@microsoft/managed-apps-dev-gateway 0.3.1

package/dist/snapshot/OobRevision.d.ts

@@ -0,0 +1,38 @@
+/*!
+ * Copyright (C) Microsoft Corporation. All rights reserved.
+ */
+/**
+ * Deterministic JSON with object keys sorted at every depth. Array order is
+ * preserved because it is meaningful in JSON Schema. Used only to derive the
+ * effective OOB revision, never to produce the bytes sent to the backend.
+ */
+export declare function canonicalJson(value: unknown): string;
+/**
+ * Opaque revision for the effective OOB content. It covers exactly what the
+ * inherited `validateDevelopmentSnapshotUpdate` treats as OOB-affecting — app
+ * identity, the inline manifest, and the effective environment identity — so it
+ * changes if and only if one of those changes. Formatting-only, asset-only and
+ * connector-only edits leave it unchanged and keep the backend session valid.
+ * Key order is insensitive because the digest is taken over canonical JSON.
+ * The digest is a local change detector, not a security or integrity claim.
+ *
+ * Identity is normalized the same way the inherited comparison normalizes it:
+ * app IDs are compared case-insensitively, so they are lowercased here, while
+ * the environment ID is compared verbatim and is digested verbatim. Digesting
+ * the raw body instead would make a case-only app ID edit change the revision
+ * without changing effective identity, which trips the inherited "revision
+ * changes iff content changes" invariant. The manifest is digested as authored,
+ * because its contents are semantic.
+ */
+export declare function computeOobRevision(input: {
+    environmentId: string;
+    body: OobRevisionBody;
+}): string;
+/** The portion of an init body the effective OOB revision is derived from. */
+export interface OobRevisionBody {
+    app: {
+        id: string;
+        manifest: unknown;
+    };
+}
+//# sourceMappingURL=OobRevision.d.ts.map

package/dist/snapshot/OobRevision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OobRevision.d.ts","sourceRoot":"","sources":["../../src/snapshot/OobRevision.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAUpD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,eAAe,CAAC;CACvB,GAAG,MAAM,CAOT;AAED,8EAA8E;AAC9E,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;CACxC"}

package/dist/snapshot/OobRevision.js

@@ -0,0 +1,40 @@
+/*!
+ * Copyright (C) Microsoft Corporation. All rights reserved.
+ */
+import { createHash } from 'node:crypto';
+/**
+ * Deterministic JSON with object keys sorted at every depth. Array order is
+ * preserved because it is meaningful in JSON Schema. Used only to derive the
+ * effective OOB revision, never to produce the bytes sent to the backend.
+ */
+export function canonicalJson(value) {
+    return JSON.stringify(value, (_key, entry) => entry !== null && typeof entry === 'object' && !Array.isArray(entry)
+        ? Object.fromEntries(Object.entries(entry).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0))
+        : entry);
+}
+/**
+ * Opaque revision for the effective OOB content. It covers exactly what the
+ * inherited `validateDevelopmentSnapshotUpdate` treats as OOB-affecting — app
+ * identity, the inline manifest, and the effective environment identity — so it
+ * changes if and only if one of those changes. Formatting-only, asset-only and
+ * connector-only edits leave it unchanged and keep the backend session valid.
+ * Key order is insensitive because the digest is taken over canonical JSON.
+ * The digest is a local change detector, not a security or integrity claim.
+ *
+ * Identity is normalized the same way the inherited comparison normalizes it:
+ * app IDs are compared case-insensitively, so they are lowercased here, while
+ * the environment ID is compared verbatim and is digested verbatim. Digesting
+ * the raw body instead would make a case-only app ID edit change the revision
+ * without changing effective identity, which trips the inherited "revision
+ * changes iff content changes" invariant. The manifest is digested as authored,
+ * because its contents are semantic.
+ */
+export function computeOobRevision(input) {
+    const identity = {
+        environmentId: input.environmentId,
+        appId: input.body.app.id.toLowerCase(),
+        manifest: input.body.app.manifest,
+    };
+    return createHash('sha256').update(canonicalJson(identity), 'utf8').digest('hex').slice(0, 32);
+}
+//# sourceMappingURL=OobRevision.js.map

package/dist/snapshot/OobRevision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OobRevision.js","sourceRoot":"","sources":["../../src/snapshot/OobRevision.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,KAAc,EAAE,EAAE,CACpD,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAClE,CAAC,CAAC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAC7C,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACzC,CACF;QACH,CAAC,CAAC,KAAK,CACV,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAGlC;IACC,MAAM,QAAQ,GAAG;QACf,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE;QACtC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ;KAClC,CAAC;IACF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACjG,CAAC"}

package/dist/snapshot/PathPolicy.d.ts

@@ -0,0 +1,69 @@
+/*!
+ * Copyright (C) Microsoft Corporation. All rights reserved.
+ */
+/**
+ * Filesystem access policy for the local development snapshot reader.
+ *
+ * The reader only ever opens two kinds of file inside one explicitly supplied
+ * project root: the base app config, whose name comes from the shared
+ * `BASE_CONFIG_FILE_NAMES` list rather than from a caller, and the schema file
+ * named by `data.schemaPath` (or its legacy `db` alias). There is no upward
+ * discovery and no second allowed root.
+ *
+ * The containment rules follow `Pack`'s `loadDataSchemaAsync`
+ * (`managed-apps-cli/src/Verbs/App/Lifecycle/Pack.ts`) so a project that packs
+ * also reads: non-empty, project-relative, contained after resolution, a regular
+ * file, and valid JSON. The reader is **stricter than pack in one way**: the real
+ * path of every file it opens — base config as well as schema — must also stay
+ * inside the canonicalized root, so a link pointing outside the project is
+ * rejected here even though pack would follow it. The root itself is
+ * canonicalized first, so explicitly selecting a symlinked project directory
+ * still works. This is a deliberate incompatibility: a project that links a
+ * schema in from outside its root must copy it in to serve it locally.
+ *
+ * This is a containment policy, not a defense against concurrent modification of
+ * the project directory. Resolution and reading are separate syscalls, so a path
+ * replaced between them is not detected; the reader assumes the developer's own
+ * working tree and validates the resulting snapshot before it is published.
+ *
+ * Size is deliberately not pack's 10 MiB: initialization is limited to a 1 MiB
+ * whole UTF-8 body by `LOCAL_DEV_INIT_MAX_BODY_BYTES`, enforced through the
+ * inherited serializer, so an oversized schema fails here with a local error
+ * rather than a backend rejection.
+ */
+/** Reader-side failure kinds. Callers map these to their own surface. */
+export declare const SnapshotReadErrorCode: {
+    readonly ConfigMissing: "ConfigMissing";
+    readonly ConfigPathRejected: "ConfigPathRejected";
+    readonly ConfigUnreadable: "ConfigUnreadable";
+    readonly ConfigInvalid: "ConfigInvalid";
+    readonly SchemaPathRejected: "SchemaPathRejected";
+    readonly SchemaUnreadable: "SchemaUnreadable";
+    readonly SchemaInvalid: "SchemaInvalid";
+    readonly SnapshotInvalid: "SnapshotInvalid";
+};
+export type SnapshotReadErrorCode = (typeof SnapshotReadErrorCode)[keyof typeof SnapshotReadErrorCode];
+/**
+ * A read failure that never carries file bytes. The message may name the
+ * configured relative path, which the developer wrote, but not absolute
+ * locations outside the project root.
+ */
+export declare class SnapshotReadError extends Error {
+    readonly code: SnapshotReadErrorCode;
+    constructor(code: SnapshotReadErrorCode, message: string);
+}
+export declare function isPathMissingError(error: unknown): boolean;
+/** Canonicalize the explicitly selected root so a symlinked root still works. */
+export declare function canonicalizeRootAsync(projectRoot: string): Promise<string>;
+/**
+ * Assert that an already-resolved file does not link out of `canonicalRoot`,
+ * which must come from {@link canonicalizeRootAsync}.
+ */
+export declare function assertRealPathContainedAsync(canonicalRoot: string, resolved: string, rejectedCode: SnapshotReadErrorCode, describe: string): Promise<void>;
+/**
+ * Resolve a configured schema path against the canonicalized project root,
+ * rejecting anything that is absolute, escapes the root lexically or through a
+ * link, or is not a regular file. Returns an absolute path safe to read.
+ */
+export declare function resolveSchemaPathAsync(canonicalRoot: string, schemaPath: string, configKey: 'data' | 'db'): Promise<string>;
+//# sourceMappingURL=PathPolicy.d.ts.map

package/dist/snapshot/PathPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PathPolicy.d.ts","sourceRoot":"","sources":["../../src/snapshot/PathPolicy.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,yEAAyE;AACzE,eAAO,MAAM,qBAAqB;;;;;;;;;CASxB,CAAC;AAEX,MAAM,MAAM,qBAAqB,GAC/B,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,OAAO,qBAAqB,CAAC,CAAC;AAErE;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,SAAgB,IAAI,EAAE,qBAAqB,CAAC;gBAEhC,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM;CAKzD;AAYD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE1D;AAED,iFAAiF;AACjF,wBAAsB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAahF;AAED;;;GAGG;AACH,wBAAsB,4BAA4B,CAChD,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,qBAAqB,EACnC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAaf;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,aAAa,EAAE,MAAM,EACrB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAAG,IAAI,GACvB,OAAO,CAAC,MAAM,CAAC,CA+CjB"}

package/dist/snapshot/PathPolicy.js

@@ -0,0 +1,129 @@
+/*!
+ * Copyright (C) Microsoft Corporation. All rights reserved.
+ */
+import { promises as fsp } from 'node:fs';
+import path from 'node:path';
+/**
+ * Filesystem access policy for the local development snapshot reader.
+ *
+ * The reader only ever opens two kinds of file inside one explicitly supplied
+ * project root: the base app config, whose name comes from the shared
+ * `BASE_CONFIG_FILE_NAMES` list rather than from a caller, and the schema file
+ * named by `data.schemaPath` (or its legacy `db` alias). There is no upward
+ * discovery and no second allowed root.
+ *
+ * The containment rules follow `Pack`'s `loadDataSchemaAsync`
+ * (`managed-apps-cli/src/Verbs/App/Lifecycle/Pack.ts`) so a project that packs
+ * also reads: non-empty, project-relative, contained after resolution, a regular
+ * file, and valid JSON. The reader is **stricter than pack in one way**: the real
+ * path of every file it opens — base config as well as schema — must also stay
+ * inside the canonicalized root, so a link pointing outside the project is
+ * rejected here even though pack would follow it. The root itself is
+ * canonicalized first, so explicitly selecting a symlinked project directory
+ * still works. This is a deliberate incompatibility: a project that links a
+ * schema in from outside its root must copy it in to serve it locally.
+ *
+ * This is a containment policy, not a defense against concurrent modification of
+ * the project directory. Resolution and reading are separate syscalls, so a path
+ * replaced between them is not detected; the reader assumes the developer's own
+ * working tree and validates the resulting snapshot before it is published.
+ *
+ * Size is deliberately not pack's 10 MiB: initialization is limited to a 1 MiB
+ * whole UTF-8 body by `LOCAL_DEV_INIT_MAX_BODY_BYTES`, enforced through the
+ * inherited serializer, so an oversized schema fails here with a local error
+ * rather than a backend rejection.
+ */
+/** Reader-side failure kinds. Callers map these to their own surface. */
+export const SnapshotReadErrorCode = {
+    ConfigMissing: 'ConfigMissing',
+    ConfigPathRejected: 'ConfigPathRejected',
+    ConfigUnreadable: 'ConfigUnreadable',
+    ConfigInvalid: 'ConfigInvalid',
+    SchemaPathRejected: 'SchemaPathRejected',
+    SchemaUnreadable: 'SchemaUnreadable',
+    SchemaInvalid: 'SchemaInvalid',
+    SnapshotInvalid: 'SnapshotInvalid',
+};
+/**
+ * A read failure that never carries file bytes. The message may name the
+ * configured relative path, which the developer wrote, but not absolute
+ * locations outside the project root.
+ */
+export class SnapshotReadError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'SnapshotReadError';
+        this.code = code;
+    }
+}
+function isContained(root, resolved) {
+    const relative = path.relative(root, resolved);
+    return (relative !== '' &&
+        relative !== '..' &&
+        !relative.startsWith(`..${path.sep}`) &&
+        !path.isAbsolute(relative));
+}
+export function isPathMissingError(error) {
+    return error.code === 'ENOENT';
+}
+/** Canonicalize the explicitly selected root so a symlinked root still works. */
+export async function canonicalizeRootAsync(projectRoot) {
+    const resolved = path.resolve(projectRoot);
+    try {
+        return await fsp.realpath(resolved);
+    }
+    catch (error) {
+        if (isPathMissingError(error)) {
+            return resolved;
+        }
+        throw new SnapshotReadError(SnapshotReadErrorCode.ConfigUnreadable, `Unable to resolve the project root: ${error.message}`);
+    }
+}
+/**
+ * Assert that an already-resolved file does not link out of `canonicalRoot`,
+ * which must come from {@link canonicalizeRootAsync}.
+ */
+export async function assertRealPathContainedAsync(canonicalRoot, resolved, rejectedCode, describe) {
+    let real;
+    try {
+        real = await fsp.realpath(resolved);
+    }
+    catch (error) {
+        throw new SnapshotReadError(rejectedCode, `Unable to resolve ${describe}: ${error.message}`);
+    }
+    if (!isContained(canonicalRoot, real)) {
+        throw new SnapshotReadError(rejectedCode, `${describe} must not link outside the project root`);
+    }
+}
+/**
+ * Resolve a configured schema path against the canonicalized project root,
+ * rejecting anything that is absolute, escapes the root lexically or through a
+ * link, or is not a regular file. Returns an absolute path safe to read.
+ */
+export async function resolveSchemaPathAsync(canonicalRoot, schemaPath, configKey) {
+    const setting = `${configKey}.schemaPath`;
+    if (!schemaPath.trim()) {
+        throw new SnapshotReadError(SnapshotReadErrorCode.SchemaPathRejected, `${setting} must not be empty`);
+    }
+    if (path.isAbsolute(schemaPath)) {
+        throw new SnapshotReadError(SnapshotReadErrorCode.SchemaPathRejected, `${setting} must be relative to the project root: "${schemaPath}"`);
+    }
+    const resolved = path.resolve(canonicalRoot, schemaPath);
+    if (!isContained(canonicalRoot, resolved)) {
+        throw new SnapshotReadError(SnapshotReadErrorCode.SchemaPathRejected, `${setting} must not resolve outside the project root: "${schemaPath}"`);
+    }
+    let stat;
+    try {
+        stat = await fsp.stat(resolved);
+    }
+    catch (error) {
+        throw new SnapshotReadError(SnapshotReadErrorCode.SchemaUnreadable, `Unable to access ${setting} "${schemaPath}": ${error.message}`);
+    }
+    if (!stat.isFile()) {
+        throw new SnapshotReadError(SnapshotReadErrorCode.SchemaPathRejected, `${setting} must reference a regular file: "${schemaPath}"`);
+    }
+    await assertRealPathContainedAsync(canonicalRoot, resolved, SnapshotReadErrorCode.SchemaPathRejected, `${setting} "${schemaPath}"`);
+    return resolved;
+}
+//# sourceMappingURL=PathPolicy.js.map

package/dist/snapshot/PathPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PathPolicy.js","sourceRoot":"","sources":["../../src/snapshot/PathPolicy.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,IAAI,GAAG,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,yEAAyE;AACzE,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,aAAa,EAAE,eAAe;IAC9B,kBAAkB,EAAE,oBAAoB;IACxC,gBAAgB,EAAE,kBAAkB;IACpC,aAAa,EAAE,eAAe;IAC9B,kBAAkB,EAAE,oBAAoB;IACxC,gBAAgB,EAAE,kBAAkB;IACpC,aAAa,EAAE,eAAe;IAC9B,eAAe,EAAE,iBAAiB;CAC1B,CAAC;AAKX;;;;GAIG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1B,IAAI,CAAwB;IAE5C,YAAY,IAA2B,EAAE,OAAe;QACtD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,QAAgB;IACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/C,OAAO,CACL,QAAQ,KAAK,EAAE;QACf,QAAQ,KAAK,IAAI;QACjB,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QACrC,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAQ,KAA+B,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC5D,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,WAAmB;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,CAAC,gBAAgB,EACtC,uCAAwC,KAAe,CAAC,OAAO,EAAE,CAClE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,aAAqB,EACrB,QAAgB,EAChB,YAAmC,EACnC,QAAgB;IAEhB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CACzB,YAAY,EACZ,qBAAqB,QAAQ,KAAM,KAAe,CAAC,OAAO,EAAE,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,iBAAiB,CAAC,YAAY,EAAE,GAAG,QAAQ,yCAAyC,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,aAAqB,EACrB,UAAkB,EAClB,SAAwB;IAExB,MAAM,OAAO,GAAG,GAAG,SAAS,aAAa,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,CAAC,kBAAkB,EACxC,GAAG,OAAO,oBAAoB,CAC/B,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,CAAC,kBAAkB,EACxC,GAAG,OAAO,2CAA2C,UAAU,GAAG,CACnE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACzD,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,CAAC,kBAAkB,EACxC,GAAG,OAAO,gDAAgD,UAAU,GAAG,CACxE,CAAC;IACJ,CAAC;IAED,IAAI,IAA0C,CAAC;IAC/C,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,CAAC,gBAAgB,EACtC,oBAAoB,OAAO,KAAK,UAAU,MAAO,KAAe,CAAC,OAAO,EAAE,CAC3E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,CAAC,kBAAkB,EACxC,GAAG,OAAO,oCAAoC,UAAU,GAAG,CAC5D,CAAC;IACJ,CAAC;IAED,MAAM,4BAA4B,CAChC,aAAa,EACb,QAAQ,EACR,qBAAqB,CAAC,kBAAkB,EACxC,GAAG,OAAO,KAAK,UAAU,GAAG,CAC7B,CAAC;IAEF,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/snapshot/SnapshotReader.d.ts

@@ -0,0 +1,63 @@
+/*!
+ * Copyright (C) Microsoft Corporation. All rights reserved.
+ */
+import type { DevelopmentSnapshot } from '@microsoft/managed-apps-common/gateway';
+/**
+ * Filesystem half of `@microsoft/managed-apps-dev-gateway`: it turns the project's
+ * on-disk config and schema into one coherent, immutable `DevelopmentSnapshot`.
+ *
+ * It is a pure reader. There is no HTTP listener, endpoint handler, watcher, Vite
+ * integration, browser channel handler or remote authorization here, and it never
+ * builds or packs the customer app — `manifest.json` is not required on disk.
+ * A snapshot is configuration, never proof of authorization.
+ *
+ * **Exposure boundary.** The reader reads only the validated `ConfigSchemaV0`
+ * fields of the project's base config plus the JSON schema file that config
+ * points at. It reads no credentials, tokens or other files, and adds no fields
+ * of its own. That is a bound on what it collects, not a claim that the result is
+ * harmless: the inline schema is data the legacy config endpoint never carried,
+ * and an app config can hold user-authored content the developer considers
+ * sensitive. Whoever exposes a snapshot owns that decision; the HTTP exposure
+ * policy is not settled here.
+ */
+/** Reader inputs. The root is explicit; the reader never discovers one itself. */
+export interface ReadDevelopmentSnapshotOptions {
+    /** Absolute path of the project directory whose config may be served. */
+    projectRoot: string;
+    /**
+     * Combined snapshot revision for this read, owned by the caller because it is
+     * scoped to a bootstrap lifetime the reader does not observe. Must increase
+     * within one bootstrap; a restarted producer starts a new bootstrap instead.
+     */
+    revision: number;
+}
+/** Successful read plus the exact init bytes retained for retries. */
+export interface DevelopmentSnapshotRead {
+    snapshot: DevelopmentSnapshot;
+    /**
+     * The serialized `InitDevSessionBody` that was validated against the 1 MiB
+     * limit. Retain these bytes with the candidate GUID so a retry replays the
+     * identical request rather than re-serializing.
+     */
+    initBody: string;
+}
+/**
+ * Freeze a JSON value in place at every depth. `Object.freeze` is shallow, so a
+ * shallowly frozen snapshot still lets a caller mutate `hostConfig.appId`,
+ * `oob.environmentId` or `oob.body.app.manifest.data`. Because the source stores
+ * and hands back the same object, such a mutation would corrupt retained state
+ * and desynchronize the snapshot from its already-serialized init body.
+ *
+ * The value is known-acyclic here: it comes from `JSON.parse` and object
+ * literals, then through a Zod parse, so no cycle tracking is needed.
+ */
+export declare function deepFreezeJson<T>(value: T): T;
+/**
+ * Produce one coherent snapshot from the project's current files. Both portions
+ * derive from a single config read, so the host config and the OOB body can never
+ * describe different apps. The OOB body carries app identity and the inline
+ * manifest only: connection references, connections and deployment fields stay in
+ * the host config and are never sent to initialization.
+ */
+export declare function readDevelopmentSnapshotAsync(options: ReadDevelopmentSnapshotOptions): Promise<DevelopmentSnapshotRead>;
+//# sourceMappingURL=SnapshotReader.d.ts.map

package/dist/snapshot/SnapshotReader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SnapshotReader.d.ts","sourceRoot":"","sources":["../../src/snapshot/SnapshotReader.ts"],"names":[],"mappings":"AAAA;;GAEG;AAOH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAkBlF;;;;;;;;;;;;;;;;;GAiBG;AAEH,kFAAkF;AAClF,MAAM,WAAW,8BAA8B;IAC7C,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,sEAAsE;AACtE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,mBAAmB,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;CAClB;AAoKD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAI7C;AAED;;;;;;GAMG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,8BAA8B,GACtC,OAAO,CAAC,uBAAuB,CAAC,CAwDlC"}

package/dist/snapshot/SnapshotReader.js

@@ -0,0 +1,182 @@
+/*!
+ * Copyright (C) Microsoft Corporation. All rights reserved.
+ */
+import { promises as fsp } from 'node:fs';
+import path from 'node:path';
+import { BASE_CONFIG_FILE_NAMES, ConfigSchemaV0 } from '@microsoft/managed-apps-common/config';
+import { DevelopmentSnapshotSchema, LOCAL_DEV_INIT_MAX_BODY_BYTES, LOCAL_DEV_OOB_MANIFEST_VERSION, serializeInitDevSessionBody, } from '@microsoft/managed-apps-common/gateway';
+import { computeOobRevision } from './OobRevision.js';
+import { assertRealPathContainedAsync, canonicalizeRootAsync, isPathMissingError, resolveSchemaPathAsync, SnapshotReadError, SnapshotReadErrorCode, } from './PathPolicy.js';
+const CONFIG_KEYS = ['data', 'db'];
+const CONFIG_MAX_FILE_BYTES = 2 * 1024 * 1024;
+async function readBoundedUtf8FileAsync(options) {
+    let stat;
+    try {
+        stat = await fsp.stat(options.filePath);
+    }
+    catch (error) {
+        throw new SnapshotReadError(options.unreadableCode, `Unable to access ${options.displayName}: ${error.message}`);
+    }
+    if (stat.size > options.maxBytes) {
+        throw new SnapshotReadError(options.invalidCode, `${options.displayName} exceeds the ${options.maxBytes}-byte file limit`);
+    }
+    let content;
+    try {
+        content = await fsp.readFile(options.filePath, 'utf-8');
+    }
+    catch (error) {
+        throw new SnapshotReadError(options.unreadableCode, `Unable to read ${options.displayName}: ${error.message}`);
+    }
+    if (Buffer.byteLength(content, 'utf-8') > options.maxBytes) {
+        throw new SnapshotReadError(options.invalidCode, `${options.displayName} exceeds the ${options.maxBytes}-byte file limit`);
+    }
+    return content;
+}
+async function readBaseConfigAsync(canonicalRoot) {
+    const attempted = [];
+    for (const fileName of BASE_CONFIG_FILE_NAMES) {
+        attempted.push(fileName);
+        const filePath = path.join(canonicalRoot, fileName);
+        let stat;
+        try {
+            stat = await fsp.stat(filePath);
+        }
+        catch (error) {
+            if (isPathMissingError(error)) {
+                continue;
+            }
+            throw new SnapshotReadError(SnapshotReadErrorCode.ConfigUnreadable, `Unable to access ${fileName}: ${error.message}`);
+        }
+        if (!stat?.isFile()) {
+            continue;
+        }
+        await assertRealPathContainedAsync(canonicalRoot, filePath, SnapshotReadErrorCode.ConfigPathRejected, fileName);
+        const content = await readBoundedUtf8FileAsync({
+            filePath,
+            displayName: fileName,
+            maxBytes: CONFIG_MAX_FILE_BYTES,
+            unreadableCode: SnapshotReadErrorCode.ConfigUnreadable,
+            invalidCode: SnapshotReadErrorCode.ConfigInvalid,
+        });
+        return { fileName, content };
+    }
+    throw new SnapshotReadError(SnapshotReadErrorCode.ConfigMissing, `No app config found in the project root. Expected one of: ${attempted.join(', ')}`);
+}
+function parseConfig(fileName, content) {
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch (error) {
+        throw new SnapshotReadError(SnapshotReadErrorCode.ConfigInvalid, `${fileName} must contain valid JSON: ${error.message}`);
+    }
+    const result = ConfigSchemaV0.safeParse(parsed);
+    if (!result.success) {
+        const issues = result.error.issues
+            .map((issue) => `${issue.path.length > 0 ? issue.path.join('.') : '(root)'}: ${issue.message}`)
+            .join('\n');
+        throw new SnapshotReadError(SnapshotReadErrorCode.ConfigInvalid, `${fileName} is not a valid app config:\n${issues}`);
+    }
+    return result.data;
+}
+/**
+ * Read the configured schema, if any. Returns `undefined` only when no schema is
+ * configured at all; a configured-but-broken schema is an error, never an empty
+ * manifest, so invalid input can never silently replace a valid snapshot.
+ */
+async function readInlineSchemaAsync(canonicalRoot, appConfig) {
+    const configKey = CONFIG_KEYS.find((key) => appConfig[key] !== undefined);
+    if (configKey === undefined) {
+        return undefined;
+    }
+    const schemaPath = appConfig[configKey].schemaPath;
+    const resolved = await resolveSchemaPathAsync(canonicalRoot, schemaPath, configKey);
+    const content = await readBoundedUtf8FileAsync({
+        filePath: resolved,
+        displayName: `${configKey}.schemaPath "${schemaPath}"`,
+        maxBytes: LOCAL_DEV_INIT_MAX_BODY_BYTES,
+        unreadableCode: SnapshotReadErrorCode.SchemaUnreadable,
+        invalidCode: SnapshotReadErrorCode.SchemaInvalid,
+    });
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch (error) {
+        throw new SnapshotReadError(SnapshotReadErrorCode.SchemaInvalid, `${configKey}.schemaPath "${schemaPath}" must contain valid JSON: ${error.message}`);
+    }
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new SnapshotReadError(SnapshotReadErrorCode.SchemaInvalid, `${configKey}.schemaPath "${schemaPath}" must contain a JSON object`);
+    }
+    return parsed;
+}
+/**
+ * Freeze a JSON value in place at every depth. `Object.freeze` is shallow, so a
+ * shallowly frozen snapshot still lets a caller mutate `hostConfig.appId`,
+ * `oob.environmentId` or `oob.body.app.manifest.data`. Because the source stores
+ * and hands back the same object, such a mutation would corrupt retained state
+ * and desynchronize the snapshot from its already-serialized init body.
+ *
+ * The value is known-acyclic here: it comes from `JSON.parse` and object
+ * literals, then through a Zod parse, so no cycle tracking is needed.
+ */
+export function deepFreezeJson(value) {
+    if (value === null || typeof value !== 'object' || Object.isFrozen(value))
+        return value;
+    for (const entry of Object.values(value))
+        deepFreezeJson(entry);
+    return Object.freeze(value);
+}
+/**
+ * Produce one coherent snapshot from the project's current files. Both portions
+ * derive from a single config read, so the host config and the OOB body can never
+ * describe different apps. The OOB body carries app identity and the inline
+ * manifest only: connection references, connections and deployment fields stay in
+ * the host config and are never sent to initialization.
+ */
+export async function readDevelopmentSnapshotAsync(options) {
+    const canonicalRoot = await canonicalizeRootAsync(options.projectRoot);
+    const { fileName, content } = await readBaseConfigAsync(canonicalRoot);
+    const hostConfig = parseConfig(fileName, content);
+    const schema = await readInlineSchemaAsync(canonicalRoot, hostConfig);
+    const dataEnabled = hostConfig.data?.enabled ?? hostConfig.db?.enabled;
+    const body = {
+        app: {
+            id: hostConfig.appId ?? '',
+            manifest: {
+                manifestVersion: LOCAL_DEV_OOB_MANIFEST_VERSION,
+                ...(dataEnabled !== undefined ? { dataEnabled } : {}),
+                ...(schema !== undefined ? { data: schema } : {}),
+            },
+        },
+    };
+    const environmentId = hostConfig.environmentId ?? '';
+    let initBody;
+    try {
+        // Also enforces the 1 MiB whole-body limit before anything is published.
+        initBody = serializeInitDevSessionBody(body);
+    }
+    catch (error) {
+        throw new SnapshotReadError(SnapshotReadErrorCode.SnapshotInvalid, `${fileName} does not describe a usable development session: ${error.message}`);
+    }
+    const candidate = {
+        version: 1,
+        revision: options.revision,
+        hostConfig,
+        oob: {
+            version: 1,
+            revision: computeOobRevision({ environmentId, body }),
+            environmentId,
+            body,
+        },
+    };
+    const validated = DevelopmentSnapshotSchema.safeParse(candidate);
+    if (!validated.success) {
+        const issues = validated.error.issues
+            .map((issue) => `${issue.path.length > 0 ? issue.path.join('.') : '(root)'}: ${issue.message}`)
+            .join('\n');
+        throw new SnapshotReadError(SnapshotReadErrorCode.SnapshotInvalid, `${fileName} does not describe a usable development session:\n${issues}`);
+    }
+    return { snapshot: deepFreezeJson(validated.data), initBody };
+}
+//# sourceMappingURL=SnapshotReader.js.map

package/dist/snapshot/SnapshotReader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SnapshotReader.js","sourceRoot":"","sources":["../../src/snapshot/SnapshotReader.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,IAAI,GAAG,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAE/F,OAAO,EACL,yBAAyB,EACzB,6BAA6B,EAC7B,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,wCAAwC,CAAC;AAEhD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EACL,4BAA4B,EAC5B,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AA4CtB,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,IAAI,CAAU,CAAC;AAC5C,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAU9C,KAAK,UAAU,wBAAwB,CAAC,OAA+B;IACrE,IAAI,IAA0C,CAAC;IAC/C,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CACzB,OAAO,CAAC,cAAc,EACtB,oBAAoB,OAAO,CAAC,WAAW,KAAM,KAAe,CAAC,OAAO,EAAE,CACvE,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,iBAAiB,CACzB,OAAO,CAAC,WAAW,EACnB,GAAG,OAAO,CAAC,WAAW,gBAAgB,OAAO,CAAC,QAAQ,kBAAkB,CACzE,CAAC;IACJ,CAAC;IAED,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CACzB,OAAO,CAAC,cAAc,EACtB,kBAAkB,OAAO,CAAC,WAAW,KAAM,KAAe,CAAC,OAAO,EAAE,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,IAAI,iBAAiB,CACzB,OAAO,CAAC,WAAW,EACnB,GAAG,OAAO,CAAC,WAAW,gBAAgB,OAAO,CAAC,QAAQ,kBAAkB,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,aAAqB;IAErB,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,QAAQ,IAAI,sBAAsB,EAAE,CAAC;QAC9C,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,IAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9B,SAAS;YACX,CAAC;YACD,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,CAAC,gBAAgB,EACtC,oBAAoB,QAAQ,KAAM,KAAe,CAAC,OAAO,EAAE,CAC5D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,4BAA4B,CAChC,aAAa,EACb,QAAQ,EACR,qBAAqB,CAAC,kBAAkB,EACxC,QAAQ,CACT,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC;YAC7C,QAAQ;YACR,WAAW,EAAE,QAAQ;YACrB,QAAQ,EAAE,qBAAqB;YAC/B,cAAc,EAAE,qBAAqB,CAAC,gBAAgB;YACtD,WAAW,EAAE,qBAAqB,CAAC,aAAa;SACjD,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,CAAC,aAAa,EACnC,6DAA6D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,QAAgB,EAAE,OAAe;IACpD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,CAAC,aAAa,EACnC,GAAG,QAAQ,6BAA8B,KAAe,CAAC,OAAO,EAAE,CACnE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAC/B,GAAG,CACF,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAC1F;aACA,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,CAAC,aAAa,EACnC,GAAG,QAAQ,gCAAgC,MAAM,EAAE,CACpD,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,IAAiB,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,qBAAqB,CAClC,aAAqB,EACrB,SAAoB;IAEpB,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC;IAC1E,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,SAAS,CAAE,CAAC,UAAU,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,aAAa,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAEpF,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC;QAC7C,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,GAAG,SAAS,gBAAgB,UAAU,GAAG;QACtD,QAAQ,EAAE,6BAA6B;QACvC,cAAc,EAAE,qBAAqB,CAAC,gBAAgB;QACtD,WAAW,EAAE,qBAAqB,CAAC,aAAa;KACjD,CAAC,CAAC;IAEH,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,CAAC,aAAa,EACnC,GAAG,SAAS,gBAAgB,UAAU,8BAA+B,KAAe,CAAC,OAAO,EAAE,CAC/F,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,CAAC,aAAa,EACnC,GAAG,SAAS,gBAAgB,UAAU,8BAA8B,CACrE,CAAC;IACJ,CAAC;IAED,OAAO,MAAiC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAI,KAAQ;IACxC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,cAAc,CAAC,KAAK,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAAuC;IAEvC,MAAM,aAAa,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACvE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,mBAAmB,CAAC,aAAa,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACtE,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,EAAE,OAAO,IAAI,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC;IAEvE,MAAM,IAAI,GAAG;QACX,GAAG,EAAE;YACH,EAAE,EAAE,UAAU,CAAC,KAAK,IAAI,EAAE;YAC1B,QAAQ,EAAE;gBACR,eAAe,EAAE,8BAA8B;gBAC/C,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClD;SACF;KACF,CAAC;IAEF,MAAM,aAAa,GAAG,UAAU,CAAC,aAAa,IAAI,EAAE,CAAC;IACrD,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,yEAAyE;QACzE,QAAQ,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,CAAC,eAAe,EACrC,GAAG,QAAQ,oDAAqD,KAAe,CAAC,OAAO,EAAE,CAC1F,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG;QAChB,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU;QACV,GAAG,EAAE;YACH,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE,kBAAkB,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;YACrD,aAAa;YACb,IAAI;SACL;KACF,CAAC;IAEF,MAAM,SAAS,GAAG,yBAAyB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACjE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM;aAClC,GAAG,CACF,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAC1F;aACA,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,iBAAiB,CACzB,qBAAqB,CAAC,eAAe,EACrC,GAAG,QAAQ,qDAAqD,MAAM,EAAE,CACzE,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC;AAChE,CAAC"}

package/dist/snapshot/SnapshotSource.d.ts

@@ -0,0 +1,49 @@
+/*!
+ * Copyright (C) Microsoft Corporation. All rights reserved.
+ */
+import type { DevelopmentSnapshot } from '@microsoft/managed-apps-common/gateway';
+import { validateDevelopmentSnapshotUpdate } from '@microsoft/managed-apps-common/gateway';
+import type { DevelopmentSnapshotRead } from './SnapshotReader.js';
+/**
+ * Holds the last snapshot that read and validated cleanly, and mints the combined
+ * revision for one bootstrap lifetime.
+ *
+ * A failed refresh leaves the previous snapshot installed and rethrows, so invalid
+ * input can never downgrade a working session to an empty manifest. This is state
+ * for a caller that decides *when* to refresh; it is not a watcher, debouncer or
+ * session coordinator, and it performs no HTTP work.
+ */
+export declare class DevelopmentSnapshotSource {
+    private readonly projectRoot;
+    private revision;
+    private current;
+    /**
+     * Tail of the serialized refresh queue. Refreshes must not interleave: the
+     * combined revision is allocated from `this.revision`, and an `await` between
+     * allocation and installation would let two overlapping refreshes both mint
+     * `N + 1` and hand back distinct snapshots carrying the same revision. Each
+     * caller installs a fulfilled gate before awaiting the previous one, preserving
+     * FIFO order without letting a failed refresh poison the callers behind it.
+     */
+    private pending;
+    constructor(projectRoot: string);
+    /** The last successful read, or `undefined` before the first one. */
+    get snapshot(): DevelopmentSnapshot | undefined;
+    /** Init bytes matching {@link snapshot}, retained for exact-body retries. */
+    get initBody(): string | undefined;
+    /**
+     * Re-read the project. On success the new snapshot is installed and classified
+     * relative to the previous one, so a caller can tell a connector-only metadata
+     * update from an OOB or identity change. On failure the previous snapshot stays
+     * installed and the error propagates.
+     *
+     * Concurrent calls are serialized, not coalesced: every call performs its own
+     * read, in call order, and observes the state left by the one before it.
+     */
+    refreshAsync(): Promise<{
+        read: DevelopmentSnapshotRead;
+        change: ReturnType<typeof validateDevelopmentSnapshotUpdate>['change'];
+    }>;
+    private readAndInstallAsync;
+}
+//# sourceMappingURL=SnapshotSource.d.ts.map

package/dist/snapshot/SnapshotSource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SnapshotSource.d.ts","sourceRoot":"","sources":["../../src/snapshot/SnapshotSource.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,EAAE,iCAAiC,EAAE,MAAM,wCAAwC,CAAC;AAE3F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAGhE;;;;;;;;GAQG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAK;IACrB,OAAO,CAAC,OAAO,CAAsC;IACrD;;;;;;;OAOG;IACH,OAAO,CAAC,OAAO,CAAoC;gBAEvC,WAAW,EAAE,MAAM;IAI/B,qEAAqE;IACrE,IAAW,QAAQ,IAAI,mBAAmB,GAAG,SAAS,CAErD;IAED,6EAA6E;IAC7E,IAAW,QAAQ,IAAI,MAAM,GAAG,SAAS,CAExC;IAED;;;;;;;;OAQG;IACU,YAAY,IAAI,OAAO,CAAC;QACnC,IAAI,EAAE,uBAAuB,CAAC;QAC9B,MAAM,EAAE,UAAU,CAAC,OAAO,iCAAiC,CAAC,CAAC,QAAQ,CAAC,CAAC;KACxE,CAAC;YAeY,mBAAmB;CAyBlC"}