@webda/core 4.0.0-beta.5 → 4.0.0-beta.7

package/lib/services/secretscheck.d.ts

@@ -0,0 +1,120 @@
+import type { JSONSchema7 } from "json-schema";
+import { type DeploymentUnit } from "../application/deployment.js";
+/**
+ * JSON Schema keyword marking a configuration value that must be encrypted
+ *
+ * Written by the compiler for a property typed with `SecretString` or tagged `@secret`:
+ * - `true`: the whole value, every string below it
+ * - a list of names: only these children of the object, a name can be a dotted path
+ *   and the arrays on the way are traversed (`users.token`)
+ */
+export declare const SECRET_KEYWORD = "x-webda-secret";
+/**
+ * Encrypter of the values kept in clear text on purpose: `crypt:none:<value>`
+ */
+export declare const OPT_OUT_ENCRYPTER = "none";
+/**
+ * A secret configuration value that is not encrypted
+ *
+ * It never holds the value itself.
+ */
+export interface SecretFinding {
+    /**
+     * Configuration path of the value, like `services.db.postgresqlServer.password`
+     */
+    path: string;
+    /**
+     * Location of the value in the checked configuration object, like `["units", 0, "apiKey"]`
+     */
+    location?: (string | number)[];
+    /**
+     * Service or deployment unit name
+     */
+    service?: string;
+    /**
+     * Service type
+     */
+    type?: string;
+    /**
+     * - `plain`: written in clear text
+     * - `marked`: still `encrypt:` or `sencrypt:`, run `webda config encrypt`
+     * - `opted-out`: kept in clear text on purpose with `crypt:none:` or `scrypt:none:`
+     */
+    reason: "plain" | "marked" | "opted-out";
+}
+/**
+ * Format a configuration path: `services.db.keys[0]`
+ * @param path - the path segments
+ * @returns the formatted path
+ */
+export declare function formatSecretPath(path: (string | number)[]): string;
+/**
+ * Find the secrets of a value that are not encrypted
+ *
+ * A schema node marked {@link SECRET_KEYWORD} must hold a `crypt:` or `scrypt:` string, or nothing.
+ * The findings never contain the values.
+ *
+ * @param value - the value, a service configuration for example
+ * @param schema - its schema
+ * @param root - the document holding the definitions, for `$ref`
+ * @param path - path of the value, prefixed to the findings
+ * @returns the findings
+ */
+export declare function findUnencryptedSecrets(value: any, schema: JSONSchema7, root?: JSONSchema7, path?: (string | number)[]): SecretFinding[];
+/**
+ * Parse the patterns of the secret paths to exclude
+ *
+ * A pattern uses the path syntax of the findings, `$.` prefix optional: `*` matches one name or index
+ * (`units[*].auth.pass`), `**` matches anything, and a pattern also excludes the values below it
+ * (`services.demo`).
+ *
+ * @param patterns - the patterns, a comma-separated string or a list
+ * @returns a function telling whether a finding path is excluded
+ */
+export declare function secretPathExcluder(patterns?: string | string[]): (path: string) => boolean;
+/**
+ * Configuration to check: an application configuration, a deployment, or both merged
+ */
+export interface SecretsCheckConfiguration {
+    /**
+     * Services configuration
+     */
+    services?: Record<string, any>;
+    /**
+     * Global parameters, merged into every service
+     */
+    parameters?: Record<string, any>;
+    /**
+     * Parameters shared by the deployment units
+     */
+    resources?: Record<string, any>;
+    /**
+     * Deployment units
+     */
+    units?: DeploymentUnit[];
+}
+/**
+ * Find the unencrypted secrets of a configuration
+ *
+ * Each service is checked against the schema of its type, with the global parameters it inherits:
+ * a secret written in `parameters` is reported once, under `parameters`. The deployment units are
+ * checked with the `resources` they inherit, reported under `resources`.
+ *
+ * @param configuration - the configuration to check
+ * @param options - how to find the schemas
+ * @param options.getSchema - the schema of a service type
+ * @param options.completeNamespace - add the namespace to a service type
+ * @param options.getType - the type of a service without one, from the application configuration
+ * @param options.inheritingServices - other services inheriting `parameters`, defined in another file
+ * @returns the findings, and the service types without schema
+ */
+export declare function findConfigurationSecrets(configuration: SecretsCheckConfiguration, options: {
+    getSchema: (type: string) => JSONSchema7 | undefined;
+    completeNamespace?: (type: string) => string;
+    getType?: (service: string) => string | undefined;
+    inheritingServices?: Record<string, any>;
+}): {
+    findings: SecretFinding[];
+    unknownTypes: string[];
+};
+//# sourceMappingURL=secretscheck.d.ts.map

package/lib/services/secretscheck.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretscheck.d.ts","sourceRoot":"","sources":["../../src/services/secretscheck.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAA6B,KAAK,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9F;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAE/C;;GAEG;AACH,eAAO,MAAM,iBAAiB,SAAS,CAAC;AAExC;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;OAEG;IACH,QAAQ,CAAC,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IAC/B;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;CAC1C;AA4BD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,GAAG,MAAM,CAOlE;AAqKD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,GAAG,EACV,MAAM,EAAE,WAAW,EACnB,IAAI,GAAE,WAAoB,EAC1B,IAAI,GAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAO,GAC7B,aAAa,EAAE,CAEjB;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,GAAE,MAAM,GAAG,MAAM,EAAO,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAmB9F;AAmBD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACjC;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChC;;OAEG;IACH,KAAK,CAAC,EAAE,cAAc,EAAE,CAAC;CAC1B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,yBAAyB,EACxC,OAAO,EAAE;IACP,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,WAAW,GAAG,SAAS,CAAC;IACrD,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAC7C,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IAClD,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC1C,GACA;IAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,CA6DvD"}

package/lib/services/secretscheck.js

@@ -0,0 +1,322 @@
+import { getDeploymentUnitServices } from "../application/deployment.js";
+/**
+ * JSON Schema keyword marking a configuration value that must be encrypted
+ *
+ * Written by the compiler for a property typed with `SecretString` or tagged `@secret`:
+ * - `true`: the whole value, every string below it
+ * - a list of names: only these children of the object, a name can be a dotted path
+ *   and the arrays on the way are traversed (`users.token`)
+ */
+export const SECRET_KEYWORD = "x-webda-secret";
+/**
+ * Encrypter of the values kept in clear text on purpose: `crypt:none:<value>`
+ */
+export const OPT_OUT_ENCRYPTER = "none";
+/**
+ * Limit of `$ref` followed without going down the value, protects from a reference cycle
+ */
+const MAX_REF_DEPTH = 32;
+/**
+ * Check if a value is a plain object, class instances are not
+ * @param value - the value to test
+ * @returns true for a plain object
+ */
+function isPlainObject(value) {
+    if (value === null || typeof value !== "object") {
+        return false;
+    }
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
+/**
+ * Format a configuration path: `services.db.keys[0]`
+ * @param path - the path segments
+ * @returns the formatted path
+ */
+export function formatSecretPath(path) {
+    return path.reduce((res, segment) => {
+        if (typeof segment === "number") {
+            return `${res}[${segment}]`;
+        }
+        return res ? `${res}.${segment}` : segment;
+    }, "");
+}
+/**
+ * Classify a secret value
+ *
+ * `crypt:` and `scrypt:` values are encrypted, except the opted-out `crypt:none:` ones. Unset values (`""`,
+ * `null`, `undefined`) are allowed: the service then falls back to its environment.
+ *
+ * @param value - the secret value
+ * @returns the reason it fails, or undefined when it is fine
+ */
+function classify(value) {
+    if (typeof value !== "string" || value === "") {
+        return undefined;
+    }
+    if (value.startsWith(`crypt:${OPT_OUT_ENCRYPTER}:`) || value.startsWith(`scrypt:${OPT_OUT_ENCRYPTER}:`)) {
+        return "opted-out";
+    }
+    if (/^s?crypt:/.test(value)) {
+        return undefined;
+    }
+    return /^s?encrypt:/.test(value) ? "marked" : "plain";
+}
+/**
+ * Check a secret value: a string, or every string below an object or an array
+ * @param value - the secret value
+ * @param path - its path
+ * @param findings - collected findings
+ */
+function checkLeaves(value, path, findings) {
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => checkLeaves(item, [...path, index], findings));
+        return;
+    }
+    if (isPlainObject(value)) {
+        for (const [key, item] of Object.entries(value)) {
+            checkLeaves(item, [...path, key], findings);
+        }
+        return;
+    }
+    const reason = classify(value);
+    if (reason) {
+        findings.push({ path, reason });
+    }
+}
+/**
+ * Check the children of a value listed by a scoped secret marker
+ * @param value - the value holding the children
+ * @param segments - the remaining segments of the child name
+ * @param path - path of the value
+ * @param findings - collected findings
+ */
+function checkScoped(value, segments, path, findings) {
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => checkScoped(item, segments, [...path, index], findings));
+        return;
+    }
+    if (segments.length === 0) {
+        checkLeaves(value, path, findings);
+        return;
+    }
+    // A string where an object is expected (a file path for example) holds no listed child
+    if (isPlainObject(value) && value[segments[0]] !== undefined) {
+        checkScoped(value[segments[0]], segments.slice(1), [...path, segments[0]], findings);
+    }
+}
+/**
+ * Resolve a `#/definitions/...` reference
+ * @param ref - the reference
+ * @param root - the document holding the definitions
+ * @returns the referenced schema
+ */
+function resolveRef(ref, root) {
+    if (!ref.startsWith("#/")) {
+        return undefined;
+    }
+    let target = root;
+    for (const segment of ref.substring(2).split("/")) {
+        target = target?.[decodeURIComponent(segment).replace(/~1/g, "/").replace(/~0/g, "~")];
+    }
+    return typeof target === "object" ? target : undefined;
+}
+/**
+ * Walk a value with its schema and collect the secrets that are not encrypted
+ * @param value - the value
+ * @param schema - its schema
+ * @param root - the document, for `$ref`
+ * @param path - path of the value
+ * @param findings - collected findings
+ * @param refDepth - `$ref` followed since the value last changed
+ */
+function walk(value, schema, root, path, findings, refDepth = 0) {
+    if (value === undefined || value === null || !schema || typeof schema !== "object") {
+        return;
+    }
+    const marker = schema[SECRET_KEYWORD];
+    if (marker === true) {
+        checkLeaves(value, path, findings);
+        return;
+    }
+    if (Array.isArray(marker)) {
+        for (const name of marker) {
+            checkScoped(value, String(name).split("."), path, findings);
+        }
+    }
+    if (schema.$ref && refDepth < MAX_REF_DEPTH) {
+        walk(value, resolveRef(schema.$ref, root), root, path, findings, refDepth + 1);
+    }
+    for (const branch of [...(schema.anyOf ?? []), ...(schema.oneOf ?? []), ...(schema.allOf ?? [])]) {
+        walk(value, branch, root, path, findings, refDepth + 1);
+    }
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => {
+            const items = Array.isArray(schema.items) ? schema.items[index] : schema.items;
+            walk(item, items, root, [...path, index], findings);
+        });
+        return;
+    }
+    if (isPlainObject(value)) {
+        for (const [key, item] of Object.entries(value)) {
+            const child = schema.properties?.[key] ?? schema.additionalProperties;
+            walk(item, child, root, [...path, key], findings);
+        }
+    }
+}
+/**
+ * Collect the secrets of a value that are not encrypted, with their path in segments
+ * @param value - the value
+ * @param schema - its schema
+ * @param root - the document, for `$ref`
+ * @param path - path of the value
+ * @returns the findings, each path once
+ */
+function collect(value, schema, root = schema, path = []) {
+    const findings = [];
+    walk(value, schema, root, path, findings);
+    // A value can be reached through several branches or markers
+    const seen = new Set();
+    return findings.filter(finding => {
+        const key = JSON.stringify(finding.path);
+        if (seen.has(key)) {
+            return false;
+        }
+        seen.add(key);
+        return true;
+    });
+}
+/**
+ * Find the secrets of a value that are not encrypted
+ *
+ * A schema node marked {@link SECRET_KEYWORD} must hold a `crypt:` or `scrypt:` string, or nothing.
+ * The findings never contain the values.
+ *
+ * @param value - the value, a service configuration for example
+ * @param schema - its schema
+ * @param root - the document holding the definitions, for `$ref`
+ * @param path - path of the value, prefixed to the findings
+ * @returns the findings
+ */
+export function findUnencryptedSecrets(value, schema, root = schema, path = []) {
+    return collect(value, schema, root, path).map(({ path, reason }) => ({ path: formatSecretPath(path), reason }));
+}
+/**
+ * Parse the patterns of the secret paths to exclude
+ *
+ * A pattern uses the path syntax of the findings, `$.` prefix optional: `*` matches one name or index
+ * (`units[*].auth.pass`), `**` matches anything, and a pattern also excludes the values below it
+ * (`services.demo`).
+ *
+ * @param patterns - the patterns, a comma-separated string or a list
+ * @returns a function telling whether a finding path is excluded
+ */
+export function secretPathExcluder(patterns = []) {
+    const list = (typeof patterns === "string" ? patterns.split(",") : patterns)
+        .map(pattern => pattern.trim().replace(/^\$\.?/, ""))
+        .filter(pattern => pattern !== "");
+    const expressions = list.map(pattern => {
+        let source = "";
+        for (let i = 0; i < pattern.length; i++) {
+            if (pattern.startsWith("**", i)) {
+                source += ".*";
+                i++;
+            }
+            else if (pattern[i] === "*") {
+                source += "[^.\\[\\]]+";
+            }
+            else {
+                source += pattern[i].replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+            }
+        }
+        return new RegExp(`^${source}(?:[.[].*)?$`);
+    });
+    return path => expressions.some(expression => expression.test(path));
+}
+/**
+ * Check if a structure holds a value at a path
+ * @param data - the structure
+ * @param path - the path
+ * @returns true when the value is defined
+ */
+function hasPath(data, path) {
+    let target = data;
+    for (const segment of path) {
+        if (target === null || typeof target !== "object" || target[segment] === undefined) {
+            return false;
+        }
+        target = target[segment];
+    }
+    return true;
+}
+/**
+ * Find the unencrypted secrets of a configuration
+ *
+ * Each service is checked against the schema of its type, with the global parameters it inherits:
+ * a secret written in `parameters` is reported once, under `parameters`. The deployment units are
+ * checked with the `resources` they inherit, reported under `resources`.
+ *
+ * @param configuration - the configuration to check
+ * @param options - how to find the schemas
+ * @param options.getSchema - the schema of a service type
+ * @param options.completeNamespace - add the namespace to a service type
+ * @param options.getType - the type of a service without one, from the application configuration
+ * @param options.inheritingServices - other services inheriting `parameters`, defined in another file
+ * @returns the findings, and the service types without schema
+ */
+export function findConfigurationSecrets(configuration, options) {
+    const completeNamespace = options.completeNamespace ?? (type => type);
+    const findings = [];
+    const unknownTypes = new Set();
+    const reported = new Set();
+    const report = (finding) => {
+        if (reported.has(finding.path))
+            return;
+        reported.add(finding.path);
+        findings.push(finding);
+    };
+    const check = (name, type, own, merged, ownLocation, ownPrefix, inheritedPrefix) => {
+        const schema = options.getSchema(type);
+        if (!schema) {
+            unknownTypes.add(type);
+            return;
+        }
+        for (const { path, reason } of collect(merged, schema)) {
+            const inherited = !hasPath(own, path);
+            report({
+                path: formatSecretPath([...(inherited ? [inheritedPrefix] : ownPrefix), ...path]),
+                location: [...(inherited ? [inheritedPrefix] : ownLocation), ...path],
+                service: name,
+                type,
+                reason
+            });
+        }
+    };
+    const parameters = configuration.parameters ?? {};
+    const services = configuration.services ?? {};
+    for (const [name, service] of Object.entries(services)) {
+        if (!isPlainObject(service))
+            continue;
+        const type = completeNamespace(service.type ?? options.getType?.(name) ?? name);
+        check(name, type, service, { ...parameters, ...service }, ["services", name], ["services", name], "parameters");
+    }
+    // The parameters also reach the services of the other files, unless they set the same key
+    for (const [name, service] of Object.entries(options.inheritingServices ?? {})) {
+        if (!isPlainObject(service) || services[name] !== undefined)
+            continue;
+        const type = completeNamespace(service.type ?? name);
+        const inherited = Object.fromEntries(Object.entries(parameters).filter(([key]) => service[key] === undefined));
+        check(name, type, {}, inherited, ["services", name], ["services", name], "parameters");
+    }
+    const units = configuration.units ?? [];
+    if (units.length) {
+        const merged = getDeploymentUnitServices({ units, resources: configuration.resources }, completeNamespace);
+        units.forEach((unit, index) => {
+            const { name, type: _type, ...own } = unit;
+            const { type, ...service } = merged[name];
+            check(name, type, own, service, ["units", index], [`units[${name}]`], "resources");
+        });
+    }
+    return { findings, unknownTypes: [...unknownTypes] };
+}
+//# sourceMappingURL=secretscheck.js.map

package/lib/services/secretscheck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretscheck.js","sourceRoot":"","sources":["../../src/services/secretscheck.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAuB,MAAM,8BAA8B,CAAC;AAE9F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAE/C;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAwCxC;;GAEG;AACH,MAAM,aAAa,GAAG,EAAE,CAAC;AAEzB;;;;GAIG;AACH,SAAS,aAAa,CAAC,KAAU;IAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAyB;IACxD,OAAO,IAAI,CAAC,MAAM,CAAS,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;QAC1C,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,GAAG,GAAG,IAAI,OAAO,GAAG,CAAC;QAC9B,CAAC;QACD,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7C,CAAC,EAAE,EAAE,CAAC,CAAC;AACT,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,QAAQ,CAAC,KAAU;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,iBAAiB,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,iBAAiB,GAAG,CAAC,EAAE,CAAC;QACxG,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,KAAU,EAAE,IAAyB,EAAE,QAAsB;IAChF,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC9E,OAAO;IACT,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,WAAW,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,MAAM,EAAE,CAAC;QACX,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,KAAU,EAAE,QAAkB,EAAE,IAAyB,EAAE,QAAsB;IACpG,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QACxF,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IACD,uFAAuF;IACvF,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC7D,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,GAAW,EAAE,IAAiB;IAChD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,GAAQ,IAAI,CAAC;IACvB,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,GAAG,MAAM,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,IAAI,CACX,KAAU,EACV,MAAyC,EACzC,IAAiB,EACjB,IAAyB,EACzB,QAAsB,EACtB,QAAQ,GAAW,CAAC;IAEpB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACnF,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,IAAI,QAAQ,GAAG,aAAa,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACjG,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC/E,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,oBAAoB,CAAC;YACtE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,OAAO,CACd,KAAU,EACV,MAAmB,EACnB,IAAI,GAAgB,MAAM,EAC1B,IAAI,GAAwB,EAAE;IAE9B,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC1C,6DAA6D;IAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAU,EACV,MAAmB,EACnB,IAAI,GAAgB,MAAM,EAC1B,IAAI,GAAwB,EAAE;IAE9B,OAAO,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AAClH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAQ,GAAsB,EAAE;IACjE,MAAM,IAAI,GAAG,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;SACzE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;SACpD,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;QACrC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,IAAI,CAAC;gBACf,CAAC,EAAE,CAAC;YACN,CAAC;iBAAM,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC9B,MAAM,IAAI,aAAa,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,OAAO,IAAI,MAAM,CAAC,IAAI,MAAM,cAAc,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,SAAS,OAAO,CAAC,IAAS,EAAE,IAAyB;IACnD,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,OAAO,IAAI,IAAI,EAAE,CAAC;QAC3B,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;YACnF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAwBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CACtC,aAAwC,EACxC,OAKC;IAED,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,MAAM,GAAG,CAAC,OAAsB,EAAE,EAAE;QACxC,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO;QACvC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CACZ,IAAY,EACZ,IAAY,EACZ,GAAwB,EACxB,MAA2B,EAC3B,WAAgC,EAChC,SAA8B,EAC9B,eAAuB,EACvB,EAAE;QACF,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YACvD,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACtC,MAAM,CAAC;gBACL,IAAI,EAAE,gBAAgB,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;gBACjF,QAAQ,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC;gBACrE,OAAO,EAAE,IAAI;gBACb,IAAI;gBACJ,MAAM;aACP,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,aAAa,CAAC,UAAU,IAAI,EAAE,CAAC;IAClD,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;QAChF,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,UAAU,EAAE,GAAG,OAAO,EAAE,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;IAClH,CAAC;IACD,0FAA0F;IAC1F,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/E,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QACtE,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;QAC/G,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,YAAY,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,IAAI,EAAE,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,yBAAyB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,aAAa,CAAC,SAAS,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAC3G,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC5B,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC;YAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1C,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,SAAS,IAAI,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,CAAC;AACvD,CAAC"}

package/lib/services/servicecommands.d.ts

@@ -29,14 +29,16 @@ export interface ServiceCommandInfo {
     /**
      * Lifecycle phase declared by each service providing this command, in the
      * same order as `services`. Values are one of:
+     * - `"application"`: service declared phase "application", a static method called without Core.
      * - `"resolved"`: service declared phase "resolved" (e.g. via `@BuildCommand`).
      * - `"initialized"`: service declared phase "initialized".
      * - `undefined`: service did not declare a phase (treat as "initialized").
      *
      * The CLI dispatcher uses this to decide whether to skip `Core.init()`:
-     * all-"resolved" → resolve-only; all-"initialized"/undefined → full init; mixed → error.
+     * all-"application" → no Core; all-"resolved" → resolve-only; all-"initialized"/undefined → full init;
+     * mixed → error.
      */
-    phases: Array<"resolved" | "initialized" | undefined>;
+    phases: Array<"application" | "resolved" | "initialized" | undefined>;
 }
 /**
  * Collect all CLI commands declared by services across all loaded modules.
@@ -73,14 +75,16 @@ export declare function collectServiceCommands(app: Application): {
  * (supports suffix matching).
  *
  * Each service's command handler is called with the parsed arguments as
- * positional parameters.
+ * positional parameters. A handler returning a number sets the exit code: the
+ * highest one wins, any other result counts as `0`.
  *
  * @param cmdName - The command name to execute (e.g., `"serve"`, `"migrate"`)
  * @param cmdInfo - The merged command definition from {@link collectServiceCommands}
  * @param args - Parsed argument values keyed by argument name
  * @param services - Map of service name to service instance (from Core.getServices())
  * @param serviceFilter - Optional list of service names to filter to (supports suffix matching)
- * @returns `0` on success, `1` if no services match the filter, a method is missing or no service instance ran
+ * @returns the highest exit code returned by the handlers (`0` on success), `1` if no services match the filter,
+ *   a method is missing or no service instance ran
  *
  * @example
  * ```typescript

package/lib/services/servicecommands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"servicecommands.d.ts","sourceRoot":"","sources":["../../src/services/servicecommands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAqB,MAAM,iBAAiB,CAAC;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGrD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,oDAAoD;IACpD,IAAI,EAAE;QAAE,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,CAAA;KAAE,CAAC;IAC/C,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;;;;OASG;IACH,MAAM,EAAE,KAAK,CAAC,UAAU,GAAG,aAAa,GAAG,SAAS,CAAC,CAAC;CACvD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,WAAW,GAAG;IAAE,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAAA;CAAE,CAoC/F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,kBAAkB,EAC3B,IAAI,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAAE,EAC5B,QAAQ,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAAA;CAAE,EAC5C,aAAa,CAAC,EAAE,MAAM,EAAE,GACvB,OAAO,CAAC,MAAM,CAAC,CA8EjB"}
+{"version":3,"file":"servicecommands.d.ts","sourceRoot":"","sources":["../../src/services/servicecommands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAqB,MAAM,iBAAiB,CAAC;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGrD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,oDAAoD;IACpD,IAAI,EAAE;QAAE,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,CAAA;KAAE,CAAC;IAC/C,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;;;;;;OAWG;IACH,MAAM,EAAE,KAAK,CAAC,aAAa,GAAG,UAAU,GAAG,aAAa,GAAG,SAAS,CAAC,CAAC;CACvE;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,WAAW,GAAG;IAAE,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAAA;CAAE,CAoC/F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,kBAAkB,EAC3B,IAAI,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAAE,EAC5B,QAAQ,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAAA;CAAE,EAC5C,aAAa,CAAC,EAAE,MAAM,EAAE,GACvB,OAAO,CAAC,MAAM,CAAC,CAsFjB"}

package/lib/services/servicecommands.js

@@ -67,14 +67,16 @@ export function collectServiceCommands(app) {
  * (supports suffix matching).
  *
  * Each service's command handler is called with the parsed arguments as
- * positional parameters.
+ * positional parameters. A handler returning a number sets the exit code: the
+ * highest one wins, any other result counts as `0`.
  *
  * @param cmdName - The command name to execute (e.g., `"serve"`, `"migrate"`)
  * @param cmdInfo - The merged command definition from {@link collectServiceCommands}
  * @param args - Parsed argument values keyed by argument name
  * @param services - Map of service name to service instance (from Core.getServices())
  * @param serviceFilter - Optional list of service names to filter to (supports suffix matching)
- * @returns `0` on success, `1` if no services match the filter, a method is missing or no service instance ran
+ * @returns the highest exit code returned by the handlers (`0` on success), `1` if no services match the filter,
+ *   a method is missing or no service instance ran
  *
  * @example
  * ```typescript
@@ -95,6 +97,13 @@ export async function executeServiceCommand(cmdName, cmdInfo, args, services, se
     const commandArgs = Object.keys(cmdInfo.args).map(argName => args[argName] !== undefined ? args[argName] : cmdInfo.args[argName].default);
     // Count executed handlers: a command where every provider was skipped did nothing
     let executed = 0;
+    // Highest exit code returned by a handler
+    let exitCode = 0;
+    const recordExitCode = (result) => {
+        if (typeof result === "number" && result > exitCode) {
+            exitCode = result;
+        }
+    };
     // Long-running handlers (serve, worker) return a cancelable promise that stays
     // pending while they run: start them all, then wait for every one to settle.
     const running = [];
@@ -137,7 +146,7 @@ export async function executeServiceCommand(cmdName, cmdInfo, args, services, se
                 running.push(result);
             }
             else {
-                await result;
+                recordExitCode(await result);
             }
             executed++;
         }
@@ -151,12 +160,12 @@ export async function executeServiceCommand(cmdName, cmdInfo, args, services, se
         return 1;
     }
     // Cancelling a long-running command (SIGINT, SIGTERM) is a clean stop
-    await Promise.all(running.map(p => Promise.resolve(p).catch(err => {
+    await Promise.all(running.map(p => Promise.resolve(p).then(recordExitCode, err => {
         if (err !== "Cancelled") {
             throw err;
         }
     })));
-    return 0;
+    return exitCode;
 }
 /**
  * Whether a command handler returned a long-running cancelable promise

package/lib/services/servicecommands.js.map

@@ -1 +1 @@
-{"version":3,"file":"servicecommands.js","sourceRoot":"","sources":["../../src/services/servicecommands.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAuCxC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAgB;IACrD,MAAM,QAAQ,GAA2C,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;IAEjC,KAAK,MAAM,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAU,EAAE,CAAC;QAChE,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC1E,IAAI,CAAC,QAAQ,CAAC,QAAQ;gBAAE,SAAS;YACjC,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClE,QAAQ,CAAC,OAAO,CAAC,KAAK;oBACpB,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,QAAQ,EAAE,EAAE;oBACZ,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE;oBACxB,QAAQ,EAAE,EAAE;oBACZ,MAAM,EAAE,EAAE;iBACX,CAAC;gBACF,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAC9B,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,IAAI,EAAE,QAAQ;iBACf,CAAC,CAAC;gBACH,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5C,+DAA+D;gBAC/D,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5D,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC;gBAC7C,CAAC;gBACD,wCAAwC;gBACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;oBACxC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC9C,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACvC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAe,EACf,OAA2B,EAC3B,IAA4B,EAC5B,QAA4C,EAC5C,aAAwB;IAExB,yGAAyG;IACzG,MAAM,QAAQ,GAAG,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,CAAC,GAAyB,EAAE,EAAE,CAAC,CAAC,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;IAChI,MAAM,eAAe,GAAG,CAAC,OAAwB,EAAE,EAAE,CACnD,QAAQ,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU,IAAI,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAEjG,gFAAgF;IAChF,+DAA+D;IAC/D,MAAM,WAAW,GAAU,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CACjE,IAAI,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAC5E,CAAC;IAEF,kFAAkF;IAClF,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,+EAA+E;IAC/E,6EAA6E;IAC7E,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,IAAI,aAAa,GAAG,CAAC,QAAQ,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACnC,IAAI,OAAO,GAAsB,EAAE,CAAC;QACpC,4EAA4E;QAC5E,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,yDAAyD;QACzD,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC5C,KAAK,MAAM,CAAC,EAAE,eAAe,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,eAAe,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAAE,SAAS;YACpE,IAAI,eAAe,CAAC,WAAW,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gBACpD,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;QACrC,CAAC;QACD,aAAa,GAAG,IAAI,CAAC;QACrB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,CAAC,IAAI,uBAAuB,CAAC,CAAC;YAC5D,SAAS;QACX,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,MAAM,YAAY,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;gBAC1F,MAAM,CAAC,OAAO,EAAE,WAAW,GAAG,CAAC,MAAM,2BAA2B,YAAY,GAAG,CAAC,CAAC;gBACjF,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC;YACnD,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,CAAC;YACf,CAAC;YACD,QAAQ,EAAE,CAAC;QACb,CAAC;IACH,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,CAAC,OAAO,EAAE,6BAA6B,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,OAAO,GAAG,CAAC,CAAC;QAClG,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,CAAC,OAAO,EAAE,6CAA6C,OAAO,GAAG,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,sEAAsE;IACtE,MAAM,OAAO,CAAC,GAAG,CACf,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CACd,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;QAC7B,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YACxB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CACH,CACF,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,MAAW;IAC/B,OAAO,OAAO,MAAM,EAAE,IAAI,KAAK,UAAU,IAAI,OAAO,MAAM,EAAE,MAAM,KAAK,UAAU,CAAC;AACpF,CAAC"}
+{"version":3,"file":"servicecommands.js","sourceRoot":"","sources":["../../src/services/servicecommands.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAyCxC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAgB;IACrD,MAAM,QAAQ,GAA2C,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;IAEjC,KAAK,MAAM,OAAO,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAU,EAAE,CAAC;QAChE,KAAK,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC1E,IAAI,CAAC,QAAQ,CAAC,QAAQ;gBAAE,SAAS;YACjC,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClE,QAAQ,CAAC,OAAO,CAAC,KAAK;oBACpB,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,QAAQ,EAAE,EAAE;oBACZ,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE;oBACxB,QAAQ,EAAE,EAAE;oBACZ,MAAM,EAAE,EAAE;iBACX,CAAC;gBACF,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAC9B,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,IAAI,EAAE,QAAQ;iBACf,CAAC,CAAC;gBACH,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5C,+DAA+D;gBAC/D,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5D,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC;gBAC7C,CAAC;gBACD,wCAAwC;gBACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;oBACxC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC9C,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACvC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAe,EACf,OAA2B,EAC3B,IAA4B,EAC5B,QAA4C,EAC5C,aAAwB;IAExB,yGAAyG;IACzG,MAAM,QAAQ,GAAG,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,CAAC,GAAyB,EAAE,EAAE,CAChD,CAAC,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;IAC/E,MAAM,eAAe,GAAG,CAAC,OAAwB,EAAE,EAAE,CACnD,QAAQ,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU,IAAI,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAEjG,gFAAgF;IAChF,+DAA+D;IAC/D,MAAM,WAAW,GAAU,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CACjE,IAAI,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAC5E,CAAC;IAEF,kFAAkF;IAClF,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,0CAA0C;IAC1C,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,cAAc,GAAG,CAAC,MAAW,EAAE,EAAE;QACrC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,GAAG,QAAQ,EAAE,CAAC;YACpD,QAAQ,GAAG,MAAM,CAAC;QACpB,CAAC;IACH,CAAC,CAAC;IACF,+EAA+E;IAC/E,6EAA6E;IAC7E,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,IAAI,aAAa,GAAG,CAAC,QAAQ,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACnC,IAAI,OAAO,GAAsB,EAAE,CAAC;QACpC,4EAA4E;QAC5E,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,yDAAyD;QACzD,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;QAC5C,KAAK,MAAM,CAAC,EAAE,eAAe,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,IAAI,CAAC,eAAe,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAAE,SAAS;YACpE,IAAI,eAAe,CAAC,WAAW,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;gBACpD,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;QACrC,CAAC;QACD,aAAa,GAAG,IAAI,CAAC;QACrB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,CAAC,IAAI,uBAAuB,CAAC,CAAC;YAC5D,SAAS;QACX,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,MAAM,YAAY,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;gBAC1F,MAAM,CAAC,OAAO,EAAE,WAAW,GAAG,CAAC,MAAM,2BAA2B,YAAY,GAAG,CAAC,CAAC;gBACjF,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC;YACnD,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,cAAc,CAAC,MAAM,MAAM,CAAC,CAAC;YAC/B,CAAC;YACD,QAAQ,EAAE,CAAC;QACb,CAAC;IACH,CAAC;IAED,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,CAAC,OAAO,EAAE,6BAA6B,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,OAAO,GAAG,CAAC,CAAC;QAClG,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,CAAC,OAAO,EAAE,6CAA6C,OAAO,GAAG,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,sEAAsE;IACtE,MAAM,OAAO,CAAC,GAAG,CACf,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CACd,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE;QAC5C,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YACxB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CACH,CACF,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,MAAW;IAC/B,OAAO,OAAO,MAAM,EAAE,IAAI,KAAK,UAAU,IAAI,OAAO,MAAM,EAAE,MAAM,KAAK,UAAU,CAAC;AACpF,CAAC"}

package/lib/session/manager.model.d.ts

@@ -1,4 +1,4 @@
-import type { CryptoService } from "../services/cryptoservice.service.js";
+import { type CryptoService } from "../services/cryptoservice.service.js";
 import { JWTOptions } from "../services/icryptoservice.js";
 import { Service } from "../services/service.js";
 import { CookieOptions } from "./cookie.js";
@@ -51,6 +51,8 @@ export declare class SessionModel extends UuidModel {
 export declare class CookieSessionParameters extends ServiceParameters {
     /**
      * Options for issue JWT token
+     *
+     * `secretOrPublicKey` can be encrypted with `webda config encrypt`
      */
     jwt?: JWTOptions;
     /**

package/lib/session/manager.model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manager.model.d.ts","sourceRoot":"","sources":["../../src/session/manager.model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAU,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAgB,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAgB,MAAM,yBAAyB,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAGvC,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,UAAU,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE5E;;GAEG;AACH,8BAAsB,cAAc,CAAC,CAAC,SAAS,iBAAiB,GAAG,iBAAiB,CAAE,SAAQ,OAAO,CAAC,CAAC,CAAC;IACtG;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjE;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAcrE;IAED;;;;;;;OAOG;IACH,UAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAY7D;CACF;AAED,2DAA2D;AAC3D,qBAAa,YAAa,SAAQ,SAAS;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,GAAG,CAAC;IACb;;OAEG;IACH,YAAY,IAAI,EAAE,GAAG,EAIpB;CACF;AAED,sDAAsD;AACtD,qBAAa,uBAAwB,SAAQ,iBAAiB;IAC5D;;OAEG;IACH,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB;;OAEG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;IAEvB;;;;OAIG;IACH,IAAI,CAAC,MAAM,GAAE,GAAQ,GAAG,IAAI,CAI3B;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,oBAAoB,CAC/B,CAAC,SAAS,uBAAuB,GAAG,uBAAuB,CAC3D,SAAQ,cAAc,CAAC,CAAC,CAAC;IAEzB,aAAa,EAAE,aAAa,CAAC;IAE7B,YAAY,EAAE,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;IAEnD;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAyB7C;IAED;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,iBAgC5C;CACF"}
+{"version":3,"file":"manager.model.d.ts","sourceRoot":"","sources":["../../src/session/manager.model.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAgB,MAAM,sCAAsC,CAAC;AACxF,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC3D,OAAO,EAAU,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,aAAa,EAAgB,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAgB,MAAM,yBAAyB,CAAC;AAEhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAGvC,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,UAAU,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE5E;;GAEG;AACH,8BAAsB,cAAc,CAAC,CAAC,SAAS,iBAAiB,GAAG,iBAAiB,CAAE,SAAQ,OAAO,CAAC,CAAC,CAAC;IACtG;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjE;;;;;OAKG;IACG,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAcrE;IAED;;;;;;;OAOG;IACH,UAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAY7D;CACF;AAED,2DAA2D;AAC3D,qBAAa,YAAa,SAAQ,SAAS;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,GAAG,CAAC;IACb;;OAEG;IACH,YAAY,IAAI,EAAE,GAAG,EAIpB;CACF;AAED,sDAAsD;AACtD,qBAAa,uBAAwB,SAAQ,iBAAiB;IAC5D;;;;OAIG;IACH,GAAG,CAAC,EAAE,UAAU,CAAC;IACjB;;OAEG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;IAEvB;;;;OAIG;IACH,IAAI,CAAC,MAAM,GAAE,GAAQ,GAAG,IAAI,CAI3B;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,oBAAoB,CAC/B,CAAC,SAAS,uBAAuB,GAAG,uBAAuB,CAC3D,SAAQ,cAAc,CAAC,CAAC,CAAC;IAEzB,aAAa,EAAE,aAAa,CAAC;IAE7B,YAAY,EAAE,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;IAEnD;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CA8B7C;IAED;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,iBAsC5C;CACF"}

package/lib/session/manager.model.js

@@ -32,6 +32,7 @@ var __runInitializers = (this && this.__runInitializers) || function (thisArg, i
     }
     return useValue ? value : void 0;
 };
+import { SecretString } from "../services/cryptoservice.service.js";
 import { Inject, Service } from "../services/service.js";
 import { CookieOptions, SecureCookie } from "./cookie.js";
 import { isWebContext } from "../contexts/icontext.js";
@@ -106,6 +107,8 @@ export class SessionModel extends UuidModel {
 export class CookieSessionParameters extends ServiceParameters {
     /**
      * Options for issue JWT token
+     *
+     * `secretOrPublicKey` can be encrypted with `webda config encrypt`
      */
     jwt;
     /**
@@ -158,7 +161,7 @@ let CookieSessionManager = (() => {
                 return this.loadFromToken(context, authorization.substring(7).trim());
             }
             const session = new Session();
-            const cookie = await SecureCookie.load(this.parameters.cookie.name, session, context, this.parameters.jwt);
+            const cookie = await SecureCookie.load(this.parameters.cookie.name, session, context, SecretString.unwrap(this.parameters.jwt));
             if (this.sessionModel) {
                 if (cookie.sub) {
                     Object.assign(session, (await this.sessionModel.get(cookie.sub))?.session);
@@ -201,10 +204,10 @@ let CookieSessionManager = (() => {
                         ttl: Date.now() + this.parameters.cookie.maxAge * 1000
                     });
                 }
-                SecureCookie.save(this.parameters.cookie.name, context, {}, { ...this.parameters.jwt, subject: session.uuid.toString() }, this.parameters.cookie);
+                SecureCookie.save(this.parameters.cookie.name, context, {}, SecretString.unwrap({ ...this.parameters.jwt, subject: session.uuid.toString() }), this.parameters.cookie);
                 return;
             }
-            SecureCookie.save(this.parameters.cookie.name, context, session, this.parameters.jwt, this.parameters.cookie);
+            SecureCookie.save(this.parameters.cookie.name, context, session, SecretString.unwrap(this.parameters.jwt), this.parameters.cookie);
         }
     };
 })();