@feasibleone/blong-gogo 1.34.0 → 1.35.0

package/src/SemanticLog.ts

@@ -0,0 +1,264 @@
+/**
+ * The framework's server-side logger, backed by `@feasibleone/semantic-log`.
+ *
+ * It is the alternative to `Log` (pino) and implements the same `ILog` contract,
+ * so `Internal`'s `this.log`, `api.createLog` and every existing call site are
+ * unaffected by which one is selected. The emitter's own log — construction, one
+ * logger per component, retention, the cluster sink and the lifecycle — is
+ * `LogBase` in `@feasibleone/semantic-log/emitter`; what is left here is what is
+ * blong's, and there are three things:
+ *
+ * - **The envelope.** The framework's call sites pass `{$meta: {mtid, method}}`,
+ *   and its call records carry the same envelope (`callTrace.ts`), so both are
+ *   read here — an envelope is not something semantic-log could know about.
+ * - **The level contract.** `logger(level, bindings)` binds *downwards*: the
+ *   original implementation uses a switch with no `break`s, so asking for `info`
+ *   binds `info` through `fatal` and leaves `trace`/`debug` undefined. Call sites
+ *   depend on that: a `this.log?.debug?.()` at info level is a silent no-op rather
+ *   than a call. `ILog.logger` also promises `progress`, which is blong-lib's.
+ * - **The call gate.** Whether a flow records its calls is the framework's
+ *   configuration and its `blong grant` tokens (`callTrace.ts`), read at the
+ *   boundary that mints a flow rather than here.
+ *
+ * ## Why this *holds* a base rather than extending one
+ *
+ * `LogBase` is what blong would extend, except that it cannot: the loader decides
+ * that a module is a component by testing `prototype instanceof Internal`
+ * (`load.ts`), and semantic-log's side of the world knows nothing of `Internal` —
+ * nor should it. So the framework's class extends `Internal` as every other
+ * component does, and delegates to a `LogBase` it owns. The hooks the base would
+ * otherwise ask a subclass for are options, which is what makes that possible.
+ *
+ * The emitter is reached through `@feasibleone/semantic-log/emitter`, not the
+ * package root: the root re-exports the cluster service, which imports `fastify`,
+ * and this module is on a path `loadBrowser.ts` shares. Keeping the service out of
+ * the import graph is what stops a browser bundle from trying to resolve a server
+ * HTTP framework.
+ *
+ * ## `fatal` does not exit
+ *
+ * The emitter's `fatal` writes a record and then calls `exit`, because its own
+ * process-failure hooks install it that way. The framework's `fatal` has always
+ * meant "log this at fatal level" — pino ends nothing — and `LogBase` leaves `exit`
+ * a no-op for exactly that reason. Installing the emitter's failure capture is a
+ * separate decision, and not one this class makes for every process that logs.
+ */
+
+import {merge, withProgress} from '@feasibleone/blong-lib';
+import {Internal, type ICallLog, type ILog, type ILogger} from '@feasibleone/blong/types';
+import {
+    LogBase,
+    resolveHome,
+    type ClusterOptions,
+    type Format,
+    type LevelName,
+    type LoggerFace,
+    type PayloadStore,
+    type RecordStore,
+    type RetentionOptions,
+} from '@feasibleone/semantic-log/emitter';
+import type {Level, Logger as PinoLogger} from 'pino';
+import {callRecord, configureCallTrace, type CallTraceConfig} from './callTrace.ts';
+import {toLogCall} from './semanticRecord.ts';
+
+export {resolveHome};
+
+/**
+ * The threshold's type, taken from the contract rather than from pino.
+ *
+ * `ILog.logger`'s first parameter is pino's level, and the framework's own type
+ * file imports that name without re-exporting it — so the parameter is named
+ * through the interface that owns it, as `types.ts` itself does elsewhere.
+ */
+type LogLevel = Parameters<ILog['logger']>[0];
+
+/** What a suite or realm may configure under `log` when `impl` is `semantic`. */
+export interface SemanticLogConfig {
+    /** Threshold. Records below it are not emitted at all. */
+    level?: LogLevel;
+    /** `human` (one readable line) or `json` (one JSON object per record). */
+    format?: Format;
+    /** ANSI colour in human format. Opt-in, as the emitter's own option is. */
+    color?: boolean;
+    /** The service name carried on every record; the framework's own by default. */
+    service?: string;
+    /**
+     * Retain records on disk so a printed reference resolves later. The directory is
+     * the framework's log cache, which the pino transport also writes — one store,
+     * shared, so a `semantic-log://record/<id>` reference resolves whichever
+     * implementation emitted it.
+     */
+    cache?: RetentionOptions;
+    /**
+     * The call channel: the framework's own account of the calls this process
+     * makes and answers, and the switch that decides whether it is produced.
+     *
+     * `enabled` and `off` are the framework's decision (see `callTrace.ts`) —
+     * `off` names the entry methods whose flows are too frequent to record. This
+     * implementation adds `stdout`: the call records reach the retention store
+     * and the cluster service whether or not it is set, and setting it is what
+     * puts them on a terminal as well.
+     */
+    calls?: CallTraceConfig;
+    /**
+     * The semantic-log cluster service: where records go to be assembled into
+     * templates, flows, diagrams and incidents. `LogBase` owns what each field
+     * means — the framework's own concern here is only that a development run may
+     * start one and a deployment may point at one.
+     */
+    cluster?: ClusterOptions;
+}
+
+/**
+ * A pino level, as an emitter threshold.
+ *
+ * pino's vocabulary has one name the emitter does not: `silent`. It means "no
+ * records at all", which is a threshold above every level, so it is translated
+ * rather than passed through — a component configured silent must not fall back
+ * to the root's threshold and start emitting again, which is exactly what
+ * happened while `child` ignored this option.
+ */
+function thresholdOf(level: Level | 'silent' | number | undefined): LevelName | number | undefined {
+    if (level === undefined) return undefined;
+    return level === 'silent' ? Number.POSITIVE_INFINITY : (level as LevelName | number);
+}
+
+export default class SemanticLog extends Internal implements ILog {
+    #config: SemanticLogConfig;
+    #base: LogBase;
+
+    public constructor(config: SemanticLogConfig) {
+        super();
+        const merged = merge<SemanticLogConfig>(
+            {level: 'info' as LogLevel, format: 'human' as Format, color: false},
+            config,
+        ) as SemanticLogConfig;
+        this.#config = merged;
+        this.#base = new LogBase({
+            service: merged.service ?? 'blong',
+            level: thresholdOf(merged.level),
+            format: merged.format,
+            color: merged.color,
+            cache: merged.cache,
+            // Only the printing switch is the base's business; `enabled`/`off` are
+            // the gate's, and are read where a flow is minted.
+            calls: merged.calls,
+            cluster: merged.cluster,
+            // Lazy on purpose: this module is on a path the browser bootstrap shares,
+            // and the service entry reaches `fastify`. A process with no cluster
+            // configured never loads it at all.
+            openCluster: async () =>
+                (await import('@feasibleone/semantic-log/service')).openCluster,
+            // The framework's envelope, on the record and on the call site's own
+            // arguments: `{$meta: {mtid, method}}` is what its readers match on.
+            envelope: ({leg, phase}) => callRecord(leg, phase),
+            translate: args => toLogCall(args),
+        });
+    }
+
+    /** What the emitter retains through, and how a retained record is read back. */
+    public get store(): RecordStore & PayloadStore {
+        return this.#base.store;
+    }
+
+    /**
+     * The address of the cluster service this process started, once it started one.
+     *
+     * The framework publishes it to the components that read the service — the realm
+     * whose pages ask it what it observed. It is the *bound* address rather than a
+     * configured one because the port is asked for, not named: two framework
+     * processes on one machine are ordinary (a dev server beside a test run, or CI
+     * running packages in parallel) and a fixed port leaves the second one with no
+     * service at all while its readers keep looking at the first one's.
+     */
+    public get clusterUrl(): string | undefined {
+        return this.#base.clusterUrl;
+    }
+
+    /**
+     * Install the call gate, then open the store and the cluster.
+     *
+     * The gate's configuration goes first: `enabled`/`off` decide whether a flow
+     * records, and both are read where a flow is minted, which is before the store
+     * can matter. The ambient scope the decision is carried in is semantic-log's
+     * own, reached by the vocabulary the server bootstrap attaches, so there is
+     * nothing to attach here.
+     */
+    public async init(): Promise<void> {
+        configureCallTrace(this.#config.calls);
+        await this.#base.init();
+    }
+
+    /** Flush and close everything the base opened. */
+    public async stop(): Promise<void> {
+        await this.#base.stop();
+    }
+
+    /**
+     * A pino-shaped child logger, with pino's `silent` translated first.
+     *
+     * Everything else about the child — the bindings, the component's name, the
+     * face — is the base's.
+     */
+    public child<T extends string>(
+        ...params: Parameters<PinoLogger<never>['child']>
+    ): PinoLogger<T> {
+        const [bindings, options] = params as unknown as [
+            Record<string, unknown> | undefined,
+            {level?: Level | 'silent' | number} | undefined,
+        ];
+        const level = thresholdOf(options?.level);
+        return this.#base.child(
+            bindings,
+            level === undefined ? undefined : {level},
+        ) as unknown as PinoLogger<T>;
+    }
+
+    public logger(
+        level: LogLevel = this.#config.level as LogLevel,
+        bindings: object,
+    ): ReturnType<ILog['logger']> {
+        const {name, ...rest} = bindings as {name?: string};
+        const face: LoggerFace = this.#base.componentFace(name, thresholdOf(level), rest);
+        const result: ILogger = {
+            trace: undefined,
+            debug: undefined,
+            info: undefined,
+            warn: undefined,
+            error: undefined,
+            fatal: undefined,
+        };
+        // The fall-through is the contract, not an oversight: see the class
+        // comment. Each case binds its own level and every one below it.
+        switch (level) {
+            case 'trace':
+                result.trace = face.trace;
+            case 'debug':
+                result.debug = face.debug;
+            case 'info':
+                result.info = face.info;
+            case 'warn':
+                result.warn = face.warn;
+            case 'error':
+                result.error = face.error;
+            case 'fatal':
+                result.fatal = face.fatal;
+        }
+        return {
+            ...result,
+            progress: (label, promise, options) => withProgress(result, label, promise, options),
+            calls: face.calls,
+        };
+    }
+
+    /**
+     * The framework's own account of the calls made through this log.
+     *
+     * Present on the log itself so a component that holds the log rather than a
+     * child logger (`Gateway`) reaches the same channel as a port that holds
+     * only its logger.
+     */
+    public get calls(): ICallLog {
+        return this.#base.callsChannel(undefined);
+    }
+}

package/src/Watch.ts

@@ -10,6 +10,7 @@ import {
     type IConfigRuntime,
     type IErrorFactory,
     type ILog,
+    type IMeta,
     type IModuleConfig,
     type IObjectSchema,
     type IPlatformApi,
@@ -21,6 +22,7 @@ import type {Dirent} from 'node:fs';
 import merge from 'ut-function.merge';
 
 import layerProxy from './layerProxy.ts';
+import {runInFlow, withStep} from './semanticContext.ts';
 
 export interface IWatch {
     start: (realm: IRegistry, remote: IRemote, configOverride: object) => Promise<void>;
@@ -64,6 +66,16 @@ const isTest = (filename: string): boolean => /\.test\.[mc]?[tj]sx?$/i.test(file
 
 const prefixRE: RegExp = /(?:\d+-)?(.*)/;
 
+/**
+ * The name a test group is displayed by: `test.meter.flow` reads as `meter flow`.
+ *
+ * The group's handler may name itself instead (`group("gateway meter flow")`), which
+ * is what the handler's own reader sees; this is the name to fall back to.
+ */
+function groupName(method: string): string {
+    return method.replace(/^test\./, '').replace(/\./g, ' ');
+}
+
 interface IConfig {
     enabled: boolean;
     test: string;
@@ -731,31 +743,53 @@ export default class Watch extends Internal implements IWatch {
                         await import('./chain.ts')
                     ).default(test as ITestContext, this.log);
 
-                    const steps = await Promise.all(
-                        ([] as string[]).concat(this.#config.test).map(async method => {
-                            const result = await remote.remote(method)({}, {});
-                            if (Array.isArray(result) && !('name' in result)) {
-                                Object.defineProperty(result, 'name', {
-                                    value: method.replace(/^test\./, '').replace(/\./g, ' '),
-                                    configurable: true,
-                                });
-                            }
-                            return result;
-                        }),
-                    );
+                    const groups = ([] as string[]).concat(this.#config.test);
                     let executed = 0;
                     await withProgress(
                         this.log,
                         'run test groups',
-                        (async () => {
-                            await Promise.all(
-                                steps.map(async step => {
-                                    await chain(step as Parameters<typeof chain>[0]);
-                                    executed += 1;
-                                }),
-                            );
-                        })(),
-                        {getProgress: () => ({done: executed, total: steps.length})},
+                        Promise.all(
+                            groups.map(async method => {
+                                // Nothing above a test group minted a flow, so each group is
+                                // an entry of its own. The groups run in parallel, so one
+                                // flow for the whole run would interleave unrelated
+                                // scenarios into a single diagram; a flow per group gives
+                                // one scenario per flow, which is what there is to draw.
+                                //
+                                // The flow wraps the *execution*, not just the dispatch: a
+                                // group answers with its steps and they run afterwards, so a
+                                // flow that ended with the dispatch covered nothing but the
+                                // call that built the scenario - the calls the scenario made
+                                // were then made in no flow at all, and the observed flow the
+                                // run was supposed to leave behind never existed.
+                                const meta: IMeta = {mtid: 'event', method};
+                                await runInFlow(meta, method, async () => {
+                                    const steps = await remote.remote(method)({}, meta);
+                                    if (Array.isArray(steps) && !('name' in steps)) {
+                                        Object.defineProperty(steps, 'name', {
+                                            value: groupName(method),
+                                            configurable: true,
+                                        });
+                                    }
+                                    // The group's display name is also the flow's *phase*: a
+                                    // sequence that runs a whole scenario reads as one band, and
+                                    // the band is what tells a reader which scenario it is.
+                                    const named =
+                                        typeof steps === 'object' && steps !== null
+                                            ? (steps as {name?: unknown})
+                                            : undefined;
+                                    const phase =
+                                        typeof named?.name === 'string'
+                                            ? named.name
+                                            : groupName(method);
+                                    await withStep(phase, () =>
+                                        chain(steps as Parameters<typeof chain>[0]),
+                                    );
+                                });
+                                executed += 1;
+                            }),
+                        ),
+                        {getProgress: () => ({done: executed, total: groups.length})},
                     );
                 } catch (error) {
                     this.log?.error?.(error);
@@ -771,6 +805,20 @@ export default class Watch extends Internal implements IWatch {
     }
 
     public async test(framework: unknown): Promise<void> {
+        // `test()` settles only when the `start()`-registered listener calls `done`, and
+        // that listener is registered only when test groups are declared. Waiting for it
+        // unconditionally hangs the whole run with no output at all — a silent wait, which
+        // is exactly what a suite that loads a platform without test groups (a browser
+        // platform in a tap run, say) used to get. Report it and return: nothing to run is
+        // not an error, it just has to be said out loud.
+        const groups = ([] as string[]).concat(this.#config.test ?? []);
+        if (groups.length === 0) {
+            this.log?.info?.(
+                {$meta: {mtid: 'event', method: 'watch.test.none'}},
+                'no test groups configured on this platform; nothing to run',
+            );
+            return;
+        }
         return new Promise<void>((resolve, reject) => {
             // this.#emit.emit('test', error => (error ? reject(error) : resolve()), framework);
             this.#emit.dispatchEvent(

package/src/callTrace.test.ts

@@ -0,0 +1,80 @@
+/**
+ * The framework's half of call recording: the configuration it falls back to, the
+ * envelope a record carries, and the name a capability is asked for by.
+ *
+ * The switch itself and the phases are semantic-log's (`src/capability.ts`
+ * there), and the two are pinned together here rather than left to agree by
+ * convention — a capability name that drifted between packages would silence the
+ * channel without failing anything.
+ */
+import {CALLS_CAPABILITY as SEMANTIC_CALLS_CAPABILITY} from '@feasibleone/semantic-log/capability';
+import t from 'tap';
+import {
+    CALLS_CAPABILITY,
+    callRecord,
+    callTraceConfig,
+    callsPermitted,
+    configureCallTrace,
+} from './callTrace.ts';
+
+t.teardown(() => configureCallTrace(undefined));
+
+t.test('the capability name is the one semantic-log asks for', t => {
+    t.equal(CALLS_CAPABILITY, SEMANTIC_CALLS_CAPABILITY);
+    t.end();
+});
+
+t.test('the default is to record', t => {
+    configureCallTrace(undefined);
+    t.equal(callsPermitted('access.access.find'), true, 'nothing configured records');
+    t.same(callTraceConfig(), {}, 'and the configuration in force says so');
+    t.end();
+});
+
+t.test('an off pattern names a flow, and matches a namespace or an exact method', t => {
+    configureCallTrace({off: ['payment', 'ledger.entry.post']});
+    t.equal(callsPermitted('payment.transfer.prepare'), false, 'a namespace is opted out');
+    t.equal(callsPermitted('ledger.entry.post'), false, 'an exact entry is opted out');
+    t.equal(callsPermitted('ledger.entry.other'), true, 'a sibling of the exact entry is not');
+    t.equal(callsPermitted('access.access.find'), true, 'an unrelated flow is untouched');
+    t.end();
+});
+
+t.test('a glob pattern opts out a whole prefix', t => {
+    configureCallTrace({off: ['payment.*']});
+    t.equal(callsPermitted('payment.transfer.prepare'), false);
+    t.equal(callsPermitted('payment'), false, 'the namespace itself matches the pattern');
+    t.equal(callsPermitted('payments.transfer.prepare'), true, 'a longer name is not a match');
+    t.end();
+});
+
+t.test('enabled false is the blunt switch', t => {
+    configureCallTrace({enabled: false, off: ['access']});
+    t.equal(callsPermitted('access.access.find'), false);
+    t.equal(callsPermitted('anything.else'), false, 'and it is not limited to the patterns');
+    t.end();
+});
+
+t.test('a single off flag is read as a list, because the CLI writes one', t => {
+    // `--log.calls.off=payment` arrives as a string and the same flag twice as an
+    // array; a configuration that only worked when it was repeated would be a trap.
+    configureCallTrace({off: 'payment' as unknown as string[]});
+    t.equal(callsPermitted('payment.transfer.prepare'), false);
+    t.same(callTraceConfig().off, ['payment'], 'and it is normalised to a list');
+    t.end();
+});
+
+t.test('a phase record keeps the shape the ledger reads a leg from', t => {
+    t.same(callRecord('gateway.access.access.find', 'start'), {
+        $meta: {mtid: 'event', method: 'gateway.access.access.find.start'},
+    });
+    t.same(callRecord('a.b', 'received'), {$meta: {mtid: 'event', method: 'a.b.received'}});
+    t.end();
+});
+
+t.test('the stdout opt-in is read by the log implementation, not here', t => {
+    configureCallTrace({stdout: true});
+    t.equal(callTraceConfig().stdout, true, 'the framework passes it through untouched');
+    t.equal(callsPermitted('a.b'), true, 'and it says nothing about whether a flow records');
+    t.end();
+});

package/src/callTrace.ts

@@ -0,0 +1,126 @@
+/**
+ * Whether a flow's calls are recorded, and the record a phase produces.
+ *
+ * The *decision* is no longer made here. It is a capability — a per-execution
+ * switch — and semantic-log owns those (`@feasibleone/semantic-log/capability`):
+ * the switch lives in its ambient scope, travels with the identity in the `cap`
+ * field of `x-semantic-trace`, and is read back where a record would be produced.
+ * What this module keeps is everything that is the *framework's* rather than the
+ * emitter's:
+ *
+ * - the configuration the decision falls back to (`log.calls.*`), and the entry
+ *   patterns a high-throughput flow is opted out by;
+ * - the envelope a call record carries — `$meta` with `mtid: 'event'` and a method
+ *   naming the leg and the phase, which is what the ledger reads a call out of;
+ * - the header a grant token arrives in.
+ *
+ * The line between the two is worth stating, because it is the line between the
+ * packages: semantic-log knows what a call *is* (a leg, its target, its position,
+ * its phases), and blong knows how this runtime names things and what its records
+ * look like.
+ */
+
+import type {CallPhase} from '@feasibleone/blong/types';
+
+/**
+ * The capability that switches the call channel.
+ *
+ * The same name semantic-log's `createCallChannel` asks for — it is defined there
+ * too, and `callTrace.test.ts` pins the two together, because a value that had to
+ * agree across packages by convention is a value that would stop agreeing
+ * silently.
+ */
+export const CALLS_CAPABILITY = 'calls';
+
+/** The header a short-lived grant token arrives in. Never forwarded. */
+export const GRANT_HEADER = 'x-blong-grant';
+
+/**
+ * What the framework may be told about call recording.
+ *
+ * Declared here rather than in the log implementation because both of them honour
+ * it — the decision belongs to the framework, not to whichever logger a process
+ * happens to run.
+ */
+export interface CallTraceConfig {
+    /** Produce call records at all. On unless this is `false`. */
+    enabled?: boolean;
+    /**
+     * Entry methods whose flows record nothing, matched against the name the flow
+     * was minted with (the gateway's method, e.g. `payment.transfer.prepare`).
+     *
+     * `payment` and `payment.*` both match the whole namespace; an exact name
+     * matches only that entry. The point is the high-throughput flows: recording
+     * them costs a record per call, and the picture they would draw is the one a
+     * reader already has.
+     */
+    off?: string[];
+    /**
+     * Print call records to stdout. Off unless asked for: the records are retained
+     * and sent to the cluster either way, and a person watching a terminal is
+     * reading the level log, not the call ledger.
+     */
+    stdout?: boolean;
+}
+
+let config: CallTraceConfig = {};
+
+/** Install the configuration. Called by whichever log implementation loaded. */
+export function configureCallTrace(next: CallTraceConfig | undefined): void {
+    if (next === undefined) {
+        config = {};
+        return;
+    }
+    // `off` normalised to a list, because the CLI is one of the two ways this is
+    // configured: `--log.calls.off=payment` arrives as a string and
+    // `--log.calls.off=payment --log.calls.off=ledger` as an array, and a
+    // configuration that only worked when it was repeated twice would be a trap.
+    const off = next.off as string | string[] | undefined;
+    config = {
+        ...next,
+        ...(off === undefined ? {} : {off: Array.isArray(off) ? off : [off]}),
+    };
+}
+
+/** The configuration in force, for a caller that has to explain it. */
+export function callTraceConfig(): CallTraceConfig {
+    return config;
+}
+
+/** Does `pattern` name this entry method? */
+function matches(pattern: string, entry: string): boolean {
+    if (pattern.length === 0) return false;
+    if (pattern === entry) return true;
+    // `payment` and `payment.*` mean the same thing — the whole namespace — and a
+    // bare name is what a configuration usually writes; the glob form exists so a
+    // pattern can end in `*` where that reads better.
+    const prefix = pattern.endsWith('.*') ? pattern.slice(0, -2) : pattern;
+    return entry === prefix || entry.startsWith(`${prefix}.`);
+}
+
+/**
+ * What the configuration says about an entry, when nothing else has decided.
+ *
+ * Only the configuration half of the decision: a capability already published for
+ * the flow settles the question before this is reached, and `semanticContext.ts`
+ * is where the two are put in order.
+ */
+export function callsPermitted(entry: string): boolean {
+    if (config.enabled === false) {
+        return false;
+    }
+    return !(config.off ?? []).some(pattern => matches(pattern, entry));
+}
+
+/**
+ * The envelope a call record carries.
+ *
+ * What it was when these records were written through the level API — `$meta` with
+ * `mtid: 'event'` and a method naming the leg and the phase — so nothing downstream
+ * of the channel had to learn a new format, and the ledger still reads a call out
+ * of the same two fields. The line beside it belongs to semantic-log, which hands
+ * it to the writer on the event; nothing here names a phase in prose.
+ */
+export function callRecord(leg: string, phase: CallPhase): Record<string, unknown> {
+    return {$meta: {mtid: 'event', method: `${leg}.${phase}`}};
+}

package/src/cliHelp.ts

@@ -17,6 +17,8 @@ Usage:
   blong <intent>...              Run with only the given intents (e.g. integration)
   blong realm <name> [--object]  Scaffold a new realm
   blong create realm <name>      Scaffold a new realm
+  blong grant <capability>       Mint a short-lived capability token
+                                 (e.g. blong grant calls --ttl=15m)
 
 Well-known intents:
   dev            Development — verbose logs, hot reload

package/src/devKeys.ts

@@ -0,0 +1,38 @@
+/**
+ * The framework's development-time gateway keys.
+ *
+ * Static, committed, and deliberately not secret: their job is that two
+ * processes started from the same checkout agree on the same key material, so a
+ * session survives a hot reload and a token minted by one command is the token a
+ * running server accepts. A deployment supplies its own through
+ * `GATEWAY_SIGN_KEY` / `GATEWAY_ENCRYPT_KEY` (see `Gateway.ts`), and this module
+ * is never consulted when they are set.
+ *
+ * They live here rather than inline in the `dev` intent because more than the
+ * loader needs them: `blong grant` mints a short-lived capability token with the
+ * same sign key the gateway verifies with, and a token minted with a key nobody
+ * else holds is a token that verifies nowhere.
+ */
+
+/* cSpell:disable */
+/** The `dev` intent's sign key (`ES384`, private: minting happens here too). */
+export const devSignKey = {
+    kty: 'EC',
+    crv: 'P-384',
+    alg: 'ES384',
+    use: 'sig',
+    x: 'VlRkjgqRHJSk9WN8CaAqHn34BUMy9pgKQUAAW9MrOqh0yvCmJW7JTr6LUCbm9zfW',
+    y: '8eYxbAZrv-HZEc4LSgdEHeSp21zO3D8KrynMcVcNAmZKTf3RMkbkh1B26lePHQNz',
+    d: 'aj6BkYmpwkKRbmcO1LO6d__HX5bvkqcRjqadlX7plXlGfj1d42XiSUWa4c9xrxwt',
+};
+/** The `dev` intent's encrypt key (`ECDH-ES+A256KW`). */
+export const devEncryptKey = {
+    kty: 'EC',
+    crv: 'P-384',
+    alg: 'ECDH-ES+A256KW',
+    use: 'enc',
+    x: '86IBoWsatO3Vky9CRMxmuYcfYoTY1Yr0D1sJGDgLlREMjbL9cIOHcBQnEaW52QJV',
+    y: 'fsKOmTuXaIRFXXteh7uU0Z8mncX4VsPhqaz9pMKMm8EktQlF7HBS_fYFdkLwqMMN',
+    d: 'rBY50TZzjONw_oYzWPqaR3DdoFwO-F9sWcmkOltrJHYnfbnTojNImX2xN1DhhC5-',
+};
+/* cSpell:enable */