spawnfile 0.1.13 → 0.1.17

package/dist/audit/types.d.ts

@@ -0,0 +1,40 @@
+/**
+ * B54 — spawnfile.audit.v1 contract types. This module is type-only (no
+ * logic, no I/O): the schema constant plus the AuditCheck/AuditReport shapes
+ * every other file in src/audit/ produces or consumes. See AGENTS.md for the
+ * folder-wide "reports, never enforces" rule this contract exists to serve.
+ */
+/** Versioned schema identifier stamped on every generated report, mirroring the `noopolis.causal-event.v1` precedent (src/ledger/envelope.ts). */
+export declare const SPAWNFILE_AUDIT_SCHEMA: "spawnfile.audit.v1";
+/**
+ * The five ledger/runtime categories checks 1-6 are grounded in, plus
+ * "provenance" for check 7 (`provenance.signed-report`). The frozen B54
+ * packet's contract line only lists five category values; "provenance" is
+ * added here to keep every check's `id` prefix equal to its `category`
+ * (checks 1-6 already follow that pattern exactly), rather than
+ * mis-bucketing check 7 under an unrelated category. See AGENTS.md
+ * "Deviations from the frozen packet".
+ */
+export type AuditCheckCategory = "causal" | "container" | "control" | "memory" | "network" | "provenance";
+export type AuditCheckStatus = "pass" | "fail" | "not_applicable";
+export type AuditCheckSeverity = "critical" | "high" | "medium";
+export interface AuditCheck {
+    category: AuditCheckCategory;
+    evidence: Record<string, unknown>;
+    id: string;
+    severity: AuditCheckSeverity;
+    status: AuditCheckStatus;
+}
+export interface AuditSummary {
+    failed: number;
+    na: number;
+    passed: number;
+}
+export interface AuditReport {
+    checks: AuditCheck[];
+    /** Diagnostic only — excluded from determinism comparisons (two otherwise-identical generator runs may differ only here). */
+    generated_at: string;
+    run_id: string | null;
+    schema: typeof SPAWNFILE_AUDIT_SCHEMA;
+    summary: AuditSummary;
+}

package/dist/audit/types.js

@@ -0,0 +1,8 @@
+/**
+ * B54 — spawnfile.audit.v1 contract types. This module is type-only (no
+ * logic, no I/O): the schema constant plus the AuditCheck/AuditReport shapes
+ * every other file in src/audit/ produces or consumes. See AGENTS.md for the
+ * folder-wide "reports, never enforces" rule this contract exists to serve.
+ */
+/** Versioned schema identifier stamped on every generated report, mirroring the `noopolis.causal-event.v1` precedent (src/ledger/envelope.ts). */
+export const SPAWNFILE_AUDIT_SCHEMA = "spawnfile.audit.v1";

package/dist/auth/credentialEnvFile.d.ts

@@ -0,0 +1,11 @@
+import type { CredentialProvisioningReceipt } from "./credentialProvisioningReceipt.js";
+import type { ProvisionedCredentialMaterials } from "./credentialProvisioning.js";
+export type ProvisionedEnvFileResult = Readonly<{
+    digest: string;
+    path: string;
+}>;
+export declare const writeProvisionedEnvFile: (input: Readonly<{
+    materials: ProvisionedCredentialMaterials;
+    path: string;
+    receipt: CredentialProvisioningReceipt;
+}>) => Promise<ProvisionedEnvFileResult>;

package/dist/auth/credentialEnvFile.js

@@ -0,0 +1,60 @@
+import { createHash } from "node:crypto";
+import { open, unlink } from "node:fs/promises";
+import { TARGET_SECRET_SOURCE_ERROR } from "./targetSecretSourceRecordCommon.js";
+const fail = () => { throw new Error(TARGET_SECRET_SOURCE_ERROR); };
+export const writeProvisionedEnvFile = async (input) => {
+    let bytes;
+    let handle;
+    let created = false;
+    try {
+        const credentials = [...input.receipt.credentials].sort((left, right) => left.env < right.env ? -1 : left.env > right.env ? 1 : 0);
+        if (credentials.length === 0 || input.materials.size !== credentials.length)
+            fail();
+        const prefixes = credentials.map(({ env }) => new TextEncoder().encode(`${env}=`));
+        try {
+            const size = credentials.reduce((total, credential, index) => {
+                const prefix = prefixes[index] ?? fail();
+                const material = input.materials.get(credential.name) ?? fail();
+                if (!material || material.length === 0 || material.some((byte) => byte === 0 || byte === 10 || byte === 13))
+                    fail();
+                return total + prefix.length + material.length + 1;
+            }, 0);
+            bytes = new Uint8Array(size);
+            let offset = 0;
+            for (const [index, credential] of credentials.entries()) {
+                const prefix = prefixes[index] ?? fail();
+                const material = input.materials.get(credential.name) ?? fail();
+                bytes.set(prefix, offset);
+                offset += prefix.length;
+                bytes.set(material, offset);
+                offset += material.length;
+                bytes[offset] = 10;
+                offset += 1;
+            }
+        }
+        finally {
+            for (const prefix of prefixes)
+                prefix.fill(0);
+        }
+        handle = await open(input.path, "wx", 0o600);
+        created = true;
+        await handle.chmod(0o600);
+        await handle.writeFile(bytes);
+        await handle.sync();
+        const digest = `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+        await handle.close();
+        handle = undefined;
+        return Object.freeze({ digest, path: input.path });
+    }
+    catch {
+        await handle?.close().catch(() => undefined);
+        handle = undefined;
+        if (created)
+            await unlink(input.path).catch(() => undefined);
+        return fail();
+    }
+    finally {
+        bytes?.fill(0);
+        await handle?.close().catch(() => undefined);
+    }
+};

package/dist/auth/credentialProvisioning.d.ts

@@ -0,0 +1,15 @@
+import { type CredentialProvisioningReceipt } from "./credentialProvisioningReceipt.js";
+import type { CredentialProvisioningRequest } from "./credentialProvisioningRequest.js";
+import type { TargetSecretSourceLifecycle } from "./targetSecretSourceLifecycle.js";
+export type ProvisionedCredentialMaterials = Map<string, Uint8Array>;
+export type CredentialProvisioningEntropy = (bytes: number) => Uint8Array;
+export interface CredentialProvisioningOptions {
+    readonly entropy?: CredentialProvisioningEntropy;
+    readonly lifecycle?: Pick<TargetSecretSourceLifecycle, "author" | "grant">;
+}
+export type ProvisionedCredentials = Readonly<{
+    materials: ProvisionedCredentialMaterials;
+    receipt: CredentialProvisioningReceipt;
+}>;
+export declare const disposeProvisionedMaterials: (materials: ProvisionedCredentialMaterials) => void;
+export declare const provisionCredentials: (request: CredentialProvisioningRequest, options?: CredentialProvisioningOptions) => Promise<ProvisionedCredentials>;

package/dist/auth/credentialProvisioning.js

@@ -0,0 +1,75 @@
+import { Buffer } from "node:buffer";
+import { randomBytes } from "node:crypto";
+import { createCredentialProvisioningReceipt } from "./credentialProvisioningReceipt.js";
+import { TARGET_SECRET_SOURCE_ERROR, createCanonicalTargetSecretSourceJson } from "./targetSecretSourceRecordCommon.js";
+const fail = () => { throw new Error(TARGET_SECRET_SOURCE_ERROR); };
+const defaultEntropy = (size) => {
+    const bytes = randomBytes(size);
+    try {
+        return Uint8Array.from(bytes);
+    }
+    finally {
+        bytes.fill(0);
+    }
+};
+const generatedToken = (size, entropy) => {
+    let raw;
+    let encoded;
+    try {
+        raw = entropy(size);
+        if (!(raw instanceof Uint8Array) || raw.length !== size)
+            fail();
+        encoded = Buffer.from(raw);
+        return new TextEncoder().encode(encoded.toString("hex"));
+    }
+    finally {
+        encoded?.fill(0);
+        raw?.fill(0);
+    }
+};
+export const disposeProvisionedMaterials = (materials) => {
+    for (const material of materials.values())
+        material.fill(0);
+    materials.clear();
+};
+export const provisionCredentials = async (request, options = {}) => {
+    const materials = new Map();
+    try {
+        const lifecycle = options.lifecycle
+            ?? await (await import("./targetSecretSourceLifecycle.js")).initializeTargetSecretSourceLifecycle();
+        const entropy = options.entropy ?? defaultEntropy;
+        for (const credential of request.credentials) {
+            const material = credential.kind === "generated-token"
+                ? generatedToken(credential.bytes, entropy)
+                : createCanonicalTargetSecretSourceJson(credential.content);
+            materials.set(credential.name, material);
+        }
+        const sources = new Map();
+        for (const credential of request.credentials) {
+            const material = materials.get(credential.name) ?? fail();
+            const authored = await lifecycle.author(material);
+            sources.set(credential.name, authored.source_handle);
+        }
+        for (const credential of request.credentials) {
+            const sourceHandle = sources.get(credential.name);
+            const granted = await lifecycle.grant({
+                descriptor_digest: request.descriptor_digest,
+                name: credential.name,
+                run_id: request.run_id,
+                scope: request.scope,
+                selected_target: request.selected_target,
+                source_handle: sourceHandle
+            });
+            if (granted.source_handle !== sourceHandle)
+                fail();
+        }
+        return Object.freeze({
+            materials,
+            receipt: createCredentialProvisioningReceipt({ request, source_handles: sources })
+        });
+    }
+    catch {
+        disposeProvisionedMaterials(materials);
+        return fail();
+    }
+};

package/dist/auth/credentialProvisioningReceipt.d.ts

@@ -0,0 +1,28 @@
+import type { CredentialProvisioningRequest } from "./credentialProvisioningRequest.js";
+import { type OpaqueTargetSecretSourceHandle } from "./targetSecretSourceRecordCommon.js";
+export declare const CREDENTIAL_PROVISIONING_RECEIPT_VERSION: "spawnfile.auth.credential-provisioning.receipt.v1";
+export type CredentialProvisioningPhase = "author" | "grant" | "model_engine_auth" | "env_file" | "world_bindings";
+export type CredentialProvisioningReceiptCredential = Readonly<{
+    env: string;
+    name: string;
+    scope: string;
+    source_handle: OpaqueTargetSecretSourceHandle;
+}>;
+export type CredentialProvisioningReceipt = Readonly<{
+    credentials: readonly CredentialProvisioningReceiptCredential[];
+    env_file_digest?: string;
+    phases: readonly CredentialProvisioningPhase[];
+    run_id: string;
+    scope: string;
+    version: typeof CREDENTIAL_PROVISIONING_RECEIPT_VERSION;
+    world_bindings_digest?: string;
+}>;
+export declare const createCredentialProvisioningReceipt: (input: Readonly<{
+    request: CredentialProvisioningRequest;
+    source_handles: ReadonlyMap<string, unknown>;
+}>) => CredentialProvisioningReceipt;
+export declare const finalizeCredentialProvisioningReceipt: (receipt: CredentialProvisioningReceipt, outputs: Readonly<{
+    env_file_digest?: string;
+    model_engine_auth?: boolean;
+    world_bindings_digest?: string;
+}>) => CredentialProvisioningReceipt;

package/dist/auth/credentialProvisioningReceipt.js

@@ -0,0 +1,70 @@
+import { TARGET_SECRET_SOURCE_ERROR, parseTargetSecretSourceOpaqueHandle } from "./targetSecretSourceRecordCommon.js";
+export const CREDENTIAL_PROVISIONING_RECEIPT_VERSION = "spawnfile.auth.credential-provisioning.receipt.v1";
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+const fail = () => { throw new Error(TARGET_SECRET_SOURCE_ERROR); };
+const digest = (raw) => typeof raw === "string" && DIGEST.test(raw) ? raw : fail();
+export const createCredentialProvisioningReceipt = (input) => {
+    try {
+        const credentials = input.request.credentials.map((credential) => {
+            const sourceHandle = input.source_handles.get(credential.name);
+            return Object.freeze({
+                env: credential.env,
+                name: credential.name,
+                scope: input.request.scope,
+                source_handle: parseTargetSecretSourceOpaqueHandle(sourceHandle)
+            });
+        });
+        if (input.source_handles.size !== credentials.length)
+            fail();
+        return Object.freeze({
+            credentials: Object.freeze(credentials),
+            phases: Object.freeze(["author", "grant"]),
+            run_id: input.request.run_id,
+            scope: input.request.scope,
+            version: CREDENTIAL_PROVISIONING_RECEIPT_VERSION
+        });
+    }
+    catch {
+        return fail();
+    }
+};
+export const finalizeCredentialProvisioningReceipt = (receipt, outputs) => {
+    try {
+        if (receipt.version !== CREDENTIAL_PROVISIONING_RECEIPT_VERSION
+            || receipt.phases.length !== 2
+            || receipt.phases[0] !== "author"
+            || receipt.phases[1] !== "grant")
+            fail();
+        const credentials = receipt.credentials.map((credential) => Object.freeze({
+            env: credential.env,
+            name: credential.name,
+            scope: credential.scope,
+            source_handle: parseTargetSecretSourceOpaqueHandle(credential.source_handle)
+        }));
+        const envFileDigest = outputs.env_file_digest === undefined
+            ? undefined
+            : digest(outputs.env_file_digest);
+        const worldBindingsDigest = outputs.world_bindings_digest === undefined
+            ? undefined
+            : digest(outputs.world_bindings_digest);
+        const phases = ["author", "grant"];
+        if (outputs.model_engine_auth === true)
+            phases.push("model_engine_auth");
+        if (envFileDigest !== undefined)
+            phases.push("env_file");
+        if (worldBindingsDigest !== undefined)
+            phases.push("world_bindings");
+        return Object.freeze({
+            credentials: Object.freeze(credentials),
+            ...(envFileDigest === undefined ? {} : { env_file_digest: envFileDigest }),
+            phases: Object.freeze(phases),
+            run_id: receipt.run_id,
+            scope: receipt.scope,
+            version: CREDENTIAL_PROVISIONING_RECEIPT_VERSION,
+            ...(worldBindingsDigest === undefined ? {} : { world_bindings_digest: worldBindingsDigest })
+        });
+    }
+    catch {
+        return fail();
+    }
+};

package/dist/auth/credentialProvisioningRequest.d.ts

@@ -0,0 +1,51 @@
+import { type SelectedTargetReceipt } from "../target/contracts.js";
+export declare const CREDENTIAL_PROVISIONING_REQUEST_VERSION: "spawnfile.auth.credential-provisioning.request.v1";
+export declare const MAX_CREDENTIAL_PROVISIONING_REQUEST_BYTES = 65536;
+export type GeneratedTokenCredentialRequest = Readonly<{
+    bytes: number;
+    env: string;
+    kind: "generated-token";
+    name: string;
+}>;
+/**
+ * `derived-config.content` is DECLARATIVE, non-secret configuration that the caller
+ * authored into the request by design — it is stored as a target secret for uniform
+ * handling, but it is not minted material and its presence in the caller's own request
+ * file is not a leak.
+ */
+export type DerivedConfigCredentialRequest = Readonly<{
+    content: unknown;
+    env: string;
+    kind: "derived-config";
+    name: string;
+}>;
+export type CredentialProvisioningCredentialRequest = GeneratedTokenCredentialRequest | DerivedConfigCredentialRequest;
+export type CredentialProvisioningWorldMember = Readonly<{
+    id: string;
+    principal_id: string;
+    token_credential_name: string;
+}>;
+export type CredentialProvisioningWorldBindings = Readonly<{
+    json_url: string;
+    mcp_url: string;
+    members: readonly CredentialProvisioningWorldMember[];
+    world_instance_id: string;
+}>;
+export type CredentialProvisioningModelEngineAuth = Readonly<{
+    from?: string;
+    kind: "codex";
+    profile: string;
+}>;
+export type CredentialProvisioningRequest = Readonly<{
+    credentials: readonly CredentialProvisioningCredentialRequest[];
+    descriptor_digest: string;
+    model_engine_auth?: CredentialProvisioningModelEngineAuth;
+    run_id: string;
+    scope: string;
+    selected_target: SelectedTargetReceipt;
+    version: typeof CREDENTIAL_PROVISIONING_REQUEST_VERSION;
+    world_bindings?: CredentialProvisioningWorldBindings;
+}>;
+export declare const parseCredentialProvisioningRequest: (raw: unknown) => CredentialProvisioningRequest;
+export declare const parseCredentialProvisioningRequestBytes: (raw: Uint8Array) => CredentialProvisioningRequest;
+export declare const readCredentialProvisioningRequestFile: (filePath: string) => Promise<CredentialProvisioningRequest>;

package/dist/auth/credentialProvisioningRequest.js

@@ -0,0 +1,169 @@
+import { Buffer } from "node:buffer";
+import { open } from "node:fs/promises";
+import { parseRunId, parseSelectedTargetReceipt } from "../target/contracts.js";
+import { TARGET_SECRET_SOURCE_ERROR, assertOrdinaryJsonGraph } from "./targetSecretSourceRecordCommon.js";
+export const CREDENTIAL_PROVISIONING_REQUEST_VERSION = "spawnfile.auth.credential-provisioning.request.v1";
+export const MAX_CREDENTIAL_PROVISIONING_REQUEST_BYTES = 65_536;
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+const ENV = /^[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+$/u;
+const FORBIDDEN_KEYS = new Set(["bearer", "material", "password", "secret", "token", "value"]);
+const fail = () => { throw new Error(TARGET_SECRET_SOURCE_ERROR); };
+const normalize = (work) => {
+    try {
+        return work();
+    }
+    catch {
+        return fail();
+    }
+};
+const exact = (raw, required, optional = []) => {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        return fail();
+    const record = raw;
+    const keys = Object.keys(record);
+    const allowed = new Set([...required, ...optional]);
+    if (keys.some((key) => !allowed.has(key)) || required.some((key) => !Object.hasOwn(record, key)))
+        fail();
+    return record;
+};
+const string = (raw) => typeof raw === "string" && raw.length > 0 ? raw : fail();
+const nonEmptyArray = (raw) => Array.isArray(raw) && raw.length > 0 ? raw : fail();
+const generatedByteCount = (raw) => typeof raw === "number"
+    && Number.isInteger(raw)
+    && raw >= 16
+    && raw <= 128
+    ? raw
+    : fail();
+const descriptorDigest = (raw) => typeof raw === "string" && DIGEST.test(raw) ? raw : fail();
+const rejectForbiddenKeys = (raw) => {
+    const pending = [raw];
+    while (pending.length > 0) {
+        const value = pending.pop();
+        if (value === null || typeof value !== "object")
+            continue;
+        if (Array.isArray(value)) {
+            pending.push(...value);
+            continue;
+        }
+        for (const [key, nested] of Object.entries(value)) {
+            if (FORBIDDEN_KEYS.has(key.toLowerCase()))
+                fail();
+            pending.push(nested);
+        }
+    }
+};
+const parseCredential = (raw) => {
+    const base = exact(raw, ["env", "kind", "name"], ["bytes", "content"]);
+    const name = string(base.name);
+    const env = string(base.env);
+    if (!ENV.test(env))
+        fail();
+    if (base.kind === "generated-token") {
+        const record = exact(raw, ["bytes", "env", "kind", "name"]);
+        const bytes = generatedByteCount(record.bytes);
+        return Object.freeze({ bytes, env, kind: "generated-token", name });
+    }
+    if (base.kind === "derived-config") {
+        const record = exact(raw, ["content", "env", "kind", "name"]);
+        assertOrdinaryJsonGraph(record.content);
+        return Object.freeze({ content: structuredClone(record.content), env, kind: "derived-config", name });
+    }
+    return fail();
+};
+const parseWorldBindings = (raw) => {
+    const record = exact(raw, ["json_url", "mcp_url", "members", "world_instance_id"]);
+    const rawMembers = nonEmptyArray(record.members);
+    const members = rawMembers.map((entry) => {
+        const member = exact(entry, ["id", "principal_id", "token_credential_name"]);
+        return Object.freeze({
+            id: string(member.id),
+            principal_id: string(member.principal_id),
+            token_credential_name: string(member.token_credential_name)
+        });
+    });
+    return Object.freeze({
+        json_url: string(record.json_url),
+        mcp_url: string(record.mcp_url),
+        members: Object.freeze(members),
+        world_instance_id: string(record.world_instance_id)
+    });
+};
+const parseModelEngineAuth = (raw) => {
+    const record = exact(raw, ["kind", "profile"], ["from"]);
+    if (record.kind !== "codex")
+        fail();
+    const from = record.from === undefined ? undefined : string(record.from);
+    return Object.freeze({
+        ...(from === undefined ? {} : { from }),
+        kind: "codex",
+        profile: string(record.profile)
+    });
+};
+export const parseCredentialProvisioningRequest = (raw) => normalize(() => {
+    assertOrdinaryJsonGraph(raw);
+    rejectForbiddenKeys(raw);
+    const record = exact(raw, ["credentials", "descriptor_digest", "run_id", "scope", "selected_target", "version"], ["model_engine_auth", "world_bindings"]);
+    if (record.version !== CREDENTIAL_PROVISIONING_REQUEST_VERSION)
+        fail();
+    const parsedDescriptorDigest = descriptorDigest(record.descriptor_digest);
+    const rawCredentials = nonEmptyArray(record.credentials);
+    const credentials = rawCredentials.map(parseCredential);
+    if (new Set(credentials.map(({ name }) => name)).size !== credentials.length
+        || new Set(credentials.map(({ env }) => env)).size !== credentials.length)
+        fail();
+    const worldBindings = record.world_bindings === undefined
+        ? undefined
+        : parseWorldBindings(record.world_bindings);
+    if (worldBindings) {
+        const names = new Set(credentials.map(({ name }) => name));
+        if (worldBindings.members.some(({ token_credential_name: name }) => !names.has(name)))
+            fail();
+    }
+    const modelEngineAuth = record.model_engine_auth === undefined
+        ? undefined
+        : parseModelEngineAuth(record.model_engine_auth);
+    return Object.freeze({
+        credentials: Object.freeze(credentials),
+        descriptor_digest: parsedDescriptorDigest,
+        ...(modelEngineAuth === undefined ? {} : { model_engine_auth: modelEngineAuth }),
+        run_id: parseRunId(record.run_id),
+        scope: string(record.scope),
+        selected_target: parseSelectedTargetReceipt(record.selected_target),
+        version: CREDENTIAL_PROVISIONING_REQUEST_VERSION,
+        ...(worldBindings === undefined ? {} : { world_bindings: worldBindings })
+    });
+});
+export const parseCredentialProvisioningRequestBytes = (raw) => normalize(() => {
+    if (!(raw instanceof Uint8Array) || raw.length < 1 || raw.length > MAX_CREDENTIAL_PROVISIONING_REQUEST_BYTES)
+        fail();
+    const text = new TextDecoder("utf-8", { fatal: true }).decode(raw);
+    return parseCredentialProvisioningRequest(JSON.parse(text));
+});
+export const readCredentialProvisioningRequestFile = async (filePath) => {
+    let bytes;
+    let handle;
+    try {
+        handle = await open(filePath, "r");
+        const info = await handle.stat();
+        if (!info.isFile() || info.size < 1 || info.size > MAX_CREDENTIAL_PROVISIONING_REQUEST_BYTES)
+            fail();
+        bytes = Buffer.alloc(info.size + 1);
+        let offset = 0;
+        while (offset < bytes.length) {
+            const result = await handle.read(bytes, offset, bytes.length - offset, offset);
+            if (result.bytesRead === 0)
+                break;
+            offset += result.bytesRead;
+        }
+        if (offset !== info.size)
+            fail();
+        return parseCredentialProvisioningRequestBytes(bytes.subarray(0, offset));
+    }
+    catch {
+        return fail();
+    }
+    finally {
+        bytes?.fill(0);
+        await handle?.close().catch(() => undefined);
+    }
+};

package/dist/auth/credentialWorldBindings.d.ts

@@ -0,0 +1,21 @@
+import { type SimfileWorldBindingsV1 } from "../compiler/worldBindings.js";
+import type { CredentialProvisioningReceipt } from "./credentialProvisioningReceipt.js";
+import type { CredentialProvisioningRequest } from "./credentialProvisioningRequest.js";
+export declare const RESOLVED_WORLD_GRANTS_VERSION: "spawnfile.auth.resolved-world-grants.v1";
+export type ResolvedWorldGrant = Readonly<{
+    capability_manifest: unknown;
+    member_id: string;
+    principal_id: string;
+}>;
+export type ResolvedWorldGrants = Readonly<{
+    grants: readonly ResolvedWorldGrant[];
+    run_id: string;
+    version: typeof RESOLVED_WORLD_GRANTS_VERSION;
+    world_instance_id: string;
+}>;
+export declare const parseResolvedWorldGrants: (raw: unknown) => ResolvedWorldGrants;
+export declare const buildProvisionedWorldBindings: (input: Readonly<{
+    receipt: CredentialProvisioningReceipt;
+    request: CredentialProvisioningRequest;
+    resolved: unknown;
+}>) => SimfileWorldBindingsV1;

package/dist/auth/credentialWorldBindings.js

@@ -0,0 +1,104 @@
+import { createHash } from "node:crypto";
+import { SIMFILE_WORLD_BINDINGS_VERSION, parseSimfileWorldBindings } from "../compiler/worldBindings.js";
+import { TARGET_SECRET_SOURCE_ERROR, assertOrdinaryJsonGraph, createCanonicalTargetSecretSourceJson } from "./targetSecretSourceRecordCommon.js";
+export const RESOLVED_WORLD_GRANTS_VERSION = "spawnfile.auth.resolved-world-grants.v1";
+const fail = () => { throw new Error(TARGET_SECRET_SOURCE_ERROR); };
+const exact = (raw, keys) => {
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        return fail();
+    const record = raw;
+    const actual = Object.keys(record).sort();
+    const expected = [...keys].sort();
+    if (actual.length !== expected.length || actual.some((key, index) => key !== expected[index]))
+        fail();
+    return record;
+};
+const string = (raw) => typeof raw === "string" && raw.length > 0 ? raw : fail();
+const nonEmptyArray = (raw) => Array.isArray(raw) && raw.length > 0 ? raw : fail();
+export const parseResolvedWorldGrants = (raw) => {
+    try {
+        assertOrdinaryJsonGraph(raw);
+        const record = exact(raw, ["grants", "run_id", "version", "world_instance_id"]);
+        if (record.version !== RESOLVED_WORLD_GRANTS_VERSION)
+            fail();
+        const rawGrants = nonEmptyArray(record.grants);
+        const grants = rawGrants.map((rawGrant) => {
+            const grant = exact(rawGrant, ["capability_manifest", "member_id", "principal_id"]);
+            assertOrdinaryJsonGraph(grant.capability_manifest);
+            return Object.freeze({
+                capability_manifest: structuredClone(grant.capability_manifest),
+                member_id: string(grant.member_id),
+                principal_id: string(grant.principal_id)
+            });
+        });
+        return Object.freeze({
+            grants: Object.freeze(grants),
+            run_id: string(record.run_id),
+            version: RESOLVED_WORLD_GRANTS_VERSION,
+            world_instance_id: string(record.world_instance_id)
+        });
+    }
+    catch {
+        return fail();
+    }
+};
+export const buildProvisionedWorldBindings = (input) => {
+    try {
+        const world = input.request.world_bindings ?? fail();
+        if (input.receipt.run_id !== input.request.run_id
+            || input.receipt.scope !== input.request.scope)
+            fail();
+        const resolved = parseResolvedWorldGrants(input.resolved);
+        if (resolved.run_id !== input.request.run_id
+            || resolved.world_instance_id !== world.world_instance_id
+            || resolved.grants.length !== world.members.length)
+            fail();
+        const declared = new Map(world.members.map((member) => [member.id, member]));
+        if (declared.size !== world.members.length)
+            fail();
+        const receiptByName = new Map(input.receipt.credentials.map((credential) => [credential.name, credential]));
+        const digests = new Set();
+        const bindings = resolved.grants.map((grant) => {
+            const member = declared.get(grant.member_id) ?? fail();
+            if (member.principal_id !== grant.principal_id)
+                fail();
+            const credential = receiptByName.get(member.token_credential_name) ?? fail();
+            const requestedCredential = input.request.credentials.find(({ name }) => name === member.token_credential_name) ?? fail();
+            if (credential.env !== requestedCredential.env)
+                fail();
+            let canonical;
+            try {
+                canonical = createCanonicalTargetSecretSourceJson(grant.capability_manifest);
+                const capabilityDigest = `sha256:${createHash("sha256").update(canonical).digest("hex")}`;
+                if (digests.has(capabilityDigest))
+                    fail();
+                digests.add(capabilityDigest);
+                return {
+                    capability_manifest_digest: capabilityDigest,
+                    json: { auth: "bearer", url: world.json_url },
+                    mcp: {
+                        auth: "bearer",
+                        transport: "streamable_http",
+                        url: world.mcp_url
+                    },
+                    member: { id: member.id, principal_id: member.principal_id },
+                    run_id: input.request.run_id,
+                    token_env: credential.env,
+                    world_instance_id: world.world_instance_id
+                };
+            }
+            finally {
+                canonical?.fill(0);
+            }
+        });
+        if (bindings.length !== declared.size)
+            fail();
+        return parseSimfileWorldBindings({
+            bindings,
+            schema: SIMFILE_WORLD_BINDINGS_VERSION
+        });
+    }
+    catch {
+        return fail();
+    }
+};