const outputFiles = facts.outputFiles.filter(({ path }) => path.endsWith(".js"));
+    const command = `run "npm run build" in ${facts.packageDirectory}`;
+    if (sourceFiles.length === 0)
+        return failure(facts.packageName, sourceFiles.length, outputFiles.length, `linked package ${facts.packageName} scanned zero source files; ${command}`);
+    if (outputFiles.length === 0)
+        return failure(facts.packageName, sourceFiles.length, outputFiles.length, `linked package ${facts.packageName} has no emitted JavaScript; ${command}`);
+    const newestSource = sourceFiles.reduce((newest, file) => file.mtimeMs > newest.mtimeMs ? file : newest);
+    const oldestOutput = outputFiles.reduce((oldest, file) => file.mtimeMs < oldest.mtimeMs ? file : oldest);
+    if (newestSource.mtimeMs > oldestOutput.mtimeMs)
+        return failure(facts.packageName, sourceFiles.length, outputFiles.length, `linked package ${facts.packageName} is stale: newest source ${newestSource.path} (${newestSource.mtimeMs}) is newer than oldest output ${oldestOutput.path} (${oldestOutput.mtimeMs}); ${command}`);
+    return { packageName: facts.packageName, linked: true, sourcesScanned: sourceFiles.length, outputsScanned: outputFiles.length, ok: true };
+}
+function failure(packageName, sourcesScanned, outputsScanned, message) {
+    return { packageName, linked: true, sourcesScanned, outputsScanned, ok: false, message };
+}

package/dist/ownership/simfileRunOperatorInputs.d.ts

@@ -0,0 +1,103 @@
+import { z } from "zod";
+import { type SelectedTargetReceipt } from "../target/contracts.js";
+export declare const SIMFILE_RUN_OPERATOR_INPUT_VERSION: "spawnfile.simfile-run-operator-input.v1";
+export declare const SIMFILE_RUN_OPERATOR_RESOLUTION_VERSION: "spawnfile.simfile-run-operator-resolution.v1";
+export declare const SIMFILE_RUN_OPERATOR_RECEIPT_VERSION: "spawnfile.simfile-run-operator-receipt.v1";
+export declare const simfileRunOperatorInputSchema: z.ZodObject<{
+    auth_profile: z.ZodString;
+    moltnet_release: z.ZodObject<{
+        directory_transport: z.ZodLiteral<"operator-path">;
+        required_capability: z.ZodLiteral<"pi-bridge">;
+        stamp_version: z.ZodLiteral<"spawnfile.moltnet-release-stamp.v1">;
+    }, z.core.$strict>;
+    run_id: z.ZodString;
+    run_root: z.ZodString;
+    target_config_transport: z.ZodLiteral<"stdin">;
+    target_selector: z.ZodString;
+    version: z.ZodLiteral<"spawnfile.simfile-run-operator-input.v1">;
+}, z.core.$strict>;
+export declare const simfileRunMoltnetIdentitySchema: z.ZodObject<{
+    architecture: z.ZodEnum<{
+        amd64: "amd64";
+        arm64: "arm64";
+    }>;
+    asset: z.ZodString;
+    asset_sha256: z.ZodString;
+    capabilities: z.ZodTuple<[z.ZodLiteral<"pi-bridge">], null>;
+    release_version: z.ZodString;
+    source_revision: z.ZodString;
+    version: z.ZodLiteral<"spawnfile.moltnet-release-identity.v1">;
+}, z.core.$strict>;
+export declare const simfileRunOperatorResolutionSchema: z.ZodObject<{
+    auth_profile: z.ZodString;
+    moltnet_release: z.ZodObject<{
+        architecture: z.ZodEnum<{
+            amd64: "amd64";
+            arm64: "arm64";
+        }>;
+        asset: z.ZodString;
+        asset_sha256: z.ZodString;
+        capabilities: z.ZodTuple<[z.ZodLiteral<"pi-bridge">], null>;
+        release_version: z.ZodString;
+        source_revision: z.ZodString;
+        version: z.ZodLiteral<"spawnfile.moltnet-release-identity.v1">;
+    }, z.core.$strict>;
+    request_digest: z.ZodString;
+    roots: z.ZodObject<{
+        cache: z.ZodString;
+        evidence: z.ZodString;
+        journal: z.ZodString;
+        output: z.ZodString;
+    }, z.core.$strict>;
+    roots_digest: z.ZodString;
+    run_id: z.ZodString;
+    target_selector: z.ZodString;
+    version: z.ZodLiteral<"spawnfile.simfile-run-operator-resolution.v1">;
+}, z.core.$strict>;
+export declare const simfileRunOperatorReceiptSchema: z.ZodObject<{
+    auth_profile: z.ZodString;
+    moltnet_release: z.ZodObject<{
+        architecture: z.ZodEnum<{
+            amd64: "amd64";
+            arm64: "arm64";
+        }>;
+        asset: z.ZodString;
+        asset_sha256: z.ZodString;
+        capabilities: z.ZodTuple<[z.ZodLiteral<"pi-bridge">], null>;
+        release_version: z.ZodString;
+        source_revision: z.ZodString;
+        version: z.ZodLiteral<"spawnfile.moltnet-release-identity.v1">;
+    }, z.core.$strict>;
+    request_digest: z.ZodString;
+    resolution_digest: z.ZodString;
+    roots_digest: z.ZodString;
+    run_id: z.ZodString;
+    selected_target: z.ZodObject<{
+        fingerprint: z.ZodString;
+        handle: z.ZodPipe<z.ZodString, z.ZodTransform<import("../target/contracts.js").OpaqueTargetHandle, string>>;
+        version: z.ZodLiteral<"spawnfile.target-resource.selected-target.v1">;
+    }, z.core.$strict>;
+    target_selector: z.ZodString;
+    version: z.ZodLiteral<"spawnfile.simfile-run-operator-receipt.v1">;
+}, z.core.$strict>;
+export type SimfileRunOperatorInput = z.infer<typeof simfileRunOperatorInputSchema>;
+export type SimfileRunMoltnetIdentity = z.infer<typeof simfileRunMoltnetIdentitySchema>;
+export type SimfileRunOperatorResolution = z.infer<typeof simfileRunOperatorResolutionSchema>;
+export type SimfileRunOperatorReceipt = z.infer<typeof simfileRunOperatorReceiptSchema>;
+export declare const parseSimfileRunOperatorInput: (raw: unknown) => SimfileRunOperatorInput;
+export declare const parseSimfileRunOperatorResolution: (raw: unknown) => SimfileRunOperatorResolution;
+export declare const parseSimfileRunOperatorReceipt: (raw: unknown) => SimfileRunOperatorReceipt;
+export declare const createSimfileRunOperatorRequestDigest: (raw: unknown) => `sha256:${string}`;
+export declare const resolveSimfileRunOperatorInput: (input: {
+    readonly request: unknown;
+    readonly moltnet_release: unknown;
+}) => SimfileRunOperatorResolution;
+export declare const createSimfileRunOperatorReceipt: (input: {
+    readonly resolution: unknown;
+    readonly selected_target: SelectedTargetReceipt;
+}) => SimfileRunOperatorReceipt;
+export declare const verifySimfileRunOperatorReceipt: (input: {
+    readonly receipt: unknown;
+    readonly resolution: unknown;
+    readonly selected_target: SelectedTargetReceipt;
+}) => SimfileRunOperatorReceipt;

package/dist/ownership/simfileRunOperatorInputs.js

@@ -0,0 +1,139 @@
+import { createHash } from "node:crypto";
+import path from "node:path";
+import { z } from "zod";
+import { assertOrdinaryJsonGraph, selectedTargetReceiptSchema } from "../target/contracts.js";
+export const SIMFILE_RUN_OPERATOR_INPUT_VERSION = "spawnfile.simfile-run-operator-input.v1";
+export const SIMFILE_RUN_OPERATOR_RESOLUTION_VERSION = "spawnfile.simfile-run-operator-resolution.v1";
+export const SIMFILE_RUN_OPERATOR_RECEIPT_VERSION = "spawnfile.simfile-run-operator-receipt.v1";
+const identifier = z.string().regex(/^[a-z][a-z0-9_-]{0,63}$/u);
+const runId = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u);
+const digest = z.string().regex(/^sha256:[a-f0-9]{64}$/u);
+const revision = z.string().regex(/^[a-f0-9]{40}$/u);
+const releaseVersion = z.string().regex(/^v?\d+\.\d+\.\d+(?:-\d+-g[a-f0-9]{7,40})?$/u)
+    .refine((value) => value !== "latest");
+const absoluteRunRoot = z.string().max(4_096).refine((value) => path.isAbsolute(value) && path.normalize(value) === value && value !== path.parse(value).root);
+export const simfileRunOperatorInputSchema = z.object({
+    auth_profile: identifier,
+    moltnet_release: z.object({
+        directory_transport: z.literal("operator-path"),
+        required_capability: z.literal("pi-bridge"),
+        stamp_version: z.literal("spawnfile.moltnet-release-stamp.v1")
+    }).strict(),
+    run_id: runId,
+    run_root: absoluteRunRoot,
+    target_config_transport: z.literal("stdin"),
+    target_selector: identifier,
+    version: z.literal(SIMFILE_RUN_OPERATOR_INPUT_VERSION)
+}).strict().superRefine((value, context) => {
+    if (path.basename(value.run_root) !== value.run_id) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: "run_root must be owned by run_id" });
+    }
+});
+export const simfileRunMoltnetIdentitySchema = z.object({
+    architecture: z.enum(["amd64", "arm64"]),
+    asset: z.string().regex(/^moltnet_linux_(?:amd64|arm64)\.tar\.gz$/u),
+    asset_sha256: digest,
+    capabilities: z.tuple([z.literal("pi-bridge")]),
+    release_version: releaseVersion,
+    source_revision: revision,
+    version: z.literal("spawnfile.moltnet-release-identity.v1")
+}).strict().superRefine((value, context) => {
+    if (value.asset !== `moltnet_linux_${value.architecture}.tar.gz`) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: "Moltnet asset architecture mismatch" });
+    }
+    const described = value.release_version.match(/-g([a-f0-9]{7,40})$/u)?.[1];
+    if (described && !value.source_revision.startsWith(described)) {
+        context.addIssue({ code: z.ZodIssueCode.custom, message: "Moltnet source revision mismatch" });
+    }
+});
+const runRootsSchema = z.object({
+    cache: absoluteRunRoot,
+    evidence: absoluteRunRoot,
+    journal: absoluteRunRoot,
+    output: absoluteRunRoot
+}).strict();
+export const simfileRunOperatorResolutionSchema = z.object({
+    auth_profile: identifier,
+    moltnet_release: simfileRunMoltnetIdentitySchema,
+    request_digest: digest,
+    roots: runRootsSchema,
+    roots_digest: digest,
+    run_id: runId,
+    target_selector: identifier,
+    version: z.literal(SIMFILE_RUN_OPERATOR_RESOLUTION_VERSION)
+}).strict();
+export const simfileRunOperatorReceiptSchema = z.object({
+    auth_profile: identifier,
+    moltnet_release: simfileRunMoltnetIdentitySchema,
+    request_digest: digest,
+    resolution_digest: digest,
+    roots_digest: digest,
+    run_id: runId,
+    selected_target: selectedTargetReceiptSchema,
+    target_selector: identifier,
+    version: z.literal(SIMFILE_RUN_OPERATOR_RECEIPT_VERSION)
+}).strict();
+const canonical = (value) => {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(",")}]`;
+    if (value !== null && typeof value === "object") {
+        const record = value;
+        return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonical(record[key])}`).join(",")}}`;
+    }
+    return JSON.stringify(value);
+};
+const hash = (domain, value) => `sha256:${createHash("sha256").update(`${domain}\0${canonical(value)}`).digest("hex")}`;
+const parse = (schema, raw) => {
+    assertOrdinaryJsonGraph(raw);
+    return schema.parse(raw);
+};
+export const parseSimfileRunOperatorInput = (raw) => parse(simfileRunOperatorInputSchema, raw);
+export const parseSimfileRunOperatorResolution = (raw) => parse(simfileRunOperatorResolutionSchema, raw);
+export const parseSimfileRunOperatorReceipt = (raw) => parse(simfileRunOperatorReceiptSchema, raw);
+export const createSimfileRunOperatorRequestDigest = (raw) => hash(SIMFILE_RUN_OPERATOR_INPUT_VERSION, parseSimfileRunOperatorInput(raw));
+export const resolveSimfileRunOperatorInput = (input) => {
+    const request = parseSimfileRunOperatorInput(input.request);
+    const moltnetRelease = parse(simfileRunMoltnetIdentitySchema, input.moltnet_release);
+    const roots = {
+        cache: path.join(request.run_root, "cache"),
+        evidence: path.join(request.run_root, "evidence"),
+        journal: path.join(request.run_root, "journal"),
+        output: path.join(request.run_root, "output")
+    };
+    return parseSimfileRunOperatorResolution({
+        auth_profile: request.auth_profile,
+        moltnet_release: moltnetRelease,
+        request_digest: createSimfileRunOperatorRequestDigest(request),
+        roots,
+        roots_digest: hash("spawnfile.simfile-run-roots.v1", roots),
+        run_id: request.run_id,
+        target_selector: request.target_selector,
+        version: SIMFILE_RUN_OPERATOR_RESOLUTION_VERSION
+    });
+};
+export const createSimfileRunOperatorReceipt = (input) => {
+    const resolution = parseSimfileRunOperatorResolution(input.resolution);
+    const selectedTarget = parse(selectedTargetReceiptSchema, input.selected_target);
+    return parseSimfileRunOperatorReceipt({
+        auth_profile: resolution.auth_profile,
+        moltnet_release: resolution.moltnet_release,
+        request_digest: resolution.request_digest,
+        resolution_digest: hash(SIMFILE_RUN_OPERATOR_RESOLUTION_VERSION, resolution),
+        roots_digest: resolution.roots_digest,
+        run_id: resolution.run_id,
+        selected_target: selectedTarget,
+        target_selector: resolution.target_selector,
+        version: SIMFILE_RUN_OPERATOR_RECEIPT_VERSION
+    });
+};
+export const verifySimfileRunOperatorReceipt = (input) => {
+    const receipt = parseSimfileRunOperatorReceipt(input.receipt);
+    const expected = createSimfileRunOperatorReceipt({
+        resolution: input.resolution,
+        selected_target: input.selected_target
+    });
+    if (canonical(receipt) !== canonical(expected)) {
+        throw new TypeError("Simfile run operator receipt correlation is invalid");
+    }
+    return receipt;
+};