spawnfile 0.1.13 → 0.1.17

package/dist/cli/targetDefaultConfig.d.ts

@@ -0,0 +1,75 @@
+import { type PreparedEvidenceHelperReceipt } from "../evidenceExportHelper/index.js";
+import { type DockerArtifactMapping } from "../target/dockerArtifactsProvider.js";
+export { resolveTargetDefaultJournalRoot } from "../target/journalRoot.js";
+export declare const TARGET_DEFAULT_CONFIG_ERROR = "Target configuration failed";
+export interface TargetDefaultConfigInputs {
+    /**
+     * Immutable artifact identities are configuration, not a late-bound provider
+     * input.  Keeping them here makes the complete production input JSON data.
+     */
+    readonly artifactMappings?: readonly DockerArtifactMapping[];
+    /**
+     * Optional durable authority for immutable target-local container bundles.
+     * It is deliberately independent from per-run lifecycle and secret roots.
+     */
+    readonly containerBundleStoreRoot?: string;
+    readonly context: string;
+    readonly dockerCommand: string;
+    readonly evidenceHelperBaseImage?: string;
+    readonly preparedEvidenceHelper?: PreparedEvidenceHelperReceipt;
+    readonly evidenceDestination: string;
+    readonly helperArtifactManifestDigest?: string;
+    /** Local-Daemon prepared images, admitted only by manifest/bundle/policy. */
+    readonly preparedArtifactMappings?: readonly PreparedArtifactMapping[];
+    readonly timeoutMs: number;
+}
+export interface PreparedArtifactMapping {
+    readonly archive_digest: string;
+    readonly artifact_manifest_digest: string;
+    readonly base_image_config_digest: string;
+    readonly build_policy_digest: string;
+    readonly bundle_digest: string;
+    readonly entrypoint: string;
+    readonly launcher_digest: string;
+    readonly network_alias: string;
+    readonly platform: {
+        readonly architecture: "amd64" | "arm64";
+        readonly os: "linux";
+    };
+    readonly platform_digest: string;
+}
+export interface TargetDefaultConfig {
+    readonly artifactMappings: readonly DockerArtifactMapping[];
+    readonly context: string;
+    readonly dockerCommand: string;
+    readonly evidenceHelperBaseImage?: string;
+    readonly preparedEvidenceHelper?: PreparedEvidenceHelperReceipt;
+    readonly evidenceDestination: string;
+    /** Present only when the private evidence-export helper was configured. */
+    readonly helperArtifact?: DockerArtifactMapping;
+    readonly preparedArtifactMappings: readonly PreparedArtifactMapping[];
+    readonly paths: {
+        readonly artifactIdentities: string;
+        readonly attachmentAuthority: string;
+        readonly evidenceExport: string;
+        readonly evidenceHelper: string;
+        readonly containerBundles: string;
+        readonly journals: string;
+        readonly root: string;
+        readonly secretAuthority: string;
+        readonly worldAuthority: string;
+    };
+    readonly timeoutMs: number;
+}
+export interface TargetDefaultWorldReadinessConfig {
+    readonly context: string;
+    readonly dockerCommand: string;
+    readonly paths: {
+        readonly worldAuthority: string;
+    };
+    readonly timeoutMs: number;
+}
+export declare const parseTargetPreparedArtifactMappings: (raw: unknown) => readonly PreparedArtifactMapping[];
+export declare const loadTargetDefaultConfig: (raw: TargetDefaultConfigInputs) => Promise<TargetDefaultConfig>;
+/** Resolves only the paths required by a world-readiness query; performs no I/O. */
+export declare const resolveTargetDefaultWorldReadinessConfig: (raw: TargetDefaultConfigInputs) => TargetDefaultWorldReadinessConfig;

package/dist/cli/targetDefaultConfig.js

@@ -0,0 +1,334 @@
+import { constants } from "node:fs";
+import { lstat, mkdir, open, realpath } from "node:fs/promises";
+import path from "node:path";
+import { types as nodeTypes } from "node:util";
+import { resolveSpawnfileHome } from "../auth/index.js";
+import { parsePreparedEvidenceHelperReceipt, } from "../evidenceExportHelper/index.js";
+import { parseDockerBaseImageReference } from "../target/dockerBaseImage.js";
+import { parseDockerArtifactMappings } from "../target/dockerArtifactsProvider.js";
+export { resolveTargetDefaultJournalRoot } from "../target/journalRoot.js";
+export const TARGET_DEFAULT_CONFIG_ERROR = "Target configuration failed";
+const MAX_PATH_BYTES = 4_096;
+const CONTEXT = /^[a-z][a-z0-9_-]{0,63}$/u;
+const DIGEST = /^sha256:[0-9a-f]{64}$/u;
+const COMMAND_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
+const CHILD_ROOTS = Object.freeze([
+    "journals",
+    "artifact-identities",
+    "secret-authority",
+    "attachment-authority",
+    "world-authority",
+    "evidence-export",
+    "evidence-helper"
+]);
+const fail = () => { throw new Error(TARGET_DEFAULT_CONFIG_ERROR); };
+const byteLength = (value) => Buffer.byteLength(value, "utf8");
+const descriptorValues = (raw) => {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw) || nodeTypes.isProxy(raw)
+        || Object.getPrototypeOf(raw) !== Object.prototype)
+        return fail();
+    const expected = [
+        "artifactMappings", "containerBundleStoreRoot", "context", "dockerCommand", "evidenceDestination", "evidenceHelperBaseImage", "preparedEvidenceHelper",
+        "helperArtifactManifestDigest", "preparedArtifactMappings", "timeoutMs"
+    ];
+    const required = ["context", "dockerCommand", "evidenceDestination", "timeoutMs"];
+    const keys = Reflect.ownKeys(raw);
+    if (keys.some((key) => typeof key !== "string" || !expected.includes(key))
+        || required.some((key) => !keys.includes(key)))
+        return fail();
+    const descriptors = Object.getOwnPropertyDescriptors(raw);
+    if (Object.values(descriptors).some((item) => !item.enumerable || !("value" in item)))
+        return fail();
+    return Object.fromEntries(expected.filter((key) => Object.hasOwn(descriptors, key)).map((key) => [key, descriptors[key].value]));
+};
+export const parseTargetPreparedArtifactMappings = (raw) => {
+    if (raw === undefined)
+        return Object.freeze([]);
+    if (!Array.isArray(raw) || raw.length > 32)
+        return fail();
+    const manifests = new Set();
+    const mappings = raw.map((item) => {
+        if (!item || typeof item !== "object" || Array.isArray(item) || nodeTypes.isProxy(item)
+            || Object.getPrototypeOf(item) !== Object.prototype)
+            return fail();
+        const descriptors = Object.getOwnPropertyDescriptors(item);
+        if (Object.values(descriptors).some((descriptor) => !descriptor.enumerable || !("value" in descriptor)))
+            return fail();
+        const value = Object.fromEntries(Object.entries(descriptors).map(([key, descriptor]) => [key, descriptor.value]));
+        if (Object.keys(value).sort().join("\0") !== "archive_digest\0artifact_manifest_digest\0base_image_config_digest\0build_policy_digest\0bundle_digest\0entrypoint\0launcher_digest\0network_alias\0platform\0platform_digest"
+            || typeof value.artifact_manifest_digest !== "string" || !DIGEST.test(value.artifact_manifest_digest)
+            || typeof value.archive_digest !== "string" || !DIGEST.test(value.archive_digest)
+            || typeof value.base_image_config_digest !== "string" || !DIGEST.test(value.base_image_config_digest)
+            || typeof value.bundle_digest !== "string" || !DIGEST.test(value.bundle_digest)
+            || typeof value.build_policy_digest !== "string" || !DIGEST.test(value.build_policy_digest)
+            || typeof value.launcher_digest !== "string" || !DIGEST.test(value.launcher_digest)
+            || typeof value.platform_digest !== "string" || !DIGEST.test(value.platform_digest)
+            || typeof value.entrypoint !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._/-]{0,239}$/u.test(value.entrypoint)
+            || value.entrypoint.includes("//") || value.entrypoint.split("/").some((part) => part === "." || part === "..")
+            || typeof value.network_alias !== "string" || !/^[a-z][a-z0-9-]{0,62}$/u.test(value.network_alias)
+            || !value.platform || typeof value.platform !== "object" || Array.isArray(value.platform) || nodeTypes.isProxy(value.platform)
+            || Object.getPrototypeOf(value.platform) !== Object.prototype
+            || Object.keys(value.platform).sort().join("\0") !== "architecture\0os"
+            || Object.values(Object.getOwnPropertyDescriptors(value.platform)).some((descriptor) => !descriptor.enumerable || !("value" in descriptor))
+            || value.platform.os !== "linux"
+            || !["amd64", "arm64"].includes(value.platform.architecture)
+            || manifests.has(value.artifact_manifest_digest))
+            return fail();
+        manifests.add(value.artifact_manifest_digest);
+        return Object.freeze({ archive_digest: value.archive_digest, artifact_manifest_digest: value.artifact_manifest_digest,
+            base_image_config_digest: value.base_image_config_digest, build_policy_digest: value.build_policy_digest,
+            bundle_digest: value.bundle_digest, entrypoint: value.entrypoint, launcher_digest: value.launcher_digest,
+            network_alias: value.network_alias, platform: Object.freeze({ ...value.platform }),
+            platform_digest: value.platform_digest });
+    });
+    return Object.freeze(mappings);
+};
+const exactPath = (raw) => {
+    if (typeof raw !== "string" || raw.length < 1 || raw.includes("\0")
+        || byteLength(raw) > MAX_PATH_BYTES || !path.isAbsolute(raw)
+        || path.normalize(raw) !== raw)
+        return fail();
+    return raw;
+};
+const command = (raw) => {
+    if (typeof raw !== "string" || raw.includes("\0") || byteLength(raw) > 1_024)
+        return fail();
+    if (COMMAND_NAME.test(raw))
+        return raw;
+    if (!path.isAbsolute(raw) || path.normalize(raw) !== raw)
+        return fail();
+    return raw;
+};
+const ensureOwnedRoot = async (root) => {
+    let info;
+    try {
+        info = await lstat(root);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            return fail();
+        try {
+            await mkdir(root, { mode: 0o700 });
+        }
+        catch {
+            return fail();
+        }
+        try {
+            info = await lstat(root);
+        }
+        catch {
+            return fail();
+        }
+    }
+    const owner = process.getuid?.();
+    if (!info.isDirectory() || info.isSymbolicLink()
+        || owner !== undefined && info.uid !== owner)
+        return fail();
+    let handle;
+    try {
+        handle = await open(root, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+        await handle.chmod(0o700);
+        info = await handle.stat();
+    }
+    catch {
+        return fail();
+    }
+    finally {
+        await handle?.close().catch(() => undefined);
+    }
+    if (!info.isDirectory() || (info.mode & 0o777) !== 0o700
+        || owner !== undefined && info.uid !== owner)
+        return fail();
+    return root;
+};
+const isWithin = (candidate, root) => candidate === root || candidate.startsWith(`${root}${path.sep}`);
+const prepareExplicitContainerBundleRoot = async (raw, lifecycleRoot) => {
+    const requested = exactPath(raw);
+    if (path.parse(requested).root === requested
+        || isWithin(requested, lifecycleRoot)
+        || isWithin(lifecycleRoot, requested))
+        return fail();
+    try {
+        const existing = await lstat(requested);
+        if (!existing.isDirectory() || existing.isSymbolicLink()
+            || await realpath(requested) !== requested)
+            return fail();
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            return fail();
+        const parent = path.dirname(requested);
+        let parentInfo;
+        try {
+            parentInfo = await lstat(parent);
+        }
+        catch {
+            return fail();
+        }
+        const owner = process.getuid?.();
+        if (!parentInfo.isDirectory() || parentInfo.isSymbolicLink()
+            || owner !== undefined && parentInfo.uid !== owner)
+            return fail();
+        try {
+            if (await realpath(parent) !== parent)
+                return fail();
+        }
+        catch {
+            return fail();
+        }
+    }
+    const root = await ensureOwnedRoot(requested);
+    try {
+        if (await realpath(root) !== root)
+            return fail();
+    }
+    catch {
+        return fail();
+    }
+    return root;
+};
+const prepareRoots = async (containerBundleStoreRoot) => {
+    const home = resolveSpawnfileHome();
+    let homeInfo;
+    try {
+        homeInfo = await lstat(home);
+    }
+    catch {
+        return fail();
+    }
+    if (!homeInfo.isDirectory() || homeInfo.isSymbolicLink())
+        return fail();
+    const owner = process.getuid?.();
+    if (owner !== undefined && homeInfo.uid !== owner)
+        return fail();
+    try {
+        if (await realpath(home) !== home)
+            return fail();
+    }
+    catch {
+        return fail();
+    }
+    const root = await ensureOwnedRoot(path.join(home, "target"));
+    const childRoots = containerBundleStoreRoot === undefined
+        ? [...CHILD_ROOTS, "container-bundles"]
+        : CHILD_ROOTS;
+    const created = await Promise.all(childRoots.map((name) => ensureOwnedRoot(path.join(root, name))));
+    const containerBundles = containerBundleStoreRoot === undefined
+        ? created[7]
+        : await prepareExplicitContainerBundleRoot(containerBundleStoreRoot, root);
+    return Object.freeze({
+        root,
+        journals: created[0],
+        artifactIdentities: created[1],
+        secretAuthority: created[2],
+        attachmentAuthority: created[3],
+        worldAuthority: created[4],
+        evidenceExport: created[5],
+        evidenceHelper: created[6],
+        containerBundles
+    });
+};
+const validateDestination = async (raw) => {
+    const destination = exactPath(raw);
+    const parent = path.dirname(destination);
+    let parentInfo;
+    try {
+        parentInfo = await lstat(parent);
+    }
+    catch {
+        return fail();
+    }
+    const owner = process.getuid?.();
+    if (!parentInfo.isDirectory() || parentInfo.isSymbolicLink()
+        || (parentInfo.mode & 0o777) !== 0o700
+        || owner !== undefined && parentInfo.uid !== owner)
+        return fail();
+    try {
+        if (await realpath(parent) !== parent)
+            return fail();
+    }
+    catch {
+        return fail();
+    }
+    try {
+        const existing = await lstat(destination);
+        if (!existing.isFile() || existing.isSymbolicLink()
+            || owner !== undefined && existing.uid !== owner
+            || (existing.mode & 0o777) !== 0o600)
+            return fail();
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            return fail();
+    }
+    return destination;
+};
+export const loadTargetDefaultConfig = async (raw) => {
+    const value = descriptorValues(raw);
+    if (typeof value.context !== "string" || !CONTEXT.test(value.context)
+        || !Number.isSafeInteger(value.timeoutMs) || value.timeoutMs < 1
+        || value.timeoutMs > 120_000
+        || (Object.hasOwn(value, "artifactMappings") !== Object.hasOwn(value, "helperArtifactManifestDigest"))
+        || (Object.hasOwn(value, "helperArtifactManifestDigest") &&
+            (typeof value.helperArtifactManifestDigest !== "string"
+                || !DIGEST.test(value.helperArtifactManifestDigest))))
+        return fail();
+    const dockerCommand = command(value.dockerCommand);
+    const evidenceHelperBaseImage = value.evidenceHelperBaseImage === undefined ? undefined
+        : parseDockerBaseImageReference(value.evidenceHelperBaseImage) ?? fail();
+    const preparedEvidenceHelper = value.preparedEvidenceHelper === undefined ? undefined
+        : (() => { try {
+            return parsePreparedEvidenceHelperReceipt(value.preparedEvidenceHelper);
+        }
+        catch {
+            return fail();
+        } })();
+    if ((evidenceHelperBaseImage === undefined) !== (preparedEvidenceHelper === undefined))
+        return fail();
+    let artifactMappings;
+    try {
+        artifactMappings = value.artifactMappings === undefined
+            ? Object.freeze([]) : parseDockerArtifactMappings(value.artifactMappings);
+    }
+    catch {
+        return fail();
+    }
+    const preparedArtifactMappings = parseTargetPreparedArtifactMappings(value.preparedArtifactMappings);
+    if (preparedArtifactMappings.some((prepared) => artifactMappings.some((artifact) => artifact.artifact_manifest_digest === prepared.artifact_manifest_digest)))
+        return fail();
+    const evidenceDestination = await validateDestination(value.evidenceDestination);
+    const matches = value.helperArtifactManifestDigest === undefined ? [] : artifactMappings.filter((mapping) => mapping.artifact_manifest_digest === value.helperArtifactManifestDigest);
+    if (value.helperArtifactManifestDigest !== undefined && matches.length !== 1)
+        return fail();
+    const paths = await prepareRoots(value.containerBundleStoreRoot);
+    const config = {
+        artifactMappings,
+        context: value.context,
+        dockerCommand,
+        ...(evidenceHelperBaseImage === undefined ? {} : { evidenceHelperBaseImage }),
+        ...(preparedEvidenceHelper === undefined ? {} : { preparedEvidenceHelper }),
+        evidenceDestination,
+        ...(matches.length === 1 ? { helperArtifact: matches[0] } : {}),
+        preparedArtifactMappings,
+        paths,
+        timeoutMs: value.timeoutMs
+    };
+    return Object.freeze(config);
+};
+/** Resolves only the paths required by a world-readiness query; performs no I/O. */
+export const resolveTargetDefaultWorldReadinessConfig = (raw) => {
+    const value = descriptorValues(raw);
+    if (typeof value.context !== "string" || !CONTEXT.test(value.context)
+        || !Number.isSafeInteger(value.timeoutMs) || value.timeoutMs < 1
+        || value.timeoutMs > 120_000)
+        return fail();
+    const home = resolveSpawnfileHome();
+    return Object.freeze({
+        context: value.context,
+        dockerCommand: command(value.dockerCommand),
+        paths: Object.freeze({
+            worldAuthority: path.join(home, "target", "world-authority")
+        }),
+        timeoutMs: value.timeoutMs
+    });
+};

package/dist/cli/targetDefaultConfigStdin.d.ts

@@ -0,0 +1,13 @@
+import type { TargetDefaultConfig, TargetDefaultWorldReadinessConfig } from "./targetDefaultConfig.js";
+export declare const TARGET_DEFAULT_CONFIG_STDIN_ERROR = "Invalid target configuration";
+export declare const TARGET_DEFAULT_CONFIG_STDIN_VERSION = "spawnfile.target-default-config.v1";
+export declare const TARGET_LOOKUP_CONFIG_STDIN_VERSION = "spawnfile.target-lookup-config.v1";
+export declare const MAX_TARGET_DEFAULT_CONFIG_STDIN_BYTES = 262144;
+export interface TargetLookupConfig {
+    readonly context: string;
+}
+export declare const readTargetDefaultConfigStdin: (input: AsyncIterable<unknown>) => Promise<TargetDefaultConfig>;
+/** Parses the normal config envelope but resolves only the read-only readiness path. */
+export declare const readTargetWorldReadinessConfigStdin: (input: AsyncIterable<unknown>) => Promise<TargetDefaultWorldReadinessConfig>;
+/** Parses only the read-only lookup authority; it performs no filesystem work. */
+export declare const readTargetLookupConfigStdin: (input: AsyncIterable<unknown>) => Promise<TargetLookupConfig>;

package/dist/cli/targetDefaultConfigStdin.js

@@ -0,0 +1,221 @@
+import { TextDecoder } from "node:util";
+export const TARGET_DEFAULT_CONFIG_STDIN_ERROR = "Invalid target configuration";
+export const TARGET_DEFAULT_CONFIG_STDIN_VERSION = "spawnfile.target-default-config.v1";
+export const TARGET_LOOKUP_CONFIG_STDIN_VERSION = "spawnfile.target-lookup-config.v1";
+export const MAX_TARGET_DEFAULT_CONFIG_STDIN_BYTES = 262_144;
+const TARGET_CONTEXT_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/u;
+const fail = () => { throw new TypeError(TARGET_DEFAULT_CONFIG_STDIN_ERROR); };
+const assertNoDuplicateJsonKeys = (source) => {
+    let offset = 0;
+    const whitespace = () => { while (/\s/u.test(source[offset] ?? ""))
+        offset += 1; };
+    const string = () => {
+        const start = offset;
+        offset += 1;
+        while (offset < source.length) {
+            if (source[offset] === "\\")
+                offset += 2;
+            else if (source[offset] === "\"") {
+                offset += 1;
+                return JSON.parse(source.slice(start, offset));
+            }
+            else
+                offset += 1;
+        }
+        return fail();
+    };
+    const value = () => {
+        whitespace();
+        if (source[offset] === "{")
+            return object();
+        if (source[offset] === "[")
+            return array();
+        if (source[offset] === "\"") {
+            string();
+            return;
+        }
+        while (offset < source.length && !/[\s,\]}]/u.test(source[offset] ?? ""))
+            offset += 1;
+    };
+    const object = () => {
+        offset += 1;
+        whitespace();
+        const keys = new Set();
+        if (source[offset] === "}") {
+            offset += 1;
+            return;
+        }
+        while (offset < source.length) {
+            const key = string();
+            if (keys.has(key))
+                return fail();
+            keys.add(key);
+            whitespace();
+            offset += 1;
+            value();
+            whitespace();
+            if (source[offset] === "}") {
+                offset += 1;
+                return;
+            }
+            offset += 1;
+            whitespace();
+        }
+        return fail();
+    };
+    const array = () => {
+        offset += 1;
+        whitespace();
+        if (source[offset] === "]") {
+            offset += 1;
+            return;
+        }
+        while (offset < source.length) {
+            value();
+            whitespace();
+            if (source[offset] === "]") {
+                offset += 1;
+                return;
+            }
+            offset += 1;
+            whitespace();
+        }
+        return fail();
+    };
+    value();
+    whitespace();
+    if (offset !== source.length)
+        fail();
+};
+const exactDefaultConfigObject = (raw) => {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)
+        || Object.getPrototypeOf(raw) !== Object.prototype)
+        return fail();
+    const expected = [
+        "artifactMappings", "container_bundle_store_root", "context", "dockerCommand", "evidenceDestination", "evidenceHelperBaseImage", "preparedEvidenceHelper",
+        "helperArtifactManifestDigest", "preparedArtifactMappings", "timeoutMs", "version"
+    ];
+    const required = ["context", "dockerCommand", "evidenceDestination", "timeoutMs", "version"];
+    const keys = Object.keys(raw);
+    if (keys.some((key) => !expected.includes(key))
+        || required.some((key) => !keys.includes(key)))
+        return fail();
+    const value = raw;
+    if (value.version !== TARGET_DEFAULT_CONFIG_STDIN_VERSION
+        || Object.hasOwn(value, "artifactMappings") !== Object.hasOwn(value, "helperArtifactManifestDigest"))
+        return fail();
+    return value;
+};
+const exactLookupConfigObject = (raw) => {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)
+        || Object.getPrototypeOf(raw) !== Object.prototype)
+        return fail();
+    const keys = Object.keys(raw);
+    if (keys.length !== 2 || !keys.includes("context") || !keys.includes("version"))
+        return fail();
+    const value = raw;
+    if (value.version !== TARGET_LOOKUP_CONFIG_STDIN_VERSION
+        || typeof value.context !== "string"
+        || !TARGET_CONTEXT_PATTERN.test(value.context))
+        return fail();
+    return Object.freeze({ context: value.context });
+};
+const readBytes = async (input) => {
+    const chunks = [];
+    let total = 0;
+    try {
+        if (!input || typeof input[Symbol.asyncIterator] !== "function")
+            return fail();
+        for await (const raw of input) {
+            const chunk = typeof raw === "string" ? new TextEncoder().encode(raw)
+                : raw instanceof Uint8Array ? Uint8Array.from(raw) : fail();
+            // A non-empty chunk consumes at least one byte, so the byte ceiling also
+            // bounds iteration.  Rejecting empty chunks prevents an unbounded stream
+            // from evading that ceiling forever.
+            if (chunk.byteLength === 0)
+                return fail();
+            if (chunk.byteLength > MAX_TARGET_DEFAULT_CONFIG_STDIN_BYTES - total)
+                return fail();
+            chunks.push(chunk);
+            total += chunk.byteLength;
+        }
+        if (total === 0)
+            return fail();
+        const bytes = new Uint8Array(total);
+        let offset = 0;
+        for (const chunk of chunks) {
+            bytes.set(chunk, offset);
+            offset += chunk.byteLength;
+        }
+        return bytes;
+    }
+    catch {
+        return fail();
+    }
+};
+const readRawConfigStdin = async (input) => {
+    const bytes = await readBytes(input);
+    let source;
+    try {
+        source = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
+    }
+    catch {
+        return fail();
+    }
+    if (source.startsWith("\uFEFF"))
+        return fail();
+    try {
+        assertNoDuplicateJsonKeys(source);
+        return JSON.parse(source);
+    }
+    catch {
+        return fail();
+    }
+};
+export const readTargetDefaultConfigStdin = async (input) => {
+    const raw = exactDefaultConfigObject(await readRawConfigStdin(input));
+    const inputs = defaultConfigInputs(raw);
+    try {
+        const { loadTargetDefaultConfig } = await import("./targetDefaultConfig.js");
+        return await loadTargetDefaultConfig(inputs);
+    }
+    catch {
+        return fail();
+    }
+};
+const defaultConfigInputs = (raw) => ({
+    ...(Object.hasOwn(raw, "artifactMappings") ? {
+        artifactMappings: raw.artifactMappings
+    } : {}),
+    ...(Object.hasOwn(raw, "container_bundle_store_root") ? {
+        containerBundleStoreRoot: raw.container_bundle_store_root
+    } : {}),
+    context: raw.context,
+    dockerCommand: raw.dockerCommand,
+    evidenceDestination: raw.evidenceDestination,
+    ...(Object.hasOwn(raw, "evidenceHelperBaseImage") ? {
+        evidenceHelperBaseImage: raw.evidenceHelperBaseImage
+    } : {}),
+    ...(Object.hasOwn(raw, "preparedEvidenceHelper") ? {
+        preparedEvidenceHelper: raw.preparedEvidenceHelper
+    } : {}),
+    ...(Object.hasOwn(raw, "helperArtifactManifestDigest") ? {
+        helperArtifactManifestDigest: raw.helperArtifactManifestDigest
+    } : {}),
+    preparedArtifactMappings: raw.preparedArtifactMappings,
+    timeoutMs: raw.timeoutMs
+});
+/** Parses the normal config envelope but resolves only the read-only readiness path. */
+export const readTargetWorldReadinessConfigStdin = async (input) => {
+    const raw = exactDefaultConfigObject(await readRawConfigStdin(input));
+    const inputs = defaultConfigInputs(raw);
+    try {
+        const { resolveTargetDefaultWorldReadinessConfig } = await import("./targetDefaultConfig.js");
+        return resolveTargetDefaultWorldReadinessConfig(inputs);
+    }
+    catch {
+        return fail();
+    }
+};
+/** Parses only the read-only lookup authority; it performs no filesystem work. */
+export const readTargetLookupConfigStdin = async (input) => exactLookupConfigObject(await readRawConfigStdin(input));

package/dist/cli/targetDefaultEnvelope.d.ts

@@ -0,0 +1 @@
+export declare const targetDefaultEnvelope: (raw: unknown, required: readonly string[], optional?: readonly string[]) => Record<string, unknown>;

package/dist/cli/targetDefaultEnvelope.js

@@ -0,0 +1,13 @@
+import { types as nodeTypes } from "node:util";
+export const targetDefaultEnvelope = (raw, required, optional = []) => {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw) || nodeTypes.isProxy(raw) || Object.getPrototypeOf(raw) !== Object.prototype)
+        throw new Error("Target authority initialization failed");
+    const keys = Reflect.ownKeys(raw);
+    const allowed = [...required, ...optional];
+    if (keys.length < required.length || keys.length > allowed.length || keys.some((key) => typeof key !== "string" || !allowed.includes(key)) || required.some((key) => !keys.includes(key)))
+        throw new Error("Target authority initialization failed");
+    const descriptors = Object.getOwnPropertyDescriptors(raw);
+    if (Object.values(descriptors).some((descriptor) => !descriptor.enumerable || !("value" in descriptor)))
+        throw new Error("Target authority initialization failed");
+    return Object.fromEntries(keys.map((key) => [key, descriptors[key].value]));
+};