@jevitate/cli 0.1.0

package/dist/source-api.js

@@ -0,0 +1,208 @@
+import { execFile } from "node:child_process";
+import { mkdir } from "node:fs/promises";
+import { promisify } from "node:util";
+import { FsJourneyStore, JourneyRegistry } from "@jevitate/journey";
+import { GitSourceManager, RemoteSource, UnknownSourceError, collectNavigateOrigins, loadManifest, publishJourney, readLock, surfaceForAck, writeLock, } from "@jevitate/sources";
+import { UnknownJourneyError } from "./journey-api.js";
+const execFileAsync = promisify(execFile);
+/**
+ * A publish was requested for a Journey that exists locally but has not been
+ * promoted. Publishing shares a Journey with the world — only reviewed,
+ * promoted Journeys may leave this machine (spec §7). Kept distinct from
+ * `UnknownJourneyError` so the CLI can emit a precise error code without
+ * string-matching.
+ */
+export class NotPromotedError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "NotPromotedError";
+    }
+}
+/**
+ * A publish request resolved to zero declared origins — the Journey has no
+ * absolute `navigate` origin and none were supplied with `--declare-origin`.
+ * A `SharedJourneyFile` MUST declare at least one origin, so this fails
+ * closed BEFORE `validateForPublish` (whose Zod error would be opaque).
+ */
+export class NoDeclaredOriginsError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "NoDeclaredOriginsError";
+    }
+}
+function mgrOf(deps) {
+    return new GitSourceManager(deps.sourcesDir, deps.git);
+}
+function nowIso(deps) {
+    return (deps.now ?? (() => new Date().toISOString()))();
+}
+/**
+ * Resolves a source `name` to its recorded `SourceEntry`, or throws
+ * `UnknownSourceError` (fail-closed, FMECA #5) — a source the lock does not
+ * know about is never silently treated as empty/absent. Reused by every
+ * command that operates on an existing source (pull/update/remove/trust/
+ * publish).
+ */
+async function requireEntry(lockPath, name) {
+    const lock = await readLock(lockPath);
+    const entry = lock.sources.find((s) => s.name === name);
+    if (!entry) {
+        throw new UnknownSourceError(`source '${name}' is not registered (run 'jevitate source add' first)`);
+    }
+    return entry;
+}
+/**
+ * Clones a remote Journey source, pins it at its current HEAD, and records the
+ * pin in the lock. Adding a source NEVER trusts its Journeys (trust is a
+ * separate, explicit `source trust` act) — it only registers the source.
+ * The source's Terms of Use are surfaced for the human; a `TouAck` is
+ * recorded ONLY when `acceptTou` is set, so the run-gate stays fail-closed
+ * until the user has explicitly accepted.
+ */
+export async function addSource(deps, req) {
+    const mgr = mgrOf(deps);
+    await mkdir(deps.sourcesDir, { recursive: true });
+    const pinnedCommit = await mgr.add(req.name, req.gitUrl);
+    const manifest = await loadManifest(mgr.resolveDir(req.name));
+    const touSurface = surfaceForAck(manifest, req.gitUrl);
+    let touAccepted = false;
+    if (req.acceptTou) {
+        await deps.ack.put({
+            sourceName: req.name,
+            gitUrl: req.gitUrl,
+            origins: manifest.sites.map((s) => s.origin),
+            ackedBy: req.ackedBy ?? "local",
+            ackedAtIso: nowIso(deps),
+        });
+        touAccepted = true;
+    }
+    const lock = await readLock(deps.lockPath);
+    const sources = lock.sources.filter((s) => s.name !== req.name);
+    sources.push({ name: req.name, gitUrl: req.gitUrl, pinnedCommit });
+    await writeLock(deps.lockPath, { version: 1, sources });
+    return { name: req.name, gitUrl: req.gitUrl, pinnedCommit, touSurface, touAccepted };
+}
+/** Lists every registered source (from the lock), annotated with which of its
+ *  Journeys the local user has explicitly trusted. */
+export async function listSources(deps) {
+    const lock = await readLock(deps.lockPath);
+    const trustRecords = await deps.trust.list();
+    return lock.sources.map((s) => ({
+        ...s,
+        trustedJourneys: trustRecords
+            .filter((t) => t.sourceId === s.name)
+            .map((t) => t.journeyId)
+            .sort(),
+    }));
+}
+/** Fetches new refs for a registered source without moving its pin. */
+export async function pullSource(deps, name) {
+    const entry = await requireEntry(deps.lockPath, name);
+    await mgrOf(deps).pull(name);
+    return { name, pulled: true, pinnedCommit: entry.pinnedCommit, pinAdvanced: false };
+}
+/** The ONLY way a pin advances: fetch + fast-forward, then record the new pin
+ *  in the lock. Explicit and per-source — never automatic. */
+export async function updateSource(deps, name) {
+    await requireEntry(deps.lockPath, name);
+    const pinnedCommit = await mgrOf(deps).update(name);
+    const lock = await readLock(deps.lockPath);
+    const sources = lock.sources.map((s) => (s.name === name ? { ...s, pinnedCommit } : s));
+    await writeLock(deps.lockPath, { version: 1, sources });
+    return { name, pinnedCommit };
+}
+/** Removes a source's clone and its lock entry. Local `TrustRecord`s are left
+ *  intact (they are hash-bound and harmless; re-adding the same content
+ *  re-uses them, a content change invalidates them). */
+export async function removeSource(deps, name) {
+    await requireEntry(deps.lockPath, name);
+    await mgrOf(deps).remove(name);
+    const lock = await readLock(deps.lockPath);
+    const sources = lock.sources.filter((s) => s.name !== name);
+    await writeLock(deps.lockPath, { version: 1, sources });
+    return { name, removed: true };
+}
+/**
+ * Records an explicit, human trust decision for one Journey in a source,
+ * BOUND to the Journey's CURRENT content hash at the recorded pin (spec §5,
+ * FMECA #2 TOCTOU). Trust is the single explicit user act that lets a source's
+ * risky Journey run: it never happens implicitly on `add`/`pull`/`update`, and
+ * a later content change invalidates it (the run-gate recomputes the hash).
+ */
+export async function trustJourney(deps, req) {
+    const entry = await requireEntry(deps.lockPath, req.sourceName);
+    const mgr = mgrOf(deps);
+    // Pin the clone to the exact recorded commit before reading, so the hash we
+    // bind trust to is the content AT the pin, not a drifted working tree.
+    await mgr.checkout(req.sourceName, entry.pinnedCommit);
+    const remote = new RemoteSource(req.sourceName, mgr.resolveDir(req.sourceName), entry.pinnedCommit);
+    const sourced = await remote.get(req.journeyId);
+    if (!sourced) {
+        throw new UnknownJourneyError(`source '${req.sourceName}' has no journey '${req.journeyId}'`);
+    }
+    const record = {
+        sourceId: req.sourceName,
+        journeyId: req.journeyId,
+        contentHash: sourced.meta.contentHash,
+        approvedBy: req.approvedBy,
+        approvedAtIso: nowIso(deps),
+    };
+    await deps.trust.put(record);
+    return record;
+}
+/**
+ * Publishes a promoted local Journey to a registered distributed source via
+ * `@jevitate/sources`' `publishJourney`. Preserves every publish-side guard:
+ *  - the target source must be REGISTERED (`UnknownSourceError` otherwise);
+ *  - the Journey must exist and be PROMOTED (`NotPromotedError`);
+ *  - `publishJourney`/`validateForPublish` then hard-block a materialized
+ *    (non-redacted) secret value (`EmbeddedSecretError`) and any origin the
+ *    steps touch but `declaredOrigins` does not cover (`UndeclaredOriginError`).
+ * The write always lands on a NEW `publish/<id>` branch — never a default
+ * branch — and degrades gracefully to instructions when `gh` is absent.
+ */
+export async function publishJourneyToSource(deps, req) {
+    await requireEntry(deps.lockPath, req.toSource);
+    const registry = new JourneyRegistry(new FsJourneyStore(req.journeysDir));
+    const journey = await registry.get(req.id);
+    if (!journey) {
+        throw new UnknownJourneyError(`unknown journey '${req.id}'`);
+    }
+    if (!journey.metadata.promoted) {
+        throw new NotPromotedError(`journey '${req.id}' is not promoted; promote it before publishing`);
+    }
+    const declaredOrigins = req.declareOrigins && req.declareOrigins.length > 0
+        ? req.declareOrigins
+        : collectNavigateOrigins(journey.recording);
+    if (declaredOrigins.length === 0) {
+        throw new NoDeclaredOriginsError(`journey '${req.id}' declares no origins and navigates to no absolute origin; pass --declare-origin <origin>`);
+    }
+    return publishJourney(mgrOf(deps), deps.gh, {
+        journey,
+        declaredOrigins,
+        toSource: req.toSource,
+        asId: req.asId,
+    });
+}
+/**
+ * Real `gh` CLI port for `publishJourney`. Degrades gracefully: `available()`
+ * is false when `gh` isn't installed/authenticated, so publish falls back to
+ * printed branch+push instructions instead of failing (spec §14.3). Shells via
+ * `execFile` with an ARGS ARRAY only — never a shell string.
+ */
+export const realGhPort = {
+    async available() {
+        try {
+            await execFileAsync("gh", ["auth", "status"]);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
+    async createPr(cwd, branch, title) {
+        const { stdout } = await execFileAsync("gh", ["pr", "create", "--head", branch, "--title", title, "--body", title], { cwd });
+        return stdout.trim();
+    },
+};
+//# sourceMappingURL=source-api.js.map

package/dist/source-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-api.js","sourceRoot":"","sources":["../src/source-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,sBAAsB,EACtB,YAAY,EACZ,cAAc,EACd,QAAQ,EACR,aAAa,EACb,SAAS,GASV,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAwBD,SAAS,KAAK,CAAC,IAAmB;IAChC,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,MAAM,CAAC,IAAmB;IACjC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,IAAY;IACxD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,kBAAkB,CAAC,WAAW,IAAI,uDAAuD,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAsBD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAmB,EAAE,GAAqB;IACxE,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAEvD,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QAClB,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YACjB,UAAU,EAAE,GAAG,CAAC,IAAI;YACpB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;YAC5C,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,OAAO;YAC/B,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC;SACzB,CAAC,CAAC;QACH,WAAW,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;IAChE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IACnE,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAExD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;AACvF,CAAC;AAOD;sDACsD;AACtD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAmB;IACnD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7C,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9B,GAAG,CAAC;QACJ,eAAe,EAAE,YAAY;aAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;aACvB,IAAI,EAAE;KACV,CAAC,CAAC,CAAC;AACN,CAAC;AAWD,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAmB,EAAE,IAAY;IAChE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACtD,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AACtF,CAAC;AAOD;8DAC8D;AAC9D,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAmB,EAAE,IAAY;IAClE,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxF,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACxD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAChC,CAAC;AAOD;;wDAEwD;AACxD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAmB,EAAE,IAAY;IAClE,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC5D,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACxD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACjC,CAAC;AAQD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAmB,EAAE,GAAwB;IAC9E,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACxB,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACpG,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAAC,WAAW,GAAG,CAAC,UAAU,qBAAqB,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,MAAM,GAAgB;QAC1B,QAAQ,EAAE,GAAG,CAAC,UAAU;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW;QACrC,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC;KAC5B,CAAC;IACF,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC;AAChB,CAAC;AAaD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAoC,EACpC,GAAkC;IAElC,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAAC,oBAAoB,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,gBAAgB,CAAC,YAAY,GAAG,CAAC,EAAE,iDAAiD,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,eAAe,GACnB,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;QACjD,CAAC,CAAC,GAAG,CAAC,cAAc;QACpB,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,sBAAsB,CAC9B,YAAY,GAAG,CAAC,EAAE,2FAA2F,CAC9G,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE;QAC1C,OAAO;QACP,eAAe;QACf,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,IAAI,EAAE,GAAG,CAAC,IAAI;KACf,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAW;IAChC,KAAK,CAAC,SAAS;QACb,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,GAAW,EAAE,MAAc,EAAE,KAAa;QACvD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CACpC,IAAI,EACJ,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,EACrE,EAAE,GAAG,EAAE,CACR,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;CACF,CAAC"}

package/dist/source-run-api.d.ts

@@ -0,0 +1,57 @@
+import { type RunPolicy } from "@jevitate/domain";
+import { type JourneyRunResult } from "@jevitate/runtime";
+import { type SharedJourneyFile } from "@jevitate/sources";
+import type { SourceApiDeps } from "./source-api.js";
+/**
+ * The runner seam for a source-resolved Journey. Takes the ALREADY-GATED
+ * `SharedJourneyFile` (`resolveForRun`'s output) — never a raw address or a
+ * store `dir` — so the security gate always runs BEFORE anything reaches this
+ * function. Injected as a fake in tests so unit tests never launch a real
+ * browser; production wires `realResolvedJourneyRunner`.
+ */
+export type RunResolvedJourney = (file: SharedJourneyFile, params: Record<string, string>, policy: RunPolicy) => Promise<JourneyRunResult>;
+/**
+ * The real, Playwright-backed runner for a gated source Journey. Mirrors
+ * `journey-api.ts`'s `runJourneyProgrammatically` exactly:
+ *  - validates params UP FRONT (`deriveParamSchema`/`validateParams`) before
+ *    any browser launch, so bad params never pay the cost/risk of a browser;
+ *  - opens a real `PlaywrightBrowserPort` scoped to the Journey's authorized
+ *    origins (the gate has already proven `declaredOrigins ⊆ manifest`);
+ *  - ALWAYS closes the session and removes the temp profile dir in `finally`
+ *    (matches the just-fixed profile-dir-leak pattern).
+ * A `SharedJourneyFile` IS a `Journey` (+ `declaredOrigins`), so it runs
+ * through the standard `JourneyRunner` unchanged.
+ */
+export declare const realResolvedJourneyRunner: RunResolvedJourney;
+/**
+ * Injected seams for `jevitate source run`. Reuses the distributed-sources
+ * `SourceApiDeps` (sources clone dir + lock + local trust/ack stores + the
+ * injectable `git` port) and adds a runner seam. Every field is injectable so
+ * unit tests never touch the network, the real home dir, `git`, or a real
+ * browser.
+ */
+export interface SourceRunApiDeps extends SourceApiDeps {
+    /** Runner seam; defaults to `realResolvedJourneyRunner` in production. */
+    runJourney?: RunResolvedJourney;
+}
+export interface RunSourceJourneyRequest {
+    sourceName: string;
+    journeyId: string;
+    params: Record<string, string>;
+    /** Defaults to `safeRunPolicy()` (Slice 1 fail-closed secret mode). */
+    policy?: RunPolicy;
+}
+/**
+ * Runs a Journey that lives in a trusted remote source — the ONE programmatic
+ * surface for `jevitate source run`. It NEVER bypasses the gate: it resolves
+ * the Journey through `@jevitate/sources`' real `resolveForRun`, which runs the
+ * full §9.8 "reviewed, pinned, in-origin, or refuse" ladder IN ORDER and THROWS
+ * a typed error on any failure (unknown source/id, hash mismatch/TOCTOU,
+ * untrusted-risky, undeclared origin, unacknowledged ToU, embedded secret).
+ * Only a `SharedJourneyFile` that passes EVERY gate reaches the runner seam.
+ *
+ * The clone is checked out to the EXACT recorded pin before the gate reads it,
+ * so the content the gate hashes is the content at the pin — not a drifted
+ * working tree (matches `trustJourney`).
+ */
+export declare function runSourceJourney(deps: SourceRunApiDeps, req: RunSourceJourneyRequest): Promise<JourneyRunResult>;

package/dist/source-run-api.js

@@ -0,0 +1,91 @@
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { deriveParamSchema, validateParams } from "@jevitate/journey";
+import { safeRunPolicy } from "@jevitate/domain";
+import { PlaywrightBrowserPort } from "@jevitate/playwright";
+import { CastActor, BrowseTheWeb } from "@jevitate/screenplay";
+import { RecordingInterpreter } from "@jevitate/interpreter";
+import { JourneyRunner } from "@jevitate/runtime";
+import { FederatedJourneyRegistry, GitSourceManager, RemoteSource, UnknownSourceError, loadManifest, readLock, resolveForRun, } from "@jevitate/sources";
+/**
+ * The real, Playwright-backed runner for a gated source Journey. Mirrors
+ * `journey-api.ts`'s `runJourneyProgrammatically` exactly:
+ *  - validates params UP FRONT (`deriveParamSchema`/`validateParams`) before
+ *    any browser launch, so bad params never pay the cost/risk of a browser;
+ *  - opens a real `PlaywrightBrowserPort` scoped to the Journey's authorized
+ *    origins (the gate has already proven `declaredOrigins ⊆ manifest`);
+ *  - ALWAYS closes the session and removes the temp profile dir in `finally`
+ *    (matches the just-fixed profile-dir-leak pattern).
+ * A `SharedJourneyFile` IS a `Journey` (+ `declaredOrigins`), so it runs
+ * through the standard `JourneyRunner` unchanged.
+ */
+export const realResolvedJourneyRunner = async (file, params, policy) => {
+    validateParams(deriveParamSchema(file.recording), params);
+    // The browser allowlist is the Journey's authorized origin set — the base
+    // site plus every gate-approved declared origin.
+    const allowedOrigins = [...new Set([file.recording.site, ...file.declaredOrigins])];
+    const profileDir = await mkdtemp(join(tmpdir(), "jevitate-source-run-"));
+    const port = new PlaywrightBrowserPort();
+    const session = await port.open({
+        profileDir,
+        headless: true,
+        allowedOrigins,
+        baseUrl: file.recording.site,
+    });
+    try {
+        const actor = CastActor.named("source-runner").whoCan(new BrowseTheWeb(session, allowedOrigins));
+        const runner = new JourneyRunner(actor, new RecordingInterpreter());
+        return await runner.run({ journey: file, params, policy });
+    }
+    finally {
+        await session.close();
+        await rm(profileDir, { recursive: true, force: true });
+    }
+};
+/** Resolves a registered source's recorded pin, or throws `UnknownSourceError`
+ *  (fail-closed) — a source the lock does not know about is never treated as
+ *  empty/absent. Mirrors `source-api.ts`'s private `requireEntry`. */
+async function requireEntry(lockPath, name) {
+    const lock = await readLock(lockPath);
+    const entry = lock.sources.find((s) => s.name === name);
+    if (!entry) {
+        throw new UnknownSourceError(`source '${name}' is not registered (run 'jevitate source add' first)`);
+    }
+    return entry;
+}
+/**
+ * Runs a Journey that lives in a trusted remote source — the ONE programmatic
+ * surface for `jevitate source run`. It NEVER bypasses the gate: it resolves
+ * the Journey through `@jevitate/sources`' real `resolveForRun`, which runs the
+ * full §9.8 "reviewed, pinned, in-origin, or refuse" ladder IN ORDER and THROWS
+ * a typed error on any failure (unknown source/id, hash mismatch/TOCTOU,
+ * untrusted-risky, undeclared origin, unacknowledged ToU, embedded secret).
+ * Only a `SharedJourneyFile` that passes EVERY gate reaches the runner seam.
+ *
+ * The clone is checked out to the EXACT recorded pin before the gate reads it,
+ * so the content the gate hashes is the content at the pin — not a drifted
+ * working tree (matches `trustJourney`).
+ */
+export async function runSourceJourney(deps, req) {
+    // Unknown/unregistered source -> UnknownSourceError, before any run.
+    const entry = await requireEntry(deps.lockPath, req.sourceName);
+    const mgr = new GitSourceManager(deps.sourcesDir, deps.git);
+    // Pin the clone to the recorded commit before the gate reads it (fail-closed:
+    // `checkout` propagates if the pinned commit is absent — never HEAD).
+    await mgr.checkout(req.sourceName, entry.pinnedCommit);
+    const remote = new RemoteSource(req.sourceName, mgr.resolveDir(req.sourceName), entry.pinnedCommit);
+    const fed = new FederatedJourneyRegistry([remote], deps.trust);
+    const gateDeps = {
+        fed,
+        trust: deps.trust,
+        manifestFor: (source) => loadManifest(mgr.resolveDir(source)),
+        ackFor: (source) => deps.ack.get(source),
+    };
+    // The full trust boundary: throws on any refusal, returns the validated,
+    // ready-to-run file only when every gate passes.
+    const file = await resolveForRun(gateDeps, `${req.sourceName}/${req.journeyId}`);
+    const run = deps.runJourney ?? realResolvedJourneyRunner;
+    return run(file, req.params, req.policy ?? safeRunPolicy());
+}
+//# sourceMappingURL=source-run-api.js.map

package/dist/source-run-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-run-api.js","sourceRoot":"","sources":["../src/source-run-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAkB,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAyB,MAAM,mBAAmB,CAAC;AACzE,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,YAAY,EACZ,QAAQ,EACR,aAAa,GAId,MAAM,mBAAmB,CAAC;AAgB3B;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAuB,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;IAC1F,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;IAE1D,0EAA0E;IAC1E,iDAAiD;IACjD,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAEpF,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,IAAI,qBAAqB,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC;QAC9B,UAAU;QACV,QAAQ,EAAE,IAAI;QACd,cAAc;QACd,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;QACjG,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,KAAK,EAAE,IAAI,oBAAoB,EAAE,CAAC,CAAC;QACpE,OAAO,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7D,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC,CAAC;AAsBF;;sEAEsE;AACtE,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,IAAY;IACxD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,kBAAkB,CAAC,WAAW,IAAI,uDAAuD,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAsB,EACtB,GAA4B;IAE5B,qEAAqE;IACrE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IAEhE,MAAM,GAAG,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,8EAA8E;IAC9E,sEAAsE;IACtE,MAAM,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAEvD,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IACpG,MAAM,GAAG,GAAG,IAAI,wBAAwB,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAE/D,MAAM,QAAQ,GAAgB;QAC5B,GAAG;QACH,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;KACzC,CAAC;IAEF,yEAAyE;IACzE,iDAAiD;IACjD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IAEjF,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,IAAI,yBAAyB,CAAC;IACzD,OAAO,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC,CAAC;AAC9D,CAAC"}

package/dist/ui-api.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The `jevitate ui` local HTTP server — the human-facing side of the HITL
+ * inbox. SM4 (loopback is NOT a trust boundary) is load-bearing here:
+ *  - bind 127.0.0.1 ONLY, on every path including the port-retry;
+ *  - every request is Host-checked (S-A), then every `/api/*` request is
+ *    capability-token-gated (S-B), before any routing happens;
+ *  - `GET /` sets a strict CSP (`default-src 'self'`) so the SPA MUST load
+ *    its JS from a same-origin `<script src="/app.js">` — no inline script;
+ *  - never logs `req.url` (it carries `?t=<token>`), request bodies, or
+ *    query strings — only `method <pathname> status`.
+ */
+export interface StartUiServerDeps {
+    /** Inbox store directory (`~/.jevitate/inbox` in production). Screenshots
+     *  are read from `<inboxDir>/screenshots/<id>.png`. */
+    inboxDir: string;
+    /** Accepted but ignored for the actual bind (SM4: 127.0.0.1 ONLY on every
+     *  path); kept in the signature for forward compatibility. */
+    host?: string;
+    /** Explicit port. When set, `EADDRINUSE` REJECTS the promise (no drift).
+     *  When unset, defaults to 4180 and retries the next port on conflict. */
+    port?: number;
+    /** Open the URL in the default browser once bound. Defaults to `true`.
+     *  Tests should always pass `false`. Fire-and-forget: a failed opener
+     *  (e.g. no `xdg-open` under WSL) never rejects `startUiServer`. */
+    open?: boolean;
+    /** Structured log sink: `method <pathname> status` lines only. */
+    logger?: (line: string) => void;
+}
+export interface UiServerHandle {
+    url: string;
+    token: string;
+    port: number;
+    close: () => Promise<void>;
+}
+export declare function startUiServer(deps: StartUiServerDeps): Promise<UiServerHandle>;