spawnfile 0.1.13 → 0.1.17

package/dist/cli/targetDefaultHandlerFactory.d.ts

@@ -0,0 +1,28 @@
+import { type SelectTargetOptions } from "../target/dockerTarget.js";
+import type { SelectedTargetReceipt } from "../target/contracts.js";
+import type { TargetDefaultAuthorities } from "./targetDefaultAuthorities.js";
+import type { TargetDefaultConfig } from "./targetDefaultConfig.js";
+import type { TargetCommandHandlers } from "./targetCommands.js";
+type Result = Awaited<ReturnType<TargetCommandHandlers["cleanup_run"]>>;
+interface Operations {
+    execute(raw: unknown): Promise<Result>;
+}
+interface EvidenceOperations {
+    recover(raw: unknown, destination: unknown): Promise<Result>;
+    execute(raw: unknown, destination: unknown): Promise<Result>;
+}
+type Factory = (options: Record<string, unknown>) => Operations;
+type EvidenceFactory = (options: Record<string, unknown>) => EvidenceOperations;
+export interface TargetDefaultHandlerFactories {
+    readonly artifact: Factory;
+    readonly attachment: Factory;
+    readonly cleanup: Factory;
+    readonly evidence: EvidenceFactory;
+    readonly resource: Factory;
+    readonly secret: Factory;
+    readonly select: (options: SelectTargetOptions) => Promise<SelectedTargetReceipt>;
+    readonly world: Factory;
+}
+export declare const targetDefaultHandlerFactories: TargetDefaultHandlerFactories;
+export declare const createTargetDefaultHandlers: (config: TargetDefaultConfig, rawFactories: TargetDefaultHandlerFactories, rawAuthorities: TargetDefaultAuthorities) => Promise<TargetCommandHandlers>;
+export {};

package/dist/cli/targetDefaultHandlerFactory.js

@@ -0,0 +1,268 @@
+import { types as nodeTypes } from "node:util";
+import { createDockerCleanupRunOperations } from "../target/cleanupRunDocker.js";
+import { createDockerArtifactOperations } from "../target/dockerArtifacts.js";
+import { createDockerPreparedArtifactOperations } from "../target/dockerPreparedArtifact.js";
+import { initializeFilesystemTargetLocalBundleStore } from "../target/containerBundleFilesystemStore.js";
+import { createDockerTargetLocalBundleBuilder } from "../target/dockerContainerBundleBuilder.js";
+import { createDockerResourceOperations } from "../target/dockerResources.js";
+import { createDockerSecretOperations } from "../target/dockerSecrets.js";
+import { selectTarget } from "../target/dockerTarget.js";
+import { createDockerWorldServiceOperations } from "../target/dockerWorldService.js";
+import { createEvidenceExportOperations } from "../target/evidenceExport.js";
+import { createEvidenceExportHelper, EVIDENCE_EXPORT_HELPER_CONTRACT } from "../target/evidenceExportProvider.js";
+import { resolvePreparedEvidenceHelperImage } from "../evidenceExportHelper/index.js";
+import { createDockerOrganizationAttachmentOperations } from "../target/organizationAttachment.js";
+import { createTargetEvidenceHelperResolutionRequest } from "./targetEvidenceHelperResolution.js";
+export const targetDefaultHandlerFactories = Object.freeze({
+    artifact: createDockerArtifactOperations,
+    attachment: createDockerOrganizationAttachmentOperations,
+    cleanup: createDockerCleanupRunOperations,
+    evidence: createEvidenceExportOperations,
+    resource: createDockerResourceOperations,
+    secret: createDockerSecretOperations,
+    select: selectTarget,
+    world: createDockerWorldServiceOperations
+});
+const MUTATIONS = Object.freeze([
+    "attach_organization",
+    "cleanup_run",
+    "create_data_network",
+    "create_evidence_volume",
+    "create_world_service",
+    "detach_organization",
+    "export_evidence_volume",
+    "prepare_secret_bindings",
+    "recover_operation",
+    "resolve_world_artifact",
+    "revoke_secret_bindings",
+    "start_world_service",
+    "stop_world_service"
+]);
+const shape = (raw, expected) => {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw) || nodeTypes.isProxy(raw)
+        || Object.getPrototypeOf(raw) !== Object.prototype) {
+        throw new Error("Target handler initialization failed");
+    }
+    const keys = Reflect.ownKeys(raw);
+    if (keys.length !== expected.length
+        || keys.some((key) => typeof key !== "string" || !expected.includes(key))) {
+        throw new Error("Target handler initialization failed");
+    }
+    const descriptors = Object.getOwnPropertyDescriptors(raw);
+    if (Object.values(descriptors).some((descriptor) => !descriptor.enumerable || !("value" in descriptor))) {
+        throw new Error("Target handler initialization failed");
+    }
+    return Object.fromEntries(expected.map((key) => [key, descriptors[key].value]));
+};
+const requireFactories = (raw) => {
+    const names = [
+        "artifact", "attachment", "cleanup", "evidence",
+        "resource", "secret", "select", "world"
+    ];
+    const values = shape(raw, names);
+    for (const name of names) {
+        if (typeof values[name] !== "function")
+            throw new Error("Target handler initialization failed");
+    }
+    return Object.freeze(values);
+};
+const requireAuthorities = (raw) => {
+    const names = [
+        "artifactIdentityStore", "attachmentAuthorityStore",
+        "evidenceExportAuthorityStore", "executors", "handoffResolver",
+        "helperArtifactResolver", "helperExecutor", "journals", "secretAuthorityStore",
+        "secretResolver", "topologyAttestor", "worldAuthorityStore", "worldResolver"
+    ];
+    if (!raw || typeof raw !== "object" || Array.isArray(raw) || nodeTypes.isProxy(raw)
+        || Object.getPrototypeOf(raw) !== Object.prototype) {
+        throw new Error("Target handler initialization failed");
+    }
+    const descriptors = Object.getOwnPropertyDescriptors(raw);
+    const values = shape(raw, Object.hasOwn(descriptors, "helperArtifactResolver")
+        ? names : names.filter((name) => name !== "helperArtifactResolver"));
+    for (const name of [
+        "artifactIdentityStore", "attachmentAuthorityStore",
+        "evidenceExportAuthorityStore", "secretAuthorityStore", "worldAuthorityStore"
+    ]) {
+        if (!values[name] || typeof values[name] !== "object") {
+            throw new Error("Target handler initialization failed");
+        }
+    }
+    const executorNames = [
+        "artifact", "attachment", "evidenceExport", "publicArtifact", "resource",
+        "secret", "world"
+    ];
+    const executors = shape(values.executors, executorNames);
+    if (executorNames.some((name) => typeof executors[name] !== "function")) {
+        throw new Error("Target handler initialization failed");
+    }
+    if (typeof values.helperExecutor !== "function") {
+        throw new Error("Target handler initialization failed");
+    }
+    for (const name of [
+        "handoffResolver", "journals", "secretResolver", "worldResolver"
+    ]) {
+        const resolver = shape(values[name], ["resolve"]);
+        if (typeof resolver.resolve !== "function") {
+            throw new Error("Target handler initialization failed");
+        }
+    }
+    if (values.helperArtifactResolver !== undefined) {
+        const resolver = shape(values.helperArtifactResolver, ["resolve"]);
+        if (typeof resolver.resolve !== "function") {
+            throw new Error("Target handler initialization failed");
+        }
+    }
+    const topologyAttestor = shape(values.topologyAttestor, ["activate", "attest"]);
+    if (typeof topologyAttestor.activate !== "function"
+        || typeof topologyAttestor.attest !== "function") {
+        throw new Error("Target handler initialization failed");
+    }
+    return Object.freeze({ ...values, executors: Object.freeze(executors) });
+};
+const execute = async (expected, factories, authorities, config, raw) => {
+    if (!raw || raw.operation !== expected)
+        throw new Error("Target operation mismatch");
+    const authority = await authorities.journals.resolve({ context: config.context, request: raw });
+    const request = authority.request;
+    if (request.operation !== expected)
+        throw new Error("Target operation mismatch");
+    const common = { context: config.context, journal: authority.journal, timeoutMs: config.timeoutMs };
+    const run = async () => {
+        switch (request.operation) {
+            case "resolve_world_artifact": {
+                const prepared = config.preparedArtifactMappings.filter((mapping) => mapping.artifact_manifest_digest === request.artifact_manifest_digest);
+                if (prepared.length > 1)
+                    throw new Error("Target operation mismatch");
+                if (prepared.length === 1) {
+                    return createDockerPreparedArtifactOperations({
+                        builder: createDockerTargetLocalBundleBuilder({
+                            context: config.context,
+                            executor: authorities.executors.artifact,
+                            timeoutMs: config.timeoutMs
+                        }),
+                        identityStore: authorities.artifactIdentityStore,
+                        journal: authority.journal,
+                        mapping: prepared[0],
+                        store: await initializeFilesystemTargetLocalBundleStore(config.paths.containerBundles)
+                    }).execute(request);
+                }
+                return factories.artifact({
+                    ...common,
+                    executor: authorities.executors.artifact,
+                    identityStore: authorities.artifactIdentityStore,
+                    mappings: config.artifactMappings
+                }).execute(request);
+            }
+            case "prepare_secret_bindings":
+            case "revoke_secret_bindings":
+                return factories.secret({
+                    ...common,
+                    authorityStore: authorities.secretAuthorityStore,
+                    executor: authorities.executors.secret,
+                    resolver: authorities.secretResolver
+                }).execute(request);
+            case "create_data_network":
+            case "create_evidence_volume":
+                return factories.resource({ ...common, executor: authorities.executors.resource }).execute(request);
+            case "attach_organization":
+            case "detach_organization":
+                return factories.attachment({
+                    ...common,
+                    authorityStore: authorities.attachmentAuthorityStore,
+                    executor: authorities.executors.attachment,
+                    resolver: authorities.handoffResolver
+                }).execute(request);
+            case "create_world_service":
+            case "start_world_service":
+            case "stop_world_service":
+                return factories.world({
+                    ...common,
+                    authorityStore: authorities.worldAuthorityStore,
+                    executor: authorities.executors.world,
+                    resolver: authorities.worldResolver
+                }).execute(request);
+            case "export_evidence_volume":
+            case "recover_operation": {
+                if (config.evidenceHelperBaseImage && config.preparedEvidenceHelper) {
+                    const helperInput = { baseImage: config.evidenceHelperBaseImage, context: config.context,
+                        executor: authorities.helperExecutor, privateRoot: config.paths.evidenceHelper,
+                        timeoutMs: config.timeoutMs };
+                    const image = await resolvePreparedEvidenceHelperImage(helperInput, config.preparedEvidenceHelper);
+                    const localHelper = createEvidenceExportHelper({ artifactManifestDigest: config.preparedEvidenceHelper.digest,
+                        imageDigest: image.configDigest, imageReference: image.imageReference, resultHandle: config.preparedEvidenceHelper.handle });
+                    const operations = factories.evidence({
+                        ...common, artifactIdentityStore: authorities.artifactIdentityStore,
+                        authorityStore: authorities.evidenceExportAuthorityStore, executor: authorities.executors.resource,
+                        exportExecutor: authorities.executors.evidenceExport, helperArtifactContract: EVIDENCE_EXPORT_HELPER_CONTRACT,
+                        helperArtifactManifestDigest: config.preparedEvidenceHelper.digest, localHelper
+                    });
+                    return request.operation === "recover_operation"
+                        ? operations.recover(request, config.evidenceDestination)
+                        : operations.execute(request, config.evidenceDestination);
+                }
+                if (!config.helperArtifact || !authorities.helperArtifactResolver) {
+                    throw new Error("Target evidence helper is not configured");
+                }
+                if (request.operation === "export_evidence_volume") {
+                    await factories.artifact({
+                        ...common,
+                        executor: authorities.executors.artifact,
+                        identityStore: authorities.artifactIdentityStore,
+                        mappings: config.artifactMappings
+                    }).execute(createTargetEvidenceHelperResolutionRequest(request, config.helperArtifact.artifact_manifest_digest));
+                }
+                const helper = await authorities.helperArtifactResolver.resolve({
+                    context: config.context,
+                    request
+                });
+                const operations = factories.evidence({
+                    ...common,
+                    artifactIdentityStore: authorities.artifactIdentityStore,
+                    authorityStore: authorities.evidenceExportAuthorityStore,
+                    executor: authorities.executors.resource,
+                    exportExecutor: authorities.executors.evidenceExport,
+                    helperArtifactBundle: helper.bundle,
+                    helperArtifactContract: EVIDENCE_EXPORT_HELPER_CONTRACT,
+                    helperArtifactManifestDigest: config.helperArtifact.artifact_manifest_digest
+                });
+                return request.operation === "recover_operation"
+                    ? operations.recover(request, config.evidenceDestination)
+                    : operations.execute(request, config.evidenceDestination);
+            }
+            case "cleanup_run":
+                return factories.cleanup({
+                    ...common,
+                    attachmentExecutor: authorities.executors.attachment,
+                    attachmentStore: authorities.attachmentAuthorityStore,
+                    evidenceExportStore: authorities.evidenceExportAuthorityStore,
+                    resourceExecutor: authorities.executors.resource,
+                    secretExecutor: authorities.executors.secret,
+                    worldExecutor: authorities.executors.world,
+                    worldStore: authorities.worldAuthorityStore
+                }).execute(request);
+        }
+    };
+    return authority.journal.withLifecycleLease(run);
+};
+export const createTargetDefaultHandlers = async (config, rawFactories, rawAuthorities) => {
+    const factories = requireFactories(rawFactories);
+    const authorities = requireAuthorities(rawAuthorities);
+    const handlers = Object.fromEntries(MUTATIONS.map((operation) => [
+        operation,
+        (request) => execute(operation, factories, authorities, config, request)
+    ]));
+    return Object.freeze({
+        ...handlers,
+        select_target: async (request) => {
+            if (request.target_reference !== config.context)
+                throw new Error("Target selection failed");
+            return factories.select({
+                context: config.context,
+                dockerCommand: config.dockerCommand,
+                execFile: async (_file, args, options) => authorities.executors.resource("docker", args, options),
+                timeoutMs: config.timeoutMs
+            });
+        }
+    });
+};

package/dist/cli/targetDefaultHandlers.d.ts

@@ -0,0 +1,21 @@
+import type { TargetTopologyAttestationRequest } from "../target/contracts.js";
+import type { TargetTopologyAttestationResult } from "../target/topologyAttestation.js";
+import type { TargetPublicArtifactSnapshotRequest, TargetPublicArtifactSnapshotResult } from "../target/publicArtifactSnapshot.js";
+import type { TargetTopologyActivationResult } from "../target/topologyActivation.js";
+import type { TargetDefaultConfig } from "./targetDefaultConfig.js";
+import type { TargetCommandHandlers } from "./targetCommands.js";
+export { createTargetDefaultHandlers, type TargetDefaultHandlerFactories } from "./targetDefaultHandlerFactory.js";
+/** A closeable production target handler graph. */
+export interface TargetDefaultHandlerSession {
+    readonly handlers: TargetCommandHandlers;
+    dispose(): Promise<void>;
+}
+export declare const createTargetDefaultHandlerSession: (config: TargetDefaultConfig) => Promise<TargetDefaultHandlerSession>;
+export declare const withTargetDefaultHandlerSession: <Result>(config: TargetDefaultConfig, invoke: (handlers: TargetCommandHandlers) => Promise<Result>, signal?: AbortSignal) => Promise<Result>;
+/** The read-only attestor owns the same private authority graph as mutations. */
+export declare const attestTargetDefaultTopology: (config: TargetDefaultConfig, request: TargetTopologyAttestationRequest) => Promise<TargetTopologyAttestationResult>;
+/** Read one exact, bounded public projection from an attested world service. */
+export declare const snapshotTargetDefaultPublicArtifact: (config: TargetDefaultConfig, request: TargetPublicArtifactSnapshotRequest) => Promise<TargetPublicArtifactSnapshotResult>;
+export declare const activateTargetDefaultTopology: (config: TargetDefaultConfig, request: TargetTopologyAttestationRequest) => Promise<TargetTopologyActivationResult>;
+/** Internal lifecycle primitive; not re-exported from the package surface. */
+export declare const runTargetDefaultHandlerSession: <Result>(session: TargetDefaultHandlerSession, invoke: (handlers: TargetCommandHandlers) => Promise<Result>, signal?: AbortSignal) => Promise<Result>;

package/dist/cli/targetDefaultHandlers.js

@@ -0,0 +1,72 @@
+import { createDockerPublicArtifactSnapshotReader } from "../target/dockerPublicArtifactSnapshot.js";
+import { initializeTargetDefaultAuthoritySession } from "./targetDefaultAuthorities.js";
+import { createTargetDefaultHandlers, targetDefaultHandlerFactories } from "./targetDefaultHandlerFactory.js";
+export { createTargetDefaultHandlers } from "./targetDefaultHandlerFactory.js";
+export const createTargetDefaultHandlerSession = async (config) => {
+    let authoritySession;
+    try {
+        authoritySession = await initializeTargetDefaultAuthoritySession(config);
+        const handlers = await createTargetDefaultHandlers(config, targetDefaultHandlerFactories, authoritySession.authorities);
+        return Object.freeze({ handlers, dispose: authoritySession.dispose });
+    }
+    catch (error) {
+        await authoritySession?.dispose().catch(() => undefined);
+        throw error;
+    }
+};
+export const withTargetDefaultHandlerSession = async (config, invoke, signal) => {
+    if (signal?.aborted)
+        throw new Error("Target handler initialization failed");
+    const session = await createTargetDefaultHandlerSession(config);
+    return runTargetDefaultHandlerSession(session, invoke, signal);
+};
+/** The read-only attestor owns the same private authority graph as mutations. */
+export const attestTargetDefaultTopology = async (config, request) => {
+    const session = await initializeTargetDefaultAuthoritySession(config);
+    try {
+        return await session.authorities.topologyAttestor.attest(request);
+    }
+    finally {
+        await session.dispose();
+    }
+};
+/** Read one exact, bounded public projection from an attested world service. */
+export const snapshotTargetDefaultPublicArtifact = async (config, request) => {
+    const session = await initializeTargetDefaultAuthoritySession(config);
+    try {
+        return await createDockerPublicArtifactSnapshotReader({
+            authorityStore: session.authorities.worldAuthorityStore,
+            context: config.context,
+            contentExecutor: session.authorities.executors.publicArtifact,
+            executor: session.authorities.executors.world,
+            timeoutMs: config.timeoutMs
+        }).snapshot(request);
+    }
+    finally {
+        await session.dispose();
+    }
+};
+export const activateTargetDefaultTopology = async (config, request) => {
+    const session = await initializeTargetDefaultAuthoritySession(config);
+    try {
+        return await session.authorities.topologyAttestor.activate(request);
+    }
+    finally {
+        await session.dispose();
+    }
+};
+/** Internal lifecycle primitive; not re-exported from the package surface. */
+export const runTargetDefaultHandlerSession = async (session, invoke, signal) => {
+    let closing;
+    const close = () => closing ??= session.dispose();
+    if (signal?.aborted) {
+        await close();
+        throw new Error("Target handler initialization failed");
+    }
+    try {
+        return await invoke(session.handlers);
+    }
+    finally {
+        await close();
+    }
+};

package/dist/cli/targetDefaultJournalAuthority.d.ts

@@ -0,0 +1,35 @@
+import { type SelectedTargetReceipt, type TargetResourceRequest } from "../target/contracts.js";
+import { type TargetJournalStore } from "../target/journal.js";
+import type { TargetDefaultConfig } from "./targetDefaultConfig.js";
+export declare const TARGET_DEFAULT_AUTHORITIES_ERROR = "Target authority initialization failed";
+type MutationRequest = Exclude<TargetResourceRequest, {
+    operation: "select_target";
+}>;
+export interface TargetMutationAuthority {
+    readonly journal: TargetJournalStore;
+    readonly request: MutationRequest;
+    readonly selectedTarget: SelectedTargetReceipt;
+}
+export interface TargetJournalResolver {
+    resolve(input: {
+        readonly context: unknown;
+        readonly request: unknown;
+    }): Promise<TargetMutationAuthority>;
+}
+export interface TargetJournalAccess {
+    readonly resolver: TargetJournalResolver;
+    resolveIdentity(input: {
+        readonly context: unknown;
+        readonly descriptorDigest: unknown;
+        readonly runId: unknown;
+        readonly selectedTarget: unknown;
+    }): Promise<TargetJournalStore>;
+    resolveExistingIdentity(input: {
+        readonly context: unknown;
+        readonly descriptorDigest: unknown;
+        readonly runId: unknown;
+        readonly selectedTarget: unknown;
+    }): Promise<TargetJournalStore>;
+}
+export declare const createTargetJournalAccess: (config: TargetDefaultConfig) => TargetJournalAccess;
+export {};

package/dist/cli/targetDefaultJournalAuthority.js

@@ -0,0 +1,135 @@
+import { SELECTED_TARGET_VERSION, parseSelectedTargetReceipt, parseTargetResourceRequest } from "../target/contracts.js";
+import { initializeTargetJournal, openExistingTargetJournalAuthority } from "../target/journal.js";
+import { targetDefaultEnvelope as envelope } from "./targetDefaultEnvelope.js";
+export const TARGET_DEFAULT_AUTHORITIES_ERROR = "Target authority initialization failed";
+const fail = () => { throw new Error(TARGET_DEFAULT_AUTHORITIES_ERROR); };
+const selectedFrom = (request) => parseSelectedTargetReceipt({
+    ...request.selected_target,
+    version: SELECTED_TARGET_VERSION
+});
+const mutation = (raw) => {
+    let request;
+    try {
+        request = parseTargetResourceRequest(raw);
+    }
+    catch {
+        return fail();
+    }
+    if (request.operation === "select_target")
+        return fail();
+    return request;
+};
+const same = (left, right) => JSON.stringify(left) === JSON.stringify(right);
+const identityKey = (context, request, selected) => [
+    context,
+    request.run_id,
+    request.descriptor_digest,
+    selected.fingerprint,
+    selected.handle
+].join("\0");
+export const createTargetJournalAccess = (config) => {
+    const cache = new Map();
+    const resolveIdentity = async (input) => {
+        if (input.context !== config.context)
+            return fail();
+        let selectedTarget;
+        try {
+            selectedTarget = parseSelectedTargetReceipt({
+                ...input.selectedTarget,
+                version: SELECTED_TARGET_VERSION
+            });
+        }
+        catch {
+            return fail();
+        }
+        const synthetic = {
+            descriptor_digest: input.descriptorDigest,
+            run_id: input.runId,
+            selected_target: {
+                fingerprint: selectedTarget.fingerprint,
+                handle: selectedTarget.handle
+            }
+        };
+        const key = identityKey(config.context, synthetic, selectedTarget);
+        let journal = cache.get(key);
+        if (!journal) {
+            journal = initializeTargetJournal({
+                context: config.context,
+                descriptorDigest: input.descriptorDigest,
+                root: config.paths.journals,
+                runId: input.runId,
+                selectedTarget
+            });
+            cache.set(key, journal);
+            journal.catch(() => { if (cache.get(key) === journal)
+                cache.delete(key); });
+        }
+        const resolved = await journal;
+        const snapshot = await resolved.read();
+        if (snapshot.run_id !== input.runId
+            || snapshot.descriptor_digest !== input.descriptorDigest
+            || !same(snapshot.selected_target, synthetic.selected_target))
+            return fail();
+        return resolved;
+    };
+    const resolveExistingIdentity = async (input) => {
+        if (input.context !== config.context)
+            return fail();
+        let selectedTarget;
+        try {
+            selectedTarget = parseSelectedTargetReceipt({
+                ...input.selectedTarget,
+                version: SELECTED_TARGET_VERSION
+            });
+        }
+        catch {
+            return fail();
+        }
+        const synthetic = {
+            descriptor_digest: input.descriptorDigest,
+            run_id: input.runId,
+            selected_target: { fingerprint: selectedTarget.fingerprint, handle: selectedTarget.handle }
+        };
+        let resolved;
+        try {
+            resolved = await openExistingTargetJournalAuthority({
+                context: config.context,
+                descriptorDigest: input.descriptorDigest,
+                root: config.paths.journals,
+                runId: input.runId,
+                selectedTarget
+            });
+        }
+        catch {
+            return fail();
+        }
+        const snapshot = await resolved.read();
+        if (snapshot.run_id !== input.runId
+            || snapshot.descriptor_digest !== input.descriptorDigest
+            || !same(snapshot.selected_target, synthetic.selected_target))
+            return fail();
+        return resolved;
+    };
+    const resolver = Object.freeze({
+        resolve: async (raw) => {
+            const input = envelope(raw, ["context", "request"]);
+            if (input.context !== config.context)
+                return fail();
+            const request = mutation(input.request);
+            const selectedTarget = selectedFrom(request);
+            if (!same(request.selected_target, {
+                fingerprint: selectedTarget.fingerprint,
+                handle: selectedTarget.handle
+            }))
+                return fail();
+            const resolved = await resolveIdentity({
+                context: input.context,
+                descriptorDigest: request.descriptor_digest,
+                runId: request.run_id,
+                selectedTarget: request.selected_target
+            });
+            return Object.freeze({ journal: resolved, request, selectedTarget });
+        }
+    });
+    return { resolver, resolveExistingIdentity, resolveIdentity };
+};

package/dist/cli/targetDefaultWorldClock.d.ts

@@ -0,0 +1,4 @@
+import { type TargetWorldClockReceipt } from "../target/worldClock.js";
+import type { TargetDefaultWorldReadinessConfig } from "./targetDefaultConfig.js";
+/** Query one recorded world and its immutable activation marker for clock truth. */
+export declare const queryTargetDefaultWorldClock: (config: TargetDefaultWorldReadinessConfig, request: unknown) => Promise<TargetWorldClockReceipt>;

package/dist/cli/targetDefaultWorldClock.js

@@ -0,0 +1,14 @@
+import { createDockerTargetExecutors } from "../target/dockerCommandExecutor.js";
+import { createDockerWorldClockReader } from "../target/dockerWorldClock.js";
+import { initializeWorldServiceAuthorityReader } from "../target/dockerWorldServiceStore.js";
+import { parseTargetWorldClockRequest, } from "../target/worldClock.js";
+/** Query one recorded world and its immutable activation marker for clock truth. */
+export const queryTargetDefaultWorldClock = async (config, request) => {
+    const parsed = parseTargetWorldClockRequest(request);
+    const authorityStore = await initializeWorldServiceAuthorityReader(config.paths.worldAuthority);
+    const executors = createDockerTargetExecutors({ dockerCommand: config.dockerCommand });
+    return createDockerWorldClockReader({
+        authorityStore, context: config.context, contentExecutor: executors.publicArtifact,
+        executor: executors.world, timeoutMs: config.timeoutMs,
+    }).query(parsed);
+};

package/dist/cli/targetDefaultWorldQueries.d.ts

@@ -0,0 +1,5 @@
+import type { TargetDefaultWorldReadinessConfig } from "./targetDefaultConfig.js";
+import type { TargetWorldClockSession } from "./targetWorldClockCommand.js";
+import type { TargetWorldReadinessSession } from "./targetWorldReadinessCommand.js";
+/** Minimal production session shared by the two read-only world queries. */
+export declare const createProductionTargetWorldQuerySession: (config: TargetDefaultWorldReadinessConfig) => TargetWorldReadinessSession & TargetWorldClockSession;

package/dist/cli/targetDefaultWorldQueries.js

@@ -0,0 +1,11 @@
+/** Minimal production session shared by the two read-only world queries. */
+export const createProductionTargetWorldQuerySession = (config) => Object.freeze({
+    queryWorldReadiness: async (request) => {
+        const { queryTargetDefaultWorldReadiness } = await import("./targetDefaultWorldReadiness.js");
+        return queryTargetDefaultWorldReadiness(config, request);
+    },
+    queryWorldClock: async (request) => {
+        const { queryTargetDefaultWorldClock } = await import("./targetDefaultWorldClock.js");
+        return queryTargetDefaultWorldClock(config, request);
+    },
+});

package/dist/cli/targetDefaultWorldReadiness.d.ts

@@ -0,0 +1,4 @@
+import { type TargetWorldReadinessReceipt } from "../target/worldReadiness.js";
+import type { TargetDefaultWorldReadinessConfig } from "./targetDefaultConfig.js";
+/** Query one exact world through its private container-local readiness endpoint. */
+export declare const queryTargetDefaultWorldReadiness: (config: TargetDefaultWorldReadinessConfig, request: unknown) => Promise<TargetWorldReadinessReceipt>;

package/dist/cli/targetDefaultWorldReadiness.js

@@ -0,0 +1,17 @@
+import { createDockerWorldReadinessReader } from "../target/dockerWorldReadiness.js";
+import { createDockerTargetExecutors } from "../target/dockerCommandExecutor.js";
+import { initializeWorldServiceAuthorityReader } from "../target/dockerWorldServiceStore.js";
+import { parseTargetWorldReadinessRequest } from "../target/worldReadiness.js";
+/** Query one exact world through its private container-local readiness endpoint. */
+export const queryTargetDefaultWorldReadiness = async (config, request) => {
+    const parsedRequest = parseTargetWorldReadinessRequest(request);
+    const authorityStore = await initializeWorldServiceAuthorityReader(config.paths.worldAuthority);
+    const executors = createDockerTargetExecutors({ dockerCommand: config.dockerCommand });
+    return createDockerWorldReadinessReader({
+        authorityStore,
+        context: config.context,
+        contentExecutor: executors.publicArtifact,
+        executor: executors.world,
+        timeoutMs: config.timeoutMs
+    }).query(parsedRequest);
+};

package/dist/cli/targetEvidenceHelperResolution.d.ts

@@ -0,0 +1,14 @@
+import { type TargetResourceRequest } from "../target/contracts.js";
+type EvidenceExportRequest = Extract<TargetResourceRequest, {
+    operation: "export_evidence_volume";
+}>;
+type ArtifactResolutionRequest = Extract<TargetResourceRequest, {
+    operation: "resolve_world_artifact";
+}>;
+/**
+ * Derives the target-owned helper admission immediately preceding an evidence
+ * export. The public export revision therefore names the second mutation in
+ * this aggregate operation; recovery reuses the completed admission.
+ */
+export declare const createTargetEvidenceHelperResolutionRequest: (request: EvidenceExportRequest, artifactManifestDigest: string) => ArtifactResolutionRequest;
+export {};