spawnfile 0.1.13 → 0.1.17

package/dist/target/contracts.d.ts

@@ -0,0 +1,538 @@
+import { z } from "zod";
+import { targetResourceExportIndexSchema } from "./evidenceExportContract.js";
+export { TARGET_EXPORT_INDEX_VERSION, targetResourceExportIndexSchema } from "./evidenceExportContract.js";
+export declare const TARGET_RESOURCE_REQUEST_VERSION: "spawnfile.target-resource.request.v1";
+export declare const TARGET_RESOURCE_RECEIPT_VERSION: "spawnfile.target-resource.receipt.v1";
+export declare const SELECTED_TARGET_VERSION: "spawnfile.target-resource.selected-target.v1";
+export declare const TARGET_JOURNAL_VERSION: "spawnfile.target-resource.journal.v1";
+export declare const TARGET_OPERATION_LOOKUP_VERSION: "spawnfile.target-resource.operation-lookup.v1";
+/**
+ * Read-only owner attestation.  This is deliberately not a target-resource
+ * mutation: it neither reserves a journal operation nor grants a Docker
+ * capability to its caller.
+ */
+export declare const TARGET_TOPOLOGY_ATTESTATION_REQUEST_VERSION: "spawnfile.target-topology-attestation.request.v1";
+export declare const TARGET_TOPOLOGY_RECEIPT_VERSION: "spawnfile.target-topology-receipt.v1";
+declare const runIdBrand: unique symbol;
+export type RunId = string & {
+    readonly [runIdBrand]: "RunId";
+};
+export declare const runIdSchema: z.ZodPipe<z.ZodString, z.ZodTransform<RunId, string>>;
+export declare const parseRunId: (raw: unknown) => RunId;
+declare const opaqueTargetHandleBrand: unique symbol;
+export type OpaqueTargetHandle = string & {
+    readonly [opaqueTargetHandleBrand]: "OpaqueTargetHandle";
+};
+export declare const opaqueTargetHandleSchema: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+export declare const parseOpaqueTargetHandle: (raw: unknown) => OpaqueTargetHandle;
+export declare const selectedTargetSchema: z.ZodObject<{
+    fingerprint: z.ZodString;
+    handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+}, z.core.$strict>;
+export declare const targetResourceRequestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    idempotency_key: z.ZodString;
+    operation: z.ZodLiteral<"select_target">;
+    target_reference: z.ZodString;
+    version: z.ZodLiteral<"spawnfile.target-resource.request.v1">;
+}, z.core.$strict>, z.ZodObject<{
+    artifact_manifest_digest: z.ZodString;
+    operation: z.ZodLiteral<"resolve_world_artifact">;
+    version: z.ZodLiteral<"spawnfile.target-resource.request.v1">;
+    descriptor_digest: z.ZodString;
+    expected_revision: z.ZodNumber;
+    idempotency_key: z.ZodString;
+    run_id: z.ZodPipe<z.ZodString, z.ZodTransform<RunId, string>>;
+    selected_target: z.ZodObject<{
+        fingerprint: z.ZodString;
+        handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    bindings: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        scope: z.ZodString;
+        source_handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    }, z.core.$strict>>;
+    operation: z.ZodLiteral<"prepare_secret_bindings">;
+    version: z.ZodLiteral<"spawnfile.target-resource.request.v1">;
+    descriptor_digest: z.ZodString;
+    expected_revision: z.ZodNumber;
+    idempotency_key: z.ZodString;
+    run_id: z.ZodPipe<z.ZodString, z.ZodTransform<RunId, string>>;
+    selected_target: z.ZodObject<{
+        fingerprint: z.ZodString;
+        handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    operation: z.ZodLiteral<"create_data_network">;
+    version: z.ZodLiteral<"spawnfile.target-resource.request.v1">;
+    descriptor_digest: z.ZodString;
+    expected_revision: z.ZodNumber;
+    idempotency_key: z.ZodString;
+    run_id: z.ZodPipe<z.ZodString, z.ZodTransform<RunId, string>>;
+    selected_target: z.ZodObject<{
+        fingerprint: z.ZodString;
+        handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    operation: z.ZodLiteral<"create_evidence_volume">;
+    version: z.ZodLiteral<"spawnfile.target-resource.request.v1">;
+    descriptor_digest: z.ZodString;
+    expected_revision: z.ZodNumber;
+    idempotency_key: z.ZodString;
+    run_id: z.ZodPipe<z.ZodString, z.ZodTransform<RunId, string>>;
+    selected_target: z.ZodObject<{
+        fingerprint: z.ZodString;
+        handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    data_network_handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    organization_handoff_handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    operation: z.ZodLiteral<"attach_organization">;
+    version: z.ZodLiteral<"spawnfile.target-resource.request.v1">;
+    descriptor_digest: z.ZodString;
+    expected_revision: z.ZodNumber;
+    idempotency_key: z.ZodString;
+    run_id: z.ZodPipe<z.ZodString, z.ZodTransform<RunId, string>>;
+    selected_target: z.ZodObject<{
+        fingerprint: z.ZodString;
+        handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    data_network_handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    evidence_mount_path: z.ZodString;
+    evidence_volume_handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    operation: z.ZodLiteral<"create_world_service">;
+    secret_bindings_handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    world_artifact_handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    version: z.ZodLiteral<"spawnfile.target-resource.request.v1">;
+    descriptor_digest: z.ZodString;
+    expected_revision: z.ZodNumber;
+    idempotency_key: z.ZodString;
+    run_id: z.ZodPipe<z.ZodString, z.ZodTransform<RunId, string>>;
+    selected_target: z.ZodObject<{
+        fingerprint: z.ZodString;
+        handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    operation: z.ZodLiteral<"start_world_service" | "stop_world_service">;
+    world_service_handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    version: z.ZodLiteral<"spawnfile.target-resource.request.v1">;
+    descriptor_digest: z.ZodString;
+    expected_revision: z.ZodNumber;
+    idempotency_key: z.ZodString;
+    run_id: z.ZodPipe<z.ZodString, z.ZodTransform<RunId, string>>;
+    selected_target: z.ZodObject<{
+        fingerprint: z.ZodString;
+        handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    operation: z.ZodLiteral<"start_world_service" | "stop_world_service">;
+    world_service_handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    version: z.ZodLiteral<"spawnfile.target-resource.request.v1">;
+    descriptor_digest: z.ZodString;
+    expected_revision: z.ZodNumber;
+    idempotency_key: z.ZodString;
+    run_id: z.ZodPipe<z.ZodString, z.ZodTransform<RunId, string>>;
+    selected_target: z.ZodObject<{
+        fingerprint: z.ZodString;
+        handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    data_network_handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    operation: z.ZodLiteral<"detach_organization">;
+    organization_attachment_handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    version: z.ZodLiteral<"spawnfile.target-resource.request.v1">;
+    descriptor_digest: z.ZodString;
+    expected_revision: z.ZodNumber;
+    idempotency_key: z.ZodString;
+    run_id: z.ZodPipe<z.ZodString, z.ZodTransform<RunId, string>>;
+    selected_target: z.ZodObject<{
+        fingerprint: z.ZodString;
+        handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    evidence_volume_handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    operation: z.ZodLiteral<"export_evidence_volume">;
+    version: z.ZodLiteral<"spawnfile.target-resource.request.v1">;
+    descriptor_digest: z.ZodString;
+    expected_revision: z.ZodNumber;
+    idempotency_key: z.ZodString;
+    run_id: z.ZodPipe<z.ZodString, z.ZodTransform<RunId, string>>;
+    selected_target: z.ZodObject<{
+        fingerprint: z.ZodString;
+        handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    operation: z.ZodLiteral<"revoke_secret_bindings">;
+    secret_bindings_handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    version: z.ZodLiteral<"spawnfile.target-resource.request.v1">;
+    descriptor_digest: z.ZodString;
+    expected_revision: z.ZodNumber;
+    idempotency_key: z.ZodString;
+    run_id: z.ZodPipe<z.ZodString, z.ZodTransform<RunId, string>>;
+    selected_target: z.ZodObject<{
+        fingerprint: z.ZodString;
+        handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    cleanup_policy: z.ZodEnum<{
+        discard_evidence: "discard_evidence";
+        remove: "remove";
+        preserve_evidence: "preserve_evidence";
+    }>;
+    evidence_volume_handle: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>>;
+    operation: z.ZodLiteral<"cleanup_run">;
+    organization_attachment_handle: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>>;
+    secret_bindings_handle: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>>;
+    version: z.ZodLiteral<"spawnfile.target-resource.request.v1">;
+    world_service_handle: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>>;
+    descriptor_digest: z.ZodString;
+    expected_revision: z.ZodNumber;
+    idempotency_key: z.ZodString;
+    run_id: z.ZodPipe<z.ZodString, z.ZodTransform<RunId, string>>;
+    selected_target: z.ZodObject<{
+        fingerprint: z.ZodString;
+        handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    operation: z.ZodLiteral<"recover_operation">;
+    operation_handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    version: z.ZodLiteral<"spawnfile.target-resource.request.v1">;
+    descriptor_digest: z.ZodString;
+    expected_revision: z.ZodNumber;
+    idempotency_key: z.ZodString;
+    run_id: z.ZodPipe<z.ZodString, z.ZodTransform<RunId, string>>;
+    selected_target: z.ZodObject<{
+        fingerprint: z.ZodString;
+        handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    }, z.core.$strict>;
+}, z.core.$strict>], "operation">;
+export declare const targetResourceReceiptSchema: z.ZodObject<{
+    cleanup_state: z.ZodNullable<z.ZodEnum<{
+        preserved: "preserved";
+        incomplete: "incomplete";
+        not_requested: "not_requested";
+        removed: "removed";
+    }>>;
+    descriptor_digest: z.ZodNullable<z.ZodString>;
+    evidence_index: z.ZodOptional<z.ZodObject<{
+        evidence_digest: z.ZodString;
+        export_handle: z.ZodString;
+        files: z.ZodArray<z.ZodObject<{
+            bytes: z.ZodNumber;
+            path: z.ZodUnion<[z.ZodString, z.ZodLiteral<".spawnfile/world-service-activated.v1">]>;
+            sha256: z.ZodString;
+        }, z.core.$strict>>;
+        item_count: z.ZodNumber;
+        labels: z.ZodArray<z.ZodObject<{
+            key: z.ZodString;
+            value: z.ZodString;
+        }, z.core.$strict>>;
+        run_id: z.ZodString;
+        source: z.ZodObject<{
+            evidence_volume_handle: z.ZodString;
+            state: z.ZodLiteral<"preserved">;
+        }, z.core.$strict>;
+        state: z.ZodEnum<{
+            exported: "exported";
+            incomplete: "incomplete";
+        }>;
+        version: z.ZodLiteral<"spawnfile.target-resource.export-index.v1">;
+    }, z.core.$strict>>;
+    export_state: z.ZodNullable<z.ZodEnum<{
+        exported: "exported";
+        incomplete: "incomplete";
+        not_requested: "not_requested";
+    }>>;
+    labels: z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        value: z.ZodString;
+    }, z.core.$strict>>;
+    operation: z.ZodEnum<{
+        select_target: "select_target";
+        resolve_world_artifact: "resolve_world_artifact";
+        prepare_secret_bindings: "prepare_secret_bindings";
+        create_data_network: "create_data_network";
+        create_evidence_volume: "create_evidence_volume";
+        attach_organization: "attach_organization";
+        create_world_service: "create_world_service";
+        start_world_service: "start_world_service";
+        stop_world_service: "stop_world_service";
+        detach_organization: "detach_organization";
+        export_evidence_volume: "export_evidence_volume";
+        revoke_secret_bindings: "revoke_secret_bindings";
+        cleanup_run: "cleanup_run";
+        recover_operation: "recover_operation";
+    }>;
+    operation_handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    receipt_digest: z.ZodString;
+    request_digest: z.ZodString;
+    result_handle: z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>>;
+    resulting_revision: z.ZodNullable<z.ZodNumber>;
+    run_id: z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<RunId, string>>>;
+    selected_target: z.ZodNullable<z.ZodObject<{
+        fingerprint: z.ZodString;
+        handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    }, z.core.$strict>>;
+    version: z.ZodLiteral<"spawnfile.target-resource.receipt.v1">;
+}, z.core.$strict>;
+export declare const selectedTargetReceiptSchema: z.ZodObject<{
+    fingerprint: z.ZodString;
+    handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    version: z.ZodLiteral<"spawnfile.target-resource.selected-target.v1">;
+}, z.core.$strict>;
+export declare const targetOperationLookupSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    status: z.ZodLiteral<"not_applied">;
+    idempotency_key: z.ZodString;
+    operation: z.ZodEnum<{
+        resolve_world_artifact: "resolve_world_artifact";
+        prepare_secret_bindings: "prepare_secret_bindings";
+        create_data_network: "create_data_network";
+        create_evidence_volume: "create_evidence_volume";
+        attach_organization: "attach_organization";
+        create_world_service: "create_world_service";
+        start_world_service: "start_world_service";
+        stop_world_service: "stop_world_service";
+        detach_organization: "detach_organization";
+        export_evidence_volume: "export_evidence_volume";
+        revoke_secret_bindings: "revoke_secret_bindings";
+        cleanup_run: "cleanup_run";
+        recover_operation: "recover_operation";
+    }>;
+    request_digest: z.ZodString;
+    version: z.ZodLiteral<"spawnfile.target-resource.operation-lookup.v1">;
+}, z.core.$strict>, z.ZodObject<{
+    operation_handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    status: z.ZodLiteral<"pending">;
+    idempotency_key: z.ZodString;
+    operation: z.ZodEnum<{
+        resolve_world_artifact: "resolve_world_artifact";
+        prepare_secret_bindings: "prepare_secret_bindings";
+        create_data_network: "create_data_network";
+        create_evidence_volume: "create_evidence_volume";
+        attach_organization: "attach_organization";
+        create_world_service: "create_world_service";
+        start_world_service: "start_world_service";
+        stop_world_service: "stop_world_service";
+        detach_organization: "detach_organization";
+        export_evidence_volume: "export_evidence_volume";
+        revoke_secret_bindings: "revoke_secret_bindings";
+        cleanup_run: "cleanup_run";
+        recover_operation: "recover_operation";
+    }>;
+    request_digest: z.ZodString;
+    version: z.ZodLiteral<"spawnfile.target-resource.operation-lookup.v1">;
+}, z.core.$strict>, z.ZodObject<{
+    operation_handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    receipt: z.ZodObject<{
+        cleanup_state: z.ZodNullable<z.ZodEnum<{
+            preserved: "preserved";
+            incomplete: "incomplete";
+            not_requested: "not_requested";
+            removed: "removed";
+        }>>;
+        descriptor_digest: z.ZodNullable<z.ZodString>;
+        evidence_index: z.ZodOptional<z.ZodObject<{
+            evidence_digest: z.ZodString;
+            export_handle: z.ZodString;
+            files: z.ZodArray<z.ZodObject<{
+                bytes: z.ZodNumber;
+                path: z.ZodUnion<[z.ZodString, z.ZodLiteral<".spawnfile/world-service-activated.v1">]>;
+                sha256: z.ZodString;
+            }, z.core.$strict>>;
+            item_count: z.ZodNumber;
+            labels: z.ZodArray<z.ZodObject<{
+                key: z.ZodString;
+                value: z.ZodString;
+            }, z.core.$strict>>;
+            run_id: z.ZodString;
+            source: z.ZodObject<{
+                evidence_volume_handle: z.ZodString;
+                state: z.ZodLiteral<"preserved">;
+            }, z.core.$strict>;
+            state: z.ZodEnum<{
+                exported: "exported";
+                incomplete: "incomplete";
+            }>;
+            version: z.ZodLiteral<"spawnfile.target-resource.export-index.v1">;
+        }, z.core.$strict>>;
+        export_state: z.ZodNullable<z.ZodEnum<{
+            exported: "exported";
+            incomplete: "incomplete";
+            not_requested: "not_requested";
+        }>>;
+        labels: z.ZodArray<z.ZodObject<{
+            key: z.ZodString;
+            value: z.ZodString;
+        }, z.core.$strict>>;
+        operation: z.ZodEnum<{
+            select_target: "select_target";
+            resolve_world_artifact: "resolve_world_artifact";
+            prepare_secret_bindings: "prepare_secret_bindings";
+            create_data_network: "create_data_network";
+            create_evidence_volume: "create_evidence_volume";
+            attach_organization: "attach_organization";
+            create_world_service: "create_world_service";
+            start_world_service: "start_world_service";
+            stop_world_service: "stop_world_service";
+            detach_organization: "detach_organization";
+            export_evidence_volume: "export_evidence_volume";
+            revoke_secret_bindings: "revoke_secret_bindings";
+            cleanup_run: "cleanup_run";
+            recover_operation: "recover_operation";
+        }>;
+        operation_handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+        receipt_digest: z.ZodString;
+        request_digest: z.ZodString;
+        result_handle: z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>>;
+        resulting_revision: z.ZodNullable<z.ZodNumber>;
+        run_id: z.ZodNullable<z.ZodPipe<z.ZodString, z.ZodTransform<RunId, string>>>;
+        selected_target: z.ZodNullable<z.ZodObject<{
+            fingerprint: z.ZodString;
+            handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+        }, z.core.$strict>>;
+        version: z.ZodLiteral<"spawnfile.target-resource.receipt.v1">;
+    }, z.core.$strict>;
+    status: z.ZodLiteral<"completed">;
+    idempotency_key: z.ZodString;
+    operation: z.ZodEnum<{
+        resolve_world_artifact: "resolve_world_artifact";
+        prepare_secret_bindings: "prepare_secret_bindings";
+        create_data_network: "create_data_network";
+        create_evidence_volume: "create_evidence_volume";
+        attach_organization: "attach_organization";
+        create_world_service: "create_world_service";
+        start_world_service: "start_world_service";
+        stop_world_service: "stop_world_service";
+        detach_organization: "detach_organization";
+        export_evidence_volume: "export_evidence_volume";
+        revoke_secret_bindings: "revoke_secret_bindings";
+        cleanup_run: "cleanup_run";
+        recover_operation: "recover_operation";
+    }>;
+    request_digest: z.ZodString;
+    version: z.ZodLiteral<"spawnfile.target-resource.operation-lookup.v1">;
+}, z.core.$strict>], "status">;
+export declare const targetResourceJournalSchema: z.ZodObject<{
+    descriptor_digest: z.ZodString;
+    entries: z.ZodArray<z.ZodObject<{
+        operation: z.ZodEnum<{
+            select_target: "select_target";
+            resolve_world_artifact: "resolve_world_artifact";
+            prepare_secret_bindings: "prepare_secret_bindings";
+            create_data_network: "create_data_network";
+            create_evidence_volume: "create_evidence_volume";
+            attach_organization: "attach_organization";
+            create_world_service: "create_world_service";
+            start_world_service: "start_world_service";
+            stop_world_service: "stop_world_service";
+            detach_organization: "detach_organization";
+            export_evidence_volume: "export_evidence_volume";
+            revoke_secret_bindings: "revoke_secret_bindings";
+            cleanup_run: "cleanup_run";
+            recover_operation: "recover_operation";
+        }>;
+        operation_handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+        receipt_digest: z.ZodString;
+        request_digest: z.ZodString;
+        state: z.ZodEnum<{
+            incomplete: "incomplete";
+            pending: "pending";
+            completed: "completed";
+        }>;
+    }, z.core.$strict>>;
+    revision: z.ZodNumber;
+    run_id: z.ZodPipe<z.ZodString, z.ZodTransform<RunId, string>>;
+    selected_target: z.ZodObject<{
+        fingerprint: z.ZodString;
+        handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    }, z.core.$strict>;
+    version: z.ZodLiteral<"spawnfile.target-resource.journal.v1">;
+}, z.core.$strict>;
+/**
+ * Public correlation packet for one already-created composed deployment.  The
+ * owner resolves every handle against its private stores; these values are
+ * never Docker references.
+ */
+export declare const targetTopologyAttestationRequestSchema: z.ZodObject<{
+    data_network: z.ZodObject<{
+        operation_handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+        request_digest: z.ZodString;
+        result_handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    }, z.core.$strict>;
+    descriptor_digest: z.ZodString;
+    organization_attachment: z.ZodObject<{
+        operation_handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+        request_digest: z.ZodString;
+        result_handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    }, z.core.$strict>;
+    run_id: z.ZodPipe<z.ZodString, z.ZodTransform<RunId, string>>;
+    selected_target: z.ZodObject<{
+        fingerprint: z.ZodString;
+        handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    }, z.core.$strict>;
+    version: z.ZodLiteral<"spawnfile.target-topology-attestation.request.v1">;
+    world_service: z.ZodObject<{
+        create: z.ZodObject<{
+            operation_handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+            request_digest: z.ZodString;
+            result_handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+        }, z.core.$strict>;
+        start: z.ZodObject<{
+            operation_handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+            request_digest: z.ZodString;
+            result_handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+/**
+ * Semantic-only projection.  It intentionally excludes every Docker name,
+ * ID, context, endpoint, path, port value and provider observation.
+ */
+export declare const targetTopologyReceiptSchema: z.ZodObject<{
+    descriptor_digest: z.ZodString;
+    handoff_scope: z.ZodLiteral<"organization_to_private_service">;
+    organization: z.ZodObject<{
+        data_network_attachment: z.ZodLiteral<"exact">;
+        egress_policy: z.ZodLiteral<"egress_only">;
+    }, z.core.$strict>;
+    receipt_digest: z.ZodString;
+    request_digest: z.ZodString;
+    run_id: z.ZodPipe<z.ZodString, z.ZodTransform<RunId, string>>;
+    selected_target: z.ZodObject<{
+        fingerprint: z.ZodString;
+        handle: z.ZodPipe<z.ZodString, z.ZodTransform<OpaqueTargetHandle, string>>;
+    }, z.core.$strict>;
+    service_discovery: z.ZodLiteral<"dns_only">;
+    version: z.ZodLiteral<"spawnfile.target-topology-receipt.v1">;
+    world_service: z.ZodObject<{
+        data_network_attachment: z.ZodLiteral<"exactly_one">;
+        egress_policy: z.ZodLiteral<"none">;
+        published_ports: z.ZodLiteral<"none">;
+    }, z.core.$strict>;
+    world_network: z.ZodLiteral<"private_internal">;
+}, z.core.$strict>;
+export declare const MAX_JSON_GRAPH_DEPTH = 32;
+export declare const MAX_JSON_GRAPH_NODES = 1024;
+export declare const MAX_JSON_GRAPH_KEYS = 128;
+export declare const MAX_JSON_GRAPH_STRING_BYTES = 65536;
+export declare const assertOrdinaryJsonGraph: (raw: unknown) => void;
+export type TargetResourceRequest = z.infer<typeof targetResourceRequestSchema>;
+export type TargetResourceReceipt = z.infer<typeof targetResourceReceiptSchema>;
+export type SelectedTargetReceipt = z.infer<typeof selectedTargetReceiptSchema>;
+export type TargetResourceJournal = z.infer<typeof targetResourceJournalSchema>;
+export type TargetResourceExportIndex = z.infer<typeof targetResourceExportIndexSchema>;
+export type TargetMutationRequest = Exclude<TargetResourceRequest, {
+    operation: "select_target";
+}>;
+export type TargetOperationLookup = z.infer<typeof targetOperationLookupSchema>;
+export type TargetTopologyAttestationRequest = z.infer<typeof targetTopologyAttestationRequestSchema>;
+export type TargetTopologyReceipt = z.infer<typeof targetTopologyReceiptSchema>;
+export declare const parseTargetResourceRequest: (raw: unknown) => TargetResourceRequest;
+export declare const parseTargetResourceReceipt: (raw: unknown) => TargetResourceReceipt;
+export declare const parseSelectedTargetReceipt: (raw: unknown) => SelectedTargetReceipt;
+export declare const parseTargetResourceJournal: (raw: unknown) => TargetResourceJournal;
+export declare const parseTargetResourceExportIndex: (raw: unknown) => TargetResourceExportIndex;
+export declare const parseTargetOperationLookup: (raw: unknown) => TargetOperationLookup;
+export declare const parseTargetTopologyAttestationRequest: (raw: unknown) => TargetTopologyAttestationRequest;
+export declare const parseTargetTopologyReceipt: (raw: unknown) => TargetTopologyReceipt;