spawnfile 0.1.12 → 0.1.14

package/dist/auth/targetSecretSourceFsPublishImmutable.js

@@ -0,0 +1,435 @@
+import { constants } from "node:fs";
+import { link, lstat, open, unlink } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { TARGET_SECRET_SOURCE_ERROR, parseTargetSecretSourceOpaqueHandle } from "./targetSecretSourceRecordCommon.js";
+const MAX_BYTES = 65_536;
+const MAX_ATTEMPTS = 512;
+const fail = () => { throw new Error(TARGET_SECRET_SOURCE_ERROR); };
+const missing = (error) => error.code === "ENOENT";
+const exists = (error) => error.code === "EEXIST";
+const same = (a, b) => a.dev === b.dev && a.ino === b.ino && a.mode === b.mode && a.nlink === b.nlink && a.size === b.size && a.uid === b.uid;
+const sameNode = (a, b) => a.dev === b.dev && a.ino === b.ino && a.mode === b.mode && a.nlink === b.nlink && a.uid === b.uid;
+const sameInode = (a, b) => a.dev === b.dev && a.ino === b.ino && a.mode === b.mode && a.size === b.size && a.uid === b.uid;
+const ownerUid = () => {
+    const value = process.getuid?.();
+    return typeof value === "number" ? value : fail();
+};
+const directoryIdentity = (value, uid) => {
+    if (!value.isDirectory() || value.isSymbolicLink() || value.uid !== uid || (value.mode & 0o7777) !== 0o700)
+        fail();
+    return { dev: value.dev, ino: value.ino, mode: value.mode, nlink: 0, size: 0, uid: value.uid };
+};
+const fileIdentity = (value, uid, links, zero = false) => {
+    if (!value.isFile() || value.isSymbolicLink() || value.uid !== uid || !links.includes(value.nlink)
+        || (value.mode & 0o7777) !== 0o600 || value.size < 0 || value.size > MAX_BYTES || (zero && value.size !== 0))
+        fail();
+    return { dev: value.dev, ino: value.ino, mode: value.mode, nlink: value.nlink, size: value.size, uid: value.uid };
+};
+const yieldTurn = () => new Promise((resolve) => setImmediate(resolve));
+export const initializeTargetSecretSourceFsPublishImmutable = async (options) => {
+    if (!options || typeof options !== "object" || !Array.isArray(options.directory_chain) || options.directory_chain.length < 1
+        || options.directory_chain.some((entry) => typeof entry !== "string" || entry.length < 1))
+        fail();
+    const uid = ownerUid();
+    const paths = [...options.directory_chain];
+    const roots = await Promise.all(paths.map(async (path) => directoryIdentity(await lstat(path), uid)));
+    const checkChain = async () => {
+        for (let index = 0; index < paths.length; index += 1) {
+            const named = directoryIdentity(await lstat(paths[index]), uid);
+            if (!same(named, roots[index]))
+                fail();
+            let fd;
+            try {
+                fd = await open(paths[index], constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+                const opened = directoryIdentity(await fd.stat(), uid);
+                const after = directoryIdentity(await lstat(paths[index]), uid);
+                if (!same(opened, roots[index]) || !same(after, roots[index]))
+                    fail();
+            }
+            catch {
+                fail();
+            }
+            finally {
+                await fd?.close().catch(() => undefined);
+            }
+        }
+    };
+    const syncDirectory = async () => {
+        await checkChain();
+        await options.hookForTest?.("before_directory_sync", paths.at(-1));
+        let fd;
+        try {
+            fd = await open(paths.at(-1), constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+            const opened = directoryIdentity(await fd.stat(), uid);
+            if (!same(opened, roots.at(-1)))
+                fail();
+            await fd.sync();
+            const after = directoryIdentity(await fd.stat(), uid);
+            const named = directoryIdentity(await lstat(paths.at(-1)), uid);
+            if (!same(after, roots.at(-1)) || !same(named, roots.at(-1)))
+                fail();
+        }
+        catch {
+            return fail();
+        }
+        finally {
+            await fd?.close().catch(() => undefined);
+        }
+        await checkChain();
+    };
+    const snapshotZero = async (path, links) => {
+        await checkChain();
+        let before;
+        try {
+            const beforeInfo = await lstat(path);
+            if (beforeInfo.nlink === 0) {
+                fileIdentity(beforeInfo, uid, [0], true);
+                return null;
+            }
+            before = fileIdentity(beforeInfo, uid, links, true);
+        }
+        catch (error) {
+            if (missing(error))
+                return null;
+            return fail();
+        }
+        let fd;
+        try {
+            try {
+                fd = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+            }
+            catch (error) {
+                if (missing(error))
+                    return null;
+                return fail();
+            }
+            if (!fd)
+                return fail();
+            const openedInfo = await fd.stat();
+            if (openedInfo.nlink === 0) {
+                fileIdentity(openedInfo, uid, [0], true);
+                return null;
+            }
+            const opened = fileIdentity(openedInfo, uid, links, true);
+            let after;
+            try {
+                const afterInfo = await lstat(path);
+                if (afterInfo.nlink === 0) {
+                    fileIdentity(afterInfo, uid, [0], true);
+                    return null;
+                }
+                after = fileIdentity(afterInfo, uid, links, true);
+            }
+            catch (error) {
+                if (missing(error))
+                    return null;
+                return fail();
+            }
+            if (!sameInode(before, opened) || !sameInode(opened, after) || !same(before, opened) || !same(opened, after))
+                return null;
+            return opened;
+        }
+        catch {
+            return fail();
+        }
+        finally {
+            await fd?.close().catch(() => undefined);
+        }
+    };
+    const unlinkExact = async (path, expected) => {
+        await checkChain();
+        const current = await snapshotZero(path, [1, 2]);
+        if (current === null || !sameInode(current, expected) || !same(current, expected))
+            return false;
+        const immediate = await snapshotZero(path, [1, 2]);
+        if (immediate === null) {
+            await syncDirectory();
+            return false;
+        }
+        if (!sameInode(immediate, expected) || !same(immediate, expected))
+            return false;
+        try {
+            await unlink(path);
+        }
+        catch (error) {
+            if (!missing(error))
+                fail();
+            await syncDirectory();
+            return false;
+        }
+        await syncDirectory();
+        return true;
+    };
+    const readFinal = async (path, expected) => {
+        await checkChain();
+        let before;
+        try {
+            before = fileIdentity(await lstat(path), uid, [1]);
+        }
+        catch (error) {
+            if (missing(error))
+                return "absent";
+            return fail();
+        }
+        if (before.size > expected.length)
+            fail();
+        let fd;
+        let bytes;
+        try {
+            fd = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+            const opened = fileIdentity(await fd.stat(), uid, [1]);
+            if (!sameNode(before, opened) || opened.size > expected.length)
+                fail();
+            bytes = new Uint8Array(opened.size);
+            let offset = 0;
+            while (offset < bytes.length) {
+                const read = await fd.read(bytes, offset, bytes.length - offset, offset);
+                if (read.bytesRead === 0)
+                    fail();
+                offset += read.bytesRead;
+            }
+            const after = fileIdentity(await fd.stat(), uid, [1]);
+            const named = fileIdentity(await lstat(path), uid, [1]);
+            if (!sameNode(opened, after) || !sameNode(opened, named))
+                fail();
+            if (!same(opened, after) || !same(opened, named))
+                return "prefix";
+            for (let index = 0; index < bytes.length; index += 1)
+                if (bytes[index] !== expected[index])
+                    fail();
+            return bytes.length === expected.length ? "exact" : "prefix";
+        }
+        catch {
+            return fail();
+        }
+        finally {
+            bytes?.fill(0);
+            await fd?.close().catch(() => undefined);
+        }
+    };
+    const createToken = async (token) => {
+        await checkChain();
+        let fd;
+        try {
+            fd = await open(token, constants.O_CREAT | constants.O_EXCL | constants.O_RDWR | constants.O_NOFOLLOW, 0o600);
+            await fd.chmod(0o600);
+            const opened = fileIdentity(await fd.stat(), uid, [1], true);
+            await fd.sync();
+            const afterInfo = await fd.stat();
+            if (afterInfo.nlink === 0) {
+                fileIdentity(afterInfo, uid, [0], true);
+                return null;
+            }
+            const after = fileIdentity(afterInfo, uid, [1, 2], true);
+            if (!sameInode(opened, after))
+                fail();
+            await syncDirectory();
+            await options.hookForTest?.("after_token_create", token);
+            return after;
+        }
+        catch (error) {
+            if (exists(error))
+                return null;
+            return fail();
+        }
+        finally {
+            await fd?.close().catch(() => undefined);
+        }
+    };
+    const writeSome = async (fd, bytes, offset, limit) => {
+        const testLimit = options.maxWriteBytesForTest;
+        const requested = testLimit === undefined ? limit : Math.min(limit, testLimit);
+        if (!Number.isSafeInteger(requested) || requested < 1)
+            fail();
+        const result = await fd.write(bytes, offset, requested, offset);
+        if (result.bytesWritten < 1 || result.bytesWritten > requested)
+            fail();
+        return result.bytesWritten;
+    };
+    const publishImmutable = async (input) => {
+        let owned;
+        try {
+            if (!input || typeof input !== "object" || !(input.bytes instanceof Uint8Array) || typeof input.final_path !== "string"
+                || typeof input.publication_handle !== "string" || typeof input.proveExact !== "function")
+                fail();
+            owned = Uint8Array.from(input.bytes);
+            if (owned.length < 1 || owned.length > MAX_BYTES)
+                fail();
+            const final = resolve(input.final_path);
+            if (input.final_path !== final || dirname(final) !== resolve(paths.at(-1)))
+                fail();
+            const publicationHandle = parseTargetSecretSourceOpaqueHandle(input.publication_handle);
+            const proveOwned = async () => {
+                const proofBytes = Uint8Array.from(owned);
+                try {
+                    await input.proveExact(proofBytes);
+                }
+                finally {
+                    proofBytes.fill(0);
+                }
+            };
+            await proveOwned();
+            const claim = `${final}.claim`;
+            const token = `${final}.token.${publicationHandle}`;
+            const proveFinal = async () => {
+                if (await readFinal(final, owned) !== "exact")
+                    return false;
+                await proveOwned();
+                return true;
+            };
+            for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt += 1) {
+                const finalState = await readFinal(final, owned);
+                const claimState = await snapshotZero(claim, [1, 2]);
+                await options.hookForTest?.("after_claim_snapshot", claim);
+                const tokenState = await snapshotZero(token, [1, 2]);
+                if (finalState === "exact" && claimState === null && tokenState === null) {
+                    if (!await proveFinal())
+                        fail();
+                    return;
+                }
+                if (claimState !== null && tokenState === null) {
+                    if (finalState !== "exact" || claimState.nlink !== 1) {
+                        await yieldTurn();
+                        continue;
+                    }
+                    if (!await proveFinal())
+                        fail();
+                    if (!await unlinkExact(claim, claimState)) {
+                        await yieldTurn();
+                        continue;
+                    }
+                    return;
+                }
+                let ownedToken = tokenState;
+                if (ownedToken === null)
+                    ownedToken = await createToken(token);
+                if (ownedToken === null) {
+                    await yieldTurn();
+                    continue;
+                }
+                let currentClaim = await snapshotZero(claim, [1, 2]);
+                if (currentClaim === null && ownedToken.nlink === 1) {
+                    try {
+                        await checkChain();
+                        await link(token, claim);
+                    }
+                    catch (error) {
+                        if (!exists(error))
+                            fail();
+                    }
+                    await syncDirectory();
+                    await options.hookForTest?.("after_claim_link", claim);
+                    currentClaim = await snapshotZero(claim, [1, 2]);
+                    ownedToken = await snapshotZero(token, [1, 2]);
+                }
+                if (!currentClaim || !ownedToken) {
+                    await yieldTurn();
+                    continue;
+                }
+                if (currentClaim.dev !== ownedToken.dev || currentClaim.ino !== ownedToken.ino) {
+                    await options.hookForTest?.("after_mismatch_snapshot", token);
+                    if (ownedToken.nlink === 1) {
+                        const latest = await snapshotZero(token, [1, 2]);
+                        if (latest?.nlink === 1 && same(latest, ownedToken))
+                            await unlinkExact(token, latest);
+                    }
+                    await yieldTurn();
+                    continue;
+                }
+                if (currentClaim.nlink !== 2 || ownedToken.nlink !== 2) {
+                    await yieldTurn();
+                    continue;
+                }
+                const state = await readFinal(final, owned);
+                if (state === "absent") {
+                    let fd;
+                    try {
+                        fd = await open(final, constants.O_CREAT | constants.O_EXCL | constants.O_RDWR | constants.O_NOFOLLOW, 0o600);
+                        await fd.chmod(0o600);
+                        const empty = fileIdentity(await fd.stat(), uid, [1], true);
+                        await options.hookForTest?.("after_final_create", final);
+                        const split = Math.max(1, Math.floor(owned.length / 2));
+                        let offset = 0;
+                        while (offset < split)
+                            offset += await writeSome(fd, owned, offset, split - offset);
+                        await options.hookForTest?.("after_partial_write", final);
+                        while (offset < owned.length)
+                            offset += await writeSome(fd, owned, offset, owned.length - offset);
+                        await fd.sync();
+                        const complete = fileIdentity(await fd.stat(), uid, [1]);
+                        if (empty.dev !== complete.dev || empty.ino !== complete.ino || complete.size !== owned.length)
+                            fail();
+                        await options.hookForTest?.("after_file_sync", final);
+                    }
+                    catch (error) {
+                        if (!exists(error))
+                            fail();
+                    }
+                    finally {
+                        await fd?.close().catch(() => undefined);
+                    }
+                }
+                else if (state === "prefix") {
+                    let fd;
+                    try {
+                        fd = await open(final, constants.O_RDWR | constants.O_NOFOLLOW);
+                        const before = fileIdentity(await fd.stat(), uid, [1]);
+                        if (before.size > owned.length)
+                            fail();
+                        let offset = before.size;
+                        while (offset < owned.length)
+                            offset += await writeSome(fd, owned, offset, owned.length - offset);
+                        await fd.sync();
+                        const after = fileIdentity(await fd.stat(), uid, [1]);
+                        if (before.dev !== after.dev || before.ino !== after.ino || after.size !== owned.length)
+                            fail();
+                    }
+                    catch {
+                        fail();
+                    }
+                    finally {
+                        await fd?.close().catch(() => undefined);
+                    }
+                }
+                if (!await proveFinal()) {
+                    await yieldTurn();
+                    continue;
+                }
+                await syncDirectory();
+                await options.hookForTest?.("after_directory_sync", final);
+                const exactToken = await snapshotZero(token, [1, 2]);
+                await options.hookForTest?.("after_exact_token_snapshot", token);
+                const exactClaim = await snapshotZero(claim, [1, 2]);
+                if (!exactToken || !exactClaim || exactToken.dev !== exactClaim.dev || exactToken.ino !== exactClaim.ino
+                    || exactToken.nlink !== 2 || exactClaim.nlink !== 2) {
+                    await yieldTurn();
+                    continue;
+                }
+                await unlinkExact(token, exactToken);
+                await options.hookForTest?.("after_token_cleanup", token);
+                const remainingClaim = await snapshotZero(claim, [1, 2]);
+                if (remainingClaim === null) {
+                    if (!await proveFinal())
+                        fail();
+                    return;
+                }
+                if (remainingClaim.nlink !== 1 || !await unlinkExact(claim, remainingClaim)) {
+                    await yieldTurn();
+                    continue;
+                }
+                await options.hookForTest?.("after_claim_cleanup", claim);
+                if (!await proveFinal())
+                    fail();
+                return;
+            }
+            fail();
+        }
+        catch {
+            fail();
+        }
+        finally {
+            owned?.fill(0);
+        }
+    };
+    return Object.freeze({ publishImmutable });
+};

package/dist/auth/targetSecretSourceFsRead.d.ts

@@ -0,0 +1,14 @@
+import { type TargetSecretSourceAliasRecord, type TargetSecretSourceVersionRecord } from "./targetSecretSourceVersionRecords.js";
+import { type TargetSecretSourceGrantRecord, type TargetSecretSourceRedemptionRecord, type TargetSecretSourceRevocationRecord } from "./targetSecretSourceGrantRecords.js";
+export interface TargetSecretSourceFsRead {
+    readAlias(handle: unknown): Promise<TargetSecretSourceAliasRecord | null>;
+    readGrant(handle: unknown): Promise<TargetSecretSourceGrantRecord | null>;
+    readRedemption(handle: unknown): Promise<TargetSecretSourceRedemptionRecord | null>;
+    readRevocation(handle: unknown): Promise<TargetSecretSourceRevocationRecord | null>;
+    readVersion(handle: unknown): Promise<TargetSecretSourceVersionRecord | null>;
+}
+export interface TargetSecretSourceFsReadOptions {
+    readonly beforeLeafLstatForTest?: (path: string) => Promise<void> | void;
+    readonly beforeOpenForTest?: (path: string) => Promise<void> | void;
+}
+export declare const initializeTargetSecretSourceFsRead: (options?: TargetSecretSourceFsReadOptions) => Promise<TargetSecretSourceFsRead>;

package/dist/auth/targetSecretSourceFsRead.js

@@ -0,0 +1,198 @@
+import { Buffer } from "node:buffer";
+import { constants } from "node:fs";
+import { lstat, mkdir, open } from "node:fs/promises";
+import { MAX_JSON_GRAPH_STRING_BYTES, TARGET_SECRET_SOURCE_ERROR, parseTargetSecretSourceOpaqueHandle } from "./targetSecretSourceRecordCommon.js";
+import { parseTargetSecretSourceAliasRecordBytes, parseTargetSecretSourceVersionRecordBytes } from "./targetSecretSourceVersionRecords.js";
+import { parseTargetSecretSourceGrantRecordBytes, parseTargetSecretSourceRedemptionRecordBytes, parseTargetSecretSourceRevocationRecordBytes } from "./targetSecretSourceGrantRecords.js";
+import { resolveAuthHome, resolveSpawnfileHome, resolveTargetSecretAliasPath, resolveTargetSecretAliasesDirectory, resolveTargetSecretGrantPath, resolveTargetSecretGrantsDirectory, resolveTargetSecretRedemptionPath, resolveTargetSecretRedemptionsDirectory, resolveTargetSecretRevocationPath, resolveTargetSecretRevocationsDirectory, resolveTargetSecretVersionPath, resolveTargetSecretVersionsDirectory, resolveTargetSecretsRoot } from "./paths.js";
+const fail = () => { throw new Error(TARGET_SECRET_SOURCE_ERROR); };
+const absent = (error) => error.code === "ENOENT";
+const uid = () => { const value = process.getuid?.(); if (typeof value !== "number")
+    return fail(); return value; };
+const directoryIdentity = (info, owner) => {
+    if (!info.isDirectory() || info.isSymbolicLink() || info.uid !== BigInt(owner) || (info.mode & 4095n) !== 448n)
+        return fail();
+    return { birthtimeNs: info.birthtimeNs, dev: info.dev, ino: info.ino, mode: info.mode, uid: info.uid };
+};
+const fileIdentity = (info, owner) => {
+    if (!info.isFile() || info.isSymbolicLink() || info.uid !== BigInt(owner) || info.nlink !== 1n || info.size < 0n || info.size > BigInt(MAX_JSON_GRAPH_STRING_BYTES) || (info.mode & 4095n) !== 384n)
+        return fail();
+    return { birthtimeNs: info.birthtimeNs, ctimeNs: info.ctimeNs, dev: info.dev, ino: info.ino, mode: info.mode, nlink: info.nlink, size: Number(info.size), uid: info.uid };
+};
+const sameDirectory = (left, right) => left.birthtimeNs === right.birthtimeNs && left.dev === right.dev && left.ino === right.ino && left.mode === right.mode && left.uid === right.uid;
+const sameFile = (left, right) => left.birthtimeNs === right.birthtimeNs && left.ctimeNs === right.ctimeNs && left.dev === right.dev && left.ino === right.ino && left.mode === right.mode && left.nlink === right.nlink && left.size === right.size && left.uid === right.uid;
+const initializeDirectory = async (directory, owner, create) => {
+    let info;
+    try {
+        info = await lstat(directory, { bigint: true });
+    }
+    catch (error) {
+        if (!create || !absent(error))
+            return fail();
+        try {
+            await mkdir(directory, { mode: 0o700 });
+            info = await lstat(directory, { bigint: true });
+        }
+        catch {
+            return fail();
+        }
+    }
+    const before = directoryIdentity(info, owner);
+    let handle;
+    try {
+        handle = await open(directory, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+    }
+    catch {
+        return fail();
+    }
+    try {
+        const opened = directoryIdentity(await handle.stat({ bigint: true }), owner);
+        const after = directoryIdentity(await lstat(directory, { bigint: true }), owner);
+        if (!sameDirectory(before, opened) || !sameDirectory(before, after))
+            return fail();
+        return opened;
+    }
+    catch {
+        return fail();
+    }
+    finally {
+        await handle.close().catch(() => undefined);
+    }
+};
+const checkChain = async (chain, owner) => {
+    for (const entry of chain) {
+        let info;
+        try {
+            info = await lstat(entry.path, { bigint: true });
+        }
+        catch {
+            return fail();
+        }
+        const before = directoryIdentity(info, owner);
+        if (!sameDirectory(before, entry.identity))
+            return fail();
+        let handle;
+        try {
+            handle = await open(entry.path, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+        }
+        catch {
+            return fail();
+        }
+        try {
+            const opened = directoryIdentity(await handle.stat({ bigint: true }), owner);
+            const after = directoryIdentity(await lstat(entry.path, { bigint: true }), owner);
+            if (!sameDirectory(opened, entry.identity) || !sameDirectory(after, entry.identity))
+                return fail();
+        }
+        catch {
+            return fail();
+        }
+        finally {
+            await handle.close().catch(() => undefined);
+        }
+    }
+};
+const readRecord = async (file, expected, parse, chain, owner, hooks) => {
+    await checkChain(chain, owner);
+    try {
+        await hooks.beforeLeafLstatForTest?.(file);
+    }
+    catch {
+        return fail();
+    }
+    let beforeInfo;
+    try {
+        beforeInfo = await lstat(file, { bigint: true });
+    }
+    catch (error) {
+        if (!absent(error))
+            return fail();
+        await checkChain(chain, owner);
+        try {
+            beforeInfo = await lstat(file, { bigint: true });
+        }
+        catch (retry) {
+            if (absent(retry))
+                return null;
+            return fail();
+        }
+    }
+    const before = fileIdentity(beforeInfo, owner);
+    try {
+        await hooks.beforeOpenForTest?.(file);
+    }
+    catch {
+        return fail();
+    }
+    let handle;
+    try {
+        handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+    }
+    catch {
+        return fail();
+    }
+    let bytes;
+    try {
+        const opened = fileIdentity(await handle.stat({ bigint: true }), owner);
+        if (!sameFile(before, opened))
+            return fail();
+        bytes = Buffer.alloc(opened.size + 1);
+        let offset = 0;
+        while (offset < bytes.length) {
+            const result = await handle.read(bytes, offset, bytes.length - offset, offset);
+            if (result.bytesRead === 0)
+                break;
+            offset += result.bytesRead;
+        }
+        const after = fileIdentity(await handle.stat({ bigint: true }), owner);
+        let pathname;
+        try {
+            pathname = fileIdentity(await lstat(file, { bigint: true }), owner);
+        }
+        catch {
+            return fail();
+        }
+        if (offset !== opened.size || !sameFile(opened, after) || !sameFile(opened, pathname))
+            return fail();
+        await checkChain(chain, owner);
+        const content = Uint8Array.from(bytes.subarray(0, offset));
+        try {
+            return parse(content, expected);
+        }
+        finally {
+            content.fill(0);
+        }
+    }
+    catch {
+        return fail();
+    }
+    finally {
+        bytes?.fill(0);
+        await handle.close().catch(() => undefined);
+    }
+};
+export const initializeTargetSecretSourceFsRead = async (options = {}) => {
+    const owner = uid();
+    const paths = [resolveSpawnfileHome(), resolveAuthHome(), resolveTargetSecretsRoot(), resolveTargetSecretVersionsDirectory(), resolveTargetSecretGrantsDirectory(), resolveTargetSecretRedemptionsDirectory(), resolveTargetSecretRevocationsDirectory(), resolveTargetSecretAliasesDirectory()];
+    const identities = [];
+    for (let index = 0; index < paths.length; index += 1)
+        identities.push(await initializeDirectory(paths[index], owner, index > 0));
+    const chains = Object.freeze({ aliases: paths.slice(0, 8).map((path, index) => ({ path, identity: identities[index] })), grants: paths.slice(0, 5).map((path, index) => ({ path, identity: identities[index] })), redemptions: paths.slice(0, 6).map((path, index) => ({ path, identity: identities[index] })), revocations: paths.slice(0, 7).map((path, index) => ({ path, identity: identities[index] })), versions: paths.slice(0, 4).map((path, index) => ({ path, identity: identities[index] })) });
+    const read = (raw, pathFor, parse, chain) => {
+        let handle;
+        try {
+            handle = parseTargetSecretSourceOpaqueHandle(raw);
+        }
+        catch {
+            return Promise.reject(new Error(TARGET_SECRET_SOURCE_ERROR));
+        }
+        return readRecord(pathFor(handle), handle, parse, chain, owner, options);
+    };
+    return Object.freeze({
+        readAlias: (handle) => read(handle, resolveTargetSecretAliasPath, parseTargetSecretSourceAliasRecordBytes, chains.aliases),
+        readGrant: (handle) => read(handle, resolveTargetSecretGrantPath, parseTargetSecretSourceGrantRecordBytes, chains.grants),
+        readRedemption: (handle) => read(handle, resolveTargetSecretRedemptionPath, parseTargetSecretSourceRedemptionRecordBytes, chains.redemptions),
+        readRevocation: (handle) => read(handle, resolveTargetSecretRevocationPath, parseTargetSecretSourceRevocationRecordBytes, chains.revocations),
+        readVersion: (handle) => read(handle, resolveTargetSecretVersionPath, parseTargetSecretSourceVersionRecordBytes, chains.versions)
+    });
+};

package/dist/auth/targetSecretSourceGrant.d.ts

@@ -0,0 +1,16 @@
+import { type OpaqueTargetSecretSourceHandle } from "./targetSecretSourceRecordCommon.js";
+import { type TargetSecretSourceFsRead } from "./targetSecretSourceFsRead.js";
+import { type TargetSecretSourceEntropy, type TargetSecretSourceGrantMetadata } from "./targetSecretSourceGrantRecords.js";
+import { type TargetSecretSourceRecordPublish } from "./targetSecretSourceRecordPublish.js";
+export type TargetSecretSourceGrantInput = Readonly<Omit<TargetSecretSourceGrantMetadata, "source_version_handle" | "version">>;
+export interface TargetSecretSourceGrant {
+    grantSource(input: TargetSecretSourceGrantInput): Promise<Readonly<{
+        source_handle: OpaqueTargetSecretSourceHandle;
+    }>>;
+}
+export interface TargetSecretSourceGrantOptions {
+    readonly publicationEntropy?: TargetSecretSourceEntropy;
+    readonly publisher?: Pick<TargetSecretSourceRecordPublish, "publishGrant">;
+    readonly reader?: Pick<TargetSecretSourceFsRead, "readAlias" | "readGrant" | "readRevocation" | "readVersion">;
+}
+export declare const initializeTargetSecretSourceGrant: (options?: TargetSecretSourceGrantOptions) => Promise<TargetSecretSourceGrant>;