spawnfile 0.1.13 → 0.1.14

package/dist/auth/targetSecretSourceRecordPublish.js

@@ -0,0 +1,104 @@
+import { resolveAuthHome, resolveSpawnfileHome, resolveTargetSecretAliasPath, resolveTargetSecretAliasesDirectory, resolveTargetSecretGrantPath, resolveTargetSecretGrantsDirectory, resolveTargetSecretRedemptionPath, resolveTargetSecretRedemptionsDirectory, resolveTargetSecretRevocationPath, resolveTargetSecretRevocationsDirectory, resolveTargetSecretsRoot } from "./paths.js";
+import { TARGET_SECRET_SOURCE_ERROR } from "./targetSecretSourceRecordCommon.js";
+import { initializeTargetSecretSourceFsPublishImmutable } from "./targetSecretSourceFsPublishImmutable.js";
+import { initializeTargetSecretSourceFsRead } from "./targetSecretSourceFsRead.js";
+import { parseTargetSecretSourceGrantRecordBytesForPublication, parseTargetSecretSourceRedemptionRecordBytesForPublication, parseTargetSecretSourceRevocationRecordBytesForPublication } from "./targetSecretSourceGrantRecords.js";
+import { parseTargetSecretSourceAliasRecordBytesForPublication } from "./targetSecretSourceVersionRecords.js";
+const fail = () => { throw new Error(TARGET_SECRET_SOURCE_ERROR); };
+export const initializeTargetSecretSourceRecordPublish = async (options = {}) => {
+    await initializeTargetSecretSourceFsRead();
+    const common = [resolveSpawnfileHome(), resolveAuthHome(), resolveTargetSecretsRoot()];
+    const create = (directory) => initializeTargetSecretSourceFsPublishImmutable({
+        directory_chain: [...common, directory],
+        hookForTest: options.hookForTest,
+        maxWriteBytesForTest: options.maxWriteBytesForTest
+    });
+    const [aliases, grants, redemptions, revocations] = await Promise.all([
+        create(resolveTargetSecretAliasesDirectory()),
+        create(resolveTargetSecretGrantsDirectory()),
+        create(resolveTargetSecretRedemptionsDirectory()),
+        create(resolveTargetSecretRevocationsDirectory())
+    ]);
+    return Object.freeze({
+        publishAlias: async (bytes) => {
+            try {
+                if (!(bytes instanceof Uint8Array))
+                    fail();
+                const initial = parseTargetSecretSourceAliasRecordBytesForPublication(bytes);
+                await aliases.publishImmutable({
+                    bytes,
+                    final_path: resolveTargetSecretAliasPath(initial.source_handle),
+                    publication_handle: initial.publication_handle,
+                    proveExact: (exact) => {
+                        const parsed = parseTargetSecretSourceAliasRecordBytesForPublication(exact);
+                        if (parsed.source_handle !== initial.source_handle || parsed.publication_handle !== initial.publication_handle)
+                            fail();
+                    }
+                });
+            }
+            catch {
+                fail();
+            }
+        },
+        publishGrant: async (bytes) => {
+            try {
+                if (!(bytes instanceof Uint8Array))
+                    fail();
+                const initial = parseTargetSecretSourceGrantRecordBytesForPublication(bytes);
+                await grants.publishImmutable({
+                    bytes,
+                    final_path: resolveTargetSecretGrantPath(initial.source_handle),
+                    publication_handle: initial.publication_handle,
+                    proveExact: (exact) => {
+                        const parsed = parseTargetSecretSourceGrantRecordBytesForPublication(exact);
+                        if (parsed.source_handle !== initial.source_handle || parsed.publication_handle !== initial.publication_handle)
+                            fail();
+                    }
+                });
+            }
+            catch {
+                fail();
+            }
+        },
+        publishRedemption: async (bytes) => {
+            try {
+                if (!(bytes instanceof Uint8Array))
+                    fail();
+                const initial = parseTargetSecretSourceRedemptionRecordBytesForPublication(bytes);
+                await redemptions.publishImmutable({
+                    bytes,
+                    final_path: resolveTargetSecretRedemptionPath(initial.source_handle),
+                    publication_handle: initial.publication_handle,
+                    proveExact: (exact) => {
+                        const parsed = parseTargetSecretSourceRedemptionRecordBytesForPublication(exact);
+                        if (parsed.source_handle !== initial.source_handle || parsed.publication_handle !== initial.publication_handle)
+                            fail();
+                    }
+                });
+            }
+            catch {
+                fail();
+            }
+        },
+        publishRevocation: async (bytes) => {
+            try {
+                if (!(bytes instanceof Uint8Array))
+                    fail();
+                const initial = parseTargetSecretSourceRevocationRecordBytesForPublication(bytes);
+                await revocations.publishImmutable({
+                    bytes,
+                    final_path: resolveTargetSecretRevocationPath(initial.revoked_handle),
+                    publication_handle: initial.publication_handle,
+                    proveExact: (exact) => {
+                        const parsed = parseTargetSecretSourceRevocationRecordBytesForPublication(exact);
+                        if (parsed.revoked_handle !== initial.revoked_handle || parsed.publication_handle !== initial.publication_handle)
+                            fail();
+                    }
+                });
+            }
+            catch {
+                fail();
+            }
+        }
+    });
+};

package/dist/auth/targetSecretSourceResolver.d.ts

@@ -0,0 +1,10 @@
+import { type TargetSecretSourceResolver } from "../target/dockerSecrets.js";
+import { type TargetSecretSourceFsRead } from "./targetSecretSourceFsRead.js";
+import { type TargetSecretSourceEntropy } from "./targetSecretSourceGrantRecords.js";
+import { type TargetSecretSourceRecordPublish } from "./targetSecretSourceRecordPublish.js";
+export interface TargetSecretSourceResolverOptions {
+    readonly publicationEntropy?: TargetSecretSourceEntropy;
+    readonly publisher?: Pick<TargetSecretSourceRecordPublish, "publishRedemption">;
+    readonly reader?: Pick<TargetSecretSourceFsRead, "readAlias" | "readGrant" | "readRedemption" | "readRevocation" | "readVersion">;
+}
+export declare const initializeTargetSecretSourceResolver: (options?: TargetSecretSourceResolverOptions) => Promise<TargetSecretSourceResolver>;

package/dist/auth/targetSecretSourceResolver.js

@@ -0,0 +1,137 @@
+import { parseTargetSecretSourceAuthorization } from "../target/dockerSecretsAuthority.js";
+import { TARGET_SECRET_SOURCE_ERROR } from "./targetSecretSourceRecordCommon.js";
+import { initializeTargetSecretSourceFsRead } from "./targetSecretSourceFsRead.js";
+import { assertTargetSecretSourceRedemptionCorrelation, createTargetSecretSourceRedemptionMetadata, createTargetSecretSourceRedemptionRecordBytes } from "./targetSecretSourceGrantRecords.js";
+import { initializeTargetSecretSourceRecordPublish } from "./targetSecretSourceRecordPublish.js";
+import { deriveTargetSecretSourceOwnerEntropy } from "./targetSecretSourceOwnerEntropy.js";
+import { assertTargetSecretSourceAliasCorrelation } from "./targetSecretSourceVersionRecords.js";
+const fail = () => { throw new Error(TARGET_SECRET_SOURCE_ERROR); };
+const sameRedemption = (left, right) => left.source_handle === right.source_handle
+    && left.source_version_handle === right.source_version_handle
+    && left.authorization.descriptorDigest === right.authorization.descriptorDigest
+    && left.authorization.name === right.authorization.name
+    && left.authorization.operationHandle === right.authorization.operationHandle
+    && left.authorization.requestDigest === right.authorization.requestDigest
+    && left.authorization.runId === right.authorization.runId
+    && left.authorization.scope === right.authorization.scope
+    && left.authorization.sourceHandle === right.authorization.sourceHandle
+    && left.authorization.selectedTarget.fingerprint === right.authorization.selectedTarget.fingerprint
+    && left.authorization.selectedTarget.handle === right.authorization.selectedTarget.handle
+    && left.authorization.version === right.authorization.version;
+export const initializeTargetSecretSourceResolver = async (options = {}) => {
+    const reader = options.reader ?? await initializeTargetSecretSourceFsRead();
+    const publisher = options.publisher ?? await initializeTargetSecretSourceRecordPublish();
+    return Object.freeze({
+        resolve: async (input) => {
+            let secret;
+            let redemptionBytes;
+            try {
+                if (input?.signal?.aborted)
+                    fail();
+                const authorization = parseTargetSecretSourceAuthorization(input?.authorization);
+                const alias = await reader.readAlias(authorization.sourceHandle);
+                if (!alias)
+                    return fail();
+                const grant = await reader.readGrant(alias.source_handle);
+                if (!grant)
+                    return fail();
+                const version = await reader.readVersion(alias.source_version_handle);
+                if (!version)
+                    return fail();
+                secret = version.secret;
+                assertTargetSecretSourceAliasCorrelation({ source_handle: alias.source_handle, source_version_handle: alias.source_version_handle, version: alias.version }, { source_version_handle: version.source_version_handle, version: version.version });
+                if (grant.source_handle !== alias.source_handle || grant.source_version_handle !== alias.source_version_handle)
+                    fail();
+                const associatedPrivateHandles = [alias.publication_handle, grant.publication_handle, version.publication_handle];
+                if (new Set(associatedPrivateHandles).size !== associatedPrivateHandles.length
+                    || associatedPrivateHandles.includes(alias.source_handle)
+                    || associatedPrivateHandles.includes(alias.source_version_handle)
+                    || associatedPrivateHandles.includes(authorization.operationHandle)
+                    || associatedPrivateHandles.includes(authorization.selectedTarget.handle))
+                    fail();
+                const assertRedemptionPublicationDistinct = (publicationHandle) => {
+                    if (associatedPrivateHandles.includes(publicationHandle))
+                        fail();
+                };
+                const grantMetadata = {
+                    descriptor_digest: grant.descriptor_digest,
+                    name: grant.name,
+                    run_id: grant.run_id,
+                    scope: grant.scope,
+                    selected_target: grant.selected_target,
+                    source_handle: grant.source_handle,
+                    source_version_handle: grant.source_version_handle,
+                    version: grant.version
+                };
+                const assertAdmissible = async () => {
+                    const [grantRevocation, versionRevocation] = await Promise.all([
+                        reader.readRevocation(alias.source_handle),
+                        reader.readRevocation(alias.source_version_handle)
+                    ]);
+                    if (grantRevocation || versionRevocation || input.signal?.aborted)
+                        fail();
+                };
+                await assertAdmissible();
+                const expected = createTargetSecretSourceRedemptionMetadata(grantMetadata, authorization);
+                let existing;
+                try {
+                    existing = await reader.readRedemption(alias.source_handle);
+                }
+                catch {
+                    existing = null;
+                }
+                if (existing) {
+                    assertRedemptionPublicationDistinct(existing.publication_handle);
+                    const existingMetadata = {
+                        authorization: existing.authorization,
+                        source_handle: existing.source_handle,
+                        source_version_handle: existing.source_version_handle,
+                        version: existing.version
+                    };
+                    assertTargetSecretSourceRedemptionCorrelation(existingMetadata, grantMetadata);
+                    if (!sameRedemption(existing, expected))
+                        fail();
+                }
+                else {
+                    const redemption = createTargetSecretSourceRedemptionRecordBytes(grantMetadata, expected.authorization, {
+                        publicationEntropy: options.publicationEntropy
+                            ?? (() => deriveTargetSecretSourceOwnerEntropy("redemption.publication_handle", expected))
+                    });
+                    redemptionBytes = redemption.private_bytes;
+                    assertRedemptionPublicationDistinct(redemption.private_metadata.publication_handle);
+                    try {
+                        await publisher.publishRedemption(redemptionBytes);
+                    }
+                    catch { /* prove the durable winner below */ }
+                    const joined = await reader.readRedemption(alias.source_handle);
+                    if (!joined)
+                        return fail();
+                    assertRedemptionPublicationDistinct(joined.publication_handle);
+                    assertTargetSecretSourceRedemptionCorrelation({
+                        authorization: joined.authorization,
+                        source_handle: joined.source_handle,
+                        source_version_handle: joined.source_version_handle,
+                        version: joined.version
+                    }, grantMetadata);
+                    if (!sameRedemption(joined, expected))
+                        fail();
+                }
+                await assertAdmissible();
+                const value = secret;
+                secret = undefined;
+                return Object.freeze({
+                    authorization: expected.authorization,
+                    sourceVersionHandle: expected.source_version_handle,
+                    value
+                });
+            }
+            catch {
+                return fail();
+            }
+            finally {
+                secret?.fill(0);
+                redemptionBytes?.fill(0);
+            }
+        }
+    });
+};

package/dist/auth/targetSecretSourceRevoke.d.ts

@@ -0,0 +1,20 @@
+import { type OpaqueTargetSecretSourceHandle } from "./targetSecretSourceRecordCommon.js";
+import { type TargetSecretSourceFsRead } from "./targetSecretSourceFsRead.js";
+import { type TargetSecretSourceEntropy } from "./targetSecretSourceGrantRecords.js";
+import { type TargetSecretSourceRecordPublish } from "./targetSecretSourceRecordPublish.js";
+type PublicRevocation = Readonly<{
+    kind: "grant" | "version";
+    source_handle: OpaqueTargetSecretSourceHandle;
+}>;
+export interface TargetSecretSourceRevoke {
+    revokeGrant(sourceHandle: unknown): Promise<PublicRevocation>;
+    revokeVersion(sourceHandle: unknown): Promise<PublicRevocation>;
+}
+export interface TargetSecretSourceRevokeOptions {
+    readonly entropy?: TargetSecretSourceEntropy;
+    readonly publicationEntropy?: TargetSecretSourceEntropy;
+    readonly publisher?: Pick<TargetSecretSourceRecordPublish, "publishRevocation">;
+    readonly reader?: Pick<TargetSecretSourceFsRead, "readAlias" | "readGrant" | "readRevocation" | "readVersion">;
+}
+export declare const initializeTargetSecretSourceRevoke: (options?: TargetSecretSourceRevokeOptions) => Promise<TargetSecretSourceRevoke>;
+export {};

package/dist/auth/targetSecretSourceRevoke.js

@@ -0,0 +1,92 @@
+import { TARGET_SECRET_SOURCE_ERROR, parseTargetSecretSourceOpaqueHandle } from "./targetSecretSourceRecordCommon.js";
+import { initializeTargetSecretSourceFsRead } from "./targetSecretSourceFsRead.js";
+import { createTargetSecretSourceRevocationRecordBytes } from "./targetSecretSourceGrantRecords.js";
+import { initializeTargetSecretSourceRecordPublish } from "./targetSecretSourceRecordPublish.js";
+import { deriveTargetSecretSourceOwnerEntropy } from "./targetSecretSourceOwnerEntropy.js";
+import { assertTargetSecretSourceAliasCorrelation } from "./targetSecretSourceVersionRecords.js";
+const fail = () => { throw new Error(TARGET_SECRET_SOURCE_ERROR); };
+export const initializeTargetSecretSourceRevoke = async (options = {}) => {
+    const reader = options.reader ?? await initializeTargetSecretSourceFsRead();
+    const publisher = options.publisher ?? await initializeTargetSecretSourceRecordPublish();
+    const revoke = async (rawSourceHandle, kind) => {
+        let secret;
+        let privateBytes;
+        try {
+            const sourceHandle = parseTargetSecretSourceOpaqueHandle(rawSourceHandle);
+            const alias = await reader.readAlias(sourceHandle);
+            if (!alias)
+                return fail();
+            const grant = await reader.readGrant(sourceHandle);
+            if (kind === "grant" && !grant)
+                return fail();
+            const version = await reader.readVersion(alias.source_version_handle);
+            if (!version)
+                return fail();
+            secret = version.secret;
+            assertTargetSecretSourceAliasCorrelation({ source_handle: alias.source_handle, source_version_handle: alias.source_version_handle, version: alias.version }, { source_version_handle: version.source_version_handle, version: version.version });
+            if (grant && (grant.source_handle !== alias.source_handle || grant.source_version_handle !== alias.source_version_handle))
+                fail();
+            const associated = [
+                alias.publication_handle,
+                version.publication_handle,
+                ...(grant ? [grant.publication_handle] : [])
+            ];
+            const associatedPublic = [
+                alias.source_handle,
+                alias.source_version_handle,
+                ...(grant ? [grant.selected_target.handle] : [])
+            ];
+            if (new Set(associated).size !== associated.length
+                || associated.some((handle) => associatedPublic.includes(handle)))
+                fail();
+            const revokedHandle = kind === "grant" ? alias.source_handle : alias.source_version_handle;
+            const assertExact = (record) => {
+                if (record.kind !== kind || record.revoked_handle !== revokedHandle
+                    || associated.includes(record.revocation_handle)
+                    || associated.includes(record.publication_handle)
+                    || associatedPublic.includes(record.revocation_handle)
+                    || associatedPublic.includes(record.publication_handle))
+                    fail();
+            };
+            let existing;
+            try {
+                existing = await reader.readRevocation(revokedHandle);
+            }
+            catch {
+                existing = null;
+            }
+            if (existing) {
+                assertExact(existing);
+                return Object.freeze({ kind, source_handle: alias.source_handle });
+            }
+            const record = createTargetSecretSourceRevocationRecordBytes({ kind, revoked_handle: revokedHandle }, {
+                entropy: options.entropy
+                    ?? (() => deriveTargetSecretSourceOwnerEntropy("revocation.revocation_handle", { kind, revoked_handle: revokedHandle })),
+                publicationEntropy: options.publicationEntropy
+                    ?? (() => deriveTargetSecretSourceOwnerEntropy("revocation.publication_handle", { kind, revoked_handle: revokedHandle }))
+            });
+            privateBytes = record.private_bytes;
+            assertExact(record.private_metadata);
+            try {
+                await publisher.publishRevocation(privateBytes);
+            }
+            catch { /* prove durable winner below */ }
+            const joined = await reader.readRevocation(revokedHandle);
+            if (!joined)
+                return fail();
+            assertExact(joined);
+            return Object.freeze({ kind, source_handle: alias.source_handle });
+        }
+        catch {
+            return fail();
+        }
+        finally {
+            secret?.fill(0);
+            privateBytes?.fill(0);
+        }
+    };
+    return Object.freeze({
+        revokeGrant: (sourceHandle) => revoke(sourceHandle, "grant"),
+        revokeVersion: (sourceHandle) => revoke(sourceHandle, "version")
+    });
+};

package/dist/auth/targetSecretSourceRotate.d.ts

@@ -0,0 +1,19 @@
+import { type OpaqueTargetSecretSourceHandle } from "./targetSecretSourceRecordCommon.js";
+import { type TargetSecretSourceAuthor } from "./targetSecretSourceAuthor.js";
+import { type TargetSecretSourceFsRead } from "./targetSecretSourceFsRead.js";
+import { type TargetSecretSourceGrant } from "./targetSecretSourceGrant.js";
+export type TargetSecretSourceRotateInput = Readonly<{
+    secret: Uint8Array;
+    source_handle: unknown;
+}>;
+export interface TargetSecretSourceRotate {
+    rotateSource(input: TargetSecretSourceRotateInput): Promise<Readonly<{
+        source_handle: OpaqueTargetSecretSourceHandle;
+    }>>;
+}
+export interface TargetSecretSourceRotateOptions {
+    readonly author?: TargetSecretSourceAuthor;
+    readonly grant?: TargetSecretSourceGrant;
+    readonly reader?: Pick<TargetSecretSourceFsRead, "readAlias" | "readGrant" | "readRevocation" | "readVersion">;
+}
+export declare const initializeTargetSecretSourceRotate: (options?: TargetSecretSourceRotateOptions) => Promise<TargetSecretSourceRotate>;

package/dist/auth/targetSecretSourceRotate.js

@@ -0,0 +1,121 @@
+import { MAX_TARGET_SECRET_SOURCE_SECRET_BYTES, TARGET_SECRET_SOURCE_ERROR, parseTargetSecretSourceOpaqueHandle } from "./targetSecretSourceRecordCommon.js";
+import { initializeTargetSecretSourceAuthor } from "./targetSecretSourceAuthor.js";
+import { initializeTargetSecretSourceFsRead } from "./targetSecretSourceFsRead.js";
+import { initializeTargetSecretSourceGrant } from "./targetSecretSourceGrant.js";
+import { assertTargetSecretSourceAliasCorrelation } from "./targetSecretSourceVersionRecords.js";
+const fail = () => { throw new Error(TARGET_SECRET_SOURCE_ERROR); };
+export const initializeTargetSecretSourceRotate = async (options = {}) => {
+    const reader = options.reader ?? await initializeTargetSecretSourceFsRead();
+    const author = options.author ?? await initializeTargetSecretSourceAuthor();
+    const grantService = options.grant ?? await initializeTargetSecretSourceGrant();
+    return Object.freeze({
+        rotateSource: async (input) => {
+            let oldSecret;
+            let newSecretRead;
+            let newSecret;
+            try {
+                const sourceHandle = parseTargetSecretSourceOpaqueHandle(input?.source_handle);
+                if (!(input?.secret instanceof Uint8Array)
+                    || input.secret.length === 0
+                    || input.secret.length > MAX_TARGET_SECRET_SOURCE_SECRET_BYTES)
+                    fail();
+                newSecret = Uint8Array.from(input.secret);
+                const requestedSecret = newSecret;
+                const alias = await reader.readAlias(sourceHandle);
+                if (!alias)
+                    return fail();
+                const grant = await reader.readGrant(sourceHandle);
+                if (!grant)
+                    return fail();
+                const version = await reader.readVersion(alias.source_version_handle);
+                if (!version)
+                    return fail();
+                oldSecret = version.secret;
+                assertTargetSecretSourceAliasCorrelation({ source_handle: alias.source_handle, source_version_handle: alias.source_version_handle, version: alias.version }, { source_version_handle: version.source_version_handle, version: version.version });
+                if (grant.source_handle !== alias.source_handle || grant.source_version_handle !== alias.source_version_handle)
+                    fail();
+                const associatedPrivate = [alias.publication_handle, grant.publication_handle, version.publication_handle];
+                if (new Set(associatedPrivate).size !== associatedPrivate.length
+                    || associatedPrivate.includes(alias.source_handle)
+                    || associatedPrivate.includes(alias.source_version_handle)
+                    || associatedPrivate.includes(grant.selected_target.handle))
+                    fail();
+                const assertOldActive = async () => {
+                    const [grantRevocation, versionRevocation] = await Promise.all([
+                        reader.readRevocation(alias.source_handle),
+                        reader.readRevocation(alias.source_version_handle)
+                    ]);
+                    if (grantRevocation || versionRevocation)
+                        fail();
+                };
+                await assertOldActive();
+                const authored = await author.authorVersion(newSecret);
+                const authoredSourceHandle = parseTargetSecretSourceOpaqueHandle(authored.source_handle);
+                const granted = await grantService.grantSource({
+                    descriptor_digest: grant.descriptor_digest,
+                    name: grant.name,
+                    run_id: grant.run_id,
+                    scope: grant.scope,
+                    selected_target: grant.selected_target,
+                    source_handle: authoredSourceHandle
+                });
+                const grantedSourceHandle = parseTargetSecretSourceOpaqueHandle(granted.source_handle);
+                if (grantedSourceHandle !== authoredSourceHandle)
+                    fail();
+                const newAlias = await reader.readAlias(authoredSourceHandle);
+                if (!newAlias)
+                    return fail();
+                const newGrant = await reader.readGrant(authoredSourceHandle);
+                if (!newGrant)
+                    return fail();
+                const newVersion = await reader.readVersion(newAlias.source_version_handle);
+                if (!newVersion)
+                    return fail();
+                newSecretRead = newVersion.secret;
+                if (newSecretRead.length !== requestedSecret.length
+                    || newSecretRead.some((byte, index) => byte !== requestedSecret[index]))
+                    fail();
+                assertTargetSecretSourceAliasCorrelation({ source_handle: newAlias.source_handle, source_version_handle: newAlias.source_version_handle, version: newAlias.version }, { source_version_handle: newVersion.source_version_handle, version: newVersion.version });
+                if (newAlias.source_handle !== authoredSourceHandle
+                    || newGrant.source_handle !== newAlias.source_handle
+                    || newGrant.source_version_handle !== newAlias.source_version_handle
+                    || newGrant.descriptor_digest !== grant.descriptor_digest
+                    || newGrant.name !== grant.name
+                    || newGrant.run_id !== grant.run_id
+                    || newGrant.scope !== grant.scope
+                    || newGrant.selected_target.fingerprint !== grant.selected_target.fingerprint
+                    || newGrant.selected_target.handle !== grant.selected_target.handle
+                    || newGrant.selected_target.version !== grant.selected_target.version)
+                    fail();
+                const newPrivate = [newAlias.publication_handle, newGrant.publication_handle, newVersion.publication_handle];
+                const allPrivate = [...associatedPrivate, ...newPrivate];
+                const allPublic = [
+                    alias.source_handle, alias.source_version_handle,
+                    newAlias.source_handle, newAlias.source_version_handle,
+                    grant.selected_target.handle
+                ];
+                if (new Set(allPrivate).size !== allPrivate.length
+                    || new Set(allPublic).size !== allPublic.length
+                    || allPrivate.some((handle) => allPublic.includes(handle)))
+                    fail();
+                const [oldGrantRevocation, oldVersionRevocation, newGrantRevocation, newVersionRevocation] = await Promise.all([
+                    reader.readRevocation(alias.source_handle),
+                    reader.readRevocation(alias.source_version_handle),
+                    reader.readRevocation(newAlias.source_handle),
+                    reader.readRevocation(newAlias.source_version_handle)
+                ]);
+                if (oldGrantRevocation || oldVersionRevocation || newGrantRevocation || newVersionRevocation)
+                    fail();
+                return Object.freeze({ source_handle: authoredSourceHandle });
+            }
+            catch {
+                return fail();
+            }
+            finally {
+                oldSecret?.fill(0);
+                newSecretRead?.fill(0);
+                newSecret?.fill(0);
+            }
+        }
+    });
+};

package/dist/auth/targetSecretSourceVersionRecords.d.ts

@@ -0,0 +1,49 @@
+import { parseTargetSecretSourceOpaqueHandle } from "./targetSecretSourceRecordCommon.js";
+export declare const TARGET_SECRET_SOURCE_VERSION_RECORD_VERSION: "spawnfile.auth.target-secret.source-version.v1";
+export declare const TARGET_SECRET_SOURCE_ALIAS_RECORD_VERSION: "spawnfile.auth.target-secret.source-alias.v1";
+export type TargetSecretSourceOpaqueHandle = ReturnType<typeof parseTargetSecretSourceOpaqueHandle>;
+export type TargetSecretSourceEntropy = () => Uint8Array;
+export type TargetSecretSourceVersionMetadata = Readonly<{
+    source_version_handle: TargetSecretSourceOpaqueHandle;
+    version: typeof TARGET_SECRET_SOURCE_VERSION_RECORD_VERSION;
+}>;
+export type TargetSecretSourcePrivateVersionMetadata = Readonly<TargetSecretSourceVersionMetadata & {
+    publication_handle: TargetSecretSourceOpaqueHandle;
+}>;
+export type TargetSecretSourceVersionRecord = Readonly<TargetSecretSourcePrivateVersionMetadata & {
+    secret: Uint8Array;
+}>;
+export type TargetSecretSourceAliasMetadata = Readonly<{
+    source_handle: TargetSecretSourceOpaqueHandle;
+    source_version_handle: TargetSecretSourceOpaqueHandle;
+    version: typeof TARGET_SECRET_SOURCE_ALIAS_RECORD_VERSION;
+}>;
+export type TargetSecretSourceAliasRecord = Readonly<TargetSecretSourceAliasMetadata & {
+    publication_handle: TargetSecretSourceOpaqueHandle;
+}>;
+export type TargetSecretSourceVersionRecordBytes = Uint8Array & {
+    readonly __brand: "TargetSecretSourceVersionRecordBytes";
+};
+export type TargetSecretSourceAliasRecordBytes = Uint8Array & {
+    readonly __brand: "TargetSecretSourceAliasRecordBytes";
+};
+export declare const createTargetSecretSourceVersionRecordBytes: (secret: Uint8Array, options?: {
+    readonly entropy?: TargetSecretSourceEntropy;
+    readonly publicationEntropy?: TargetSecretSourceEntropy;
+}) => {
+    readonly private_bytes: TargetSecretSourceVersionRecordBytes;
+    readonly private_metadata: TargetSecretSourcePrivateVersionMetadata;
+    readonly metadata: TargetSecretSourceVersionMetadata;
+};
+export declare const parseTargetSecretSourceVersionRecordBytes: (raw: Uint8Array, expectedLeafHandle: TargetSecretSourceOpaqueHandle) => TargetSecretSourceVersionRecord;
+export declare const createTargetSecretSourceAliasRecordBytes: (version: TargetSecretSourceVersionMetadata, options?: {
+    readonly entropy?: TargetSecretSourceEntropy;
+    readonly publicationEntropy?: TargetSecretSourceEntropy;
+}) => {
+    readonly private_bytes: TargetSecretSourceAliasRecordBytes;
+    readonly private_metadata: TargetSecretSourceAliasRecord;
+    readonly metadata: TargetSecretSourceAliasMetadata;
+};
+export declare const parseTargetSecretSourceAliasRecordBytes: (raw: Uint8Array, expectedLeafHandle: TargetSecretSourceOpaqueHandle) => TargetSecretSourceAliasRecord;
+export declare const parseTargetSecretSourceAliasRecordBytesForPublication: (raw: Uint8Array) => TargetSecretSourceAliasRecord;
+export declare const assertTargetSecretSourceAliasCorrelation: (alias: TargetSecretSourceAliasMetadata, version: TargetSecretSourceVersionMetadata) => void;