@outerlayer/cli 0.2.0 → 0.4.1

package/dist/chunk-M5POMKKW.js

@@ -0,0 +1,1051 @@
+#!/usr/bin/env node
+import { createRequire } from 'node:module';
+import { hostKeyPath, runnerDir, RUNNER_DIR_MODE, RUNNER_FILE_MODE } from './chunk-ZM2IMMYN.js';
+import { generateKeyPairSync, createPrivateKey, createPublicKey, sign } from 'crypto';
+import { existsSync, mkdirSync, writeFileSync, readFileSync } from 'fs';
+
+createRequire(import.meta.url);
+
+// ../../node_modules/structured-headers/dist/util.js
+var asciiRe = /^[\x20-\x7E]*$/;
+var tokenRe = /^[a-zA-Z*][:/!#$%&'*+\-.^_`|~A-Za-z0-9]*$/;
+var keyRe = /^[a-z*][*\-_.a-z0-9]*$/;
+function isAscii(str) {
+  return asciiRe.test(str);
+}
+function isValidTokenStr(str) {
+  return tokenRe.test(str);
+}
+function isValidKeyStr(str) {
+  return keyRe.test(str);
+}
+function isInnerList(input) {
+  return Array.isArray(input[0]);
+}
+function arrayBufferToBase64(ab) {
+  const bytes = new Uint8Array(ab);
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary);
+}
+function base64ToArrayBuffer(b64) {
+  const binaryString = atob(b64);
+  const len = binaryString.length;
+  const bytes = new Uint8Array(len);
+  for (let i = 0; i < len; i++) {
+    bytes[i] = binaryString.charCodeAt(i);
+  }
+  return bytes.buffer;
+}
+
+// ../../node_modules/structured-headers/dist/token.js
+var Token = class {
+  constructor(value) {
+    if (!isValidTokenStr(value)) {
+      throw new TypeError("Invalid character in Token string. Tokens must start with *, A-Z and the rest of the string may only contain a-z, A-Z, 0-9, :/!#$%&'*+-.^_`|~");
+    }
+    this.value = value;
+  }
+  toString() {
+    return this.value;
+  }
+};
+
+// ../../node_modules/structured-headers/dist/displaystring.js
+var DisplayString = class {
+  constructor(value) {
+    this.value = value;
+  }
+  toString() {
+    return this.value;
+  }
+};
+
+// ../../node_modules/structured-headers/dist/serializer.js
+var SerializeError = class extends Error {
+};
+function serializeDictionary(input) {
+  const entries = input instanceof Map ? input.entries() : Object.entries(input);
+  return Array.from(entries).map(([key, entry]) => {
+    const keyStr = serializeKey(key);
+    if (Array.isArray(entry)) {
+      if (entry[0] === true) {
+        return keyStr + serializeParameters(entry[1]);
+      } else {
+        if (isInnerList(entry)) {
+          return keyStr + "=" + serializeInnerList(entry);
+        } else {
+          return keyStr + "=" + serializeItem(entry);
+        }
+      }
+    } else {
+      if (entry === true) {
+        return keyStr;
+      } else {
+        return keyStr + "=" + serializeBareItem(entry);
+      }
+    }
+  }).join(", ");
+}
+function serializeItem(input, params) {
+  if (Array.isArray(input)) {
+    return serializeBareItem(input[0]) + serializeParameters(input[1]);
+  } else {
+    return serializeBareItem(input) + (params ? serializeParameters(params) : "");
+  }
+}
+function serializeInnerList(input) {
+  return `(${input[0].map((value) => serializeItem(value)).join(" ")})${serializeParameters(input[1])}`;
+}
+function serializeBareItem(input) {
+  if (typeof input === "number") {
+    if (Number.isInteger(input)) {
+      return serializeInteger(input);
+    }
+    return serializeDecimal(input);
+  }
+  if (typeof input === "string") {
+    return serializeString(input);
+  }
+  if (input instanceof Token) {
+    return serializeToken(input);
+  }
+  if (input instanceof ArrayBuffer) {
+    return serializeByteSequence(input);
+  }
+  if (input instanceof DisplayString) {
+    return serializeDisplayString(input);
+  }
+  if (input instanceof Date) {
+    return serializeDate(input);
+  }
+  if (typeof input === "boolean") {
+    return serializeBoolean(input);
+  }
+  throw new SerializeError(`Cannot serialize values of type ${typeof input}`);
+}
+function serializeInteger(input) {
+  if (input < -999999999999999 || input > 999999999999999) {
+    throw new SerializeError("Structured headers can only encode integers in the range range of -999,999,999,999,999 to 999,999,999,999,999 inclusive");
+  }
+  return input.toString();
+}
+function serializeDecimal(input) {
+  const out = input.toFixed(3).replace(/0+$/, "");
+  const signifantDigits = out.split(".")[0].replace("-", "").length;
+  if (signifantDigits > 12) {
+    throw new SerializeError("Fractional numbers are not allowed to have more than 12 significant digits before the decimal point");
+  }
+  return out;
+}
+function serializeString(input) {
+  if (!isAscii(input)) {
+    throw new SerializeError("Only ASCII strings may be serialized");
+  }
+  return `"${input.replace(/("|\\)/g, (v) => "\\" + v)}"`;
+}
+function serializeDisplayString(input) {
+  let out = '%"';
+  const textEncoder = new TextEncoder();
+  for (const char of textEncoder.encode(input.toString())) {
+    if (char === 37 || char === 34 || char <= 31 || char >= 127) {
+      out += "%" + char.toString(16);
+    } else {
+      out += String.fromCharCode(char);
+    }
+  }
+  return out + '"';
+}
+function serializeBoolean(input) {
+  return input ? "?1" : "?0";
+}
+function serializeByteSequence(input) {
+  return `:${arrayBufferToBase64(input)}:`;
+}
+function serializeToken(input) {
+  return input.toString();
+}
+function serializeDate(input) {
+  return "@" + Math.floor(input.getTime() / 1e3);
+}
+function serializeParameters(input) {
+  return Array.from(input).map(([key, value]) => {
+    let out = ";" + serializeKey(key);
+    if (value !== true) {
+      out += "=" + serializeBareItem(value);
+    }
+    return out;
+  }).join("");
+}
+function serializeKey(input) {
+  if (!isValidKeyStr(input)) {
+    throw new SerializeError("Keys in dictionaries must only contain lowercase letter, numbers, _-*. and must start with a letter or *");
+  }
+  return input;
+}
+
+// ../../node_modules/structured-headers/dist/parser.js
+function parseDictionary(input) {
+  const parser = new Parser(input);
+  return parser.parseDictionary();
+}
+var ParseError = class extends Error {
+  constructor(position, message) {
+    super(`Parse error: ${message} at offset ${position}`);
+  }
+};
+var Parser = class {
+  constructor(input) {
+    this.input = input;
+    this.pos = 0;
+  }
+  parseDictionary() {
+    this.skipWS();
+    const dictionary = /* @__PURE__ */ new Map();
+    while (!this.eof()) {
+      const thisKey = this.parseKey();
+      let member;
+      if (this.lookChar() === "=") {
+        this.pos++;
+        member = this.parseItemOrInnerList();
+      } else {
+        member = [true, this.parseParameters()];
+      }
+      dictionary.set(thisKey, member);
+      this.skipOWS();
+      if (this.eof()) {
+        return dictionary;
+      }
+      this.expectChar(",");
+      this.pos++;
+      this.skipOWS();
+      if (this.eof()) {
+        throw new ParseError(this.pos, "Dictionary contained a trailing comma");
+      }
+    }
+    return dictionary;
+  }
+  parseList() {
+    this.skipWS();
+    const members = [];
+    while (!this.eof()) {
+      members.push(this.parseItemOrInnerList());
+      this.skipOWS();
+      if (this.eof()) {
+        return members;
+      }
+      this.expectChar(",");
+      this.pos++;
+      this.skipOWS();
+      if (this.eof()) {
+        throw new ParseError(this.pos, "A list may not end with a trailing comma");
+      }
+    }
+    return members;
+  }
+  parseItem(standaloneItem = true) {
+    if (standaloneItem)
+      this.skipWS();
+    const result = [
+      this.parseBareItem(),
+      this.parseParameters()
+    ];
+    if (standaloneItem)
+      this.checkTrail();
+    return result;
+  }
+  parseItemOrInnerList() {
+    if (this.lookChar() === "(") {
+      return this.parseInnerList();
+    } else {
+      return this.parseItem(false);
+    }
+  }
+  parseInnerList() {
+    this.expectChar("(");
+    this.pos++;
+    const innerList = [];
+    while (!this.eof()) {
+      this.skipWS();
+      if (this.lookChar() === ")") {
+        this.pos++;
+        return [
+          innerList,
+          this.parseParameters()
+        ];
+      }
+      innerList.push(this.parseItem(false));
+      const nextChar = this.lookChar();
+      if (nextChar !== " " && nextChar !== ")") {
+        throw new ParseError(this.pos, "Expected a whitespace or ) after every item in an inner list");
+      }
+    }
+    throw new ParseError(this.pos, "Could not find end of inner list");
+  }
+  parseBareItem() {
+    const char = this.lookChar();
+    if (char === void 0) {
+      throw new ParseError(this.pos, "Unexpected end of string");
+    }
+    if (char.match(/^[-0-9]/)) {
+      return this.parseIntegerOrDecimal();
+    }
+    if (char === '"') {
+      return this.parseString();
+    }
+    if (char.match(/^[A-Za-z*]/)) {
+      return this.parseToken();
+    }
+    if (char === ":") {
+      return this.parseByteSequence();
+    }
+    if (char === "?") {
+      return this.parseBoolean();
+    }
+    if (char === "@") {
+      return this.parseDate();
+    }
+    if (char === "%") {
+      return this.parseDisplayString();
+    }
+    throw new ParseError(this.pos, "Unexpected input");
+  }
+  parseParameters() {
+    const parameters = /* @__PURE__ */ new Map();
+    while (!this.eof()) {
+      const char = this.lookChar();
+      if (char !== ";") {
+        break;
+      }
+      this.pos++;
+      this.skipWS();
+      const key = this.parseKey();
+      let value = true;
+      if (this.lookChar() === "=") {
+        this.pos++;
+        value = this.parseBareItem();
+      }
+      parameters.set(key, value);
+    }
+    return parameters;
+  }
+  parseIntegerOrDecimal() {
+    let type = "integer";
+    let sign = 1;
+    let inputNumber = "";
+    if (this.lookChar() === "-") {
+      sign = -1;
+      this.pos++;
+    }
+    if (!isDigit(this.lookChar())) {
+      throw new ParseError(this.pos, "Expected a digit (0-9)");
+    }
+    while (!this.eof()) {
+      const char = this.getChar();
+      if (isDigit(char)) {
+        inputNumber += char;
+      } else if (type === "integer" && char === ".") {
+        if (inputNumber.length > 12) {
+          throw new ParseError(this.pos, "Exceeded maximum decimal length");
+        }
+        inputNumber += ".";
+        type = "decimal";
+      } else {
+        this.pos--;
+        break;
+      }
+      if (type === "integer" && inputNumber.length > 15) {
+        throw new ParseError(this.pos, "Exceeded maximum integer length");
+      }
+      if (type === "decimal" && inputNumber.length > 16) {
+        throw new ParseError(this.pos, "Exceeded maximum decimal length");
+      }
+    }
+    if (type === "integer") {
+      return parseInt(inputNumber, 10) * sign;
+    } else {
+      if (inputNumber.endsWith(".")) {
+        throw new ParseError(this.pos, "Decimal cannot end on a period");
+      }
+      if (inputNumber.split(".")[1].length > 3) {
+        throw new ParseError(this.pos, "Number of digits after the decimal point cannot exceed 3");
+      }
+      return parseFloat(inputNumber) * sign;
+    }
+  }
+  parseString() {
+    let outputString = "";
+    this.expectChar('"');
+    this.pos++;
+    while (!this.eof()) {
+      const char = this.getChar();
+      if (char === "\\") {
+        if (this.eof()) {
+          throw new ParseError(this.pos, "Unexpected end of input");
+        }
+        const nextChar = this.getChar();
+        if (nextChar !== "\\" && nextChar !== '"') {
+          throw new ParseError(this.pos, "A backslash must be followed by another backslash or double quote");
+        }
+        outputString += nextChar;
+      } else if (char === '"') {
+        return outputString;
+      } else if (!isAscii(char)) {
+        throw new ParseError(this.pos, "Strings must be in the ASCII range");
+      } else {
+        outputString += char;
+      }
+    }
+    throw new ParseError(this.pos, "Unexpected end of input");
+  }
+  parseDisplayString() {
+    const chars = this.getChars(2);
+    if (chars !== '%"') {
+      throw new ParseError(this.pos, "Unexpected character. Display strings should start with %=");
+    }
+    const result = [];
+    while (!this.eof()) {
+      const char = this.getChar();
+      if (char.charCodeAt(0) <= 31 || char.charCodeAt(0) >= 127 && char.charCodeAt(0) <= 255) {
+        throw new ParseError(this.pos, "Invalid char found in DisplayString. Did you forget to escape?");
+      }
+      if (char === "%") {
+        const hexChars = this.getChars(2);
+        if (/^[0-9a-f]{2}$/.test(hexChars)) {
+          result.push(parseInt(hexChars, 16));
+        } else {
+          throw new ParseError(this.pos, `Unexpected sequence after % in DispalyString: "${hexChars}". Note that hexidecimals must be lowercase`);
+        }
+        continue;
+      }
+      if (char === '"') {
+        const textDecoder = new TextDecoder("utf-8", {
+          fatal: true
+        });
+        try {
+          return new DisplayString(textDecoder.decode(new Uint8Array(result)));
+        } catch {
+          throw new ParseError(this.pos, "Fatal error decoding UTF-8 sequence in Display String");
+        }
+      }
+      result.push(char.charCodeAt(0));
+    }
+    throw new ParseError(this.pos, "Unexpected end of input");
+  }
+  parseToken() {
+    let outputString = "";
+    while (!this.eof()) {
+      const char = this.lookChar();
+      if (char === void 0 || !/^[:/!#$%&'*+\-.^_`|~A-Za-z0-9]$/.test(char)) {
+        return new Token(outputString);
+      }
+      outputString += this.getChar();
+    }
+    return new Token(outputString);
+  }
+  parseByteSequence() {
+    this.expectChar(":");
+    this.pos++;
+    const endPos = this.input.indexOf(":", this.pos);
+    if (endPos === -1) {
+      throw new ParseError(this.pos, 'Could not find a closing ":" character to mark end of Byte Sequence');
+    }
+    const b64Content = this.input.substring(this.pos, endPos);
+    this.pos += b64Content.length + 1;
+    if (!/^[A-Za-z0-9+/=]*$/.test(b64Content)) {
+      throw new ParseError(this.pos, "ByteSequence does not contain a valid base64 string");
+    }
+    try {
+      return base64ToArrayBuffer(b64Content);
+    } catch {
+      throw new ParseError(this.pos, "ByteSequence does not contain a valid base64 string");
+    }
+  }
+  parseBoolean() {
+    this.expectChar("?");
+    this.pos++;
+    const char = this.getChar();
+    if (char === "1") {
+      return true;
+    }
+    if (char === "0") {
+      return false;
+    }
+    throw new ParseError(this.pos, 'Unexpected character. Expected a "1" or a "0"');
+  }
+  parseDate() {
+    this.expectChar("@");
+    this.pos++;
+    let sign = 1;
+    let inputNumber = "";
+    if (this.lookChar() === "-") {
+      sign = -1;
+      this.pos++;
+    }
+    if (!isDigit(this.lookChar())) {
+      throw new ParseError(this.pos, "Expected a digit (0-9)");
+    }
+    while (!this.eof()) {
+      const char = this.getChar();
+      if (isDigit(char)) {
+        inputNumber += char;
+      } else {
+        throw new ParseError(this.pos, "Expected a digit (0-9), whitespace or EOL");
+      }
+    }
+    if (inputNumber.length > 15) {
+      throw new ParseError(this.pos, "Exceeded max length for a date value");
+    }
+    return new Date(parseInt(inputNumber, 10) * sign * 1e3);
+  }
+  parseKey() {
+    if (!this.lookChar()?.match(/^[a-z*]/)) {
+      throw new ParseError(this.pos, "A key must begin with an asterisk or letter (a-z)");
+    }
+    let outputString = "";
+    while (!this.eof()) {
+      const char = this.lookChar();
+      if (char === void 0 || !/^[a-z0-9_\-.*]$/.test(char)) {
+        return outputString;
+      }
+      outputString += this.getChar();
+    }
+    return outputString;
+  }
+  /**
+   * Looks at the next character without advancing the cursor.
+   *
+   * Returns undefined if we were at the end of the string.
+   */
+  lookChar() {
+    return this.input[this.pos];
+  }
+  /**
+   * Checks if the next character is 'char', and fail otherwise.
+   */
+  expectChar(char) {
+    if (this.lookChar() !== char) {
+      throw new ParseError(this.pos, `Expected ${char}`);
+    }
+  }
+  getChar() {
+    return this.input[this.pos++];
+  }
+  getChars(count) {
+    const result = this.input.substr(this.pos, count);
+    this.pos += count;
+    return result;
+  }
+  eof() {
+    return this.pos >= this.input.length;
+  }
+  // Advances the pointer to skip all whitespace.
+  skipOWS() {
+    while (true) {
+      const c = this.input.substr(this.pos, 1);
+      if (c === " " || c === "	") {
+        this.pos++;
+      } else {
+        break;
+      }
+    }
+  }
+  // Advances the pointer to skip all spaces
+  skipWS() {
+    while (this.lookChar() === " ") {
+      this.pos++;
+    }
+  }
+  // At the end of parsing, we need to make sure there are no bytes after the
+  // header except whitespace.
+  checkTrail() {
+    this.skipWS();
+    if (!this.eof()) {
+      throw new ParseError(this.pos, "Unexpected characters at end of input");
+    }
+  }
+};
+var isDigitRegex = /^[0-9]$/;
+function isDigit(char) {
+  if (char === void 0)
+    return false;
+  return isDigitRegex.test(char);
+}
+
+// ../../node_modules/http-message-sig/dist/index.mjs
+var SignatureErrorCode = Object.freeze({
+  MissingField: "MissingField",
+  MalformedField: "MalformedField",
+  LabelRequired: "LabelRequired",
+  LabelMismatch: "LabelMismatch",
+  DuplicateLabel: "DuplicateLabel",
+  InvalidComponent: "InvalidComponent",
+  DuplicateComponent: "DuplicateComponent",
+  UnsupportedFeature: "UnsupportedFeature",
+  AlgorithmMismatch: "AlgorithmMismatch",
+  PolicyViolation: "PolicyViolation",
+  VerificationFailed: "VerificationFailed",
+  ResolverFailed: "ResolverFailed"
+});
+var SignatureError = class extends Error {
+  constructor(code, message, cause) {
+    super(message);
+    this.name = "SignatureError";
+    this.code = code;
+    this.cause = cause;
+  }
+};
+var encoder = new TextEncoder();
+var fieldNamePattern = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+var sfKeyPattern = /^[a-z*][a-z0-9_.*-]*$/;
+var derivedComponents = /* @__PURE__ */ new Set([
+  "@method",
+  "@target-uri",
+  "@authority",
+  "@scheme",
+  "@request-target",
+  "@path",
+  "@query",
+  "@status"
+]);
+var unsupportedParameters = /* @__PURE__ */ new Set([
+  "sf",
+  "bs",
+  "tr"
+]);
+function fail(code, message, cause) {
+  throw new SignatureError(code, message, cause);
+}
+function cloneBareItem(value) {
+  if (value instanceof ArrayBuffer) return value.slice(0);
+  return value;
+}
+function validateParameterName(name) {
+  if (!sfKeyPattern.test(name)) fail(SignatureErrorCode.MalformedField, `Invalid parameter name ${name}`);
+}
+function validateSerializableBareItem(value, location) {
+  try {
+    serializeItem(value);
+  } catch (error) {
+    fail(SignatureErrorCode.MalformedField, `Invalid ${location}`, error);
+  }
+}
+function isRfc8941BareItem(value) {
+  return !(value instanceof Date) && !(value instanceof DisplayString);
+}
+function validateBareItem(value, location) {
+  if (!isRfc8941BareItem(value)) return fail(SignatureErrorCode.UnsupportedFeature, `${location} uses an RFC 9651-only value`);
+  return cloneBareItem(value);
+}
+function copyParameters(input) {
+  const output = {};
+  for (const [name, value] of Object.entries(input)) {
+    validateParameterName(name);
+    if (value !== void 0) {
+      validateSerializableBareItem(value, `parameter ${name}`);
+      output[name] = cloneBareItem(value);
+    }
+  }
+  validateKnownParameters(output);
+  return Object.freeze(output);
+}
+function validateKnownParameters(parameters) {
+  for (const name of ["created", "expires"]) {
+    const value = parameters[name];
+    if (value !== void 0 && (!Number.isInteger(value) || typeof value !== "number")) fail(SignatureErrorCode.MalformedField, `${name} must be an integer`);
+  }
+  for (const name of [
+    "nonce",
+    "alg",
+    "keyid",
+    "tag"
+  ]) {
+    const value = parameters[name];
+    if (value !== void 0 && typeof value !== "string") fail(SignatureErrorCode.MalformedField, `${name} must be a string`);
+  }
+}
+function parametersToMap(parameters) {
+  const output = /* @__PURE__ */ new Map();
+  for (const [name, value] of Object.entries(parameters)) if (value !== void 0) output.set(name, cloneBareItem(value));
+  return output;
+}
+function component(name, parameters = {}) {
+  const normalizedName = normalizeComponentName(name);
+  const copied = copyComponentParameters(parameters);
+  validateComponent({
+    name: normalizedName,
+    parameters: copied
+  });
+  return Object.freeze({
+    name: normalizedName,
+    parameters: copied
+  });
+}
+function copyComponentParameters(parameters) {
+  const output = {};
+  for (const [name, value] of Object.entries(parameters)) {
+    validateParameterName(name);
+    if (value !== void 0) {
+      validateSerializableBareItem(value, `component parameter ${name}`);
+      output[name] = cloneBareItem(value);
+    }
+  }
+  return Object.freeze(output);
+}
+function normalizeComponentName(name) {
+  const normalized = name.toLowerCase();
+  if (normalized.startsWith("@")) {
+    if (normalized === "@query-param") return fail(SignatureErrorCode.UnsupportedFeature, "@query-param is not supported");
+    if (!derivedComponents.has(normalized)) return fail(SignatureErrorCode.UnsupportedFeature, `Unknown derived component ${normalized}`);
+  } else if (!fieldNamePattern.test(normalized)) return fail(SignatureErrorCode.InvalidComponent, `Invalid field component ${name}`);
+  return normalized;
+}
+function normalizeComponent(input) {
+  return typeof input === "string" ? component(input) : component(input.name, input.parameters);
+}
+function validateComponent(value) {
+  const entries = Object.entries(value.parameters);
+  for (const [name, parameterValue] of entries) {
+    if (unsupportedParameters.has(name)) fail(SignatureErrorCode.UnsupportedFeature, `${name} is not supported`);
+    if (name !== "req" && name !== "key") fail(SignatureErrorCode.UnsupportedFeature, `Component parameter ${name} is not supported`);
+    if (name === "req" && parameterValue !== true) fail(SignatureErrorCode.InvalidComponent, "req must be true");
+    if (name === "key" && typeof parameterValue !== "string") fail(SignatureErrorCode.InvalidComponent, "key must be a string");
+  }
+  if (value.name.startsWith("@") && value.parameters.key !== void 0) fail(SignatureErrorCode.InvalidComponent, `key is invalid on derived component ${value.name}`);
+}
+function componentMap(value) {
+  const output = /* @__PURE__ */ new Map();
+  for (const [name, parameterValue] of Object.entries(value.parameters)) if (parameterValue !== void 0) output.set(name, parameterValue);
+  return output;
+}
+function equivalentIdentity(input) {
+  const ordered = Object.entries(input.parameters).filter((entry) => entry[1] !== void 0).sort(([left], [right]) => left.localeCompare(right));
+  const parameters = /* @__PURE__ */ new Map();
+  for (const [name, value] of ordered) if (value !== void 0) parameters.set(name, value);
+  return serializeItem(input.name, parameters);
+}
+function normalizeComponents(inputs) {
+  const output = [];
+  const identities = /* @__PURE__ */ new Set();
+  for (const input of inputs) {
+    const value = normalizeComponent(input);
+    const identity = equivalentIdentity(value);
+    if (identities.has(identity)) fail(SignatureErrorCode.DuplicateComponent, `Duplicate component ${identity}`);
+    identities.add(identity);
+    output.push(value);
+  }
+  return Object.freeze(output);
+}
+function fieldsFromHeaders(headers) {
+  const fields = [];
+  headers.forEach((value, name) => fields.push(Object.freeze({
+    name,
+    value
+  })));
+  return Object.freeze(fields);
+}
+function copyFields(fields) {
+  return Object.freeze(fields.map(({ name, value }) => {
+    if (!fieldNamePattern.test(name)) fail(SignatureErrorCode.MalformedField, `Invalid field name ${name}`);
+    const normalized = normalizeFieldValue(value);
+    validateAscii(normalized, `Field ${name}`);
+    return Object.freeze({
+      name: name.toLowerCase(),
+      value: normalized
+    });
+  }));
+}
+function isNativeRequest(message) {
+  return typeof Request !== "undefined" && message instanceof Request;
+}
+function isNativeResponse(message) {
+  return typeof Response !== "undefined" && message instanceof Response;
+}
+function snapshotRequest(message) {
+  if (isNativeRequest(message)) return Object.freeze({
+    kind: "request",
+    method: message.method,
+    targetUri: message.url,
+    fields: fieldsFromHeaders(message.headers),
+    trailers: Object.freeze([])
+  });
+  if (!fieldNamePattern.test(message.method)) fail(SignatureErrorCode.InvalidComponent, "Invalid request method");
+  validateAscii(message.targetUri, "Target URI");
+  if (message.requestTarget !== void 0) validateAscii(message.requestTarget, "Request target");
+  return Object.freeze({
+    kind: "request",
+    method: message.method,
+    targetUri: message.targetUri,
+    requestTarget: message.requestTarget,
+    fields: copyFields(message.fields),
+    trailers: copyFields(message.trailers ?? [])
+  });
+}
+function snapshotMessage(message) {
+  if (isNativeRequest(message)) return snapshotRequest(message);
+  if (isNativeResponse(message)) return Object.freeze({
+    kind: "response",
+    status: message.status,
+    fields: fieldsFromHeaders(message.headers),
+    trailers: Object.freeze([])
+  });
+  return snapshotRequest(message);
+}
+function normalizeFieldValue(value) {
+  return value.replace(/\r\n[\t ]+/g, " ").replace(/^[\t ]+|[\t ]+$/g, "");
+}
+function validateAscii(value, location) {
+  for (const character of value) {
+    const code = character.charCodeAt(0);
+    if (code > 126 || code < 32 || code === 127) {
+      if (code === 9) continue;
+      fail(SignatureErrorCode.MalformedField, `${location} is not ASCII field content`);
+    }
+  }
+}
+function extractField(snapshot, name, trailers) {
+  const values = (snapshot.fields).filter((field) => field.name.toLowerCase() === name).map((field) => normalizeFieldValue(field.value));
+  if (values.length === 0) return fail(SignatureErrorCode.MissingField, `Missing field ${name}`);
+  return values.join(", ");
+}
+function requestForComponent(snapshot, value) {
+  if (value.parameters.req === void 0) return snapshot;
+  if (snapshot.kind !== "response" || snapshot.request === void 0) return fail(SignatureErrorCode.InvalidComponent, "req requires a response with a related request");
+  return snapshot.request;
+}
+function requestUrl(snapshot, name) {
+  try {
+    return new URL(snapshot.targetUri);
+  } catch (error) {
+    return fail(SignatureErrorCode.InvalidComponent, `${name} requires an absolute target URI`, error);
+  }
+}
+function requestTarget(snapshot, name) {
+  const url = requestUrl(snapshot, name);
+  if (url.hash !== "") return fail(SignatureErrorCode.InvalidComponent, `${name} target URI cannot contain a fragment`);
+  const schemeEnd = snapshot.targetUri.indexOf("://");
+  if (schemeEnd === -1) return fail(SignatureErrorCode.InvalidComponent, `${name} requires an HTTP target URI`);
+  const pathStart = snapshot.targetUri.indexOf("/", schemeEnd + 3);
+  const queryStart = snapshot.targetUri.indexOf("?", schemeEnd + 3);
+  const start = pathStart !== -1 && (queryStart === -1 || pathStart < queryStart) ? pathStart : queryStart;
+  const pathEnd = queryStart === -1 ? snapshot.targetUri.length : queryStart;
+  return Object.freeze({
+    url,
+    path: start === -1 || start === queryStart ? "/" : snapshot.targetUri.slice(start, pathEnd),
+    query: queryStart === -1 ? "?" : snapshot.targetUri.slice(queryStart)
+  });
+}
+function extractDerived(snapshot, name) {
+  if (name === "@status") {
+    if (snapshot.kind !== "response") return fail(SignatureErrorCode.InvalidComponent, "@status requires a response");
+    return snapshot.status.toString();
+  }
+  if (snapshot.kind !== "request") return fail(SignatureErrorCode.InvalidComponent, `${name} requires a request`);
+  if (name === "@method") return snapshot.method;
+  const target = requestTarget(snapshot, name);
+  switch (name) {
+    case "@target-uri":
+      return snapshot.targetUri;
+    case "@authority":
+      return target.url.host;
+    case "@scheme":
+      return target.url.protocol.slice(0, -1);
+    case "@request-target":
+      if (snapshot.requestTarget === void 0) return fail(SignatureErrorCode.UnsupportedFeature, "@request-target requires a descriptor requestTarget");
+      return snapshot.requestTarget;
+    case "@path":
+      return target.path;
+    case "@query":
+      return target.query;
+    default:
+      return fail(SignatureErrorCode.UnsupportedFeature, `Unknown derived component ${name}`);
+  }
+}
+function extractComponentValue(snapshot, value) {
+  const selected = requestForComponent(snapshot, value);
+  if (value.name.startsWith("@")) return extractDerived(selected, value.name);
+  const fieldValue = extractField(selected, value.name);
+  const key = value.parameters.key;
+  if (key === void 0) return fieldValue;
+  if (typeof key !== "string") return fail(SignatureErrorCode.InvalidComponent, "key must be a string");
+  const member = parseRfc8941Dictionary(fieldValue, `field ${value.name}`).get(key);
+  if (member === void 0) return fail(SignatureErrorCode.MissingField, `Field ${value.name} has no dictionary member ${key}`);
+  return isInnerList(member) ? serializeInnerList(member) : serializeItem(member);
+}
+function componentsToInnerList(components, parameters) {
+  return [components.map((value) => [value.name, componentMap(value)]), parametersToMap(parameters)];
+}
+function buildSignatureBase(snapshot, components, signatureInput) {
+  const lines = components.map((value) => `${serializeItem(value.name, componentMap(value))}: ${extractComponentValue(snapshot, value)}`);
+  lines.push(`"@signature-params": ${serializeInnerList(signatureInput)}`);
+  return encoder.encode(lines.join("\n"));
+}
+function assertAlgorithm(claimed, actual) {
+  if (claimed !== void 0 && claimed !== actual) fail(SignatureErrorCode.AlgorithmMismatch, `Claimed algorithm ${String(claimed)} does not match ${actual}`);
+}
+function createInput(message, label, componentsInput, parametersInput, algorithm) {
+  if (!sfKeyPattern.test(label)) fail(SignatureErrorCode.MalformedField, `Invalid signature label ${label}`);
+  const snapshot = snapshotMessage(message);
+  const components = normalizeComponents(componentsInput);
+  const parameters = copyParameters(parametersInput);
+  assertAlgorithm(parameters.alg, algorithm);
+  const innerList = componentsToInnerList(components, parameters);
+  const dictionary = /* @__PURE__ */ new Map([[label, innerList]]);
+  return Object.freeze({
+    base: buildSignatureBase(snapshot, components, innerList),
+    signatureInput: serializeDictionary(dictionary)
+  });
+}
+function signatureDictionary(label, signature) {
+  const item = [Uint8Array.from(signature).buffer, /* @__PURE__ */ new Map()];
+  return serializeDictionary(/* @__PURE__ */ new Map([[label, item]]));
+}
+async function createSignature(message, options) {
+  const label = options.label ?? "sig1";
+  const input = createInput(message, label, options.components, options.parameters, options.signer.algorithm);
+  const signature = await options.signer.sign(input.base.slice());
+  return Object.freeze({
+    signature: signatureDictionary(label, signature),
+    signatureInput: input.signatureInput
+  });
+}
+function assertNoRfc9651Syntax(input, name) {
+  let quoted = false;
+  let escaped = false;
+  for (let index = 0; index < input.length; index += 1) {
+    const character = input[index];
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+    if (quoted && character === "\\") {
+      escaped = true;
+      continue;
+    }
+    if (character === '"') {
+      quoted = !quoted;
+      continue;
+    }
+    if (!quoted && (character === "@" || character === "%" && input[index + 1] === '"')) fail(SignatureErrorCode.UnsupportedFeature, `${name} uses an RFC 9651-only value`);
+  }
+}
+function parseRfc8941Dictionary(input, name) {
+  assertNoRfc9651Syntax(input, name);
+  let dictionary;
+  try {
+    dictionary = parseDictionary(input);
+  } catch (error) {
+    return fail(SignatureErrorCode.MalformedField, `Malformed ${name}`, error);
+  }
+  assertRfc8941Dictionary(dictionary, name);
+  return dictionary;
+}
+function assertRfc8941Dictionary(dictionary, name) {
+  for (const member of dictionary.values()) {
+    if (isInnerList(member)) for (const [value, parameters] of member[0]) {
+      validateBareItem(value, name);
+      for (const parameter of parameters.values()) validateBareItem(parameter, name);
+    }
+    else validateBareItem(member[0], name);
+    for (const parameter of member[1].values()) validateBareItem(parameter, name);
+  }
+}
+
+// ../runner-signature/dist/index.js
+var RUNNER_SIGNATURE_LABEL = "runner";
+var RUNNER_SIGNATURE_ALGORITHM = "ed25519";
+var RUNNER_SIGNED_COMPONENTS = ["@method", "@path", "@query", "content-digest"];
+async function sha256(data) {
+  return new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", data));
+}
+function base64FromBytes(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}
+async function contentDigest(body) {
+  return `sha-256=:${base64FromBytes(await sha256(body))}:`;
+}
+async function hostKeyFingerprint(publicKeyRaw) {
+  return `SHA256:${base64FromBytes(await sha256(publicKeyRaw)).replace(/=+$/, "")}`;
+}
+async function signRunnerRequest(input) {
+  var _a, _b;
+  const digest = await contentDigest(input.body);
+  const fields = await createSignature(
+    {
+      method: input.method.toUpperCase(),
+      targetUri: input.url,
+      fields: [{ name: "content-digest", value: digest }]
+    },
+    {
+      label: RUNNER_SIGNATURE_LABEL,
+      components: RUNNER_SIGNED_COMPONENTS,
+      parameters: {
+        created: (_a = input.created) != null ? _a : Math.floor(Date.now() / 1e3),
+        nonce: (_b = input.nonce) != null ? _b : globalThis.crypto.randomUUID(),
+        keyid: input.signer.keyId,
+        alg: RUNNER_SIGNATURE_ALGORITHM
+      },
+      signer: {
+        algorithm: RUNNER_SIGNATURE_ALGORITHM,
+        sign: (data) => input.signer.sign(data)
+      }
+    }
+  );
+  return {
+    signature: fields.signature,
+    "signature-input": fields.signatureInput,
+    "content-digest": digest
+  };
+}
+
+// src/runner/host-key.ts
+var SPKI_ED25519_PREFIX_BYTES = 12;
+async function toHostKey(privateKey) {
+  const spki = createPublicKey(privateKey).export({ format: "der", type: "spki" });
+  const publicKeyRaw = new Uint8Array(spki.subarray(SPKI_ED25519_PREFIX_BYTES));
+  const hostKey = Buffer.from(publicKeyRaw).toString("base64url");
+  const fingerprint = await hostKeyFingerprint(publicKeyRaw);
+  return {
+    signer: { keyId: fingerprint, sign: (data) => new Uint8Array(sign(null, data, privateKey)) },
+    publicKeyRaw,
+    hostKey,
+    fingerprint
+  };
+}
+async function readHostKey(path) {
+  let privateKey;
+  try {
+    privateKey = createPrivateKey(readFileSync(path, "utf8"));
+  } catch (err) {
+    throw new Error(`${path}: the host key cannot be read as a private key (${err instanceof Error ? err.message : String(err)})`);
+  }
+  if (privateKey.asymmetricKeyType !== "ed25519") {
+    throw new Error(`${path}: the host key must be an Ed25519 private key, found ${String(privateKey.asymmetricKeyType)}`);
+  }
+  return toHostKey(privateKey);
+}
+async function loadHostKey(configPath) {
+  const path = hostKeyPath(configPath);
+  return existsSync(path) ? readHostKey(path) : void 0;
+}
+async function ensureHostKey(configPath) {
+  const path = hostKeyPath(configPath);
+  mkdirSync(runnerDir(configPath), { recursive: true, mode: RUNNER_DIR_MODE });
+  const { privateKey } = generateKeyPairSync("ed25519");
+  try {
+    writeFileSync(path, privateKey.export({ type: "pkcs8", format: "pem" }), { flag: "wx", mode: RUNNER_FILE_MODE });
+  } catch (err) {
+    if (err.code !== "EEXIST") throw err;
+    return readHostKey(path);
+  }
+  return toHostKey(privateKey);
+}
+async function signerFor(configPath) {
+  return (await loadHostKey(configPath))?.signer;
+}
+
+export { ensureHostKey, loadHostKey, signRunnerRequest, signerFor };