@launchfile/macos-dev 0.2.0 → 0.4.0

package/dist/shell.d.ts

@@ -1,5 +1,16 @@
 /**
- * Shell execution helper with timeout, logging, and structured results.
+ * Command execution helpers with timeout, logging, and structured results.
+ *
+ * Two entry points, and the difference between them is a security boundary:
+ *
+ * - `shell(cmd, args, opts)` passes arguments straight to the OS via
+ *   `execFile`. No shell is involved, so metacharacters in an argument are
+ *   inert. Every command this provider builds itself uses this form — a value
+ *   spliced into a command string would be CWE-78.
+ * - `shellScript(command, opts)` runs a command string through `/bin/sh -c`.
+ *   It exists only for command strings the Launchfile author wrote for their
+ *   own app (`commands:`, `health:`, `release:`), where shell syntax is the
+ *   documented contract. Never build one of these by interpolation.
  */
 export interface ShellResult {
     exitCode: number;
@@ -14,12 +25,23 @@ export interface ShellOpts {
     silent?: boolean;
 }
 /**
- * Run a shell command and return structured output.
- * Throws on non-zero exit code unless `allowFailure` is set.
+ * Run a command with an argument array. Arguments reach the OS directly, so
+ * they are never parsed as shell syntax.
  */
-export declare function shell(command: string, opts?: ShellOpts & {
+export declare function shell(cmd: string, args: string[], opts?: ShellOpts & {
+    allowFailure?: boolean;
+}): Promise<ShellResult>;
+/** Run a command with an argument array, return true if exit code is 0. */
+export declare function shellOk(cmd: string, args: string[], opts?: ShellOpts): Promise<boolean>;
+/**
+ * Run an author-written command string through `/bin/sh -c`.
+ *
+ * The shell is the point here: `commands:`, `health:` and `release:` values are
+ * documented as shell commands, and app authors rely on pipes, `&&` and
+ * variable expansion in them. The string must come from the Launchfile
+ * verbatim — building one by interpolating a value makes it injectable.
+ */
+export declare function shellScript(command: string, opts?: ShellOpts & {
     allowFailure?: boolean;
 }): Promise<ShellResult>;
-/** Run a command, return true if exit code is 0 */
-export declare function shellOk(command: string, opts?: ShellOpts): Promise<boolean>;
 //# sourceMappingURL=shell.d.ts.map

package/dist/shell.js

@@ -1,46 +1,101 @@
 /**
- * Shell execution helper with timeout, logging, and structured results.
+ * Command execution helpers with timeout, logging, and structured results.
+ *
+ * Two entry points, and the difference between them is a security boundary:
+ *
+ * - `shell(cmd, args, opts)` passes arguments straight to the OS via
+ *   `execFile`. No shell is involved, so metacharacters in an argument are
+ *   inert. Every command this provider builds itself uses this form — a value
+ *   spliced into a command string would be CWE-78.
+ * - `shellScript(command, opts)` runs a command string through `/bin/sh -c`.
+ *   It exists only for command strings the Launchfile author wrote for their
+ *   own app (`commands:`, `health:`, `release:`), where shell syntax is the
+ *   documented contract. Never build one of these by interpolation.
  */
-import { exec as cpExec } from "node:child_process";
+import { exec as cpExec, execFile as cpExecFile, } from "node:child_process";
+import { redactSecrets } from "./redact.js";
+const DEFAULT_TIMEOUT_MS = 120_000;
+const MAX_BUFFER = 10 * 1024 * 1024;
+function toResult(error, stdout, stderr) {
+    const result = {
+        exitCode: typeof error?.code === "number" ? error.code : 0,
+        stdout: typeof stdout === "string" ? stdout : "",
+        stderr: typeof stderr === "string" ? stderr : "",
+    };
+    // Node sets error.code to the exit code on non-zero; a signal or a spawn
+    // failure leaves it non-numeric, so surface those as a generic failure.
+    if (error && result.exitCode === 0)
+        result.exitCode = 1;
+    return result;
+}
+function failure(display, result) {
+    // The message reaches the user and may be logged by a caller; both the
+    // command and the child's stderr can echo a secret back, so neither goes
+    // in unscrubbed (D-18, CWE-532).
+    return Object.assign(new Error(`Command failed: ${redactSecrets(display)}\n${redactSecrets(result.stderr)}`), { result });
+}
 /**
- * Run a shell command and return structured output.
- * Throws on non-zero exit code unless `allowFailure` is set.
+ * Run a command with an argument array. Arguments reach the OS directly, so
+ * they are never parsed as shell syntax.
  */
-export async function shell(command, opts = {}) {
+export async function shell(cmd, args, opts = {}) {
+    const display = [cmd, ...args].join(" ");
     if (!opts.silent) {
-        console.log(`  $ ${command}`);
+        // An argument can carry a resolved secret (a generated DB password, a
+        // credential-bearing URL). Scrub before echo.
+        console.log(`  $ ${redactSecrets(display)}`);
     }
     const execOpts = {
         cwd: opts.cwd,
         env: opts.env ? { ...process.env, ...opts.env } : undefined,
-        timeout: opts.timeout ?? 120_000,
-        maxBuffer: 10 * 1024 * 1024,
+        timeout: opts.timeout ?? DEFAULT_TIMEOUT_MS,
+        maxBuffer: MAX_BUFFER,
     };
     return new Promise((resolve, reject) => {
-        cpExec(command, execOpts, (error, stdout, stderr) => {
-            const result = {
-                exitCode: error?.code ?? (typeof error?.code === "number" ? error.code : 0),
-                stdout: typeof stdout === "string" ? stdout : "",
-                stderr: typeof stderr === "string" ? stderr : "",
-            };
-            // Node's exec sets error.code to the exit code on non-zero
-            if (error && result.exitCode === 0) {
-                result.exitCode = 1;
-            }
-            if (error && !opts.allowFailure) {
-                reject(Object.assign(new Error(`Command failed: ${command}\n${result.stderr}`), {
-                    result,
-                }));
-            }
-            else {
+        cpExecFile(cmd, args, execOpts, (error, stdout, stderr) => {
+            const result = toResult(error, stdout, stderr);
+            if (error && !opts.allowFailure)
+                reject(failure(display, result));
+            else
                 resolve(result);
-            }
         });
     });
 }
-/** Run a command, return true if exit code is 0 */
-export async function shellOk(command, opts) {
-    const result = await shell(command, { ...opts, allowFailure: true, silent: true });
+/** Run a command with an argument array, return true if exit code is 0. */
+export async function shellOk(cmd, args, opts) {
+    const result = await shell(cmd, args, {
+        ...opts,
+        allowFailure: true,
+        silent: true,
+    });
     return result.exitCode === 0;
 }
+/**
+ * Run an author-written command string through `/bin/sh -c`.
+ *
+ * The shell is the point here: `commands:`, `health:` and `release:` values are
+ * documented as shell commands, and app authors rely on pipes, `&&` and
+ * variable expansion in them. The string must come from the Launchfile
+ * verbatim — building one by interpolating a value makes it injectable.
+ */
+export async function shellScript(command, opts = {}) {
+    if (!opts.silent) {
+        console.log(`  $ ${redactSecrets(command)}`);
+    }
+    const execOpts = {
+        cwd: opts.cwd,
+        env: opts.env ? { ...process.env, ...opts.env } : undefined,
+        timeout: opts.timeout ?? DEFAULT_TIMEOUT_MS,
+        maxBuffer: MAX_BUFFER,
+    };
+    return new Promise((resolve, reject) => {
+        cpExec(command, execOpts, (error, stdout, stderr) => {
+            const result = toResult(error, stdout, stderr);
+            if (error && !opts.allowFailure)
+                reject(failure(command, result));
+            else
+                resolve(result);
+        });
+    });
+}
 //# sourceMappingURL=shell.js.map

package/dist/state.d.ts

@@ -13,6 +13,28 @@ export interface ResourceState {
     user?: string;
     password?: string;
 }
+/**
+ * Records a spawned app component process so `launch down` can stop it
+ * from a different shell or after the foreground `launch up` session ends.
+ *
+ * Identity is captured at spawn time so `down` can re-verify the recorded
+ * pid still belongs to the process we started before signaling it — guarding
+ * against pid-reuse (a recycled pid belonging to an unrelated process).
+ */
+export interface ProcessState {
+    /** Leader pid of the spawned shell (`sh -c <command>`). */
+    pid: number;
+    /**
+     * Process group id. Because we spawn detached, the child is its own group
+     * leader, so pgid === pid. We persist it explicitly so `down` can signal the
+     * whole group (negative pid) and take down child processes too.
+     */
+    pgid: number;
+    /** ISO timestamp captured immediately after spawn — part of the identity check. */
+    startedAt: string;
+    /** The shell command string we launched — used as a best-effort identity cross-check. */
+    command: string;
+}
 export interface LaunchState {
     version: 1;
     appName: string;
@@ -22,6 +44,22 @@ export interface LaunchState {
     resources: Record<string, ResourceState>;
     secrets: Record<string, string>;
     ports: Record<string, number>;
+    /**
+     * App component processes recorded at spawn time, keyed by component name.
+     * Optional for backward compatibility: state files written before pid
+     * persistence existed simply omit this, and `down` tolerates its absence.
+     */
+    processes?: Record<string, ProcessState>;
+    /**
+     * Minted `env:`-level generator values (D-49: generate once, then
+     * preserve), keyed `<component>.<ENV_NAME>` — one entry per declaration
+     * (D-25), so same-named variables on different components hold independent
+     * values. `generator: port` values are never stored here (ports are
+     * re-allocated each run). Disjoint from `secrets` on purpose: these names
+     * must not become resolvable as `$secrets.<name>`. Optional for backward
+     * compatibility: older state files omit it and load as a first run.
+     */
+    generatedEnv?: Record<string, string>;
 }
 export declare function hashLaunchfile(content: string): string;
 /** Load state from disk, or return null if none exists */

package/dist/state.js

@@ -7,6 +7,7 @@
 import { readFile, writeFile, mkdir } from "node:fs/promises";
 import { join } from "node:path";
 import { createHash } from "node:crypto";
+import { registerSecrets } from "./redact.js";
 const STATE_DIR = ".launchfile";
 const STATE_FILE = "state.json";
 function stateDir(projectDir) {
@@ -22,7 +23,17 @@ export function hashLaunchfile(content) {
 export async function loadState(projectDir) {
     try {
         const raw = await readFile(statePath(projectDir), "utf8");
-        return JSON.parse(raw);
+        const state = JSON.parse(raw);
+        // Persisted credentials are reused verbatim in provisioning commands and
+        // in `$secrets.*` / `$<resource>.*` expressions, so they must be known to
+        // the redactor before anything can echo them.
+        registerSecrets(Object.values(state.secrets ?? {}));
+        registerSecrets(Object.values(state.resources ?? {}).map((r) => r.password));
+        // A value minted in an earlier run and merely reused in this one never
+        // passes through generateValue()'s registration, so the loader is the
+        // only place it can become scrubbable (D-18).
+        registerSecrets(Object.values(state.generatedEnv ?? {}));
+        return state;
     }
     catch {
         return null;

package/dist/storage.d.ts

@@ -1,12 +1,25 @@
 /**
  * Local storage provisioning for Launchfile volumes.
  *
- * Maps container paths to local directories under .launchfile/.
+ * Maps named volumes to local directories under .launchfile/, and exposes the
+ * resolved local path per volume so the provider can inject it as
+ * `$storage.<name>.path` (D-39).
  */
 import type { StorageVolume } from "@launchfile/sdk";
 /**
- * Create local directories for a component's storage volumes.
- * Returns a map of container path → local path.
+ * Compute the local path this provider uses for each of a component's storage
+ * volumes — keyed by **volume name** (the `storage:` key), which is what
+ * `$storage.<name>.path` resolves against (D-39). Pure: no filesystem side
+ * effects, so callers that only need the resolved paths (e.g. `launchfile env`)
+ * can use it without provisioning. Persistent volumes live under
+ * `.launchfile/storage/<component>/<name>`; ephemeral ones under `.../tmp/...`.
+ */
+export declare function storagePaths(storage: Record<string, StorageVolume> | undefined, componentName: string, projectDir: string): Record<string, string>;
+/**
+ * Create the local directories for a component's storage volumes and return the
+ * volume-name → local-path map (the home-#3 value the resolver injects as
+ * `$storage.<name>.path`, D-39). Previously the return was keyed by container
+ * path and discarded at the call site — the path is now captured and delivered.
  */
 export declare function provisionStorage(storage: Record<string, StorageVolume> | undefined, componentName: string, projectDir: string): Promise<Record<string, string>>;
 /** Clean up ephemeral (non-persistent) storage for a component */

package/dist/storage.js

@@ -1,25 +1,42 @@
 /**
  * Local storage provisioning for Launchfile volumes.
  *
- * Maps container paths to local directories under .launchfile/.
+ * Maps named volumes to local directories under .launchfile/, and exposes the
+ * resolved local path per volume so the provider can inject it as
+ * `$storage.<name>.path` (D-39).
  */
 import { mkdir, rm } from "node:fs/promises";
 import { join } from "node:path";
 const STATE_DIR = ".launchfile";
 /**
- * Create local directories for a component's storage volumes.
- * Returns a map of container path → local path.
+ * Compute the local path this provider uses for each of a component's storage
+ * volumes — keyed by **volume name** (the `storage:` key), which is what
+ * `$storage.<name>.path` resolves against (D-39). Pure: no filesystem side
+ * effects, so callers that only need the resolved paths (e.g. `launchfile env`)
+ * can use it without provisioning. Persistent volumes live under
+ * `.launchfile/storage/<component>/<name>`; ephemeral ones under `.../tmp/...`.
  */
-export async function provisionStorage(storage, componentName, projectDir) {
+export function storagePaths(storage, componentName, projectDir) {
     if (!storage)
         return {};
     const volumeMap = {};
     for (const [name, volume] of Object.entries(storage)) {
         const persistent = volume.persistent !== false; // default true
         const subdir = persistent ? "storage" : "tmp";
-        const localPath = join(projectDir, STATE_DIR, subdir, componentName, name);
+        volumeMap[name] = join(projectDir, STATE_DIR, subdir, componentName, name);
+    }
+    return volumeMap;
+}
+/**
+ * Create the local directories for a component's storage volumes and return the
+ * volume-name → local-path map (the home-#3 value the resolver injects as
+ * `$storage.<name>.path`, D-39). Previously the return was keyed by container
+ * path and discarded at the call site — the path is now captured and delivered.
+ */
+export async function provisionStorage(storage, componentName, projectDir) {
+    const volumeMap = storagePaths(storage, componentName, projectDir);
+    for (const localPath of Object.values(volumeMap)) {
         await mkdir(localPath, { recursive: true });
-        volumeMap[volume.path] = localPath;
     }
     return volumeMap;
 }

package/package.json

@@ -1,12 +1,15 @@
 {
   "name": "@launchfile/macos-dev",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "macOS dev provider for Launchfile — run apps locally via brew services and native runtimes",
+  "os": [
+    "darwin"
+  ],
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "scripts": {
-    "build": "tsc",
+    "build": "tsc -p tsconfig.build.json",
     "test": "vitest run",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit",
@@ -33,14 +36,14 @@
     "directory": "providers/macos-dev"
   },
   "dependencies": {
-    "@launchfile/sdk": "^0.2.0",
+    "@launchfile/sdk": "^0.4.0",
     "semver": "^7.7.4"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.4.10",
     "@types/bun": "^1.3.11",
     "@types/semver": "^7.7.1",
-    "typescript": "^6.0.0",
+    "typescript": "^7.0.2",
     "vitest": "^4.1.3"
   }
 }

package/dist/__tests__/bootstrap.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=bootstrap.test.d.ts.map

package/dist/__tests__/bootstrap.test.js

@@ -1,90 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { extractCaptures, parseDuration } from "../bootstrap.js";
-describe("extractCaptures (D-34)", () => {
-    it("extracts a single-group regex from stdout", () => {
-        const captures = {
-            invite_link: {
-                pattern: "https?://\\S+",
-                description: "One-time invite link",
-                sensitive: true,
-            },
-        };
-        const stdout = "Admin created.\nInvite URL: https://example.com/invite/abc123\n";
-        expect(extractCaptures(stdout, captures)).toEqual({
-            invite_link: "https://example.com/invite/abc123",
-        });
-    });
-    it("uses first capture group when present", () => {
-        const captures = {
-            password: {
-                pattern: "Admin password: (.+)",
-            },
-        };
-        const stdout = "Admin password: s3cret!\n";
-        expect(extractCaptures(stdout, captures)).toEqual({
-            password: "s3cret!",
-        });
-    });
-    it("returns empty result when no patterns match", () => {
-        const captures = {
-            token: { pattern: "token=(\\S+)" },
-        };
-        expect(extractCaptures("nothing to see here", captures)).toEqual({});
-    });
-    it("strips ANSI escape codes before matching", () => {
-        const captures = {
-            url: { pattern: "https?://\\S+" },
-        };
-        // Simulates colorized output from a CLI tool that detects a TTY
-        const stdout = "\x1b[32mSuccess:\x1b[0m visit \x1b[4mhttps://example.com/admin\x1b[0m to continue";
-        expect(extractCaptures(stdout, captures)).toEqual({
-            url: "https://example.com/admin",
-        });
-    });
-    it("skips invalid regex without throwing", () => {
-        const captures = {
-            bad: { pattern: "(unclosed" },
-            good: { pattern: "ok" },
-        };
-        const result = extractCaptures("ok here", captures);
-        // good matches; bad is skipped
-        expect(result.good).toBe("ok");
-        expect(result.bad).toBeUndefined();
-    });
-    it("handles multiple captures in one stdout", () => {
-        const captures = {
-            user: { pattern: "user=(\\S+)" },
-            pw: { pattern: "pw=(\\S+)" },
-        };
-        const stdout = "Created user=alice pw=hunter2 expires=1h\n";
-        expect(extractCaptures(stdout, captures)).toEqual({
-            user: "alice",
-            pw: "hunter2",
-        });
-    });
-    it("returns full match when pattern has no capture group", () => {
-        const captures = {
-            hash: { pattern: "[a-f0-9]{8}" },
-        };
-        const stdout = "Commit: deadbeef\n";
-        expect(extractCaptures(stdout, captures)).toEqual({
-            hash: "deadbeef",
-        });
-    });
-});
-describe("parseDuration", () => {
-    it("parses ms, s, m, h units", () => {
-        expect(parseDuration("500ms")).toBe(500);
-        expect(parseDuration("30s")).toBe(30_000);
-        expect(parseDuration("5m")).toBe(300_000);
-        expect(parseDuration("2h")).toBe(7_200_000);
-    });
-    it("tolerates whitespace", () => {
-        expect(parseDuration(" 10s ")).toBe(10_000);
-    });
-    it("falls back to default for invalid input", () => {
-        expect(parseDuration("bogus")).toBe(120_000);
-        expect(parseDuration("")).toBe(120_000);
-    });
-});
-//# sourceMappingURL=bootstrap.test.js.map

package/dist/__tests__/dry-run.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=dry-run.test.d.ts.map

package/dist/__tests__/dry-run.test.js

@@ -1,141 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { readFile } from "node:fs/promises";
-import { existsSync } from "node:fs";
-import { join } from "node:path";
-import { readLaunch } from "@launchfile/sdk";
-import { buildResolverContext, resolveComponentEnv, resolveGenerators, } from "../env-writer.js";
-import { getProvisioner } from "../resources/index.js";
-import { allocatePorts } from "../port-allocator.js";
-const CATALOG_ROOT = join(import.meta.dirname, "../../../../catalog");
-const CATALOG_APPS = join(CATALOG_ROOT, "apps");
-const CATALOG_DRAFTS = join(CATALOG_ROOT, "drafts");
-/** Find a Launchfile in apps/ or drafts/ */
-function catalogPath(app) {
-    const appsPath = join(CATALOG_APPS, app, "Launchfile");
-    if (existsSync(appsPath))
-        return appsPath;
-    return join(CATALOG_DRAFTS, app, "Launchfile");
-}
-/**
- * Dry-run test: parse a catalog Launchfile, simulate provisioning,
- * resolve env vars, and verify the output makes sense.
- */
-describe("dry-run against catalog", () => {
-    it("resolves miniflux Launchfile", async () => {
-        const yaml = await readFile(catalogPath("miniflux"), "utf8");
-        const launch = readLaunch(yaml);
-        expect(launch.name).toBe("miniflux");
-        expect(Object.keys(launch.components)).toEqual(["default"]);
-        const component = launch.components.default;
-        // Verify requires
-        expect(component.requires).toHaveLength(1);
-        expect(component.requires[0].type).toBe("postgres");
-        expect(component.requires[0].set_env?.DATABASE_URL).toBe("$url");
-        // Simulate provisioned postgres
-        const resourceMap = {
-            postgres: {
-                url: "postgresql://launchfile_miniflux:secret@localhost:5432/launchfile_miniflux",
-                host: "localhost",
-                port: 5432,
-                user: "launchfile_miniflux",
-                password: "secret",
-                name: "launchfile_miniflux",
-            },
-        };
-        const ports = await allocatePorts(launch.components, "miniflux");
-        const context = buildResolverContext(resourceMap, ports, {}, {});
-        const env = resolveComponentEnv(component, context, resourceMap);
-        await resolveGenerators(component, env);
-        // DATABASE_URL should be resolved from postgres $url
-        expect(env.DATABASE_URL).toBe("postgresql://launchfile_miniflux:secret@localhost:5432/launchfile_miniflux");
-        // Default env vars should be resolved
-        expect(env.RUN_MIGRATIONS).toBe("1");
-        expect(env.CREATE_ADMIN).toBe("1");
-        expect(env.ADMIN_USERNAME).toBe("admin");
-        // ADMIN_PASSWORD has generator: secret, so it should be generated
-        expect(env.ADMIN_PASSWORD).toBeTruthy();
-        expect(env.ADMIN_PASSWORD.length).toBeGreaterThan(10);
-    });
-    it("resolves langfuse Launchfile", async () => {
-        const yaml = await readFile(catalogPath("langfuse"), "utf8");
-        const launch = readLaunch(yaml);
-        expect(launch.name).toBe("langfuse");
-        for (const [name, component] of Object.entries(launch.components)) {
-            // Every required resource should have a known provisioner
-            for (const req of component.requires ?? []) {
-                const provisioner = getProvisioner(req.type);
-                expect(provisioner, `No provisioner for ${req.type} in ${name}`).toBeDefined();
-            }
-        }
-    });
-    it("resolves chatwoot multi-component Launchfile", async () => {
-        const yaml = await readFile(catalogPath("chatwoot"), "utf8");
-        const launch = readLaunch(yaml);
-        expect(launch.name).toBe("chatwoot");
-        const componentNames = Object.keys(launch.components);
-        expect(componentNames.length).toBeGreaterThan(1);
-        // Simulate resources
-        const resourceMap = {
-            postgres: {
-                url: "postgresql://user:pass@localhost:5432/chatwoot",
-                host: "localhost",
-                port: 5432,
-                user: "user",
-                password: "pass",
-                name: "chatwoot",
-            },
-            redis: {
-                url: "redis://localhost:6379/0",
-                host: "localhost",
-                port: 6379,
-            },
-        };
-        const ports = await allocatePorts(launch.components, "chatwoot");
-        const secrets = {};
-        // Generate secrets from launch.secrets
-        if (launch.secrets) {
-            for (const [name] of Object.entries(launch.secrets)) {
-                secrets[name] = `test-secret-${name}`;
-            }
-        }
-        const context = buildResolverContext(resourceMap, ports, secrets, {});
-        // Resolve env for each component — should not throw
-        for (const [name, component] of Object.entries(launch.components)) {
-            const env = resolveComponentEnv(component, context, resourceMap);
-            await resolveGenerators(component, env);
-            // Every component should have at least some env vars
-            expect(Object.keys(env).length, `${name} should have env vars`).toBeGreaterThan(0);
-        }
-    });
-    it("identifies unsupported resource types", async () => {
-        // Check all catalog Launchfiles for resource types we support
-        const { readdir } = await import("node:fs/promises");
-        const appsEntries = await readdir(CATALOG_APPS).catch(() => []);
-        const draftsEntries = await readdir(CATALOG_DRAFTS).catch(() => []);
-        const allApps = [...new Set([...appsEntries, ...draftsEntries])];
-        const unsupported = new Set();
-        for (const app of allApps) {
-            try {
-                const yaml = await readFile(catalogPath(app), "utf8");
-                const launch = readLaunch(yaml);
-                for (const component of Object.values(launch.components)) {
-                    for (const req of [...(component.requires ?? []), ...(component.supports ?? [])]) {
-                        if (!getProvisioner(req.type)) {
-                            unsupported.add(req.type);
-                        }
-                    }
-                }
-            }
-            catch {
-                // Skip apps that can't be parsed
-            }
-        }
-        // Log unsupported types for visibility
-        if (unsupported.size > 0) {
-            console.log(`  Unsupported resource types in catalog: ${[...unsupported].join(", ")}`);
-        }
-        // This test is informational — it doesn't fail
-        expect(true).toBe(true);
-    });
-});
-//# sourceMappingURL=dry-run.test.js.map

package/dist/__tests__/env-writer.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=env-writer.test.d.ts.map