spawnfile 0.1.13 → 0.1.14

package/dist/auth/credentialProvisioningRequest.d.ts

@@ -0,0 +1,51 @@
+import { type SelectedTargetReceipt } from "../target/contracts.js";
+export declare const CREDENTIAL_PROVISIONING_REQUEST_VERSION: "spawnfile.auth.credential-provisioning.request.v1";
+export declare const MAX_CREDENTIAL_PROVISIONING_REQUEST_BYTES = 65536;
+export type GeneratedTokenCredentialRequest = Readonly<{
+    bytes: number;
+    env: string;
+    kind: "generated-token";
+    name: string;
+}>;
+/**
+ * `derived-config.content` is DECLARATIVE, non-secret configuration that the caller
+ * authored into the request by design — it is stored as a target secret for uniform
+ * handling, but it is not minted material and its presence in the caller's own request
+ * file is not a leak.
+ */
+export type DerivedConfigCredentialRequest = Readonly<{
+    content: unknown;
+    env: string;
+    kind: "derived-config";
+    name: string;
+}>;
+export type CredentialProvisioningCredentialRequest = GeneratedTokenCredentialRequest | DerivedConfigCredentialRequest;
+export type CredentialProvisioningWorldMember = Readonly<{
+    id: string;
+    principal_id: string;
+    token_credential_name: string;
+}>;
+export type CredentialProvisioningWorldBindings = Readonly<{
+    json_url: string;
+    mcp_url: string;
+    members: readonly CredentialProvisioningWorldMember[];
+    world_instance_id: string;
+}>;
+export type CredentialProvisioningModelEngineAuth = Readonly<{
+    from?: string;
+    kind: "codex";
+    profile: string;
+}>;
+export type CredentialProvisioningRequest = Readonly<{
+    credentials: readonly CredentialProvisioningCredentialRequest[];
+    descriptor_digest: string;
+    model_engine_auth?: CredentialProvisioningModelEngineAuth;
+    run_id: string;
+    scope: string;
+    selected_target: SelectedTargetReceipt;
+    version: typeof CREDENTIAL_PROVISIONING_REQUEST_VERSION;
+    world_bindings?: CredentialProvisioningWorldBindings;
+}>;
+export declare const parseCredentialProvisioningRequest: (raw: unknown) => CredentialProvisioningRequest;
+export declare const parseCredentialProvisioningRequestBytes: (raw: Uint8Array) => CredentialProvisioningRequest;
+export declare const readCredentialProvisioningRequestFile: (filePath: string) => Promise<CredentialProvisioningRequest>;

package/dist/auth/credentialProvisioningRequest.js

@@ -0,0 +1,169 @@
+import { Buffer } from "node:buffer";
+import { open } from "node:fs/promises";
+import { parseRunId, parseSelectedTargetReceipt } from "../target/contracts.js";
+import { TARGET_SECRET_SOURCE_ERROR, assertOrdinaryJsonGraph } from "./targetSecretSourceRecordCommon.js";
+export const CREDENTIAL_PROVISIONING_REQUEST_VERSION = "spawnfile.auth.credential-provisioning.request.v1";
+export const MAX_CREDENTIAL_PROVISIONING_REQUEST_BYTES = 65_536;
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+const ENV = /^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+$/u;
+const FORBIDDEN_KEYS = new Set(["bearer", "material", "password", "secret", "token", "value"]);
+const fail = () => { throw new Error(TARGET_SECRET_SOURCE_ERROR); };
+const normalize = (work) => {
+    try {
+        return work();
+    }
+    catch {
+        return fail();
+    }
+};
+const exact = (raw, required, optional = []) => {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        return fail();
+    const record = raw;
+    const keys = Object.keys(record);
+    const allowed = new Set([...required, ...optional]);
+    if (keys.some((key) => !allowed.has(key)) || required.some((key) => !Object.hasOwn(record, key)))
+        fail();
+    return record;
+};
+const string = (raw) => typeof raw === "string" && raw.length > 0 ? raw : fail();
+const nonEmptyArray = (raw) => Array.isArray(raw) && raw.length > 0 ? raw : fail();
+const generatedByteCount = (raw) => typeof raw === "number"
+    && Number.isInteger(raw)
+    && raw >= 16
+    && raw <= 128
+    ? raw
+    : fail();
+const descriptorDigest = (raw) => typeof raw === "string" && DIGEST.test(raw) ? raw : fail();
+const rejectForbiddenKeys = (raw) => {
+    const pending = [raw];
+    while (pending.length > 0) {
+        const value = pending.pop();
+        if (value === null || typeof value !== "object")
+            continue;
+        if (Array.isArray(value)) {
+            pending.push(...value);
+            continue;
+        }
+        for (const [key, nested] of Object.entries(value)) {
+            if (FORBIDDEN_KEYS.has(key.toLowerCase()))
+                fail();
+            pending.push(nested);
+        }
+    }
+};
+const parseCredential = (raw) => {
+    const base = exact(raw, ["env", "kind", "name"], ["bytes", "content"]);
+    const name = string(base.name);
+    const env = string(base.env);
+    if (!ENV.test(env))
+        fail();
+    if (base.kind === "generated-token") {
+        const record = exact(raw, ["bytes", "env", "kind", "name"]);
+        const bytes = generatedByteCount(record.bytes);
+        return Object.freeze({ bytes, env, kind: "generated-token", name });
+    }
+    if (base.kind === "derived-config") {
+        const record = exact(raw, ["content", "env", "kind", "name"]);
+        assertOrdinaryJsonGraph(record.content);
+        return Object.freeze({ content: structuredClone(record.content), env, kind: "derived-config", name });
+    }
+    return fail();
+};
+const parseWorldBindings = (raw) => {
+    const record = exact(raw, ["json_url", "mcp_url", "members", "world_instance_id"]);
+    const rawMembers = nonEmptyArray(record.members);
+    const members = rawMembers.map((entry) => {
+        const member = exact(entry, ["id", "principal_id", "token_credential_name"]);
+        return Object.freeze({
+            id: string(member.id),
+            principal_id: string(member.principal_id),
+            token_credential_name: string(member.token_credential_name)
+        });
+    });
+    return Object.freeze({
+        json_url: string(record.json_url),
+        mcp_url: string(record.mcp_url),
+        members: Object.freeze(members),
+        world_instance_id: string(record.world_instance_id)
+    });
+};
+const parseModelEngineAuth = (raw) => {
+    const record = exact(raw, ["kind", "profile"], ["from"]);
+    if (record.kind !== "codex")
+        fail();
+    const from = record.from === undefined ? undefined : string(record.from);
+    return Object.freeze({
+        ...(from === undefined ? {} : { from }),
+        kind: "codex",
+        profile: string(record.profile)
+    });
+};
+export const parseCredentialProvisioningRequest = (raw) => normalize(() => {
+    assertOrdinaryJsonGraph(raw);
+    rejectForbiddenKeys(raw);
+    const record = exact(raw, ["credentials", "descriptor_digest", "run_id", "scope", "selected_target", "version"], ["model_engine_auth", "world_bindings"]);
+    if (record.version !== CREDENTIAL_PROVISIONING_REQUEST_VERSION)
+        fail();
+    const parsedDescriptorDigest = descriptorDigest(record.descriptor_digest);
+    const rawCredentials = nonEmptyArray(record.credentials);
+    const credentials = rawCredentials.map(parseCredential);
+    if (new Set(credentials.map(({ name }) => name)).size !== credentials.length
+        || new Set(credentials.map(({ env }) => env)).size !== credentials.length)
+        fail();
+    const worldBindings = record.world_bindings === undefined
+        ? undefined
+        : parseWorldBindings(record.world_bindings);
+    if (worldBindings) {
+        const names = new Set(credentials.map(({ name }) => name));
+        if (worldBindings.members.some(({ token_credential_name: name }) => !names.has(name)))
+            fail();
+    }
+    const modelEngineAuth = record.model_engine_auth === undefined
+        ? undefined
+        : parseModelEngineAuth(record.model_engine_auth);
+    return Object.freeze({
+        credentials: Object.freeze(credentials),
+        descriptor_digest: parsedDescriptorDigest,
+        ...(modelEngineAuth === undefined ? {} : { model_engine_auth: modelEngineAuth }),
+        run_id: parseRunId(record.run_id),
+        scope: string(record.scope),
+        selected_target: parseSelectedTargetReceipt(record.selected_target),
+        version: CREDENTIAL_PROVISIONING_REQUEST_VERSION,
+        ...(worldBindings === undefined ? {} : { world_bindings: worldBindings })
+    });
+});
+export const parseCredentialProvisioningRequestBytes = (raw) => normalize(() => {
+    if (!(raw instanceof Uint8Array) || raw.length < 1 || raw.length > MAX_CREDENTIAL_PROVISIONING_REQUEST_BYTES)
+        fail();
+    const text = new TextDecoder("utf-8", { fatal: true }).decode(raw);
+    return parseCredentialProvisioningRequest(JSON.parse(text));
+});
+export const readCredentialProvisioningRequestFile = async (filePath) => {
+    let bytes;
+    let handle;
+    try {
+        handle = await open(filePath, "r");
+        const info = await handle.stat();
+        if (!info.isFile() || info.size < 1 || info.size > MAX_CREDENTIAL_PROVISIONING_REQUEST_BYTES)
+            fail();
+        bytes = Buffer.alloc(info.size + 1);
+        let offset = 0;
+        while (offset < bytes.length) {
+            const result = await handle.read(bytes, offset, bytes.length - offset, offset);
+            if (result.bytesRead === 0)
+                break;
+            offset += result.bytesRead;
+        }
+        if (offset !== info.size)
+            fail();
+        return parseCredentialProvisioningRequestBytes(bytes.subarray(0, offset));
+    }
+    catch {
+        return fail();
+    }
+    finally {
+        bytes?.fill(0);
+        await handle?.close().catch(() => undefined);
+    }
+};

package/dist/auth/credentialWorldBindings.d.ts

@@ -0,0 +1,21 @@
+import { type SimfileWorldBindingsV1 } from "../compiler/worldBindings.js";
+import type { CredentialProvisioningReceipt } from "./credentialProvisioningReceipt.js";
+import type { CredentialProvisioningRequest } from "./credentialProvisioningRequest.js";
+export declare const RESOLVED_WORLD_GRANTS_VERSION: "spawnfile.auth.resolved-world-grants.v1";
+export type ResolvedWorldGrant = Readonly<{
+    capability_manifest: unknown;
+    member_id: string;
+    principal_id: string;
+}>;
+export type ResolvedWorldGrants = Readonly<{
+    grants: readonly ResolvedWorldGrant[];
+    run_id: string;
+    version: typeof RESOLVED_WORLD_GRANTS_VERSION;
+    world_instance_id: string;
+}>;
+export declare const parseResolvedWorldGrants: (raw: unknown) => ResolvedWorldGrants;
+export declare const buildProvisionedWorldBindings: (input: Readonly<{
+    receipt: CredentialProvisioningReceipt;
+    request: CredentialProvisioningRequest;
+    resolved: unknown;
+}>) => SimfileWorldBindingsV1;

package/dist/auth/credentialWorldBindings.js

@@ -0,0 +1,104 @@
+import { createHash } from "node:crypto";
+import { SIMFILE_WORLD_BINDINGS_VERSION, parseSimfileWorldBindings } from "../compiler/worldBindings.js";
+import { TARGET_SECRET_SOURCE_ERROR, assertOrdinaryJsonGraph, createCanonicalTargetSecretSourceJson } from "./targetSecretSourceRecordCommon.js";
+export const RESOLVED_WORLD_GRANTS_VERSION = "spawnfile.auth.resolved-world-grants.v1";
+const fail = () => { throw new Error(TARGET_SECRET_SOURCE_ERROR); };
+const exact = (raw, keys) => {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        return fail();
+    const record = raw;
+    const actual = Object.keys(record).sort();
+    const expected = [...keys].sort();
+    if (actual.length !== expected.length || actual.some((key, index) => key !== expected[index]))
+        fail();
+    return record;
+};
+const string = (raw) => typeof raw === "string" && raw.length > 0 ? raw : fail();
+const nonEmptyArray = (raw) => Array.isArray(raw) && raw.length > 0 ? raw : fail();
+export const parseResolvedWorldGrants = (raw) => {
+    try {
+        assertOrdinaryJsonGraph(raw);
+        const record = exact(raw, ["grants", "run_id", "version", "world_instance_id"]);
+        if (record.version !== RESOLVED_WORLD_GRANTS_VERSION)
+            fail();
+        const rawGrants = nonEmptyArray(record.grants);
+        const grants = rawGrants.map((rawGrant) => {
+            const grant = exact(rawGrant, ["capability_manifest", "member_id", "principal_id"]);
+            assertOrdinaryJsonGraph(grant.capability_manifest);
+            return Object.freeze({
+                capability_manifest: structuredClone(grant.capability_manifest),
+                member_id: string(grant.member_id),
+                principal_id: string(grant.principal_id)
+            });
+        });
+        return Object.freeze({
+            grants: Object.freeze(grants),
+            run_id: string(record.run_id),
+            version: RESOLVED_WORLD_GRANTS_VERSION,
+            world_instance_id: string(record.world_instance_id)
+        });
+    }
+    catch {
+        return fail();
+    }
+};
+export const buildProvisionedWorldBindings = (input) => {
+    try {
+        const world = input.request.world_bindings ?? fail();
+        if (input.receipt.run_id !== input.request.run_id
+            || input.receipt.scope !== input.request.scope)
+            fail();
+        const resolved = parseResolvedWorldGrants(input.resolved);
+        if (resolved.run_id !== input.request.run_id
+            || resolved.world_instance_id !== world.world_instance_id
+            || resolved.grants.length !== world.members.length)
+            fail();
+        const declared = new Map(world.members.map((member) => [member.id, member]));
+        if (declared.size !== world.members.length)
+            fail();
+        const receiptByName = new Map(input.receipt.credentials.map((credential) => [credential.name, credential]));
+        const digests = new Set();
+        const bindings = resolved.grants.map((grant) => {
+            const member = declared.get(grant.member_id) ?? fail();
+            if (member.principal_id !== grant.principal_id)
+                fail();
+            const credential = receiptByName.get(member.token_credential_name) ?? fail();
+            const requestedCredential = input.request.credentials.find(({ name }) => name === member.token_credential_name) ?? fail();
+            if (credential.env !== requestedCredential.env)
+                fail();
+            let canonical;
+            try {
+                canonical = createCanonicalTargetSecretSourceJson(grant.capability_manifest);
+                const capabilityDigest = `sha256:${createHash("sha256").update(canonical).digest("hex")}`;
+                if (digests.has(capabilityDigest))
+                    fail();
+                digests.add(capabilityDigest);
+                return {
+                    capability_manifest_digest: capabilityDigest,
+                    json: { auth: "bearer", url: world.json_url },
+                    mcp: {
+                        auth: "bearer",
+                        transport: "streamable_http",
+                        url: world.mcp_url
+                    },
+                    member: { id: member.id, principal_id: member.principal_id },
+                    run_id: input.request.run_id,
+                    token_env: credential.env,
+                    world_instance_id: world.world_instance_id
+                };
+            }
+            finally {
+                canonical?.fill(0);
+            }
+        });
+        if (bindings.length !== declared.size)
+            fail();
+        return parseSimfileWorldBindings({
+            bindings,
+            schema: SIMFILE_WORLD_BINDINGS_VERSION
+        });
+    }
+    catch {
+        return fail();
+    }
+};

package/dist/auth/index.d.ts

@@ -3,3 +3,10 @@ export * from "./paths.js";
 export * from "./profileStore.js";
 export * from "./runtimeCredentials.js";
 export * from "./types.js";
+export * from "./credentialEnvFile.js";
+export * from "./credentialProvisioning.js";
+export * from "./credentialProvisioningReceipt.js";
+export * from "./credentialProvisioningRequest.js";
+export * from "./credentialWorldBindings.js";
+export * from "./targetSecretSourceLifecycle.js";
+export * from "./targetSecretSourceResolver.js";

package/dist/auth/index.js

@@ -3,3 +3,10 @@ export * from "./paths.js";
 export * from "./profileStore.js";
 export * from "./runtimeCredentials.js";
 export * from "./types.js";
+export * from "./credentialEnvFile.js";
+export * from "./credentialProvisioning.js";
+export * from "./credentialProvisioningReceipt.js";
+export * from "./credentialProvisioningRequest.js";
+export * from "./credentialWorldBindings.js";
+export * from "./targetSecretSourceLifecycle.js";
+export * from "./targetSecretSourceResolver.js";

package/dist/auth/paths.d.ts

@@ -4,3 +4,14 @@ export declare const resolveProfilesRoot: () => string;
 export declare const resolveProfileDirectory: (profileName: string) => string;
 export declare const resolveProfilePath: (profileName: string) => string;
 export declare const resolveImportedAuthDirectory: (profileName: string, kind: "claude-code" | "codex") => string;
+export declare const resolveTargetSecretsRoot: () => string;
+export declare const resolveTargetSecretVersionsDirectory: () => string;
+export declare const resolveTargetSecretVersionPath: (versionKey: string) => string;
+export declare const resolveTargetSecretGrantsDirectory: () => string;
+export declare const resolveTargetSecretGrantPath: (grantKey: string) => string;
+export declare const resolveTargetSecretRedemptionsDirectory: () => string;
+export declare const resolveTargetSecretRedemptionPath: (redemptionKey: string) => string;
+export declare const resolveTargetSecretRevocationsDirectory: () => string;
+export declare const resolveTargetSecretRevocationPath: (revocationKey: string) => string;
+export declare const resolveTargetSecretAliasesDirectory: () => string;
+export declare const resolveTargetSecretAliasPath: (aliasKey: string) => string;

package/dist/auth/paths.js

@@ -1,6 +1,16 @@
 import os from "node:os";
 import path from "node:path";
 const DEFAULT_SPAWNFILE_HOME = "~/.spawnfile";
+const OPAQUE_TARGET_SECRET_HANDLE_PATTERN = /^opaque_[a-z0-9]{16,64}$/u;
+const assertCanonicalTargetSecretKey = (targetSecretKey) => {
+    if (!OPAQUE_TARGET_SECRET_HANDLE_PATTERN.test(targetSecretKey)) {
+        throw new Error("Invalid target-secret path key");
+    }
+};
+const resolveTargetSecretLeafPath = (leafDirectory, targetSecretKey) => {
+    assertCanonicalTargetSecretKey(targetSecretKey);
+    return path.join(leafDirectory, targetSecretKey);
+};
 const expandHomePath = (inputPath) => {
     if (inputPath === "~") {
         return os.homedir();
@@ -16,3 +26,14 @@ export const resolveProfilesRoot = () => path.join(resolveAuthHome(), "profiles"
 export const resolveProfileDirectory = (profileName) => path.join(resolveProfilesRoot(), profileName);
 export const resolveProfilePath = (profileName) => path.join(resolveProfileDirectory(profileName), "profile.json");
 export const resolveImportedAuthDirectory = (profileName, kind) => path.join(resolveProfileDirectory(profileName), "imports", kind);
+export const resolveTargetSecretsRoot = () => path.join(resolveAuthHome(), "target-secrets");
+export const resolveTargetSecretVersionsDirectory = () => path.join(resolveTargetSecretsRoot(), "versions");
+export const resolveTargetSecretVersionPath = (versionKey) => resolveTargetSecretLeafPath(resolveTargetSecretVersionsDirectory(), versionKey);
+export const resolveTargetSecretGrantsDirectory = () => path.join(resolveTargetSecretsRoot(), "grants");
+export const resolveTargetSecretGrantPath = (grantKey) => resolveTargetSecretLeafPath(resolveTargetSecretGrantsDirectory(), grantKey);
+export const resolveTargetSecretRedemptionsDirectory = () => path.join(resolveTargetSecretsRoot(), "redemptions");
+export const resolveTargetSecretRedemptionPath = (redemptionKey) => resolveTargetSecretLeafPath(resolveTargetSecretRedemptionsDirectory(), redemptionKey);
+export const resolveTargetSecretRevocationsDirectory = () => path.join(resolveTargetSecretsRoot(), "revocations");
+export const resolveTargetSecretRevocationPath = (revocationKey) => resolveTargetSecretLeafPath(resolveTargetSecretRevocationsDirectory(), revocationKey);
+export const resolveTargetSecretAliasesDirectory = () => path.join(resolveTargetSecretsRoot(), "aliases");
+export const resolveTargetSecretAliasPath = (aliasKey) => resolveTargetSecretLeafPath(resolveTargetSecretAliasesDirectory(), aliasKey);

package/dist/auth/targetSecretSourceAuthor.d.ts

@@ -0,0 +1,18 @@
+import { type OpaqueTargetSecretSourceHandle } from "./targetSecretSourceRecordCommon.js";
+import { type TargetSecretSourceFsPublish } from "./targetSecretSourceFsPublish.js";
+import { type TargetSecretSourceRecordPublish } from "./targetSecretSourceRecordPublish.js";
+import { type TargetSecretSourceEntropy } from "./targetSecretSourceVersionRecords.js";
+export interface TargetSecretSourceAuthor {
+    authorVersion(secret: Uint8Array): Promise<Readonly<{
+        source_handle: OpaqueTargetSecretSourceHandle;
+    }>>;
+}
+export interface TargetSecretSourceAuthorOptions {
+    readonly aliasEntropy?: TargetSecretSourceEntropy;
+    readonly aliasPublicationEntropy?: TargetSecretSourceEntropy;
+    readonly recordPublisher?: Pick<TargetSecretSourceRecordPublish, "publishAlias">;
+    readonly versionEntropy?: TargetSecretSourceEntropy;
+    readonly versionPublicationEntropy?: TargetSecretSourceEntropy;
+    readonly versionPublisher?: Pick<TargetSecretSourceFsPublish, "publishVersion">;
+}
+export declare const initializeTargetSecretSourceAuthor: (options?: TargetSecretSourceAuthorOptions) => Promise<TargetSecretSourceAuthor>;

package/dist/auth/targetSecretSourceAuthor.js

@@ -0,0 +1,52 @@
+import { TARGET_SECRET_SOURCE_ERROR } from "./targetSecretSourceRecordCommon.js";
+import { initializeTargetSecretSourceFsPublish } from "./targetSecretSourceFsPublish.js";
+import { initializeTargetSecretSourceRecordPublish } from "./targetSecretSourceRecordPublish.js";
+import { createTargetSecretSourceAliasRecordBytes, createTargetSecretSourceVersionRecordBytes } from "./targetSecretSourceVersionRecords.js";
+const fail = () => { throw new Error(TARGET_SECRET_SOURCE_ERROR); };
+export const initializeTargetSecretSourceAuthor = async (options = {}) => {
+    // Both defaults establish and pin the same auth-owned directory hierarchy.
+    // Initialize them sequentially so a fresh home has no mkdir election race.
+    const versionPublisher = options.versionPublisher ?? await initializeTargetSecretSourceFsPublish();
+    const recordPublisher = options.recordPublisher ?? await initializeTargetSecretSourceRecordPublish();
+    return Object.freeze({
+        authorVersion: async (secret) => {
+            let workingSecret;
+            let versionBytes;
+            let aliasBytes;
+            try {
+                if (!(secret instanceof Uint8Array))
+                    fail();
+                workingSecret = Uint8Array.from(secret);
+                const version = createTargetSecretSourceVersionRecordBytes(workingSecret, {
+                    entropy: options.versionEntropy,
+                    publicationEntropy: options.versionPublicationEntropy
+                });
+                versionBytes = version.private_bytes;
+                const alias = createTargetSecretSourceAliasRecordBytes(version.metadata, {
+                    entropy: options.aliasEntropy,
+                    publicationEntropy: options.aliasPublicationEntropy
+                });
+                aliasBytes = alias.private_bytes;
+                if (alias.metadata.source_handle === version.private_metadata.publication_handle
+                    || alias.private_metadata.publication_handle === version.private_metadata.publication_handle)
+                    fail();
+                // Alias publication is the public commit point. A process interruption
+                // before it may leave only an unreachable immutable version record.
+                await versionPublisher.publishVersion({
+                    bytes: versionBytes,
+                    private_metadata: version.private_metadata
+                });
+                await recordPublisher.publishAlias(aliasBytes);
+                return Object.freeze({ source_handle: alias.metadata.source_handle });
+            }
+            catch {
+                return fail();
+            }
+            finally {
+                workingSecret?.fill(0);
+                versionBytes?.fill(0);
+                aliasBytes?.fill(0);
+            }
+        }
+    });
+};

package/dist/auth/targetSecretSourceFsPublish.d.ts

@@ -0,0 +1,15 @@
+import { type TargetSecretSourceFsPublishImmutablePhase } from "./targetSecretSourceFsPublishImmutable.js";
+import { type TargetSecretSourcePrivateVersionMetadata } from "./targetSecretSourceVersionRecords.js";
+export type TargetSecretSourceFsPublishPhase = TargetSecretSourceFsPublishImmutablePhase;
+export interface TargetSecretSourceFsPublishInput {
+    readonly bytes: Uint8Array;
+    readonly private_metadata: Pick<TargetSecretSourcePrivateVersionMetadata, "publication_handle" | "source_version_handle">;
+}
+export interface TargetSecretSourceFsPublishOptions {
+    readonly hookForTest?: (phase: TargetSecretSourceFsPublishPhase, path: string) => Promise<void> | void;
+    readonly maxWriteBytesForTest?: number;
+}
+export interface TargetSecretSourceFsPublish {
+    publishVersion(input: TargetSecretSourceFsPublishInput): Promise<void>;
+}
+export declare const initializeTargetSecretSourceFsPublish: (options?: TargetSecretSourceFsPublishOptions) => Promise<TargetSecretSourceFsPublish>;

package/dist/auth/targetSecretSourceFsPublish.js

@@ -0,0 +1,49 @@
+import { resolveAuthHome, resolveSpawnfileHome, resolveTargetSecretVersionPath, resolveTargetSecretVersionsDirectory, resolveTargetSecretsRoot } from "./paths.js";
+import { TARGET_SECRET_SOURCE_ERROR, parseTargetSecretSourceOpaqueHandle } from "./targetSecretSourceRecordCommon.js";
+import { initializeTargetSecretSourceFsPublishImmutable } from "./targetSecretSourceFsPublishImmutable.js";
+import { initializeTargetSecretSourceFsRead } from "./targetSecretSourceFsRead.js";
+import { parseTargetSecretSourceVersionRecordBytes } from "./targetSecretSourceVersionRecords.js";
+const fail = () => { throw new Error(TARGET_SECRET_SOURCE_ERROR); };
+export const initializeTargetSecretSourceFsPublish = async (options = {}) => {
+    await initializeTargetSecretSourceFsRead();
+    const publisher = await initializeTargetSecretSourceFsPublishImmutable({
+        directory_chain: [
+            resolveSpawnfileHome(),
+            resolveAuthHome(),
+            resolveTargetSecretsRoot(),
+            resolveTargetSecretVersionsDirectory()
+        ],
+        hookForTest: options.hookForTest,
+        maxWriteBytesForTest: options.maxWriteBytesForTest
+    });
+    const publishVersion = async (input) => {
+        try {
+            if (!input || typeof input !== "object" || !(input.bytes instanceof Uint8Array)
+                || !input.private_metadata || typeof input.private_metadata !== "object")
+                fail();
+            const sourceVersionHandle = parseTargetSecretSourceOpaqueHandle(input.private_metadata.source_version_handle);
+            const publicationHandle = parseTargetSecretSourceOpaqueHandle(input.private_metadata.publication_handle);
+            if (sourceVersionHandle === publicationHandle)
+                fail();
+            await publisher.publishImmutable({
+                bytes: input.bytes,
+                final_path: resolveTargetSecretVersionPath(sourceVersionHandle),
+                publication_handle: publicationHandle,
+                proveExact: (bytes) => {
+                    const parsed = parseTargetSecretSourceVersionRecordBytes(bytes, sourceVersionHandle);
+                    try {
+                        if (parsed.publication_handle !== publicationHandle)
+                            fail();
+                    }
+                    finally {
+                        parsed.secret.fill(0);
+                    }
+                }
+            });
+        }
+        catch {
+            fail();
+        }
+    };
+    return Object.freeze({ publishVersion });
+};

package/dist/auth/targetSecretSourceFsPublishImmutable.d.ts

@@ -0,0 +1,16 @@
+export type TargetSecretSourceFsPublishImmutablePhase = "after_token_create" | "after_claim_link" | "after_claim_snapshot" | "after_mismatch_snapshot" | "after_exact_token_snapshot" | "after_final_create" | "after_partial_write" | "after_file_sync" | "before_directory_sync" | "after_directory_sync" | "after_token_cleanup" | "after_claim_cleanup";
+export interface TargetSecretSourceFsPublishImmutableInput {
+    readonly bytes: Uint8Array;
+    readonly final_path: string;
+    readonly publication_handle: string;
+    readonly proveExact: (bytes: Uint8Array) => Promise<void> | void;
+}
+export interface TargetSecretSourceFsPublishImmutableOptions {
+    readonly directory_chain: readonly string[];
+    readonly hookForTest?: (phase: TargetSecretSourceFsPublishImmutablePhase, path: string) => Promise<void> | void;
+    readonly maxWriteBytesForTest?: number;
+}
+export interface TargetSecretSourceFsPublishImmutable {
+    publishImmutable(input: TargetSecretSourceFsPublishImmutableInput): Promise<void>;
+}
+export declare const initializeTargetSecretSourceFsPublishImmutable: (options: TargetSecretSourceFsPublishImmutableOptions) => Promise<TargetSecretSourceFsPublishImmutable>;