@launchfile/macos-dev 0.7.0 → 0.9.0

package/dist/bootstrap.d.ts

@@ -101,6 +101,13 @@ export type BootstrapExec = (cmd: string, args: string[], opts: {
 export declare function launchBootstrap(opts?: {
     component?: string;
     projectDir?: string;
+    /**
+     * Print sensitive captures instead of masking them — the operator's
+     * explicit act on the invoking command (`launchfile bootstrap
+     * --reveal`). Display only: the values are registered with the
+     * redactor either way.
+     */
+    reveal?: boolean;
     exec?: BootstrapExec;
 }): Promise<BootstrapResult[]>;
 //# sourceMappingURL=bootstrap.d.ts.map

package/dist/bootstrap.js

@@ -16,10 +16,10 @@
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { spawn } from "node:child_process";
-import { parseDurationMs, readLaunch, resolveExpression, } from "@launchfile/sdk";
+import { formatCaptures, parseDurationMs, readLaunch, resolveExpression, sensitiveCaptureValues, } from "@launchfile/sdk";
 import { loadState, saveState } from "./state.js";
 import { buildResolverContext, computeAppProperties, resolveComponentEnv, resolveGenerators, } from "./env-writer.js";
-import { redactSecrets } from "./redact.js";
+import { redactSecrets, registerDeclaredSecret } from "./redact.js";
 import { getProvisioner } from "./resources/index.js";
 /** Default budget for a bootstrap command when no `timeout` is declared. */
 export const DEFAULT_BOOTSTRAP_TIMEOUT_MS = 120_000;
@@ -184,6 +184,7 @@ const defaultExec = (cmd, args, opts) => new Promise((resolveP) => {
  */
 export async function launchBootstrap(opts = {}) {
     const projectDir = opts.projectDir ?? process.cwd();
+    const reveal = opts.reveal === true;
     const launchfileContent = await readFile(join(projectDir, "Launchfile"), "utf8");
     const launch = readLaunch(launchfileContent);
     const state = await loadState(projectDir);
@@ -259,26 +260,31 @@ export async function launchBootstrap(opts = {}) {
             env,
             timeoutMs: item.timeoutMs,
         });
+        const captureMeta = item.capture ?? {};
         const captures = item.capture ? extractCaptures(stdout, item.capture) : {};
+        // A `sensitive: true` capture is a declared secret (D-18): it registers
+        // before any result or printed line is built, so the value can leak
+        // through neither (CWE-532). `--reveal` changes what the display loop
+        // below prints, never this.
+        for (const value of sensitiveCaptureValues(captures, captureMeta)) {
+            registerDeclaredSecret(value);
+        }
         results.push({
             component: name,
             command: item.command,
             ok: exitCode === 0,
             exitCode,
             captures,
-            captureMeta: item.capture ?? {},
+            captureMeta,
             stdout,
             stderr,
         });
         // Print captures inline so the user sees them immediately.
-        if (Object.keys(captures).length > 0) {
-            console.log("\n  Captured:");
-            for (const [key, value] of Object.entries(captures)) {
-                const meta = item.capture?.[key];
-                const displayValue = meta?.sensitive ? "***" : value;
-                const desc = meta?.description ? ` — ${meta.description}` : "";
-                console.log(`    ${key}: ${displayValue}${desc}`);
-            }
+        const lines = formatCaptures(captures, captureMeta, reveal);
+        if (lines.length > 0) {
+            console.log("");
+            for (const line of lines)
+                console.log(line);
         }
         if (exitCode !== 0) {
             console.error(`  \u2717 Bootstrap [${name}] failed with exit code ${exitCode}`);

package/dist/provider.d.ts

@@ -67,6 +67,48 @@ export declare function scheduleWarning(component: string, schedule: string): st
  * report success over an empty set.
  */
 export declare function applyHostCapabilityRefusals(launch: NormalizedLaunch): "ok" | "none-left";
+/**
+ * Components this provider must refuse because they require a public HTTPS
+ * origin (D-60 rule 5), mapped to the entries it cannot satisfy.
+ *
+ * This provider has no orchestrator-facing publication channel ([#294]) and no
+ * edge of its own, so it can neither provision the origin nor accept a supplied
+ * one — it refuses, which PROVIDERS.md §10 item 5 makes conformant. `supports:`
+ * entries are not refused: the component runs, degraded.
+ */
+export declare function refusedHttpsOrigins(launch: NormalizedLaunch): Map<string, string[]>;
+/**
+ * Remove every component whose required `https-origin` this provider cannot
+ * satisfy, and say so on stderr. Same shape and same reason as
+ * {@link applyHostCapabilityRefusals}: the removal IS the refusal — a component
+ * left in the map goes on to be installed, wired, registered and started, and
+ * an app that declared it needs HTTPS would run over plain HTTP behind a
+ * message nobody acted on.
+ */
+export declare function applyHttpsOriginRefusals(launch: NormalizedLaunch): "ok" | "none-left";
+/**
+ * Components this provider must refuse because native TLS was selected on a
+ * listener it cannot activate (D-61 rule 5), mapped to the entries.
+ *
+ * Selection on this provider is `--with-optional`: it is the only way a
+ * `supports:` entry is ever turned on here. Without the flag a certificate
+ * binding is simply inactive and the component runs its declared HTTP
+ * baseline, which is correct (D-8) — so this returns nothing.
+ *
+ * With the flag, the operator asked for the optional capability and this
+ * provider has no way to deliver it: it has no supplied-resource channel to
+ * receive `cert_file`/`key_file` through, and no certificate of its own to
+ * offer. Refusing is what PROVIDERS.md §10 item 5 makes conformant; falling
+ * back to HTTP on a listener the operator asked to secure is the silent
+ * success the decision forbids.
+ */
+export declare function refusedCertificates(launch: NormalizedLaunch, withOptional: boolean): Map<string, string[]>;
+/**
+ * Remove every component whose selected certificate binding this provider
+ * cannot activate, and say so on stderr. Same shape and same reason as
+ * {@link applyHostCapabilityRefusals}: the removal IS the refusal.
+ */
+export declare function applyCertificateRefusals(launch: NormalizedLaunch, withOptional: boolean): "ok" | "none-left";
 export declare function launchUp(opts?: LaunchUpOpts): Promise<void>;
 export declare function launchDown(opts?: {
     destroy?: boolean;

package/dist/provider.js

@@ -7,7 +7,7 @@
 import { accessSync, constants as fsConstants } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { join, resolve as resolvePath } from "node:path";
-import { indexOperatorStoragePaths, MissingOperatorStoragePathError, readLaunch, resolveSourcePrepareCommand, resolveSourceRunCommand, selectionClosure, UnboundOperatorStorageError, unsuppliedRequiredEnv, } from "@launchfile/sdk";
+import { CERTIFICATE, certificateBindings, indexOperatorStoragePaths, MissingOperatorStoragePathError, readLaunch, resolveSourcePrepareCommand, resolveSourceRunCommand, selectionClosure, UnboundOperatorStorageError, unsuppliedRequiredEnv, } from "@launchfile/sdk";
 import { checkPrereqs } from "./prereqs.js";
 import { loadState, initState, saveState, ensureDirs } from "./state.js";
 import { buildResolverContext, computeAppProperties, resolveComponentEnv, generateSecrets, resolveGenerators, writeEnvFile, } from "./env-writer.js";
@@ -121,6 +121,96 @@ export function applyHostCapabilityRefusals(launch) {
     launch.components = Object.fromEntries(Object.entries(launch.components).filter(([n]) => !refused.has(n)));
     return Object.keys(launch.components).length === 0 ? "none-left" : "ok";
 }
+/** The backing-service type that declares the app's public HTTPS origin (D-60). */
+const HTTPS_ORIGIN = "https-origin";
+/**
+ * Components this provider must refuse because they require a public HTTPS
+ * origin (D-60 rule 5), mapped to the entries it cannot satisfy.
+ *
+ * This provider has no orchestrator-facing publication channel ([#294]) and no
+ * edge of its own, so it can neither provision the origin nor accept a supplied
+ * one — it refuses, which PROVIDERS.md §10 item 5 makes conformant. `supports:`
+ * entries are not refused: the component runs, degraded.
+ */
+export function refusedHttpsOrigins(launch) {
+    const refused = new Map();
+    for (const [name, c] of Object.entries(launch.components)) {
+        const entries = (c.requires ?? [])
+            .filter((r) => r.type === HTTPS_ORIGIN)
+            .map((r) => `${r.name ?? r.type} (endpoint "${r.endpoint ?? "?"}")`);
+        if (entries.length > 0)
+            refused.set(name, entries);
+    }
+    return refused;
+}
+/**
+ * Remove every component whose required `https-origin` this provider cannot
+ * satisfy, and say so on stderr. Same shape and same reason as
+ * {@link applyHostCapabilityRefusals}: the removal IS the refusal — a component
+ * left in the map goes on to be installed, wired, registered and started, and
+ * an app that declared it needs HTTPS would run over plain HTTP behind a
+ * message nobody acted on.
+ */
+export function applyHttpsOriginRefusals(launch) {
+    const refused = refusedHttpsOrigins(launch);
+    for (const [name, entries] of refused) {
+        console.error(`  Refused: ${name} requires a public HTTPS origin this provider cannot supply ` +
+            `(${entries.join("; ")}) — it has no edge and no publication channel — component not started`);
+    }
+    if (refused.size === 0)
+        return "ok";
+    launch.components = Object.fromEntries(Object.entries(launch.components).filter(([n]) => !refused.has(n)));
+    return Object.keys(launch.components).length === 0 ? "none-left" : "ok";
+}
+/**
+ * Components this provider must refuse because native TLS was selected on a
+ * listener it cannot activate (D-61 rule 5), mapped to the entries.
+ *
+ * Selection on this provider is `--with-optional`: it is the only way a
+ * `supports:` entry is ever turned on here. Without the flag a certificate
+ * binding is simply inactive and the component runs its declared HTTP
+ * baseline, which is correct (D-8) — so this returns nothing.
+ *
+ * With the flag, the operator asked for the optional capability and this
+ * provider has no way to deliver it: it has no supplied-resource channel to
+ * receive `cert_file`/`key_file` through, and no certificate of its own to
+ * offer. Refusing is what PROVIDERS.md §10 item 5 makes conformant; falling
+ * back to HTTP on a listener the operator asked to secure is the silent
+ * success the decision forbids.
+ */
+export function refusedCertificates(launch, withOptional) {
+    const refused = new Map();
+    if (!withOptional)
+        return refused;
+    for (const [name, component] of Object.entries(launch.components)) {
+        const declared = new Set((component.supports ?? [])
+            .filter((s) => !s.host && s.type === CERTIFICATE)
+            .map((s) => s.name ?? s.type));
+        const entries = certificateBindings(component)
+            .filter(({ certificate }) => declared.has(certificate))
+            .map(({ entry, certificate }) => `${certificate} (endpoint ${entry.name === undefined ? "(unnamed)" : `"${entry.name}"`})`);
+        if (entries.length > 0)
+            refused.set(name, entries);
+    }
+    return refused;
+}
+/**
+ * Remove every component whose selected certificate binding this provider
+ * cannot activate, and say so on stderr. Same shape and same reason as
+ * {@link applyHostCapabilityRefusals}: the removal IS the refusal.
+ */
+export function applyCertificateRefusals(launch, withOptional) {
+    const refused = refusedCertificates(launch, withOptional);
+    for (const [name, entries] of refused) {
+        console.error(`  Refused: ${name} selected native TLS and this provider cannot activate it ` +
+            `(${entries.join("; ")}) — it has no channel to receive cert_file/key_file — ` +
+            "component not started; it never falls back to HTTP");
+    }
+    if (refused.size === 0)
+        return "ok";
+    launch.components = Object.fromEntries(Object.entries(launch.components).filter(([n]) => !refused.has(n)));
+    return Object.keys(launch.components).length === 0 ? "none-left" : "ok";
+}
 export async function launchUp(opts = {}) {
     const projectDir = opts.projectDir ?? process.cwd();
     // 1. Check prerequisites
@@ -177,6 +267,22 @@ export async function launchUp(opts = {}) {
         console.error("Every selected component requires a host capability this provider cannot grant.");
         process.exit(1);
     }
+    // 2a-bis. A required `https-origin` is refused for the same reason and in
+    // the same way (D-60 rule 5, PROVIDERS.md §10 item 5): this provider has
+    // no edge and no publication channel, so it cannot satisfy the entry, and
+    // starting the component anyway is the silent success the type removes.
+    if (applyHttpsOriginRefusals(launch) === "none-left") {
+        console.error("Every selected component requires a public HTTPS origin this provider cannot supply.");
+        process.exit(1);
+    }
+    // 2a-ter. A SELECTED certificate binding (`--with-optional`) is refused on
+    // the same grounds (D-61 rule 5): no channel to receive the material, so
+    // the listener the operator asked to secure would come up cleartext.
+    // Unselected, the binding is inactive and the baseline is correct (D-8).
+    if (applyCertificateRefusals(launch, opts.withOptional === true) === "none-left") {
+        console.error("Every selected component selected native TLS this provider cannot activate.");
+        process.exit(1);
+    }
     // An optional capability is not refused — the component runs, degraded.
     for (const [name, c] of Object.entries(launch.components)) {
         for (const sup of c.supports ?? []) {
@@ -185,6 +291,12 @@ export async function launchUp(opts = {}) {
                     `${capability}=${String(value)} not granted — running degraded`);
             }
         }
+        for (const sup of c.supports ?? []) {
+            if (sup.type !== HTTPS_ORIGIN)
+                continue;
+            console.warn(`  Warning: ${name}: optional public HTTPS origin ` +
+                `${sup.name ?? sup.type} (endpoint "${sup.endpoint ?? "?"}") not satisfied — running degraded`);
+        }
     }
     const componentNames = Object.keys(launch.components);
     // 2b. Source-mode guard (D-38) — fail fast before provisioning anything.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@launchfile/macos-dev",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "macOS dev provider for Launchfile — run apps locally via brew services and native runtimes",
   "os": [
     "darwin"
@@ -36,7 +36,7 @@
     "directory": "providers/macos-dev"
   },
   "dependencies": {
-    "@launchfile/sdk": "^0.7.0",
+    "@launchfile/sdk": "^0.9.0",
     "semver": "^7.7.4"
   },
   "devDependencies": {