@caracalai/core 0.1.2 → 0.1.3-rc.1

package/dist/async.d.ts

@@ -0,0 +1,2 @@
+export declare function withTimeout<T>(task: Promise<T>, timeoutMs: number, message: string): Promise<T>;
+//# sourceMappingURL=async.d.ts.map

package/dist/async.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"async.d.ts","sourceRoot":"","sources":["../src/async.ts"],"names":[],"mappings":"AASA,wBAAsB,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAerG"}

package/dist/async.js

@@ -0,0 +1,27 @@
+// Copyright (C) 2026 Garudex Labs.  All Rights Reserved.
+// Caracal, a product of Garudex Labs
+//
+// Async control helpers for bounded runtime operations.
+// Rejects with `message` after `timeoutMs` if `task` has not settled.
+// The underlying `task` is not cancelled and may continue running; its
+// later resolution/rejection is discarded. Pass only idempotent reads
+// (e.g. SELECT 1, PING) or operations whose stray completion is safe.
+export async function withTimeout(task, timeoutMs, message) {
+    let timeout;
+    try {
+        return await Promise.race([
+            task,
+            new Promise((_resolve, reject) => {
+                timeout = setTimeout(() => {
+                    reject(new Error(message));
+                }, timeoutMs);
+                timeout.unref();
+            }),
+        ]);
+    }
+    finally {
+        if (timeout)
+            clearTimeout(timeout);
+    }
+}
+//# sourceMappingURL=async.js.map

package/dist/async.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"async.js","sourceRoot":"","sources":["../src/async.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,wDAAwD;AAExD,sEAAsE;AACtE,uEAAuE;AACvE,sEAAsE;AACtE,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAI,IAAgB,EAAE,SAAiB,EAAE,OAAe;IACvF,IAAI,OAAmC,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACxB,IAAI;YACJ,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;gBACtC,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;oBACxB,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC7B,CAAC,EAAE,SAAS,CAAC,CAAC;gBACd,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,OAAO;YAAE,YAAY,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;AACH,CAAC"}

package/dist/audit.d.ts

@@ -0,0 +1,98 @@
+import type { Logger } from './logging.js';
+import type { JsonValue } from './json.js';
+export declare const AUDIT_STREAM = "caracal.audit.events";
+/**
+ * Canonical audit event. Mirrors packages/core/go/audit/event.go Event struct.
+ * JSON field names are the on-the-wire contract; do not rename.
+ */
+export interface AuditEvent {
+    id: string;
+    zone_id: string;
+    event_type: string;
+    request_id: string;
+    decision: string;
+    policy_set_id?: string;
+    policy_set_version_id?: string;
+    manifest_sha?: string;
+    evaluation_status: string;
+    determining_policies_json: JsonValue;
+    diagnostics_json: JsonValue;
+    metadata_json?: JsonValue;
+    occurred_at: string;
+}
+/**
+ * Minimal Redis-stream interface. Pass any client (ioredis, node-redis adapter)
+ * that exposes XADD with a flat field/value list.
+ */
+export interface AuditStreamer {
+    xadd(stream: string, ...args: string[]): Promise<string>;
+}
+export interface AuditMetricsHook {
+    onDropped?: (total: number) => void;
+    onSinkError?: () => void;
+    onReplayPersisted?: (count: number) => void;
+    onReplayDrained?: (count: number) => void;
+}
+export interface AuditClientOptions {
+    streamer: AuditStreamer;
+    logger: Logger;
+    hmacKey?: Buffer | null;
+    replayDir: string;
+    bufferCap?: number;
+    flushBatch?: number;
+    flushTtlMs?: number;
+    stream?: string;
+    production?: boolean;
+    metrics?: AuditMetricsHook;
+}
+export interface AuditMetrics {
+    emitted: number;
+    dropped: number;
+    persisted: number;
+    drained: number;
+    sink_errors: number;
+    queue_depth: number;
+    queue_cap: number;
+}
+export declare class AuditClient {
+    private readonly streamer;
+    private readonly logger;
+    private readonly hmacKey;
+    private readonly replayDir;
+    private readonly bufferCap;
+    private readonly flushBatch;
+    private readonly flushTtlMs;
+    private readonly stream;
+    private readonly metrics;
+    private readonly buffer;
+    private emittedTotal;
+    private droppedTotal;
+    private persistedTotal;
+    private drainedTotal;
+    private sinkErrorsTotal;
+    private timer;
+    private closed;
+    private flushing;
+    constructor(opts: AuditClientOptions);
+    start(): Promise<void>;
+    /**
+     * Emit an event. Never blocks. On overflow the event is dropped and counted;
+     * on shutdown the unflushed batch is persisted to disk.
+     */
+    emit(event: AuditEvent): void;
+    dropped(): number;
+    snapshot(): AuditMetrics;
+    close(): Promise<void>;
+    private flush;
+    private sign;
+    private xadd;
+    private persistBatch;
+    private replayPending;
+}
+export declare function defaultReplayDir(service: string): string;
+/**
+ * Install SIGTERM/SIGINT handlers that flush the audit client before exit.
+ * Returns a stop function that removes the handlers (useful for tests).
+ */
+export declare function installShutdownHandler(client: AuditClient, timeoutMs?: number): () => void;
+//# sourceMappingURL=audit.d.ts.map

package/dist/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C,eAAO,MAAM,YAAY,yBAAyB,CAAC;AAEnD;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,yBAAyB,EAAE,SAAS,CAAC;IACrC,gBAAgB,EAAE,SAAS,CAAC;IAC5B,aAAa,CAAC,EAAE,SAAS,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,WAAW,CAAC,EAAE,MAAM,IAAI,CAAC;IACzB,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,aAAa,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmB;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAC3C,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,KAAK,CAA+B;IAC5C,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,QAAQ,CAAoC;gBAExC,IAAI,EAAE,kBAAkB;IAoB9B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAS5B;;;OAGG;IACH,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI;IAiB7B,OAAO,IAAI,MAAM;IAIjB,QAAQ,IAAI,YAAY;IAYlB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAWd,KAAK;IAoBnB,OAAO,CAAC,IAAI;YAKE,IAAI;YAQJ,YAAY;YAeZ,aAAa;CA6B5B;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,SAAO,GAAG,MAAM,IAAI,CAcxF"}

package/dist/audit.js

@@ -0,0 +1,213 @@
+// Copyright (C) 2026 Garudex Labs.  All Rights Reserved.
+// Caracal, a product of Garudex Labs
+//
+// Centralized audit emit client: HMAC-signed events to caracal.audit.events with disk-spill fallback.
+import { createHmac } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+export const AUDIT_STREAM = 'caracal.audit.events';
+export class AuditClient {
+    streamer;
+    logger;
+    hmacKey;
+    replayDir;
+    bufferCap;
+    flushBatch;
+    flushTtlMs;
+    stream;
+    metrics;
+    buffer = [];
+    emittedTotal = 0;
+    droppedTotal = 0;
+    persistedTotal = 0;
+    drainedTotal = 0;
+    sinkErrorsTotal = 0;
+    timer = null;
+    closed = false;
+    flushing = Promise.resolve();
+    constructor(opts) {
+        if (!opts.streamer)
+            throw new Error('audit: streamer is required');
+        if (!opts.replayDir)
+            throw new Error('audit: replayDir is required');
+        if (opts.production && (!opts.hmacKey || opts.hmacKey.length === 0)) {
+            throw new Error('audit: hmacKey is required in production');
+        }
+        if (opts.hmacKey && opts.hmacKey.length > 0 && opts.hmacKey.length < 32) {
+            throw new Error('audit: hmacKey must be at least 32 bytes');
+        }
+        this.streamer = opts.streamer;
+        this.logger = opts.logger;
+        this.hmacKey = opts.hmacKey ?? null;
+        this.replayDir = opts.replayDir;
+        this.bufferCap = opts.bufferCap ?? 10_000;
+        this.flushBatch = opts.flushBatch ?? 1_000;
+        this.flushTtlMs = opts.flushTtlMs ?? 50;
+        this.stream = opts.stream ?? AUDIT_STREAM;
+        this.metrics = opts.metrics ?? {};
+    }
+    async start() {
+        await fs.mkdir(this.replayDir, { recursive: true, mode: 0o700 });
+        await this.replayPending();
+        this.timer = setInterval(() => {
+            void this.flush();
+        }, this.flushTtlMs);
+        if (typeof this.timer.unref === 'function')
+            this.timer.unref();
+    }
+    /**
+     * Emit an event. Never blocks. On overflow the event is dropped and counted;
+     * on shutdown the unflushed batch is persisted to disk.
+     */
+    emit(event) {
+        if (this.closed)
+            return;
+        if (this.buffer.length >= this.bufferCap) {
+            this.droppedTotal++;
+            this.metrics.onDropped?.(this.droppedTotal);
+            if (this.droppedTotal === 1 || this.droppedTotal % 1000 === 0) {
+                this.logger.warn('audit buffer full', { dropped: this.droppedTotal });
+            }
+            return;
+        }
+        this.buffer.push(event);
+        this.emittedTotal++;
+        if (this.buffer.length >= this.flushBatch) {
+            void this.flush();
+        }
+    }
+    dropped() {
+        return this.droppedTotal;
+    }
+    snapshot() {
+        return {
+            emitted: this.emittedTotal,
+            dropped: this.droppedTotal,
+            persisted: this.persistedTotal,
+            drained: this.drainedTotal,
+            sink_errors: this.sinkErrorsTotal,
+            queue_depth: this.buffer.length,
+            queue_cap: this.bufferCap,
+        };
+    }
+    async close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        if (this.timer)
+            clearInterval(this.timer);
+        await this.flushing;
+        await this.flush();
+        if (this.buffer.length > 0) {
+            await this.persistBatch(this.buffer.splice(0, this.buffer.length));
+        }
+    }
+    async flush() {
+        if (this.buffer.length === 0)
+            return;
+        const batch = this.buffer.splice(0, this.buffer.length);
+        this.flushing = this.flushing.then(async () => {
+            const failed = [];
+            for (const ev of batch) {
+                try {
+                    await this.xadd(ev);
+                }
+                catch (err) {
+                    this.logger.error('xadd audit event', { id: ev.id, err: err instanceof Error ? err.message : String(err) });
+                    this.sinkErrorsTotal++;
+                    this.metrics.onSinkError?.();
+                    failed.push(ev);
+                }
+            }
+            if (failed.length > 0)
+                await this.persistBatch(failed);
+        });
+        await this.flushing;
+    }
+    sign(data) {
+        if (!this.hmacKey)
+            return null;
+        return createHmac('sha256', this.hmacKey).update(data).digest('hex');
+    }
+    async xadd(ev) {
+        const data = JSON.stringify(ev);
+        const args = ['*', 'id', ev.id, 'data', data];
+        const sig = this.sign(data);
+        if (sig)
+            args.push('sig', sig);
+        await this.streamer.xadd(this.stream, ...args);
+    }
+    async persistBatch(batch) {
+        if (batch.length === 0)
+            return;
+        const name = `pending-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}.ndjson`;
+        const path = join(this.replayDir, name);
+        try {
+            const body = batch.map((e) => JSON.stringify(e)).join('\n') + '\n';
+            await fs.writeFile(path, body, { mode: 0o600 });
+            this.persistedTotal += batch.length;
+            this.metrics.onReplayPersisted?.(batch.length);
+            this.logger.warn('audit batch persisted to disk for later replay', { path, count: batch.length });
+        }
+        catch (err) {
+            this.logger.error('audit replay file write', { path, err: err instanceof Error ? err.message : String(err) });
+        }
+    }
+    async replayPending() {
+        let entries;
+        try {
+            entries = await fs.readdir(this.replayDir);
+        }
+        catch (err) {
+            this.logger.error('audit replay dir scan', { dir: this.replayDir, err: err instanceof Error ? err.message : String(err) });
+            return;
+        }
+        for (const name of entries) {
+            if (!name.endsWith('.ndjson'))
+                continue;
+            const path = join(this.replayDir, name);
+            try {
+                const body = await fs.readFile(path, 'utf8');
+                let drained = 0;
+                for (const line of body.split('\n')) {
+                    if (!line.trim())
+                        continue;
+                    const ev = JSON.parse(line);
+                    await this.xadd(ev);
+                    drained++;
+                }
+                this.drainedTotal += drained;
+                this.metrics.onReplayDrained?.(drained);
+                await fs.unlink(path);
+                this.logger.info('audit replay file drained', { path, count: drained });
+            }
+            catch (err) {
+                this.logger.error('audit replay file failed; will retry on next start', { path, err: err instanceof Error ? err.message : String(err) });
+            }
+        }
+    }
+}
+export function defaultReplayDir(service) {
+    return join(tmpdir(), 'caracal-audit-replay', service);
+}
+/**
+ * Install SIGTERM/SIGINT handlers that flush the audit client before exit.
+ * Returns a stop function that removes the handlers (useful for tests).
+ */
+export function installShutdownHandler(client, timeoutMs = 2000) {
+    const handler = () => {
+        const t = setTimeout(() => process.exit(1), timeoutMs).unref();
+        client.close().finally(() => {
+            clearTimeout(t);
+            process.exit(0);
+        });
+    };
+    process.on('SIGTERM', handler);
+    process.on('SIGINT', handler);
+    return () => {
+        process.off('SIGTERM', handler);
+        process.off('SIGINT', handler);
+    };
+}
+//# sourceMappingURL=audit.js.map

package/dist/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,sGAAsG;AAEtG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAIjC,MAAM,CAAC,MAAM,YAAY,GAAG,sBAAsB,CAAC;AA4DnD,MAAM,OAAO,WAAW;IACL,QAAQ,CAAgB;IACxB,MAAM,CAAS;IACf,OAAO,CAAgB;IACvB,SAAS,CAAS;IAClB,SAAS,CAAS;IAClB,UAAU,CAAS;IACnB,UAAU,CAAS;IACnB,MAAM,CAAS;IACf,OAAO,CAAmB;IAC1B,MAAM,GAAiB,EAAE,CAAC;IACnC,YAAY,GAAG,CAAC,CAAC;IACjB,YAAY,GAAG,CAAC,CAAC;IACjB,cAAc,GAAG,CAAC,CAAC;IACnB,YAAY,GAAG,CAAC,CAAC;IACjB,eAAe,GAAG,CAAC,CAAC;IACpB,KAAK,GAA0B,IAAI,CAAC;IACpC,MAAM,GAAG,KAAK,CAAC;IACf,QAAQ,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAEpD,YAAY,IAAwB;QAClC,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACnE,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACrE,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;QAC1C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC;QAC1C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5B,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACpB,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACjE,CAAC;IAED;;;OAGG;IACH,IAAI,CAAC,KAAiB;QACpB,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACzC,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,YAAY,KAAK,CAAC,IAAI,IAAI,CAAC,YAAY,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC9D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC1C,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,QAAQ;QACN,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,YAAY;YAC1B,OAAO,EAAE,IAAI,CAAC,YAAY;YAC1B,SAAS,EAAE,IAAI,CAAC,cAAc;YAC9B,OAAO,EAAE,IAAI,CAAC,YAAY;YAC1B,WAAW,EAAE,IAAI,CAAC,eAAe;YACjC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,IAAI,CAAC,KAAK;YAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,IAAI,CAAC,QAAQ,CAAC;QACpB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,KAAK;QACjB,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC5C,MAAM,MAAM,GAAiB,EAAE,CAAC;YAChC,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACtB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC5G,IAAI,CAAC,eAAe,EAAE,CAAC;oBACvB,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;oBAC7B,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,QAAQ,CAAC;IACtB,CAAC;IAEO,IAAI,CAAC,IAAY;QACvB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC/B,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,EAAc;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,IAAI,GAAa,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,GAAG;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/B,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;IACjD,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,KAAmB;QAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC/B,MAAM,IAAI,GAAG,WAAW,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAClG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YACnE,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAChD,IAAI,CAAC,cAAc,IAAI,KAAK,CAAC,MAAM,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gDAAgD,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACpG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa;QACzB,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3H,OAAO;QACT,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,SAAS;YACxC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACxC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC7C,IAAI,OAAO,GAAG,CAAC,CAAC;gBAChB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;wBAAE,SAAS;oBAC3B,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;oBAC1C,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACpB,OAAO,EAAE,CAAC;gBACZ,CAAC;gBACD,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC;gBAC7B,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,CAAC;gBACxC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oDAAoD,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3I,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,EAAE,OAAO,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAmB,EAAE,SAAS,GAAG,IAAI;IAC1E,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,KAAK,EAAE,CAAC;QAC/D,MAAM,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAC1B,YAAY,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,GAAG,EAAE;QACV,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC,CAAC;AACJ,CAAC"}

package/dist/config.d.ts

@@ -1,3 +1,6 @@
 export declare function mustGetenv(key: string): string;
 export declare function getenv(key: string, fallback: string): string;
+export declare function intEnv(key: string, fallback: number, min?: number): number;
+export declare function boolEnv(key: string, fallback: boolean): boolean;
+export declare function resolveFileSecrets(keys: readonly string[]): void;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAKA,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAI9C;AAED,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAOA,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAI9C;AAED,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAI,GAAG,MAAM,CAQrE;AAED,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAQ/D;AAMD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAWhE"}

package/dist/config.js

@@ -2,6 +2,7 @@
 // Caracal, a product of Garudex Labs
 //
 // Shared environment variable accessors for TypeScript services.
+import { readFileSync } from 'node:fs';
 export function mustGetenv(key) {
     const v = process.env[key];
     if (!v)
@@ -11,4 +12,49 @@ export function mustGetenv(key) {
 export function getenv(key, fallback) {
     return process.env[key] ?? fallback;
 }
+export function intEnv(key, fallback, min = 0) {
+    const raw = process.env[key];
+    if (raw === undefined || raw === '')
+        return fallback;
+    const n = parseInt(raw, 10);
+    if (!Number.isFinite(n) || n < min) {
+        throw new Error(`Invalid integer env var ${key}: ${raw}`);
+    }
+    return n;
+}
+export function boolEnv(key, fallback) {
+    const raw = process.env[key];
+    if (raw === undefined || raw === '')
+        return fallback;
+    switch (raw.toLowerCase()) {
+        case '1':
+        case 'true':
+        case 'yes':
+        case 'on': return true;
+        case '0':
+        case 'false':
+        case 'no':
+        case 'off': return false;
+        default: throw new Error(`Invalid boolean env var ${key}: ${raw}`);
+    }
+}
+// resolveFileSecrets reads `${KEY}_FILE` for each given key and, when set,
+// loads the file contents into `process.env[KEY]`. The `_FILE` variable is
+// cleared so secrets do not appear in the process environment beyond what is
+// actually needed at runtime. Existing values for `KEY` are preserved.
+export function resolveFileSecrets(keys) {
+    for (const key of keys) {
+        if (process.env[key])
+            continue;
+        const fileVar = `${key}_FILE`;
+        const path = process.env[fileVar];
+        if (!path)
+            continue;
+        const value = readFileSync(path, 'utf8').replace(/\s+$/, '');
+        if (!value)
+            throw new Error(`Secret file empty: ${fileVar}=${path}`);
+        process.env[key] = value;
+        delete process.env[fileVar];
+    }
+}
 //# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,iEAAiE;AAEjE,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,GAAW,EAAE,QAAgB;IAClD,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;AACtC,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,iEAAiE;AAEjE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,GAAW,EAAE,QAAgB;IAClD,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,GAAW,EAAE,QAAgB,EAAE,GAAG,GAAG,CAAC;IAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IACrD,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAW,EAAE,QAAiB;IACpD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IACrD,QAAQ,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;QAC1B,KAAK,GAAG,CAAC;QAAC,KAAK,MAAM,CAAC;QAAC,KAAK,KAAK,CAAC;QAAC,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC;QAC1D,KAAK,GAAG,CAAC;QAAC,KAAK,OAAO,CAAC;QAAC,KAAK,IAAI,CAAC;QAAC,KAAK,KAAK,CAAC,CAAC,OAAO,KAAK,CAAC;QAC5D,OAAO,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,KAAK,GAAG,EAAE,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,2EAA2E;AAC3E,6EAA6E;AAC7E,uEAAuE;AACvE,MAAM,UAAU,kBAAkB,CAAC,IAAuB;IACxD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC/B,MAAM,OAAO,GAAG,GAAG,GAAG,OAAO,CAAC;QAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACzB,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC"}

package/dist/crypto.d.ts

@@ -11,4 +11,8 @@ export declare const STREAM_SIG_FIELD = "_sig";
 export type StreamValue = string | number | boolean | null | undefined;
 export declare function loadStreamsHmacKey(): Buffer | null;
 export declare function signStream(key: Buffer, stream: string, values: Record<string, StreamValue>): string;
+export declare const GATEWAY_TIMESTAMP_HEADER = "X-Caracal-Gateway-Timestamp";
+export declare const GATEWAY_REQUEST_HEADER = "X-Caracal-Gateway-Request";
+export declare const GATEWAY_SIGNATURE_HEADER = "X-Caracal-Gateway-Signature";
+export declare function signGatewayExchange(key: Buffer, timestampUnix: number, requestId: string, method: string, path: string, body: Buffer | string): string;
 //# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAExD;AAED,wBAAgB,WAAW,IAAI,MAAM,CAWpC;AAED,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY,CAMjE;AAED,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,MAAM,CAO9D;AAID,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAEvC,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC;AAIvE,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,IAAI,CAQlD;AAgBD,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,CAEnG"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAExD;AAED,wBAAgB,WAAW,IAAI,MAAM,CAWpC;AAED,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY,CAMjE;AAED,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,MAAM,CAO9D;AAID,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAEvC,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC;AAIvE,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,IAAI,CAQlD;AAgBD,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,MAAM,CAEnG;AAED,eAAO,MAAM,wBAAwB,gCAAgC,CAAC;AACtE,eAAO,MAAM,sBAAsB,8BAA8B,CAAC;AAClE,eAAO,MAAM,wBAAwB,gCAAgC,CAAC;AAMtE,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GAAG,MAAM,GACpB,MAAM,CAIR"}

package/dist/crypto.js

@@ -75,4 +75,16 @@ function canonicalizeStream(stream, values) {
 export function signStream(key, stream, values) {
     return createHmac('sha256', key).update(canonicalizeStream(stream, values)).digest('hex');
 }
+export const GATEWAY_TIMESTAMP_HEADER = 'X-Caracal-Gateway-Timestamp';
+export const GATEWAY_REQUEST_HEADER = 'X-Caracal-Gateway-Request';
+export const GATEWAY_SIGNATURE_HEADER = 'X-Caracal-Gateway-Signature';
+// signGatewayExchange returns the hex HMAC-SHA256 over the canonical envelope:
+//   `${unix}\n${requestId}\n${METHOD}\n${path}\n${sha256(body)}`
+// Method and path bind the signature to a specific endpoint so a signed
+// envelope cannot be replayed against any other endpoint accepting the same key.
+export function signGatewayExchange(key, timestampUnix, requestId, method, path, body) {
+    const digest = createHash('sha256').update(body).digest('hex');
+    const payload = `${timestampUnix}\n${requestId}\n${method.toUpperCase()}\n${path}\n${digest}`;
+    return createHmac('sha256', key).update(payload).digest('hex');
+}
 //# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,kFAAkF;AAElF,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEpG,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,SAAS,GAAG,EAAE,CAAC;AAOrB,MAAM,UAAU,MAAM,CAAC,KAAsB;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAsB;IAC9C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;IACjC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oBAAoB,SAAS,eAAe,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC;IAClC,IAAI,OAAO,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACrE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,GAAW,EAAE,SAAiB;IACjD,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,cAAc,CAAC,mBAAmB,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7F,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,GAAW,EAAE,MAAoB;IACpD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAClF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,mBAAmB,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;IACxG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,qFAAqF;AACrF,sFAAsF;AACtF,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAIvC,kFAAkF;AAClF,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc,EAAE,MAAmC;IAC7E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9E,IAAI,GAAG,GAAG,GAAG,MAAM,IAAI,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC5C,GAAG,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oFAAoF;AACpF,kFAAkF;AAClF,qDAAqD;AACrD,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,MAAc,EAAE,MAAmC;IACzF,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5F,CAAC"}
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,kFAAkF;AAElF,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEpG,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,SAAS,GAAG,EAAE,CAAC;AAOrB,MAAM,UAAU,MAAM,CAAC,KAAsB;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAsB;IAC9C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;IACjC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oBAAoB,SAAS,eAAe,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC;IAClC,IAAI,OAAO,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACrE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,GAAW,EAAE,SAAiB;IACjD,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,cAAc,CAAC,mBAAmB,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7F,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,GAAW,EAAE,MAAoB;IACpD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAClF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,mBAAmB,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;IACxG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,qFAAqF;AACrF,sFAAsF;AACtF,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAIvC,kFAAkF;AAClF,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACpC,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc,EAAE,MAAmC;IAC7E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9E,IAAI,GAAG,GAAG,GAAG,MAAM,IAAI,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAC5C,GAAG,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oFAAoF;AACpF,kFAAkF;AAClF,qDAAqD;AACrD,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,MAAc,EAAE,MAAmC;IACzF,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5F,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,6BAA6B,CAAC;AACtE,MAAM,CAAC,MAAM,sBAAsB,GAAG,2BAA2B,CAAC;AAClE,MAAM,CAAC,MAAM,wBAAwB,GAAG,6BAA6B,CAAC;AAEtE,+EAA+E;AAC/E,iEAAiE;AACjE,wEAAwE;AACxE,iFAAiF;AACjF,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,aAAqB,EACrB,SAAiB,EACjB,MAAc,EACd,IAAY,EACZ,IAAqB;IAErB,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,GAAG,aAAa,KAAK,SAAS,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,IAAI,KAAK,MAAM,EAAE,CAAC;IAC9F,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC"}

package/dist/env.d.ts

@@ -1,5 +1,5 @@
-export type CaracalMode = 'dev' | 'runtime';
+export type CaracalMode = 'dev' | 'rc' | 'stable';
 export declare function caracalMode(): CaracalMode;
-export declare function isRuntime(): boolean;
-export declare function assertRuntimeSafe(): void;
+export declare function isPublished(): boolean;
+export declare function assertPublishedSafe(): void;
 //# sourceMappingURL=env.d.ts.map

package/dist/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,SAAS,CAAC;AAE5C,wBAAgB,WAAW,IAAI,WAAW,CAKzC;AAED,wBAAgB,SAAS,IAAI,OAAO,CAEnC;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAUxC"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,IAAI,GAAG,QAAQ,CAAC;AAElD,wBAAgB,WAAW,IAAI,WAAW,CAKzC;AAED,wBAAgB,WAAW,IAAI,OAAO,CAErC;AAED,wBAAgB,mBAAmB,IAAI,IAAI,CAU1C"}

package/dist/env.js

@@ -4,25 +4,25 @@
 // Shared environment classification for TypeScript services.
 export function caracalMode() {
     const raw = (process.env.CARACAL_MODE ?? '').trim().toLowerCase();
-    if (raw === '' || raw === 'runtime')
-        return 'runtime';
-    if (raw === 'dev')
-        return 'dev';
-    throw new Error(`CARACAL_MODE must be 'dev' or 'runtime' (got '${raw}')`);
+    if (raw === '')
+        return 'stable';
+    if (raw === 'dev' || raw === 'rc' || raw === 'stable')
+        return raw;
+    throw new Error(`CARACAL_MODE must be 'dev', 'rc', or 'stable' (got '${raw}')`);
 }
-export function isRuntime() {
-    return caracalMode() === 'runtime';
+export function isPublished() {
+    return caracalMode() !== 'dev';
 }
-export function assertRuntimeSafe() {
-    if (caracalMode() !== 'runtime')
+export function assertPublishedSafe() {
+    if (!isPublished())
         return;
-    const forbidden = ['INSECURE_STS', 'INSECURE_HTTP', 'CARACAL_LOCAL_BOOTSTRAP_ENABLED'];
+    const forbidden = ['INSECURE_STS', 'INSECURE_HTTP'];
     const set = forbidden.filter((k) => {
         const v = (process.env[k] ?? '').toLowerCase();
         return v === 'true' || v === '1' || v === 'yes';
     });
     if (set.length > 0) {
-        throw new Error(`CARACAL_MODE=runtime forbids: ${set.join(', ')}`);
+        throw new Error(`CARACAL_MODE=rc or CARACAL_MODE=stable forbids: ${set.join(', ')}`);
     }
 }
 //# sourceMappingURL=env.js.map

package/dist/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,6DAA6D;AAI7D,MAAM,UAAU,WAAW;IACzB,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClE,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,IAAI,KAAK,CAAC,iDAAiD,GAAG,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,OAAO,WAAW,EAAE,KAAK,SAAS,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,IAAI,WAAW,EAAE,KAAK,SAAS;QAAE,OAAO;IACxC,MAAM,SAAS,GAAG,CAAC,cAAc,EAAE,eAAe,EAAE,iCAAiC,CAAC,CAAC;IACvF,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACjC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/C,OAAO,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,CAAC;IAClD,CAAC,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;AACH,CAAC"}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,qCAAqC;AACrC,EAAE;AACF,6DAA6D;AAI7D,MAAM,UAAU,WAAW;IACzB,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClE,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAClE,MAAM,IAAI,KAAK,CAAC,uDAAuD,GAAG,IAAI,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,WAAW,EAAE,KAAK,KAAK,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,IAAI,CAAC,WAAW,EAAE;QAAE,OAAO;IAC3B,MAAM,SAAS,GAAG,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACjC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/C,OAAO,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,CAAC;IAClD,CAAC,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,mDAAmD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;AACH,CAAC"}

package/dist/envfile.d.ts

@@ -1,3 +1,12 @@
 export declare function readEnvFile(path: string): Record<string, string>;
-export declare function discoverAdminToken(explicit?: string): string | undefined;
+/**
+ * Resolve the installed home written to by `caracal up`.
+ * Mirrors the layout in packages/engine/src/runtime.ts.
+ */
+export declare function installedHome(): string;
+export interface DiscoverTokenOptions {
+    preferGenerated?: boolean;
+}
+export declare function discoverAdminToken(explicit?: string, opts?: DiscoverTokenOptions): string | undefined;
+export declare function discoverCoordinatorToken(explicit?: string, opts?: DiscoverTokenOptions): string | undefined;
 //# sourceMappingURL=envfile.d.ts.map

package/dist/envfile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"envfile.d.ts","sourceRoot":"","sources":["../src/envfile.ts"],"names":[],"mappings":"AAQA,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAahE;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAaxE"}
+{"version":3,"file":"envfile.d.ts","sourceRoot":"","sources":["../src/envfile.ts"],"names":[],"mappings":"AASA,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAahE;AAED;;;GAGG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAQtC;AAQD,MAAM,WAAW,oBAAoB;IACnC,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAwBD,wBAAgB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,oBAAyB,GAAG,MAAM,GAAG,SAAS,CAoBzG;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,oBAAyB,GAAG,MAAM,GAAG,SAAS,CAoB/G"}