spawnfile 0.1.12 → 0.1.14

package/dist/target/dockerTargetBinding.js

@@ -0,0 +1,96 @@
+import { execFile as execFileCallback } from "node:child_process";
+import { createHash } from "node:crypto";
+import { promisify } from "node:util";
+import { SpawnfileError } from "../shared/index.js";
+import { SELECTED_TARGET_VERSION, parseOpaqueTargetHandle, parseSelectedTargetReceipt } from "./contracts.js";
+import { createEndpointFingerprint } from "./dockerEndpointFingerprint.js";
+export const defaultDockerTargetExecFile = promisify(execFileCallback);
+const TARGET_SELECTION_ERROR = "Target selection failed";
+const DOCKER_CONTEXT_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/u;
+const MAX_RAW_EXECUTOR_STDOUT_BYTES = 4_096;
+const parseDockerEndpoint = (stdout) => {
+    if (Buffer.byteLength(stdout, "utf8") > MAX_RAW_EXECUTOR_STDOUT_BYTES) {
+        throw new SpawnfileError("runtime_error", TARGET_SELECTION_ERROR);
+    }
+    const trimmed = stdout.trim();
+    if (trimmed.length === 0) {
+        throw new SpawnfileError("runtime_error", "Docker context endpoint was empty");
+    }
+    try {
+        const parsed = JSON.parse(trimmed);
+        if (typeof parsed === "string" && parsed.trim().length > 0)
+            return parsed.trim();
+    }
+    catch {
+        // Docker/podman variants may return a plain string instead of JSON.
+    }
+    return trimmed;
+};
+export const resolveDockerContextEndpoint = async (context, options) => {
+    try {
+        const { stdout } = await options.execFile(options.dockerCommand, ["context", "inspect", context, "--format", "{{json .Endpoints.docker.Host}}"], { signal: options.signal, timeout: options.timeoutMs });
+        return parseDockerEndpoint(stdout);
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new SpawnfileError("runtime_error", `Unable to resolve Docker context "${context}": ${reason}`);
+    }
+};
+const selectionFailure = (code) => {
+    throw new SpawnfileError(code, TARGET_SELECTION_ERROR);
+};
+const selectTargetContext = (input) => {
+    if (input.DOCKER_HOST != null || input.dockerHost != null || input.endpoint != null || input.host != null) {
+        return selectionFailure("validation_error");
+    }
+    if (typeof input.context !== "string" || !DOCKER_CONTEXT_PATTERN.test(input.context)) {
+        return selectionFailure("validation_error");
+    }
+    return input.context;
+};
+const isDockerContextEndpoint = (endpoint) => endpoint.length <= 4_096
+    && /^(?:npipe|ssh|tcp|unix|fd|http|https):\/\/[^\s]+$/u.test(endpoint);
+const selectTargetOptions = (input) => {
+    if (input.dockerCommand !== undefined && (typeof input.dockerCommand !== "string" || input.dockerCommand.length === 0 || input.dockerCommand.length > 128)) {
+        return selectionFailure("validation_error");
+    }
+    if (input.timeoutMs !== undefined && (typeof input.timeoutMs !== "number" || !Number.isSafeInteger(input.timeoutMs) || input.timeoutMs < 1 || input.timeoutMs > 120_000)) {
+        return selectionFailure("validation_error");
+    }
+    return {
+        dockerCommand: input.dockerCommand ?? "docker",
+        execFile: input.execFile ?? defaultDockerTargetExecFile,
+        signal: input.signal,
+        timeoutMs: input.timeoutMs ?? 10_000
+    };
+};
+const createSelectedTargetHandle = (context, fingerprint) => parseOpaqueTargetHandle(`opaque_${createHash("sha256")
+    .update("spawnfile.target-resource.selected-target.v1\0", "utf8")
+    .update(context, "utf8")
+    .update("\0", "utf8")
+    .update(fingerprint, "utf8")
+    .digest("hex")}`);
+export const selectedTargetForContextEndpoint = (context, endpoint) => {
+    if (!DOCKER_CONTEXT_PATTERN.test(context) || !isDockerContextEndpoint(endpoint)) {
+        return selectionFailure("runtime_error");
+    }
+    const fingerprint = createEndpointFingerprint(endpoint);
+    return parseSelectedTargetReceipt({
+        fingerprint,
+        handle: createSelectedTargetHandle(context, fingerprint),
+        version: SELECTED_TARGET_VERSION
+    });
+};
+export const resolveSelectedTargetBinding = async (input = {}) => {
+    try {
+        const context = selectTargetContext(input);
+        const endpoint = await resolveDockerContextEndpoint(context, selectTargetOptions(input));
+        const selected = selectedTargetForContextEndpoint(context, endpoint);
+        return Object.freeze({ endpoint, selected });
+    }
+    catch {
+        return selectionFailure("runtime_error");
+    }
+};
+/** Resolves one explicit named Docker context without exposing private selector data. */
+export const selectTarget = async (input = {}) => (await resolveSelectedTargetBinding(input)).selected;

package/dist/target/dockerWorldClock.d.ts

@@ -0,0 +1,17 @@
+import type { DockerTargetExecutors } from "./dockerCommandExecutor.js";
+import type { DockerWorldServiceExecutor } from "./dockerWorldServiceProvider.js";
+import type { WorldServiceAuthorityReader } from "./dockerWorldServiceStore.js";
+import { type TargetWorldClockReceipt } from "./worldClock.js";
+export declare const TARGET_WORLD_CLOCK_ERROR = "Target world clock query failed";
+export interface DockerWorldClockOptions {
+    readonly authorityStore: WorldServiceAuthorityReader;
+    readonly context: string;
+    readonly contentExecutor: DockerTargetExecutors["publicArtifact"];
+    readonly executor: DockerWorldServiceExecutor;
+    readonly signal?: AbortSignal;
+    readonly timeoutMs: number;
+}
+export interface WorldClockReader {
+    query(raw: unknown): Promise<TargetWorldClockReceipt>;
+}
+export declare const createDockerWorldClockReader: (input: DockerWorldClockOptions) => WorldClockReader;

package/dist/target/dockerWorldClock.js

@@ -0,0 +1,111 @@
+import { SpawnfileError } from "../shared/index.js";
+import { inspectDockerWorldService, sameWorldServiceValue, worldServiceSpecForBinding, } from "./dockerWorldServiceLifecycle.js";
+import { createCanonicalWorldServiceActivationBytes, createTargetTopologyActivationReceiptDigest, createWorldServiceActivationDigest, parseWorldServiceActivation, } from "./topologyActivation.js";
+import { createTargetWorldClockReceipt, MAX_TARGET_WORLD_CLOCK_BYTES, parseTargetWorldClockRequest, } from "./worldClock.js";
+export const TARGET_WORLD_CLOCK_ERROR = "Target world clock query failed";
+const CONTEXT = /^[a-z][a-z0-9_-]{0,63}$/u;
+const fail = () => { throw new SpawnfileError("runtime_error", TARGET_WORLD_CLOCK_ERROR); };
+const options = (raw) => {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)
+        || typeof raw.context !== "string" || !CONTEXT.test(raw.context)
+        || typeof raw.contentExecutor !== "function" || typeof raw.executor !== "function"
+        || !raw.authorityStore || typeof raw.authorityStore.loadService !== "function"
+        || !Number.isSafeInteger(raw.timeoutMs) || raw.timeoutMs < 1 || raw.timeoutMs > 120_000
+        || raw.signal !== undefined && !(raw.signal instanceof AbortSignal))
+        return fail();
+    return raw;
+};
+const queryScript = [
+    "import http from \"node:http\";",
+    "const [rawPort,pathname]=process.argv.slice(1);const port=Number(rawPort);",
+    "const fail=()=>{process.exitCode=1;};",
+    "if(!Number.isSafeInteger(port)||port<1||port>65535||pathname!==\"/v1/world/clock\")fail();",
+    "else http.get({headers:{accept:\"application/json\"},host:\"127.0.0.1\",path:pathname,port},response=>{",
+    "const media=response.headers[\"content-type\"];if(response.statusCode!==200||typeof media!==\"string\"||!media.toLowerCase().startsWith(\"application/json\")){response.resume();fail();return;}",
+    `const chunks=[];let size=0;response.on("data",chunk=>{size+=chunk.length;if(size>${MAX_TARGET_WORLD_CLOCK_BYTES}){response.destroy();fail();}else chunks.push(chunk);});`,
+    "response.on(\"end\",()=>{if(process.exitCode!==1)process.stdout.write(Buffer.concat(chunks));});response.on(\"error\",fail);",
+    "}).on(\"error\",fail);",
+].join("\n");
+const bytes = async (optionsValue, args) => {
+    const result = await optionsValue.contentExecutor("docker", [
+        "--context", optionsValue.context, "container", "exec", ...args,
+    ], { signal: optionsValue.signal, timeout: optionsValue.timeoutMs }).catch(fail);
+    if (!result || !(result.bytes instanceof Uint8Array)
+        || result.bytes.byteLength < 2 || result.bytes.byteLength > MAX_TARGET_WORLD_CLOCK_BYTES)
+        return fail();
+    return result.bytes;
+};
+const json = (raw) => {
+    try {
+        return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(raw));
+    }
+    catch {
+        return fail();
+    }
+};
+class DockerWorldClockReader {
+    #options;
+    constructor(input) { this.#options = options(input); }
+    async query(raw) {
+        let request;
+        try {
+            request = parseTargetWorldClockRequest(raw);
+        }
+        catch {
+            return fail();
+        }
+        const binding = await this.#options.authorityStore
+            .loadService(request.world_service_handle).catch(fail);
+        const authorization = binding.resolution.authorization;
+        if (binding.world_service_handle !== request.world_service_handle
+            || authorization.run_id !== request.run_id
+            || authorization.descriptor_digest !== request.descriptor_digest
+            || !sameWorldServiceValue(authorization.selected_target, request.selected_target))
+            return fail();
+        const spec = worldServiceSpecForBinding(binding);
+        const before = await inspectDockerWorldService(binding.container_id, spec, this.#options).catch(fail);
+        if (!before || before.containerId !== binding.container_id || before.status !== "running")
+            return fail();
+        const markerBytes = await bytes(this.#options, [
+            binding.container_id, "/bin/cat",
+            `${spec.evidenceMountPath}/.spawnfile/world-service-activated.v1`,
+        ]);
+        let marker;
+        try {
+            marker = parseWorldServiceActivation(json(markerBytes));
+            if (new TextDecoder().decode(markerBytes) !== createCanonicalWorldServiceActivationBytes(marker)
+                || marker.run_id !== request.run_id
+                || marker.topology_receipt_digest !== request.topology_receipt_digest
+                || marker.topology_request_digest !== request.topology_request_digest
+                || createWorldServiceActivationDigest(marker) !== request.activation_digest)
+                return fail();
+            const activationBody = {
+                activation_digest: request.activation_digest, bundle_digest: marker.bundle_digest,
+                receipt_digest: `sha256:${"0".repeat(64)}`, run_id: marker.run_id,
+                state: "activated", topology_receipt_digest: marker.topology_receipt_digest,
+                topology_request_digest: marker.topology_request_digest,
+                version: "spawnfile.target-topology-activation-receipt.v1",
+            };
+            if (createTargetTopologyActivationReceiptDigest(activationBody)
+                !== request.activation_receipt_digest)
+                return fail();
+        }
+        catch {
+            return fail();
+        }
+        const observed = json(await bytes(this.#options, [
+            binding.container_id, "/usr/local/bin/node", "--input-type=module", "-e",
+            queryScript, String(request.endpoint.internal_port), request.endpoint.path,
+        ]));
+        const after = await inspectDockerWorldService(binding.container_id, spec, this.#options).catch(fail);
+        if (!after || after.containerId !== before.containerId || after.status !== "running")
+            return fail();
+        try {
+            return createTargetWorldClockReceipt({ observation: observed, request });
+        }
+        catch {
+            return fail();
+        }
+    }
+}
+export const createDockerWorldClockReader = (input) => new DockerWorldClockReader(input);

package/dist/target/dockerWorldReadiness.d.ts

@@ -0,0 +1,17 @@
+import type { DockerTargetExecutors } from "./dockerCommandExecutor.js";
+import { type DockerWorldServiceExecutor } from "./dockerWorldServiceProvider.js";
+import type { WorldServiceAuthorityReader } from "./dockerWorldServiceStore.js";
+import { type TargetWorldReadinessReceipt } from "./worldReadiness.js";
+export declare const TARGET_WORLD_READINESS_ERROR = "Target world readiness query failed";
+export interface DockerWorldReadinessOptions {
+    readonly authorityStore: WorldServiceAuthorityReader;
+    readonly context: string;
+    readonly contentExecutor: DockerTargetExecutors["publicArtifact"];
+    readonly executor: DockerWorldServiceExecutor;
+    readonly signal?: AbortSignal;
+    readonly timeoutMs: number;
+}
+export interface WorldReadinessReader {
+    query(raw: unknown): Promise<TargetWorldReadinessReceipt>;
+}
+export declare const createDockerWorldReadinessReader: (options: DockerWorldReadinessOptions) => WorldReadinessReader;

package/dist/target/dockerWorldReadiness.js

@@ -0,0 +1,119 @@
+import { SpawnfileError } from "../shared/index.js";
+import { types as nodeTypes } from "node:util";
+import { inspectDockerWorldService, sameWorldServiceValue, worldServiceSpecForBinding } from "./dockerWorldServiceLifecycle.js";
+import { createTargetWorldReadinessReceipt, MAX_TARGET_WORLD_READINESS_BYTES, parseTargetWorldReadinessRequest } from "./worldReadiness.js";
+export const TARGET_WORLD_READINESS_ERROR = "Target world readiness query failed";
+const CONTEXT_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/u;
+const fail = () => {
+    throw new SpawnfileError("runtime_error", TARGET_WORLD_READINESS_ERROR);
+};
+const validOptions = (raw) => {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw) || nodeTypes.isProxy(raw)
+        || Object.getPrototypeOf(raw) !== Object.prototype)
+        return fail();
+    const descriptors = Object.getOwnPropertyDescriptors(raw);
+    const required = [
+        "authorityStore", "context", "contentExecutor", "executor", "timeoutMs"
+    ];
+    const expected = Object.hasOwn(descriptors, "signal") ? [...required, "signal"] : required;
+    const keys = Reflect.ownKeys(raw);
+    if (keys.length !== expected.length
+        || keys.some((key) => typeof key !== "string" || !expected.includes(key))
+        || Object.values(descriptors).some((descriptor) => !descriptor.enumerable || !("value" in descriptor)))
+        return fail();
+    const values = Object.fromEntries(expected.map((key) => [key, descriptors[key].value]));
+    if (typeof values.context !== "string" || !CONTEXT_PATTERN.test(values.context)
+        || typeof values.contentExecutor !== "function"
+        || typeof values.executor !== "function"
+        || !values.authorityStore || typeof values.authorityStore.loadService !== "function"
+        || !Number.isSafeInteger(values.timeoutMs) || values.timeoutMs < 1
+        || values.timeoutMs > 120_000
+        || values.signal !== undefined && !(values.signal instanceof AbortSignal))
+        return fail();
+    return Object.freeze(values);
+};
+const exactBinding = async (request, options) => {
+    const binding = await options.authorityStore.loadService(request.world_service_handle);
+    const authorization = binding.resolution.authorization;
+    if (binding.world_service_handle !== request.world_service_handle
+        || authorization.run_id !== request.run_id
+        || authorization.descriptor_digest !== request.descriptor_digest
+        || !sameWorldServiceValue(authorization.selected_target, request.selected_target))
+        return fail();
+    return binding;
+};
+const queryScript = [
+    "import http from \"node:http\";",
+    "const [rawPort, pathname] = process.argv.slice(1);",
+    "const port = Number(rawPort);",
+    "const fail = () => { process.exitCode = 1; };",
+    "if (!Number.isSafeInteger(port) || port < 1 || port > 65535 || pathname !== \"/v1/world/readiness\") fail();",
+    "else http.get({headers:{accept:\"application/json\"},host:\"127.0.0.1\",path:pathname,port}, response => {",
+    "const mediaType = response.headers[\"content-type\"];",
+    "if (response.statusCode !== 200 || typeof mediaType !== \"string\" || !mediaType.toLowerCase().startsWith(\"application/json\")) { response.resume(); fail(); return; }",
+    "const chunks = []; let size = 0;",
+    `response.on("data", chunk => { size += chunk.length; if (size > ${MAX_TARGET_WORLD_READINESS_BYTES}) { response.destroy(); fail(); } else chunks.push(chunk); });`,
+    "response.on(\"end\", () => { if (process.exitCode !== 1) process.stdout.write(Buffer.concat(chunks)); });",
+    "response.on(\"error\", fail);",
+    "}).on(\"error\", fail);"
+].join("\n");
+const queryWorld = async (containerId, request, options) => {
+    try {
+        const result = await options.contentExecutor("docker", [
+            "--context", options.context,
+            "container", "exec",
+            containerId,
+            "/usr/local/bin/node",
+            "--input-type=module",
+            "-e",
+            queryScript,
+            String(request.endpoint.internal_port),
+            request.endpoint.path
+        ], {
+            signal: options.signal,
+            timeout: options.timeoutMs
+        });
+        if (!result || !(result.bytes instanceof Uint8Array)
+            || result.bytes.byteLength < 2
+            || result.bytes.byteLength > MAX_TARGET_WORLD_READINESS_BYTES)
+            return fail();
+        const text = new TextDecoder("utf-8", { fatal: true }).decode(result.bytes);
+        return JSON.parse(text);
+    }
+    catch {
+        return fail();
+    }
+};
+class DockerWorldReadinessReader {
+    #options;
+    constructor(options) {
+        this.#options = validOptions(options);
+    }
+    async query(raw) {
+        let request;
+        try {
+            request = parseTargetWorldReadinessRequest(raw);
+        }
+        catch {
+            return fail();
+        }
+        const binding = await exactBinding(request, this.#options).catch(fail);
+        const spec = worldServiceSpecForBinding(binding);
+        const before = await inspectDockerWorldService(binding.container_id, spec, this.#options).catch(fail);
+        if (!before || before.containerId !== binding.container_id
+            || before.status !== "running")
+            return fail();
+        const document = await queryWorld(binding.container_id, request, this.#options);
+        const after = await inspectDockerWorldService(binding.container_id, spec, this.#options).catch(fail);
+        if (!after || after.containerId !== before.containerId
+            || after.status !== "running")
+            return fail();
+        try {
+            return createTargetWorldReadinessReceipt({ document, request });
+        }
+        catch {
+            return fail();
+        }
+    }
+}
+export const createDockerWorldReadinessReader = (options) => new DockerWorldReadinessReader(options);

package/dist/target/dockerWorldService.d.ts

@@ -0,0 +1,23 @@
+import { type TargetResourceReceipt } from "./contracts.js";
+import { type TargetJournalStore } from "./journal.js";
+import { type WorldServiceResolver } from "./dockerWorldServiceAuthority.js";
+import { type DockerWorldServiceExecutor } from "./dockerWorldServiceProvider.js";
+import { type WorldServiceAuthorityStore } from "./dockerWorldServiceStore.js";
+type OperationResult = {
+    readonly receipt: TargetResourceReceipt;
+    readonly receiptBytes: string;
+};
+export interface DockerWorldServiceOperationsOptions {
+    readonly authorityStore: WorldServiceAuthorityStore;
+    readonly context: unknown;
+    readonly executor: DockerWorldServiceExecutor;
+    readonly journal: TargetJournalStore;
+    readonly resolver: WorldServiceResolver;
+    readonly signal?: AbortSignal;
+    readonly timeoutMs?: unknown;
+}
+export interface DockerWorldServiceOperations {
+    execute(raw: unknown): Promise<OperationResult>;
+}
+export declare const createDockerWorldServiceOperations: (options: DockerWorldServiceOperationsOptions) => DockerWorldServiceOperations;
+export {};

package/dist/target/dockerWorldService.js

@@ -0,0 +1,216 @@
+import { SpawnfileError } from "../shared/index.js";
+import { parseTargetResourceRequest } from "./contracts.js";
+import { WORLD_SERVICE_ERROR } from "./dockerWorldServiceAuthority.js";
+import { DockerWorldServiceProviderError } from "./dockerWorldServiceProvider.js";
+import { createWorldServiceReceipt, inspectDockerWorldService, mutateDockerWorldService, resolveWorldServiceCreate, sameWorldServiceValue, selectedWorldServiceContextMatches, verifyWorldServiceResources, worldServiceSpecForBinding } from "./dockerWorldServiceLifecycle.js";
+import { createWorldServiceBinding, createWorldServiceMutationAdmission } from "./dockerWorldServiceStore.js";
+const CONTEXT_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/u;
+const CONTAINER_ID_PATTERN = /^[a-f0-9]{64}$/u;
+const exactMutationAck = (stdout, containerId) => stdout === "" || stdout === `${containerId}\n`;
+const fail = () => {
+    throw new SpawnfileError("runtime_error", WORLD_SERVICE_ERROR);
+};
+const validOptions = (raw) => {
+    if (typeof raw.context !== "string" || !CONTEXT_PATTERN.test(raw.context)
+        || typeof raw.executor !== "function"
+        || !raw.journal || typeof raw.journal.reserve !== "function"
+        || !raw.resolver || typeof raw.resolver.resolve !== "function"
+        || !raw.authorityStore || typeof raw.authorityStore.bindResolution !== "function"
+        || typeof raw.timeoutMs !== "undefined"
+            && (typeof raw.timeoutMs !== "number" || !Number.isSafeInteger(raw.timeoutMs)
+                || raw.timeoutMs < 1 || raw.timeoutMs > 120_000))
+        return fail();
+    return {
+        authorityStore: raw.authorityStore,
+        context: raw.context,
+        executor: raw.executor,
+        journal: raw.journal,
+        resolver: raw.resolver,
+        signal: raw.signal,
+        timeoutMs: raw.timeoutMs ?? 10_000
+    };
+};
+const parseRequest = (raw) => {
+    const request = parseTargetResourceRequest(raw);
+    if (request.operation !== "create_world_service"
+        && request.operation !== "start_world_service"
+        && request.operation !== "stop_world_service")
+        return fail();
+    return request;
+};
+class DockerWorldServiceOperationsImpl {
+    #live = new Map();
+    #options;
+    constructor(options) { this.#options = options; }
+    execute(raw) {
+        let request;
+        try {
+            request = parseRequest(raw);
+        }
+        catch {
+            return Promise.reject(new SpawnfileError("runtime_error", WORLD_SERVICE_ERROR));
+        }
+        const active = this.#live.get(request.idempotency_key);
+        if (active)
+            return sameWorldServiceValue(active.request, request) ? active.promise
+                : Promise.reject(new SpawnfileError("runtime_error", WORLD_SERVICE_ERROR));
+        const promise = this.executeOwner(request).finally(() => {
+            if (this.#live.get(request.idempotency_key)?.promise === promise) {
+                this.#live.delete(request.idempotency_key);
+            }
+        });
+        this.#live.set(request.idempotency_key, { promise, request });
+        return promise;
+    }
+    async executeOwner(request) {
+        try {
+            const reservation = await this.#options.journal.reserve(request);
+            if (reservation.kind === "replay") {
+                return { receipt: reservation.receipt, receiptBytes: reservation.receiptBytes };
+            }
+            return request.operation === "create_world_service"
+                ? await this.create(request, reservation.claim, reservation.kind)
+                : await this.change(request, reservation.claim, reservation.kind);
+        }
+        catch {
+            return fail();
+        }
+    }
+    async create(request, claim, reservation) {
+        const resolved = await resolveWorldServiceCreate(request, claim, this.#options);
+        await selectedWorldServiceContextMatches(request, this.#options);
+        await verifyWorldServiceResources(resolved, this.#options);
+        const spec = worldServiceSpecForBinding(resolved);
+        const admission = createWorldServiceMutationAdmission({
+            containerId: null,
+            containerName: spec.containerName,
+            operation: request.operation,
+            operationHandle: claim.operationHandle,
+            requestDigest: claim.requestDigest,
+            worldServiceHandle: spec.resultHandle
+        });
+        let current;
+        if (reservation === "owner") {
+            current = await inspectDockerWorldService(spec.containerName, spec, this.#options);
+            if (current !== null)
+                return fail();
+            await this.#options.authorityStore.bindMutationAdmission(admission);
+        }
+        else {
+            await this.#options.authorityStore.requireMutationAdmission(admission);
+            current = await inspectDockerWorldService(spec.containerName, spec, this.#options);
+        }
+        let createdId = null;
+        if (current === null) {
+            try {
+                const stdout = await mutateDockerWorldService([...spec.createArgs], this.#options);
+                const candidate = stdout.endsWith("\n") ? stdout.slice(0, -1) : stdout;
+                if (!CONTAINER_ID_PATTERN.test(candidate))
+                    return fail();
+                createdId = candidate;
+            }
+            catch (error) {
+                if (!(error instanceof DockerWorldServiceProviderError)
+                    || error.kind !== "collision")
+                    throw error;
+            }
+            current = await inspectDockerWorldService(spec.containerName, spec, this.#options);
+        }
+        if (!current || current.status !== "created"
+            || createdId !== null && current.containerId !== createdId)
+            return fail();
+        const binding = createWorldServiceBinding({
+            containerId: current.containerId,
+            dataNetwork: resolved.resources.data_network,
+            evidenceVolume: resolved.resources.evidence_volume,
+            resolution: resolved.resolution,
+            secretBindings: resolved.resources.secret_bindings,
+            spec
+        });
+        await this.#options.authorityStore.bindService(binding);
+        const receipt = await createWorldServiceReceipt({ claim, journal: this.#options.journal,
+            labels: spec.receiptLabels, request, resultHandle: spec.resultHandle });
+        return this.#options.journal.complete(claim, receipt);
+    }
+    async change(request, claim, reservation) {
+        const binding = await this.#options.authorityStore.loadService(request.world_service_handle);
+        if (binding.world_service_handle !== request.world_service_handle
+            || binding.resolution.authorization.run_id !== request.run_id
+            || binding.resolution.authorization.descriptor_digest !== request.descriptor_digest
+            || !sameWorldServiceValue(binding.resolution.authorization.selected_target, request.selected_target))
+            return fail();
+        const spec = worldServiceSpecForBinding(binding);
+        if (spec.resultHandle !== request.world_service_handle)
+            return fail();
+        await selectedWorldServiceContextMatches(request, this.#options);
+        await verifyWorldServiceResources(binding, this.#options);
+        const admission = createWorldServiceMutationAdmission({
+            containerId: binding.container_id,
+            containerName: spec.containerName,
+            operation: request.operation,
+            operationHandle: claim.operationHandle,
+            requestDigest: claim.requestDigest,
+            worldServiceHandle: binding.world_service_handle
+        });
+        let current;
+        if (reservation === "owner") {
+            current = await inspectDockerWorldService(binding.container_id, spec, this.#options);
+            if (!current || current.containerId !== binding.container_id)
+                return fail();
+            if (request.operation === "start_world_service"
+                && current.status !== "created" && current.status !== "exited")
+                return fail();
+            if (request.operation === "stop_world_service" && current.status === "removing")
+                return fail();
+            await this.#options.authorityStore.bindMutationAdmission(admission);
+        }
+        else {
+            await this.#options.authorityStore.requireMutationAdmission(admission);
+            current = await inspectDockerWorldService(binding.container_id, spec, this.#options);
+        }
+        if (request.operation === "start_world_service") {
+            if (!current)
+                return fail();
+            if (current.status !== "running") {
+                if (current.status !== "created" && current.status !== "exited")
+                    return fail();
+                if (!exactMutationAck(await mutateDockerWorldService(["container", "start", binding.container_id], this.#options), binding.container_id))
+                    return fail();
+                current = await inspectDockerWorldService(binding.container_id, spec, this.#options);
+            }
+            if (!current || current.containerId !== binding.container_id
+                || current.status !== "running")
+                return fail();
+        }
+        else {
+            if (current?.status === "running" || current?.status === "paused"
+                || current?.status === "restarting") {
+                if (!exactMutationAck(await mutateDockerWorldService(["container", "stop", "--timeout", "10", binding.container_id], this.#options), binding.container_id))
+                    return fail();
+                current = await inspectDockerWorldService(binding.container_id, spec, this.#options);
+            }
+            if (current?.status === "running" || current?.status === "paused"
+                || current?.status === "restarting" || current?.status === "removing")
+                return fail();
+            if (current) {
+                try {
+                    if (!exactMutationAck(await mutateDockerWorldService(["container", "rm", binding.container_id], this.#options), binding.container_id))
+                        return fail();
+                }
+                catch (error) {
+                    if (!(error instanceof DockerWorldServiceProviderError)
+                        || error.kind !== "not_found")
+                        throw error;
+                }
+            }
+            if (await inspectDockerWorldService(binding.container_id, spec, this.#options) !== null)
+                return fail();
+        }
+        const resultHandle = request.operation === "start_world_service"
+            ? binding.world_service_handle : null;
+        const receipt = await createWorldServiceReceipt({ claim, journal: this.#options.journal,
+            labels: spec.receiptLabels, request, resultHandle });
+        return this.#options.journal.complete(claim, receipt);
+    }
+}
+export const createDockerWorldServiceOperations = (options) => new DockerWorldServiceOperationsImpl(validOptions(options));