spawnfile 0.1.13 → 0.1.14

package/dist/target/topologyActivation.js

@@ -0,0 +1,149 @@
+import { createHash } from "node:crypto";
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { z } from "zod";
+import { boundedRedactedText, SpawnfileError } from "../shared/index.js";
+import { assertOrdinaryJsonGraph, parseRunId } from "./contracts.js";
+import { executeDockerWorldService } from "./dockerWorldServiceProvider.js";
+import { worldServiceSpecForBinding } from "./dockerWorldServiceLifecycle.js";
+export const WORLD_SERVICE_ACTIVATION_VERSION = "spawnfile.world-service-activation.v1";
+export const TARGET_TOPOLOGY_ACTIVATION_RECEIPT_VERSION = "spawnfile.target-topology-activation-receipt.v1";
+export const WORLD_SERVICE_ACTIVATION_RELATIVE_PATH = ".spawnfile/world-service-activated.v1";
+const digestSchema = z.string().regex(/^sha256:[0-9a-f]{64}$/u);
+const markerSchema = z.object({
+    bundle_digest: digestSchema,
+    run_id: z.string(),
+    state: z.literal("activated"),
+    topology_receipt_digest: digestSchema,
+    topology_request_digest: digestSchema,
+    version: z.literal(WORLD_SERVICE_ACTIVATION_VERSION)
+}).strict();
+const receiptSchema = z.object({
+    activation_digest: digestSchema,
+    bundle_digest: digestSchema,
+    receipt_digest: digestSchema,
+    run_id: z.string(),
+    state: z.literal("activated"),
+    topology_receipt_digest: digestSchema,
+    topology_request_digest: digestSchema,
+    version: z.literal(TARGET_TOPOLOGY_ACTIVATION_RECEIPT_VERSION)
+}).strict();
+const fail = (reason) => {
+    throw new SpawnfileError("runtime_error", `Target topology activation failed: ${reason}`);
+};
+const canonical = (value) => {
+    assertOrdinaryJsonGraph(value);
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(",")}]`;
+    if (value !== null && typeof value === "object") {
+        const record = value;
+        return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonical(record[key])}`).join(",")}}`;
+    }
+    return JSON.stringify(value);
+};
+const digest = (domain, value) => `sha256:${createHash("sha256")
+    .update(domain === "activation"
+    ? "spawnfile.world-service-activation.v1\0"
+    : "spawnfile.target-topology-activation-receipt.v1\0", "utf8")
+    .update(canonical(value), "utf8")
+    .digest("hex")}`;
+export const parseWorldServiceActivation = (raw) => {
+    assertOrdinaryJsonGraph(raw);
+    const parsed = markerSchema.parse(raw);
+    return Object.freeze({ ...parsed, run_id: parseRunId(parsed.run_id) });
+};
+export const parseTargetTopologyActivationReceipt = (raw) => {
+    assertOrdinaryJsonGraph(raw);
+    const parsed = receiptSchema.parse(raw);
+    return Object.freeze({ ...parsed, run_id: parseRunId(parsed.run_id) });
+};
+export const createCanonicalWorldServiceActivationBytes = (raw) => `${canonical(parseWorldServiceActivation(raw))}\n`;
+export const createCanonicalTargetTopologyActivationReceiptBytes = (raw) => canonical(parseTargetTopologyActivationReceipt(raw));
+export const createWorldServiceActivationDigest = (raw) => digest("activation", parseWorldServiceActivation(raw));
+export const createTargetTopologyActivationReceiptDigest = (raw) => {
+    const parsed = parseTargetTopologyActivationReceipt(raw);
+    const { receipt_digest: _receiptDigest, ...body } = parsed;
+    return digest("receipt", body);
+};
+const markerFor = (world, topology) => parseWorldServiceActivation({
+    bundle_digest: world.resolution.artifact.artifact_manifest_digest,
+    run_id: topology.run_id,
+    state: "activated",
+    topology_receipt_digest: topology.receipt_digest,
+    topology_request_digest: topology.request_digest,
+    version: WORLD_SERVICE_ACTIVATION_VERSION
+});
+const receiptFor = (marker) => {
+    const body = {
+        activation_digest: createWorldServiceActivationDigest(marker),
+        bundle_digest: marker.bundle_digest,
+        receipt_digest: `sha256:${"0".repeat(64)}`,
+        run_id: marker.run_id,
+        state: "activated",
+        topology_receipt_digest: marker.topology_receipt_digest,
+        topology_request_digest: marker.topology_request_digest,
+        version: TARGET_TOPOLOGY_ACTIVATION_RECEIPT_VERSION
+    };
+    const receipt = parseTargetTopologyActivationReceipt({
+        ...body,
+        receipt_digest: createTargetTopologyActivationReceiptDigest(body)
+    });
+    return Object.freeze({
+        receipt,
+        receiptBytes: createCanonicalTargetTopologyActivationReceiptBytes(receipt)
+    });
+};
+/**
+ * Publishes the owner-only lifecycle release through the service's existing
+ * evidence mount. Docker copies exact canonical bytes; no provider traffic or
+ * agent-reachable endpoint participates in activation.
+ */
+export const activateDockerWorldService = async (input) => {
+    const marker = markerFor(input.world, input.topology);
+    const spec = worldServiceSpecForBinding(input.world);
+    const temporaryRoot = await mkdtemp(path.join(os.tmpdir(), "spawnfile-world-activation-"));
+    try {
+        const markerDirectory = path.join(temporaryRoot, ".spawnfile");
+        // This path is docker cp'd into the evidence volume, which is exported by a
+        // helper running as uid 65534. The marker is a closed schema of digests and
+        // identifiers with no secret material, so the restriction protected nothing;
+        // tightening it back disables evidence export. A file written into a volume
+        // that exists to be exported must be readable by the exporter.
+        await mkdir(markerDirectory, { mode: 0o755 });
+        // This path is docker cp'd into the evidence volume, which is exported by a
+        // helper running as uid 65534. The marker is a closed schema of digests and
+        // identifiers with no secret material, so the restriction protected nothing;
+        // tightening it back disables evidence export. A file written into a volume
+        // that exists to be exported must be readable by the exporter.
+        await writeFile(path.join(markerDirectory, "world-service-activated.v1"), createCanonicalWorldServiceActivationBytes(marker), { encoding: "utf8", mode: 0o644 });
+        const result = await executeDockerWorldService({
+            args: [
+                ...input.target,
+                "container",
+                "cp",
+                markerDirectory,
+                `${input.world.container_id}:${spec.evidenceMountPath}`
+            ],
+            executor: input.executor,
+            signal: input.signal,
+            timeoutMs: input.timeoutMs
+        });
+        if (result.stdout !== "") {
+            return fail(`activation_stdout_unexpected:${boundedRedactedText(result.stdout)}`);
+        }
+        if (result.stderr !== "") {
+            return fail(`activation_stderr_unexpected:${boundedRedactedText(result.stderr)}`);
+        }
+        return receiptFor(marker);
+    }
+    catch (error) {
+        if (error instanceof SpawnfileError
+            && error.message.startsWith("Target topology activation failed:"))
+            throw error;
+        return fail("activation_failed");
+    }
+    finally {
+        await rm(temporaryRoot, { force: true, recursive: true }).catch(() => undefined);
+    }
+};

package/dist/target/topologyAttestation.d.ts

@@ -0,0 +1,37 @@
+import { type TargetTopologyReceipt } from "./contracts.js";
+import { type DockerResourceExecutor } from "./dockerResourcesProvider.js";
+import { type DockerOrganizationAttachmentExecutor } from "./organizationAttachmentProvider.js";
+import type { OrganizationAttachmentAuthorityStore } from "./organizationAttachmentStore.js";
+import { type DockerWorldServiceExecutor } from "./dockerWorldServiceProvider.js";
+import { type WorldServiceAuthorityStore } from "./dockerWorldServiceStore.js";
+import type { TargetJournalStore } from "./journal.js";
+import { type TargetTopologyActivationResult } from "./topologyActivation.js";
+export declare const TARGET_TOPOLOGY_ATTESTATION_ERROR = "Target topology attestation failed";
+export interface TargetTopologyAttestationResult {
+    readonly receipt: TargetTopologyReceipt;
+    readonly receiptBytes: string;
+}
+export interface TargetTopologyAttestor {
+    activate(raw: unknown): Promise<TargetTopologyActivationResult>;
+    attest(raw: unknown): Promise<TargetTopologyAttestationResult>;
+}
+export interface CreateTargetTopologyAttestorOptions {
+    readonly attachmentExecutor: DockerOrganizationAttachmentExecutor;
+    readonly attachmentStore: OrganizationAttachmentAuthorityStore;
+    readonly context: string;
+    readonly resolveJournal: (input: {
+        readonly descriptorDigest: unknown;
+        readonly runId: unknown;
+        readonly selectedTarget: unknown;
+    }) => Promise<TargetJournalStore>;
+    readonly resourceExecutor: DockerResourceExecutor;
+    readonly timeoutMs: number;
+    readonly worldExecutor: DockerWorldServiceExecutor;
+    readonly worldStore: WorldServiceAuthorityStore;
+}
+/**
+ * Builds the read-only owner endpoint.  The only caller-controlled input is a
+ * public correlation packet; all topology facts come from exact completed
+ * journal records, private capability stores and bounded Docker projections.
+ */
+export declare const createTargetTopologyAttestor: (raw: CreateTargetTopologyAttestorOptions) => TargetTopologyAttestor;

package/dist/target/topologyAttestation.js

@@ -0,0 +1,300 @@
+import { boundedRedactedText, SpawnfileError } from "../shared/index.js";
+import { types as nodeTypes } from "node:util";
+import { parseTargetTopologyAttestationRequest } from "./contracts.js";
+import { createDockerContextSnapshot } from "./dockerContextSnapshot.js";
+import { ORGANIZATION_NETWORK_INSPECTION_FORMAT, ORGANIZATION_EGRESS_NETWORK_INSPECTION_FORMAT, executeDockerOrganizationAttachment, isExpectedOrganizationEgressNetwork, organizationTopologyInspectionFormat, parseExpectedOrganizationNetwork, parseExpectedOrganizationEgressNetwork, createDockerOrganizationAttachmentSpec } from "./organizationAttachmentProvider.js";
+import { executeDockerWorldService, parseExpectedDockerWorldService } from "./dockerWorldServiceProvider.js";
+import { worldServiceSpecForBinding } from "./dockerWorldServiceLifecycle.js";
+import { createCanonicalTargetTopologyReceiptBytes, createTargetTopologyAttestationRequestDigest, createTargetTopologyReceiptDigest } from "./handles.js";
+import { activateDockerWorldService } from "./topologyActivation.js";
+export const TARGET_TOPOLOGY_ATTESTATION_ERROR = "Target topology attestation failed";
+const fail = (reason) => {
+    throw new SpawnfileError("runtime_error", `${TARGET_TOPOLOGY_ATTESTATION_ERROR}: ${reason}`);
+};
+const same = (left, right) => JSON.stringify(left) === JSON.stringify(right);
+const context = (raw) => typeof raw === "string" && /^[a-z][a-z0-9_-]{0,63}$/u.test(raw) ? raw : fail("invalid_context");
+const timeout = (raw) => typeof raw === "number" && Number.isSafeInteger(raw) && raw >= 1 && raw <= 120_000 ? raw : fail("invalid_timeout");
+const claim = (tuple) => ({
+    operationHandle: tuple.operation_handle,
+    requestDigest: tuple.request_digest
+});
+const completed = async (journal, request, tuple, operation) => {
+    const result = await journal.resolveCompletedReceipt(claim(tuple));
+    if (!result)
+        return fail("journal_receipt_missing");
+    const receipt = result.receipt;
+    if (receipt.operation !== operation)
+        return fail("receipt_operation_mismatch");
+    if (receipt.operation_handle !== tuple.operation_handle)
+        return fail("receipt_operation_handle_mismatch");
+    if (receipt.request_digest !== tuple.request_digest)
+        return fail("receipt_request_digest_mismatch");
+    if (receipt.result_handle !== tuple.result_handle)
+        return fail("receipt_result_handle_mismatch");
+    if (receipt.run_id !== request.run_id)
+        return fail("run_id_mismatch");
+    if (receipt.descriptor_digest !== request.descriptor_digest)
+        return fail("descriptor_digest_mismatch");
+    if (!same(receipt.selected_target, request.selected_target))
+        return fail("selected_target_mismatch");
+    return receipt;
+};
+const sameTarget = (left, right) => same(left, { fingerprint: right.fingerprint, handle: right.handle });
+const attachmentSpec = (binding) => createDockerOrganizationAttachmentSpec({
+    containerId: binding.resolution.network_attachment.container_id,
+    dataNetworkOperationHandle: binding.data_network.operation_handle,
+    dataNetworkRequestDigest: binding.data_network.request_digest,
+    deploymentLabels: binding.resolution.network_attachment.deployment_labels,
+    operationHandle: binding.resolution.authorization.operation_handle,
+    organizationHandoffHandle: binding.resolution.authorization.organization_handoff_handle,
+    requestDigest: binding.resolution.authorization.request_digest,
+    runId: binding.resolution.authorization.run_id,
+    selectedTargetHandle: binding.resolution.authorization.selected_target.handle
+});
+const validateAttachment = (binding, request) => {
+    const tuple = request.organization_attachment;
+    if (binding.attachment_handle !== tuple.result_handle
+        || binding.data_network.handle !== request.data_network.result_handle
+        || binding.data_network.operation_handle !== request.data_network.operation_handle
+        || binding.data_network.request_digest !== request.data_network.request_digest
+        || binding.resolution.authorization.operation_handle !== tuple.operation_handle
+        || binding.resolution.authorization.request_digest !== tuple.request_digest
+        || binding.resolution.authorization.run_id !== request.run_id
+        || binding.resolution.authorization.descriptor_digest !== request.descriptor_digest
+        || !sameTarget(binding.resolution.authorization.selected_target, request.selected_target))
+        fail("attachment_binding_mismatch");
+};
+const validateWorldService = (binding, request) => {
+    const create = request.world_service.create;
+    if (binding.world_service_handle !== create.result_handle
+        || binding.resolution.authorization.operation_handle !== create.operation_handle
+        || binding.resolution.authorization.request_digest !== create.request_digest
+        || binding.resolution.authorization.data_network_handle !== request.data_network.result_handle
+        || binding.resources.data_network.handle !== request.data_network.result_handle
+        || binding.resolution.authorization.run_id !== request.run_id
+        || binding.resolution.authorization.descriptor_digest !== request.descriptor_digest
+        || !sameTarget(binding.resolution.authorization.selected_target, request.selected_target))
+        fail("world_service_binding_mismatch");
+};
+const bindSelectedTarget = async (value, options) => {
+    return createDockerContextSnapshot({
+        context: options.context,
+        executor: options.resourceExecutor,
+        selectedTarget: value.selected_target,
+        timeoutMs: options.timeoutMs
+    });
+};
+const inspectBound = async (request, binding, world, target, options) => {
+    const organization = attachmentSpec(binding);
+    if (organization.resultHandle !== binding.attachment_handle
+        || organization.network.resultHandle !== request.data_network.result_handle
+        || organization.network.name !== binding.data_network.name
+        || !same(organization.network.labels, binding.data_network.labels))
+        return fail("attachment_binding_mismatch");
+    const inspectedNetworkId = await (async () => {
+        const networkInspection = await executeDockerOrganizationAttachment({
+            args: [...target, "network", "inspect", "--format",
+                ORGANIZATION_NETWORK_INSPECTION_FORMAT, organization.network.name],
+            executor: options.attachmentExecutor,
+            timeoutMs: options.timeoutMs
+        });
+        return networkInspection.stderr === ""
+            ? parseExpectedOrganizationNetwork(networkInspection.stdout, organization) : null;
+    })();
+    if (inspectedNetworkId === null || inspectedNetworkId !== binding.data_network.id)
+        return fail("data_network_inspection_mismatch");
+    const egressNetwork = await (async () => {
+        const organizationInspection = await executeDockerOrganizationAttachment({
+            args: [...target, "container", "inspect", "--format",
+                organizationTopologyInspectionFormat(organization.network.name), organization.containerId],
+            executor: options.attachmentExecutor,
+            timeoutMs: options.timeoutMs
+        });
+        return organizationInspection.stderr === ""
+            ? parseExpectedOrganizationEgressNetwork(organizationInspection.stdout, organization) : null;
+    })();
+    if (egressNetwork === null)
+        return fail("organization_egress_missing");
+    if (egressNetwork.dataNetworkId !== binding.data_network.id)
+        return fail("organization_egress_data_network_mismatch");
+    const expectedEgress = await (async () => {
+        const egressInspection = await executeDockerOrganizationAttachment({
+            args: [...target, "network", "inspect", "--format",
+                ORGANIZATION_EGRESS_NETWORK_INSPECTION_FORMAT, egressNetwork.name],
+            executor: options.attachmentExecutor,
+            timeoutMs: options.timeoutMs
+        });
+        return egressInspection.stderr === ""
+            && isExpectedOrganizationEgressNetwork(egressInspection.stdout, egressNetwork);
+    })();
+    if (!expectedEgress)
+        return fail("organization_egress_policy_mismatch");
+    const egressAfter = await (async () => {
+        const organizationInspection = await executeDockerOrganizationAttachment({
+            args: [...target, "container", "inspect", "--format",
+                organizationTopologyInspectionFormat(organization.network.name), organization.containerId],
+            executor: options.attachmentExecutor,
+            timeoutMs: options.timeoutMs
+        });
+        return organizationInspection.stderr === ""
+            ? parseExpectedOrganizationEgressNetwork(organizationInspection.stdout, organization) : null;
+    })();
+    if (!egressAfter || egressAfter.id !== egressNetwork.id || egressAfter.name !== egressNetwork.name
+        || egressAfter.dataNetworkId !== binding.data_network.id)
+        return fail("organization_topology_changed");
+    const worldSpec = worldServiceSpecForBinding(world);
+    if (worldSpec.resultHandle !== world.world_service_handle)
+        return fail("world_service_handle_mismatch");
+    const worldInspection = await executeDockerWorldService({
+        args: [...target, "container", "inspect", "--format",
+            worldSpec.inspectionFormat, world.container_id],
+        executor: options.worldExecutor,
+        timeoutMs: options.timeoutMs
+    });
+    if (worldInspection.stderr !== "") {
+        return fail(`world_service_inspection_stderr:${boundedRedactedText(worldInspection.stderr)}`);
+    }
+    let parsedWorld;
+    try {
+        parsedWorld = parseExpectedDockerWorldService(worldInspection.stdout, worldSpec);
+    }
+    catch {
+        parsedWorld = null;
+    }
+    if (!parsedWorld)
+        return fail("world_service_inspection_unparseable");
+    if (parsedWorld.status !== "running")
+        return fail("world_service_status_mismatch");
+    if (parsedWorld.containerId !== world.container_id)
+        return fail("world_service_container_id_mismatch");
+    if (parsedWorld.networkId !== binding.data_network.id)
+        return fail("world_service_network_id_mismatch");
+    const finalNetworkInspection = await executeDockerOrganizationAttachment({
+        args: [...target, "network", "inspect", "--format",
+            ORGANIZATION_NETWORK_INSPECTION_FORMAT, organization.network.name],
+        executor: options.attachmentExecutor,
+        timeoutMs: options.timeoutMs
+    });
+    if (finalNetworkInspection.stderr !== ""
+        || parseExpectedOrganizationNetwork(finalNetworkInspection.stdout, organization) !== binding.data_network.id)
+        return fail("final_data_network_mismatch");
+};
+const inspect = async (request, binding, world, options, afterProof) => {
+    const snapshot = await bindSelectedTarget(request, options);
+    try {
+        await inspectBound(request, binding, world, snapshot.args, options);
+        return await afterProof?.(snapshot.args);
+    }
+    finally {
+        await snapshot.dispose();
+    }
+};
+const receiptFor = (request) => {
+    const body = {
+        descriptor_digest: request.descriptor_digest,
+        handoff_scope: "organization_to_private_service",
+        organization: { data_network_attachment: "exact", egress_policy: "egress_only" },
+        receipt_digest: `sha256:${"0".repeat(64)}`,
+        request_digest: createTargetTopologyAttestationRequestDigest(request),
+        run_id: request.run_id,
+        selected_target: request.selected_target,
+        service_discovery: "dns_only",
+        version: "spawnfile.target-topology-receipt.v1",
+        world_network: "private_internal",
+        world_service: {
+            data_network_attachment: "exactly_one",
+            egress_policy: "none",
+            published_ports: "none"
+        }
+    };
+    const receipt = {
+        ...body,
+        receipt_digest: createTargetTopologyReceiptDigest(body)
+    };
+    const bytes = createCanonicalTargetTopologyReceiptBytes(receipt);
+    return Object.freeze({ receipt, receiptBytes: bytes });
+};
+/**
+ * Builds the read-only owner endpoint.  The only caller-controlled input is a
+ * public correlation packet; all topology facts come from exact completed
+ * journal records, private capability stores and bounded Docker projections.
+ */
+export const createTargetTopologyAttestor = (raw) => {
+    const names = [
+        "attachmentExecutor", "attachmentStore", "context", "resolveJournal",
+        "resourceExecutor", "timeoutMs", "worldExecutor", "worldStore"
+    ];
+    if (!raw || typeof raw !== "object" || Array.isArray(raw) || nodeTypes.isProxy(raw)
+        || Object.getPrototypeOf(raw) !== Object.prototype)
+        return fail("invalid_attestor_options");
+    const keys = Reflect.ownKeys(raw);
+    const descriptors = Object.getOwnPropertyDescriptors(raw);
+    if (keys.length !== names.length || keys.some((key) => typeof key !== "string" || !names.includes(key))
+        || names.some((key) => !Object.hasOwn(descriptors, key))
+        || Object.values(descriptors).some((descriptor) => !descriptor.enumerable || !("value" in descriptor)))
+        return fail("invalid_attestor_shape");
+    const value = Object.fromEntries(names.map((name) => [name, descriptors[name].value]));
+    if (typeof value.resolveJournal !== "function" || typeof value.resourceExecutor !== "function"
+        || typeof value.attachmentExecutor !== "function" || typeof value.worldExecutor !== "function"
+        || !value.attachmentStore || typeof value.attachmentStore.loadAttachment !== "function"
+        || !value.worldStore || typeof value.worldStore.loadService !== "function")
+        return fail("invalid_attestor_dependencies");
+    const options = Object.freeze({ ...value, context: context(value.context), timeoutMs: timeout(value.timeoutMs) });
+    const prove = async (rawRequest, afterProof) => {
+        const request = parseTargetTopologyAttestationRequest(rawRequest);
+        const journal = await options.resolveJournal({
+            descriptorDigest: request.descriptor_digest,
+            runId: request.run_id,
+            selectedTarget: request.selected_target
+        });
+        return journal.withLifecycleLease(async () => {
+            await Promise.all([
+                completed(journal, request, request.data_network, "create_data_network"),
+                completed(journal, request, request.organization_attachment, "attach_organization"),
+                completed(journal, request, request.world_service.create, "create_world_service"),
+                completed(journal, request, request.world_service.start, "start_world_service")
+            ]);
+            const [attachment, world] = await Promise.all([
+                options.attachmentStore.loadAttachment(request.organization_attachment.result_handle),
+                options.worldStore.loadService(request.world_service.create.result_handle)
+            ]);
+            validateAttachment(attachment, request);
+            validateWorldService(world, request);
+            const topology = receiptFor(request);
+            const result = await inspect(request, attachment, world, options, (target) => afterProof(request, topology, world, target));
+            if (result === undefined)
+                return fail("attestation_result_missing");
+            return result;
+        });
+    };
+    return Object.freeze({
+        activate: async (rawRequest) => {
+            try {
+                return await prove(rawRequest, async (_request, topology, world, target) => activateDockerWorldService({
+                    executor: options.worldExecutor,
+                    target,
+                    timeoutMs: options.timeoutMs,
+                    topology: topology.receipt,
+                    world
+                }));
+            }
+            catch (error) {
+                if (error instanceof SpawnfileError
+                    && error.message.startsWith(TARGET_TOPOLOGY_ATTESTATION_ERROR))
+                    throw error;
+                return fail("activation_failed");
+            }
+        },
+        attest: async (rawRequest) => {
+            try {
+                return await prove(rawRequest, async (_request, topology) => topology);
+            }
+            catch (error) {
+                if (error instanceof SpawnfileError
+                    && error.message.startsWith(TARGET_TOPOLOGY_ATTESTATION_ERROR))
+                    throw error;
+                return fail("attestation_failed");
+            }
+        }
+    });
+};

package/dist/target/topologyAttestationErrors.d.ts

@@ -0,0 +1 @@
+export type TopologyAttestationReason = "invalid_context" | "invalid_timeout" | "journal_receipt_missing" | "receipt_operation_mismatch" | "receipt_operation_handle_mismatch" | "receipt_request_digest_mismatch" | "receipt_result_handle_mismatch" | "run_id_mismatch" | "descriptor_digest_mismatch" | "selected_target_mismatch" | "attachment_binding_mismatch" | "world_service_binding_mismatch" | "data_network_inspection_mismatch" | "organization_egress_missing" | "organization_egress_data_network_mismatch" | "organization_egress_policy_mismatch" | "organization_topology_changed" | "world_service_handle_mismatch" | `world_service_inspection_stderr:${string}` | "world_service_inspection_unparseable" | "world_service_status_mismatch" | "world_service_container_id_mismatch" | "world_service_network_id_mismatch" | `activation_stdout_unexpected:${string}` | `activation_stderr_unexpected:${string}` | "world_service_topology_mismatch" | "final_data_network_mismatch" | "invalid_attestor_options" | "invalid_attestor_shape" | "invalid_attestor_dependencies" | "attestation_result_missing" | "activation_failed" | "attestation_failed";

package/dist/target/topologyAttestationErrors.js

@@ -0,0 +1 @@
+export {};

package/dist/target/worldClock.d.ts

@@ -0,0 +1,60 @@
+import { z } from "zod";
+export declare const TARGET_WORLD_CLOCK_REQUEST_VERSION: "spawnfile.target-world-clock.request.v1";
+export declare const TARGET_WORLD_CLOCK_RECEIPT_VERSION: "spawnfile.target-world-clock-receipt.v1";
+export declare const TARGET_WORLD_CLOCK_PATH: "/v1/world/clock";
+export declare const MAX_TARGET_WORLD_CLOCK_BYTES = 8192;
+export declare const targetWorldClockRequestSchema: z.ZodObject<{
+    activation_digest: z.ZodString;
+    activation_receipt_digest: z.ZodString;
+    descriptor_digest: z.ZodString;
+    endpoint: z.ZodObject<{
+        internal_port: z.ZodNumber;
+        path: z.ZodLiteral<"/v1/world/clock">;
+    }, z.core.$strict>;
+    expected: z.ZodObject<{
+        document_version: z.ZodString;
+        world_instance_id: z.ZodPipe<z.ZodString, z.ZodTransform<import("./contracts.js").RunId, string>>;
+    }, z.core.$strict>;
+    run_id: z.ZodPipe<z.ZodString, z.ZodTransform<import("./contracts.js").RunId, string>>;
+    selected_target: z.ZodObject<{
+        fingerprint: z.ZodString;
+        handle: z.ZodPipe<z.ZodString, z.ZodTransform<import("./contracts.js").OpaqueTargetHandle, string>>;
+    }, z.core.$strict>;
+    topology_receipt_digest: z.ZodString;
+    topology_request_digest: z.ZodString;
+    version: z.ZodLiteral<"spawnfile.target-world-clock.request.v1">;
+    world_service_handle: z.ZodPipe<z.ZodString, z.ZodTransform<import("./contracts.js").OpaqueTargetHandle, string>>;
+}, z.core.$strict>;
+export declare const targetWorldClockReceiptSchema: z.ZodObject<{
+    action_count: z.ZodLiteral<0>;
+    activation_digest: z.ZodString;
+    activation_receipt_digest: z.ZodString;
+    clock: z.ZodObject<{
+        completed_tick: z.ZodNumber;
+        next_tick: z.ZodNumber;
+        state: z.ZodLiteral<"running">;
+    }, z.core.$strict>;
+    observation_digest: z.ZodString;
+    receipt_digest: z.ZodString;
+    request_digest: z.ZodString;
+    run_id: z.ZodPipe<z.ZodString, z.ZodTransform<import("./contracts.js").RunId, string>>;
+    topology_receipt_digest: z.ZodString;
+    topology_request_digest: z.ZodString;
+    version: z.ZodLiteral<"spawnfile.target-world-clock-receipt.v1">;
+    world_instance_id: z.ZodPipe<z.ZodString, z.ZodTransform<import("./contracts.js").RunId, string>>;
+    world_service_handle: z.ZodPipe<z.ZodString, z.ZodTransform<import("./contracts.js").OpaqueTargetHandle, string>>;
+}, z.core.$strict>;
+export type TargetWorldClockRequest = z.infer<typeof targetWorldClockRequestSchema>;
+export type TargetWorldClockReceipt = z.infer<typeof targetWorldClockReceiptSchema>;
+export declare const parseTargetWorldClockRequest: (raw: unknown) => TargetWorldClockRequest;
+export declare const createTargetWorldClockRequestDigest: (raw: unknown) => `sha256:${string}`;
+export declare const parseTargetWorldClockReceipt: (raw: unknown) => TargetWorldClockReceipt;
+export declare const createTargetWorldClockReceipt: (input: Readonly<{
+    observation: unknown;
+    request: unknown;
+}>) => TargetWorldClockReceipt;
+export declare const verifyTargetWorldClockReceipt: (input: Readonly<{
+    receipt: unknown;
+    request: unknown;
+}>) => TargetWorldClockReceipt;
+export declare const createCanonicalTargetWorldClockReceiptBytes: (raw: unknown) => string;