@murmurv2/cli 2.11.0

package/runtime/packages/setup/dist/src/onboarding.js

@@ -0,0 +1,298 @@
+import { constants } from 'node:fs';
+import { mkdir, open, rmdir, lstat, unlink, realpath, stat } from 'node:fs/promises';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { isDeepStrictEqual, promisify } from 'node:util';
+import { execFile } from 'node:child_process';
+import { SQLiteDedupeOutboxStore } from '@murmurv2/core';
+import { createKeyPair, createSigningKeyPair } from '@murmurv2/security';
+import { loadConfig, validateConfig, validAgentId } from './config.js';
+import { writeState } from './state.js';
+import { refuseVirtualizedAppData } from './appdata.js';
+import { protectPrivateFile } from './private-file.js';
+async function privateText(file, role) {
+    if (!path.isAbsolute(file))
+        throw new Error('onboarding.file-must-be-absolute');
+    // Name the option and the reason, never the path or contents: this is what a new user acts on.
+    const handle = await open(file, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0)).catch((e) => {
+        if (e.code === 'ENOENT')
+            throw new Error(`onboarding.${role}-not-found`);
+        if (e.code === 'EPERM' || e.code === 'EACCES')
+            throw new Error(`onboarding.${role}-access-denied`);
+        throw e;
+    });
+    try {
+        const info = await handle.stat();
+        if (!info.isFile() || info.size > 16384)
+            throw new Error('onboarding.file-invalid');
+        return (await handle.readFile('utf8')).trim();
+    }
+    finally {
+        await handle.close();
+    }
+}
+/** Resolve existing ancestors without erasing symlink/.. filesystem semantics. */
+async function canonicalPath(file) {
+    try {
+        return await realpath(file);
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+        const parent = path.dirname(file);
+        if (parent === file)
+            throw error;
+        return path.join(await canonicalPath(parent), path.basename(file));
+    }
+}
+async function validateOutput(c, file) {
+    if (!path.isAbsolute(file))
+        throw new Error('onboarding.output-must-be-absolute');
+    let parent;
+    try {
+        parent = await realpath(path.dirname(file));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            throw new Error('onboarding.output-parent-required');
+        throw error;
+    }
+    if (!(await stat(parent)).isDirectory())
+        throw new Error('onboarding.output-parent-required');
+    // A nonexistent output parent must not become valid as a side effect of profile creation.
+    // On case-insensitive APFS, differently spelled missing paths can name that same directory.
+    const target = path.join(parent, path.basename(file)), profile = await canonicalPath(c.dataDir);
+    const relative = path.relative(profile, target);
+    if (!relative || (!relative.startsWith('..' + path.sep) && relative !== '..' && !path.isAbsolute(relative))) {
+        throw new Error('onboarding.output-inside-profile');
+    }
+    const profileInfo = await stat(c.dataDir, { bigint: true }).catch((error) => {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    });
+    // Existing path aliases are compared by filesystem identity, not by lowercasing names.
+    if (profileInfo)
+        for (let ancestor = parent;; ancestor = path.dirname(ancestor)) {
+            // NTFS file IDs can exceed Number.MAX_SAFE_INTEGER. Rounding neighboring
+            // directory IDs can falsely identify an outside output as part of the profile.
+            const info = await stat(ancestor, { bigint: true });
+            if (info.dev === profileInfo.dev && info.ino === profileInfo.ino)
+                throw new Error('onboarding.output-inside-profile');
+            if (path.dirname(ancestor) === ancestor)
+                break;
+        }
+}
+const execFileAsync = promisify(execFile);
+// These tools set the ACL of files holding keys and the broker token: never resolve them through PATH.
+const system32 = (tool) => path.win32.join(process.env.SystemRoot ?? 'C:\\Windows', 'System32', tool);
+let userSid;
+/**
+ * POSIX modes do not restrict Windows files: a new file inherits its folder's DACL, which on a
+ * non-system drive grants Authenticated Users modify. Replace it with a protected DACL for the
+ * current user and SYSTEM (the LocalSystem service reads the profile). Only paths this process
+ * has just created are changed; an existing profile keeps the ACL its owner chose.
+ */
+async function restrictToCurrentUser(target, directory) {
+    if (process.platform !== 'win32')
+        return;
+    userSid ??= execFileAsync(system32('whoami.exe'), ['/user', '/fo', 'csv', '/nh'], { windowsHide: true }).then(({ stdout }) => {
+        const sid = /"(S-1-5-[0-9-]+)"\s*$/.exec(stdout.trim())?.[1];
+        if (!sid)
+            throw new Error('onboarding.user-sid-unavailable');
+        return sid;
+    }, () => { throw new Error('onboarding.user-sid-unavailable'); });
+    // A failed lookup is not remembered: the next attempt in this process measures again.
+    const sid = await userSid.catch((error) => { userSid = undefined; throw error; });
+    const inherit = directory ? '(OI)(CI)' : '';
+    await execFileAsync(system32('icacls.exe'), [target, '/inheritance:r', '/grant:r', `*${sid}:${inherit}(F)`, `*S-1-5-18:${inherit}(F)`], { windowsHide: true })
+        .catch(() => { throw new Error('onboarding.private-acl-failed'); });
+}
+async function outputBlob(file, value, prefix, beforeWrite) {
+    if (!path.isAbsolute(file))
+        throw new Error('onboarding.output-must-be-absolute');
+    const handle = await open(file, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0), 0o600);
+    let written = false;
+    try {
+        // Protect the still-empty output before writing the invitation credential.
+        await protectPrivateFile(file, handle);
+        await beforeWrite?.();
+        await handle.writeFile(prefix + Buffer.from(JSON.stringify(value)).toString('base64') + '\n');
+        await handle.sync();
+        written = true;
+    }
+    finally {
+        await handle.close();
+        if (!written)
+            await unlink(file).catch(() => { });
+    }
+}
+async function locked(c, fn) {
+    // mkdir reports a path only when it created something: never rewrite an existing profile's ACL.
+    const created = await mkdir(c.dataDir, { recursive: true, mode: 0o700 });
+    if (created !== undefined) {
+        try {
+            await restrictToCurrentUser(c.dataDir, true);
+        }
+        catch (error) {
+            // Left in place, the unprotected directory would pass as an existing profile on retry and
+            // receive the keys under its inherited DACL. Remove exactly what mkdir just created (all empty).
+            for (let dir = c.dataDir;; dir = path.dirname(dir)) {
+                await rmdir(dir).catch(() => { });
+                if (dir === created || path.dirname(dir) === dir)
+                    break;
+            }
+            throw error;
+        }
+    }
+    const lock = path.join(c.dataDir, '.setup-write.lock');
+    await mkdir(lock, { mode: 0o700 });
+    try {
+        return await fn();
+    }
+    finally {
+        await rmdir(lock);
+    }
+}
+async function existing(c) {
+    try {
+        return await loadConfig(c);
+    }
+    catch (e) {
+        if (e instanceof Error && e.message === 'config.missing')
+            return null;
+        throw e;
+    }
+}
+async function newConfig(agentId, url, token) {
+    if (!validAgentId(agentId))
+        throw new Error('config.identity-invalid');
+    return validateConfig({ agentId, subject: `msg.${agentId}`, natsUrl: url, ...(token ? { natsToken: token } : {}),
+        keys: { encryption: await createKeyPair(), signing: await createSigningKeyPair() }, peers: {},
+        wake: { enabled: true }, ackSecurity: { emitSigned: true, requireSigned: true } });
+}
+async function saveChanged(c, previous, next) {
+    validateConfig(next);
+    if (previous && isDeepStrictEqual(previous, next))
+        return null;
+    const backup = previous ? path.join(c.dataDir, `agent-config.backup-${randomUUID()}.json`) : null;
+    if (backup)
+        await writeState(c, backup, previous);
+    await writeState(c, c.configPath, next);
+    if (!previous)
+        await writeState(c, path.join(c.dataDir, 'read-state.json'), { schema: 'murmur.read/1', agentId: next.agentId, rowid: 0 });
+    return backup;
+}
+const publicPeer = (c) => ({ agentId: c.agentId, subject: c.subject,
+    encryption: { publicKey: c.keys.encryption.publicKey }, signing: { publicKey: c.keys.signing.publicKey } });
+async function readBlob(file, prefix, type) {
+    const text = await privateText(file, `${type}-file`);
+    if (!text.startsWith(prefix))
+        throw new Error('onboarding.invalid-blob');
+    const encoded = text.slice(prefix.length);
+    if (!/^[A-Za-z0-9+/]+={0,2}$/.test(encoded) || Buffer.from(encoded, 'base64').toString('base64') !== encoded)
+        throw new Error('onboarding.invalid-blob');
+    let value;
+    try {
+        value = JSON.parse(Buffer.from(encoded, 'base64').toString('utf8'));
+    }
+    catch {
+        throw new Error('onboarding.invalid-blob');
+    }
+    if (!value || value.v !== 1 || value.type !== type || !validAgentId(value.agentId) || value.subject !== `msg.${value.agentId}`)
+        throw new Error('onboarding.invalid-peer');
+    for (const key of [value.encryption?.publicKey, value.signing?.publicKey]) {
+        if (typeof key !== 'string' || Buffer.from(key, 'base64').length !== 32 || Buffer.from(key, 'base64').toString('base64') !== key)
+            throw new Error('onboarding.invalid-peer-key');
+    }
+    if (type === 'invite' && (typeof value.natsUrl !== 'string' || (value.natsToken !== undefined && typeof value.natsToken !== 'string')))
+        throw new Error('onboarding.invalid-broker');
+    return value;
+}
+function addPeer(config, peer) {
+    if (peer.agentId === config.agentId)
+        throw new Error('onboarding.self-peer');
+    const previous = config.peers[peer.agentId];
+    if (previous && (previous.subject !== peer.subject || previous.encryption.publicKey !== peer.encryption.publicKey || previous.signing.publicKey !== peer.signing.publicKey))
+        throw new Error('onboarding.peer-key-conflict');
+    const next = previous ?? { subject: peer.subject, encryption: { publicKey: peer.encryption.publicKey }, signing: { publicKey: peer.signing.publicKey } };
+    return { ...config, peers: { ...config.peers, [peer.agentId]: next } };
+}
+export async function initialize(c, options) {
+    await refuseVirtualizedAppData(c.dataDir);
+    return locked(c, async () => {
+        const previous = await existing(c);
+        if (previous) {
+            if (previous.agentId !== options.agentId || previous.natsUrl !== options.brokerUrl)
+                throw new Error('onboarding.existing-profile-conflict');
+            // Re-running init never rotates keys or replaces credentials.
+            return { schema: 'murmur.init/1', agentId: previous.agentId, dataDir: c.dataDir, serviceName: c.serviceName, existing: true };
+        }
+        const token = options.tokenFile ? await privateText(options.tokenFile, 'token-file') : undefined;
+        if (token?.includes('\n') || token?.includes('\r'))
+            throw new Error('onboarding.token-file-invalid');
+        const config = await newConfig(options.agentId, options.brokerUrl, token);
+        await saveChanged(c, null, config);
+        return { schema: 'murmur.init/1', agentId: config.agentId, dataDir: c.dataDir, serviceName: c.serviceName, existing: false };
+    });
+}
+export async function invite(c, outFile) {
+    await validateOutput(c, outFile);
+    const config = await loadConfig(c);
+    await outputBlob(outFile, { v: 1, type: 'invite', ...publicPeer(config), natsUrl: config.natsUrl, ...(config.natsToken ? { natsToken: config.natsToken } : {}) }, 'MURMUR:');
+    // The warning names what is actually inside. A person weighs "password" and "identity"
+    // differently, and the same sentence for both teaches them to ignore it.
+    const containsBrokerCredential = !!config.natsToken;
+    return { schema: 'murmur.invite/1', file: outFile, containsBrokerCredential,
+        instruction: containsBrokerCredential
+            ? 'This file carries the broker address and its credential. Treat it like a password: send it only through a channel you would trust with one. Importing it does not prove pairing.'
+            : 'This file carries your identity and the broker address. Send it through a channel you trust. Importing it does not prove pairing.' };
+}
+export async function join(c, options) {
+    await validateOutput(c, options.replyOut);
+    const incoming = await readBlob(options.inviteFile, 'MURMUR:', 'invite');
+    // Before anything is created: a profile the service cannot see must not be written at all.
+    await refuseVirtualizedAppData(c.dataDir);
+    return locked(c, async () => {
+        const previous = await existing(c);
+        if (previous && (previous.agentId !== options.agentId || previous.natsUrl !== incoming.natsUrl))
+            throw new Error('onboarding.existing-profile-conflict');
+        const config = previous ?? await newConfig(options.agentId, incoming.natsUrl, incoming.natsToken);
+        const next = addPeer(config, incoming);
+        let backup = null;
+        // Reserve the reply path before changing config: an existing output must not half-import a profile.
+        await outputBlob(options.replyOut, { v: 1, type: 'reply', ...publicPeer(next) }, 'MURMUR-REPLY:', async () => {
+            backup = await saveChanged(c, previous, next);
+        });
+        return { schema: 'murmur.join/1', agentId: next.agentId, peerId: incoming.agentId, paired: null, replyFile: options.replyOut, backup, restartRequired: true, serviceName: c.serviceName };
+    });
+}
+async function clearPeerPoison(c, peerId) {
+    try {
+        const info = await lstat(c.storePath);
+        if (!info.isFile())
+            throw new Error('onboarding.store-invalid');
+        const store = new SQLiteDedupeOutboxStore(c.storePath);
+        try {
+            return { cleared: await store.clearPoisonedFrom(peerId), reason: null };
+        }
+        finally {
+            store.close();
+        }
+    }
+    catch (e) {
+        if (e.code === 'ENOENT')
+            return { cleared: 0, reason: null };
+        // Key import succeeded; an unreadable/locked store must not be reported as zero cleared.
+        return { cleared: null, reason: 'onboarding.poison-reset-failed' };
+    }
+}
+export async function importPeer(c, replyFile) {
+    const incoming = await readBlob(replyFile, 'MURMUR-REPLY:', 'reply');
+    return locked(c, async () => {
+        const previous = await loadConfig(c), next = addPeer(previous, incoming);
+        const backup = await saveChanged(c, previous, next);
+        return { schema: 'murmur.peer/1', peerId: incoming.agentId, paired: null, backup,
+            poisonReset: await clearPeerPoison(c, incoming.agentId), restartRequired: true };
+    });
+}

package/runtime/packages/setup/dist/src/outbox-attention.d.ts

@@ -0,0 +1,51 @@
+import { DatabaseSync } from 'node:sqlite';
+import type { ServiceContext } from './types.js';
+/** Metadata only. A dismissal never changes transport state or implies delivery. */
+export declare function readOutboxAttention(c: ServiceContext, agentId: string, db: DatabaseSync): Promise<{
+    schema: "murmur.outbox-attention/1";
+    total: number;
+    pending: number;
+    dismissed: number;
+    items: {
+        msgId: string;
+        peer: string | null;
+        createdAt: string;
+        failedAt: string;
+        reason: string;
+        attempts: number;
+        token: string;
+        dismissed: boolean;
+    }[];
+    truncated: boolean;
+    unknownReason: null;
+}>;
+export declare function listOutboxAttention(c: ServiceContext): Promise<{
+    schema: "murmur.outbox-attention/1";
+    total: number;
+    pending: number;
+    dismissed: number;
+    items: {
+        msgId: string;
+        peer: string | null;
+        createdAt: string;
+        failedAt: string;
+        reason: string;
+        attempts: number;
+        token: string;
+        dismissed: boolean;
+    }[];
+    truncated: boolean;
+    unknownReason: null;
+    agentId: string;
+}>;
+/** Reversible local acknowledgement, serialized with setup writers. The outbox DB stays read-only. */
+export declare function setOutboxDismissed(c: ServiceContext, msgId: string, token: string, expectedAgent: string, dismissed: boolean): Promise<{
+    schema: "murmur.outbox-action/1";
+    agentId: string;
+    msgId: string;
+    token: string;
+    dismissed: boolean;
+    transportState: "dlq";
+    historyPreserved: boolean;
+    resent: boolean;
+}>;

package/runtime/packages/setup/dist/src/outbox-attention.js

@@ -0,0 +1,98 @@
+import { DatabaseSync } from 'node:sqlite';
+import { createHash } from 'node:crypto';
+import { mkdir, rmdir } from 'node:fs/promises';
+import path from 'node:path';
+import { loadConfig, readJson, safeError, validAgentId } from './config.js';
+import { writeState } from './state.js';
+const stateFile = (c) => path.join(c.dataDir, 'outbox-attention.json');
+const validId = (v) => typeof v === 'string' && /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,150}$/.test(v);
+const validToken = (v) => typeof v === 'string' && /^[a-f0-9]{64}$/.test(v);
+const columns = `msg_id AS msgId,subject,attempts,created_at AS createdAt,updated_at AS failedAt,last_error AS error,version,
+  json_extract(envelope_json,'$.recipients[0]') AS peer`;
+const tokenFor = (row) => createHash('sha256').update(JSON.stringify([
+    row.msgId, row.subject, row.attempts, row.createdAt, row.failedAt, row.error, row.version, row.peer,
+])).digest('hex');
+async function saved(c, agentId) {
+    let value;
+    try {
+        value = await readJson(stateFile(c));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { schema: 'murmur.outbox-dismissals/1', agentId, records: [] };
+        throw new Error('outbox.dismissals-unreadable');
+    }
+    if (value?.schema !== 'murmur.outbox-dismissals/1' || value.agentId !== agentId || !Array.isArray(value.records)
+        || value.records.length > 1000 || value.records.some((r) => !validId(r?.msgId) || !validToken(r?.token))
+        || new Set(value.records.map((r) => r.msgId)).size !== value.records.length)
+        throw new Error('outbox.dismissals-invalid');
+    return value;
+}
+/** Metadata only. A dismissal never changes transport state or implies delivery. */
+export async function readOutboxAttention(c, agentId, db) {
+    const state = await saved(c, agentId), ignored = new Map(state.records.map(r => [r.msgId, r.token]));
+    // Keep the native status response below its 256 KiB transport limit.
+    const rows = db.prepare(`SELECT ${columns} FROM outbox WHERE status='dlq' ORDER BY updated_at DESC,msg_id LIMIT 201`).all();
+    if (rows.length > 200)
+        throw new Error('outbox.attention-limit-exceeded');
+    const items = rows.map(row => {
+        if (!validId(row.msgId))
+            throw new Error('outbox.record-invalid');
+        const token = tokenFor(row);
+        return { msgId: row.msgId, peer: validAgentId(row.peer) ? row.peer : null,
+            createdAt: row.createdAt, failedAt: row.failedAt, reason: safeError(row.error), attempts: row.attempts,
+            token, dismissed: ignored.get(row.msgId) === token };
+    });
+    // Outstanding items stay first, so older failures cannot disappear behind recent dismissals.
+    items.sort((a, b) => Number(a.dismissed) - Number(b.dismissed));
+    const dismissed = items.filter(i => i.dismissed).length;
+    return { schema: 'murmur.outbox-attention/1', total: items.length, pending: items.length - dismissed,
+        dismissed, items, truncated: false, unknownReason: null };
+}
+export async function listOutboxAttention(c) {
+    const config = await loadConfig(c), db = new DatabaseSync(c.storePath, { readOnly: true });
+    try {
+        db.exec('PRAGMA busy_timeout=1000; BEGIN');
+        return { agentId: config.agentId, ...await readOutboxAttention(c, config.agentId, db) };
+    }
+    finally {
+        db.close();
+    }
+}
+/** Reversible local acknowledgement, serialized with setup writers. The outbox DB stays read-only. */
+export async function setOutboxDismissed(c, msgId, token, expectedAgent, dismissed) {
+    if (!validId(msgId) || !validToken(token) || !validAgentId(expectedAgent))
+        throw new Error('outbox.selection-invalid');
+    const lock = path.join(c.dataDir, '.setup-write.lock');
+    await mkdir(lock, { mode: 0o700 });
+    try {
+        const config = await loadConfig(c);
+        if (config.agentId !== expectedAgent)
+            throw new Error('outbox.identity-changed');
+        const db = new DatabaseSync(c.storePath, { readOnly: true });
+        try {
+            db.exec('PRAGMA busy_timeout=1000; BEGIN');
+            const row = db.prepare(`SELECT ${columns} FROM outbox WHERE status='dlq' AND msg_id=?`).get(msgId);
+            if (!row)
+                throw new Error('outbox.record-not-found');
+            if (tokenFor(row) !== token)
+                throw new Error('outbox.record-changed');
+            const state = await saved(c, config.agentId);
+            const records = state.records.filter(r => r.msgId !== msgId);
+            if (dismissed)
+                records.push({ msgId, token });
+            if (records.length > 1000)
+                throw new Error('outbox.dismissals-limit-exceeded');
+            if (JSON.stringify(records) !== JSON.stringify(state.records))
+                await writeState(c, stateFile(c), { ...state, records });
+            return { schema: 'murmur.outbox-action/1', agentId: config.agentId, msgId, token, dismissed,
+                transportState: 'dlq', historyPreserved: true, resent: false };
+        }
+        finally {
+            db.close();
+        }
+    }
+    finally {
+        await rmdir(lock);
+    }
+}

package/runtime/packages/setup/dist/src/paths.d.ts

@@ -0,0 +1,10 @@
+import type { ServiceContext } from "./types.js";
+export declare function resolveContext(options?: {
+    dataDir?: string;
+    repoRoot?: string;
+    nodePath?: string;
+    serviceName?: string;
+    platform?: NodeJS.Platform;
+    home?: string;
+    env?: NodeJS.ProcessEnv;
+}): ServiceContext;

package/runtime/packages/setup/dist/src/paths.js

@@ -0,0 +1,41 @@
+import path from "node:path";
+import { homedir } from "node:os";
+import { fileURLToPath } from "node:url";
+import { createHash } from "node:crypto";
+export function resolveContext(options = {}) {
+    const env = options.env ?? process.env;
+    const platform = options.platform ?? process.platform;
+    const home = options.home ?? homedir();
+    const paths = platform === "win32" ? path.win32 : path.posix;
+    const defaultDir = platform === "darwin" ? paths.join(home, "Library", "Application Support", "Murmur")
+        : platform === "win32" ? paths.join(env.LOCALAPPDATA || paths.join(home, "AppData", "Local"), "Murmur")
+            : paths.join(env.XDG_STATE_HOME || paths.join(home, ".local", "state"), "murmur");
+    let selected = options.dataDir;
+    if (selected === undefined) {
+        if (env.DATA_DIR !== undefined) {
+            if (!env.DATA_DIR)
+                throw new Error("config.data-dir-empty");
+            if (env.MURMUR_DATA_DIR && paths.normalize(env.DATA_DIR) !== paths.normalize(env.MURMUR_DATA_DIR))
+                throw new Error("config.data-dir-conflict");
+            selected = env.DATA_DIR;
+        }
+        else
+            selected = env.MURMUR_DATA_DIR ?? defaultDir;
+    }
+    const dataDir = paths.normalize(selected);
+    if (!paths.isAbsolute(dataDir))
+        throw new Error("config.data-dir-must-be-absolute");
+    // The default service name hashes the path as written (see AGENTS.md), and shell completion appends
+    // a separator to folders: refuse it rather than silently select a second service for one profile.
+    if (dataDir.length > paths.parse(dataDir).root.length && /[\\/]$/.test(dataDir))
+        throw new Error("profile.trailing-separator");
+    const repoRoot = paths.normalize(options.repoRoot ?? fileURLToPath(new URL("../../../../", import.meta.url))).replace(/[\\/]$/, "");
+    const nodePath = paths.normalize(options.nodePath ?? process.execPath);
+    if (!paths.isAbsolute(repoRoot) || !paths.isAbsolute(nodePath))
+        throw new Error("config.runtime-path-must-be-absolute");
+    const serviceName = options.serviceName ?? `murmur-${createHash("sha256").update(dataDir).digest("hex").slice(0, 12)}`;
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,100}$/.test(serviceName))
+        throw new Error("config.invalid-service-name");
+    return { dataDir, repoRoot, nodePath, serviceName, configPath: paths.join(dataDir, "agent-config.json"),
+        storePath: paths.join(dataDir, "murmur.db"), logDir: paths.join(dataDir, "logs") };
+}

package/runtime/packages/setup/dist/src/platform/darwin.d.ts

@@ -0,0 +1,17 @@
+import type { PlatformAdapter } from "../types.js";
+export interface CommandResult {
+    code: number;
+    stdout: string;
+    stderr: string;
+}
+export type CommandRunner = (file: string, args: string[]) => Promise<CommandResult>;
+export interface DarwinOptions {
+    homeDir?: string;
+    uid?: number;
+    env?: NodeJS.ProcessEnv;
+    run?: CommandRunner;
+    applicationDirs?: string[];
+    /** Fully replaces executable search roots, primarily for hermetic tests. */
+    executableDirs?: string[];
+}
+export declare function createDarwinAdapter(options?: DarwinOptions): PlatformAdapter;