spawnfile 0.1.13 → 0.1.14

package/dist/target/cleanupRunDocker.test-helper.js

@@ -0,0 +1,238 @@
+import { createOrganizationHandoff, parseCanonicalSha256Digest } from "../deployment/organizationHandoffTypes.js";
+import { parseOpaqueTargetHandle } from "./contracts.js";
+import { createDockerArtifactSpec } from "./dockerArtifactsProvider.js";
+import { DockerSecretProviderError, createExistingDockerSecretSpec } from "./dockerSecretsProvider.js";
+import { DockerResourceProviderError, createDockerResourceSpec } from "./dockerResourcesProvider.js";
+import { createWorldServiceAuthorization, parseWorldServiceResolution } from "./dockerWorldServiceAuthority.js";
+import { DockerWorldServiceProviderError, createDockerWorldServiceSpec } from "./dockerWorldServiceProvider.js";
+import { createWorldServiceBinding, worldServiceResourceBindings } from "./dockerWorldServiceStore.js";
+import { createOrganizationAttachmentAuthorization, parseOrganizationAttachmentResolution } from "./organizationAttachmentAuthority.js";
+import { DockerOrganizationAttachmentProviderError, createDockerOrganizationAttachmentSpec } from "./organizationAttachmentProvider.js";
+import { createOrganizationAttachmentBinding } from "./organizationAttachmentStore.js";
+const deploymentLabels = {
+    "com.spawnfile.compile_fingerprint": "sf1:compile",
+    "com.spawnfile.deployment": "test-deployment",
+    "com.spawnfile.project": "test-project",
+    "com.spawnfile.run_id": "run-one",
+    "com.spawnfile.unit": "world",
+    "com.spawnfile.version": "0.1"
+};
+export const canonicalCleanupBindings = (input) => {
+    const artifact = createDockerArtifactSpec({
+        artifactManifestDigest: `sha256:${"a".repeat(64)}`,
+        imageDigest: `sha256:${"b".repeat(64)}`,
+        imageReference: `registry.example/world@sha256:${"b".repeat(64)}`,
+        operationHandle: parseOpaqueTargetHandle("opaque_artifact00000001"),
+        requestDigest: `sha256:${"3".repeat(64)}`,
+        selectedTargetHandle: input.selected.handle
+    });
+    const worldAuthorization = createWorldServiceAuthorization({
+        dataNetworkHandle: input.network.resultHandle,
+        descriptorDigest: input.descriptorDigest,
+        evidenceMountPath: "/run/world/evidence",
+        evidenceVolumeHandle: input.evidence.resultHandle,
+        operationHandle: input.worldOperationHandle,
+        requestDigest: input.worldRequestDigest,
+        runId: input.runId,
+        secretBindingsHandle: input.secretHandle,
+        selectedTarget: input.selected,
+        worldArtifactHandle: artifact.resultHandle
+    });
+    const worldResolution = parseWorldServiceResolution({
+        artifact: {
+            artifact_manifest_digest: `sha256:${"a".repeat(64)}`,
+            identity_kind: "oci_image_manifest",
+            image_digest: artifact.imageDigest,
+            image_reference: artifact.imageReference,
+            operation_handle: parseOpaqueTargetHandle("opaque_artifact00000001"),
+            request_digest: `sha256:${"3".repeat(64)}`,
+            result_handle: artifact.resultHandle
+        },
+        authorization: worldAuthorization
+    });
+    const worldResources = worldServiceResourceBindings({
+        dataNetworkClaim: {
+            operationHandle: input.networkOperationHandle,
+            requestDigest: input.networkRequestDigest
+        },
+        evidenceVolumeClaim: {
+            operationHandle: input.evidenceOperationHandle,
+            requestDigest: input.evidenceRequestDigest
+        },
+        resolution: worldResolution
+    });
+    const resources = {
+        ...worldResources,
+        secret_bindings: (() => {
+            const spec = createExistingDockerSecretSpec({
+                bindingsHandle: input.secretHandle,
+                runId: input.runId,
+                selectedTargetHandle: input.selected.handle
+            });
+            return { handle: spec.resultHandle, labels: spec.labels, name: spec.volumeName };
+        })()
+    };
+    const worldSpec = createDockerWorldServiceSpec({
+        dataNetwork: resources.data_network,
+        evidenceMountPath: worldAuthorization.evidence_mount_path,
+        evidenceVolume: resources.evidence_volume,
+        imageDigest: worldResolution.artifact.image_digest,
+        imageReference: worldResolution.artifact.image_reference,
+        operationHandle: worldAuthorization.operation_handle,
+        requestDigest: worldAuthorization.request_digest,
+        runId: input.runId,
+        secretBindings: resources.secret_bindings,
+        selectedTargetHandle: input.selected.handle
+    });
+    const world = createWorldServiceBinding({
+        containerId: "c".repeat(64),
+        dataNetwork: resources.data_network,
+        evidenceVolume: resources.evidence_volume,
+        resolution: worldResolution,
+        secretBindings: resources.secret_bindings,
+        spec: worldSpec
+    });
+    const attachmentAuthorization = createOrganizationAttachmentAuthorization({
+        descriptorDigest: input.descriptorDigest,
+        operationHandle: input.attachmentOperationHandle,
+        organizationHandoffHandle: parseOpaqueTargetHandle("opaque_handoff000000001"),
+        requestDigest: input.attachmentRequestDigest,
+        runId: input.runId,
+        selectedTarget: input.selected
+    });
+    const handoff = createOrganizationHandoff(input.runId, {
+        bindingDigest: parseCanonicalSha256Digest(`sha256:${"4".repeat(64)}`),
+        networkAttachmentHandle: parseOpaqueTargetHandle("opaque_networkattach001"),
+        selectedTargetReceiptDigest: parseCanonicalSha256Digest(`sha256:${"5".repeat(64)}`)
+    });
+    const attachmentResolution = parseOrganizationAttachmentResolution({
+        authorization: attachmentAuthorization,
+        descriptor_binding: {
+            binding_digest: handoff.binding_digest,
+            descriptor_digest: input.descriptorDigest
+        },
+        handoff,
+        network_attachment: {
+            container_id: world.container_id,
+            deployment_labels: deploymentLabels,
+            network_attachment_handle: handoff.network_attachment_handle
+        },
+        selected_target_binding: {
+            receipt: {
+                ...input.selected,
+                version: "spawnfile.target-resource.selected-target.v1"
+            },
+            receipt_digest: handoff.selected_target_receipt_digest
+        }
+    });
+    const attachmentSpec = createDockerOrganizationAttachmentSpec({
+        containerId: world.container_id,
+        dataNetworkOperationHandle: input.networkOperationHandle,
+        dataNetworkRequestDigest: input.networkRequestDigest,
+        deploymentLabels,
+        operationHandle: input.attachmentOperationHandle,
+        organizationHandoffHandle: attachmentAuthorization.organization_handoff_handle,
+        requestDigest: input.attachmentRequestDigest,
+        runId: input.runId,
+        selectedTargetHandle: input.selected.handle
+    });
+    const attachment = createOrganizationAttachmentBinding({
+        dataNetworkOperationHandle: input.networkOperationHandle,
+        dataNetworkRequestDigest: input.networkRequestDigest,
+        networkId: "f".repeat(64),
+        resolution: attachmentResolution,
+        spec: attachmentSpec
+    });
+    return { attachment, world };
+};
+export const canonicalCleanupScenario = (input) => {
+    const bindings = canonicalCleanupBindings(input);
+    const calls = {
+        attachment: [],
+        secret: [],
+        world: []
+    };
+    const otherNetwork = createDockerResourceSpec({
+        kind: "data_network",
+        operationHandle: parseOpaqueTargetHandle("opaque_qqqqqqqqqqqqqqqq"),
+        requestDigest: `sha256:${"a".repeat(64)}`,
+        runId: input.runId,
+        selectedTargetHandle: input.selected.handle
+    });
+    const drift = canonicalCleanupBindings({
+        ...input,
+        network: otherNetwork,
+        networkOperationHandle: parseOpaqueTargetHandle("opaque_qqqqqqqqqqqqqqqq"),
+        networkRequestDigest: `sha256:${"a".repeat(64)}`
+    });
+    return {
+        attachmentExecutor: async (_file, args) => {
+            calls.attachment.push([...args]);
+            if (args[2] === "network")
+                return {
+                    stderr: "",
+                    stdout: JSON.stringify([{
+                            Id: bindings.attachment.data_network.id,
+                            Internal: true,
+                            Labels: bindings.attachment.data_network.labels,
+                            Name: bindings.attachment.data_network.name
+                        }])
+                };
+            throw new DockerOrganizationAttachmentProviderError("not_found");
+        },
+        bindings,
+        calls,
+        drift,
+        secretExecutor: async (_file, args) => {
+            calls.secret.push([...args]);
+            throw new DockerSecretProviderError("not_found");
+        },
+        worldExecutor: async (_file, args) => {
+            calls.world.push([...args]);
+            throw new DockerWorldServiceProviderError("not_found");
+        }
+    };
+};
+export const cleanupResourceExecutor = (specs) => {
+    const present = new Set(specs.map(({ name }) => name));
+    const calls = [];
+    const executor = async (_file, args) => {
+        calls.push(args);
+        const name = args.at(-1);
+        const spec = specs.find((candidate) => candidate.name === name);
+        if (!spec)
+            throw new Error("unknown resource");
+        if (args[3] === "inspect") {
+            if (!present.has(name))
+                throw new DockerResourceProviderError("not_found");
+            return {
+                stderr: "",
+                stdout: JSON.stringify([spec.kind === "data_network"
+                        ? { Internal: true, Labels: spec.labels, Name: name }
+                        : { Labels: spec.labels, Name: name }])
+            };
+        }
+        if (args[3] === "rm") {
+            present.delete(name);
+            return { stderr: "", stdout: `${name}\n` };
+        }
+        throw new Error("unexpected resource command");
+    };
+    return { calls, executor, present };
+};
+export const cleanupAuthorityStores = (input = {}) => {
+    const loads = { attachment: 0, world: 0 };
+    return {
+        attachmentStore: {
+            loadAttachment: async () => (loads.attachment += 1, input.attachment)
+        },
+        evidenceExportStore: {
+            loadAdmission: async () => input.admission,
+            loadIndex: async () => input.index ?? null
+        },
+        loads,
+        worldStore: {
+            loadService: async () => (loads.world += 1, input.world)
+        }
+    };
+};

package/dist/target/cleanupRunDockerPreflight.d.ts

@@ -0,0 +1,17 @@
+import { type TargetResourceRequest } from "./contracts.js";
+import { type CleanupRunPlan } from "./cleanupRun.js";
+import { type WorldServiceAuthorityStore } from "./dockerWorldServiceStore.js";
+import { type EvidenceExportAuthorityStore } from "./evidenceExportStore.js";
+import { type OrganizationAttachmentAuthorityStore } from "./organizationAttachmentStore.js";
+import { type TargetJournalStore } from "./journal.js";
+type CleanupRequest = Extract<TargetResourceRequest, {
+    operation: "cleanup_run";
+}>;
+export interface DockerCleanupRunPreflightOptions {
+    readonly attachmentStore: OrganizationAttachmentAuthorityStore;
+    readonly evidenceExportStore: EvidenceExportAuthorityStore;
+    readonly journal: TargetJournalStore;
+    readonly worldStore: WorldServiceAuthorityStore;
+}
+export declare const prepareDockerCleanupRun: (request: CleanupRequest, options: DockerCleanupRunPreflightOptions) => Promise<CleanupRunPlan>;
+export {};

package/dist/target/cleanupRunDockerPreflight.js

@@ -0,0 +1,224 @@
+import { SpawnfileError } from "../shared/index.js";
+import { parseTargetResourceExportIndex } from "./contracts.js";
+import { createExistingDockerSecretSpec } from "./dockerSecretsProvider.js";
+import { createDockerResourceSpec } from "./dockerResourcesProvider.js";
+import { parseWorldServiceBinding } from "./dockerWorldServiceStore.js";
+import { createEvidenceExportHandle, evidenceReceiptLabels, parseEvidenceVolumeAuthority } from "./evidenceExportProvider.js";
+import { parseOrganizationAttachmentBinding } from "./organizationAttachmentStore.js";
+const CLEANUP_ERROR = "Target cleanup failed";
+const fail = () => {
+    throw new SpawnfileError("runtime_error", CLEANUP_ERROR);
+};
+const same = (left, right) => JSON.stringify(left) === JSON.stringify(right);
+const requestDigest = (raw) => {
+    if (!/^sha256:[a-f0-9]{64}$/u.test(raw))
+        return fail();
+    return raw;
+};
+const resource = (handle, authority) => Object.freeze({ authority, handle });
+const roleFor = (operation) => {
+    switch (operation) {
+        case "attach_organization": return "attachment";
+        case "create_data_network": return "dataNetwork";
+        case "create_evidence_volume": return "evidence";
+        case "prepare_secret_bindings": return "secrets";
+        case "create_world_service": return "world";
+        default: return null;
+    }
+};
+const completedEntries = async (request, options) => {
+    const snapshot = await options.journal.read();
+    if (snapshot.run_id !== request.run_id
+        || snapshot.descriptor_digest !== request.descriptor_digest
+        || !same(snapshot.selected_target, request.selected_target))
+        return fail();
+    const completed = [];
+    for (const entry of snapshot.entries) {
+        if (entry.state !== "completed")
+            continue;
+        const digest = requestDigest(entry.request_digest);
+        const resolved = await options.journal.resolveCompletedReceipt({
+            operationHandle: entry.operation_handle,
+            requestDigest: digest
+        });
+        if (!resolved)
+            return fail();
+        const receipt = resolved.receipt;
+        if (receipt.operation !== entry.operation
+            || receipt.operation_handle !== entry.operation_handle
+            || receipt.request_digest !== entry.request_digest
+            || receipt.run_id !== request.run_id
+            || receipt.descriptor_digest !== request.descriptor_digest
+            || !same(receipt.selected_target, request.selected_target))
+            return fail();
+        completed.push({
+            entry: {
+                operation: entry.operation,
+                operation_handle: entry.operation_handle,
+                request_digest: digest
+            },
+            receipt
+        });
+    }
+    return completed;
+};
+const exactRoles = (completed) => {
+    const roles = new Map();
+    for (const item of completed) {
+        const role = roleFor(item.entry.operation);
+        if (!role)
+            continue;
+        if (roles.has(role) || item.receipt.result_handle === null)
+            return fail();
+        roles.set(role, item);
+    }
+    return roles;
+};
+const requireRole = (roles, role, supplied) => {
+    const found = roles.get(role);
+    if ((found === undefined) !== (supplied === undefined))
+        return fail();
+    if (!found)
+        return null;
+    if (found.receipt.result_handle !== supplied)
+        return fail();
+    return found;
+};
+const specFor = (kind, completed, request) => {
+    const spec = createDockerResourceSpec({
+        kind,
+        operationHandle: completed.entry.operation_handle,
+        requestDigest: completed.entry.request_digest,
+        runId: request.run_id,
+        selectedTargetHandle: request.selected_target.handle
+    });
+    if (spec.resultHandle !== completed.receipt.result_handle)
+        return fail();
+    return spec;
+};
+const matchingWorld = (binding, request, network, evidence, secretAuthority) => {
+    const secretSpec = secretAuthority
+        ? createExistingDockerSecretSpec(secretAuthority) : null;
+    if (binding.world_service_handle !== request.world_service_handle
+        || binding.resolution.authorization.run_id !== request.run_id
+        || binding.resolution.authorization.descriptor_digest !== request.descriptor_digest
+        || !same(binding.resolution.authorization.selected_target, request.selected_target)
+        || binding.resources.data_network.handle !== network.resultHandle
+        || binding.resources.data_network.name !== network.name
+        || !same(binding.resources.data_network.labels, network.labels)
+        || binding.resources.evidence_volume.handle !== evidence?.resultHandle
+        || binding.resources.evidence_volume.name !== evidence?.name
+        || !same(binding.resources.evidence_volume.labels, evidence?.labels)
+        || binding.resources.secret_bindings.handle !== secretSpec?.resultHandle
+        || binding.resources.secret_bindings.name !== secretSpec?.volumeName
+        || !same(binding.resources.secret_bindings.labels, secretSpec?.labels))
+        return fail();
+};
+const matchingAttachment = (binding, request, network) => {
+    if (binding.attachment_handle !== request.organization_attachment_handle
+        || binding.resolution.authorization.run_id !== request.run_id
+        || binding.resolution.authorization.descriptor_digest !== request.descriptor_digest
+        || !same(binding.resolution.authorization.selected_target, request.selected_target)
+        || binding.data_network.handle !== network.resultHandle
+        || binding.data_network.name !== network.name
+        || !same(binding.data_network.labels, network.labels))
+        return fail();
+};
+const exportState = async (evidence, completed, request, options) => {
+    const exports = completed.filter(({ entry }) => entry.operation === "export_evidence_volume");
+    if (!evidence) {
+        if (exports.length !== 0)
+            return fail();
+        return "not_requested";
+    }
+    if (exports.length === 0)
+        return "incomplete";
+    if (exports.length !== 1)
+        return fail();
+    const exported = exports[0];
+    if (exported.receipt.export_state !== "exported"
+        || exported.receipt.result_handle === null)
+        return fail();
+    const admission = await options.evidenceExportStore.loadAdmission(exported.entry.operation_handle);
+    const evidenceAuthority = parseEvidenceVolumeAuthority(admission.evidence_volume);
+    if (admission.operation_handle !== exported.entry.operation_handle
+        || admission.request_digest !== exported.entry.request_digest
+        || evidenceAuthority.resultHandle !== evidence.resultHandle
+        || evidenceAuthority.name !== evidence.name
+        || !same(evidenceAuthority.labels, evidence.labels)
+        || admission.run_id !== request.run_id
+        || admission.descriptor_digest !== request.descriptor_digest
+        || !same(admission.selected_target, request.selected_target))
+        return fail();
+    const loaded = await options.evidenceExportStore.loadIndex(admission);
+    if (!loaded)
+        return fail();
+    const index = parseTargetResourceExportIndex(loaded.index);
+    const expectedExportHandle = createEvidenceExportHandle({
+        evidenceVolumeHandle: evidence.resultHandle,
+        operationHandle: exported.entry.operation_handle,
+        requestDigest: exported.entry.request_digest
+    });
+    if (index.state !== "exported" || index.run_id !== request.run_id
+        || index.export_handle !== expectedExportHandle
+        || exported.receipt.result_handle !== expectedExportHandle
+        || !same(index.labels, evidenceReceiptLabels(evidenceAuthority))
+        || !same(exported.receipt.labels, index.labels))
+        return fail();
+    return "exported";
+};
+export const prepareDockerCleanupRun = async (request, options) => {
+    const completed = await completedEntries(request, options);
+    const roles = exactRoles(completed);
+    const networkCompleted = roles.get("dataNetwork");
+    const network = networkCompleted
+        ? specFor("data_network", networkCompleted, request)
+        : null;
+    const evidenceCompleted = requireRole(roles, "evidence", request.evidence_volume_handle);
+    const secretCompleted = requireRole(roles, "secrets", request.secret_bindings_handle);
+    const worldCompleted = requireRole(roles, "world", request.world_service_handle);
+    const attachmentCompleted = requireRole(roles, "attachment", request.organization_attachment_handle);
+    if (!network && (worldCompleted || attachmentCompleted))
+        return fail();
+    const evidence = evidenceCompleted
+        ? specFor("evidence_volume", evidenceCompleted, request) : null;
+    const worldBinding = worldCompleted
+        ? parseWorldServiceBinding(await options.worldStore.loadService(worldCompleted.receipt.result_handle)) : null;
+    const attachmentBinding = attachmentCompleted
+        ? parseOrganizationAttachmentBinding(await options.attachmentStore.loadAttachment(attachmentCompleted.receipt.result_handle)) : null;
+    const secretAuthority = secretCompleted
+        ? Object.freeze({
+            bindingsHandle: secretCompleted.receipt.result_handle,
+            runId: request.run_id,
+            selectedTargetHandle: request.selected_target.handle
+        }) : null;
+    if (worldBinding) {
+        matchingWorld(worldBinding, request, network, evidence, secretAuthority);
+    }
+    if (attachmentBinding)
+        matchingAttachment(attachmentBinding, request, network);
+    if (worldBinding && attachmentBinding
+        && (worldBinding.resources.data_network.handle
+            !== attachmentBinding.data_network.handle
+            || worldBinding.resources.data_network.name
+                !== attachmentBinding.data_network.name
+            || !same(worldBinding.resources.data_network.labels, attachmentBinding.data_network.labels)))
+        return fail();
+    const state = await exportState(evidence, completed, request, options);
+    if (request.cleanup_policy === "remove" && evidence && state !== "exported") {
+        return fail();
+    }
+    return Object.freeze({
+        attachment: attachmentBinding
+            ? resource(attachmentBinding.attachment_handle, attachmentBinding) : null,
+        cleanupPolicy: request.cleanup_policy,
+        dataNetwork: network
+            ? resource(network.resultHandle, Object.freeze(network)) : null,
+        evidence: evidence ? resource(evidence.resultHandle, Object.freeze(evidence)) : null,
+        exportState: state,
+        secrets: secretAuthority
+            ? resource(secretAuthority.bindingsHandle, secretAuthority) : null,
+        world: worldBinding
+            ? resource(worldBinding.world_service_handle, worldBinding) : null
+    });
+};

package/dist/target/composedPreparation.d.ts

@@ -0,0 +1,205 @@
+import { z } from "zod";
+import { type SelectedTargetReceipt, type TargetResourceRequest } from "./contracts.js";
+export declare const COMPOSED_PREPARATION_REQUEST_VERSION: "spawnfile.composed-preparation.request.v1";
+export declare const COMPOSED_PREPARATION_RECEIPT_VERSION: "spawnfile.composed-preparation.receipt.v1";
+export declare const composedPreparationRequestSchema: z.ZodObject<{
+    auth_profile: z.ZodString;
+    descriptor_digest: z.ZodString;
+    idempotency_key: z.ZodString;
+    organization: z.ZodObject<{
+        artifact_digest: z.ZodString;
+        world_bindings_digest: z.ZodString;
+    }, z.core.$strict>;
+    run_id: z.ZodString;
+    secret_bindings: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        scope: z.ZodString;
+        source_handle: z.ZodString;
+    }, z.core.$strict>>;
+    target_selector: z.ZodString;
+    version: z.ZodLiteral<"spawnfile.composed-preparation.request.v1">;
+    world: z.ZodObject<{
+        artifact_manifest_digest: z.ZodString;
+        bundle_digest: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export declare const composedPreparationReceiptSchema: z.ZodObject<{
+    auth_profile: z.ZodString;
+    descriptor_digest: z.ZodString;
+    organization: z.ZodObject<{
+        artifact_digest: z.ZodString;
+        world_bindings_digest: z.ZodString;
+    }, z.core.$strict>;
+    receipt_digest: z.ZodString;
+    request_digest: z.ZodString;
+    resources: z.ZodObject<{
+        data_network: z.ZodObject<{
+            cleanup_state: z.ZodNullable<z.ZodEnum<{
+                preserved: "preserved";
+                incomplete: "incomplete";
+                not_requested: "not_requested";
+                removed: "removed";
+            }>>;
+            descriptor_digest: z.ZodString;
+            export_state: z.ZodNullable<z.ZodEnum<{
+                exported: "exported";
+                incomplete: "incomplete";
+                not_requested: "not_requested";
+            }>>;
+            labels: z.ZodArray<z.ZodObject<{
+                key: z.ZodString;
+                value: z.ZodString;
+            }, z.core.$strict>>;
+            operation: z.ZodEnum<{
+                resolve_world_artifact: "resolve_world_artifact";
+                prepare_secret_bindings: "prepare_secret_bindings";
+                create_data_network: "create_data_network";
+                create_evidence_volume: "create_evidence_volume";
+            }>;
+            operation_handle: z.ZodString;
+            receipt_digest: z.ZodString;
+            request_digest: z.ZodString;
+            result_handle: z.ZodString;
+            resulting_revision: z.ZodNumber;
+            run_id: z.ZodString;
+            selected_target: z.ZodObject<{
+                fingerprint: z.ZodString;
+                handle: z.ZodString;
+            }, z.core.$strict>;
+            version: z.ZodLiteral<"spawnfile.target-resource.receipt.v1">;
+        }, z.core.$strict>;
+        evidence_volume: z.ZodObject<{
+            cleanup_state: z.ZodNullable<z.ZodEnum<{
+                preserved: "preserved";
+                incomplete: "incomplete";
+                not_requested: "not_requested";
+                removed: "removed";
+            }>>;
+            descriptor_digest: z.ZodString;
+            export_state: z.ZodNullable<z.ZodEnum<{
+                exported: "exported";
+                incomplete: "incomplete";
+                not_requested: "not_requested";
+            }>>;
+            labels: z.ZodArray<z.ZodObject<{
+                key: z.ZodString;
+                value: z.ZodString;
+            }, z.core.$strict>>;
+            operation: z.ZodEnum<{
+                resolve_world_artifact: "resolve_world_artifact";
+                prepare_secret_bindings: "prepare_secret_bindings";
+                create_data_network: "create_data_network";
+                create_evidence_volume: "create_evidence_volume";
+            }>;
+            operation_handle: z.ZodString;
+            receipt_digest: z.ZodString;
+            request_digest: z.ZodString;
+            result_handle: z.ZodString;
+            resulting_revision: z.ZodNumber;
+            run_id: z.ZodString;
+            selected_target: z.ZodObject<{
+                fingerprint: z.ZodString;
+                handle: z.ZodString;
+            }, z.core.$strict>;
+            version: z.ZodLiteral<"spawnfile.target-resource.receipt.v1">;
+        }, z.core.$strict>;
+        secret_bindings: z.ZodObject<{
+            cleanup_state: z.ZodNullable<z.ZodEnum<{
+                preserved: "preserved";
+                incomplete: "incomplete";
+                not_requested: "not_requested";
+                removed: "removed";
+            }>>;
+            descriptor_digest: z.ZodString;
+            export_state: z.ZodNullable<z.ZodEnum<{
+                exported: "exported";
+                incomplete: "incomplete";
+                not_requested: "not_requested";
+            }>>;
+            labels: z.ZodArray<z.ZodObject<{
+                key: z.ZodString;
+                value: z.ZodString;
+            }, z.core.$strict>>;
+            operation: z.ZodEnum<{
+                resolve_world_artifact: "resolve_world_artifact";
+                prepare_secret_bindings: "prepare_secret_bindings";
+                create_data_network: "create_data_network";
+                create_evidence_volume: "create_evidence_volume";
+            }>;
+            operation_handle: z.ZodString;
+            receipt_digest: z.ZodString;
+            request_digest: z.ZodString;
+            result_handle: z.ZodString;
+            resulting_revision: z.ZodNumber;
+            run_id: z.ZodString;
+            selected_target: z.ZodObject<{
+                fingerprint: z.ZodString;
+                handle: z.ZodString;
+            }, z.core.$strict>;
+            version: z.ZodLiteral<"spawnfile.target-resource.receipt.v1">;
+        }, z.core.$strict>;
+        world_artifact: z.ZodObject<{
+            cleanup_state: z.ZodNullable<z.ZodEnum<{
+                preserved: "preserved";
+                incomplete: "incomplete";
+                not_requested: "not_requested";
+                removed: "removed";
+            }>>;
+            descriptor_digest: z.ZodString;
+            export_state: z.ZodNullable<z.ZodEnum<{
+                exported: "exported";
+                incomplete: "incomplete";
+                not_requested: "not_requested";
+            }>>;
+            labels: z.ZodArray<z.ZodObject<{
+                key: z.ZodString;
+                value: z.ZodString;
+            }, z.core.$strict>>;
+            operation: z.ZodEnum<{
+                resolve_world_artifact: "resolve_world_artifact";
+                prepare_secret_bindings: "prepare_secret_bindings";
+                create_data_network: "create_data_network";
+                create_evidence_volume: "create_evidence_volume";
+            }>;
+            operation_handle: z.ZodString;
+            receipt_digest: z.ZodString;
+            request_digest: z.ZodString;
+            result_handle: z.ZodString;
+            resulting_revision: z.ZodNumber;
+            run_id: z.ZodString;
+            selected_target: z.ZodObject<{
+                fingerprint: z.ZodString;
+                handle: z.ZodString;
+            }, z.core.$strict>;
+            version: z.ZodLiteral<"spawnfile.target-resource.receipt.v1">;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+    run_id: z.ZodString;
+    selected_target: z.ZodObject<{
+        fingerprint: z.ZodString;
+        handle: z.ZodString;
+        version: z.ZodLiteral<"spawnfile.target-resource.selected-target.v1">;
+    }, z.core.$strict>;
+    target_selector: z.ZodString;
+    version: z.ZodLiteral<"spawnfile.composed-preparation.receipt.v1">;
+    world: z.ZodObject<{
+        artifact_manifest_digest: z.ZodString;
+        bundle_digest: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type ComposedPreparationRequest = z.infer<typeof composedPreparationRequestSchema>;
+export type ComposedPreparationReceipt = z.infer<typeof composedPreparationReceiptSchema>;
+export interface ComposedPreparationMutationResult {
+    readonly receipt: unknown;
+    readonly receiptBytes: unknown;
+}
+export type ComposedPreparationHandlers = {
+    [Operation in TargetResourceRequest["operation"]]: (request: Extract<TargetResourceRequest, {
+        operation: Operation;
+    }>) => Promise<Operation extends "select_target" ? SelectedTargetReceipt : ComposedPreparationMutationResult>;
+};
+export declare const parseComposedPreparationRequest: (raw: unknown) => ComposedPreparationRequest;
+export declare const createComposedPreparationRequestDigest: (raw: unknown) => `sha256:${string}`;
+export declare const parseComposedPreparationReceipt: (raw: unknown) => ComposedPreparationReceipt;
+export declare const createCanonicalComposedPreparationReceiptBytes: (raw: unknown) => string;
+export declare const prepareComposedRun: (handlers: ComposedPreparationHandlers, raw: unknown) => Promise<ComposedPreparationReceipt>;