spawnfile 0.1.13 → 0.1.17

package/dist/auth/importers.d.ts

@@ -4,5 +4,15 @@ interface ClaudeCodeImportOptions {
 export declare const parseEnvFile: (content: string) => Record<string, string>;
 export declare const importEnvFile: (profileName: string, envFilePath: string) => Promise<import("./types.js").ResolvedAuthProfile>;
 export declare const importCodexAuth: (profileName: string, sourceDirectory?: string) => Promise<import("./types.js").ResolvedAuthProfile>;
+/**
+ * Imports a **dedicated** Grok login into a profile.
+ *
+ * Unlike Codex, the source is always explicit: training rotates the credential
+ * it is given, so defaulting to `~/.grok` would let a routine training run
+ * invalidate the developer's own desktop session, and the refreshed token
+ * would land on container tmpfs rather than back in `~/.grok` (D2). The
+ * desktop home is refused outright, by resolved path and through `GROK_HOME`.
+ */
+export declare const importGrokAuth: (profileName: string, sourceDirectory: string | undefined) => Promise<import("./types.js").ResolvedAuthProfile>;
 export declare const importClaudeCodeAuth: (profileName: string, sourceDirectory?: string, options?: ClaudeCodeImportOptions) => Promise<import("./types.js").ResolvedAuthProfile>;
 export {};

package/dist/auth/importers.js

@@ -1,6 +1,6 @@
 import path from "node:path";
 import os from "node:os";
-import { ensureDirectory, fileExists, readUtf8File, writeUtf8File } from "../filesystem/index.js";
+import { fileExists, readUtf8File, writePrivateUtf8File } from "../filesystem/index.js";
 import { SpawnfileError } from "../shared/index.js";
 import { registerImportedAuth, setAuthProfileEnv } from "./profileStore.js";
 const ENV_LINE_PATTERN = /^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)\s*$/;
@@ -67,7 +67,33 @@ export const importCodexAuth = async (profileName, sourceDirectory) => {
         throw new SpawnfileError("validation_error", `Codex auth file does not exist: ${authFilePath}`);
     }
     const { directory, profile } = await registerImportedAuth(profileName, "codex");
-    await writeUtf8File(path.join(directory, "auth.json"), await readUtf8File(authFilePath));
+    await writePrivateUtf8File(path.join(directory, "auth.json"), await readUtf8File(authFilePath));
+    return profile;
+};
+/**
+ * Imports a **dedicated** Grok login into a profile.
+ *
+ * Unlike Codex, the source is always explicit: training rotates the credential
+ * it is given, so defaulting to `~/.grok` would let a routine training run
+ * invalidate the developer's own desktop session, and the refreshed token
+ * would land on container tmpfs rather than back in `~/.grok` (D2). The
+ * desktop home is refused outright, by resolved path and through `GROK_HOME`.
+ */
+export const importGrokAuth = async (profileName, sourceDirectory) => {
+    if (!sourceDirectory) {
+        throw new SpawnfileError("validation_error", "Grok import requires --from <directory> holding a dedicated training login; training never uses the desktop ~/.grok");
+    }
+    const resolvedSource = path.resolve(sourceDirectory);
+    const desktop = path.resolve(process.env.GROK_HOME ?? path.join(os.homedir(), ".grok"));
+    if (resolvedSource === desktop || resolvedSource === path.join(os.homedir(), ".grok")) {
+        throw new SpawnfileError("validation_error", `Refusing the desktop Grok home ${resolvedSource}; a training run rotates the credential it imports`);
+    }
+    const authFilePath = path.join(resolvedSource, "auth.json");
+    if (!(await fileExists(authFilePath))) {
+        throw new SpawnfileError("validation_error", `Grok auth file does not exist: ${authFilePath}`);
+    }
+    const { directory, profile } = await registerImportedAuth(profileName, "grok");
+    await writePrivateUtf8File(path.join(directory, "auth.json"), await readUtf8File(authFilePath));
     return profile;
 };
 export const importClaudeCodeAuth = async (profileName, sourceDirectory, options = {}) => {
@@ -87,7 +113,6 @@ export const importClaudeCodeAuth = async (profileName, sourceDirectory, options
         throw new SpawnfileError("validation_error", `Claude Code credentials file does not exist: ${credentialsPath} and macOS Keychain service ${CLAUDE_CODE_KEYCHAIN_SERVICE} was unavailable`);
     }
     const { directory, profile } = await registerImportedAuth(profileName, "claude-code");
-    await ensureDirectory(directory);
-    await writeUtf8File(path.join(directory, ".credentials.json"), credentialsContent);
+    await writePrivateUtf8File(path.join(directory, ".credentials.json"), credentialsContent);
     return profile;
 };

package/dist/auth/index.d.ts

@@ -3,3 +3,12 @@ export * from "./paths.js";
 export * from "./profileStore.js";
 export * from "./runtimeCredentials.js";
 export * from "./types.js";
+export * from "./credentialEnvFile.js";
+export * from "./credentialProvisioning.js";
+export * from "./credentialProvisioningReceipt.js";
+export * from "./credentialProvisioningRequest.js";
+export * from "./credentialWorldBindings.js";
+export * from "./targetSecretSourceLifecycle.js";
+export * from "./targetSecretSourceResolver.js";
+export { stageTrainingAuth } from "./trainingAuth.js";
+export type { TrainingAuthStageOptions, TrainingAuthProvider } from "./trainingAuth.js";

package/dist/auth/index.js

@@ -3,3 +3,11 @@ export * from "./paths.js";
 export * from "./profileStore.js";
 export * from "./runtimeCredentials.js";
 export * from "./types.js";
+export * from "./credentialEnvFile.js";
+export * from "./credentialProvisioning.js";
+export * from "./credentialProvisioningReceipt.js";
+export * from "./credentialProvisioningRequest.js";
+export * from "./credentialWorldBindings.js";
+export * from "./targetSecretSourceLifecycle.js";
+export * from "./targetSecretSourceResolver.js";
+export { stageTrainingAuth } from "./trainingAuth.js";

package/dist/auth/paths.d.ts

@@ -3,4 +3,15 @@ export declare const resolveAuthHome: () => string;
 export declare const resolveProfilesRoot: () => string;
 export declare const resolveProfileDirectory: (profileName: string) => string;
 export declare const resolveProfilePath: (profileName: string) => string;
-export declare const resolveImportedAuthDirectory: (profileName: string, kind: "claude-code" | "codex") => string;
+export declare const resolveImportedAuthDirectory: (profileName: string, kind: "claude-code" | "codex" | "grok") => string;
+export declare const resolveTargetSecretsRoot: () => string;
+export declare const resolveTargetSecretVersionsDirectory: () => string;
+export declare const resolveTargetSecretVersionPath: (versionKey: string) => string;
+export declare const resolveTargetSecretGrantsDirectory: () => string;
+export declare const resolveTargetSecretGrantPath: (grantKey: string) => string;
+export declare const resolveTargetSecretRedemptionsDirectory: () => string;
+export declare const resolveTargetSecretRedemptionPath: (redemptionKey: string) => string;
+export declare const resolveTargetSecretRevocationsDirectory: () => string;
+export declare const resolveTargetSecretRevocationPath: (revocationKey: string) => string;
+export declare const resolveTargetSecretAliasesDirectory: () => string;
+export declare const resolveTargetSecretAliasPath: (aliasKey: string) => string;

package/dist/auth/paths.js

@@ -1,6 +1,16 @@
 import os from "node:os";
 import path from "node:path";
 const DEFAULT_SPAWNFILE_HOME = "~/.spawnfile";
+const OPAQUE_TARGET_SECRET_HANDLE_PATTERN = /^opaque_[a-z0-9]{16,64}$/u;
+const assertCanonicalTargetSecretKey = (targetSecretKey) => {
+    if (!OPAQUE_TARGET_SECRET_HANDLE_PATTERN.test(targetSecretKey)) {
+        throw new Error("Invalid target-secret path key");
+    }
+};
+const resolveTargetSecretLeafPath = (leafDirectory, targetSecretKey) => {
+    assertCanonicalTargetSecretKey(targetSecretKey);
+    return path.join(leafDirectory, targetSecretKey);
+};
 const expandHomePath = (inputPath) => {
     if (inputPath === "~") {
         return os.homedir();
@@ -16,3 +26,14 @@ export const resolveProfilesRoot = () => path.join(resolveAuthHome(), "profiles"
 export const resolveProfileDirectory = (profileName) => path.join(resolveProfilesRoot(), profileName);
 export const resolveProfilePath = (profileName) => path.join(resolveProfileDirectory(profileName), "profile.json");
 export const resolveImportedAuthDirectory = (profileName, kind) => path.join(resolveProfileDirectory(profileName), "imports", kind);
+export const resolveTargetSecretsRoot = () => path.join(resolveAuthHome(), "target-secrets");
+export const resolveTargetSecretVersionsDirectory = () => path.join(resolveTargetSecretsRoot(), "versions");
+export const resolveTargetSecretVersionPath = (versionKey) => resolveTargetSecretLeafPath(resolveTargetSecretVersionsDirectory(), versionKey);
+export const resolveTargetSecretGrantsDirectory = () => path.join(resolveTargetSecretsRoot(), "grants");
+export const resolveTargetSecretGrantPath = (grantKey) => resolveTargetSecretLeafPath(resolveTargetSecretGrantsDirectory(), grantKey);
+export const resolveTargetSecretRedemptionsDirectory = () => path.join(resolveTargetSecretsRoot(), "redemptions");
+export const resolveTargetSecretRedemptionPath = (redemptionKey) => resolveTargetSecretLeafPath(resolveTargetSecretRedemptionsDirectory(), redemptionKey);
+export const resolveTargetSecretRevocationsDirectory = () => path.join(resolveTargetSecretsRoot(), "revocations");
+export const resolveTargetSecretRevocationPath = (revocationKey) => resolveTargetSecretLeafPath(resolveTargetSecretRevocationsDirectory(), revocationKey);
+export const resolveTargetSecretAliasesDirectory = () => path.join(resolveTargetSecretsRoot(), "aliases");
+export const resolveTargetSecretAliasPath = (aliasKey) => resolveTargetSecretLeafPath(resolveTargetSecretAliasesDirectory(), aliasKey);

package/dist/auth/profileStore.js

@@ -1,8 +1,8 @@
 import path from "node:path";
 import { z } from "zod";
-import { ensureDirectory, fileExists, readUtf8File, removeDirectory, writeUtf8File } from "../filesystem/index.js";
+import { ensurePrivateDirectory, fileExists, readUtf8File, removeDirectory, writePrivateUtf8File } from "../filesystem/index.js";
 import { SpawnfileError } from "../shared/index.js";
-import { resolveAuthHome, resolveImportedAuthDirectory, resolveProfileDirectory, resolveProfilePath } from "./paths.js";
+import { resolveAuthHome, resolveImportedAuthDirectory, resolveProfileDirectory, resolveProfilePath, resolveProfilesRoot } from "./paths.js";
 const importedAuthEntrySchema = z.object({
     kind: z.enum(["claude-code", "codex"]),
     relativePath: z.string().min(1)
@@ -68,15 +68,14 @@ export const ensureAuthProfile = async (profileName) => {
     if (existing) {
         return existing;
     }
-    const profileDirectory = resolveProfileDirectory(profileName);
-    await ensureDirectory(profileDirectory);
-    await writeUtf8File(resolveProfilePath(profileName), `${JSON.stringify(createEmptyProfile(), null, 2)}\n`);
-    return createResolvedAuthProfile(profileName, createEmptyProfile());
+    return writeProfile(profileName, createEmptyProfile());
 };
 const writeProfile = async (profileName, profile) => {
     const profileDirectory = resolveProfileDirectory(profileName);
-    await ensureDirectory(profileDirectory);
-    await writeUtf8File(resolveProfilePath(profileName), `${JSON.stringify(profile, null, 2)}\n`);
+    await ensurePrivateDirectory(resolveAuthHome());
+    await ensurePrivateDirectory(resolveProfilesRoot());
+    await ensurePrivateDirectory(profileDirectory);
+    await writePrivateUtf8File(resolveProfilePath(profileName), `${JSON.stringify(profile, null, 2)}\n`);
     return createResolvedAuthProfile(profileName, profile);
 };
 export const setAuthProfileEnv = async (profileName, env) => {
@@ -99,8 +98,9 @@ export const setAuthProfileEnv = async (profileName, env) => {
 export const registerImportedAuth = async (profileName, kind) => {
     const current = (await loadAuthProfile(profileName)) ?? (await ensureAuthProfile(profileName));
     const importDirectory = resolveImportedAuthDirectory(profileName, kind);
+    await ensurePrivateDirectory(path.dirname(importDirectory));
     await removeDirectory(importDirectory);
-    await ensureDirectory(importDirectory);
+    await ensurePrivateDirectory(importDirectory);
     const nextProfile = {
         env: { ...current.env },
         imports: {

package/dist/auth/targetSecretSourceAuthor.d.ts

@@ -0,0 +1,18 @@
+import { type OpaqueTargetSecretSourceHandle } from "./targetSecretSourceRecordCommon.js";
+import { type TargetSecretSourceFsPublish } from "./targetSecretSourceFsPublish.js";
+import { type TargetSecretSourceRecordPublish } from "./targetSecretSourceRecordPublish.js";
+import { type TargetSecretSourceEntropy } from "./targetSecretSourceVersionRecords.js";
+export interface TargetSecretSourceAuthor {
+    authorVersion(secret: Uint8Array): Promise<Readonly<{
+        source_handle: OpaqueTargetSecretSourceHandle;
+    }>>;
+}
+export interface TargetSecretSourceAuthorOptions {
+    readonly aliasEntropy?: TargetSecretSourceEntropy;
+    readonly aliasPublicationEntropy?: TargetSecretSourceEntropy;
+    readonly recordPublisher?: Pick<TargetSecretSourceRecordPublish, "publishAlias">;
+    readonly versionEntropy?: TargetSecretSourceEntropy;
+    readonly versionPublicationEntropy?: TargetSecretSourceEntropy;
+    readonly versionPublisher?: Pick<TargetSecretSourceFsPublish, "publishVersion">;
+}
+export declare const initializeTargetSecretSourceAuthor: (options?: TargetSecretSourceAuthorOptions) => Promise<TargetSecretSourceAuthor>;

package/dist/auth/targetSecretSourceAuthor.js

@@ -0,0 +1,52 @@
+import { TARGET_SECRET_SOURCE_ERROR } from "./targetSecretSourceRecordCommon.js";
+import { initializeTargetSecretSourceFsPublish } from "./targetSecretSourceFsPublish.js";
+import { initializeTargetSecretSourceRecordPublish } from "./targetSecretSourceRecordPublish.js";
+import { createTargetSecretSourceAliasRecordBytes, createTargetSecretSourceVersionRecordBytes } from "./targetSecretSourceVersionRecords.js";
+const fail = () => { throw new Error(TARGET_SECRET_SOURCE_ERROR); };
+export const initializeTargetSecretSourceAuthor = async (options = {}) => {
+    // Both defaults establish and pin the same auth-owned directory hierarchy.
+    // Initialize them sequentially so a fresh home has no mkdir election race.
+    const versionPublisher = options.versionPublisher ?? await initializeTargetSecretSourceFsPublish();
+    const recordPublisher = options.recordPublisher ?? await initializeTargetSecretSourceRecordPublish();
+    return Object.freeze({
+        authorVersion: async (secret) => {
+            let workingSecret;
+            let versionBytes;
+            let aliasBytes;
+            try {
+                if (!(secret instanceof Uint8Array))
+                    fail();
+                workingSecret = Uint8Array.from(secret);
+                const version = createTargetSecretSourceVersionRecordBytes(workingSecret, {
+                    entropy: options.versionEntropy,
+                    publicationEntropy: options.versionPublicationEntropy
+                });
+                versionBytes = version.private_bytes;
+                const alias = createTargetSecretSourceAliasRecordBytes(version.metadata, {
+                    entropy: options.aliasEntropy,
+                    publicationEntropy: options.aliasPublicationEntropy
+                });
+                aliasBytes = alias.private_bytes;
+                if (alias.metadata.source_handle === version.private_metadata.publication_handle
+                    || alias.private_metadata.publication_handle === version.private_metadata.publication_handle)
+                    fail();
+                // Alias publication is the public commit point. A process interruption
+                // before it may leave only an unreachable immutable version record.
+                await versionPublisher.publishVersion({
+                    bytes: versionBytes,
+                    private_metadata: version.private_metadata
+                });
+                await recordPublisher.publishAlias(aliasBytes);
+                return Object.freeze({ source_handle: alias.metadata.source_handle });
+            }
+            catch {
+                return fail();
+            }
+            finally {
+                workingSecret?.fill(0);
+                versionBytes?.fill(0);
+                aliasBytes?.fill(0);
+            }
+        }
+    });
+};

package/dist/auth/targetSecretSourceFsIdentity.d.ts

@@ -0,0 +1,40 @@
+import { type BigIntStats } from "node:fs";
+export type DirectoryIdentity = Readonly<{
+    birthtimeNs: bigint;
+    dev: bigint;
+    ino: bigint;
+    mode: bigint;
+    uid: bigint;
+}>;
+export type FileIdentity = Readonly<{
+    birthtimeNs: bigint;
+    ctimeNs: bigint;
+    dev: bigint;
+    ino: bigint;
+    mode: bigint;
+    nlink: bigint;
+    size: number;
+    uid: bigint;
+}>;
+/** Validates one mode-`0700` owner-held directory and reduces it to its identity. */
+export declare const directoryIdentityOf: (info: BigIntStats, owner: number) => DirectoryIdentity;
+/** Validates one mode-`0600` owner-held regular file and reduces it to its identity. */
+export declare const fileIdentityOf: (info: BigIntStats, owner: number, links: readonly number[], maxBytes: number, zero?: boolean) => FileIdentity;
+/**
+ * Same directory node. Never compares ctime: the publisher mutates the leaf
+ * directory's ctime itself every time it links or unlinks an election name.
+ */
+export declare const sameDirectory: (left: DirectoryIdentity, right: DirectoryIdentity) => boolean;
+/** Same file, unchanged in every observable field including ctime and size. */
+export declare const sameFileExact: (left: FileIdentity, right: FileIdentity) => boolean;
+/**
+ * Same file node, allowing the size and ctime to move. This is the growing
+ * final: an identical writer may legitimately append the rest of the record
+ * between two observations, which changes both.
+ */
+export declare const sameFileNode: (left: FileIdentity, right: FileIdentity) => boolean;
+/**
+ * Same inode, allowing the link count and ctime to move. This is the zero-byte
+ * token or claim while an identical publisher links or unlinks the other name.
+ */
+export declare const sameFileInode: (left: FileIdentity, right: FileIdentity) => boolean;

package/dist/auth/targetSecretSourceFsIdentity.js

@@ -0,0 +1,42 @@
+import { TARGET_SECRET_SOURCE_ERROR } from "./targetSecretSourceRecordCommon.js";
+const fail = () => { throw new Error(TARGET_SECRET_SOURCE_ERROR); };
+/** Validates one mode-`0700` owner-held directory and reduces it to its identity. */
+export const directoryIdentityOf = (info, owner) => {
+    if (!info.isDirectory() || info.isSymbolicLink() || info.uid !== BigInt(owner) || (info.mode & 4095n) !== 448n)
+        fail();
+    return { birthtimeNs: info.birthtimeNs, dev: info.dev, ino: info.ino, mode: info.mode, uid: info.uid };
+};
+/** Validates one mode-`0600` owner-held regular file and reduces it to its identity. */
+export const fileIdentityOf = (info, owner, links, maxBytes, zero = false) => {
+    if (!info.isFile() || info.isSymbolicLink() || info.uid !== BigInt(owner)
+        || !links.some((link) => info.nlink === BigInt(link)) || (info.mode & 4095n) !== 384n
+        || info.size < 0n || info.size > BigInt(maxBytes) || (zero && info.size !== 0n))
+        fail();
+    return {
+        birthtimeNs: info.birthtimeNs, ctimeNs: info.ctimeNs, dev: info.dev, ino: info.ino,
+        mode: info.mode, nlink: info.nlink, size: Number(info.size), uid: info.uid
+    };
+};
+/**
+ * Same directory node. Never compares ctime: the publisher mutates the leaf
+ * directory's ctime itself every time it links or unlinks an election name.
+ */
+export const sameDirectory = (left, right) => left.birthtimeNs === right.birthtimeNs && left.dev === right.dev && left.ino === right.ino
+    && left.mode === right.mode && left.uid === right.uid;
+/** Same file, unchanged in every observable field including ctime and size. */
+export const sameFileExact = (left, right) => left.birthtimeNs === right.birthtimeNs && left.ctimeNs === right.ctimeNs && left.dev === right.dev
+    && left.ino === right.ino && left.mode === right.mode && left.nlink === right.nlink
+    && left.size === right.size && left.uid === right.uid;
+/**
+ * Same file node, allowing the size and ctime to move. This is the growing
+ * final: an identical writer may legitimately append the rest of the record
+ * between two observations, which changes both.
+ */
+export const sameFileNode = (left, right) => left.birthtimeNs === right.birthtimeNs && left.dev === right.dev && left.ino === right.ino
+    && left.mode === right.mode && left.nlink === right.nlink && left.uid === right.uid;
+/**
+ * Same inode, allowing the link count and ctime to move. This is the zero-byte
+ * token or claim while an identical publisher links or unlinks the other name.
+ */
+export const sameFileInode = (left, right) => left.birthtimeNs === right.birthtimeNs && left.dev === right.dev && left.ino === right.ino
+    && left.mode === right.mode && left.size === right.size && left.uid === right.uid;

package/dist/auth/targetSecretSourceFsPublish.d.ts

@@ -0,0 +1,17 @@
+import { type TargetSecretSourceFsPublishImmutablePhase } from "./targetSecretSourceFsPublishImmutable.js";
+import { type TargetSecretSourcePrivateVersionMetadata } from "./targetSecretSourceVersionRecords.js";
+export type TargetSecretSourceFsPublishPhase = TargetSecretSourceFsPublishImmutablePhase;
+export interface TargetSecretSourceFsPublishInput {
+    readonly bytes: Uint8Array;
+    readonly private_metadata: Pick<TargetSecretSourcePrivateVersionMetadata, "publication_handle" | "source_version_handle">;
+}
+export interface TargetSecretSourceFsPublishOptions {
+    readonly contentionForTest?: (reason: string, attempt: number) => void;
+    readonly errorForTest?: (error: unknown) => void;
+    readonly hookForTest?: (phase: TargetSecretSourceFsPublishPhase, path: string) => Promise<void> | void;
+    readonly maxWriteBytesForTest?: number;
+}
+export interface TargetSecretSourceFsPublish {
+    publishVersion(input: TargetSecretSourceFsPublishInput): Promise<void>;
+}
+export declare const initializeTargetSecretSourceFsPublish: (options?: TargetSecretSourceFsPublishOptions) => Promise<TargetSecretSourceFsPublish>;

package/dist/auth/targetSecretSourceFsPublish.js

@@ -0,0 +1,51 @@
+import { resolveAuthHome, resolveSpawnfileHome, resolveTargetSecretVersionPath, resolveTargetSecretVersionsDirectory, resolveTargetSecretsRoot } from "./paths.js";
+import { TARGET_SECRET_SOURCE_ERROR, parseTargetSecretSourceOpaqueHandle } from "./targetSecretSourceRecordCommon.js";
+import { initializeTargetSecretSourceFsPublishImmutable } from "./targetSecretSourceFsPublishImmutable.js";
+import { initializeTargetSecretSourceFsRead } from "./targetSecretSourceFsRead.js";
+import { parseTargetSecretSourceVersionRecordBytes } from "./targetSecretSourceVersionRecords.js";
+const fail = () => { throw new Error(TARGET_SECRET_SOURCE_ERROR); };
+export const initializeTargetSecretSourceFsPublish = async (options = {}) => {
+    await initializeTargetSecretSourceFsRead();
+    const publisher = await initializeTargetSecretSourceFsPublishImmutable({
+        directory_chain: [
+            resolveSpawnfileHome(),
+            resolveAuthHome(),
+            resolveTargetSecretsRoot(),
+            resolveTargetSecretVersionsDirectory()
+        ],
+        contentionForTest: options.contentionForTest,
+        hookForTest: options.hookForTest,
+        maxWriteBytesForTest: options.maxWriteBytesForTest
+    });
+    const publishVersion = async (input) => {
+        try {
+            if (!input || typeof input !== "object" || !(input.bytes instanceof Uint8Array)
+                || !input.private_metadata || typeof input.private_metadata !== "object")
+                fail();
+            const sourceVersionHandle = parseTargetSecretSourceOpaqueHandle(input.private_metadata.source_version_handle);
+            const publicationHandle = parseTargetSecretSourceOpaqueHandle(input.private_metadata.publication_handle);
+            if (sourceVersionHandle === publicationHandle)
+                fail();
+            await publisher.publishImmutable({
+                bytes: input.bytes,
+                final_path: resolveTargetSecretVersionPath(sourceVersionHandle),
+                publication_handle: publicationHandle,
+                proveExact: (bytes) => {
+                    const parsed = parseTargetSecretSourceVersionRecordBytes(bytes, sourceVersionHandle);
+                    try {
+                        if (parsed.publication_handle !== publicationHandle)
+                            fail();
+                    }
+                    finally {
+                        parsed.secret.fill(0);
+                    }
+                }
+            });
+        }
+        catch (error) {
+            options.errorForTest?.(error);
+            fail();
+        }
+    };
+    return Object.freeze({ publishVersion });
+};

package/dist/auth/targetSecretSourceFsPublishImmutable.d.ts

@@ -0,0 +1,17 @@
+export type TargetSecretSourceFsPublishImmutablePhase = "after_token_create" | "after_claim_link" | "after_claim_snapshot" | "after_mismatch_snapshot" | "after_exact_token_snapshot" | "after_final_create" | "after_partial_write" | "after_file_sync" | "before_directory_sync" | "after_directory_sync" | "after_token_cleanup" | "after_claim_cleanup" | "after_zero_lstat" | "after_final_lstat" | "after_token_open" | "after_token_sync" | "after_final_open" | "before_unlink_exact" | "before_contention_retry";
+export interface TargetSecretSourceFsPublishImmutableInput {
+    readonly bytes: Uint8Array;
+    readonly final_path: string;
+    readonly publication_handle: string;
+    readonly proveExact: (bytes: Uint8Array) => Promise<void> | void;
+}
+export interface TargetSecretSourceFsPublishImmutableOptions {
+    readonly directory_chain: readonly string[];
+    readonly contentionForTest?: (reason: string, attempt: number) => void;
+    readonly hookForTest?: (phase: TargetSecretSourceFsPublishImmutablePhase, path: string) => Promise<void> | void;
+    readonly maxWriteBytesForTest?: number;
+}
+export interface TargetSecretSourceFsPublishImmutable {
+    publishImmutable(input: TargetSecretSourceFsPublishImmutableInput): Promise<void>;
+}
+export declare const initializeTargetSecretSourceFsPublishImmutable: (options: TargetSecretSourceFsPublishImmutableOptions) => Promise<TargetSecretSourceFsPublishImmutable>;