spawnfile 0.1.13 → 0.1.17

package/dist/deployment/organizationHandoffTypes.js

@@ -0,0 +1,80 @@
+import { createHash } from "node:crypto";
+import { z } from "zod";
+import { assertOrdinaryJsonGraph, parseOpaqueTargetHandle, parseRunId } from "../target/index.js";
+export const ORGANIZATION_HANDOFF_VERSION = "spawnfile.organization-handoff.v1";
+const digestSchema = z.string().regex(/^sha256:[a-f0-9]{64}$/u);
+const lifecycleReceiptsSchema = z.object({
+    down: z.literal("spawnfile.down-receipt.v1"),
+    export: z.literal("spawnfile.export-index.v1"),
+    up: z.literal("spawnfile.up-receipt.v1")
+}).strict();
+const parseError = (label, detail) => {
+    throw new Error(`invalid ${ORGANIZATION_HANDOFF_VERSION} ${label}: ${detail}`);
+};
+export const parseCanonicalSha256Digest = (value, label = "digest") => {
+    const parsed = digestSchema.safeParse(value);
+    if (!parsed.success)
+        parseError(label, "must be a canonical sha256 digest");
+    return parsed.data;
+};
+const lifecycleReceipts = {
+    down: "spawnfile.down-receipt.v1",
+    export: "spawnfile.export-index.v1",
+    up: "spawnfile.up-receipt.v1"
+};
+const canonicalDerivationBytes = (input) => [
+    "spawnfile.organization-handoff.v1\0",
+    input.run_id,
+    input.selected_target_receipt_digest,
+    input.network_attachment_handle,
+    input.binding_digest,
+    input.lifecycle_receipts.up,
+    input.lifecycle_receipts.export,
+    input.lifecycle_receipts.down
+].join("\n");
+export const createOrganizationDeploymentHandle = (input) => `sf-oh1-${createHash("sha256").update(canonicalDerivationBytes(input), "utf8").digest("hex")}`;
+export const createOrganizationHandoff = (runId, input) => {
+    const handoff = {
+        binding_digest: parseCanonicalSha256Digest(input.bindingDigest, "binding_digest"),
+        lifecycle_receipts: lifecycleReceipts,
+        network_attachment_handle: parseOpaqueTargetHandle(input.networkAttachmentHandle),
+        run_id: parseRunId(runId),
+        selected_target_receipt_digest: parseCanonicalSha256Digest(input.selectedTargetReceiptDigest, "selected_target_receipt_digest")
+    };
+    return {
+        ...handoff,
+        deployment_handle: createOrganizationDeploymentHandle(handoff),
+        version: ORGANIZATION_HANDOFF_VERSION
+    };
+};
+const organizationHandoffSchema = z.object({
+    binding_digest: digestSchema,
+    deployment_handle: z.string().regex(/^sf-oh1-[a-f0-9]{64}$/u),
+    lifecycle_receipts: lifecycleReceiptsSchema,
+    network_attachment_handle: z.string(),
+    run_id: z.string(),
+    selected_target_receipt_digest: digestSchema,
+    version: z.literal(ORGANIZATION_HANDOFF_VERSION)
+}).strict();
+export const parseOrganizationHandoff = (value) => {
+    try {
+        assertOrdinaryJsonGraph(value);
+        const parsed = organizationHandoffSchema.safeParse(value);
+        if (!parsed.success)
+            throw new TypeError();
+        const handoff = {
+            binding_digest: parseCanonicalSha256Digest(parsed.data.binding_digest, "binding_digest"),
+            lifecycle_receipts: parsed.data.lifecycle_receipts,
+            network_attachment_handle: parseOpaqueTargetHandle(parsed.data.network_attachment_handle),
+            run_id: parseRunId(parsed.data.run_id),
+            selected_target_receipt_digest: parseCanonicalSha256Digest(parsed.data.selected_target_receipt_digest, "selected_target_receipt_digest")
+        };
+        const expectedHandle = createOrganizationDeploymentHandle(handoff);
+        if (parsed.data.deployment_handle !== expectedHandle)
+            throw new TypeError();
+        return { ...handoff, deployment_handle: expectedHandle, version: ORGANIZATION_HANDOFF_VERSION };
+    }
+    catch {
+        return parseError("artifact", "must be a bounded canonical handoff");
+    }
+};

package/dist/deployment/organizationReady.d.ts

@@ -0,0 +1,54 @@
+import { z } from "zod";
+import type { OrganizationReadinessEvidence } from "../compiler/organizationReadyEvidence.js";
+import type { DockerUnitInspection } from "./dockerInspect.js";
+export declare const ORGANIZATION_READY_VERSION: "spawnfile.organization-ready.v1";
+declare const codes: readonly ["organization_ready", "external_moltnet", "compiled_evidence_missing", "unit_unavailable", "unit_restarted", "probe_unavailable", "identity_mismatch", "topology_mismatch", "probe_timeout", "probe_cancelled"];
+export type OrganizationReadyCode = (typeof codes)[number];
+export type OrganizationReadyState = "ready" | "pending" | "failed" | "cancelled";
+export interface OrganizationReadiness {
+    readonly version: typeof ORGANIZATION_READY_VERSION;
+    readonly run_id: string | null;
+    readonly compile_fingerprint: string;
+    readonly unit_id: string;
+    readonly world_binding_digest: string | null;
+    readonly state: OrganizationReadyState;
+    readonly code: OrganizationReadyCode;
+    readonly reason?: string;
+}
+export interface OrganizationReadinessProbeData {
+    readonly daimonReceipt?: string | null;
+    readonly configs: ReadonlyMap<string, string>;
+    readonly attachmentReceipts?: ReadonlyMap<string, string>;
+    readonly networks: readonly {
+        readonly healthOk: boolean;
+        readonly id: string;
+    }[];
+    readonly worldBindings: string | null;
+}
+export interface ReconcileOrganizationReadinessInput {
+    readonly evidence: OrganizationReadinessEvidence;
+    readonly inspection: DockerUnitInspection | null;
+    readonly record: {
+        readonly compileFingerprint: string;
+        readonly deploymentName: string;
+        readonly runId: string | null;
+        readonly unitCount: number;
+        readonly unitId: string;
+    };
+    readonly probe: OrganizationReadinessProbeData | null;
+}
+export declare const organizationReadinessSchema: z.ZodPreprocess<z.ZodObject<{
+    code: z.ZodUnion<readonly [z.ZodLiteral<"organization_ready">, z.ZodLiteral<"external_moltnet">, z.ZodLiteral<"compiled_evidence_missing">, z.ZodLiteral<"unit_unavailable">, z.ZodLiteral<"unit_restarted">, z.ZodLiteral<"probe_unavailable">, z.ZodLiteral<"identity_mismatch">, z.ZodLiteral<"topology_mismatch">, z.ZodLiteral<"probe_timeout">, z.ZodLiteral<"probe_cancelled">]>;
+    compile_fingerprint: z.ZodString;
+    run_id: z.ZodNullable<z.ZodString>;
+    state: z.ZodUnion<readonly [z.ZodLiteral<"ready">, z.ZodLiteral<"pending">, z.ZodLiteral<"failed">, z.ZodLiteral<"cancelled">]>;
+    unit_id: z.ZodString;
+    version: z.ZodLiteral<"spawnfile.organization-ready.v1">;
+    world_binding_digest: z.ZodNullable<z.ZodString>;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>>;
+export declare const createOrganizationReadinessPending: (evidence: OrganizationReadinessEvidence, record: ReconcileOrganizationReadinessInput["record"]) => OrganizationReadiness;
+export declare const parseOrganizationReadiness: (value: unknown) => OrganizationReadiness;
+export declare const reconcileOrganizationReadiness: (input: ReconcileOrganizationReadinessInput) => OrganizationReadiness;
+export declare const organizationReadinessFromProbeError: (evidence: OrganizationReadinessEvidence, record: ReconcileOrganizationReadinessInput["record"], error: unknown) => OrganizationReadiness;
+export {};

package/dist/deployment/organizationReady.js

@@ -0,0 +1,232 @@
+import { createHash } from "node:crypto";
+import { types as nodeTypes } from "node:util";
+import { z } from "zod";
+export const ORGANIZATION_READY_VERSION = "spawnfile.organization-ready.v1";
+const ID = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$/u;
+const FINGERPRINT = /^sf1:[a-f0-9]{12}$/u;
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+const codes = [
+    "organization_ready",
+    "external_moltnet",
+    "compiled_evidence_missing",
+    "unit_unavailable",
+    "unit_restarted",
+    "probe_unavailable",
+    "identity_mismatch",
+    "topology_mismatch",
+    "probe_timeout",
+    "probe_cancelled"
+];
+const isPlainRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value)
+    && Object.getPrototypeOf(value) === Object.prototype && !nodeTypes.isProxy(value);
+const organizationReadinessObjectSchema = z.object({
+    code: z.union([
+        z.literal("organization_ready"), z.literal("external_moltnet"),
+        z.literal("compiled_evidence_missing"), z.literal("unit_unavailable"),
+        z.literal("unit_restarted"), z.literal("probe_unavailable"),
+        z.literal("identity_mismatch"), z.literal("topology_mismatch"),
+        z.literal("probe_timeout"), z.literal("probe_cancelled")
+    ]),
+    compile_fingerprint: z.string(),
+    run_id: z.string().nullable(),
+    state: z.union([
+        z.literal("ready"), z.literal("pending"), z.literal("failed"), z.literal("cancelled")
+    ]),
+    unit_id: z.string(),
+    version: z.literal(ORGANIZATION_READY_VERSION),
+    world_binding_digest: z.string().nullable(),
+    reason: z.string().min(1).max(512).optional()
+}).strict().superRefine((result, context) => {
+    if (!FINGERPRINT.test(result.compile_fingerprint)) {
+        context.addIssue({ code: z.ZodIssueCode.custom, path: ["compile_fingerprint"], message: "invalid fingerprint" });
+    }
+    if (!ID.test(result.unit_id)) {
+        context.addIssue({ code: z.ZodIssueCode.custom, path: ["unit_id"], message: "invalid unit id" });
+    }
+    if (result.run_id !== null && !ID.test(result.run_id)) {
+        context.addIssue({ code: z.ZodIssueCode.custom, path: ["run_id"], message: "invalid run id" });
+    }
+    if (result.world_binding_digest !== null && !DIGEST.test(result.world_binding_digest)) {
+        context.addIssue({ code: z.ZodIssueCode.custom, path: ["world_binding_digest"], message: "invalid digest" });
+    }
+    if (!validStateCode(result.state, result.code)) {
+        context.addIssue({ code: z.ZodIssueCode.custom, path: ["state"], message: "invalid state/code combination" });
+    }
+    if (result.state === "ready" && result.run_id === null) {
+        context.addIssue({ code: z.ZodIssueCode.custom, path: ["state"], message: "ready requires run_id" });
+    }
+});
+export const organizationReadinessSchema = z.preprocess((value) => isPlainRecord(value) ? value : null, organizationReadinessObjectSchema);
+const exact = (value, fields) => {
+    if (!isPlainRecord(value))
+        return null;
+    const keys = Object.keys(value);
+    return keys.length === fields.length
+        && keys.every((key) => fields.includes(key))
+        && fields.every((field) => Object.hasOwn(value, field))
+        ? value
+        : null;
+};
+const sameSet = (left, right) => left.length === right.length
+    && new Set(left).size === left.length
+    && new Set(right).size === right.length
+    && left.every((entry) => right.includes(entry));
+const create = (input) => ({
+    code: input.code,
+    compile_fingerprint: input.compileFingerprint,
+    run_id: input.runId,
+    state: input.state,
+    unit_id: input.unitId,
+    version: ORGANIZATION_READY_VERSION,
+    world_binding_digest: input.worldBindingDigest,
+    ...(input.reason ? { reason: input.reason } : {})
+});
+const correlation = (evidence, record, state, code) => create({
+    code,
+    compileFingerprint: evidence.compileFingerprint,
+    runId: record.runId,
+    state,
+    unitId: record.unitId,
+    worldBindingDigest: evidence.worldBindings?.digest ?? null
+});
+const validStateCode = (state, code) => (state === "ready" && code === "organization_ready")
+    || (state === "pending" && [
+        "external_moltnet", "compiled_evidence_missing", "unit_unavailable", "unit_restarted", "probe_unavailable"
+    ].includes(code))
+    || (state === "failed" && ["identity_mismatch", "topology_mismatch", "probe_timeout"].includes(code))
+    || (state === "cancelled" && code === "probe_cancelled");
+export const createOrganizationReadinessPending = (evidence, record) => correlation(evidence, record, "pending", evidence.hasExternalMoltnet ? "external_moltnet" : evidence.worldBindings ? "probe_unavailable" : "compiled_evidence_missing");
+export const parseOrganizationReadiness = (value) => {
+    const parsed = organizationReadinessSchema.safeParse(value);
+    if (!parsed.success) {
+        throw new Error(`invalid ${ORGANIZATION_READY_VERSION}`);
+    }
+    const result = {
+        code: parsed.data.code,
+        compile_fingerprint: parsed.data.compile_fingerprint,
+        run_id: parsed.data.run_id,
+        state: parsed.data.state,
+        unit_id: parsed.data.unit_id,
+        version: ORGANIZATION_READY_VERSION,
+        world_binding_digest: parsed.data.world_binding_digest,
+        ...(parsed.data.reason ? { reason: parsed.data.reason } : {})
+    };
+    return result;
+};
+const hash = (content) => `sha256:${createHash("sha256").update(content).digest("hex")}`;
+const validNodeConfig = (content, expectedDigest) => {
+    if (!content || hash(content) !== expectedDigest)
+        return false;
+    try {
+        const config = JSON.parse(content);
+        return isPlainRecord(config) && config.version === "moltnet.node.v1";
+    }
+    catch {
+        return false;
+    }
+};
+const validBindings = (evidence, content) => {
+    if (evidence.worldBindings === null)
+        return content === null;
+    if (!content || !evidence.worldBindings || hash(content) !== evidence.worldBindings.digest)
+        return false;
+    try {
+        const body = exact(JSON.parse(content), ["schema", "bindings"]);
+        if (!body || body.schema !== evidence.worldBindings.schema || !Array.isArray(body.bindings))
+            return false;
+        const members = body.bindings.map((entry) => {
+            const binding = exact(entry, [
+                "member", "run_id", "world_instance_id", "capability_manifest_digest", "token_env", "json", "mcp"
+            ]);
+            const member = binding ? exact(binding.member, ["id", "principal_id"]) : null;
+            return member && typeof member.id === "string" && member.principal_id === `agent:${member.id}` && ID.test(member.id)
+                ? member.id
+                : null;
+        });
+        return members.every((member) => member !== null)
+            && sameSet(members, evidence.worldBindings.assignments.map((assignment) => assignment.memberId));
+    }
+    catch {
+        return false;
+    }
+};
+const validDaimon = (evidence, content) => {
+    if (evidence.daimon == null)
+        return content == null;
+    try {
+        const value = exact(JSON.parse(content ?? ""), ["version", "agents"]);
+        if (value?.version !== "noopolis.daimon.readiness-receipt.v1" || !Array.isArray(value.agents))
+            return false;
+        const agents = value.agents.map((entry) => { const item = exact(entry, ["agent_id", "engine"]); return item && typeof item.agent_id === "string" && typeof item.engine === "string" ? [item.agent_id, item.engine] : null; });
+        return agents.every(Boolean) && JSON.stringify(agents) === JSON.stringify(evidence.daimon.agents.map((agent) => [agent.agentId, agent.engine]));
+    }
+    catch {
+        return false;
+    }
+};
+const validAttachmentReceipts = (evidence, receipts) => {
+    const expected = evidence.networks.flatMap((network) => network.nodes.map((node) => ({ networkId: network.id, memberId: node.memberId, path: node.receiptPath })));
+    if (!receipts || receipts.size !== expected.length)
+        return expected.length === 0;
+    return expected.every((entry) => {
+        try {
+            const body = exact(JSON.parse(receipts.get(entry.path) ?? ""), ["version", "attachments"]);
+            if (body?.version !== "moltnet.node-readiness.v1" || !Array.isArray(body.attachments))
+                return false;
+            return body.attachments.length === 1 && body.attachments.every((value) => { const attachment = exact(value, ["network_id", "agent_id"]); return attachment?.network_id === entry.networkId && attachment.agent_id === entry.memberId; });
+        }
+        catch {
+            return false;
+        }
+    });
+};
+export const reconcileOrganizationReadiness = (input) => {
+    const { evidence, inspection, record } = input;
+    if (evidence.hasExternalMoltnet)
+        return correlation(evidence, record, "pending", "external_moltnet");
+    if (!record.runId)
+        return correlation(evidence, record, "pending", "compiled_evidence_missing");
+    if (record.unitCount !== 1 || !inspection || inspection.running !== true || inspection.exists !== true) {
+        return correlation(evidence, record, "pending", "unit_unavailable");
+    }
+    if (inspection.restartCount !== 0)
+        return correlation(evidence, record, "pending", "unit_restarted");
+    const identity = inspection.identity;
+    if (!identity)
+        return correlation(evidence, record, "pending", "probe_unavailable");
+    if (inspection.drift.length > 0 || record.compileFingerprint !== evidence.compileFingerprint
+        || identity.compileFingerprint !== evidence.compileFingerprint || identity.deployment !== record.deploymentName
+        || identity.project !== evidence.projectLabel || identity.runId !== record.runId
+        || identity.unit !== record.unitId || identity.version !== evidence.compileVersion) {
+        return correlation(evidence, record, "failed", "identity_mismatch");
+    }
+    if (!input.probe || !validDaimon(evidence, input.probe.daimonReceipt) || !validAttachmentReceipts(evidence, input.probe.attachmentReceipts) || input.probe.networks.length !== evidence.networks.length
+        || !evidence.networks.every((network) => {
+            const live = input.probe?.networks.find((candidate) => candidate.id === network.id);
+            return live?.healthOk === true;
+        })
+        || !evidence.networks.every((network) => network.nodes.every((node) => validNodeConfig(input.probe.configs.get(node.configPath), node.sha256)))
+        || !validBindings(evidence, input.probe.worldBindings)) {
+        return correlation(evidence, record, "failed", "topology_mismatch");
+    }
+    return correlation(evidence, record, "ready", "organization_ready");
+};
+export const organizationReadinessFromProbeError = (evidence, record, error) => {
+    const name = error instanceof Error ? error.name : "";
+    const message = error instanceof Error ? error.message : "";
+    if (name === "TimeoutError" || /timeout|timed out/iu.test(message)) {
+        return { ...correlation(evidence, record, "failed", "probe_timeout"), reason: boundedReadinessReason(message) };
+    }
+    if (name === "AbortError" || /cancel|abort/iu.test(message)) {
+        return { ...correlation(evidence, record, "cancelled", "probe_cancelled"), reason: boundedReadinessReason(message) };
+    }
+    if (/\bHTTP 4\d{2}\b/iu.test(message)) {
+        return { ...correlation(evidence, record, "failed", "topology_mismatch"), reason: boundedReadinessReason(message) };
+    }
+    return { ...correlation(evidence, record, "pending", "probe_unavailable"), reason: boundedReadinessReason(message) };
+};
+const boundedReadinessReason = (message) => message
+    .replace(/\s+/gu, " ")
+    .replace(/(bearer|token|password|passwd|secret|authorization)[=: ]+(?:bearer[ ]+)?[^ ]+/giu, "$1=[redacted]")
+    .replace(/https?:\/\/[^ ]+/giu, "[url redacted]")
+    .slice(0, 512) || "probe unavailable";

package/dist/deployment/privateArtifactsExport.d.ts

@@ -0,0 +1,18 @@
+import type { CompileReport } from "../report/index.js";
+import { type DockerArtifactExecFile } from "./artifactsExportDocker.js";
+import type { ExportIndexFile } from "./artifactsExportTypes.js";
+import type { DeploymentRecord } from "./record.js";
+export interface PrivateArtifactsExportResult {
+    readonly files: readonly ExportIndexFile[];
+    readonly missing: readonly string[];
+}
+/** Explicit opt-in egress for unredacted runtime training artifacts. */
+export declare const exportPrivateRuntimeArtifacts: (input: Readonly<{
+    containerRef: string;
+    destinationDirectory: string;
+    dockerCommand: string;
+    execFile: DockerArtifactExecFile;
+    report: CompileReport;
+    target: DeploymentRecord["target"];
+    timeoutMs: number;
+}>) => Promise<PrivateArtifactsExportResult>;

package/dist/deployment/privateArtifactsExport.js

@@ -0,0 +1,80 @@
+import { createHash } from "node:crypto";
+import { lstat, readFile, readdir, rm } from "node:fs/promises";
+import path from "node:path";
+import { ensureDirectory } from "../filesystem/index.js";
+import { copyContainerFileToHost, } from "./artifactsExportDocker.js";
+const plans = (report) => (report.container?.runtime_instances ?? [])
+    .filter((instance) => (instance.runtime === "pi" || instance.runtime === "daimon")
+    && instance.home_path !== null)
+    .flatMap((instance) => {
+    const instanceRoot = path.posix.dirname(instance.home_path);
+    return (instance.node_ids ?? [])
+        .filter((nodeId) => nodeId.startsWith("agent:"))
+        .map((nodeId) => nodeId.slice("agent:".length))
+        .filter((slug) => /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(slug))
+        .map((slug) => Object.freeze({
+        containerPath: `${instanceRoot}/runtime/agents/${slug}/private-training/pi/raw`,
+        relativePath: `private/daimon/${slug}/private-training/pi/raw`,
+    }));
+});
+const filesUnder = async (root) => {
+    if (!(await lstat(root)).isDirectory()) {
+        throw new Error("Private artifact export source is not a directory");
+    }
+    const files = [];
+    const pending = [root];
+    while (pending.length > 0) {
+        const directory = pending.pop();
+        for (const entry of await readdir(directory, { withFileTypes: true })) {
+            const child = path.join(directory, entry.name);
+            if (entry.isSymbolicLink() || !entry.isDirectory() && !entry.isFile()) {
+                throw new Error("Private artifact export rejects non-regular entries");
+            }
+            if (entry.isDirectory())
+                pending.push(child);
+            else
+                files.push(path.relative(root, child).split(path.sep).join("/"));
+        }
+    }
+    return Object.freeze(files.sort());
+};
+const digest = (bytes) => createHash("sha256").update(bytes).digest("hex");
+/** Explicit opt-in egress for unredacted runtime training artifacts. */
+export const exportPrivateRuntimeArtifacts = async (input) => {
+    const output = [];
+    const missing = [];
+    for (const plan of plans(input.report)) {
+        const destination = path.join(input.destinationDirectory, ...plan.relativePath.split("/"));
+        await ensureDirectory(path.dirname(destination));
+        const copied = await copyContainerFileToHost({
+            containerPath: plan.containerPath,
+            containerRef: input.containerRef,
+            dockerCommand: input.dockerCommand,
+            execFile: input.execFile,
+            hostPath: destination,
+            target: input.target,
+            timeoutMs: input.timeoutMs,
+        });
+        if (!copied) {
+            await rm(destination, { force: true, recursive: true });
+            missing.push(plan.relativePath);
+            continue;
+        }
+        for (const relative of await filesUnder(destination)) {
+            const bytes = await readFile(path.join(destination, ...relative.split("/")));
+            output.push({
+                bytes: bytes.byteLength,
+                path: `${plan.relativePath}/${relative}`,
+                sha256: digest(bytes),
+                source: {
+                    kind: "container",
+                    ref: `${input.containerRef}:${plan.containerPath}/${relative}`,
+                },
+            });
+        }
+    }
+    return Object.freeze({
+        files: Object.freeze(output),
+        missing: Object.freeze(missing),
+    });
+};

package/dist/deployment/productStateClone.d.ts

@@ -0,0 +1,43 @@
+type DockerExec = (command: string, args: string[]) => Promise<{
+    stdout: string;
+}>;
+export declare const issueProductStateSourceAuthority: (input: {
+    dockerCommand: string;
+    container: string;
+    sourceRunId: string;
+    mountPath: string;
+    candidateVolumeName: string;
+    candidateResourceIdentity: string;
+}, docker?: DockerExec) => Promise<Record<string, unknown>>;
+export declare const createProductStateProof: (source: string, sourceRunId: string) => Promise<Record<string, unknown>>;
+export declare const issueProductStateSourceSnapshot: (input: {
+    dockerCommand: string;
+    container: string;
+    sourceRunId: string;
+    mountPath: string;
+    candidateVolumeName: string;
+    candidateResourceIdentity: string;
+}, docker?: DockerExec) => Promise<{
+    authority: Record<string, unknown>;
+    proof: Record<string, unknown>;
+}>;
+export declare const cloneQuiescedProductState: (input: {
+    source: string;
+    destination: string;
+    proof: unknown;
+    candidateRunId: string;
+    activationIdentity?: string;
+}) => Promise<{
+    files: number;
+    source_run_id: string;
+    candidate_run_id: string;
+}>;
+export declare const runProductStateCloneWorkflow: (input: {
+    authorityReceiptPath: string;
+    dockerCommand: string;
+    destination: string;
+    proofPath: string;
+    receiptPath: string;
+    candidateRunId: string;
+}, docker?: DockerExec) => Promise<Record<string, unknown>>;
+export {};