@launchfile/macos-dev 0.8.0 → 0.10.0

package/dist/resources/postgres.js

@@ -10,6 +10,7 @@
 import { shell, shellOk } from "../shell.js";
 import { generatePassword } from "../secret-generator.js";
 import { assertSafeIdentifier, assertSafePassword, SAFE_IDENTIFIER, } from "./identifiers.js";
+import { namedDatabase } from "./uses.js";
 const DEFAULT_PORT = 5432;
 const DEFAULT_HOST = "localhost";
 const READY_TIMEOUT_SECONDS = 10;
@@ -28,6 +29,20 @@ export class PostgresProvisioner {
     async isRunning() {
         return this.#shellOk("pg_isready", ["-q"]);
     }
+    /**
+     * Whether `database` exists on the server. psql exits 0 whenever the query
+     * ran, a zero-row SELECT included, so the exit code says nothing about
+     * existence — only the `1` the row prints does. The caller validates the
+     * name before it reaches the SQL here.
+     */
+    async #databaseExists(port, database) {
+        const result = await this.#shell("psql", [
+            ...psqlArgs(port, "postgres"),
+            "-tAc",
+            `SELECT 1 FROM pg_database WHERE datname='${database}'`,
+        ], { allowFailure: true, silent: true });
+        return result.exitCode === 0 && result.stdout.trim() === "1";
+    }
     async provision(req, opts, existingState) {
         // Ensure postgres is running
         if (!(await this.isRunning())) {
@@ -77,12 +92,7 @@ export class PostgresProvisioner {
         // silent: this command embeds the generated DB password; don't echo it (CWE-532).
         { allowFailure: true, silent: true });
         // Create database (idempotent)
-        const dbExists = await this.#shellOk("psql", [
-            ...psqlArgs(port, "postgres"),
-            "-tAc",
-            `SELECT 1 FROM pg_database WHERE datname='${dbName}'`,
-        ]);
-        if (!dbExists) {
+        if (!(await this.#databaseExists(port, dbName))) {
             await this.#shell("createdb", ["-h", DEFAULT_HOST, "-p", String(port), "-O", user, dbName], { allowFailure: true });
         }
         // Handle extensions from config
@@ -104,6 +114,19 @@ export class PostgresProvisioner {
                 ], { allowFailure: true });
             }
         }
+        // Named `database` uses (SPEC.md § Resource uses): one more database per
+        // name, `<instance>_<name>`, created the same way as the app's own.
+        // Security: a use name is schema-validated (^[a-z][a-z0-9-]*$) and the
+        // hyphens become underscores, so the identifier check cannot fail on a
+        // name that reached here through the parser; it guards the SQL below
+        // all the same.
+        const databases = (opts.databases ?? []).map((name) => namedDatabase(dbName, name));
+        for (const database of databases) {
+            assertSafeIdentifier(database, "database name");
+            if (!(await this.#databaseExists(port, database))) {
+                await this.#shell("createdb", ["-h", DEFAULT_HOST, "-p", String(port), "-O", user, database], { allowFailure: true });
+            }
+        }
         const url = `postgresql://${user}:${password}@${DEFAULT_HOST}:${port}/${dbName}`;
         const properties = {
             url,
@@ -121,13 +144,16 @@ export class PostgresProvisioner {
             dbName,
             user,
             password,
+            ...(databases.length > 0 ? { databases } : {}),
         };
         return { properties, state };
     }
-    async destroy(state) {
+    async destroy(state, _opts) {
         // Security: state values come from disk (state.json) — validate before SQL interpolation
-        if (state.dbName && SAFE_IDENTIFIER.test(state.dbName)) {
-            await this.#shell("dropdb", ["-h", DEFAULT_HOST, "--if-exists", state.dbName], { allowFailure: true });
+        for (const database of [state.dbName, ...(state.databases ?? [])]) {
+            if (!database || !SAFE_IDENTIFIER.test(database))
+                continue;
+            await this.#shell("dropdb", ["-h", DEFAULT_HOST, "--if-exists", database], { allowFailure: true });
         }
         if (state.user && SAFE_IDENTIFIER.test(state.user)) {
             await this.#shell("psql", [

package/dist/resources/redis.d.ts

@@ -3,7 +3,7 @@
  */
 import type { NormalizedRequirement } from "@launchfile/sdk";
 import type { ResourceState } from "../state.js";
-import type { ProvisionOpts, ResourceProperties, ResourceProvisioner, ShellRunner } from "./types.js";
+import type { DestroyOpts, ProvisionOpts, ResourceProperties, ResourceProvisioner, ShellRunner } from "./types.js";
 export declare class RedisProvisioner implements ResourceProvisioner {
     #private;
     readonly type = "redis";
@@ -13,6 +13,6 @@ export declare class RedisProvisioner implements ResourceProvisioner {
         properties: ResourceProperties;
         state: ResourceState;
     }>;
-    destroy(_state: ResourceState): Promise<void>;
+    destroy(_state: ResourceState, _opts: DestroyOpts): Promise<void>;
 }
 //# sourceMappingURL=redis.d.ts.map

package/dist/resources/redis.js

@@ -44,7 +44,7 @@ export class RedisProvisioner {
         };
         return { properties, state };
     }
-    async destroy(_state) {
+    async destroy(_state, _opts) {
         // Redis is shared, don't stop the service
         // Could flush a specific database prefix, but not worth the complexity
     }

package/dist/resources/sqlite.d.ts

@@ -3,7 +3,7 @@
  */
 import type { NormalizedRequirement } from "@launchfile/sdk";
 import type { ResourceState } from "../state.js";
-import type { ProvisionOpts, ResourceProperties, ResourceProvisioner } from "./types.js";
+import type { DestroyOpts, ProvisionOpts, ResourceProperties, ResourceProvisioner } from "./types.js";
 export declare class SqliteProvisioner implements ResourceProvisioner {
     readonly type = "sqlite";
     isRunning(): Promise<boolean>;
@@ -11,6 +11,6 @@ export declare class SqliteProvisioner implements ResourceProvisioner {
         properties: ResourceProperties;
         state: ResourceState;
     }>;
-    destroy(state: ResourceState): Promise<void>;
+    destroy(state: ResourceState, opts: DestroyOpts): Promise<void>;
 }
 //# sourceMappingURL=sqlite.d.ts.map

package/dist/resources/sqlite.js

@@ -2,7 +2,7 @@
  * SQLite resource provisioner — just creates a directory for the DB file.
  */
 import { mkdir } from "node:fs/promises";
-import { join } from "node:path";
+import { basename, dirname, join, resolve, sep } from "node:path";
 export class SqliteProvisioner {
     type = "sqlite";
     async isRunning() {
@@ -28,11 +28,32 @@ export class SqliteProvisioner {
         };
         return { properties, state };
     }
-    async destroy(state) {
-        if (state.dbName) {
-            const { rm } = await import("node:fs/promises");
-            await rm(state.dbName, { force: true });
+    async destroy(state, opts) {
+        if (!state.dbName)
+            return;
+        // state.json is repo-supplied and parsed without validation (state.ts),
+        // so dbName is untrusted here. The repo also supplies .launchfile/, so
+        // the data directory itself can be a symlink: resolve() is lexical and
+        // would not see it, while fs.rm follows symlinked components at the OS
+        // layer. Anchor on realpath(projectDir), which the caller supplies, and
+        // compare the target's real parent against it.
+        // The trailing separator matters: a bare startsWith(root) would leave a
+        // sibling directory named `sqlite-evil` deletable.
+        const { realpath, rm } = await import("node:fs/promises");
+        const projectRoot = await realpath(opts.projectDir).catch(() => null);
+        if (projectRoot === null)
+            return;
+        const root = join(projectRoot, ".launchfile", "data", "sqlite");
+        const target = resolve(projectRoot, state.dbName);
+        const parent = await realpath(dirname(target)).catch(() => null);
+        if (parent === null)
+            return; // nothing at that path to delete
+        const real = join(parent, basename(target));
+        if (!real.startsWith(root + sep)) {
+            console.warn(`  ! sqlite: refusing to delete ${target} — outside ${root}`);
+            return;
         }
+        await rm(real, { force: true });
     }
 }
 //# sourceMappingURL=sqlite.js.map

package/dist/resources/types.d.ts

@@ -42,6 +42,23 @@ export interface ShellRunner {
 export interface ProvisionOpts {
     appName: string;
     projectDir: string;
+    /**
+     * The names of the entry's named `database` uses (SPEC.md § Resource
+     * uses), pooled across same-name entries. A SQL provisioner creates one
+     * more database per name beside the app's — `<instance>_<name>` — and
+     * records them in state so `destroy` drops them. Other provisioners
+     * ignore it.
+     */
+    databases?: readonly string[];
+}
+/**
+ * The trusted context a teardown runs in. `state.json` is repo-supplied and
+ * parsed without validation (`state.ts`), so a provisioner cannot treat a
+ * stored path or identifier as its own; `projectDir` comes from the caller and
+ * is the only trustworthy boundary a destroy can confine itself to.
+ */
+export interface DestroyOpts {
+    projectDir: string;
 }
 export interface ResourceProvisioner {
     readonly type: string;
@@ -53,6 +70,6 @@ export interface ResourceProvisioner {
         state: ResourceState;
     }>;
     /** Drop app-specific databases/users (destroy mode) */
-    destroy(state: ResourceState): Promise<void>;
+    destroy(state: ResourceState, opts: DestroyOpts): Promise<void>;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/resources/uses.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Coverage of a `requires`/`supports` entry's declared `uses` (SPEC.md
+ * § Resource uses) by this provider's provisioners.
+ *
+ * A declared use is covered when the provisioner can hand over what the use
+ * asks for and register its properties under `<use>.<property>` — the dotted
+ * keys `$<resource>.<use>.<property>` resolves from. A named occurrence of a
+ * repeatable use (`- db: cache`) registers under `<use>.<name>.<property>`
+ * and is addressed as `$<resource>.<use>.<name>.<property>`. A use this
+ * provider cannot cover, a token it does not recognise, or a name on a use
+ * that does not repeat, refuses the component (PROVIDERS.md §10 item 5,
+ * D-64): no provider can claim to cover a use it does not know. This
+ * provider has no supplied-resource channel, so provision-and-cover or
+ * refuse are its only outcomes.
+ *
+ * Every function here takes **use keys** — `db` for a bare use, `db.cache`
+ * for a named one — the spelling `useKeys` from `@launchfile/sdk` produces
+ * and the resolver context lists.
+ *
+ * What each provisioner gives:
+ *
+ * - **redis** — the machine's Homebrew Redis, shared by every app on it. `db`
+ *   is one numbered database on that server, allocated per use key within
+ *   the app by {@link allocateDbIndexes}; `pubsub` and `server` are covered by
+ *   the server itself and register nothing beyond the instance vocabulary.
+ *   The server is shared across apps on this machine exactly as it is for an
+ *   entry with no `uses` — a machine-wide index allocation is not attempted
+ *   here.
+ * - **postgres / mysql / mariadb** — a per-app database on the local server.
+ *   A bare `database` is that database; each named `database` is one more
+ *   database on the server, `<instance>_<name>` ({@link namedDatabase}),
+ *   created by the provisioner's own create-database path; `server` is the
+ *   local instance.
+ */
+import { type NormalizedLaunch } from "@launchfile/sdk";
+import type { ResourceProperties } from "./types.js";
+/**
+ * The redis database index allocated to each `db` use key of one resource —
+ * `db` for the bare use, `db.<name>` for a named one. Produced per resource
+ * by {@link allocateDbIndexes}.
+ */
+export type DbIndexes = Readonly<Record<string, number>>;
+/**
+ * The database a named `database` use gets on the local server:
+ * `<instance database>_<name>`, hyphens as underscores so the name is one SQL
+ * identifier on every engine. The same rule as `@launchfile/docker`.
+ */
+export declare function namedDatabase(instance: string, name: string): string;
+/**
+ * `url` with its path replaced by `/<database>`, the query and fragment kept:
+ * the instance URL selects the instance database, a named use's URL selects
+ * its own.
+ */
+export declare function withDatabasePath(url: string, database: string): string;
+/**
+ * The properties this provider registers for one declared use key of a
+ * resource it provisions, or `undefined` when it cannot cover it — a token it
+ * does not know, or a name on a use that does not repeat. `dbIndexes` carries
+ * the numbered database allocated to each `db` key when the type is redis.
+ */
+export declare function coverUse(type: string, key: string, base: ResourceProperties, dbIndexes: DbIndexes): Record<string, string | number> | undefined;
+/**
+ * The declared use keys this provider cannot cover for `type`, each spelled
+ * as the file spells it (`db: cache`) — the refusal's content. A name on a
+ * use that does not repeat says so, since the token itself is one this
+ * provider knows.
+ */
+export declare function uncoveredUses(type: string, keys: readonly string[]): string[];
+/**
+ * The declared use keys this provider covers for `type`, in order. Used to
+ * register a resource from the pooled uses of every same-name entry: a
+ * pooled key this provider does not cover belongs to an unfulfilled
+ * `supports` entry (a `requires` one refused its component already) and
+ * registers nothing.
+ */
+export declare function coveredUses(type: string, keys: readonly string[]): string[];
+/**
+ * The entry's property map with every declared use's properties registered
+ * under `<use>.<property>` / `<use>.<name>.<property>`. Callers refuse before
+ * reaching here, so an uncovered use is a caller bug and throws.
+ */
+export declare function withCoveredUses(type: string, keys: readonly string[] | undefined, base: ResourceProperties, dbIndexes: DbIndexes): ResourceProperties;
+/**
+ * The names of the named `database` uses among `keys`, sorted and unique —
+ * the extra databases a SQL provisioner creates beside the app's. Empty for
+ * any other token, named or not.
+ */
+export declare function namedDatabases(keys: readonly string[]): string[];
+/**
+ * One numbered redis database per `db` use key, app-wide, keyed by resource
+ * name — the same allocation as `@launchfile/docker` (D-65 conformance), so
+ * one file yields the same `db.*` values under each provider:
+ *
+ * - redis resources take blocks in the order their first `db`-declaring entry
+ *   appears, walking components in file order and `requires` before
+ *   `supports` — a `supports` entry's `db` takes its index whether or not the
+ *   entry is fulfilled;
+ * - within a block the bare `db` (if any same-name entry declares it) takes
+ *   the first index and the named `db` uses follow in name order, so
+ *   `- db: sessions` beside `- db: cache` is the later index whichever is
+ *   written first.
+ *
+ * Index 0 is the first allocated. Same-name entries pool their keys (D-24).
+ * A resource that declares no `db` use has no entry.
+ */
+export declare function allocateDbIndexes(launch: NormalizedLaunch): Record<string, DbIndexes>;
+//# sourceMappingURL=uses.d.ts.map

package/dist/resources/uses.js

@@ -0,0 +1,217 @@
+/**
+ * Coverage of a `requires`/`supports` entry's declared `uses` (SPEC.md
+ * § Resource uses) by this provider's provisioners.
+ *
+ * A declared use is covered when the provisioner can hand over what the use
+ * asks for and register its properties under `<use>.<property>` — the dotted
+ * keys `$<resource>.<use>.<property>` resolves from. A named occurrence of a
+ * repeatable use (`- db: cache`) registers under `<use>.<name>.<property>`
+ * and is addressed as `$<resource>.<use>.<name>.<property>`. A use this
+ * provider cannot cover, a token it does not recognise, or a name on a use
+ * that does not repeat, refuses the component (PROVIDERS.md §10 item 5,
+ * D-64): no provider can claim to cover a use it does not know. This
+ * provider has no supplied-resource channel, so provision-and-cover or
+ * refuse are its only outcomes.
+ *
+ * Every function here takes **use keys** — `db` for a bare use, `db.cache`
+ * for a named one — the spelling `useKeys` from `@launchfile/sdk` produces
+ * and the resolver context lists.
+ *
+ * What each provisioner gives:
+ *
+ * - **redis** — the machine's Homebrew Redis, shared by every app on it. `db`
+ *   is one numbered database on that server, allocated per use key within
+ *   the app by {@link allocateDbIndexes}; `pubsub` and `server` are covered by
+ *   the server itself and register nothing beyond the instance vocabulary.
+ *   The server is shared across apps on this machine exactly as it is for an
+ *   entry with no `uses` — a machine-wide index allocation is not attempted
+ *   here.
+ * - **postgres / mysql / mariadb** — a per-app database on the local server.
+ *   A bare `database` is that database; each named `database` is one more
+ *   database on the server, `<instance>_<name>` ({@link namedDatabase}),
+ *   created by the provisioner's own create-database path; `server` is the
+ *   local instance.
+ */
+import { formatUseKey, parseUseKey, useKeys, } from "@launchfile/sdk";
+/**
+ * The database a named `database` use gets on the local server:
+ * `<instance database>_<name>`, hyphens as underscores so the name is one SQL
+ * identifier on every engine. The same rule as `@launchfile/docker`.
+ */
+export function namedDatabase(instance, name) {
+    return `${instance}_${name.replace(/-/g, "_")}`;
+}
+/**
+ * `url` with its path replaced by `/<database>`, the query and fragment kept:
+ * the instance URL selects the instance database, a named use's URL selects
+ * its own.
+ */
+export function withDatabasePath(url, database) {
+    const match = /^([a-z][a-z0-9+.-]*:\/\/[^/?#]*)(?:\/[^?#]*)?(.*)$/i.exec(url);
+    if (!match)
+        return url;
+    return `${match[1]}/${database}${match[2]}`;
+}
+const SQL_SERVER_USES = {
+    database: {
+        repeatable: true,
+        cover: ({ base, name }) => {
+            if (name === undefined) {
+                return { "database.url": base.url, "database.name": base.name ?? "" };
+            }
+            const database = namedDatabase(base.name ?? "", name);
+            return {
+                [`database.${name}.url`]: withDatabasePath(base.url, database),
+                [`database.${name}.name`]: database,
+            };
+        },
+    },
+    server: { repeatable: false, cover: () => ({}) },
+};
+const COVERAGE = {
+    redis: {
+        db: {
+            repeatable: true,
+            cover: ({ base, name, dbIndex }) => {
+                // The instance url may already select database 0; the use's
+                // url selects the allocated index instead.
+                const instance = base.url.replace(/\/\d+$/, "");
+                const prefix = name === undefined ? "db" : `db.${name}`;
+                return { [`${prefix}.url`]: `${instance}/${dbIndex}`, [`${prefix}.index`]: dbIndex };
+            },
+        },
+        pubsub: { repeatable: false, cover: () => ({}) },
+        server: { repeatable: false, cover: () => ({}) },
+    },
+    postgres: SQL_SERVER_USES,
+    mysql: SQL_SERVER_USES,
+    mariadb: SQL_SERVER_USES,
+};
+function coverageOf(type, key) {
+    const uses = Object.hasOwn(COVERAGE, type) ? COVERAGE[type] : undefined;
+    const { use, name } = parseUseKey(key);
+    const coverage = uses && Object.hasOwn(uses, use) ? uses[use] : undefined;
+    if (!coverage)
+        return undefined;
+    return name !== undefined && !coverage.repeatable ? undefined : coverage;
+}
+/**
+ * The properties this provider registers for one declared use key of a
+ * resource it provisions, or `undefined` when it cannot cover it — a token it
+ * does not know, or a name on a use that does not repeat. `dbIndexes` carries
+ * the numbered database allocated to each `db` key when the type is redis.
+ */
+export function coverUse(type, key, base, dbIndexes) {
+    const coverage = coverageOf(type, key);
+    if (!coverage)
+        return undefined;
+    const { name } = parseUseKey(key);
+    const dbIndex = Object.hasOwn(dbIndexes, key) ? dbIndexes[key] : 0;
+    return coverage.cover({ base, name, dbIndex });
+}
+/**
+ * The declared use keys this provider cannot cover for `type`, each spelled
+ * as the file spells it (`db: cache`) — the refusal's content. A name on a
+ * use that does not repeat says so, since the token itself is one this
+ * provider knows.
+ */
+export function uncoveredUses(type, keys) {
+    const uncovered = [];
+    for (const key of keys) {
+        if (coverageOf(type, key) !== undefined)
+            continue;
+        const { use, name } = parseUseKey(key);
+        const known = Object.hasOwn(COVERAGE, type) && Object.hasOwn(COVERAGE[type], use);
+        uncovered.push(name !== undefined && known
+            ? `${formatUseKey(key)} (${use} on ${type} is not repeatable and takes no name)`
+            : formatUseKey(key));
+    }
+    return uncovered;
+}
+/**
+ * The declared use keys this provider covers for `type`, in order. Used to
+ * register a resource from the pooled uses of every same-name entry: a
+ * pooled key this provider does not cover belongs to an unfulfilled
+ * `supports` entry (a `requires` one refused its component already) and
+ * registers nothing.
+ */
+export function coveredUses(type, keys) {
+    return keys.filter((key) => coverageOf(type, key) !== undefined);
+}
+/**
+ * The entry's property map with every declared use's properties registered
+ * under `<use>.<property>` / `<use>.<name>.<property>`. Callers refuse before
+ * reaching here, so an uncovered use is a caller bug and throws.
+ */
+export function withCoveredUses(type, keys, base, dbIndexes) {
+    const properties = { ...base };
+    for (const key of keys ?? []) {
+        const covered = coverUse(type, key, base, dbIndexes);
+        if (covered === undefined) {
+            throw new Error(`withCoveredUses: use "${formatUseKey(key)}" on ${type} is not covered — the caller must refuse first`);
+        }
+        Object.assign(properties, covered);
+    }
+    return properties;
+}
+/**
+ * The names of the named `database` uses among `keys`, sorted and unique —
+ * the extra databases a SQL provisioner creates beside the app's. Empty for
+ * any other token, named or not.
+ */
+export function namedDatabases(keys) {
+    const names = new Set();
+    for (const key of keys) {
+        const { use, name } = parseUseKey(key);
+        if (use === "database" && name !== undefined)
+            names.add(name);
+    }
+    return [...names].sort();
+}
+/**
+ * One numbered redis database per `db` use key, app-wide, keyed by resource
+ * name — the same allocation as `@launchfile/docker` (D-65 conformance), so
+ * one file yields the same `db.*` values under each provider:
+ *
+ * - redis resources take blocks in the order their first `db`-declaring entry
+ *   appears, walking components in file order and `requires` before
+ *   `supports` — a `supports` entry's `db` takes its index whether or not the
+ *   entry is fulfilled;
+ * - within a block the bare `db` (if any same-name entry declares it) takes
+ *   the first index and the named `db` uses follow in name order, so
+ *   `- db: sessions` beside `- db: cache` is the later index whichever is
+ *   written first.
+ *
+ * Index 0 is the first allocated. Same-name entries pool their keys (D-24).
+ * A resource that declares no `db` use has no entry.
+ */
+export function allocateDbIndexes(launch) {
+    const pooled = new Map();
+    for (const component of Object.values(launch.components)) {
+        for (const entry of [...(component.requires ?? []), ...(component.supports ?? [])]) {
+            if (entry.host || entry.type !== "redis" || !entry.uses)
+                continue;
+            const dbKeys = useKeys(entry.uses).filter((key) => parseUseKey(key).use === "db");
+            if (dbKeys.length === 0)
+                continue;
+            const key = entry.name ?? entry.type;
+            const keys = pooled.get(key) ?? new Set();
+            for (const dbKey of dbKeys)
+                keys.add(dbKey);
+            pooled.set(key, keys);
+        }
+    }
+    const allocation = {};
+    let next = 0;
+    for (const [resource, keys] of pooled) {
+        const indexes = {};
+        if (keys.has("db"))
+            indexes.db = next++;
+        for (const key of [...keys].filter((k) => k !== "db").sort()) {
+            indexes[key] = next++;
+        }
+        allocation[resource] = indexes;
+    }
+    return allocation;
+}
+//# sourceMappingURL=uses.js.map

package/dist/state.d.ts

@@ -4,6 +4,7 @@
  * Persists secrets, ports, and resource state in .launchfile/state.json
  * so credentials and ports are stable across restarts.
  */
+import type { DbIndexes } from "./resources/uses.js";
 export interface ResourceState {
     type: string;
     name: string;
@@ -12,7 +13,31 @@ export interface ResourceState {
     dbName?: string;
     user?: string;
     password?: string;
+    /**
+     * The numbered database `up` allocated to this resource for its bare redis
+     * `db` use (SPEC.md § Resource uses). Recorded so `env` registers the same
+     * `db.url` / `db.index` the running app was given, rather than re-deriving
+     * an index from a file that may have changed since. Absent on a resource
+     * with no bare `db` use and on state written before the index was recorded.
+     */
+    dbIndex?: number;
+    /**
+     * The numbered database allocated to each named redis `db` use, by name
+     * (`- db: cache` → `{ cache: 1 }`), recorded for the same reason as
+     * `dbIndex`. Absent on a resource with no named `db` use.
+     */
+    namedDbIndexes?: Record<string, number>;
+    /**
+     * The extra databases the provisioner created for named `database` uses
+     * (`<instance>_<name>`), so `destroy` drops what `up` created. Absent on a
+     * resource with no named `database` use.
+     */
+    databases?: string[];
 }
+/** The `db` use keys → index map `up` recorded on a resource: `db` from `dbIndex`, `db.<name>` from `namedDbIndexes`. */
+export declare function recordedDbIndexes(res: ResourceState): DbIndexes;
+/** `res` with the allocated `db` indexes recorded — the inverse of {@link recordedDbIndexes}. Records nothing for an empty allocation. */
+export declare function withRecordedDbIndexes(res: ResourceState, indexes: DbIndexes): ResourceState;
 /**
  * Records a spawned app component process so `launch down` can stop it
  * from a different shell or after the foreground `launch up` session ends.
@@ -72,6 +97,17 @@ export interface LaunchState {
      * written before this existed omit it.
      */
     operatorStorage?: Record<string, Record<string, string>>;
+    /**
+     * Orchestrator-supplied publication context (D-58): the normalized public
+     * URL `$app.*` resolves from, persisted alongside `ports` so `env` and
+     * `bootstrap` resolve the same values as the `up` that set it. A later `up`
+     * that supplies a different value replaces it and the derived env recomputes
+     * (D-49); one that omits it preserves what is recorded — the same rule
+     * `@launchfile/docker` applies to its own `appUrl`. Optional for backward
+     * compatibility — absent means this provider's own localhost routing
+     * answers.
+     */
+    appUrl?: string;
 }
 export declare function hashLaunchfile(content: string): string;
 /** Load state from disk, or return null if none exists */

package/dist/state.js

@@ -4,10 +4,36 @@
  * Persists secrets, ports, and resource state in .launchfile/state.json
  * so credentials and ports are stable across restarts.
  */
-import { readFile, writeFile, mkdir } from "node:fs/promises";
+import { readFile, writeFile, mkdir, chmod } from "node:fs/promises";
 import { join } from "node:path";
 import { createHash } from "node:crypto";
 import { registerSecrets } from "./redact.js";
+/** The `db` use keys → index map `up` recorded on a resource: `db` from `dbIndex`, `db.<name>` from `namedDbIndexes`. */
+export function recordedDbIndexes(res) {
+    const indexes = {};
+    if (res.dbIndex !== undefined)
+        indexes.db = res.dbIndex;
+    for (const [name, index] of Object.entries(res.namedDbIndexes ?? {})) {
+        indexes[`db.${name}`] = index;
+    }
+    return indexes;
+}
+/** `res` with the allocated `db` indexes recorded — the inverse of {@link recordedDbIndexes}. Records nothing for an empty allocation. */
+export function withRecordedDbIndexes(res, indexes) {
+    const named = {};
+    let dbIndex;
+    for (const [key, index] of Object.entries(indexes)) {
+        if (key === "db")
+            dbIndex = index;
+        else
+            named[key.slice("db.".length)] = index;
+    }
+    return {
+        ...res,
+        ...(dbIndex !== undefined ? { dbIndex } : {}),
+        ...(Object.keys(named).length > 0 ? { namedDbIndexes: named } : {}),
+    };
+}
 const STATE_DIR = ".launchfile";
 const STATE_FILE = "state.json";
 function stateDir(projectDir) {
@@ -64,8 +90,15 @@ export async function saveState(projectDir, state) {
 /** Ensure .launchfile directories exist */
 export async function ensureDirs(projectDir) {
     const dirs = ["storage", "tmp", "logs", "data", "env"];
-    // Security: restrict permissions — these dirs contain secrets, logs, env files
-    await Promise.all(dirs.map((d) => mkdir(join(projectDir, STATE_DIR, d), { recursive: true, mode: 0o700 })));
+    // Security: these dirs hold secrets, logs, and env files. mkdir applies the
+    // mode only when it creates the directory, so chmod unconditionally — a dir
+    // left by an earlier version or a looser umask must not stay world-readable
+    // (CWE-276). Mirrors packages/launchfile/src/state/errors.ts.
+    await Promise.all(dirs.map(async (d) => {
+        const dir = join(projectDir, STATE_DIR, d);
+        await mkdir(dir, { recursive: true, mode: 0o700 });
+        await chmod(dir, 0o700);
+    }));
     // Safety net: write a .gitignore inside .launchfile/ so secrets aren't
     // accidentally committed even if the project's .gitignore doesn't exclude it.
     await writeFile(join(projectDir, STATE_DIR, ".gitignore"), "*\n", { mode: 0o644 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@launchfile/macos-dev",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "macOS dev provider for Launchfile — run apps locally via brew services and native runtimes",
   "os": [
     "darwin"
@@ -36,7 +36,7 @@
     "directory": "providers/macos-dev"
   },
   "dependencies": {
-    "@launchfile/sdk": "^0.8.0",
+    "@launchfile/sdk": "^0.10.0",
     "semver": "^7.7.4"
   },
   "devDependencies": {