spawnfile 0.1.13 → 0.1.14

package/dist/cli/targetCommands.d.ts

@@ -0,0 +1,33 @@
+import type { Command } from "commander";
+import { type TargetPublicArtifactSnapshot, type TargetPublicArtifactSnapshotRequest } from "../target/publicArtifactSnapshot.js";
+import { type TargetTopologyActivationResult } from "../target/topologyActivation.js";
+import { type SelectedTargetReceipt, type TargetResourceRequest, type TargetTopologyAttestationRequest } from "../target/contracts.js";
+import { type TargetOperation } from "./targetOperationDispatch.js";
+import { type TargetMutationResult } from "./targetReceiptOutput.js";
+import type { TargetDefaultConfig } from "./targetDefaultConfig.js";
+import { type TargetOperationLookupLoader } from "./targetLookupCommands.js";
+import type { TargetTopologyAttestationResult } from "../target/topologyAttestation.js";
+import { type TargetWorldClockSession } from "./targetWorldClockCommand.js";
+import { type TargetWorldReadinessSession } from "./targetWorldReadinessCommand.js";
+type RequestFor<Operation extends TargetOperation> = Extract<TargetResourceRequest, {
+    operation: Operation;
+}>;
+export type TargetCommandHandlers = {
+    [Operation in TargetOperation]: (request: RequestFor<Operation>) => Promise<Operation extends "select_target" ? SelectedTargetReceipt : TargetMutationResult>;
+};
+export type TargetCommandSessionLoader = (configInput: unknown) => Promise<TargetCommandHandlerSession>;
+export interface TargetCommandHandlerSession extends TargetWorldReadinessSession, TargetWorldClockSession {
+    run<Result>(invoke: (handlers: TargetCommandHandlers) => Promise<Result>): Promise<Result>;
+    activateTopology?(request: TargetTopologyAttestationRequest): Promise<TargetTopologyActivationResult>;
+    attestTopology?(request: TargetTopologyAttestationRequest): Promise<TargetTopologyAttestationResult>;
+    snapshotPublicArtifact?(request: TargetPublicArtifactSnapshotRequest): Promise<TargetPublicArtifactSnapshot>;
+}
+export interface TargetCommandStreams {
+    stderr(message: string): void;
+    stdout(message: string): void;
+}
+type SetTargetCommandExitCode = (exitCode: 1 | 2) => void;
+export declare const registerTargetCommands: (program: Command, session: TargetCommandHandlerSession | TargetCommandSessionLoader, streams: TargetCommandStreams, setExitCode: SetTargetCommandExitCode, lookupLoader?: TargetOperationLookupLoader, worldReadinessSession?: (configInput: unknown) => Promise<TargetWorldReadinessSession & TargetWorldClockSession>) => Command;
+export declare const createProductionTargetCommandSession: (config: TargetDefaultConfig) => TargetCommandHandlerSession;
+export declare const registerProductionTargetCommands: (program: Command, streams: TargetCommandStreams, stdin: AsyncIterable<unknown>, setExitCode: SetTargetCommandExitCode) => void;
+export {};

package/dist/cli/targetCommands.js

@@ -0,0 +1,257 @@
+import { createCanonicalTargetTopologyReceiptBytes, createCanonicalSelectedTargetReceiptBytes, createTargetTopologyReceiptDigest } from "../target/handles.js";
+import { createCanonicalTargetPublicArtifactSnapshotBytes } from "../target/publicArtifactSnapshot.js";
+import { createCanonicalTargetTopologyActivationReceiptBytes, createTargetTopologyActivationReceiptDigest, parseTargetTopologyActivationReceipt } from "../target/topologyActivation.js";
+import { parseSelectedTargetReceipt, parseTargetTopologyReceipt } from "../target/contracts.js";
+import { TARGET_OPERATION_DISPATCH } from "./targetOperationDispatch.js";
+import { emitCanonicalTargetMutationReceipt, formatCaughtTargetCliError, formatTargetCliError } from "./targetReceiptOutput.js";
+import { readTargetRequestFile, readTargetPublicArtifactSnapshotRequestFile, readTargetTopologyAttestationRequestFile } from "./targetRequestFile.js";
+import { readTargetDefaultConfigStdin, readTargetWorldReadinessConfigStdin } from "./targetDefaultConfigStdin.js";
+import { createProductionTargetLookupLoader, registerTargetOperationLookup } from "./targetLookupCommands.js";
+import { registerContainerBundleCommand } from "./containerBundleCommand.js";
+import { registerTargetWorldClockCommand } from "./targetWorldClockCommand.js";
+import { registerTargetWorldReadinessCommand, } from "./targetWorldReadinessCommand.js";
+import { registerTargetComposedPreparationCommand } from "./targetComposedPreparationCommand.js";
+import { createProductionTargetWorldQuerySession } from "./targetDefaultWorldQueries.js";
+const operations = Object.keys(TARGET_OPERATION_DISPATCH);
+const invoke = async (handlers, request) => {
+    const handler = handlers[request.operation];
+    return handler(request);
+};
+const emitSelection = (raw, streams) => {
+    const receipt = parseSelectedTargetReceipt(raw);
+    streams.stdout(createCanonicalSelectedTargetReceiptBytes(receipt));
+};
+const registerOperation = (target, operation, session, streams, setExitCode) => {
+    target.command(operation)
+        .description(`Execute the ${operation} target operation`)
+        .argument("<request-file>", "Strict target-resource request JSON file")
+        .action(async (requestFile) => {
+        let request;
+        try {
+            request = await readTargetRequestFile(requestFile);
+            if (request.operation !== operation)
+                throw new TypeError("operation mismatch");
+        }
+        catch {
+            streams.stderr(formatTargetCliError("request"));
+            setExitCode(2);
+            return;
+        }
+        let activeSession;
+        try {
+            activeSession = typeof session === "function"
+                ? await session(target.opts().config)
+                : session;
+        }
+        catch {
+            streams.stderr("error: Invalid target configuration");
+            setExitCode(2);
+            return;
+        }
+        try {
+            const result = await activeSession.run((handlers) => invoke(handlers, request));
+            if (operation === "select_target") {
+                emitSelection(result, streams);
+            }
+            else {
+                emitCanonicalTargetMutationReceipt(result, streams.stdout);
+            }
+        }
+        catch (error) {
+            streams.stderr(formatCaughtTargetCliError(error, "Target operation crashed"));
+            setExitCode(1);
+        }
+    });
+};
+const emitTopologyReceipt = (raw, streams) => {
+    const receipt = parseTargetTopologyReceipt(raw.receipt);
+    const bytes = createCanonicalTargetTopologyReceiptBytes(receipt);
+    if (typeof raw.receiptBytes !== "string" || raw.receiptBytes !== bytes
+        || receipt.receipt_digest !== createTargetTopologyReceiptDigest(receipt)) {
+        throw new TypeError("Target attestation returned a non-canonical receipt");
+    }
+    streams.stdout(bytes);
+};
+const emitTopologyActivationReceipt = (raw, streams) => {
+    const receipt = parseTargetTopologyActivationReceipt(raw.receipt);
+    const bytes = createCanonicalTargetTopologyActivationReceiptBytes(receipt);
+    if (typeof raw.receiptBytes !== "string" || raw.receiptBytes !== bytes
+        || receipt.receipt_digest !== createTargetTopologyActivationReceiptDigest(receipt)) {
+        throw new TypeError("Target activation returned a non-canonical receipt");
+    }
+    streams.stdout(bytes);
+};
+const registerTopologyActivation = (target, session, streams, setExitCode) => {
+    target.command("activate_topology")
+        .description("Release one exact attested target topology")
+        .argument("<request-file>", "Strict target topology-attestation request JSON file")
+        .action(async (requestFile) => {
+        let request;
+        try {
+            request = await readTargetTopologyAttestationRequestFile(requestFile);
+        }
+        catch {
+            streams.stderr("error: Invalid target activation request");
+            setExitCode(2);
+            return;
+        }
+        let activeSession;
+        try {
+            activeSession = typeof session === "function"
+                ? await session(target.opts().config)
+                : session;
+            if (typeof activeSession.activateTopology !== "function")
+                throw new TypeError();
+        }
+        catch {
+            streams.stderr("error: Invalid target configuration");
+            setExitCode(2);
+            return;
+        }
+        try {
+            emitTopologyActivationReceipt(await activeSession.activateTopology(request), streams);
+        }
+        catch (error) {
+            streams.stderr(formatCaughtTargetCliError(error, "Target topology activation crashed"));
+            setExitCode(1);
+        }
+    });
+};
+const registerTopologyAttestation = (target, session, streams, setExitCode) => {
+    target.command("attest_topology")
+        .description("Attest one exact composed target topology")
+        .argument("<request-file>", "Strict target topology-attestation request JSON file")
+        .action(async (requestFile) => {
+        let request;
+        try {
+            request = await readTargetTopologyAttestationRequestFile(requestFile);
+        }
+        catch {
+            streams.stderr("error: Invalid target attestation request");
+            setExitCode(2);
+            return;
+        }
+        let activeSession;
+        try {
+            activeSession = typeof session === "function"
+                ? await session(target.opts().config)
+                : session;
+            if (typeof activeSession.attestTopology !== "function")
+                throw new TypeError();
+        }
+        catch {
+            streams.stderr("error: Invalid target configuration");
+            setExitCode(2);
+            return;
+        }
+        try {
+            emitTopologyReceipt(await activeSession.attestTopology(request), streams);
+        }
+        catch (error) {
+            streams.stderr(formatCaughtTargetCliError(error, "Target topology attestation crashed"));
+            setExitCode(1);
+        }
+    });
+};
+const registerPublicArtifactSnapshot = (target, session, streams, setExitCode) => {
+    target.command("snapshot_public_artifact")
+        .description("Read one exact bounded public artifact from a world service")
+        .argument("<request-file>", "Strict public artifact snapshot request JSON file")
+        .action(async (requestFile) => {
+        let request;
+        try {
+            request = await readTargetPublicArtifactSnapshotRequestFile(requestFile);
+        }
+        catch {
+            streams.stderr("error: Invalid public artifact snapshot request");
+            setExitCode(2);
+            return;
+        }
+        let activeSession;
+        try {
+            activeSession = typeof session === "function"
+                ? await session(target.opts().config)
+                : session;
+            if (typeof activeSession.snapshotPublicArtifact !== "function")
+                throw new TypeError();
+        }
+        catch {
+            streams.stderr("error: Invalid target configuration");
+            setExitCode(2);
+            return;
+        }
+        try {
+            streams.stdout(createCanonicalTargetPublicArtifactSnapshotBytes(await activeSession.snapshotPublicArtifact(request)));
+        }
+        catch (error) {
+            streams.stderr(formatCaughtTargetCliError(error, "Target public artifact snapshot crashed"));
+            setExitCode(1);
+        }
+    });
+};
+export const registerTargetCommands = (program, session, streams, setExitCode, lookupLoader, worldReadinessSession) => {
+    const target = program.command("target").description("Execute target-resource operations");
+    if (typeof session === "function") {
+        target.requiredOption("--config <config-input>", "Strict target configuration JSON stdin; use -");
+    }
+    for (const operation of operations) {
+        registerOperation(target, operation, session, streams, setExitCode);
+    }
+    registerTargetComposedPreparationCommand(target, session, streams, setExitCode);
+    if (typeof session === "function" || typeof session.attestTopology === "function") {
+        registerTopologyAttestation(target, session, streams, setExitCode);
+    }
+    if (typeof session === "function" || typeof session.snapshotPublicArtifact === "function") {
+        registerPublicArtifactSnapshot(target, session, streams, setExitCode);
+    }
+    if (typeof session === "function" || typeof session.queryWorldReadiness === "function") {
+        registerTargetWorldReadinessCommand(target, worldReadinessSession ?? session, streams, setExitCode);
+    }
+    if (typeof session === "function" || typeof session.queryWorldClock === "function") {
+        registerTargetWorldClockCommand(target, worldReadinessSession ?? session, streams, setExitCode);
+    }
+    if (typeof session === "function" || typeof session.activateTopology === "function") {
+        registerTopologyActivation(target, session, streams, setExitCode);
+    }
+    if (lookupLoader)
+        registerTargetOperationLookup(target, lookupLoader, streams, setExitCode);
+    return target;
+};
+export const createProductionTargetCommandSession = (config) => Object.freeze({
+    activateTopology: async (request) => {
+        const { activateTargetDefaultTopology } = await import("./targetDefaultHandlers.js");
+        return activateTargetDefaultTopology(config, request);
+    },
+    run: async (invokeHandlers) => {
+        const { withTargetDefaultHandlerSession } = await import("./targetDefaultHandlers.js");
+        return withTargetDefaultHandlerSession(config, invokeHandlers);
+    },
+    attestTopology: async (request) => {
+        const { attestTargetDefaultTopology } = await import("./targetDefaultHandlers.js");
+        return attestTargetDefaultTopology(config, request);
+    },
+    queryWorldReadiness: async (request) => {
+        const { queryTargetDefaultWorldReadiness } = await import("./targetDefaultWorldReadiness.js");
+        return queryTargetDefaultWorldReadiness(config, request);
+    },
+    queryWorldClock: async (request) => {
+        const { queryTargetDefaultWorldClock } = await import("./targetDefaultWorldClock.js");
+        return queryTargetDefaultWorldClock(config, request);
+    },
+    snapshotPublicArtifact: async (request) => {
+        const { snapshotTargetDefaultPublicArtifact } = await import("./targetDefaultHandlers.js");
+        return snapshotTargetDefaultPublicArtifact(config, request);
+    }
+});
+export const registerProductionTargetCommands = (program, streams, stdin, setExitCode) => {
+    const target = registerTargetCommands(program, async (configInput) => {
+        if (configInput !== "-")
+            throw new TypeError("Invalid target configuration");
+        return createProductionTargetCommandSession(await readTargetDefaultConfigStdin(stdin));
+    }, streams, setExitCode, createProductionTargetLookupLoader(stdin), async (configInput) => {
+        if (configInput !== "-")
+            throw new TypeError("Invalid target configuration");
+        return createProductionTargetWorldQuerySession(await readTargetWorldReadinessConfigStdin(stdin));
+    });
+    registerContainerBundleCommand(target, stdin, streams, setExitCode);
+};

package/dist/cli/targetComposedPreparationCommand.d.ts

@@ -0,0 +1,6 @@
+import type { Command } from "commander";
+import type { TargetCommandHandlerSession, TargetCommandSessionLoader, TargetCommandStreams } from "./targetCommands.js";
+type SetExitCode = (exitCode: 1 | 2) => void;
+/** Registers the sole aggregate preparation path consumed by Simfile. */
+export declare const registerTargetComposedPreparationCommand: (target: Command, session: TargetCommandHandlerSession | TargetCommandSessionLoader, streams: TargetCommandStreams, setExitCode: SetExitCode) => void;
+export {};

package/dist/cli/targetComposedPreparationCommand.js

@@ -0,0 +1,39 @@
+import { createCanonicalComposedPreparationReceiptBytes, prepareComposedRun, } from "../target/composedPreparation.js";
+import { formatCaughtTargetCliError } from "./targetReceiptOutput.js";
+import { readComposedPreparationRequestFile } from "./targetRequestFile.js";
+/** Registers the sole aggregate preparation path consumed by Simfile. */
+export const registerTargetComposedPreparationCommand = (target, session, streams, setExitCode) => {
+    target.command("prepare_composed_run")
+        .description("Prepare one immutable composed-run target resource set")
+        .argument("<request-file>", "Strict composed-preparation request JSON file")
+        .action(async (requestFile) => {
+        let request;
+        try {
+            request = await readComposedPreparationRequestFile(requestFile);
+        }
+        catch {
+            streams.stderr("error: Invalid composed preparation request");
+            setExitCode(2);
+            return;
+        }
+        let activeSession;
+        try {
+            activeSession = typeof session === "function"
+                ? await session(target.opts().config)
+                : session;
+        }
+        catch {
+            streams.stderr("error: Invalid target configuration");
+            setExitCode(2);
+            return;
+        }
+        try {
+            const receipt = await activeSession.run((handlers) => prepareComposedRun(handlers, request));
+            streams.stdout(createCanonicalComposedPreparationReceiptBytes(receipt));
+        }
+        catch (error) {
+            streams.stderr(formatCaughtTargetCliError(error, "Composed preparation crashed"));
+            setExitCode(1);
+        }
+    });
+};

package/dist/cli/targetDefaultArtifactAuthority.d.ts

@@ -0,0 +1,5 @@
+import type { TargetDefaultConfig } from "./targetDefaultConfig.js";
+import type { DockerArtifactIdentityBinding, DockerArtifactIdentityStore, DockerArtifactMapping } from "../target/dockerArtifactsProvider.js";
+import type { TargetJournalStore } from "../target/journal.js";
+export declare const completedTargetArtifacts: (journal: TargetJournalStore, identities: DockerArtifactIdentityStore) => Promise<readonly DockerArtifactIdentityBinding[]>;
+export declare const exactTargetArtifactMapping: (config: TargetDefaultConfig, binding: DockerArtifactIdentityBinding) => DockerArtifactMapping;

package/dist/cli/targetDefaultArtifactAuthority.js

@@ -0,0 +1,28 @@
+const fail = () => { throw new Error("Target authority initialization failed"); };
+export const completedTargetArtifacts = async (journal, identities) => {
+    const snapshot = await journal.read();
+    const bindings = [];
+    for (const entry of snapshot.entries) {
+        if (entry.operation !== "resolve_world_artifact" || entry.state !== "completed")
+            continue;
+        const completed = await journal.resolveCompletedReceipt({ operationHandle: entry.operation_handle, requestDigest: entry.request_digest });
+        if (!completed || completed.receipt.operation !== "resolve_world_artifact" || completed.receipt.operation_handle !== entry.operation_handle
+            || completed.receipt.request_digest !== entry.request_digest || completed.receipt.result_handle === null)
+            return fail();
+        const binding = await identities.resolveOperation(entry.operation_handle, entry.request_digest);
+        if (!binding || binding.operationHandle !== entry.operation_handle || binding.requestDigest !== entry.request_digest
+            || binding.resultHandle !== completed.receipt.result_handle || binding.selectedTargetHandle !== snapshot.selected_target.handle)
+            return fail();
+        bindings.push(binding);
+    }
+    return Object.freeze(bindings);
+};
+export const exactTargetArtifactMapping = (config, binding) => {
+    if (binding.identityKind !== "oci_image_manifest")
+        return fail();
+    const matches = config.artifactMappings.filter((mapping) => mapping.artifact_manifest_digest === binding.artifactManifestDigest
+        && mapping.image_digest === binding.imageDigest && mapping.image_reference === binding.imageReference);
+    if (matches.length !== 1)
+        return fail();
+    return matches[0];
+};

package/dist/cli/targetDefaultAuthorities.d.ts

@@ -0,0 +1,53 @@
+import { type DockerArtifactIdentityBinding, type DockerArtifactIdentityStore, type DockerArtifactMapping } from "../target/dockerArtifactsProvider.js";
+import { type DockerTargetExecutors } from "../target/dockerCommandExecutor.js";
+import { type TargetSecretVersionAuthorityStore } from "../target/dockerSecretsAuthority.js";
+import { type WorldServiceResolver } from "../target/dockerWorldServiceAuthority.js";
+import { type WorldServiceAuthorityStore } from "../target/dockerWorldServiceStore.js";
+import { type EvidenceExportAuthorityStore } from "../target/evidenceExportStore.js";
+import { type OrganizationAttachmentAuthorityStore } from "../target/organizationAttachmentStore.js";
+import { type TargetTopologyAttestor } from "../target/topologyAttestation.js";
+import type { TargetSecretSourceResolver } from "../target/dockerSecrets.js";
+import type { OrganizationAttachmentResolver } from "../target/organizationAttachmentAuthority.js";
+import type { TargetDefaultConfig } from "./targetDefaultConfig.js";
+import { type TargetJournalResolver } from "./targetDefaultJournalAuthority.js";
+export { TARGET_DEFAULT_AUTHORITIES_ERROR, type TargetJournalResolver, type TargetMutationAuthority } from "./targetDefaultJournalAuthority.js";
+export interface HelperArtifactAuthority {
+    readonly artifactIdentity: DockerArtifactIdentityBinding;
+    readonly bundle: {
+        readonly operation_handle: DockerArtifactIdentityBinding["operationHandle"];
+        readonly request_digest: string;
+        readonly result_handle: DockerArtifactIdentityBinding["resultHandle"];
+    };
+    readonly mapping: DockerArtifactMapping;
+}
+export interface HelperArtifactResolver {
+    resolve(input: {
+        readonly context: unknown;
+        readonly request: unknown;
+    }): Promise<HelperArtifactAuthority>;
+}
+export interface TargetDefaultAuthorities {
+    readonly artifactIdentityStore: DockerArtifactIdentityStore;
+    readonly attachmentAuthorityStore: OrganizationAttachmentAuthorityStore;
+    readonly evidenceExportAuthorityStore: EvidenceExportAuthorityStore;
+    readonly executors: DockerTargetExecutors;
+    readonly handoffResolver: OrganizationAttachmentResolver;
+    /** Omitted when this invocation cannot export evidence. */
+    readonly helperArtifactResolver?: HelperArtifactResolver;
+    readonly journals: TargetJournalResolver;
+    readonly secretAuthorityStore: TargetSecretVersionAuthorityStore;
+    readonly secretResolver: TargetSecretSourceResolver;
+    readonly topologyAttestor: TargetTopologyAttestor;
+    readonly worldAuthorityStore: WorldServiceAuthorityStore;
+    readonly worldResolver: WorldServiceResolver;
+}
+/**
+ * The production authority graph owns B114 worker clients and directory file
+ * handles.  It is therefore deliberately a session, rather than an ambient
+ * process singleton: the caller that starts the graph must close it.
+ */
+export interface TargetDefaultAuthoritySession {
+    readonly authorities: TargetDefaultAuthorities;
+    dispose(): Promise<void>;
+}
+export declare const initializeTargetDefaultAuthoritySession: (config: TargetDefaultConfig) => Promise<TargetDefaultAuthoritySession>;

package/dist/cli/targetDefaultAuthorities.js

@@ -0,0 +1,210 @@
+import { initializeDockerArtifactIdentityStore } from "../target/dockerArtifactsProvider.js";
+import { createDockerTargetExecutors } from "../target/dockerCommandExecutor.js";
+import { initializeTargetSecretVersionAuthorityStore } from "../target/dockerSecretsAuthority.js";
+import { parseWorldServiceAuthorization, parseWorldServiceResolution } from "../target/dockerWorldServiceAuthority.js";
+import { initializeWorldServiceAuthorityStore } from "../target/dockerWorldServiceStore.js";
+import { initializeEvidenceExportAuthorityStore } from "../target/evidenceExportStore.js";
+import { initializeOrganizationAttachmentAuthorityStore } from "../target/organizationAttachmentStore.js";
+import { createTargetTopologyAttestor } from "../target/topologyAttestation.js";
+import { initializeTargetSecretSourceResolver } from "../auth/targetSecretSourceResolver.js";
+import { initializeOrganizationHandoffAuthorityStore } from "../deployment/organizationHandoffAuthorityStore.js";
+import { completedTargetArtifacts, exactTargetArtifactMapping } from "./targetDefaultArtifactAuthority.js";
+import { targetDefaultEnvelope as envelope } from "./targetDefaultEnvelope.js";
+import { createDockerTargetLocalBundleBuilder } from "../target/dockerContainerBundleBuilder.js";
+import { attestPreparedArtifactIdentity } from "../target/dockerPreparedArtifact.js";
+import { initializeFilesystemTargetLocalBundleStore } from "../target/containerBundleFilesystemStore.js";
+import { createTargetJournalAccess, TARGET_DEFAULT_AUTHORITIES_ERROR } from "./targetDefaultJournalAuthority.js";
+export { TARGET_DEFAULT_AUTHORITIES_ERROR } from "./targetDefaultJournalAuthority.js";
+const fail = () => { throw new Error(TARGET_DEFAULT_AUTHORITIES_ERROR); };
+const same = (left, right) => JSON.stringify(left) === JSON.stringify(right);
+export const initializeTargetDefaultAuthoritySession = async (config) => {
+    let handoffAuthority;
+    try {
+        const journalAccess = createTargetJournalAccess(config);
+        const journals = journalAccess.resolver;
+        const [artifactIdentityStore, secretAuthorityStore, attachmentAuthorityStore, worldAuthorityStore, evidenceExportAuthorityStore, secretResolver] = await Promise.all([
+            initializeDockerArtifactIdentityStore(config.paths.artifactIdentities),
+            initializeTargetSecretVersionAuthorityStore(config.paths.secretAuthority),
+            initializeOrganizationAttachmentAuthorityStore(config.paths.attachmentAuthority),
+            initializeWorldServiceAuthorityStore(config.paths.worldAuthority),
+            initializeEvidenceExportAuthorityStore(config.paths.evidenceExport),
+            // Production always resolves grants from the B113 host-local authority
+            // store.  It deliberately has no configuration or ambient override seam.
+            initializeTargetSecretSourceResolver()
+        ]);
+        // The B114 store owns its anchored filesystem workers.  Keep the store
+        // alive through its resolver rather than accepting a caller-provided one.
+        handoffAuthority = await initializeOrganizationHandoffAuthorityStore();
+        const handoffResolver = handoffAuthority.resolver;
+        const executors = createDockerTargetExecutors({ dockerCommand: config.dockerCommand });
+        const preparedBuilder = createDockerTargetLocalBundleBuilder({ context: config.context,
+            executor: executors.artifact, timeoutMs: config.timeoutMs });
+        const preparedStore = await initializeFilesystemTargetLocalBundleStore(config.paths.containerBundles);
+        const worldResolver = Object.freeze({
+            resolve: async (raw) => {
+                const input = envelope(raw, ["authorization"], ["signal"]);
+                let authorization;
+                try {
+                    authorization = parseWorldServiceAuthorization(input.authorization);
+                }
+                catch {
+                    return fail();
+                }
+                const journal = await journalAccess.resolveIdentity({
+                    context: config.context,
+                    descriptorDigest: authorization.descriptor_digest,
+                    runId: authorization.run_id,
+                    selectedTarget: authorization.selected_target
+                });
+                const bindings = (await completedTargetArtifacts(journal, artifactIdentityStore))
+                    .filter((binding) => binding.resultHandle === authorization.world_artifact_handle);
+                if (bindings.length !== 1)
+                    return fail();
+                const binding = bindings[0];
+                try {
+                    let artifact;
+                    if (binding.identityKind === "oci_image_manifest") {
+                        artifact = {
+                            artifact_manifest_digest: binding.artifactManifestDigest,
+                            identity_kind: binding.identityKind,
+                            image_digest: binding.imageDigest,
+                            image_reference: binding.imageReference,
+                            operation_handle: binding.operationHandle,
+                            request_digest: binding.requestDigest,
+                            result_handle: binding.resultHandle
+                        };
+                    }
+                    else if (binding.identityKind === "docker_image_config_digest") {
+                        const prepared = await preparedStore.resolve({
+                            operation_handle: binding.preparedOperationHandle,
+                            request_digest: binding.preparedRequestDigest
+                        });
+                        if (!prepared || !same(prepared, {
+                            archive_digest: binding.archiveDigest,
+                            artifact_digest: binding.artifactManifestDigest,
+                            base_image_config_digest: binding.baseImageConfigDigest,
+                            build_policy_digest: binding.buildPolicyDigest,
+                            bundle_digest: binding.bundleDigest,
+                            config_id: binding.configId,
+                            daemon_epoch: binding.daemonEpoch,
+                            entrypoint: binding.entrypoint,
+                            gc_tag: binding.gcTag,
+                            identity_kind: binding.identityKind,
+                            launcher_digest: binding.launcherDigest,
+                            network_alias: binding.networkAlias,
+                            operation_handle: binding.preparedOperationHandle,
+                            platform: binding.platform,
+                            platform_digest: binding.platformDigest,
+                            request_digest: binding.preparedRequestDigest,
+                            selected_target: authorization.selected_target
+                        }))
+                            return fail();
+                        await attestPreparedArtifactIdentity(preparedBuilder, binding, prepared, authorization.selected_target);
+                        artifact = {
+                            archive_digest: binding.archiveDigest,
+                            artifact_manifest_digest: binding.artifactManifestDigest,
+                            base_image_config_digest: binding.baseImageConfigDigest,
+                            build_policy_digest: binding.buildPolicyDigest,
+                            bundle_digest: binding.bundleDigest,
+                            config_id: binding.configId,
+                            daemon_epoch: binding.daemonEpoch,
+                            entrypoint: binding.entrypoint,
+                            gc_tag: binding.gcTag,
+                            identity_kind: binding.identityKind,
+                            image_digest: binding.configId,
+                            image_reference: binding.configId,
+                            launcher_digest: binding.launcherDigest,
+                            network_alias: binding.networkAlias,
+                            operation_handle: binding.operationHandle,
+                            platform: binding.platform,
+                            platform_digest: binding.platformDigest,
+                            prepared_operation_handle: binding.preparedOperationHandle,
+                            prepared_request_digest: binding.preparedRequestDigest,
+                            request_digest: binding.requestDigest,
+                            result_handle: binding.resultHandle
+                        };
+                    }
+                    else
+                        return fail();
+                    return parseWorldServiceResolution({
+                        artifact,
+                        authorization
+                    });
+                }
+                catch {
+                    return fail();
+                }
+            }
+        });
+        const helperArtifactResolver = config.helperArtifact
+            ? Object.freeze({
+                resolve: async (raw) => {
+                    const input = envelope(raw, ["context", "request"]);
+                    const authority = await journals.resolve({
+                        context: input.context,
+                        request: input.request
+                    });
+                    const bindings = (await completedTargetArtifacts(authority.journal, artifactIdentityStore))
+                        .filter((binding) => binding.identityKind === "oci_image_manifest"
+                        && binding.artifactManifestDigest === config.helperArtifact.artifact_manifest_digest);
+                    if (bindings.length !== 1)
+                        return fail();
+                    const artifactIdentity = bindings[0];
+                    if (artifactIdentity.identityKind !== "oci_image_manifest")
+                        return fail();
+                    const mapping = exactTargetArtifactMapping(config, artifactIdentity);
+                    return Object.freeze({
+                        artifactIdentity,
+                        bundle: Object.freeze({
+                            operation_handle: artifactIdentity.operationHandle,
+                            request_digest: artifactIdentity.requestDigest,
+                            result_handle: artifactIdentity.resultHandle
+                        }),
+                        mapping
+                    });
+                }
+            }) : undefined;
+        const topologyAttestor = createTargetTopologyAttestor({
+            attachmentExecutor: executors.attachment,
+            attachmentStore: attachmentAuthorityStore,
+            context: config.context,
+            resolveJournal: async (input) => journalAccess.resolveExistingIdentity({
+                context: config.context,
+                descriptorDigest: input.descriptorDigest,
+                runId: input.runId,
+                selectedTarget: input.selectedTarget
+            }),
+            resourceExecutor: executors.resource,
+            timeoutMs: config.timeoutMs,
+            worldExecutor: executors.world,
+            worldStore: worldAuthorityStore
+        });
+        const authorities = Object.freeze({
+            artifactIdentityStore,
+            attachmentAuthorityStore,
+            evidenceExportAuthorityStore,
+            executors,
+            handoffResolver,
+            ...(helperArtifactResolver ? { helperArtifactResolver } : {}),
+            journals,
+            secretAuthorityStore,
+            secretResolver,
+            topologyAttestor,
+            worldAuthorityStore,
+            worldResolver
+        });
+        let disposal;
+        const dispose = async () => {
+            disposal ??= handoffAuthority.dispose();
+            await disposal;
+        };
+        return Object.freeze({ authorities, dispose });
+    }
+    catch {
+        // Do not orphan B114's worker clients if a later authority fails to
+        // initialize.  A successfully-created session transfers that ownership
+        // to its explicit disposer instead.
+        await handoffAuthority?.dispose().catch(() => undefined);
+        return fail();
+    }
+};