@xemahq/xema 0.13.0 → 0.14.0

package/dist/runtime/secrets/resolver.js

@@ -0,0 +1,265 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretResolver = void 0;
+exports.secretEnvironment = secretEnvironment;
+exports.assertSecretMaterializationSupported = assertSecretMaterializationSupported;
+exports.externalPostgresCredentials = externalPostgresCredentials;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const schema_1 = require("../config/schema");
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+class SecretResolver {
+    env;
+    cwd;
+    prompt;
+    constructor(opts = {}) {
+        this.env = opts.env ?? process.env;
+        this.cwd = opts.cwd ?? process.cwd();
+        this.prompt = opts.prompt ?? promptHidden;
+    }
+    async resolve(config) {
+        const resolved = new Map();
+        for (const [name, declaration] of Object.entries(config.secrets)) {
+            const value = await this.resolveOne(name, declaration);
+            if (value.length === 0) {
+                throw new Error(`Secret "${name}" resolved to an empty value.`);
+            }
+            if (value.includes('\0')) {
+                throw new Error(`Secret "${name}" contains a NUL byte.`);
+            }
+            resolved.set(name, value);
+        }
+        validateInfraReferences(config, resolved);
+        validateExternalPostgres(config, resolved);
+        return new SecretSnapshot(resolved);
+    }
+    async resolveOne(name, declaration) {
+        switch (declaration.from) {
+            case schema_1.SecretSource.Env: {
+                const envName = declaration.env ?? name;
+                if (!ENV_NAME.test(envName)) {
+                    throw new Error(`Secret "${name}" has invalid env source "${envName}". Use a valid environment variable name.`);
+                }
+                const value = this.env[envName];
+                if (value === undefined || value.length === 0) {
+                    throw new Error(`Secret "${name}" requires environment variable ${envName}, but it is unset or empty.`);
+                }
+                return value;
+            }
+            case schema_1.SecretSource.File: {
+                if (declaration.path === undefined) {
+                    throw new Error(`Secret "${name}" uses a file source but has no path.`);
+                }
+                const path = (0, node_path_1.isAbsolute)(declaration.path)
+                    ? declaration.path
+                    : (0, node_path_1.resolve)(this.cwd, declaration.path);
+                return readSecretFile(name, path);
+            }
+            case schema_1.SecretSource.Prompt:
+                return this.prompt(name);
+        }
+    }
+}
+exports.SecretResolver = SecretResolver;
+function secretEnvironment(resolved) {
+    const env = {};
+    for (const [name, value] of resolved) {
+        if (ENV_NAME.test(name)) {
+            env[name] = value;
+        }
+    }
+    return env;
+}
+function assertSecretMaterializationSupported(config, substrate) {
+    if (substrate !== schema_1.Substrate.Helm) {
+        return;
+    }
+    const hasDeclarations = Object.keys(config.secrets).length > 0;
+    const usesExternalPostgres = config.infra[schema_1.InfraComponent.Postgres]?.mode === schema_1.InfraMode.External;
+    if (hasDeclarations || usesExternalPostgres) {
+        throw new Error('The Helm substrate does not materialize launcher secrets or external PostgreSQL credentials. Configure Kubernetes Secrets through the service charts instead.');
+    }
+}
+function externalPostgresCredentials(config, resolved) {
+    const postgres = config.infra[schema_1.InfraComponent.Postgres];
+    if (postgres?.mode !== schema_1.InfraMode.External) {
+        return undefined;
+    }
+    const url = parsePostgresUrl(postgres);
+    const username = decodeURIComponent(url.username);
+    const inlinePassword = decodeURIComponent(url.password);
+    if (inlinePassword.length > 0) {
+        throw new Error('infra.postgres external URL must not contain a password; reference a declared secret with secretRef.');
+    }
+    if (username.length === 0) {
+        throw new Error('infra.postgres external URL must include an explicit username.');
+    }
+    if (postgres.secretRef === undefined) {
+        throw new Error('infra.postgres external configuration requires secretRef.');
+    }
+    const password = resolved.get(postgres.secretRef);
+    if (password === undefined || password.length === 0) {
+        throw new Error(`infra.postgres secretRef "${postgres.secretRef}" is unresolved.`);
+    }
+    return { username, password };
+}
+function validateInfraReferences(config, resolved) {
+    for (const [component, componentConfig] of Object.entries(config.infra)) {
+        if (componentConfig === undefined) {
+            continue;
+        }
+        const reference = componentConfig.secretRef;
+        if (reference === undefined) {
+            continue;
+        }
+        if (component !== schema_1.InfraComponent.Postgres) {
+            throw new Error(`infra.${component}.secretRef is unsupported; only external PostgreSQL passwords accept an infra secretRef.`);
+        }
+        if (!resolved.has(reference)) {
+            throw new Error(`infra.${component}.secretRef references undeclared or unresolved secret "${reference}".`);
+        }
+    }
+}
+function validateExternalPostgres(config, resolved) {
+    externalPostgresCredentials(config, resolved);
+}
+function parsePostgresUrl(config) {
+    if (config.url === undefined) {
+        throw new Error('infra.postgres external configuration has no URL.');
+    }
+    let url;
+    try {
+        url = new URL(config.url);
+    }
+    catch {
+        throw new Error('infra.postgres external URL is invalid.');
+    }
+    if (url.protocol !== 'postgres:' && url.protocol !== 'postgresql:') {
+        throw new Error('infra.postgres external URL must use the postgres or postgresql scheme.');
+    }
+    return url;
+}
+async function promptHidden(name) {
+    const input = process.stdin;
+    const output = process.stderr;
+    if (!input.isTTY || !output.isTTY || typeof input.setRawMode !== 'function') {
+        throw new Error(`Secret "${name}" requires an interactive terminal. Use an env or file source for unattended launches.`);
+    }
+    output.write(`Secret ${name}: `);
+    return new Promise((resolvePromise, rejectPromise) => {
+        const bytes = [];
+        const wasRaw = input.isRaw;
+        let settled = false;
+        const cleanup = () => {
+            input.off('data', onData);
+            input.off('end', onEnd);
+            input.off('error', onError);
+            input.setRawMode(wasRaw);
+            input.pause();
+            output.write('\n');
+        };
+        const finish = (operation) => {
+            if (settled) {
+                return;
+            }
+            settled = true;
+            cleanup();
+            operation();
+        };
+        const onEnd = () => {
+            finish(() => rejectPromise(new Error(`Secret prompt for "${name}" ended before a value was read.`)));
+        };
+        const onError = () => {
+            finish(() => rejectPromise(new Error(`Secret prompt for "${name}" failed.`)));
+        };
+        const onData = (chunk) => {
+            for (const byte of chunk) {
+                if (byte === 3) {
+                    finish(() => rejectPromise(new Error(`Secret prompt for "${name}" was cancelled.`)));
+                    return;
+                }
+                if (byte === 10 || byte === 13) {
+                    finish(() => resolvePromise(Buffer.concat(bytes).toString('utf8')));
+                    return;
+                }
+                if (byte === 8 || byte === 127) {
+                    const current = Buffer.concat(bytes);
+                    bytes.length = 0;
+                    if (current.length > 0) {
+                        bytes.push(current.subarray(0, current.length - 1));
+                    }
+                    continue;
+                }
+                bytes.push(Buffer.from([byte]));
+            }
+        };
+        input.setRawMode(true);
+        input.resume();
+        input.on('data', onData);
+        input.once('end', onEnd);
+        input.once('error', onError);
+    });
+}
+function readSecretFile(name, path) {
+    let descriptor;
+    try {
+        descriptor = (0, node_fs_1.openSync)(path, node_fs_1.constants.O_RDONLY | (node_fs_1.constants.O_NOFOLLOW ?? 0));
+        const metadata = (0, node_fs_1.fstatSync)(descriptor);
+        if (!metadata.isFile()) {
+            throw new Error('source is not a regular file');
+        }
+        if (process.platform !== 'win32' && (metadata.mode & 0o077) !== 0) {
+            throw new Error(`source permissions are ${modeString(metadata.mode)}; expected no group or other access (0600 or stricter)`);
+        }
+        return (0, node_fs_1.readFileSync)(descriptor, 'utf8');
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new Error(`Secret "${name}" could not be read from ${path}: ${reason}`);
+    }
+    finally {
+        if (descriptor !== undefined) {
+            (0, node_fs_1.closeSync)(descriptor);
+        }
+    }
+}
+function modeString(mode) {
+    return (mode & 0o777).toString(8).padStart(4, '0');
+}
+class SecretSnapshot {
+    #values;
+    constructor(values) {
+        this.#values = new Map(values);
+        Object.freeze(this);
+    }
+    get size() {
+        return this.#values.size;
+    }
+    get(key) {
+        return this.#values.get(key);
+    }
+    has(key) {
+        return this.#values.has(key);
+    }
+    entries() {
+        return this.#values.entries();
+    }
+    keys() {
+        return this.#values.keys();
+    }
+    values() {
+        return this.#values.values();
+    }
+    forEach(callbackfn, thisArg) {
+        this.#values.forEach((value, key) => {
+            callbackfn.call(thisArg, value, key, this);
+        });
+    }
+    [Symbol.iterator]() {
+        return this.entries();
+    }
+    get [Symbol.toStringTag]() {
+        return 'SecretSnapshot';
+    }
+}
+//# sourceMappingURL=resolver.js.map

package/dist/runtime/secrets/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../../src/runtime/secrets/resolver.ts"],"names":[],"mappings":";;;AAiHA,8CAUC;AAQD,oFAeC;AAWD,kEAkCC;AA/LD,qCAMiB;AACjB,yCAAgD;AAEhD,6CAQ0B;AAgB1B,MAAM,QAAQ,GAAG,0BAA0B,CAAC;AAE5C,MAAa,cAAc;IACR,GAAG,CAAoB;IACvB,GAAG,CAAS;IACZ,MAAM,CAAoC;IAE3D,YAAY,OAA8B,EAAE;QAC1C,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC;IAC5C,CAAC;IAOD,KAAK,CAAC,OAAO,CAAC,MAAkB;QAC9B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACjE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YACvD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,+BAA+B,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,wBAAwB,CAAC,CAAC;YAC3D,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5B,CAAC;QAED,uBAAuB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC1C,wBAAwB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,OAAO,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,IAAY,EACZ,WAAyB;QAEzB,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,qBAAY,CAAC,GAAG,CAAC,CAAC,CAAC;gBACtB,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,IAAI,IAAI,CAAC;gBACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5B,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,6BAA6B,OAAO,2CAA2C,CAC/F,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,mCAAmC,OAAO,6BAA6B,CACvF,CAAC;gBACJ,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,KAAK,qBAAY,CAAC,IAAI,CAAC,CAAC,CAAC;gBACvB,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBAGnC,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,uCAAuC,CACvD,CAAC;gBACJ,CAAC;gBACD,MAAM,IAAI,GAAG,IAAA,sBAAU,EAAC,WAAW,CAAC,IAAI,CAAC;oBACvC,CAAC,CAAC,WAAW,CAAC,IAAI;oBAClB,CAAC,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;gBACxC,OAAO,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACpC,CAAC;YACD,KAAK,qBAAY,CAAC,MAAM;gBACtB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;CACF;AAvED,wCAuEC;AAOD,SAAgB,iBAAiB,CAC/B,QAAyB;IAEzB,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;QACrC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAQD,SAAgB,oCAAoC,CAClD,MAAkB,EAClB,SAAoB;IAEpB,IAAI,SAAS,KAAK,kBAAS,CAAC,IAAI,EAAE,CAAC;QACjC,OAAO;IACT,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/D,MAAM,oBAAoB,GACxB,MAAM,CAAC,KAAK,CAAC,uBAAc,CAAC,QAAQ,CAAC,EAAE,IAAI,KAAK,kBAAS,CAAC,QAAQ,CAAC;IACrE,IAAI,eAAe,IAAI,oBAAoB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,+JAA+J,CAChK,CAAC;IACJ,CAAC;AACH,CAAC;AAWD,SAAgB,2BAA2B,CACzC,MAAkB,EAClB,QAAyB;IAEzB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,uBAAc,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,QAAQ,EAAE,IAAI,KAAK,kBAAS,CAAC,QAAQ,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAExD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,6BAA6B,QAAQ,CAAC,SAAS,kBAAkB,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,uBAAuB,CAC9B,MAAkB,EAClB,QAAyB;IAEzB,KAAK,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC;QAC5C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,IAAI,SAAS,KAAK,uBAAc,CAAC,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CACb,SAAS,SAAS,0FAA0F,CAC7G,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,SAAS,SAAS,0DAA0D,SAAS,IAAI,CAC1F,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAC/B,MAAkB,EAClB,QAAyB;IAEzB,2BAA2B,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA4B;IACpD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAMD,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,wFAAwF,CACxG,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC;IACjC,OAAO,IAAI,OAAO,CAAS,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE;QAC3D,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC;QAC3B,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACxB,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5B,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACzB,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,SAAqB,EAAQ,EAAE;YAC7C,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;YACV,SAAS,EAAE,CAAC;QACd,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,GAAS,EAAE;YACvB,MAAM,CAAC,GAAG,EAAE,CACV,aAAa,CACX,IAAI,KAAK,CACP,sBAAsB,IAAI,kCAAkC,CAC7D,CACF,CACF,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,MAAM,CAAC,GAAG,EAAE,CACV,aAAa,CAAC,IAAI,KAAK,CAAC,sBAAsB,IAAI,WAAW,CAAC,CAAC,CAChE,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAQ,EAAE;YACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBACf,MAAM,CAAC,GAAG,EAAE,CACV,aAAa,CACX,IAAI,KAAK,CAAC,sBAAsB,IAAI,kBAAkB,CAAC,CACxD,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;oBAC/B,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBACpE,OAAO;gBACT,CAAC;gBACD,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;oBAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACrC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;oBACjB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACvB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;oBACtD,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClC,CAAC;QACH,CAAC,CAAC;QAEF,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvB,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,IAAY;IAChD,IAAI,UAA8B,CAAC;IACnC,IAAI,CAAC;QACH,UAAU,GAAG,IAAA,kBAAQ,EACnB,IAAI,EACJ,mBAAS,CAAC,QAAQ,GAAG,CAAC,mBAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CACjD,CAAC;QACF,MAAM,QAAQ,GAAG,IAAA,mBAAS,EAAC,UAAU,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CACb,0BAA0B,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,wDAAwD,CAC5G,CAAC;QACJ,CAAC;QACD,OAAO,IAAA,sBAAY,EAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,4BAA4B,IAAI,KAAK,MAAM,EAAE,CAC7D,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAA,mBAAS,EAAC,UAAU,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,cAAc;IACT,OAAO,CAA8B;IAE9C,YAAY,MAAmC;QAC7C,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;IAC/B,CAAC;IAED,OAAO,CACL,UAIS,EACT,OAAiB;QAEjB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAClC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,CAAC,MAAM,CAAC,QAAQ,CAAC;QACf,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACtB,OAAO,gBAAgB,CAAC;IAC1B,CAAC;CACF"}

package/dist/runtime/secrets/url-security.d.ts

@@ -0,0 +1,3 @@
+export declare function isSensitiveCredentialKey(key: string): boolean;
+export declare function urlContainsCredentialMaterial(url: URL): boolean;
+//# sourceMappingURL=url-security.d.ts.map

package/dist/runtime/secrets/url-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-security.d.ts","sourceRoot":"","sources":["../../../src/runtime/secrets/url-security.ts"],"names":[],"mappings":"AAGA,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAK/D"}

package/dist/runtime/secrets/url-security.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSensitiveCredentialKey = isSensitiveCredentialKey;
+exports.urlContainsCredentialMaterial = urlContainsCredentialMaterial;
+const CREDENTIAL_KEY = /(password|token|authorization|credential|private[-_]?key|secret[-_]?value)|^value$/i;
+function isSensitiveCredentialKey(key) {
+    return CREDENTIAL_KEY.test(key);
+}
+function urlContainsCredentialMaterial(url) {
+    return (url.password.length > 0 ||
+        [...url.searchParams.keys()].some(isSensitiveCredentialKey));
+}
+//# sourceMappingURL=url-security.js.map

package/dist/runtime/secrets/url-security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-security.js","sourceRoot":"","sources":["../../../src/runtime/secrets/url-security.ts"],"names":[],"mappings":";;AAGA,4DAEC;AAED,sEAKC;AAZD,MAAM,cAAc,GAClB,qFAAqF,CAAC;AAExF,SAAgB,wBAAwB,CAAC,GAAW;IAClD,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,SAAgB,6BAA6B,CAAC,GAAQ;IACpD,OAAO,CACL,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAC5D,CAAC;AACJ,CAAC"}

package/dist/runtime/sources/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/runtime/sources/credentials.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,gBAAgB,QAA8C,CAAC;AAQ5E,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,MAAyB,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CA2BhG;AAMD,qBAAa,kBAAkB;IAI3B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAHtB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA8B;gBAGrC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACrD,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC;IAUzC,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO;IAa9C,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAejF,OAAO,CAAC,MAAM;CAOf"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/runtime/sources/credentials.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,gBAAgB,QAA8C,CAAC;AAQ5E,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,MAAyB,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CA2BhG;AAMD,qBAAa,kBAAkB;IAI3B,OAAO,CAAC,QAAQ,CAAC,GAAG;IAHtB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA8B;gBAGrC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACrD,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC;IAUzC,GAAG,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO;IAa9C,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAejF,OAAO,CAAC,MAAM;CAWf"}

package/dist/runtime/sources/credentials.js

@@ -61,7 +61,8 @@ class CredentialResolver {
         if (fromEnv !== undefined && fromEnv.length > 0) {
             return fromEnv;
         }
-        return this.fileCreds.get(name);
+        const fromFile = this.fileCreds.get(name);
+        return fromFile !== undefined && fromFile.length > 0 ? fromFile : undefined;
     }
 }
 exports.CredentialResolver = CredentialResolver;

package/dist/runtime/sources/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/runtime/sources/credentials.ts"],"names":[],"mappings":";;;AA0BA,kDA2BC;AArDD,qCAAmD;AACnD,qCAAkC;AAClC,yCAAiC;AAgBpB,QAAA,gBAAgB,GAAG,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;AAQ5E,SAAgB,mBAAmB,CAAC,OAAe,wBAAgB;IACjE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,KAAK,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAMD,MAAa,kBAAkB;IAIV;IAHF,SAAS,CAA8B;IAExD,YACmB,MAAyB,OAAO,CAAC,GAAG,EACrD,SAAuC;QADtB,QAAG,GAAH,GAAG,CAAiC;QAGrD,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,mBAAmB,EAAE,CAAC;IACtD,CAAC;IAOD,GAAG,CAAC,YAAgC;QAClC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,SAAS,CAAC;IACjD,CAAC;IAQD,OAAO,CAAC,YAAgC,EAAE,UAAkB;QAC1D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,WAAW,UAAU,4BAA4B,YAAY,mBAAmB;gBAC9E,qBAAqB,YAAY,eAAe,wBAAgB,GAAG,CACtE,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAGO,MAAM,CAAC,IAAY;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;CACF;AAlDD,gDAkDC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/runtime/sources/credentials.ts"],"names":[],"mappings":";;;AA0BA,kDA2BC;AArDD,qCAAmD;AACnD,qCAAkC;AAClC,yCAAiC;AAgBpB,QAAA,gBAAgB,GAAG,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;AAQ5E,SAAgB,mBAAmB,CAAC,OAAe,wBAAgB;IACjE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,KAAK,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAMD,MAAa,kBAAkB;IAIV;IAHF,SAAS,CAA8B;IAExD,YACmB,MAAyB,OAAO,CAAC,GAAG,EACrD,SAAuC;QADtB,QAAG,GAAH,GAAG,CAAiC;QAGrD,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,mBAAmB,EAAE,CAAC;IACtD,CAAC;IAOD,GAAG,CAAC,YAAgC;QAClC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,SAAS,CAAC;IACjD,CAAC;IAQD,OAAO,CAAC,YAAgC,EAAE,UAAkB;QAC1D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,WAAW,UAAU,4BAA4B,YAAY,mBAAmB;gBAC9E,qBAAqB,YAAY,eAAe,wBAAgB,GAAG,CACtE,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAGO,MAAM,CAAC,IAAY;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO,OAAO,CAAC;QACjB,CAAC;QAID,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1C,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,CAAC;CACF;AAtDD,gDAsDC"}

package/dist/runtime/sources/kinds/git.d.ts

@@ -1,9 +1,12 @@
 import { type LockIndex } from '../../roster';
 import type { CredentialResolver } from '../credentials';
+import type { LaunchResolveContext } from '../resolve-context';
 import type { GitSource } from '../schema';
-import type { SourceResolveContext } from '../types';
 type LogFn = (line: string) => void;
-export declare function resolveGitSource(spec: GitSource, ctx: SourceResolveContext): LockIndex | null;
-export declare function checkoutGitSource(spec: GitSource, credentials: CredentialResolver, log?: LogFn): string;
+export interface CheckoutOptions {
+    readonly offline?: boolean;
+}
+export declare function resolveGitSource(spec: GitSource, ctx: LaunchResolveContext): LockIndex | null;
+export declare function checkoutGitSource(spec: GitSource, credentials: CredentialResolver, log?: LogFn, opts?: CheckoutOptions): string;
 export {};
 //# sourceMappingURL=git.d.ts.map

package/dist/runtime/sources/kinds/git.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../../../src/runtime/sources/kinds/git.ts"],"names":[],"mappings":"AAKA,OAAO,EAA6B,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAGrD,KAAK,KAAK,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AAmBpC,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,oBAAoB,GAAG,SAAS,GAAG,IAAI,CAgB7F;AAOD,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,SAAS,EACf,WAAW,EAAE,kBAAkB,EAC/B,GAAG,CAAC,EAAE,KAAK,GACV,MAAM,CAMR"}
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../../../src/runtime/sources/kinds/git.ts"],"names":[],"mappings":"AAKA,OAAO,EAA6B,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAG3C,KAAK,KAAK,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;AAmBpC,MAAM,WAAW,eAAe;IAE9B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAoBD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,oBAAoB,GAAG,SAAS,GAAG,IAAI,CAwD7F;AA4BD,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,SAAS,EACf,WAAW,EAAE,kBAAkB,EAC/B,GAAG,CAAC,EAAE,KAAK,EACX,IAAI,GAAE,eAAoB,GACzB,MAAM,CAKR"}

package/dist/runtime/sources/kinds/git.js

@@ -11,54 +11,131 @@ const manifest_walk_1 = require("../manifest-walk");
 const GIT_CACHE_DIR = (0, node_path_1.join)((0, node_os_1.homedir)(), '.xema', 'cache', 'git');
 const REF_MARKER = '.xema-source-ref';
 const CLONE_TIMEOUT_MS = 120_000;
+const FULL_SHA_REF = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i;
 function resolveGitSource(spec, ctx) {
     if (ctx.usesImages) {
         ctx.log?.(`source "${spec.name}" (git): inert on an image substrate ` +
             `(a clone is source, not an image; use native substrate for git biomes).`);
         return null;
     }
-    const dir = checkoutGitSource(spec, ctx.credentials, ctx.log);
-    const { biomes } = (0, manifest_walk_1.walkBiomeManifests)(dir);
-    const serverBiomes = biomes.filter((b) => b.target === 'server' && b.services.length > 0);
-    ctx.log?.(`source "${spec.name}" (git): ${String(serverBiomes.length)} biome(s) from ${spec.url}@${spec.ref ?? 'HEAD'}`);
+    const ref = spec.ref ?? 'HEAD';
+    const dir = gitCacheDir(spec);
+    const cached = hasCachedCheckout(dir);
+    const shadowed = ctx.workspaceProvidedBiomes;
+    if (!cached && ctx.offline) {
+        const line = `source "${spec.name}" (git): would clone ${spec.url}@${ref} ` +
+            `(offline preview — not fetched).`;
+        ctx.note?.(line);
+        ctx.log?.(line);
+        return null;
+    }
+    if (cached && isFullyShadowed(discoverServerBiomes(dir), shadowed)) {
+        ctx.log?.(`source "${spec.name}" (git): all biomes already provided by workspace — skipped (C1).`);
+        return null;
+    }
+    checkoutGitSource(spec, ctx.credentials, ctx.log, { offline: ctx.offline });
+    let serverBiomes = discoverServerBiomes(dir);
+    if (shadowed !== undefined && shadowed.size > 0) {
+        const before = serverBiomes.length;
+        serverBiomes = serverBiomes.filter((b) => !shadowed.has(b.id));
+        const dropped = before - serverBiomes.length;
+        if (dropped > 0) {
+            ctx.log?.(`source "${spec.name}" (git): ${String(dropped)} biome(s) already provided by workspace ` +
+                `— not overriding a local biome (C1).`);
+        }
+    }
+    ctx.log?.(`source "${spec.name}" (git): ${String(serverBiomes.length)} biome(s) from ${spec.url}@${ref}`);
     return (0, roster_1.indexFromDiscoveredBiomes)(serverBiomes, { sourceName: spec.name, sourceRoot: dir });
 }
-function checkoutGitSource(spec, credentials, log) {
-    const token = credentials.resolve(spec.authTokenEnv, spec.name);
+function discoverServerBiomes(dir) {
+    return (0, manifest_walk_1.walkBiomeManifests)(dir).biomes.filter((b) => b.target === 'server' && b.services.length > 0);
+}
+function isFullyShadowed(biomes, shadowed) {
+    if (shadowed === undefined || shadowed.size === 0) {
+        return false;
+    }
+    return biomes.length > 0 && biomes.every((b) => shadowed.has(b.id));
+}
+function checkoutGitSource(spec, credentials, log, opts = {}) {
     const ref = spec.ref ?? 'HEAD';
-    const dir = (0, node_path_1.join)(GIT_CACHE_DIR, spec.name);
-    ensureClone(spec, dir, ref, token, log);
+    const dir = gitCacheDir(spec);
+    ensureClone(spec, dir, ref, credentials, log, opts.offline ?? false);
     return dir;
 }
-function ensureClone(spec, dir, ref, token, log) {
-    if ((0, node_fs_1.existsSync)((0, node_path_1.join)(dir, REF_MARKER))) {
+function gitCacheDir(spec) {
+    return (0, node_path_1.join)(GIT_CACHE_DIR, spec.name);
+}
+function hasCachedCheckout(dir) {
+    return (0, node_fs_1.existsSync)((0, node_path_1.join)(dir, REF_MARKER));
+}
+function ensureClone(spec, dir, ref, credentials, log, offline) {
+    const isSha = FULL_SHA_REF.test(ref);
+    if (hasCachedCheckout(dir)) {
         const cached = (0, node_fs_1.readFileSync)((0, node_path_1.join)(dir, REF_MARKER), 'utf8').trim();
         if (cached === ref) {
-            log?.(`source "${spec.name}" (git): reusing cached clone (${ref}).`);
+            if (isSha) {
+                log?.(`source "${spec.name}" (git): reusing pinned commit ${ref}.`);
+                return;
+            }
+            if (offline) {
+                log?.(`source "${spec.name}" (git): offline — reusing cached clone (${ref}); may be stale.`);
+                return;
+            }
+            const token = credentials.resolve(spec.authTokenEnv, spec.name);
+            refreshFloatingRef(spec, dir, ref, token, log);
             return;
         }
     }
+    if (offline) {
+        throw new Error(`source "${spec.name}" (git): offline and no cached clone for ${spec.url}@${ref}. ` +
+            `Run \`xema up\`/\`dev\` online once to populate ~/.xema/cache/git.`);
+    }
     if ((0, node_fs_1.existsSync)(dir)) {
         (0, node_fs_1.rmSync)(dir, { recursive: true, force: true });
     }
     (0, node_fs_1.mkdirSync)(GIT_CACHE_DIR, { recursive: true });
-    const args = ['clone', '--depth', '1'];
-    if (spec.ref !== undefined) {
-        args.push('--branch', spec.ref);
-    }
-    args.push('--', spec.url, dir);
+    const token = credentials.resolve(spec.authTokenEnv, spec.name);
+    cloneAtRef(spec, dir, ref, isSha, token, log);
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, REF_MARKER), ref, 'utf8');
+}
+function cloneAtRef(spec, dir, ref, isSha, token, log) {
     try {
-        (0, node_child_process_1.execFileSync)('git', args, {
-            stdio: 'pipe',
-            timeout: CLONE_TIMEOUT_MS,
-            env: gitEnvWithAuth(token),
-        });
+        if (isSha) {
+            runGit(['clone', '--depth', '1', '--', spec.url, dir], token);
+            runGit(['-C', dir, 'fetch', '--depth', '1', 'origin', '--', ref], token);
+            runGit(['-C', dir, 'checkout', '--detach', ref], token);
+            log?.(`source "${spec.name}" (git): checked out commit ${ref}.`);
+            return;
+        }
+        const args = ['clone', '--depth', '1'];
+        if (spec.ref !== undefined) {
+            args.push('--branch', spec.ref);
+        }
+        args.push('--', spec.url, dir);
+        runGit(args, token);
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
         throw new Error(`source "${spec.name}" (git): clone of ${spec.url}@${ref} failed: ${message}`);
     }
-    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, REF_MARKER), ref, 'utf8');
+}
+function refreshFloatingRef(spec, dir, ref, token, log) {
+    try {
+        runGit(['-C', dir, 'fetch', '--depth', '1', 'origin', '--', ref], token);
+        runGit(['-C', dir, 'reset', '--hard', 'FETCH_HEAD'], token);
+        log?.(`source "${spec.name}" (git): refreshed floating ref ${ref} to remote.`);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`source "${spec.name}" (git): refresh of ${spec.url}@${ref} failed: ${message}`);
+    }
+}
+function runGit(args, token) {
+    (0, node_child_process_1.execFileSync)('git', [...args], {
+        stdio: 'pipe',
+        timeout: CLONE_TIMEOUT_MS,
+        env: gitEnvWithAuth(token),
+    });
 }
 function gitEnvWithAuth(token) {
     const base = { ...process.env, GIT_TERMINAL_PROMPT: '0' };

package/dist/runtime/sources/kinds/git.js.map

@@ -1 +1 @@
-{"version":3,"file":"git.js","sourceRoot":"","sources":["../../../../src/runtime/sources/kinds/git.ts"],"names":[],"mappings":";;AAgCA,4CAgBC;AAOD,8CAUC;AAjED,2DAAkD;AAClD,qCAAqF;AACrF,qCAAkC;AAClC,yCAAiC;AAEjC,yCAAyE;AACzE,oDAAsD;AAUtD,MAAM,aAAa,GAAG,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAE/D,MAAM,UAAU,GAAG,kBAAkB,CAAC;AACtC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAajC,SAAgB,gBAAgB,CAAC,IAAe,EAAE,GAAyB;IACzE,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CACP,WAAW,IAAI,CAAC,IAAI,uCAAuC;YACzD,yEAAyE,CAC5E,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAE9D,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,kCAAkB,EAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1F,GAAG,CAAC,GAAG,EAAE,CACP,WAAW,IAAI,CAAC,IAAI,YAAY,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,kBAAkB,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,MAAM,EAAE,CAC9G,CAAC;IACF,OAAO,IAAA,kCAAyB,EAAC,YAAY,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;AAC7F,CAAC;AAOD,SAAgB,iBAAiB,CAC/B,IAAe,EACf,WAA+B,EAC/B,GAAW;IAEX,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAA,gBAAI,EAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACxC,OAAO,GAAG,CAAC;AACb,CAAC;AAGD,SAAS,WAAW,CAClB,IAAe,EACf,GAAW,EACX,GAAW,EACX,KAAyB,EACzB,GAAW;IAEX,IAAI,IAAA,oBAAU,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAClE,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,GAAG,EAAE,CAAC,WAAW,IAAI,CAAC,IAAI,kCAAkC,GAAG,IAAI,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;IACH,CAAC;IACD,IAAI,IAAA,oBAAU,EAAC,GAAG,CAAC,EAAE,CAAC;QACpB,IAAA,gBAAM,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,IAAA,mBAAS,EAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAG9C,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACvC,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAE/B,IAAI,CAAC;QACH,IAAA,iCAAY,EAAC,KAAK,EAAE,IAAI,EAAE;YACxB,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,gBAAgB;YACzB,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,IAAI,qBAAqB,IAAI,CAAC,GAAG,IAAI,GAAG,YAAY,OAAO,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,UAAU,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC;AAQD,SAAS,cAAc,CAAC,KAAyB;IAC/C,MAAM,IAAI,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC;IAC7E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,GAAG,IAAI;QACP,gBAAgB,EAAE,GAAG;QACrB,gBAAgB,EAAE,kBAAkB;QACpC,kBAAkB,EAAE,yBAAyB,KAAK,EAAE;KACrD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../../../../src/runtime/sources/kinds/git.ts"],"names":[],"mappings":";;AAuDA,4CAwDC;AA4BD,8CAUC;AArJD,2DAAkD;AAClD,qCAAqF;AACrF,qCAAkC;AAClC,yCAAiC;AAEjC,yCAAyE;AACzE,oDAA4E;AAU5E,MAAM,aAAa,GAAG,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAE/D,MAAM,UAAU,GAAG,kBAAkB,CAAC;AACtC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAUjC,MAAM,YAAY,GAAG,kCAAkC,CAAC;AA0BxD,SAAgB,gBAAgB,CAAC,IAAe,EAAE,GAAyB;IACzE,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CACP,WAAW,IAAI,CAAC,IAAI,uCAAuC;YACzD,yEAAyE,CAC5E,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC;IAC/B,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,GAAG,CAAC,uBAAuB,CAAC;IAI7C,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,GACR,WAAW,IAAI,CAAC,IAAI,wBAAwB,IAAI,CAAC,GAAG,IAAI,GAAG,GAAG;YAC9D,kCAAkC,CAAC;QACrC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;QACjB,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAQD,IAAI,MAAM,IAAI,eAAe,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,GAAG,EAAE,CACP,WAAW,IAAI,CAAC,IAAI,mEAAmE,CACxF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAE5E,IAAI,YAAY,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;QACnC,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;QAC7C,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,GAAG,CAAC,GAAG,EAAE,CACP,WAAW,IAAI,CAAC,IAAI,YAAY,MAAM,CAAC,OAAO,CAAC,0CAA0C;gBACvF,sCAAsC,CACzC,CAAC;QACJ,CAAC;IACH,CAAC;IACD,GAAG,CAAC,GAAG,EAAE,CACP,WAAW,IAAI,CAAC,IAAI,YAAY,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,kBAAkB,IAAI,CAAC,GAAG,IAAI,GAAG,EAAE,CAC/F,CAAC;IACF,OAAO,IAAA,kCAAyB,EAAC,YAAY,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;AAC7F,CAAC;AAGD,SAAS,oBAAoB,CAAC,GAAW;IACvC,OAAO,IAAA,kCAAkB,EAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAC1C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CACtD,CAAC;AACJ,CAAC;AAGD,SAAS,eAAe,CACtB,MAAkC,EAClC,QAAyC;IAEzC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC;AAUD,SAAgB,iBAAiB,CAC/B,IAAe,EACf,WAA+B,EAC/B,GAAW,EACX,OAAwB,EAAE;IAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC;IAC/B,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9B,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC;IACrE,OAAO,GAAG,CAAC;AACb,CAAC;AAGD,SAAS,WAAW,CAAC,IAAe;IAClC,OAAO,IAAA,gBAAI,EAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAGD,SAAS,iBAAiB,CAAC,GAAW;IACpC,OAAO,IAAA,oBAAU,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;AAC3C,CAAC;AASD,SAAS,WAAW,CAClB,IAAe,EACf,GAAW,EACX,GAAW,EACX,WAA+B,EAC/B,GAAsB,EACtB,OAAgB;IAEhB,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAClE,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,IAAI,KAAK,EAAE,CAAC;gBACV,GAAG,EAAE,CAAC,WAAW,IAAI,CAAC,IAAI,kCAAkC,GAAG,GAAG,CAAC,CAAC;gBACpE,OAAO;YACT,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACZ,GAAG,EAAE,CACH,WAAW,IAAI,CAAC,IAAI,4CAA4C,GAAG,kBAAkB,CACtF,CAAC;gBACF,OAAO;YACT,CAAC;YAGD,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAChE,kBAAkB,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;IACH,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,CAAC,IAAI,4CAA4C,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI;YACjF,oEAAoE,CACvE,CAAC;IACJ,CAAC;IACD,IAAI,IAAA,oBAAU,EAAC,GAAG,CAAC,EAAE,CAAC;QACpB,IAAA,gBAAM,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,IAAA,mBAAS,EAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAG9C,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9C,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,UAAU,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC;AASD,SAAS,UAAU,CACjB,IAAe,EACf,GAAW,EACX,GAAW,EACX,KAAc,EACd,KAAyB,EACzB,GAAW;IAEX,IAAI,CAAC;QACH,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;YAC9D,MAAM,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;YACzE,MAAM,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;YACxD,GAAG,EAAE,CAAC,WAAW,IAAI,CAAC,IAAI,+BAA+B,GAAG,GAAG,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,IAAI,qBAAqB,IAAI,CAAC,GAAG,IAAI,GAAG,YAAY,OAAO,EAAE,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAOD,SAAS,kBAAkB,CACzB,IAAe,EACf,GAAW,EACX,GAAW,EACX,KAAyB,EACzB,GAAW;IAEX,IAAI,CAAC;QACH,MAAM,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QACzE,MAAM,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5D,GAAG,EAAE,CAAC,WAAW,IAAI,CAAC,IAAI,mCAAmC,GAAG,aAAa,CAAC,CAAC;IACjF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,CAAC,IAAI,uBAAuB,IAAI,CAAC,GAAG,IAAI,GAAG,YAAY,OAAO,EAAE,CAChF,CAAC;IACJ,CAAC;AACH,CAAC;AAGD,SAAS,MAAM,CAAC,IAAuB,EAAE,KAAyB;IAChE,IAAA,iCAAY,EAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;QAC7B,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,gBAAgB;QACzB,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC;KAC3B,CAAC,CAAC;AACL,CAAC;AAQD,SAAS,cAAc,CAAC,KAAyB;IAC/C,MAAM,IAAI,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC;IAC7E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,GAAG,IAAI;QACP,gBAAgB,EAAE,GAAG;QACrB,gBAAgB,EAAE,kBAAkB;QACpC,kBAAkB,EAAE,yBAAyB,KAAK,EAAE;KACrD,CAAC;AACJ,CAAC"}

package/dist/runtime/sources/resolve-context.d.ts

@@ -0,0 +1,7 @@
+import type { SourceResolveContext } from './types';
+export interface LaunchResolveContext extends SourceResolveContext {
+    readonly offline: boolean;
+    readonly note?: (line: string) => void;
+    readonly workspaceProvidedBiomes?: ReadonlySet<string>;
+}
+//# sourceMappingURL=resolve-context.d.ts.map

package/dist/runtime/sources/resolve-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-context.d.ts","sourceRoot":"","sources":["../../../src/runtime/sources/resolve-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AASpD,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IAOhE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAM1B,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAOvC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACxD"}

package/dist/runtime/sources/resolve-context.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=resolve-context.js.map

package/dist/runtime/sources/resolve-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-context.js","sourceRoot":"","sources":["../../../src/runtime/sources/resolve-context.ts"],"names":[],"mappings":""}

package/dist/runtime/sources/resolver.d.ts

@@ -1,8 +1,8 @@
 import { type LockIndex } from '../roster';
 import { CredentialResolver } from './credentials';
 import { SourceKind, type SourceSpec } from './schema';
-import type { SourceResolveContext } from './types';
-export declare function composeSourceIndex(base: LockIndex, sources: readonly SourceSpec[], ctx: SourceResolveContext): LockIndex;
+import type { LaunchResolveContext } from './resolve-context';
+export declare function composeSourceIndex(base: LockIndex, sources: readonly SourceSpec[], ctx: LaunchResolveContext): LockIndex;
 export interface SourceStatus {
     readonly name: string;
     readonly kind: SourceKind;

package/dist/runtime/sources/resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../src/runtime/sources/resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAInD,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAEvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAepD,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,GAAG,EAAE,oBAAoB,GACxB,SAAS,CAqBX;AAsBD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAE/B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAGD,wBAAgB,eAAe,CAC7B,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,WAAW,GAAE,kBAA6C,GACzD,YAAY,EAAE,CAahB"}
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../src/runtime/sources/resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAInD,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAEvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAqB9D,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,GAAG,EAAE,oBAAoB,GACxB,SAAS,CAoCX;AAsBD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAE/B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAGD,wBAAgB,eAAe,CAC7B,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,WAAW,GAAE,kBAA6C,GACzD,YAAY,EAAE,CAahB"}

package/dist/runtime/sources/resolver.js

@@ -14,19 +14,25 @@ function composeSourceIndex(base, sources, ctx) {
     for (const spec of sources) {
         (spec.kind === schema_1.SourceKind.Workspace ? workspace : other).push(spec);
     }
-    let index = base;
-    for (const spec of [...other].reverse()) {
+    let workspaceIndex = null;
+    for (const spec of [...workspace].reverse()) {
         const contrib = resolveOne(spec, ctx);
         if (contrib !== null) {
-            index = (0, roster_1.mergeIndices)(index, contrib);
+            workspaceIndex = workspaceIndex === null ? contrib : (0, roster_1.mergeIndices)(workspaceIndex, contrib);
         }
     }
-    for (const spec of [...workspace].reverse()) {
-        const contrib = resolveOne(spec, ctx);
+    const workspaceProvidedBiomes = workspaceIndex !== null ? new Set(workspaceIndex.servicesByBiome.keys()) : ctx.workspaceProvidedBiomes;
+    const otherCtx = workspaceProvidedBiomes !== undefined ? { ...ctx, workspaceProvidedBiomes } : ctx;
+    let index = base;
+    for (const spec of [...other].reverse()) {
+        const contrib = resolveOne(spec, otherCtx);
         if (contrib !== null) {
             index = (0, roster_1.mergeIndices)(index, contrib);
         }
     }
+    if (workspaceIndex !== null) {
+        index = (0, roster_1.mergeIndices)(index, workspaceIndex);
+    }
     return index;
 }
 function resolveOne(spec, ctx) {