@kitman-sh/cli 0.9.0 → 0.10.53

package/dist/{chunk-snn0e1qb.js → chunk-eg8f5ncv.js}

@@ -4,9 +4,13 @@ import {
   runnerRpcUrl2,
   makeRunnerRpcClient2,
   makeProgramRpcClient2
-} from "./chunk-8bvf4fh4.js";
-import"./chunk-8z5b6fpd.js";
-import"./chunk-3gxahgnq.js";
+} from "./chunk-ctasxxz5.js";
+import"./chunk-x9dhxfts.js";
+import"./chunk-wh1pa2aa.js";
+import"./chunk-11p4wf6n.js";
+import"./chunk-pp1p3g6e.js";
+import"./chunk-arvwar2c.js";
+import"./chunk-mbctzx7e.js";
 export {
   makeProgramRpcClient2 as makeProgramRpcClient,
   makeRunnerRpcClient2 as makeRunnerRpcClient,

package/dist/chunk-g5bs3f6z.js

@@ -0,0 +1,173 @@
+// @bun
+import {
+  isString2,
+  isNone,
+  match,
+  fromUndefinedOr,
+  flatMap,
+  Reference,
+  TaggedError,
+  tryPromise,
+  succeed6,
+  gen,
+  fail7,
+  flatMap3,
+  map8,
+  mapError2,
+  orDie,
+  provide3,
+  decodeUnknownOption,
+  optionalKey,
+  Unknown,
+  String4,
+  Struct,
+  Record,
+  Int,
+  fromJsonString
+} from "./chunk-mbctzx7e.js";
+import {
+  withDefault,
+  String2
+} from "./chunk-11p4wf6n.js";
+import {
+  digestSha256,
+  digestSha512,
+  digestWith,
+  schemaBodyJson,
+  filterStatusOk,
+  get2,
+  layer2
+} from "./chunk-wh1pa2aa.js";
+import {
+  KitDigest
+} from "./chunk-z821b2gp.js";
+
+// packages/core/src/npm-registry.ts
+var KitManifest = Struct({
+  bundle: String4,
+  digest: KitDigest,
+  protocolVersion: Int,
+  declarations: String4,
+  setup: Record(KitDigest, String4)
+});
+
+class NpmRegistryError extends TaggedError("NpmRegistryError") {
+}
+var Dist = Struct({
+  tarball: String4,
+  integrity: optionalKey(String4),
+  shasum: optionalKey(String4)
+});
+var Packument = Struct({
+  "dist-tags": Record(String4, String4),
+  versions: Record(String4, Struct({ dist: Dist }))
+});
+var integrityAlgorithms = ["sha512", "sha384", "sha256", "sha1"];
+var tarballMatches = (tarball, dist) => {
+  if (dist.integrity === undefined)
+    return dist.shasum === digestWith("sha1", tarball, "hex");
+  const hashes = dist.integrity.split(/\s+/u).map((hash) => /^([^-]+)-([^?]+)/u.exec(hash));
+  const algorithm = integrityAlgorithms.find((candidate) => hashes.some((hash) => hash?.[1] === candidate));
+  return algorithm !== undefined && hashes.some((hash) => hash?.[1] === algorithm && hash[2] === digestWith(algorithm, tarball, "base64"));
+};
+var PackageJson = Struct({ kitman: optionalKey(Unknown) });
+var decodePackageJson = decodeUnknownOption(fromJsonString(PackageJson));
+var decodeManifest = decodeUnknownOption(KitManifest);
+var decodeJson = decodeUnknownOption(fromJsonString(Unknown));
+var gunzip = (bytes) => tryPromise(() => new Response(new Blob([new Uint8Array(bytes)]).stream().pipeThrough(new DecompressionStream("gzip"))).arrayBuffer()).pipe(map8((buffer) => new Uint8Array(buffer)));
+var text = (bytes) => new TextDecoder().decode(bytes).replace(/\0.*$/su, "");
+var untar = (tar) => {
+  const files = new Map;
+  let longName;
+  for (let offset = 0;offset + 512 <= tar.length; ) {
+    const header = tar.subarray(offset, offset + 512);
+    if (header.every((byte) => byte === 0))
+      break;
+    const size = Number.parseInt(text(header.subarray(124, 136)).trim() || "0", 8);
+    if (!Number.isSafeInteger(size) || size < 0 || offset + 512 + size > tar.length)
+      return;
+    const type = String.fromCharCode(header[156] ?? 0);
+    const prefix = text(header.subarray(345, 500));
+    const body = tar.subarray(offset + 512, offset + 512 + size);
+    const name = longName ?? (prefix === "" ? text(header.subarray(0, 100)) : `${prefix}/${text(header.subarray(0, 100))}`);
+    longName = undefined;
+    if (type === "x")
+      longName = /(?:^|\n)\d+ path=([^\n]*)\n/u.exec(new TextDecoder().decode(body))?.[1];
+    else if (type === "L")
+      longName = text(body);
+    else if (type === "0" || type === "\x00")
+      files.set(name.replace(/^[^/]*\//u, ""), body);
+    offset += 512 + Math.ceil(size / 512) * 512;
+  }
+  return files;
+};
+var registryUrl = String2("NPM_CONFIG_REGISTRY").pipe(withDefault("https://registry.npmjs.org"));
+var npmRegistryAt = (url = registryUrl) => {
+  const base = (isString2(url) ? succeed6(url) : orDie(url)).pipe(map8((value) => value.replace(/\/+$/u, "")));
+  const unreachable = (name, version) => (error) => new NpmRegistryError({
+    kind: "unreachable",
+    message: `npm did not answer for ${name}@${version}: ${error.message}; try again`
+  });
+  const packument = (name, version) => gen(function* () {
+    const response = yield* get2(`${yield* base}/${name.replace("/", "%2F")}`).pipe(mapError2(unreachable(name, version)), provide3(layer2));
+    if (response.status === 404)
+      return yield* new NpmRegistryError({ kind: "not_found", message: `npm has no package ${name}` });
+    return yield* filterStatusOk(response).pipe(flatMap3(schemaBodyJson(Packument)), mapError2(unreachable(name, version)));
+  });
+  return {
+    latest: (name) => flatMap3(packument(name, "latest"), (found) => {
+      const latest = found["dist-tags"].latest;
+      return latest === undefined ? fail7(new NpmRegistryError({ kind: "not_found", message: `npm has no latest ${name}` })) : succeed6(latest);
+    }),
+    kit: (name, wanted) => gen(function* () {
+      const found = yield* packument(name, wanted);
+      const version = found["dist-tags"][wanted] ?? wanted;
+      const dist = found.versions[version]?.dist;
+      if (dist === undefined)
+        return yield* new NpmRegistryError({ kind: "not_found", message: `npm has no ${name}@${wanted}` });
+      const tarball = yield* get2(dist.tarball).pipe(flatMap3(filterStatusOk), flatMap3((response) => response.arrayBuffer), map8((buffer) => new Uint8Array(buffer)), mapError2(unreachable(name, version)), provide3(layer2));
+      if (!tarballMatches(tarball, dist))
+        return yield* new NpmRegistryError({
+          kind: "integrity",
+          message: `${name}@${version}'s tarball does not match npm's integrity: expected ${dist.integrity ?? `sha1 ${dist.shasum}`}, got sha512-${digestSha512(tarball, "base64")}; its publisher must publish a new version`
+        });
+      const notAKit = new NpmRegistryError({
+        kind: "not_a_kit",
+        message: `${name}@${version} is not a Kitman Kit: add \`kitman kit build\` to its prepack and publish again`
+      });
+      const files = untar(yield* gunzip(tarball).pipe(mapError2(() => notAKit)));
+      if (files === undefined)
+        return yield* notAKit;
+      const file = (path) => fromUndefinedOr(files.get(path.replace(/^\.\//u, "")));
+      const manifest = flatMap(file("package.json"), (bytes) => flatMap(decodePackageJson(new TextDecoder().decode(bytes)), (json) => decodeManifest(json.kitman)));
+      if (isNone(manifest))
+        return yield* notAKit;
+      const bundle = file(manifest.value.bundle);
+      const declarations = file(manifest.value.declarations);
+      const setupArchives = Object.entries(manifest.value.setup).flatMap(([digest, path]) => match(file(path), {
+        onNone: () => [],
+        onSome: (archive) => digestSha256(archive, "hex") === digest ? [{ digest, archive }] : []
+      }));
+      if (isNone(bundle) || isNone(declarations) || digestSha256(bundle.value, "hex") !== manifest.value.digest || setupArchives.length !== Object.keys(manifest.value.setup).length)
+        return yield* notAKit;
+      const parsed = decodeJson(new TextDecoder().decode(declarations.value));
+      if (isNone(parsed))
+        return yield* notAKit;
+      return {
+        name,
+        version,
+        integrity: dist.integrity ?? `sha1-${digestWith("sha1", tarball, "base64")}`,
+        bundle: bundle.value,
+        digest: manifest.value.digest,
+        protocolVersion: manifest.value.protocolVersion,
+        declarations: parsed.value,
+        setupArchives
+      };
+    })
+  };
+};
+var NpmRegistry = Reference("kitman/core/NpmRegistry", {
+  defaultValue: () => npmRegistryAt()
+});
+
+export { Packument, tarballMatches, NpmRegistry };

package/dist/chunk-jafetf7z.js

@@ -0,0 +1,109 @@
+// @bun
+import {
+  getOrUndefined,
+  flatMap,
+  toArray,
+  decodeUnknownOption,
+  optionalKey,
+  String4,
+  Struct,
+  Record,
+  ArraySchema,
+  decodeJsonStringOption,
+  encodeUnknownJsonStringSync
+} from "./chunk-mbctzx7e.js";
+import {
+  replaceSecretReferences,
+  secretReferencesIn
+} from "./chunk-pp1p3g6e.js";
+
+// packages/agent-runtime/src/secret-proxy.ts
+import { appendFileSync, readFileSync, renameSync, writeFileSync } from "fs";
+
+// packages/agent-runtime/src/egress-proxy.ts
+var egressAllowed = (hosts, host, port) => {
+  const target = host.toLowerCase();
+  return hosts.some((entry) => {
+    const [name = "", entryPort] = entry.toLowerCase().split(":");
+    if (entryPort !== undefined && Number(entryPort) !== port)
+      return false;
+    return name.startsWith("*.") ? target.endsWith(name.slice(1)) : target === name;
+  });
+};
+if (false)
+  ;
+
+// packages/agent-runtime/src/secret-proxy.ts
+var basicPrefix = /^basic\s+/i;
+var basicCredential = (value) => {
+  if (!basicPrefix.test(value))
+    return;
+  const decoded = Buffer.from(value.replace(basicPrefix, ""), "base64").toString("utf8");
+  return secretReferencesIn(decoded).length === 0 ? undefined : decoded;
+};
+var referencesInHeader = (value) => [
+  ...new Set([...secretReferencesIn(value), ...secretReferencesIn(basicCredential(value) ?? "")])
+];
+var swapped = (value, registry) => {
+  const swap = (reference) => registry[reference]?.value ?? reference;
+  const basic = basicCredential(value);
+  return basic === undefined ? replaceSecretReferences(value, swap) : `Basic ${Buffer.from(replaceSecretReferences(basic, swap)).toString("base64")}`;
+};
+var decideSecretRequest = (request, readRegistry) => {
+  const carrying = request.headers.flatMap(([name, value]) => {
+    const references = referencesInHeader(value);
+    return references.length === 0 ? [] : [{ name, value, references }];
+  });
+  const inTarget = secretReferencesIn(request.target);
+  if (carrying.length === 0 && inTarget.length === 0)
+    return { action: "allow" };
+  const registry = readRegistry();
+  const refusals = [
+    ...inTarget.map((reference) => ({
+      reference,
+      host: request.host,
+      reason: "A reference is swapped only in a header, never in a URL."
+    })),
+    ...[...new Set(carrying.flatMap((header) => header.references))].flatMap((reference) => {
+      const entry = registry?.[reference];
+      const reason = entry === undefined ? "The reference is unknown or revoked." : request.scheme !== "https" ? "A reference is swapped only over HTTPS." : !egressAllowed(entry.hosts, request.host, request.port) ? `The Secret may be sent only to ${entry.hosts.join(", ")}.` : undefined;
+      return reason === undefined ? [] : [{ reference, host: request.host, reason }];
+    })
+  ];
+  if (refusals.length > 0)
+    return {
+      action: "deny",
+      reason: `Kitman refused this request: ${refusals.map((refusal) => `${refusal.reference}: ${refusal.reason}`).join(" ")}`,
+      refusals
+    };
+  const names = new Set(carrying.map((header) => header.name.toLowerCase()));
+  return {
+    action: "allow",
+    setHeaders: request.headers.filter(([name]) => names.has(name.toLowerCase())).map(([name, value]) => [name, registry === undefined ? value : swapped(value, registry)])
+  };
+};
+var Registry = Record(String4, Struct({ value: String4, hosts: ArraySchema(String4) }));
+var Refusal = Struct({
+  reference: optionalKey(String4),
+  host: String4,
+  reason: String4
+});
+var readSecretRegistry = (file) => {
+  try {
+    return getOrUndefined(flatMap(decodeJsonStringOption(readFileSync(file, "utf8")), decodeUnknownOption(Registry)));
+  } catch {
+    return;
+  }
+};
+var writeSecretRegistry = (file, registry) => {
+  const next = `${file}.next`;
+  writeFileSync(next, encodeUnknownJsonStringSync(registry), { mode: 384 });
+  renameSync(next, file);
+};
+var secretRefusalLog = (registryFile) => `${registryFile}.refused`;
+var appendSecretRefusals = (registryFile, refusals) => appendFileSync(secretRefusalLog(registryFile), refusals.map((refusal) => `${encodeUnknownJsonStringSync(refusal)}
+`).join(""), { mode: 384 });
+var parseSecretRefusals = (text) => text.split(`
+`).flatMap((line) => toArray(flatMap(decodeJsonStringOption(line), decodeUnknownOption(Refusal))));
+
+export { decideSecretRequest, readSecretRegistry, writeSecretRegistry, secretRefusalLog, appendSecretRefusals, parseSecretRefusals };