spawnfile 0.1.12 → 0.1.14

package/dist/cli/targetDefaultConfigStdin.d.ts

@@ -0,0 +1,13 @@
+import type { TargetDefaultConfig, TargetDefaultWorldReadinessConfig } from "./targetDefaultConfig.js";
+export declare const TARGET_DEFAULT_CONFIG_STDIN_ERROR = "Invalid target configuration";
+export declare const TARGET_DEFAULT_CONFIG_STDIN_VERSION = "spawnfile.target-default-config.v1";
+export declare const TARGET_LOOKUP_CONFIG_STDIN_VERSION = "spawnfile.target-lookup-config.v1";
+export declare const MAX_TARGET_DEFAULT_CONFIG_STDIN_BYTES = 262144;
+export interface TargetLookupConfig {
+    readonly context: string;
+}
+export declare const readTargetDefaultConfigStdin: (input: AsyncIterable<unknown>) => Promise<TargetDefaultConfig>;
+/** Parses the normal config envelope but resolves only the read-only readiness path. */
+export declare const readTargetWorldReadinessConfigStdin: (input: AsyncIterable<unknown>) => Promise<TargetDefaultWorldReadinessConfig>;
+/** Parses only the read-only lookup authority; it performs no filesystem work. */
+export declare const readTargetLookupConfigStdin: (input: AsyncIterable<unknown>) => Promise<TargetLookupConfig>;

package/dist/cli/targetDefaultConfigStdin.js

@@ -0,0 +1,215 @@
+import { TextDecoder } from "node:util";
+export const TARGET_DEFAULT_CONFIG_STDIN_ERROR = "Invalid target configuration";
+export const TARGET_DEFAULT_CONFIG_STDIN_VERSION = "spawnfile.target-default-config.v1";
+export const TARGET_LOOKUP_CONFIG_STDIN_VERSION = "spawnfile.target-lookup-config.v1";
+export const MAX_TARGET_DEFAULT_CONFIG_STDIN_BYTES = 262_144;
+const TARGET_CONTEXT_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/u;
+const fail = () => { throw new TypeError(TARGET_DEFAULT_CONFIG_STDIN_ERROR); };
+const assertNoDuplicateJsonKeys = (source) => {
+    let offset = 0;
+    const whitespace = () => { while (/\s/u.test(source[offset] ?? ""))
+        offset += 1; };
+    const string = () => {
+        const start = offset;
+        offset += 1;
+        while (offset < source.length) {
+            if (source[offset] === "\\")
+                offset += 2;
+            else if (source[offset] === "\"") {
+                offset += 1;
+                return JSON.parse(source.slice(start, offset));
+            }
+            else
+                offset += 1;
+        }
+        return fail();
+    };
+    const value = () => {
+        whitespace();
+        if (source[offset] === "{")
+            return object();
+        if (source[offset] === "[")
+            return array();
+        if (source[offset] === "\"") {
+            string();
+            return;
+        }
+        while (offset < source.length && !/[\s,\]}]/u.test(source[offset] ?? ""))
+            offset += 1;
+    };
+    const object = () => {
+        offset += 1;
+        whitespace();
+        const keys = new Set();
+        if (source[offset] === "}") {
+            offset += 1;
+            return;
+        }
+        while (offset < source.length) {
+            const key = string();
+            if (keys.has(key))
+                return fail();
+            keys.add(key);
+            whitespace();
+            offset += 1;
+            value();
+            whitespace();
+            if (source[offset] === "}") {
+                offset += 1;
+                return;
+            }
+            offset += 1;
+            whitespace();
+        }
+        return fail();
+    };
+    const array = () => {
+        offset += 1;
+        whitespace();
+        if (source[offset] === "]") {
+            offset += 1;
+            return;
+        }
+        while (offset < source.length) {
+            value();
+            whitespace();
+            if (source[offset] === "]") {
+                offset += 1;
+                return;
+            }
+            offset += 1;
+            whitespace();
+        }
+        return fail();
+    };
+    value();
+    whitespace();
+    if (offset !== source.length)
+        fail();
+};
+const exactDefaultConfigObject = (raw) => {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)
+        || Object.getPrototypeOf(raw) !== Object.prototype)
+        return fail();
+    const expected = [
+        "artifactMappings", "container_bundle_store_root", "context", "dockerCommand", "evidenceDestination",
+        "helperArtifactManifestDigest", "preparedArtifactMappings", "timeoutMs", "version"
+    ];
+    const required = ["context", "dockerCommand", "evidenceDestination", "timeoutMs", "version"];
+    const keys = Object.keys(raw);
+    if (keys.some((key) => !expected.includes(key))
+        || required.some((key) => !keys.includes(key)))
+        return fail();
+    const value = raw;
+    if (value.version !== TARGET_DEFAULT_CONFIG_STDIN_VERSION
+        || Object.hasOwn(value, "artifactMappings") !== Object.hasOwn(value, "helperArtifactManifestDigest"))
+        return fail();
+    return value;
+};
+const exactLookupConfigObject = (raw) => {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)
+        || Object.getPrototypeOf(raw) !== Object.prototype)
+        return fail();
+    const keys = Object.keys(raw);
+    if (keys.length !== 2 || !keys.includes("context") || !keys.includes("version"))
+        return fail();
+    const value = raw;
+    if (value.version !== TARGET_LOOKUP_CONFIG_STDIN_VERSION
+        || typeof value.context !== "string"
+        || !TARGET_CONTEXT_PATTERN.test(value.context))
+        return fail();
+    return Object.freeze({ context: value.context });
+};
+const readBytes = async (input) => {
+    const chunks = [];
+    let total = 0;
+    try {
+        if (!input || typeof input[Symbol.asyncIterator] !== "function")
+            return fail();
+        for await (const raw of input) {
+            const chunk = typeof raw === "string" ? new TextEncoder().encode(raw)
+                : raw instanceof Uint8Array ? Uint8Array.from(raw) : fail();
+            // A non-empty chunk consumes at least one byte, so the byte ceiling also
+            // bounds iteration.  Rejecting empty chunks prevents an unbounded stream
+            // from evading that ceiling forever.
+            if (chunk.byteLength === 0)
+                return fail();
+            if (chunk.byteLength > MAX_TARGET_DEFAULT_CONFIG_STDIN_BYTES - total)
+                return fail();
+            chunks.push(chunk);
+            total += chunk.byteLength;
+        }
+        if (total === 0)
+            return fail();
+        const bytes = new Uint8Array(total);
+        let offset = 0;
+        for (const chunk of chunks) {
+            bytes.set(chunk, offset);
+            offset += chunk.byteLength;
+        }
+        return bytes;
+    }
+    catch {
+        return fail();
+    }
+};
+const readRawConfigStdin = async (input) => {
+    const bytes = await readBytes(input);
+    let source;
+    try {
+        source = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
+    }
+    catch {
+        return fail();
+    }
+    if (source.startsWith("\uFEFF"))
+        return fail();
+    try {
+        assertNoDuplicateJsonKeys(source);
+        return JSON.parse(source);
+    }
+    catch {
+        return fail();
+    }
+};
+export const readTargetDefaultConfigStdin = async (input) => {
+    const raw = exactDefaultConfigObject(await readRawConfigStdin(input));
+    const inputs = defaultConfigInputs(raw);
+    try {
+        const { loadTargetDefaultConfig } = await import("./targetDefaultConfig.js");
+        return await loadTargetDefaultConfig(inputs);
+    }
+    catch {
+        return fail();
+    }
+};
+const defaultConfigInputs = (raw) => ({
+    ...(Object.hasOwn(raw, "artifactMappings") ? {
+        artifactMappings: raw.artifactMappings
+    } : {}),
+    ...(Object.hasOwn(raw, "container_bundle_store_root") ? {
+        containerBundleStoreRoot: raw.container_bundle_store_root
+    } : {}),
+    context: raw.context,
+    dockerCommand: raw.dockerCommand,
+    evidenceDestination: raw.evidenceDestination,
+    ...(Object.hasOwn(raw, "helperArtifactManifestDigest") ? {
+        helperArtifactManifestDigest: raw.helperArtifactManifestDigest
+    } : {}),
+    preparedArtifactMappings: raw.preparedArtifactMappings,
+    timeoutMs: raw.timeoutMs
+});
+/** Parses the normal config envelope but resolves only the read-only readiness path. */
+export const readTargetWorldReadinessConfigStdin = async (input) => {
+    const raw = exactDefaultConfigObject(await readRawConfigStdin(input));
+    const inputs = defaultConfigInputs(raw);
+    try {
+        const { resolveTargetDefaultWorldReadinessConfig } = await import("./targetDefaultConfig.js");
+        return resolveTargetDefaultWorldReadinessConfig(inputs);
+    }
+    catch {
+        return fail();
+    }
+};
+/** Parses only the read-only lookup authority; it performs no filesystem work. */
+export const readTargetLookupConfigStdin = async (input) => exactLookupConfigObject(await readRawConfigStdin(input));

package/dist/cli/targetDefaultEnvelope.d.ts

@@ -0,0 +1 @@
+export declare const targetDefaultEnvelope: (raw: unknown, required: readonly string[], optional?: readonly string[]) => Record<string, unknown>;

package/dist/cli/targetDefaultEnvelope.js

@@ -0,0 +1,13 @@
+import { types as nodeTypes } from "node:util";
+export const targetDefaultEnvelope = (raw, required, optional = []) => {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw) || nodeTypes.isProxy(raw) || Object.getPrototypeOf(raw) !== Object.prototype)
+        throw new Error("Target authority initialization failed");
+    const keys = Reflect.ownKeys(raw);
+    const allowed = [...required, ...optional];
+    if (keys.length < required.length || keys.length > allowed.length || keys.some((key) => typeof key !== "string" || !allowed.includes(key)) || required.some((key) => !keys.includes(key)))
+        throw new Error("Target authority initialization failed");
+    const descriptors = Object.getOwnPropertyDescriptors(raw);
+    if (Object.values(descriptors).some((descriptor) => !descriptor.enumerable || !("value" in descriptor)))
+        throw new Error("Target authority initialization failed");
+    return Object.fromEntries(keys.map((key) => [key, descriptors[key].value]));
+};

package/dist/cli/targetDefaultHandlerFactory.d.ts

@@ -0,0 +1,28 @@
+import { type SelectTargetOptions } from "../target/dockerTarget.js";
+import type { SelectedTargetReceipt } from "../target/contracts.js";
+import type { TargetDefaultAuthorities } from "./targetDefaultAuthorities.js";
+import type { TargetDefaultConfig } from "./targetDefaultConfig.js";
+import type { TargetCommandHandlers } from "./targetCommands.js";
+type Result = Awaited<ReturnType<TargetCommandHandlers["cleanup_run"]>>;
+interface Operations {
+    execute(raw: unknown): Promise<Result>;
+}
+interface EvidenceOperations {
+    recover(raw: unknown, destination: unknown): Promise<Result>;
+    execute(raw: unknown, destination: unknown): Promise<Result>;
+}
+type Factory = (options: Record<string, unknown>) => Operations;
+type EvidenceFactory = (options: Record<string, unknown>) => EvidenceOperations;
+export interface TargetDefaultHandlerFactories {
+    readonly artifact: Factory;
+    readonly attachment: Factory;
+    readonly cleanup: Factory;
+    readonly evidence: EvidenceFactory;
+    readonly resource: Factory;
+    readonly secret: Factory;
+    readonly select: (options: SelectTargetOptions) => Promise<SelectedTargetReceipt>;
+    readonly world: Factory;
+}
+export declare const targetDefaultHandlerFactories: TargetDefaultHandlerFactories;
+export declare const createTargetDefaultHandlers: (config: TargetDefaultConfig, rawFactories: TargetDefaultHandlerFactories, rawAuthorities: TargetDefaultAuthorities) => Promise<TargetCommandHandlers>;
+export {};

package/dist/cli/targetDefaultHandlerFactory.js

@@ -0,0 +1,247 @@
+import { types as nodeTypes } from "node:util";
+import { createDockerCleanupRunOperations } from "../target/cleanupRunDocker.js";
+import { createDockerArtifactOperations } from "../target/dockerArtifacts.js";
+import { createDockerPreparedArtifactOperations } from "../target/dockerPreparedArtifact.js";
+import { initializeFilesystemTargetLocalBundleStore } from "../target/containerBundleFilesystemStore.js";
+import { createDockerTargetLocalBundleBuilder } from "../target/dockerContainerBundleBuilder.js";
+import { createDockerResourceOperations } from "../target/dockerResources.js";
+import { createDockerSecretOperations } from "../target/dockerSecrets.js";
+import { selectTarget } from "../target/dockerTarget.js";
+import { createDockerWorldServiceOperations } from "../target/dockerWorldService.js";
+import { createEvidenceExportOperations } from "../target/evidenceExport.js";
+import { EVIDENCE_EXPORT_HELPER_CONTRACT } from "../target/evidenceExportProvider.js";
+import { createDockerOrganizationAttachmentOperations } from "../target/organizationAttachment.js";
+import { createTargetEvidenceHelperResolutionRequest } from "./targetEvidenceHelperResolution.js";
+export const targetDefaultHandlerFactories = Object.freeze({
+    artifact: createDockerArtifactOperations,
+    attachment: createDockerOrganizationAttachmentOperations,
+    cleanup: createDockerCleanupRunOperations,
+    evidence: createEvidenceExportOperations,
+    resource: createDockerResourceOperations,
+    secret: createDockerSecretOperations,
+    select: selectTarget,
+    world: createDockerWorldServiceOperations
+});
+const MUTATIONS = Object.freeze([
+    "attach_organization",
+    "cleanup_run",
+    "create_data_network",
+    "create_evidence_volume",
+    "create_world_service",
+    "detach_organization",
+    "export_evidence_volume",
+    "prepare_secret_bindings",
+    "recover_operation",
+    "resolve_world_artifact",
+    "revoke_secret_bindings",
+    "start_world_service",
+    "stop_world_service"
+]);
+const shape = (raw, expected) => {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw) || nodeTypes.isProxy(raw)
+        || Object.getPrototypeOf(raw) !== Object.prototype) {
+        throw new Error("Target handler initialization failed");
+    }
+    const keys = Reflect.ownKeys(raw);
+    if (keys.length !== expected.length
+        || keys.some((key) => typeof key !== "string" || !expected.includes(key))) {
+        throw new Error("Target handler initialization failed");
+    }
+    const descriptors = Object.getOwnPropertyDescriptors(raw);
+    if (Object.values(descriptors).some((descriptor) => !descriptor.enumerable || !("value" in descriptor))) {
+        throw new Error("Target handler initialization failed");
+    }
+    return Object.fromEntries(expected.map((key) => [key, descriptors[key].value]));
+};
+const requireFactories = (raw) => {
+    const names = [
+        "artifact", "attachment", "cleanup", "evidence",
+        "resource", "secret", "select", "world"
+    ];
+    const values = shape(raw, names);
+    for (const name of names) {
+        if (typeof values[name] !== "function")
+            throw new Error("Target handler initialization failed");
+    }
+    return Object.freeze(values);
+};
+const requireAuthorities = (raw) => {
+    const names = [
+        "artifactIdentityStore", "attachmentAuthorityStore",
+        "evidenceExportAuthorityStore", "executors", "handoffResolver",
+        "helperArtifactResolver", "journals", "secretAuthorityStore",
+        "secretResolver", "topologyAttestor", "worldAuthorityStore", "worldResolver"
+    ];
+    if (!raw || typeof raw !== "object" || Array.isArray(raw) || nodeTypes.isProxy(raw)
+        || Object.getPrototypeOf(raw) !== Object.prototype) {
+        throw new Error("Target handler initialization failed");
+    }
+    const descriptors = Object.getOwnPropertyDescriptors(raw);
+    const values = shape(raw, Object.hasOwn(descriptors, "helperArtifactResolver")
+        ? names : names.filter((name) => name !== "helperArtifactResolver"));
+    for (const name of [
+        "artifactIdentityStore", "attachmentAuthorityStore",
+        "evidenceExportAuthorityStore", "secretAuthorityStore", "worldAuthorityStore"
+    ]) {
+        if (!values[name] || typeof values[name] !== "object") {
+            throw new Error("Target handler initialization failed");
+        }
+    }
+    const executorNames = [
+        "artifact", "attachment", "evidenceExport", "publicArtifact", "resource",
+        "secret", "world"
+    ];
+    const executors = shape(values.executors, executorNames);
+    if (executorNames.some((name) => typeof executors[name] !== "function")) {
+        throw new Error("Target handler initialization failed");
+    }
+    for (const name of [
+        "handoffResolver", "journals", "secretResolver", "worldResolver"
+    ]) {
+        const resolver = shape(values[name], ["resolve"]);
+        if (typeof resolver.resolve !== "function") {
+            throw new Error("Target handler initialization failed");
+        }
+    }
+    if (values.helperArtifactResolver !== undefined) {
+        const resolver = shape(values.helperArtifactResolver, ["resolve"]);
+        if (typeof resolver.resolve !== "function") {
+            throw new Error("Target handler initialization failed");
+        }
+    }
+    const topologyAttestor = shape(values.topologyAttestor, ["activate", "attest"]);
+    if (typeof topologyAttestor.activate !== "function"
+        || typeof topologyAttestor.attest !== "function") {
+        throw new Error("Target handler initialization failed");
+    }
+    return Object.freeze({ ...values, executors: Object.freeze(executors) });
+};
+const execute = async (expected, factories, authorities, config, raw) => {
+    if (!raw || raw.operation !== expected)
+        throw new Error("Target operation mismatch");
+    const authority = await authorities.journals.resolve({ context: config.context, request: raw });
+    const request = authority.request;
+    if (request.operation !== expected)
+        throw new Error("Target operation mismatch");
+    const common = { context: config.context, journal: authority.journal, timeoutMs: config.timeoutMs };
+    const run = async () => {
+        switch (request.operation) {
+            case "resolve_world_artifact": {
+                const prepared = config.preparedArtifactMappings.filter((mapping) => mapping.artifact_manifest_digest === request.artifact_manifest_digest);
+                if (prepared.length > 1)
+                    throw new Error("Target operation mismatch");
+                if (prepared.length === 1) {
+                    return createDockerPreparedArtifactOperations({
+                        builder: createDockerTargetLocalBundleBuilder({
+                            context: config.context,
+                            executor: authorities.executors.artifact,
+                            timeoutMs: config.timeoutMs
+                        }),
+                        identityStore: authorities.artifactIdentityStore,
+                        journal: authority.journal,
+                        mapping: prepared[0],
+                        store: await initializeFilesystemTargetLocalBundleStore(config.paths.containerBundles)
+                    }).execute(request);
+                }
+                return factories.artifact({
+                    ...common,
+                    executor: authorities.executors.artifact,
+                    identityStore: authorities.artifactIdentityStore,
+                    mappings: config.artifactMappings
+                }).execute(request);
+            }
+            case "prepare_secret_bindings":
+            case "revoke_secret_bindings":
+                return factories.secret({
+                    ...common,
+                    authorityStore: authorities.secretAuthorityStore,
+                    executor: authorities.executors.secret,
+                    resolver: authorities.secretResolver
+                }).execute(request);
+            case "create_data_network":
+            case "create_evidence_volume":
+                return factories.resource({ ...common, executor: authorities.executors.resource }).execute(request);
+            case "attach_organization":
+            case "detach_organization":
+                return factories.attachment({
+                    ...common,
+                    authorityStore: authorities.attachmentAuthorityStore,
+                    executor: authorities.executors.attachment,
+                    resolver: authorities.handoffResolver
+                }).execute(request);
+            case "create_world_service":
+            case "start_world_service":
+            case "stop_world_service":
+                return factories.world({
+                    ...common,
+                    authorityStore: authorities.worldAuthorityStore,
+                    executor: authorities.executors.world,
+                    resolver: authorities.worldResolver
+                }).execute(request);
+            case "export_evidence_volume":
+            case "recover_operation": {
+                if (!config.helperArtifact || !authorities.helperArtifactResolver) {
+                    throw new Error("Target evidence helper is not configured");
+                }
+                if (request.operation === "export_evidence_volume") {
+                    await factories.artifact({
+                        ...common,
+                        executor: authorities.executors.artifact,
+                        identityStore: authorities.artifactIdentityStore,
+                        mappings: config.artifactMappings
+                    }).execute(createTargetEvidenceHelperResolutionRequest(request, config.helperArtifact.artifact_manifest_digest));
+                }
+                const helper = await authorities.helperArtifactResolver.resolve({
+                    context: config.context,
+                    request
+                });
+                const operations = factories.evidence({
+                    ...common,
+                    artifactIdentityStore: authorities.artifactIdentityStore,
+                    authorityStore: authorities.evidenceExportAuthorityStore,
+                    executor: authorities.executors.resource,
+                    exportExecutor: authorities.executors.evidenceExport,
+                    helperArtifactBundle: helper.bundle,
+                    helperArtifactContract: EVIDENCE_EXPORT_HELPER_CONTRACT,
+                    helperArtifactManifestDigest: config.helperArtifact.artifact_manifest_digest
+                });
+                return request.operation === "recover_operation"
+                    ? operations.recover(request, config.evidenceDestination)
+                    : operations.execute(request, config.evidenceDestination);
+            }
+            case "cleanup_run":
+                return factories.cleanup({
+                    ...common,
+                    attachmentExecutor: authorities.executors.attachment,
+                    attachmentStore: authorities.attachmentAuthorityStore,
+                    evidenceExportStore: authorities.evidenceExportAuthorityStore,
+                    resourceExecutor: authorities.executors.resource,
+                    secretExecutor: authorities.executors.secret,
+                    worldExecutor: authorities.executors.world,
+                    worldStore: authorities.worldAuthorityStore
+                }).execute(request);
+        }
+    };
+    return authority.journal.withLifecycleLease(run);
+};
+export const createTargetDefaultHandlers = async (config, rawFactories, rawAuthorities) => {
+    const factories = requireFactories(rawFactories);
+    const authorities = requireAuthorities(rawAuthorities);
+    const handlers = Object.fromEntries(MUTATIONS.map((operation) => [
+        operation,
+        (request) => execute(operation, factories, authorities, config, request)
+    ]));
+    return Object.freeze({
+        ...handlers,
+        select_target: async (request) => {
+            if (request.target_reference !== config.context)
+                throw new Error("Target selection failed");
+            return factories.select({
+                context: config.context,
+                dockerCommand: config.dockerCommand,
+                execFile: async (_file, args, options) => authorities.executors.resource("docker", args, options),
+                timeoutMs: config.timeoutMs
+            });
+        }
+    });
+};

package/dist/cli/targetDefaultHandlers.d.ts

@@ -0,0 +1,21 @@
+import type { TargetTopologyAttestationRequest } from "../target/contracts.js";
+import type { TargetTopologyAttestationResult } from "../target/topologyAttestation.js";
+import type { TargetPublicArtifactSnapshot, TargetPublicArtifactSnapshotRequest } from "../target/publicArtifactSnapshot.js";
+import type { TargetTopologyActivationResult } from "../target/topologyActivation.js";
+import type { TargetDefaultConfig } from "./targetDefaultConfig.js";
+import type { TargetCommandHandlers } from "./targetCommands.js";
+export { createTargetDefaultHandlers, type TargetDefaultHandlerFactories } from "./targetDefaultHandlerFactory.js";
+/** A closeable production target handler graph. */
+export interface TargetDefaultHandlerSession {
+    readonly handlers: TargetCommandHandlers;
+    dispose(): Promise<void>;
+}
+export declare const createTargetDefaultHandlerSession: (config: TargetDefaultConfig) => Promise<TargetDefaultHandlerSession>;
+export declare const withTargetDefaultHandlerSession: <Result>(config: TargetDefaultConfig, invoke: (handlers: TargetCommandHandlers) => Promise<Result>, signal?: AbortSignal) => Promise<Result>;
+/** The read-only attestor owns the same private authority graph as mutations. */
+export declare const attestTargetDefaultTopology: (config: TargetDefaultConfig, request: TargetTopologyAttestationRequest) => Promise<TargetTopologyAttestationResult>;
+/** Read one exact, bounded public projection from an attested world service. */
+export declare const snapshotTargetDefaultPublicArtifact: (config: TargetDefaultConfig, request: TargetPublicArtifactSnapshotRequest) => Promise<TargetPublicArtifactSnapshot>;
+export declare const activateTargetDefaultTopology: (config: TargetDefaultConfig, request: TargetTopologyAttestationRequest) => Promise<TargetTopologyActivationResult>;
+/** Internal lifecycle primitive; not re-exported from the package surface. */
+export declare const runTargetDefaultHandlerSession: <Result>(session: TargetDefaultHandlerSession, invoke: (handlers: TargetCommandHandlers) => Promise<Result>, signal?: AbortSignal) => Promise<Result>;

package/dist/cli/targetDefaultHandlers.js

@@ -0,0 +1,72 @@
+import { createDockerPublicArtifactSnapshotReader } from "../target/dockerPublicArtifactSnapshot.js";
+import { initializeTargetDefaultAuthoritySession } from "./targetDefaultAuthorities.js";
+import { createTargetDefaultHandlers, targetDefaultHandlerFactories } from "./targetDefaultHandlerFactory.js";
+export { createTargetDefaultHandlers } from "./targetDefaultHandlerFactory.js";
+export const createTargetDefaultHandlerSession = async (config) => {
+    let authoritySession;
+    try {
+        authoritySession = await initializeTargetDefaultAuthoritySession(config);
+        const handlers = await createTargetDefaultHandlers(config, targetDefaultHandlerFactories, authoritySession.authorities);
+        return Object.freeze({ handlers, dispose: authoritySession.dispose });
+    }
+    catch (error) {
+        await authoritySession?.dispose().catch(() => undefined);
+        throw error;
+    }
+};
+export const withTargetDefaultHandlerSession = async (config, invoke, signal) => {
+    if (signal?.aborted)
+        throw new Error("Target handler initialization failed");
+    const session = await createTargetDefaultHandlerSession(config);
+    return runTargetDefaultHandlerSession(session, invoke, signal);
+};
+/** The read-only attestor owns the same private authority graph as mutations. */
+export const attestTargetDefaultTopology = async (config, request) => {
+    const session = await initializeTargetDefaultAuthoritySession(config);
+    try {
+        return await session.authorities.topologyAttestor.attest(request);
+    }
+    finally {
+        await session.dispose();
+    }
+};
+/** Read one exact, bounded public projection from an attested world service. */
+export const snapshotTargetDefaultPublicArtifact = async (config, request) => {
+    const session = await initializeTargetDefaultAuthoritySession(config);
+    try {
+        return await createDockerPublicArtifactSnapshotReader({
+            authorityStore: session.authorities.worldAuthorityStore,
+            context: config.context,
+            contentExecutor: session.authorities.executors.publicArtifact,
+            executor: session.authorities.executors.world,
+            timeoutMs: config.timeoutMs
+        }).snapshot(request);
+    }
+    finally {
+        await session.dispose();
+    }
+};
+export const activateTargetDefaultTopology = async (config, request) => {
+    const session = await initializeTargetDefaultAuthoritySession(config);
+    try {
+        return await session.authorities.topologyAttestor.activate(request);
+    }
+    finally {
+        await session.dispose();
+    }
+};
+/** Internal lifecycle primitive; not re-exported from the package surface. */
+export const runTargetDefaultHandlerSession = async (session, invoke, signal) => {
+    let closing;
+    const close = () => closing ??= session.dispose();
+    if (signal?.aborted) {
+        await close();
+        throw new Error("Target handler initialization failed");
+    }
+    try {
+        return await invoke(session.handlers);
+    }
+    finally {
+        await close();
+    }
+};

package/dist/cli/targetDefaultJournalAuthority.d.ts

@@ -0,0 +1,35 @@
+import { type SelectedTargetReceipt, type TargetResourceRequest } from "../target/contracts.js";
+import { type TargetJournalStore } from "../target/journal.js";
+import type { TargetDefaultConfig } from "./targetDefaultConfig.js";
+export declare const TARGET_DEFAULT_AUTHORITIES_ERROR = "Target authority initialization failed";
+type MutationRequest = Exclude<TargetResourceRequest, {
+    operation: "select_target";
+}>;
+export interface TargetMutationAuthority {
+    readonly journal: TargetJournalStore;
+    readonly request: MutationRequest;
+    readonly selectedTarget: SelectedTargetReceipt;
+}
+export interface TargetJournalResolver {
+    resolve(input: {
+        readonly context: unknown;
+        readonly request: unknown;
+    }): Promise<TargetMutationAuthority>;
+}
+export interface TargetJournalAccess {
+    readonly resolver: TargetJournalResolver;
+    resolveIdentity(input: {
+        readonly context: unknown;
+        readonly descriptorDigest: unknown;
+        readonly runId: unknown;
+        readonly selectedTarget: unknown;
+    }): Promise<TargetJournalStore>;
+    resolveExistingIdentity(input: {
+        readonly context: unknown;
+        readonly descriptorDigest: unknown;
+        readonly runId: unknown;
+        readonly selectedTarget: unknown;
+    }): Promise<TargetJournalStore>;
+}
+export declare const createTargetJournalAccess: (config: TargetDefaultConfig) => TargetJournalAccess;
+export {};