@kici-dev/compiler 0.0.0 → 0.1.1

package/dist/remote/client.d.ts

@@ -0,0 +1,204 @@
+/**
+ * REST client for communicating with the KiCI orchestrator.
+ *
+ * Provides typed methods for triggering test runs, cancelling runs,
+ * managing uploads, and checking run status.
+ */
+export declare class AuthenticationError extends Error {
+    constructor(message?: string);
+}
+export declare class NotFoundError extends Error {
+    constructor(message?: string);
+}
+export declare class ServerError extends Error {
+    statusCode?: number | undefined;
+    constructor(message?: string, statusCode?: number | undefined);
+}
+export declare class ConnectionError extends Error {
+    endpoint?: string | undefined;
+    constructor(message: string, endpoint?: string | undefined);
+}
+export interface TestTriggerInput {
+    fixtureId: string;
+    event: {
+        type: string;
+        action?: string;
+        targetBranch: string;
+        sourceBranch?: string;
+        payload: Record<string, unknown>;
+        changedFiles?: string[];
+    };
+    routingKey: string;
+    uploadId?: string;
+    /** CLI's ephemeral public key (base64, SPKI/DER) for overlay decryption */
+    cliPublicKey?: string;
+    secrets?: Record<string, string>;
+    workflowName?: string;
+    /** JSON-stringified lock file content for repos with no remote. */
+    inlineLockFile?: string;
+    /** When true, repo has no remote -- agent uses overlay tarball as full workspace. */
+    fullRepo?: boolean;
+}
+export interface TestTriggerResponse {
+    runId: string;
+    observeUrl: string;
+    status: 'accepted' | 'rejected';
+    reason?: string;
+    jobIds?: string[];
+}
+export interface TestCancelResponse {
+    status: 'cancelled' | 'not_found' | 'already_complete';
+    cancelledJobs?: number;
+}
+interface UploadInitInput {
+    routingKey: string;
+    sha?: string;
+    fileCount?: number;
+    compressedSize?: number;
+}
+interface UploadInitResponse {
+    uploadId: string;
+    signedUrl: string;
+    publicKey: string;
+    expiresIn: number;
+}
+interface UploadStatusResponse {
+    uploadId: string;
+    status: string;
+    routingKey?: string;
+    sha?: string | null;
+    fileCount?: number | null;
+    compressedSize?: number | null;
+}
+export interface RunStatusResponse {
+    runId: string;
+    status: string;
+    summary?: {
+        totalDurationMs: number;
+        jobs: Array<{
+            name: string;
+            status: string;
+            durationMs?: number;
+        }>;
+    };
+}
+export interface RunLogsResponse {
+    runId: string;
+    status: string;
+    /** Present when the run is still active — connect via WebSocket for live streaming. */
+    observeUrl?: string;
+    /** Present when the run is terminal — historical log entries. */
+    logs?: Array<{
+        jobName: string;
+        stepIndex: number;
+        stepName: string;
+        lines: string[];
+    }>;
+}
+export interface RegistrationItem {
+    id: string;
+    repoIdentifier: string;
+    workflowName: string;
+    triggerTypes: string[];
+    triggers: unknown[];
+    lastTriggeredAt: string | null;
+    nextFireAt: string | null;
+    sourceRepos: string[];
+    createdAt: string;
+    updatedAt: string;
+}
+interface RegistrationsListResponse {
+    registrations: RegistrationItem[];
+    registryVersion: number;
+    registryUpdatedAt: string;
+}
+interface OrchestratorClientConfig {
+    endpoint: string;
+    token: string;
+}
+/**
+ * Orchestrator capability manifest returned by `GET /api/v1/capabilities`.
+ *
+ * All fields are optional because the endpoint may not exist on older
+ * orchestrators. Callers treat missing fields as "unknown" and format an
+ * error that says so rather than failing hard.
+ */
+export interface OrchestratorCapabilities {
+    orchestratorVersion?: string;
+    protocolVersion?: number;
+    minProtocolVersion?: number;
+}
+/**
+ * REST client for the KiCI orchestrator API.
+ *
+ * Handles authentication, request formatting, and typed response parsing
+ * for all test-trigger and upload operations.
+ */
+export declare class OrchestratorClient {
+    private readonly baseUrl;
+    private readonly token;
+    private cachedCapabilities?;
+    constructor(config: OrchestratorClientConfig);
+    /**
+     * Fetch the orchestrator's capability manifest.
+     *
+     * Never throws — on any failure (old orchestrator returning 404, network
+     * error, malformed JSON) it returns an empty manifest. Callers use the
+     * returned fields to format actionable capability-gap errors and treat
+     * missing fields as "unknown".
+     *
+     * Memoised per client instance so repeated calls in a single CLI session
+     * hit the orchestrator once.
+     */
+    getCapabilities(): Promise<OrchestratorCapabilities>;
+    private fetchCapabilities;
+    /**
+     * Trigger a test run on the orchestrator.
+     *
+     * POST /api/v1/test/trigger
+     */
+    triggerTest(input: TestTriggerInput): Promise<TestTriggerResponse>;
+    /**
+     * Cancel a running test run.
+     *
+     * POST /api/v1/test/cancel
+     */
+    cancelTest(runId: string): Promise<TestCancelResponse>;
+    /**
+     * Initialize an upload and get a pre-signed URL.
+     *
+     * POST /api/v1/uploads/init
+     */
+    initUpload(opts: UploadInitInput): Promise<UploadInitResponse>;
+    /**
+     * Get the status of an upload.
+     *
+     * GET /api/v1/uploads/:uploadId/status
+     */
+    getUploadStatus(uploadId: string): Promise<UploadStatusResponse>;
+    /**
+     * List workflow registrations for an organization.
+     *
+     * GET /api/v1/orgs/:orgId/registrations
+     */
+    getRegistrations(orgId: string, filters?: Record<string, string>): Promise<RegistrationsListResponse>;
+    /**
+     * Get the status of a test run (polling fallback).
+     *
+     * GET /api/v1/test/runs/:runId
+     */
+    getRunStatus(runId: string): Promise<RunStatusResponse>;
+    /**
+     * Get logs for a test run.
+     *
+     * GET /api/v1/test/runs/:runId/logs
+     */
+    getRunLogs(runId: string, jobFilter?: string): Promise<RunLogsResponse>;
+    /**
+     * Make an authenticated request to the orchestrator.
+     * Handles error classification and connection errors.
+     */
+    private request;
+}
+export {};
+//# sourceMappingURL=client.d.ts.map

package/dist/remote/client.js

@@ -0,0 +1,203 @@
+import "../chunk-gOLHoazu.js";
+import { toErrorMessage } from "@kici-dev/shared";
+//#region src/remote/client.ts
+/**
+* REST client for communicating with the KiCI orchestrator.
+*
+* Provides typed methods for triggering test runs, cancelling runs,
+* managing uploads, and checking run status.
+*/
+var AuthenticationError = class extends Error {
+	constructor(message = "Invalid API key. Run `kici login` to authenticate.") {
+		super(message);
+		this.name = "AuthenticationError";
+	}
+};
+var AccessDeniedError = class extends Error {
+	constructor(message = "Access denied") {
+		super(message);
+		this.name = "AccessDeniedError";
+	}
+};
+var NotFoundError = class extends Error {
+	constructor(message = "Resource not found") {
+		super(message);
+		this.name = "NotFoundError";
+	}
+};
+var ServerError = class extends Error {
+	constructor(message = "Server error", statusCode) {
+		super(message);
+		this.statusCode = statusCode;
+		this.name = "ServerError";
+	}
+};
+var ConnectionError = class extends Error {
+	constructor(message, endpoint) {
+		super(message);
+		this.endpoint = endpoint;
+		this.name = "ConnectionError";
+	}
+};
+/**
+* REST client for the KiCI orchestrator API.
+*
+* Handles authentication, request formatting, and typed response parsing
+* for all test-trigger and upload operations.
+*/
+var OrchestratorClient = class {
+	baseUrl;
+	token;
+	cachedCapabilities;
+	constructor(config) {
+		this.baseUrl = config.endpoint.replace(/\/+$/, "");
+		this.token = config.token;
+	}
+	/**
+	* Fetch the orchestrator's capability manifest.
+	*
+	* Never throws — on any failure (old orchestrator returning 404, network
+	* error, malformed JSON) it returns an empty manifest. Callers use the
+	* returned fields to format actionable capability-gap errors and treat
+	* missing fields as "unknown".
+	*
+	* Memoised per client instance so repeated calls in a single CLI session
+	* hit the orchestrator once.
+	*/
+	async getCapabilities() {
+		if (!this.cachedCapabilities) this.cachedCapabilities = this.fetchCapabilities();
+		return this.cachedCapabilities;
+	}
+	async fetchCapabilities() {
+		const url = `${this.baseUrl}/api/v1/capabilities`;
+		try {
+			const response = await fetch(url);
+			if (!response.ok) return {};
+			const body = await response.json();
+			return {
+				orchestratorVersion: typeof body.orchestratorVersion === "string" ? body.orchestratorVersion : void 0,
+				protocolVersion: typeof body.protocolVersion === "number" ? body.protocolVersion : void 0,
+				minProtocolVersion: typeof body.minProtocolVersion === "number" ? body.minProtocolVersion : void 0
+			};
+		} catch {
+			return {};
+		}
+	}
+	/**
+	* Trigger a test run on the orchestrator.
+	*
+	* POST /api/v1/test/trigger
+	*/
+	async triggerTest(input) {
+		return await (await this.request("/api/v1/test/trigger", {
+			method: "POST",
+			body: JSON.stringify(input)
+		})).json();
+	}
+	/**
+	* Cancel a running test run.
+	*
+	* POST /api/v1/test/cancel
+	*/
+	async cancelTest(runId) {
+		return await (await this.request("/api/v1/test/cancel", {
+			method: "POST",
+			body: JSON.stringify({ runId })
+		})).json();
+	}
+	/**
+	* Initialize an upload and get a pre-signed URL.
+	*
+	* POST /api/v1/uploads/init
+	*/
+	async initUpload(opts) {
+		return await (await this.request("/api/v1/uploads/init", {
+			method: "POST",
+			body: JSON.stringify(opts)
+		})).json();
+	}
+	/**
+	* Get the status of an upload.
+	*
+	* GET /api/v1/uploads/:uploadId/status
+	*/
+	async getUploadStatus(uploadId) {
+		return await (await this.request(`/api/v1/uploads/${uploadId}/status`, { method: "GET" })).json();
+	}
+	/**
+	* List workflow registrations for an organization.
+	*
+	* GET /api/v1/orgs/:orgId/registrations
+	*/
+	async getRegistrations(orgId, filters) {
+		const query = new URLSearchParams(filters).toString();
+		const path = `/api/v1/orgs/${orgId}/registrations${query ? `?${query}` : ""}`;
+		return await (await this.request(path, { method: "GET" })).json();
+	}
+	/**
+	* Get the status of a test run (polling fallback).
+	*
+	* GET /api/v1/test/runs/:runId
+	*/
+	async getRunStatus(runId) {
+		return await (await this.request(`/api/v1/test/runs/${runId}`, { method: "GET" })).json();
+	}
+	/**
+	* Get logs for a test run.
+	*
+	* GET /api/v1/test/runs/:runId/logs
+	*/
+	async getRunLogs(runId, jobFilter) {
+		const query = jobFilter ? `?job=${encodeURIComponent(jobFilter)}` : "";
+		return await (await this.request(`/api/v1/test/runs/${runId}/logs${query}`, { method: "GET" })).json();
+	}
+	/**
+	* Make an authenticated request to the orchestrator.
+	* Handles error classification and connection errors.
+	*/
+	async request(path, init) {
+		const url = `${this.baseUrl}${path}`;
+		let response;
+		try {
+			response = await fetch(url, {
+				...init,
+				headers: {
+					"Content-Type": "application/json",
+					Authorization: `Bearer ${this.token}`,
+					...init.headers
+				}
+			});
+		} catch (err) {
+			const message = toErrorMessage(err);
+			throw new ConnectionError(`Failed to connect to orchestrator at ${this.baseUrl}: ${message}`, this.baseUrl);
+		}
+		if (response.ok) return response;
+		if (response.status === 401) throw new AuthenticationError();
+		if (response.status === 403) {
+			let detail = "Access denied";
+			try {
+				const body = await response.json();
+				if (body.error) detail = body.error;
+			} catch {}
+			throw new AccessDeniedError(detail);
+		}
+		if (response.status === 404) throw new NotFoundError();
+		if (response.status >= 500) {
+			let detail = `Server error (${response.status})`;
+			try {
+				const body = await response.json();
+				if (body.error) detail = `${body.error} (${response.status})`;
+			} catch {}
+			throw new ServerError(`${detail}. The orchestrator may be temporarily unavailable -- try again in a moment.`, response.status);
+		}
+		let bodyText = "";
+		try {
+			bodyText = await response.text();
+		} catch {}
+		throw new Error(`Request failed with status ${response.status}: ${bodyText}`);
+	}
+};
+//#endregion
+export { AuthenticationError, ConnectionError, NotFoundError, OrchestratorClient, ServerError };
+
+//# sourceMappingURL=client.js.map

package/dist/remote/config.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Global KiCI configuration stored in ~/.kici/config.
+ * Contains authentication tokens and endpoint settings.
+ */
+export interface GlobalConfig {
+    /** API key for authentication (legacy) */
+    token?: string;
+    /** Orchestrator URL for direct mode */
+    endpoint?: string;
+    /** Platform relay URL */
+    platformEndpoint?: string;
+    /** Connection mode: 'platform' or 'direct' */
+    connectionMode?: 'platform' | 'direct';
+    /** Routing key for webhook source identification (e.g., 'github:42') */
+    routingKey?: string;
+    /** Personal access token (from OAuth login) */
+    pat?: string;
+    /** PAT identifier (server-side ID) */
+    patId?: string;
+    /** PAT expiry timestamp (ISO 8601) */
+    patExpiresAt?: string;
+    /** Active organization ID */
+    activeOrgId?: string;
+    /** User email from OIDC token */
+    userEmail?: string;
+}
+/**
+ * Returns the global KiCI config directory path.
+ * Checks KICI_CONFIG_DIR env var first, falls back to ~/.kici.
+ */
+export declare function getConfigDir(): string;
+/**
+ * Returns the path to the global config file (~/.kici/config).
+ */
+export declare function getConfigPath(): string;
+/**
+ * Load the global KiCI config from ~/.kici/config.
+ * Returns an empty object if the file does not exist.
+ * Unknown keys are stripped; invalid values are ignored.
+ */
+export declare function loadGlobalConfig(): Promise<GlobalConfig>;
+/**
+ * Save the global KiCI config to ~/.kici/config.
+ * Creates the config directory if needed.
+ * Sets file permissions to 0o600 (owner read/write only) since it contains tokens.
+ */
+export declare function saveGlobalConfig(config: GlobalConfig): Promise<void>;
+/**
+ * Merge partial config into the existing global config.
+ * Loads existing config, merges with the partial, saves, and returns the merged result.
+ * Undefined values in the partial are ignored (existing values preserved).
+ */
+export declare function mergeGlobalConfig(partial: Partial<GlobalConfig>): Promise<GlobalConfig>;
+//# sourceMappingURL=config.d.ts.map

package/dist/remote/config.js

@@ -0,0 +1,92 @@
+import "../chunk-gOLHoazu.js";
+import fs from "node:fs/promises";
+import path from "node:path";
+import os from "node:os";
+//#region src/remote/config.ts
+const VALID_CONNECTION_MODES = ["platform", "direct"];
+/**
+* Strips unknown keys and validates known fields from a raw config object.
+* Returns a clean GlobalConfig with only recognized, valid fields.
+*/
+function sanitizeConfig(raw) {
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return {};
+	const obj = raw;
+	const config = {};
+	if (typeof obj.token === "string") config.token = obj.token;
+	if (typeof obj.endpoint === "string") config.endpoint = obj.endpoint;
+	if (typeof obj.platformEndpoint === "string") config.platformEndpoint = obj.platformEndpoint;
+	if (typeof obj.connectionMode === "string" && VALID_CONNECTION_MODES.includes(obj.connectionMode)) config.connectionMode = obj.connectionMode;
+	if (typeof obj.routingKey === "string") config.routingKey = obj.routingKey;
+	if (typeof obj.pat === "string") config.pat = obj.pat;
+	if (typeof obj.patId === "string") config.patId = obj.patId;
+	if (typeof obj.patExpiresAt === "string") config.patExpiresAt = obj.patExpiresAt;
+	if (typeof obj.activeOrgId === "string") config.activeOrgId = obj.activeOrgId;
+	if (typeof obj.userEmail === "string") config.userEmail = obj.userEmail;
+	return config;
+}
+/**
+* Returns the global KiCI config directory path.
+* Checks KICI_CONFIG_DIR env var first, falls back to ~/.kici.
+*/
+function getConfigDir() {
+	if (process.env.KICI_CONFIG_DIR) return process.env.KICI_CONFIG_DIR;
+	return path.join(os.homedir(), ".kici");
+}
+/**
+* Returns the path to the global config file (~/.kici/config).
+*/
+function getConfigPath() {
+	return path.join(getConfigDir(), "config");
+}
+/**
+* Load the global KiCI config from ~/.kici/config.
+* Returns an empty object if the file does not exist.
+* Unknown keys are stripped; invalid values are ignored.
+*/
+async function loadGlobalConfig() {
+	const configPath = getConfigPath();
+	try {
+		const content = await fs.readFile(configPath, "utf-8");
+		return sanitizeConfig(JSON.parse(content));
+	} catch (err) {
+		if (err instanceof Error && "code" in err && err.code === "ENOENT") return {};
+		if (err instanceof SyntaxError) throw new Error(`Config file at ${configPath} contains invalid JSON. Delete it and re-run \`kici login\` to authenticate.`);
+		throw err;
+	}
+}
+/**
+* Save the global KiCI config to ~/.kici/config.
+* Creates the config directory if needed.
+* Sets file permissions to 0o600 (owner read/write only) since it contains tokens.
+*/
+async function saveGlobalConfig(config) {
+	const configDir = getConfigDir();
+	await fs.mkdir(configDir, { recursive: true });
+	const configPath = getConfigPath();
+	const content = JSON.stringify(config, null, 2) + "\n";
+	await fs.writeFile(configPath, content, { mode: 384 });
+}
+/**
+* Merge partial config into the existing global config.
+* Loads existing config, merges with the partial, saves, and returns the merged result.
+* Undefined values in the partial are ignored (existing values preserved).
+*/
+async function mergeGlobalConfig(partial) {
+	const merged = { ...await loadGlobalConfig() };
+	if (partial.token !== void 0) merged.token = partial.token;
+	if (partial.endpoint !== void 0) merged.endpoint = partial.endpoint;
+	if (partial.platformEndpoint !== void 0) merged.platformEndpoint = partial.platformEndpoint;
+	if (partial.connectionMode !== void 0) merged.connectionMode = partial.connectionMode;
+	if (partial.routingKey !== void 0) merged.routingKey = partial.routingKey;
+	if (partial.pat !== void 0) merged.pat = partial.pat;
+	if (partial.patId !== void 0) merged.patId = partial.patId;
+	if (partial.patExpiresAt !== void 0) merged.patExpiresAt = partial.patExpiresAt;
+	if (partial.activeOrgId !== void 0) merged.activeOrgId = partial.activeOrgId;
+	if (partial.userEmail !== void 0) merged.userEmail = partial.userEmail;
+	await saveGlobalConfig(merged);
+	return merged;
+}
+//#endregion
+export { getConfigDir, getConfigPath, loadGlobalConfig, mergeGlobalConfig, saveGlobalConfig };
+
+//# sourceMappingURL=config.js.map

package/dist/remote/encryption.d.ts

@@ -0,0 +1,35 @@
+import { deriveSharedSecret } from '@kici-dev/shared';
+export { deriveSharedSecret };
+/**
+ * Generate an ephemeral X25519 keypair.
+ * Keys are exported as DER buffers for compact wire format.
+ */
+export declare function generateEphemeralKeypair(): {
+    publicKey: Buffer;
+    privateKey: Buffer;
+};
+/**
+ * Encrypt a tarball file using X25519 ECDH + AES-256-GCM.
+ *
+ * Generates an ephemeral CLI keypair, derives a shared secret with the
+ * orchestrator's public key, and encrypts the tarball.
+ *
+ * Wire format: [12-byte IV][16-byte auth tag][ciphertext]
+ *
+ * @returns The encrypted file path and the CLI's ephemeral public key
+ *          (the agent needs this to derive the same shared secret for decryption).
+ */
+export declare function encryptTarball(tarballPath: string, orchestratorPublicKey: Buffer): Promise<{
+    encryptedPath: string;
+    cliPublicKey: Buffer;
+}>;
+/**
+ * Decrypt an encrypted tarball using X25519 ECDH + AES-256-GCM.
+ *
+ * Derives the same shared secret from the orchestrator's private key
+ * and the CLI's ephemeral public key.
+ *
+ * @returns The path to the decrypted file (encrypted path with .enc suffix removed).
+ */
+export declare function decryptTarball(encryptedPath: string, cliPublicKey: Buffer, orchestratorPrivateKey: Buffer): Promise<string>;
+//# sourceMappingURL=encryption.d.ts.map

package/dist/remote/encryption.js

@@ -0,0 +1,87 @@
+import "../chunk-gOLHoazu.js";
+import fs from "node:fs/promises";
+import { deriveSharedSecret } from "@kici-dev/shared";
+import crypto from "node:crypto";
+//#region src/remote/encryption.ts
+/**
+* Wire format for encrypted tarballs:
+* [12-byte IV][16-byte auth tag][ciphertext]
+*
+* Uses AES-256-GCM with X25519 ECDH key exchange.
+* Same pattern as engine/src/secrets/crypto.ts.
+*/
+const IV_LENGTH = 12;
+const AUTH_TAG_LENGTH = 16;
+/**
+* Generate an ephemeral X25519 keypair.
+* Keys are exported as DER buffers for compact wire format.
+*/
+function generateEphemeralKeypair() {
+	const { publicKey, privateKey } = crypto.generateKeyPairSync("x25519");
+	return {
+		publicKey: Buffer.from(publicKey.export({
+			type: "spki",
+			format: "der"
+		})),
+		privateKey: Buffer.from(privateKey.export({
+			type: "pkcs8",
+			format: "der"
+		}))
+	};
+}
+/**
+* Encrypt a tarball file using X25519 ECDH + AES-256-GCM.
+*
+* Generates an ephemeral CLI keypair, derives a shared secret with the
+* orchestrator's public key, and encrypts the tarball.
+*
+* Wire format: [12-byte IV][16-byte auth tag][ciphertext]
+*
+* @returns The encrypted file path and the CLI's ephemeral public key
+*          (the agent needs this to derive the same shared secret for decryption).
+*/
+async function encryptTarball(tarballPath, orchestratorPublicKey) {
+	const { publicKey: cliPublicKey, privateKey: cliPrivateKey } = generateEphemeralKeypair();
+	const aesKey = deriveSharedSecret(cliPrivateKey, orchestratorPublicKey);
+	const plaintext = await fs.readFile(tarballPath);
+	const iv = crypto.randomBytes(IV_LENGTH);
+	const cipher = crypto.createCipheriv("aes-256-gcm", aesKey, iv);
+	const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+	const authTag = cipher.getAuthTag();
+	const encrypted = Buffer.concat([
+		iv,
+		authTag,
+		ciphertext
+	]);
+	const encryptedPath = `${tarballPath}.enc`;
+	await fs.writeFile(encryptedPath, encrypted);
+	return {
+		encryptedPath,
+		cliPublicKey
+	};
+}
+/**
+* Decrypt an encrypted tarball using X25519 ECDH + AES-256-GCM.
+*
+* Derives the same shared secret from the orchestrator's private key
+* and the CLI's ephemeral public key.
+*
+* @returns The path to the decrypted file (encrypted path with .enc suffix removed).
+*/
+async function decryptTarball(encryptedPath, cliPublicKey, orchestratorPrivateKey) {
+	const aesKey = deriveSharedSecret(orchestratorPrivateKey, cliPublicKey);
+	const encrypted = await fs.readFile(encryptedPath);
+	const iv = encrypted.subarray(0, IV_LENGTH);
+	const authTag = encrypted.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);
+	const ciphertext = encrypted.subarray(IV_LENGTH + AUTH_TAG_LENGTH);
+	const decipher = crypto.createDecipheriv("aes-256-gcm", aesKey, iv);
+	decipher.setAuthTag(authTag);
+	const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+	const decryptedPath = encryptedPath.endsWith(".enc") ? encryptedPath.slice(0, -4) : `${encryptedPath}.dec`;
+	await fs.writeFile(decryptedPath, decrypted);
+	return decryptedPath;
+}
+//#endregion
+export { decryptTarball, deriveSharedSecret, encryptTarball, generateEphemeralKeypair };
+
+//# sourceMappingURL=encryption.js.map