@xemahq/xema 0.13.0 → 0.14.0

package/dist/runtime/runner/docker-cli.js

@@ -8,9 +8,12 @@ class DockerCli {
     constructor(bin = 'docker') {
         this.bin = bin;
     }
-    run(args) {
+    run(args, opts = {}) {
         return new Promise((resolve, reject) => {
-            (0, node_child_process_1.execFile)(this.bin, [...args], { maxBuffer: 32 * 1024 * 1024 }, (err, stdout, stderr) => {
+            (0, node_child_process_1.execFile)(this.bin, [...args], {
+                maxBuffer: 32 * 1024 * 1024,
+                ...(opts.env !== undefined ? { env: opts.env } : {}),
+            }, (err, stdout, stderr) => {
                 if (err) {
                     reject(new Error(`${this.bin} ${args.join(' ')} failed: ${stderr || err.message}`));
                     return;
@@ -19,6 +22,13 @@ class DockerCli {
             });
         });
     }
+    stream(args) {
+        return new Promise((resolve, reject) => {
+            const child = (0, node_child_process_1.spawn)(this.bin, [...args], { stdio: 'inherit' });
+            child.on('error', reject);
+            child.on('exit', () => resolve());
+        });
+    }
     async runQuiet(args) {
         try {
             return await this.run(args);
@@ -28,12 +38,26 @@ class DockerCli {
         }
     }
     async available() {
-        const out = await this.runQuiet(['version', '--format', '{{.Server.Version}}']);
+        const out = await this.runQuiet([
+            'version',
+            '--format',
+            '{{.Server.Version}}',
+        ]);
         return out.trim().length > 0;
     }
     async ensureNetwork(name) {
-        const existing = await this.runQuiet(['network', 'ls', '--filter', `name=^${name}$`, '--format', '{{.Name}}']);
-        if (!existing.split('\n').map((l) => l.trim()).includes(name)) {
+        const existing = await this.runQuiet([
+            'network',
+            'ls',
+            '--filter',
+            `name=^${name}$`,
+            '--format',
+            '{{.Name}}',
+        ]);
+        if (!existing
+            .split('\n')
+            .map((l) => l.trim())
+            .includes(name)) {
             await this.runQuiet(['network', 'create', name]);
         }
     }
@@ -46,7 +70,24 @@ class DockerCli {
             '--format',
             '{{.Names}}',
         ]);
-        return out.split('\n').map((l) => l.trim()).filter((l) => l.length > 0);
+        return out
+            .split('\n')
+            .map((l) => l.trim())
+            .filter((l) => l.length > 0);
+    }
+    async volumeExists(name) {
+        const out = await this.runQuiet([
+            'volume',
+            'ls',
+            '--filter',
+            `name=^${name}$`,
+            '--format',
+            '{{.Name}}',
+        ]);
+        return out
+            .split('\n')
+            .map((line) => line.trim())
+            .includes(name);
     }
 }
 exports.DockerCli = DockerCli;

package/dist/runtime/runner/docker-cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"docker-cli.js","sourceRoot":"","sources":["../../../src/runtime/runner/docker-cli.ts"],"names":[],"mappings":";;;AAAA,2DAA8C;AAUjC,QAAA,cAAc,GAAG,eAAe,CAAC;AAE9C,MAAa,SAAS;IACS;IAA7B,YAA6B,MAAc,QAAQ;QAAtB,QAAG,GAAH,GAAG,CAAmB;IAAG,CAAC;IAEvD,GAAG,CAAC,IAAuB;QACzB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAA,6BAAQ,EAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;gBACrF,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;oBACpF,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAGD,KAAK,CAAC,QAAQ,CAAC,IAAuB;QACpC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAGD,KAAK,CAAC,SAAS;QACb,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAChF,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/B,CAAC;IAGD,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,IAAI,GAAG,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;QAC/G,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAGD,KAAK,CAAC,kBAAkB;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;YAC9B,IAAI;YACJ,IAAI;YACJ,UAAU;YACV,SAAS,sBAAc,EAAE;YACzB,UAAU;YACV,YAAY;SACb,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1E,CAAC;CACF;AAlDD,8BAkDC"}
+{"version":3,"file":"docker-cli.js","sourceRoot":"","sources":["../../../src/runtime/runner/docker-cli.ts"],"names":[],"mappings":";;;AAAA,2DAAqD;AAUxC,QAAA,cAAc,GAAG,eAAe,CAAC;AAM9C,MAAa,SAAS;IACS;IAA7B,YAA6B,MAAc,QAAQ;QAAtB,QAAG,GAAH,GAAG,CAAmB;IAAG,CAAC;IAEvD,GAAG,CAAC,IAAuB,EAAE,OAAyB,EAAE;QACtD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAA,6BAAQ,EACN,IAAI,CAAC,GAAG,EACR,CAAC,GAAG,IAAI,CAAC,EACT;gBACE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;gBAC3B,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrD,EACD,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;gBACtB,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,CACJ,IAAI,KAAK,CACP,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CACjE,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAUD,MAAM,CAAC,IAAuB;QAC5B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YAC/D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;IAGD,KAAK,CAAC,QAAQ,CAAC,IAAuB;QACpC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAGD,KAAK,CAAC,SAAS;QACb,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;YAC9B,SAAS;YACT,UAAU;YACV,qBAAqB;SACtB,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/B,CAAC;IAGD,KAAK,CAAC,aAAa,CAAC,IAAY;QAC9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;YACnC,SAAS;YACT,IAAI;YACJ,UAAU;YACV,SAAS,IAAI,GAAG;YAChB,UAAU;YACV,WAAW;SACZ,CAAC,CAAC;QACH,IACE,CAAC,QAAQ;aACN,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,QAAQ,CAAC,IAAI,CAAC,EACjB,CAAC;YACD,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAGD,KAAK,CAAC,kBAAkB;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;YAC9B,IAAI;YACJ,IAAI;YACJ,UAAU;YACV,SAAS,sBAAc,EAAE;YACzB,UAAU;YACV,YAAY;SACb,CAAC,CAAC;QACH,OAAO,GAAG;aACP,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjC,CAAC;IAGD,KAAK,CAAC,YAAY,CAAC,IAAY;QAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;YAC9B,QAAQ;YACR,IAAI;YACJ,UAAU;YACV,SAAS,IAAI,GAAG;YAChB,UAAU;YACV,WAAW;SACZ,CAAC,CAAC;QACH,OAAO,GAAG;aACP,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,QAAQ,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;CACF;AAjHD,8BAiHC"}

package/dist/runtime/runner/native-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native-runner.d.ts","sourceRoot":"","sources":["../../../src/runtime/runner/native-runner.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACvB,MAAM,kBAAkB,CAAC;AAa1B,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,qBAAa,YAAa,YAAW,aAAa;IAChD,QAAQ,CAAC,IAAI,4BAA4B;IACzC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;gBAE1B,IAAI,GAAE,mBAAwB;IAWpC,KAAK,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;YAgChD,WAAW;IA0BzB,OAAO,CAAC,kBAAkB;CAY3B"}
+{"version":3,"file":"native-runner.d.ts","sourceRoot":"","sources":["../../../src/runtime/runner/native-runner.ts"],"names":[],"mappings":"AASA,OAAO,EACL,iBAAiB,EACjB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACvB,MAAM,kBAAkB,CAAC;AAa1B,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,qBAAa,YAAa,YAAW,aAAa;IAChD,QAAQ,CAAC,IAAI,4BAA4B;IACzC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;gBAE1B,IAAI,GAAE,mBAAwB;IAWpC,KAAK,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;YAoDhD,WAAW;IAoCzB,OAAO,CAAC,kBAAkB;CAiB3B"}

package/dist/runtime/runner/native-runner.js

@@ -23,17 +23,28 @@ class NativeRunner {
             throw new Error(`${entry.name}: no servicePath (platform-substrate service) — not bootable natively. ` +
                 `Use the container substrate for this service.`);
         }
+        const watch = (0, forked_worker_1.resolveLaunchMode)() === forked_worker_1.LaunchMode.Watch;
         const baseRoot = entry.sourceRoot ?? this.monorepoRoot;
-        const serviceRoot = this.resolveServiceRoot(entry.servicePath, baseRoot);
+        const serviceRoot = this.resolveServiceRoot(entry.servicePath, baseRoot, watch);
         if (!serviceRoot) {
-            const primary = (0, node_path_1.join)(baseRoot, entry.servicePath, 'dist', 'main.js');
-            throw new Error(`${entry.name} dist not found at ${primary}. Run \`pnpm --filter ${entry.name} build\` first.`);
+            const marker = watch ? (0, node_path_1.join)('src', 'main.ts') : (0, node_path_1.join)('dist', 'main.js');
+            const primary = (0, node_path_1.join)(baseRoot, entry.servicePath, marker);
+            throw new Error(watch
+                ? `${entry.name} source entry not found at ${primary}. --watch runs each ` +
+                    `service from source; a source checkout of ${entry.name} is required.`
+                : `${entry.name} dist not found at ${primary}. Run \`pnpm --filter ${entry.name} build\` first.`);
         }
-        applyEnv(env);
-        return this.forkService(entry, serviceRoot, port, readinessTimeoutMs);
+        return this.forkService(entry, serviceRoot, port, readinessTimeoutMs, watch, env);
     }
-    async forkService(entry, serviceRoot, port, readinessTimeoutMs) {
-        const child = await (0, forked_worker_1.spawnForkedWorker)({ name: entry.name, port, siblingAppDir: serviceRoot, readinessTimeoutMs }, '/');
+    async forkService(entry, serviceRoot, port, readinessTimeoutMs, watch, env) {
+        const child = await (0, forked_worker_1.spawnForkedWorker)({
+            name: entry.name,
+            port,
+            siblingAppDir: serviceRoot,
+            readinessTimeoutMs,
+            watch,
+            env,
+        }, '/');
         return {
             name: entry.name,
             url: child.url,
@@ -41,13 +52,14 @@ class NativeRunner {
             close: () => child.close(),
         };
     }
-    resolveServiceRoot(servicePath, baseRoot) {
+    resolveServiceRoot(servicePath, baseRoot, watch) {
+        const marker = watch ? (0, node_path_1.join)('src', 'main.ts') : (0, node_path_1.join)('dist', 'main.js');
         const candidates = [
             (0, node_path_1.join)(baseRoot, servicePath),
             (0, node_path_1.join)(baseRoot, (0, node_path_1.dirname)(servicePath)),
         ];
         for (const candidate of candidates) {
-            if ((0, node_fs_1.existsSync)((0, node_path_1.join)(candidate, 'dist', 'main.js'))) {
+            if ((0, node_fs_1.existsSync)((0, node_path_1.join)(candidate, marker))) {
                 return candidate;
             }
         }
@@ -55,9 +67,4 @@ class NativeRunner {
     }
 }
 exports.NativeRunner = NativeRunner;
-function applyEnv(env) {
-    for (const [k, v] of Object.entries(env)) {
-        process.env[k] = v;
-    }
-}
 //# sourceMappingURL=native-runner.js.map

package/dist/runtime/runner/native-runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"native-runner.js","sourceRoot":"","sources":["../../../src/runtime/runner/native-runner.ts"],"names":[],"mappings":";;;AAAA,qCAAqC;AACrC,yCAA0C;AAE1C,2DAA4D;AAC5D,oCAA4C;AAC5C,qDAK0B;AAiB1B,MAAa,YAAY;IACd,IAAI,GAAG,kCAAiB,CAAC,MAAM,CAAC;IACxB,YAAY,CAAS;IAEtC,YAAY,OAA4B,EAAE;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,IAAA,wBAAgB,GAAE,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,yEAAyE;gBACvE,0DAA0D,CAC7D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAwB;QAClC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,KAAK,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,IAAI,yEAAyE;gBACpF,+CAA+C,CAClD,CAAC;QACJ,CAAC;QAGD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,YAAY,CAAC;QACvD,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACzE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,IAAA,gBAAI,EAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YACrE,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,IAAI,sBAAsB,OAAO,yBAAyB,KAAK,CAAC,IAAI,iBAAiB,CAC/F,CAAC;QACJ,CAAC;QAED,QAAQ,CAAC,GAAG,CAAC,CAAC;QAGd,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACxE,CAAC;IASO,KAAK,CAAC,WAAW,CACvB,KAAkB,EAClB,WAAmB,EACnB,IAAY,EACZ,kBAA0B;QAE1B,MAAM,KAAK,GAAG,MAAM,IAAA,iCAAiB,EACnC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,kBAAkB,EAAE,EAC1E,GAAG,CACJ,CAAC;QACF,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,MAAM,EAAE,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;YAClC,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE;SAC3B,CAAC;IACJ,CAAC;IAUO,kBAAkB,CAAC,WAAmB,EAAE,QAAgB;QAC9D,MAAM,UAAU,GAAG;YACjB,IAAA,gBAAI,EAAC,QAAQ,EAAE,WAAW,CAAC;YAC3B,IAAA,gBAAI,EAAC,QAAQ,EAAE,IAAA,mBAAO,EAAC,WAAW,CAAC,CAAC;SACrC,CAAC;QACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,IAAA,oBAAU,EAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;gBACnD,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AArFD,oCAqFC;AAED,SAAS,QAAQ,CAAC,GAAqC;IACrD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACH,CAAC"}
+{"version":3,"file":"native-runner.js","sourceRoot":"","sources":["../../../src/runtime/runner/native-runner.ts"],"names":[],"mappings":";;;AAAA,qCAAqC;AACrC,yCAA0C;AAE1C,2DAIiC;AACjC,oCAA4C;AAC5C,qDAK0B;AAiB1B,MAAa,YAAY;IACd,IAAI,GAAG,kCAAiB,CAAC,MAAM,CAAC;IACxB,YAAY,CAAS;IAEtC,YAAY,OAA4B,EAAE;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,IAAA,wBAAgB,GAAE,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,yEAAyE;gBACvE,0DAA0D,CAC7D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAwB;QAClC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,KAAK,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,IAAI,yEAAyE;gBACpF,+CAA+C,CAClD,CAAC;QACJ,CAAC;QAMD,MAAM,KAAK,GAAG,IAAA,iCAAiB,GAAE,KAAK,0BAAU,CAAC,KAAK,CAAC;QAIvD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,YAAY,CAAC;QACvD,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CACzC,KAAK,CAAC,WAAW,EACjB,QAAQ,EACR,KAAK,CACN,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACxE,MAAM,OAAO,GAAG,IAAA,gBAAI,EAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAC1D,MAAM,IAAI,KAAK,CACb,KAAK;gBACH,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,8BAA8B,OAAO,sBAAsB;oBACxE,6CAA6C,KAAK,CAAC,IAAI,eAAe;gBACxE,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,sBAAsB,OAAO,yBAAyB,KAAK,CAAC,IAAI,iBAAiB,CACnG,CAAC;QACJ,CAAC;QAGD,OAAO,IAAI,CAAC,WAAW,CACrB,KAAK,EACL,WAAW,EACX,IAAI,EACJ,kBAAkB,EAClB,KAAK,EACL,GAAG,CACJ,CAAC;IACJ,CAAC;IASO,KAAK,CAAC,WAAW,CACvB,KAAkB,EAClB,WAAmB,EACnB,IAAY,EACZ,kBAA0B,EAC1B,KAAc,EACd,GAAqC;QAErC,MAAM,KAAK,GAAG,MAAM,IAAA,iCAAiB,EACnC;YACE,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI;YACJ,aAAa,EAAE,WAAW;YAC1B,kBAAkB;YAClB,KAAK;YACL,GAAG;SACJ,EACD,GAAG,CACJ,CAAC;QACF,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,MAAM,EAAE,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;YAClC,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE;SAC3B,CAAC;IACJ,CAAC;IAWO,kBAAkB,CACxB,WAAmB,EACnB,QAAgB,EAChB,KAAc;QAEd,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACxE,MAAM,UAAU,GAAG;YACjB,IAAA,gBAAI,EAAC,QAAQ,EAAE,WAAW,CAAC;YAC3B,IAAA,gBAAI,EAAC,QAAQ,EAAE,IAAA,mBAAO,EAAC,WAAW,CAAC,CAAC;SACrC,CAAC;QACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,IAAA,oBAAU,EAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;gBACxC,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAxHD,oCAwHC"}

package/dist/runtime/secrets/managed-local-store.d.ts

@@ -0,0 +1,26 @@
+export interface InfrastructureCredentialPair {
+    readonly username: string;
+    readonly password: string;
+}
+export interface LocalInfrastructureCredentials {
+    readonly postgres?: InfrastructureCredentialPair;
+    readonly objectStore?: InfrastructureCredentialPair;
+}
+export interface ManagedLocalCredentials extends LocalInfrastructureCredentials {
+    readonly postgres: InfrastructureCredentialPair;
+    readonly objectStore: InfrastructureCredentialPair;
+}
+export interface ManagedLocalCredentialStoreOptions {
+    readonly installationIdentity: string;
+    readonly stateRoot?: string;
+}
+export declare class ManagedLocalCredentialStore {
+    readonly installationId: string;
+    readonly directory: string;
+    readonly path: string;
+    constructor(opts: ManagedLocalCredentialStoreOptions);
+    load(): Promise<ManagedLocalCredentials | undefined>;
+    getOrCreate(): Promise<ManagedLocalCredentials>;
+    purge(): Promise<boolean>;
+}
+//# sourceMappingURL=managed-local-store.d.ts.map

package/dist/runtime/secrets/managed-local-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-local-store.d.ts","sourceRoot":"","sources":["../../../src/runtime/secrets/managed-local-store.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAGD,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,4BAA4B,CAAC;IACjD,QAAQ,CAAC,WAAW,CAAC,EAAE,4BAA4B,CAAC;CACrD;AAGD,MAAM,WAAW,uBACf,SAAQ,8BAA8B;IACtC,QAAQ,CAAC,QAAQ,EAAE,4BAA4B,CAAC;IAChD,QAAQ,CAAC,WAAW,EAAE,4BAA4B,CAAC;CACpD;AAOD,MAAM,WAAW,kCAAkC;IAEjD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IAEtC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAUD,qBAAa,2BAA2B;IACtC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,IAAI,EAAE,kCAAkC;IAc9C,IAAI,IAAI,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC;IAmEpD,WAAW,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAiE/C,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC;CAqBhC"}

package/dist/runtime/secrets/managed-local-store.js

@@ -0,0 +1,202 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ManagedLocalCredentialStore = void 0;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const promises_1 = require("node:fs/promises");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const STORE_VERSION = 1;
+const PRIVATE_DIRECTORY_MODE = 0o700;
+const PRIVATE_FILE_MODE = 0o600;
+const CREDENTIAL_FILE = 'managed-local-credentials.json';
+class ManagedLocalCredentialStore {
+    installationId;
+    directory;
+    path;
+    constructor(opts) {
+        const identity = opts.installationIdentity.trim();
+        if (identity.length === 0) {
+            throw new Error('Managed-local credential installation identity must not be empty.');
+        }
+        this.installationId = (0, node_crypto_1.createHash)('sha256').update(identity).digest('hex');
+        const root = opts.stateRoot ?? (0, node_path_1.join)((0, node_os_1.homedir)(), '.xema', 'installations');
+        this.directory = (0, node_path_1.join)(root, this.installationId);
+        this.path = (0, node_path_1.join)(this.directory, CREDENTIAL_FILE);
+    }
+    async load() {
+        let directoryStat;
+        try {
+            directoryStat = await (0, promises_1.lstat)(this.directory);
+        }
+        catch (error) {
+            if (errorCode(error) === 'ENOENT') {
+                return undefined;
+            }
+            throw new Error(`Managed-local credential directory could not be inspected at ${this.directory}.`);
+        }
+        if (!directoryStat.isDirectory() ||
+            (directoryStat.mode & 0o077) !== 0 ||
+            !ownedByCurrentUser(directoryStat.uid)) {
+            throw new Error(`Managed-local credential directory is unsafe at ${this.directory}; expected an installer-owned directory with mode 0700.`);
+        }
+        let handle;
+        try {
+            handle = await (0, promises_1.open)(this.path, node_fs_1.constants.O_RDONLY | (node_fs_1.constants.O_NOFOLLOW ?? 0));
+        }
+        catch (error) {
+            if (errorCode(error) === 'ENOENT') {
+                return undefined;
+            }
+            throw new Error(`Managed-local credential store could not be inspected at ${this.path}.`);
+        }
+        try {
+            const fileStat = await handle.stat();
+            if (!fileStat.isFile() || !ownedByCurrentUser(fileStat.uid)) {
+                throw new Error(`Managed-local credential store path is not a regular file: ${this.path}.`);
+            }
+            if ((fileStat.mode & 0o077) !== 0) {
+                throw new Error(`Managed-local credential store permissions are unsafe at ${this.path}; expected mode 0600.`);
+            }
+            let raw;
+            try {
+                raw = await handle.readFile('utf8');
+            }
+            catch {
+                throw new Error(`Managed-local credential store could not be read at ${this.path}.`);
+            }
+            return parsePersisted(raw, this.installationId, this.path);
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async getOrCreate() {
+        const existing = await this.load();
+        if (existing !== undefined) {
+            return existing;
+        }
+        await (0, promises_1.mkdir)(this.directory, {
+            recursive: true,
+            mode: PRIVATE_DIRECTORY_MODE,
+        });
+        await (0, promises_1.chmod)(this.directory, PRIVATE_DIRECTORY_MODE);
+        const persisted = {
+            version: STORE_VERSION,
+            installationId: this.installationId,
+            postgres: {
+                username: 'xema',
+                password: strongSecret(48),
+            },
+            objectStore: {
+                username: strongSecret(24),
+                password: strongSecret(48),
+            },
+        };
+        const candidatePath = (0, node_path_1.join)(this.directory, `.${CREDENTIAL_FILE}.${String(process.pid)}.${strongSecret(12)}.tmp`);
+        const handle = await (0, promises_1.open)(candidatePath, 'wx', PRIVATE_FILE_MODE);
+        try {
+            await handle.writeFile(`${JSON.stringify(persisted)}\n`, 'utf8');
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        try {
+            await (0, promises_1.link)(candidatePath, this.path);
+        }
+        catch (error) {
+            if (errorCode(error) !== 'EEXIST') {
+                throw new Error(`Managed-local credential store could not be created at ${this.path}.`);
+            }
+        }
+        finally {
+            await (0, promises_1.unlink)(candidatePath).catch((error) => {
+                if (errorCode(error) !== 'ENOENT') {
+                    throw error;
+                }
+            });
+        }
+        const installed = await this.load();
+        if (installed === undefined) {
+            throw new Error(`Managed-local credential store was not installed at ${this.path}.`);
+        }
+        return installed;
+    }
+    async purge() {
+        if ((await this.load()) === undefined) {
+            return false;
+        }
+        try {
+            await (0, promises_1.unlink)(this.path);
+        }
+        catch (error) {
+            if (errorCode(error) === 'ENOENT') {
+                return false;
+            }
+            throw new Error(`Managed-local credential store could not be removed at ${this.path}.`);
+        }
+        await (0, promises_1.rmdir)(this.directory).catch((error) => {
+            if (errorCode(error) !== 'ENOTEMPTY' && errorCode(error) !== 'ENOENT') {
+                throw error;
+            }
+        });
+        return true;
+    }
+}
+exports.ManagedLocalCredentialStore = ManagedLocalCredentialStore;
+function parsePersisted(raw, installationId, path) {
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        throw new Error(`Managed-local credential store is invalid JSON at ${path}.`);
+    }
+    if (!isRecord(value)) {
+        throw invalidStore(path);
+    }
+    if (value.version !== STORE_VERSION ||
+        value.installationId !== installationId) {
+        throw invalidStore(path);
+    }
+    if (!isCredentialPair(value.postgres) ||
+        !isCredentialPair(value.objectStore)) {
+        throw invalidStore(path);
+    }
+    return {
+        postgres: {
+            username: value.postgres.username,
+            password: value.postgres.password,
+        },
+        objectStore: {
+            username: value.objectStore.username,
+            password: value.objectStore.password,
+        },
+    };
+}
+function isCredentialPair(value) {
+    return (isRecord(value) &&
+        typeof value.username === 'string' &&
+        value.username.length > 0 &&
+        typeof value.password === 'string' &&
+        value.password.length >= 32);
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function invalidStore(path) {
+    return new Error(`Managed-local credential store has an unsupported or incomplete format at ${path}.`);
+}
+function strongSecret(bytes) {
+    return (0, node_crypto_1.randomBytes)(bytes).toString('base64url');
+}
+function errorCode(error) {
+    return isRecord(error) && typeof error.code === 'string'
+        ? error.code
+        : undefined;
+}
+function ownedByCurrentUser(uid) {
+    return typeof process.getuid !== 'function' || process.getuid() === uid;
+}
+//# sourceMappingURL=managed-local-store.js.map

package/dist/runtime/secrets/managed-local-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-local-store.js","sourceRoot":"","sources":["../../../src/runtime/secrets/managed-local-store.ts"],"names":[],"mappings":";;;AAAA,6CAAsD;AACtD,qCAAoC;AACpC,+CAQ0B;AAC1B,qCAAkC;AAClC,yCAAiC;AAEjC,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB,MAAM,sBAAsB,GAAG,KAAK,CAAC;AACrC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAChC,MAAM,eAAe,GAAG,gCAAgC,CAAC;AAwCzD,MAAa,2BAA2B;IAC7B,cAAc,CAAS;IACvB,SAAS,CAAS;IAClB,IAAI,CAAS;IAEtB,YAAY,IAAwC;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,IAAI,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;QACzE,IAAI,CAAC,SAAS,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,IAAA,gBAAI,EAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IACpD,CAAC;IAGD,KAAK,CAAC,IAAI;QACR,IAAI,aAAa,CAAC;QAClB,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,IAAA,gBAAK,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAClC,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,IAAI,KAAK,CACb,gEAAgE,IAAI,CAAC,SAAS,GAAG,CAClF,CAAC;QACJ,CAAC;QACD,IACE,CAAC,aAAa,CAAC,WAAW,EAAE;YAC5B,CAAC,aAAa,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;YAClC,CAAC,kBAAkB,CAAC,aAAa,CAAC,GAAG,CAAC,EACtC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,mDAAmD,IAAI,CAAC,SAAS,yDAAyD,CAC3H,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAA,eAAI,EACjB,IAAI,CAAC,IAAI,EACT,mBAAS,CAAC,QAAQ,GAAG,CAAC,mBAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CACjD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAClC,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,IAAI,KAAK,CACb,4DAA4D,IAAI,CAAC,IAAI,GAAG,CACzE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,KAAK,CACb,8DAA8D,IAAI,CAAC,IAAI,GAAG,CAC3E,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CACb,4DAA4D,IAAI,CAAC,IAAI,uBAAuB,CAC7F,CAAC;YACJ,CAAC;YACD,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CACb,uDAAuD,IAAI,CAAC,IAAI,GAAG,CACpE,CAAC;YACJ,CAAC;YACD,OAAO,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAOD,KAAK,CAAC,WAAW;QACf,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,IAAA,gBAAK,EAAC,IAAI,CAAC,SAAS,EAAE;YAC1B,SAAS,EAAE,IAAI;YACf,IAAI,EAAE,sBAAsB;SAC7B,CAAC,CAAC;QACH,MAAM,IAAA,gBAAK,EAAC,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;QAEpD,MAAM,SAAS,GAAqC;YAClD,OAAO,EAAE,aAAa;YACtB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,QAAQ,EAAE;gBACR,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;aAC3B;YACD,WAAW,EAAE;gBACX,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;gBAC1B,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;aAC3B;SACF,CAAC;QACF,MAAM,aAAa,GAAG,IAAA,gBAAI,EACxB,IAAI,CAAC,SAAS,EACd,IAAI,eAAe,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,EAAE,CAAC,MAAM,CACrE,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAA,eAAI,EAAC,aAAa,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACjE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAA,eAAI,EAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CACb,0DAA0D,IAAI,CAAC,IAAI,GAAG,CACvE,CAAC;YACJ,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,IAAA,iBAAM,EAAC,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACnD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;oBAClC,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,uDAAuD,IAAI,CAAC,IAAI,GAAG,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAMD,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAA,iBAAM,EAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAClC,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,IAAI,KAAK,CACb,0DAA0D,IAAI,CAAC,IAAI,GAAG,CACvE,CAAC;QACJ,CAAC;QACD,MAAM,IAAA,gBAAK,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACnD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,WAAW,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACtE,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AA5KD,kEA4KC;AAED,SAAS,cAAc,CACrB,GAAW,EACX,cAAsB,EACtB,IAAY;IAEZ,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,qDAAqD,IAAI,GAAG,CAC7D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,IACE,KAAK,CAAC,OAAO,KAAK,aAAa;QAC/B,KAAK,CAAC,cAAc,KAAK,cAAc,EACvC,CAAC;QACD,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,IACE,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC;QACjC,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW,CAAC,EACpC,CAAC;QACD,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO;QACL,QAAQ,EAAE;YACR,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ;YACjC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ;SAClC;QACD,WAAW,EAAE;YACX,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,QAAQ;YACpC,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,QAAQ;SACrC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IAItC,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACzB,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAC5B,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,KAAK,CACd,6EAA6E,IAAI,GAAG,CACrF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,IAAA,yBAAW,EAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QACtD,CAAC,CAAC,KAAK,CAAC,IAAI;QACZ,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,OAAO,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC;AAC1E,CAAC"}

package/dist/runtime/secrets/resolver.d.ts

@@ -0,0 +1,23 @@
+import { Substrate, type XemaConfig } from '../config/schema';
+export type ResolvedSecrets = ReadonlyMap<string, string>;
+export interface SecretResolverOptions {
+    readonly env?: NodeJS.ProcessEnv;
+    readonly cwd?: string;
+    readonly prompt?: (name: string) => Promise<string>;
+}
+export declare class SecretResolver {
+    private readonly env;
+    private readonly cwd;
+    private readonly prompt;
+    constructor(opts?: SecretResolverOptions);
+    resolve(config: XemaConfig): Promise<ResolvedSecrets>;
+    private resolveOne;
+}
+export declare function secretEnvironment(resolved: ResolvedSecrets): Readonly<Record<string, string>>;
+export declare function assertSecretMaterializationSupported(config: XemaConfig, substrate: Substrate): void;
+export interface PostgresCredentials {
+    readonly username: string;
+    readonly password: string;
+}
+export declare function externalPostgresCredentials(config: XemaConfig, resolved: ResolvedSecrets): PostgresCredentials | undefined;
+//# sourceMappingURL=resolver.d.ts.map

package/dist/runtime/secrets/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../src/runtime/secrets/resolver.ts"],"names":[],"mappings":"AASA,OAAO,EAIL,SAAS,EAGT,KAAK,UAAU,EAChB,MAAM,kBAAkB,CAAC;AAM1B,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE1D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAEjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACrD;AAID,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoB;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;gBAE/C,IAAI,GAAE,qBAA0B;IAWtC,OAAO,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,eAAe,CAAC;YAkB7C,UAAU;CAqCzB;AAOD,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,eAAe,GACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAQlC;AAQD,wBAAgB,oCAAoC,CAClD,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,SAAS,GACnB,IAAI,CAYN;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAMD,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,UAAU,EAClB,QAAQ,EAAE,eAAe,GACxB,mBAAmB,GAAG,SAAS,CA+BjC"}