spawnfile 0.1.14 → 0.1.17

package/dist/cli/targetWorldClockCrossProcess.test-helper.js

@@ -1,109 +0,0 @@
-import { chmod, mkdtemp, realpath, writeFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { parseOpaqueTargetHandle } from "../target/contracts.js";
-import { createDockerArtifactSpec } from "../target/dockerArtifactsProvider.js";
-import { createDockerResourceSpec } from "../target/dockerResourcesProvider.js";
-import { createWorldServiceAuthorization, parseWorldServiceResolution } from "../target/dockerWorldServiceAuthority.js";
-import { worldServiceSpecForBinding } from "../target/dockerWorldServiceLifecycle.js";
-import { createWorldServiceBinding, initializeWorldServiceAuthorityStore, worldServiceResourceBindings, } from "../target/dockerWorldServiceStore.js";
-import { createCanonicalWorldServiceActivationBytes, createTargetTopologyActivationReceiptDigest, createWorldServiceActivationDigest, parseWorldServiceActivation, } from "../target/topologyActivation.js";
-import { parseTargetWorldClockRequest } from "../target/worldClock.js";
-const d = (value) => `sha256:${value.repeat(64).slice(0, 64)}`;
-const h = (value) => parseOpaqueTargetHandle(`opaque_${value.repeat(16)}`);
-const containerId = "c".repeat(64);
-const after = (args, flag) => args[args.indexOf(flag) + 1];
-const inspection = (spec) => ({
-    AutoRemove: false, BindCount: 0, CapAddCount: 0, CapDrop: ["ALL"], CgroupnsMode: "private", DeviceCount: 0,
-    DeviceRequestCount: 0, DnsCount: 0, Domainname: "", ExposedPortCount: 0, ExtraHostCount: 0, GroupAddCount: 0,
-    Hostname: spec.containerName, Id: containerId, Image: spec.imageReference, IpcMode: "none", Labels: spec.receiptLabels,
-    LinkCount: 0, LogType: "none", Mounts: spec.createArgs.filter((value, index, values) => values[index - 1] === "--mount")
-        .map((value) => Object.fromEntries(value.split(",").map((part) => part.split("=", 2))))
-        .map((mount) => ({ Destination: mount.dst, Name: mount.src, RW: mount.dst === spec.evidenceMountPath, Type: "volume" })),
-    Name: `/${spec.containerName}`, NetworkAliases: spec.networkAlias ? [spec.networkAlias] : null,
-    NetworkAttachmentCount: 1, NetworkAttachmentId: "b".repeat(64), NetworkAttachmentName: after(spec.createArgs, "--network"),
-    NetworkMode: after(spec.createArgs, "--network"), PidMode: "", PortBindingCount: 0, Privileged: false,
-    PublishAllPorts: false, ReadonlyRootfs: true, RestartMaximumRetryCount: 0, RestartPolicyName: "no",
-    SecurityOpt: ["no-new-privileges=true"], Status: "running", Tmpfs: { "/tmp": "rw,noexec,nosuid,nodev,size=1m,mode=1777" },
-    UTSMode: "", UsernsMode: "", VolumesFromCount: 0,
-});
-const fixture = () => {
-    const selectedTarget = { fingerprint: `sha256:${"1".repeat(32)}`, handle: h("1") };
-    const runId = "run-built-clock";
-    const dataClaim = { operationHandle: h("2"), requestDigest: d("2") };
-    const evidenceClaim = { operationHandle: h("3"), requestDigest: d("3") };
-    const data = createDockerResourceSpec({ kind: "data_network", ...dataClaim, runId, selectedTargetHandle: selectedTarget.handle });
-    const evidence = createDockerResourceSpec({ kind: "evidence_volume", ...evidenceClaim, runId, selectedTargetHandle: selectedTarget.handle });
-    const artifact = createDockerArtifactSpec({ artifactManifestDigest: d("4"), imageDigest: d("5"),
-        imageReference: `registry.example/world@${d("5")}`, operationHandle: h("4"), requestDigest: d("4"),
-        selectedTargetHandle: selectedTarget.handle });
-    const authorization = createWorldServiceAuthorization({ dataNetworkHandle: data.resultHandle, descriptorDigest: d("6"),
-        evidenceMountPath: "/run/world/evidence", evidenceVolumeHandle: evidence.resultHandle, operationHandle: h("6"),
-        requestDigest: d("6"), runId, secretBindingsHandle: h("7"), selectedTarget, worldArtifactHandle: artifact.resultHandle });
-    const resolution = parseWorldServiceResolution({ artifact: { artifact_manifest_digest: d("4"), identity_kind: "oci_image_manifest",
-            image_digest: artifact.imageDigest, image_reference: artifact.imageReference, operation_handle: h("4"),
-            request_digest: d("4"), result_handle: artifact.resultHandle }, authorization });
-    const resources = worldServiceResourceBindings({ dataNetworkClaim: dataClaim, evidenceVolumeClaim: evidenceClaim, resolution });
-    const spec = worldServiceSpecForBinding({ resolution, resources });
-    const binding = createWorldServiceBinding({ containerId, dataNetwork: resources.data_network, evidenceVolume: resources.evidence_volume,
-        resolution, secretBindings: resources.secret_bindings, spec });
-    const marker = parseWorldServiceActivation({ bundle_digest: d("8"), run_id: runId, state: "activated",
-        topology_receipt_digest: d("9"), topology_request_digest: d("a"), version: "spawnfile.world-service-activation.v1" });
-    const activationDigest = createWorldServiceActivationDigest(marker);
-    const activationReceiptDigest = createTargetTopologyActivationReceiptDigest({ activation_digest: activationDigest,
-        bundle_digest: marker.bundle_digest, receipt_digest: d("0"), run_id: runId, state: "activated",
-        topology_receipt_digest: marker.topology_receipt_digest, topology_request_digest: marker.topology_request_digest,
-        version: "spawnfile.target-topology-activation-receipt.v1" });
-    const request = parseTargetWorldClockRequest({ activation_digest: activationDigest,
-        activation_receipt_digest: activationReceiptDigest, descriptor_digest: authorization.descriptor_digest,
-        endpoint: { internal_port: 4_070, path: "/v1/world/clock" },
-        expected: { document_version: "world.clock-document.v1", world_instance_id: "world-built-clock" }, run_id: runId,
-        selected_target: selectedTarget, topology_receipt_digest: marker.topology_receipt_digest,
-        topology_request_digest: marker.topology_request_digest, version: "spawnfile.target-world-clock.request.v1",
-        world_service_handle: binding.world_service_handle });
-    return { binding, marker, request, spec };
-};
-export const createBuiltWorldClockState = async () => {
-    const root = await realpath(await mkdtemp(path.join(os.tmpdir(), "spawnfile-built-world-clock-")));
-    const home = path.join(root, "home");
-    const callsPath = path.join(root, "docker-calls.ndjson");
-    const modePath = path.join(root, "mode");
-    const scenariosPath = path.join(root, "scenarios.json");
-    const fakeDocker = path.join(root, "docker-clock");
-    const requestPath = path.join(root, "request.json");
-    const { binding, marker, request, spec } = fixture();
-    const store = await initializeWorldServiceAuthorityStore(path.join(home, "target", "world-authority"));
-    await store.bindService(binding);
-    const observation = { action_count: 0, clock: { completed_tick: 1, next_tick: 2, state: "running" },
-        run_id: request.run_id, version: request.expected.document_version, world_instance_id: request.expected.world_instance_id };
-    const topologyMarker = parseWorldServiceActivation({ ...marker, topology_receipt_digest: d("b") });
-    const activationMarker = parseWorldServiceActivation({ ...marker, bundle_digest: d("c") });
-    const scenarios = {
-        success: { marker: createCanonicalWorldServiceActivationBytes(marker), observation: JSON.stringify(observation) },
-        "tick-zero": { marker: createCanonicalWorldServiceActivationBytes(marker), observation: JSON.stringify({ ...observation,
-                clock: { completed_tick: 0, next_tick: 1, state: "running" } }) },
-        stale: { marker: createCanonicalWorldServiceActivationBytes(marker), observation: JSON.stringify({ ...observation, run_id: "run-stale-clock" }) },
-        topology: { marker: createCanonicalWorldServiceActivationBytes(topologyMarker), observation: JSON.stringify(observation) },
-        activation: { marker: createCanonicalWorldServiceActivationBytes(activationMarker), observation: JSON.stringify(observation) },
-        "nonzero-action": { marker: createCanonicalWorldServiceActivationBytes(marker), observation: JSON.stringify({ ...observation, action_count: 1 }) },
-    };
-    await writeFile(callsPath, "", { mode: 0o600 });
-    await writeFile(modePath, "success", { mode: 0o600 });
-    await writeFile(scenariosPath, JSON.stringify(scenarios), { mode: 0o600 });
-    await writeFile(requestPath, JSON.stringify(request), { mode: 0o600 });
-    await writeFile(fakeDocker, `#!${process.execPath}
-const fs=require("node:fs");const args=process.argv.slice(2);
-fs.appendFileSync(${JSON.stringify(callsPath)},JSON.stringify(args)+"\\n");
-const all=JSON.parse(fs.readFileSync(${JSON.stringify(scenariosPath)},"utf8"));
-const current=all[fs.readFileSync(${JSON.stringify(modePath)},"utf8").trim()];
-if(args[2]==="container"&&args[3]==="inspect")process.stdout.write(${JSON.stringify(JSON.stringify([inspection(spec)]))});
-else if(args[2]==="container"&&args[3]==="exec"&&args.includes("/bin/cat"))process.stdout.write(current.marker);
-else if(args[2]==="container"&&args[3]==="exec"&&args.includes("/usr/local/bin/node"))process.stdout.write(current.observation);
-else{process.stderr.write("unexpected fake Docker command\\n");process.exitCode=71;}
-`, { mode: 0o700 });
-    await chmod(fakeDocker, 0o700);
-    return { callsPath, config: { context: "built_clock", dockerCommand: fakeDocker,
-            evidenceDestination: path.join(root, "unused.tar"), timeoutMs: 10_000,
-            version: "spawnfile.target-default-config.v1" }, home, modePath, request, requestPath, root };
-};
-export const selectBuiltWorldClockMode = async (state, mode) => { await writeFile(state.modePath, mode, { mode: 0o600 }); };

package/dist/deployment/providerRuntimeBoundaryScanner.test-helper.d.ts

@@ -1,8 +0,0 @@
-export type ProviderRuntimeViolationKind = "moltnet-live-endpoint" | "provider-authenticated-http" | "docker-exec-http-transport" | "transport-receipt" | "generated-client" | "cursor-operation";
-export type ProviderRuntimeViolation = {
-    classification: ProviderRuntimeViolationKind;
-    file: string;
-    matched: string;
-};
-export declare const scanProviderRuntimeSource: (source: string, file?: string) => ProviderRuntimeViolation[];
-export declare const scanProviderRuntimeTree: (repositoryRoot: string) => Promise<ProviderRuntimeViolation[]>;

package/dist/deployment/providerRuntimeBoundaryScanner.test-helper.js

@@ -1,60 +0,0 @@
-import { readdir, readFile } from "node:fs/promises";
-import path from "node:path";
-const forbiddenIdentifiers = [
-    ["transport-receipt", /spawnfile\.moltnet-transport/u],
-    ["transport-receipt", /ContainedMoltnetTransport/u],
-    ["generated-client", /CONTAINED_MOLTNET_CLIENT/u],
-    ["generated-client", /SendMessageRequest/u],
-    ["cursor-operation", /ListRoomMessages/u]
-];
-const productionFiles = async (directory) => {
-    const entries = await readdir(directory, { withFileTypes: true });
-    const nested = await Promise.all(entries.map(async (entry) => {
-        const file = path.join(directory, entry.name);
-        if (entry.isDirectory())
-            return productionFiles(file);
-        if (!entry.isFile() || !entry.name.endsWith(".ts") || entry.name.endsWith(".test.ts") || entry.name.endsWith(".test-helper.ts"))
-            return [];
-        return [file];
-    }));
-    return nested.flat();
-};
-const violationsForSource = (source, file) => {
-    const violations = [];
-    for (const endpoint of ["/v1/messages", "/v1/network", "/v1/rooms", "/v1/agents"]) {
-        if (source.includes(endpoint))
-            violations.push({ classification: "moltnet-live-endpoint", file, matched: endpoint });
-    }
-    const providerSurface = /(?:fetch|httpGet|curl)[\s\S]*(?:\/healthz|\/v1\/)/u.test(source)
-        || /(?:\/healthz|\/v1\/)[\s\S]*(?:fetch|httpGet|curl)/u.test(source);
-    const authenticatedMarker = [
-        [/\bAuthorization\s*:/u, "Authorization property"],
-        [/["']Authorization["']\s*:/u, "Authorization string key"],
-        [/\[\s*["']Authorization["']\s*\]\s*=/u, "Authorization element assignment"],
-        [/`Bearer\s+/u, "Bearer template"],
-        [/["']Bearer\s+["']\s*\+/u, "Bearer concatenation"],
-        [/["']Bearer\s+/u, "Bearer literal"]
-    ].find(([pattern]) => pattern.test(source));
-    if (providerSurface && authenticatedMarker) {
-        violations.push({
-            classification: "provider-authenticated-http",
-            file,
-            matched: authenticatedMarker[1]
-        });
-    }
-    if (/(?:exec\s*\(\s*\[\s*["'](?:curl|wget)["'])|(?:["']exec["'][\s\S]{0,160}["'](?:curl|wget)["'])/u.test(source)) {
-        violations.push({ classification: "docker-exec-http-transport", file, matched: "exec curl/wget" });
-    }
-    for (const [classification, pattern] of forbiddenIdentifiers) {
-        if (pattern.test(source))
-            violations.push({ classification, file, matched: pattern.source });
-    }
-    return violations;
-};
-export const scanProviderRuntimeSource = (source, file = "synthetic.ts") => violationsForSource(source, file);
-export const scanProviderRuntimeTree = async (repositoryRoot) => {
-    const roots = ["cli", "compiler", "deployment", "status"].map((folder) => path.join(repositoryRoot, "src", folder));
-    const files = (await Promise.all(roots.map(productionFiles))).flat();
-    const results = await Promise.all(files.map(async (file) => violationsForSource(await readFile(file, "utf8"), path.relative(repositoryRoot, file))));
-    return results.flat();
-};

package/dist/deployment/simfileFixtureBoundary.test-helper.d.ts

@@ -1,8 +0,0 @@
-export type SimfileFixtureViolation = {
-    file: string;
-    classification: "simfile-scenario-direct-literal" | "simfile-scenario-path-join" | "simfile-scenario-path-resolve";
-    matchedPath: string;
-};
-export declare const scanSimfileFixtureSource: (text: string, file?: string) => SimfileFixtureViolation[];
-export declare const scanSimfileFixtureFile: (file: string) => Promise<SimfileFixtureViolation[]>;
-export declare const scanSimfileFixtureTree: (repositoryRoot: string) => Promise<SimfileFixtureViolation[]>;

package/dist/deployment/simfileFixtureBoundary.test-helper.js

@@ -1,103 +0,0 @@
-import { readdir, readFile } from "node:fs/promises";
-import path from "node:path";
-import * as ts from "typescript";
-const normalize = (value) => value.replace(/\\/g, "/");
-const fixturePath = (value) => {
-    const normalized = normalize(value);
-    const index = normalized.toLowerCase().indexOf("ecosystem/simfile/fixtures");
-    if (index < 0 || (index > 0 && !/[\\/]/u.test(normalized[index - 1])))
-        return null;
-    return normalized.slice(index);
-};
-const aliasesFor = (sourceFile) => {
-    const namespaceAliases = new Set();
-    const functionAliases = new Map();
-    for (const statement of sourceFile.statements) {
-        if (!ts.isImportDeclaration(statement) || !ts.isStringLiteral(statement.moduleSpecifier)
-            || !["node:path", "path"].includes(statement.moduleSpecifier.text))
-            continue;
-        const clause = statement.importClause;
-        if (!clause)
-            continue;
-        if (clause.name)
-            namespaceAliases.add(clause.name.text);
-        if (!clause.namedBindings)
-            continue;
-        if (ts.isNamespaceImport(clause.namedBindings))
-            namespaceAliases.add(clause.namedBindings.name.text);
-        if (ts.isNamedImports(clause.namedBindings)) {
-            for (const element of clause.namedBindings.elements) {
-                const imported = element.propertyName?.text ?? element.name.text;
-                if (imported === "join" || imported === "resolve")
-                    functionAliases.set(element.name.text, imported);
-            }
-        }
-    }
-    return { namespaceAliases, functionAliases };
-};
-const pathCallViolations = (node, aliases, sourceFile) => {
-    const callee = node.expression;
-    let kind = null;
-    if (ts.isPropertyAccessExpression(callee) && ts.isIdentifier(callee.expression)
-        && aliases.namespaceAliases.has(callee.expression.text) && ["join", "resolve"].includes(callee.name.text)) {
-        kind = callee.name.text;
-    }
-    else if (ts.isIdentifier(callee)) {
-        kind = aliases.functionAliases.get(callee.text) ?? null;
-    }
-    if (!kind)
-        return [];
-    const segments = node.arguments.map((argument) => ts.isStringLiteral(argument) || ts.isNoSubstitutionTemplateLiteral(argument) ? normalize(argument.text) : null);
-    const start = segments.findIndex((segment, index) => index <= segments.length - 3 && segment === "ecosystem" && segments[index + 1] === "simfile" && segments[index + 2] === "fixtures");
-    if (start < 0)
-        return [];
-    const matchedSegments = [];
-    for (const segment of segments.slice(start)) {
-        if (segment === null)
-            break;
-        matchedSegments.push(segment);
-    }
-    return [{
-            file: path.relative(process.cwd(), sourceFile.fileName),
-            classification: kind === "join" ? "simfile-scenario-path-join" : "simfile-scenario-path-resolve",
-            matchedPath: matchedSegments.join("/")
-        }];
-};
-export const scanSimfileFixtureSource = (text, file = "synthetic.ts") => {
-    const sourceFile = ts.createSourceFile(file, text, ts.ScriptTarget.ES2022, true, ts.ScriptKind.TS);
-    const aliases = aliasesFor(sourceFile);
-    const violations = [];
-    const visit = (node) => {
-        if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) {
-            const matchedPath = fixturePath(node.text);
-            if (matchedPath)
-                violations.push({ file, classification: "simfile-scenario-direct-literal", matchedPath });
-        }
-        if (ts.isCallExpression(node))
-            violations.push(...pathCallViolations(node, aliases, sourceFile));
-        ts.forEachChild(node, visit);
-    };
-    visit(sourceFile);
-    return violations;
-};
-export const scanSimfileFixtureFile = async (file) => scanSimfileFixtureSource(await readFile(file, "utf8"), file);
-const typescriptFiles = async (directory) => {
-    const entries = await readdir(directory, { withFileTypes: true });
-    const nested = await Promise.all(entries.map(async (entry) => {
-        const file = path.join(directory, entry.name);
-        if (entry.isDirectory())
-            return typescriptFiles(file);
-        return entry.isFile() && entry.name.endsWith(".ts") ? [file] : [];
-    }));
-    return nested.flat();
-};
-export const scanSimfileFixtureTree = async (repositoryRoot) => {
-    const excluded = new Set([
-        path.resolve(repositoryRoot, "src/deployment/providerRuntimeBoundary.test.ts"),
-        path.resolve(repositoryRoot, "src/deployment/simfileFixtureBoundary.test-helper.ts")
-    ]);
-    const files = (await typescriptFiles(path.join(repositoryRoot, "src")))
-        .map((file) => path.resolve(file))
-        .filter((file) => !excluded.has(file));
-    return (await Promise.all(files.map(scanSimfileFixtureFile))).flat();
-};

package/dist/ownership/simfileRunOperatorInputs.d.ts

@@ -1,103 +0,0 @@
-import { z } from "zod";
-import { type SelectedTargetReceipt } from "../target/contracts.js";
-export declare const SIMFILE_RUN_OPERATOR_INPUT_VERSION: "spawnfile.simfile-run-operator-input.v1";
-export declare const SIMFILE_RUN_OPERATOR_RESOLUTION_VERSION: "spawnfile.simfile-run-operator-resolution.v1";
-export declare const SIMFILE_RUN_OPERATOR_RECEIPT_VERSION: "spawnfile.simfile-run-operator-receipt.v1";
-export declare const simfileRunOperatorInputSchema: z.ZodObject<{
-    auth_profile: z.ZodString;
-    moltnet_release: z.ZodObject<{
-        directory_transport: z.ZodLiteral<"operator-path">;
-        required_capability: z.ZodLiteral<"pi-bridge">;
-        stamp_version: z.ZodLiteral<"spawnfile.moltnet-release-stamp.v1">;
-    }, z.core.$strict>;
-    run_id: z.ZodString;
-    run_root: z.ZodString;
-    target_config_transport: z.ZodLiteral<"stdin">;
-    target_selector: z.ZodString;
-    version: z.ZodLiteral<"spawnfile.simfile-run-operator-input.v1">;
-}, z.core.$strict>;
-export declare const simfileRunMoltnetIdentitySchema: z.ZodObject<{
-    architecture: z.ZodEnum<{
-        amd64: "amd64";
-        arm64: "arm64";
-    }>;
-    asset: z.ZodString;
-    asset_sha256: z.ZodString;
-    capabilities: z.ZodTuple<[z.ZodLiteral<"pi-bridge">], null>;
-    release_version: z.ZodString;
-    source_revision: z.ZodString;
-    version: z.ZodLiteral<"spawnfile.moltnet-release-identity.v1">;
-}, z.core.$strict>;
-export declare const simfileRunOperatorResolutionSchema: z.ZodObject<{
-    auth_profile: z.ZodString;
-    moltnet_release: z.ZodObject<{
-        architecture: z.ZodEnum<{
-            amd64: "amd64";
-            arm64: "arm64";
-        }>;
-        asset: z.ZodString;
-        asset_sha256: z.ZodString;
-        capabilities: z.ZodTuple<[z.ZodLiteral<"pi-bridge">], null>;
-        release_version: z.ZodString;
-        source_revision: z.ZodString;
-        version: z.ZodLiteral<"spawnfile.moltnet-release-identity.v1">;
-    }, z.core.$strict>;
-    request_digest: z.ZodString;
-    roots: z.ZodObject<{
-        cache: z.ZodString;
-        evidence: z.ZodString;
-        journal: z.ZodString;
-        output: z.ZodString;
-    }, z.core.$strict>;
-    roots_digest: z.ZodString;
-    run_id: z.ZodString;
-    target_selector: z.ZodString;
-    version: z.ZodLiteral<"spawnfile.simfile-run-operator-resolution.v1">;
-}, z.core.$strict>;
-export declare const simfileRunOperatorReceiptSchema: z.ZodObject<{
-    auth_profile: z.ZodString;
-    moltnet_release: z.ZodObject<{
-        architecture: z.ZodEnum<{
-            amd64: "amd64";
-            arm64: "arm64";
-        }>;
-        asset: z.ZodString;
-        asset_sha256: z.ZodString;
-        capabilities: z.ZodTuple<[z.ZodLiteral<"pi-bridge">], null>;
-        release_version: z.ZodString;
-        source_revision: z.ZodString;
-        version: z.ZodLiteral<"spawnfile.moltnet-release-identity.v1">;
-    }, z.core.$strict>;
-    request_digest: z.ZodString;
-    resolution_digest: z.ZodString;
-    roots_digest: z.ZodString;
-    run_id: z.ZodString;
-    selected_target: z.ZodObject<{
-        fingerprint: z.ZodString;
-        handle: z.ZodPipe<z.ZodString, z.ZodTransform<import("../target/contracts.js").OpaqueTargetHandle, string>>;
-        version: z.ZodLiteral<"spawnfile.target-resource.selected-target.v1">;
-    }, z.core.$strict>;
-    target_selector: z.ZodString;
-    version: z.ZodLiteral<"spawnfile.simfile-run-operator-receipt.v1">;
-}, z.core.$strict>;
-export type SimfileRunOperatorInput = z.infer<typeof simfileRunOperatorInputSchema>;
-export type SimfileRunMoltnetIdentity = z.infer<typeof simfileRunMoltnetIdentitySchema>;
-export type SimfileRunOperatorResolution = z.infer<typeof simfileRunOperatorResolutionSchema>;
-export type SimfileRunOperatorReceipt = z.infer<typeof simfileRunOperatorReceiptSchema>;
-export declare const parseSimfileRunOperatorInput: (raw: unknown) => SimfileRunOperatorInput;
-export declare const parseSimfileRunOperatorResolution: (raw: unknown) => SimfileRunOperatorResolution;
-export declare const parseSimfileRunOperatorReceipt: (raw: unknown) => SimfileRunOperatorReceipt;
-export declare const createSimfileRunOperatorRequestDigest: (raw: unknown) => `sha256:${string}`;
-export declare const resolveSimfileRunOperatorInput: (input: {
-    readonly request: unknown;
-    readonly moltnet_release: unknown;
-}) => SimfileRunOperatorResolution;
-export declare const createSimfileRunOperatorReceipt: (input: {
-    readonly resolution: unknown;
-    readonly selected_target: SelectedTargetReceipt;
-}) => SimfileRunOperatorReceipt;
-export declare const verifySimfileRunOperatorReceipt: (input: {
-    readonly receipt: unknown;
-    readonly resolution: unknown;
-    readonly selected_target: SelectedTargetReceipt;
-}) => SimfileRunOperatorReceipt;

package/dist/ownership/simfileRunOperatorInputs.js

@@ -1,139 +0,0 @@
-import { createHash } from "node:crypto";
-import path from "node:path";
-import { z } from "zod";
-import { assertOrdinaryJsonGraph, selectedTargetReceiptSchema } from "../target/contracts.js";
-export const SIMFILE_RUN_OPERATOR_INPUT_VERSION = "spawnfile.simfile-run-operator-input.v1";
-export const SIMFILE_RUN_OPERATOR_RESOLUTION_VERSION = "spawnfile.simfile-run-operator-resolution.v1";
-export const SIMFILE_RUN_OPERATOR_RECEIPT_VERSION = "spawnfile.simfile-run-operator-receipt.v1";
-const identifier = z.string().regex(/^[a-z][a-z0-9_-]{0,63}$/u);
-const runId = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u);
-const digest = z.string().regex(/^sha256:[a-f0-9]{64}$/u);
-const revision = z.string().regex(/^[a-f0-9]{40}$/u);
-const releaseVersion = z.string().regex(/^v?\d+\.\d+\.\d+(?:-\d+-g[a-f0-9]{7,40})?$/u)
-    .refine((value) => value !== "latest");
-const absoluteRunRoot = z.string().max(4_096).refine((value) => path.isAbsolute(value) && path.normalize(value) === value && value !== path.parse(value).root);
-export const simfileRunOperatorInputSchema = z.object({
-    auth_profile: identifier,
-    moltnet_release: z.object({
-        directory_transport: z.literal("operator-path"),
-        required_capability: z.literal("pi-bridge"),
-        stamp_version: z.literal("spawnfile.moltnet-release-stamp.v1")
-    }).strict(),
-    run_id: runId,
-    run_root: absoluteRunRoot,
-    target_config_transport: z.literal("stdin"),
-    target_selector: identifier,
-    version: z.literal(SIMFILE_RUN_OPERATOR_INPUT_VERSION)
-}).strict().superRefine((value, context) => {
-    if (path.basename(value.run_root) !== value.run_id) {
-        context.addIssue({ code: z.ZodIssueCode.custom, message: "run_root must be owned by run_id" });
-    }
-});
-export const simfileRunMoltnetIdentitySchema = z.object({
-    architecture: z.enum(["amd64", "arm64"]),
-    asset: z.string().regex(/^moltnet_linux_(?:amd64|arm64)\.tar\.gz$/u),
-    asset_sha256: digest,
-    capabilities: z.tuple([z.literal("pi-bridge")]),
-    release_version: releaseVersion,
-    source_revision: revision,
-    version: z.literal("spawnfile.moltnet-release-identity.v1")
-}).strict().superRefine((value, context) => {
-    if (value.asset !== `moltnet_linux_${value.architecture}.tar.gz`) {
-        context.addIssue({ code: z.ZodIssueCode.custom, message: "Moltnet asset architecture mismatch" });
-    }
-    const described = value.release_version.match(/-g([a-f0-9]{7,40})$/u)?.[1];
-    if (described && !value.source_revision.startsWith(described)) {
-        context.addIssue({ code: z.ZodIssueCode.custom, message: "Moltnet source revision mismatch" });
-    }
-});
-const runRootsSchema = z.object({
-    cache: absoluteRunRoot,
-    evidence: absoluteRunRoot,
-    journal: absoluteRunRoot,
-    output: absoluteRunRoot
-}).strict();
-export const simfileRunOperatorResolutionSchema = z.object({
-    auth_profile: identifier,
-    moltnet_release: simfileRunMoltnetIdentitySchema,
-    request_digest: digest,
-    roots: runRootsSchema,
-    roots_digest: digest,
-    run_id: runId,
-    target_selector: identifier,
-    version: z.literal(SIMFILE_RUN_OPERATOR_RESOLUTION_VERSION)
-}).strict();
-export const simfileRunOperatorReceiptSchema = z.object({
-    auth_profile: identifier,
-    moltnet_release: simfileRunMoltnetIdentitySchema,
-    request_digest: digest,
-    resolution_digest: digest,
-    roots_digest: digest,
-    run_id: runId,
-    selected_target: selectedTargetReceiptSchema,
-    target_selector: identifier,
-    version: z.literal(SIMFILE_RUN_OPERATOR_RECEIPT_VERSION)
-}).strict();
-const canonical = (value) => {
-    if (Array.isArray(value))
-        return `[${value.map(canonical).join(",")}]`;
-    if (value !== null && typeof value === "object") {
-        const record = value;
-        return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonical(record[key])}`).join(",")}}`;
-    }
-    return JSON.stringify(value);
-};
-const hash = (domain, value) => `sha256:${createHash("sha256").update(`${domain}\0${canonical(value)}`).digest("hex")}`;
-const parse = (schema, raw) => {
-    assertOrdinaryJsonGraph(raw);
-    return schema.parse(raw);
-};
-export const parseSimfileRunOperatorInput = (raw) => parse(simfileRunOperatorInputSchema, raw);
-export const parseSimfileRunOperatorResolution = (raw) => parse(simfileRunOperatorResolutionSchema, raw);
-export const parseSimfileRunOperatorReceipt = (raw) => parse(simfileRunOperatorReceiptSchema, raw);
-export const createSimfileRunOperatorRequestDigest = (raw) => hash(SIMFILE_RUN_OPERATOR_INPUT_VERSION, parseSimfileRunOperatorInput(raw));
-export const resolveSimfileRunOperatorInput = (input) => {
-    const request = parseSimfileRunOperatorInput(input.request);
-    const moltnetRelease = parse(simfileRunMoltnetIdentitySchema, input.moltnet_release);
-    const roots = {
-        cache: path.join(request.run_root, "cache"),
-        evidence: path.join(request.run_root, "evidence"),
-        journal: path.join(request.run_root, "journal"),
-        output: path.join(request.run_root, "output")
-    };
-    return parseSimfileRunOperatorResolution({
-        auth_profile: request.auth_profile,
-        moltnet_release: moltnetRelease,
-        request_digest: createSimfileRunOperatorRequestDigest(request),
-        roots,
-        roots_digest: hash("spawnfile.simfile-run-roots.v1", roots),
-        run_id: request.run_id,
-        target_selector: request.target_selector,
-        version: SIMFILE_RUN_OPERATOR_RESOLUTION_VERSION
-    });
-};
-export const createSimfileRunOperatorReceipt = (input) => {
-    const resolution = parseSimfileRunOperatorResolution(input.resolution);
-    const selectedTarget = parse(selectedTargetReceiptSchema, input.selected_target);
-    return parseSimfileRunOperatorReceipt({
-        auth_profile: resolution.auth_profile,
-        moltnet_release: resolution.moltnet_release,
-        request_digest: resolution.request_digest,
-        resolution_digest: hash(SIMFILE_RUN_OPERATOR_RESOLUTION_VERSION, resolution),
-        roots_digest: resolution.roots_digest,
-        run_id: resolution.run_id,
-        selected_target: selectedTarget,
-        target_selector: resolution.target_selector,
-        version: SIMFILE_RUN_OPERATOR_RECEIPT_VERSION
-    });
-};
-export const verifySimfileRunOperatorReceipt = (input) => {
-    const receipt = parseSimfileRunOperatorReceipt(input.receipt);
-    const expected = createSimfileRunOperatorReceipt({
-        resolution: input.resolution,
-        selected_target: input.selected_target
-    });
-    if (canonical(receipt) !== canonical(expected)) {
-        throw new TypeError("Simfile run operator receipt correlation is invalid");
-    }
-    return receipt;
-};

package/dist/target/cleanupRunDocker.test-helper.d.ts

@@ -1,67 +0,0 @@
-import { type OpaqueTargetHandle } from "./contracts.js";
-import { type DockerResourceExecutor, type DockerResourceSpec } from "./dockerResourcesProvider.js";
-import { type WorldServiceAuthorityStore } from "./dockerWorldServiceStore.js";
-import { type OrganizationAttachmentAuthorityStore } from "./organizationAttachmentStore.js";
-import { type EvidenceExportAuthorityStore } from "./evidenceExportStore.js";
-export declare const canonicalCleanupBindings: (input: {
-    readonly attachmentOperationHandle: OpaqueTargetHandle;
-    readonly attachmentRequestDigest: string;
-    readonly descriptorDigest: string;
-    readonly evidence: DockerResourceSpec;
-    readonly evidenceOperationHandle: OpaqueTargetHandle;
-    readonly evidenceRequestDigest: string;
-    readonly network: DockerResourceSpec;
-    readonly networkOperationHandle: OpaqueTargetHandle;
-    readonly networkRequestDigest: string;
-    readonly runId: string;
-    readonly secretHandle: OpaqueTargetHandle;
-    readonly selected: {
-        readonly fingerprint: string;
-        readonly handle: OpaqueTargetHandle;
-    };
-    readonly worldOperationHandle: OpaqueTargetHandle;
-    readonly worldRequestDigest: string;
-}) => {
-    attachment: import("./organizationAttachmentStore.js").OrganizationAttachmentBinding;
-    world: import("./dockerWorldServiceStore.js").WorldServiceBinding;
-};
-export declare const canonicalCleanupScenario: (input: Parameters<typeof canonicalCleanupBindings>[0]) => {
-    attachmentExecutor: (_file: string, args: string[]) => Promise<{
-        stderr: string;
-        stdout: string;
-    }>;
-    bindings: {
-        attachment: import("./organizationAttachmentStore.js").OrganizationAttachmentBinding;
-        world: import("./dockerWorldServiceStore.js").WorldServiceBinding;
-    };
-    calls: {
-        attachment: string[][];
-        secret: string[][];
-        world: string[][];
-    };
-    drift: {
-        attachment: import("./organizationAttachmentStore.js").OrganizationAttachmentBinding;
-        world: import("./dockerWorldServiceStore.js").WorldServiceBinding;
-    };
-    secretExecutor: (_file: string, args: string[]) => Promise<never>;
-    worldExecutor: (_file: string, args: string[]) => Promise<never>;
-};
-export declare const cleanupResourceExecutor: (specs: DockerResourceSpec[]) => {
-    calls: string[][];
-    executor: DockerResourceExecutor;
-    present: Set<string>;
-};
-export declare const cleanupAuthorityStores: (input?: {
-    readonly admission?: unknown;
-    readonly attachment?: unknown;
-    readonly index?: unknown;
-    readonly world?: unknown;
-}) => {
-    attachmentStore: OrganizationAttachmentAuthorityStore;
-    evidenceExportStore: EvidenceExportAuthorityStore;
-    loads: {
-        attachment: number;
-        world: number;
-    };
-    worldStore: WorldServiceAuthorityStore;
-};