@xemahq/xema 0.13.0 → 0.15.0

package/dist/runtime/runner/native-runner.js

@@ -18,22 +18,57 @@ class NativeRunner {
         this.monorepoRoot = root;
     }
     async start(input) {
-        const { entry, env, port, readinessTimeoutMs } = input;
+        const { entry, env, port, readinessTimeoutMs, onSpawned, onStoppedBeforeReady, } = input;
         if (!entry.servicePath) {
             throw new Error(`${entry.name}: no servicePath (platform-substrate service) — not bootable natively. ` +
                 `Use the container substrate for this service.`);
         }
+        const watch = (0, forked_worker_1.resolveLaunchMode)() === forked_worker_1.LaunchMode.Watch;
         const baseRoot = entry.sourceRoot ?? this.monorepoRoot;
-        const serviceRoot = this.resolveServiceRoot(entry.servicePath, baseRoot);
+        const serviceRoot = this.resolveServiceRoot(entry.servicePath, baseRoot, watch);
         if (!serviceRoot) {
-            const primary = (0, node_path_1.join)(baseRoot, entry.servicePath, 'dist', 'main.js');
-            throw new Error(`${entry.name} dist not found at ${primary}. Run \`pnpm --filter ${entry.name} build\` first.`);
+            const marker = watch ? (0, node_path_1.join)('src', 'main.ts') : (0, node_path_1.join)('dist', 'main.js');
+            const primary = (0, node_path_1.join)(baseRoot, entry.servicePath, marker);
+            throw new Error(watch
+                ? `${entry.name} source entry not found at ${primary}. --watch runs each ` +
+                    `service from source; a source checkout of ${entry.name} is required.`
+                : `${entry.name} dist not found at ${primary}. Run \`pnpm --filter ${entry.name} build\` first.`);
         }
-        applyEnv(env);
-        return this.forkService(entry, serviceRoot, port, readinessTimeoutMs);
+        return this.forkService(entry, serviceRoot, port, readinessTimeoutMs, watch, env, onSpawned, onStoppedBeforeReady);
     }
-    async forkService(entry, serviceRoot, port, readinessTimeoutMs) {
-        const child = await (0, forked_worker_1.spawnForkedWorker)({ name: entry.name, port, siblingAppDir: serviceRoot, readinessTimeoutMs }, '/');
+    async forkService(entry, serviceRoot, port, readinessTimeoutMs, watch, env, onSpawned, onStoppedBeforeReady) {
+        const child = await (0, forked_worker_1.spawnForkedWorker)({
+            name: entry.name,
+            port,
+            siblingAppDir: serviceRoot,
+            readinessTimeoutMs,
+            watch,
+            env,
+            ...(onSpawned === undefined
+                ? {}
+                : {
+                    onSpawned: async (handle) => {
+                        await onSpawned({
+                            name: entry.name,
+                            url: handle.url,
+                            handle: `pid:${String(handle.pid)}`,
+                            close: () => handle.close(),
+                        });
+                    },
+                }),
+            ...(onStoppedBeforeReady === undefined
+                ? {}
+                : {
+                    onStoppedBeforeReady: async (handle) => {
+                        await onStoppedBeforeReady({
+                            name: entry.name,
+                            url: handle.url,
+                            handle: `pid:${String(handle.pid)}`,
+                            close: () => handle.close(),
+                        });
+                    },
+                }),
+        }, '/');
         return {
             name: entry.name,
             url: child.url,
@@ -41,13 +76,14 @@ class NativeRunner {
             close: () => child.close(),
         };
     }
-    resolveServiceRoot(servicePath, baseRoot) {
+    resolveServiceRoot(servicePath, baseRoot, watch) {
+        const marker = watch ? (0, node_path_1.join)('src', 'main.ts') : (0, node_path_1.join)('dist', 'main.js');
         const candidates = [
             (0, node_path_1.join)(baseRoot, servicePath),
             (0, node_path_1.join)(baseRoot, (0, node_path_1.dirname)(servicePath)),
         ];
         for (const candidate of candidates) {
-            if ((0, node_fs_1.existsSync)((0, node_path_1.join)(candidate, 'dist', 'main.js'))) {
+            if ((0, node_fs_1.existsSync)((0, node_path_1.join)(candidate, marker))) {
                 return candidate;
             }
         }
@@ -55,9 +91,4 @@ class NativeRunner {
     }
 }
 exports.NativeRunner = NativeRunner;
-function applyEnv(env) {
-    for (const [k, v] of Object.entries(env)) {
-        process.env[k] = v;
-    }
-}
 //# sourceMappingURL=native-runner.js.map

package/dist/runtime/runner/native-runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"native-runner.js","sourceRoot":"","sources":["../../../src/runtime/runner/native-runner.ts"],"names":[],"mappings":";;;AAAA,qCAAqC;AACrC,yCAA0C;AAE1C,2DAA4D;AAC5D,oCAA4C;AAC5C,qDAK0B;AAiB1B,MAAa,YAAY;IACd,IAAI,GAAG,kCAAiB,CAAC,MAAM,CAAC;IACxB,YAAY,CAAS;IAEtC,YAAY,OAA4B,EAAE;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,IAAA,wBAAgB,GAAE,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,yEAAyE;gBACvE,0DAA0D,CAC7D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAwB;QAClC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,KAAK,CAAC;QACvD,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,IAAI,yEAAyE;gBACpF,+CAA+C,CAClD,CAAC;QACJ,CAAC;QAGD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,YAAY,CAAC;QACvD,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACzE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,IAAA,gBAAI,EAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YACrE,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,IAAI,sBAAsB,OAAO,yBAAyB,KAAK,CAAC,IAAI,iBAAiB,CAC/F,CAAC;QACJ,CAAC;QAED,QAAQ,CAAC,GAAG,CAAC,CAAC;QAGd,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACxE,CAAC;IASO,KAAK,CAAC,WAAW,CACvB,KAAkB,EAClB,WAAmB,EACnB,IAAY,EACZ,kBAA0B;QAE1B,MAAM,KAAK,GAAG,MAAM,IAAA,iCAAiB,EACnC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,kBAAkB,EAAE,EAC1E,GAAG,CACJ,CAAC;QACF,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,MAAM,EAAE,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;YAClC,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE;SAC3B,CAAC;IACJ,CAAC;IAUO,kBAAkB,CAAC,WAAmB,EAAE,QAAgB;QAC9D,MAAM,UAAU,GAAG;YACjB,IAAA,gBAAI,EAAC,QAAQ,EAAE,WAAW,CAAC;YAC3B,IAAA,gBAAI,EAAC,QAAQ,EAAE,IAAA,mBAAO,EAAC,WAAW,CAAC,CAAC;SACrC,CAAC;QACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,IAAA,oBAAU,EAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;gBACnD,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AArFD,oCAqFC;AAED,SAAS,QAAQ,CAAC,GAAqC;IACrD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;AACH,CAAC"}
+{"version":3,"file":"native-runner.js","sourceRoot":"","sources":["../../../src/runtime/runner/native-runner.ts"],"names":[],"mappings":";;;AAAA,qCAAqC;AACrC,yCAA0C;AAE1C,2DAIiC;AACjC,oCAA4C;AAC5C,qDAK0B;AAiB1B,MAAa,YAAY;IACd,IAAI,GAAG,kCAAiB,CAAC,MAAM,CAAC;IACxB,YAAY,CAAS;IAEtC,YAAY,OAA4B,EAAE;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,IAAA,wBAAgB,GAAE,CAAC;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,yEAAyE;gBACvE,0DAA0D,CAC7D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAwB;QAClC,MAAM,EACJ,KAAK,EACL,GAAG,EACH,IAAI,EACJ,kBAAkB,EAClB,SAAS,EACT,oBAAoB,GACrB,GAAG,KAAK,CAAC;QACV,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,CAAC,IAAI,yEAAyE;gBACpF,+CAA+C,CAClD,CAAC;QACJ,CAAC;QAMD,MAAM,KAAK,GAAG,IAAA,iCAAiB,GAAE,KAAK,0BAAU,CAAC,KAAK,CAAC;QAIvD,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,YAAY,CAAC;QACvD,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CACzC,KAAK,CAAC,WAAW,EACjB,QAAQ,EACR,KAAK,CACN,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACxE,MAAM,OAAO,GAAG,IAAA,gBAAI,EAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAC1D,MAAM,IAAI,KAAK,CACb,KAAK;gBACH,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,8BAA8B,OAAO,sBAAsB;oBACxE,6CAA6C,KAAK,CAAC,IAAI,eAAe;gBACxE,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,sBAAsB,OAAO,yBAAyB,KAAK,CAAC,IAAI,iBAAiB,CACnG,CAAC;QACJ,CAAC;QAGD,OAAO,IAAI,CAAC,WAAW,CACrB,KAAK,EACL,WAAW,EACX,IAAI,EACJ,kBAAkB,EAClB,KAAK,EACL,GAAG,EACH,SAAS,EACT,oBAAoB,CACrB,CAAC;IACJ,CAAC;IASO,KAAK,CAAC,WAAW,CACvB,KAAkB,EAClB,WAAmB,EACnB,IAAY,EACZ,kBAA0B,EAC1B,KAAc,EACd,GAAqC,EACrC,SAAyC,EACzC,oBAA+D;QAE/D,MAAM,KAAK,GAAG,MAAM,IAAA,iCAAiB,EACnC;YACE,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI;YACJ,aAAa,EAAE,WAAW;YAC1B,kBAAkB;YAClB,KAAK;YACL,GAAG;YACH,GAAG,CAAC,SAAS,KAAK,SAAS;gBACzB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;wBAC1B,MAAM,SAAS,CAAC;4BACd,IAAI,EAAE,KAAK,CAAC,IAAI;4BAChB,GAAG,EAAE,MAAM,CAAC,GAAG;4BACf,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;4BACnC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;yBAC5B,CAAC,CAAC;oBACL,CAAC;iBACF,CAAC;YACN,GAAG,CAAC,oBAAoB,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;wBACrC,MAAM,oBAAoB,CAAC;4BACzB,IAAI,EAAE,KAAK,CAAC,IAAI;4BAChB,GAAG,EAAE,MAAM,CAAC,GAAG;4BACf,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;4BACnC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;yBAC5B,CAAC,CAAC;oBACL,CAAC;iBACF,CAAC;SACP,EACD,GAAG,CACJ,CAAC;QACF,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,MAAM,EAAE,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;YAClC,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE;SAC3B,CAAC;IACJ,CAAC;IAWO,kBAAkB,CACxB,WAAmB,EACnB,QAAgB,EAChB,KAAc;QAEd,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACxE,MAAM,UAAU,GAAG;YACjB,IAAA,gBAAI,EAAC,QAAQ,EAAE,WAAW,CAAC;YAC3B,IAAA,gBAAI,EAAC,QAAQ,EAAE,IAAA,mBAAO,EAAC,WAAW,CAAC,CAAC;SACrC,CAAC;QACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,IAAA,oBAAU,EAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;gBACxC,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AA3JD,oCA2JC"}

package/dist/runtime/runner/service-runner.d.ts

@@ -7,9 +7,14 @@ export interface RunningService {
 }
 export interface StartServiceInput {
     readonly entry: RosterEntry;
+    readonly installationId: string;
+    readonly planHash: string;
+    readonly executionId: string;
     readonly env: Readonly<Record<string, string>>;
     readonly port: number;
     readonly readinessTimeoutMs: number;
+    readonly onSpawned?: (service: RunningService) => Promise<void>;
+    readonly onStoppedBeforeReady?: (service: RunningService) => Promise<void>;
 }
 export declare enum ServiceRunnerKind {
     Native = "native",

package/dist/runtime/runner/service-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-runner.d.ts","sourceRoot":"","sources":["../../../src/runtime/runner/service-runner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAS7C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAE5B,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAE/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED,oBAAY,iBAAiB;IAC3B,MAAM,WAAW;IACjB,SAAS,cAAc;IACvB,IAAI,SAAS;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAOjC,KAAK,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC1D"}
+{"version":3,"file":"service-runner.d.ts","sourceRoot":"","sources":["../../../src/runtime/runner/service-runner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAS7C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAE5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAE/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IAEpC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAC9B,OAAO,EAAE,cAAc,KACpB,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB;AAED,oBAAY,iBAAiB;IAC3B,MAAM,WAAW;IACjB,SAAS,cAAc;IACvB,IAAI,SAAS;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAOjC,KAAK,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC1D"}

package/dist/runtime/runner/service-runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"service-runner.js","sourceRoot":"","sources":["../../../src/runtime/runner/service-runner.ts"],"names":[],"mappings":";;;AA6BA,IAAY,iBAIX;AAJD,WAAY,iBAAiB;IAC3B,sCAAiB,CAAA;IACjB,4CAAuB,CAAA;IACvB,kCAAa,CAAA;AACf,CAAC,EAJW,iBAAiB,iCAAjB,iBAAiB,QAI5B"}
+{"version":3,"file":"service-runner.js","sourceRoot":"","sources":["../../../src/runtime/runner/service-runner.ts"],"names":[],"mappings":";;;AAyCA,IAAY,iBAIX;AAJD,WAAY,iBAAiB;IAC3B,sCAAiB,CAAA;IACjB,4CAAuB,CAAA;IACvB,kCAAa,CAAA;AACf,CAAC,EAJW,iBAAiB,iCAAjB,iBAAiB,QAI5B"}

package/dist/runtime/runner/stream-outcome.d.ts

@@ -0,0 +1,7 @@
+import { XemaCliExitCode } from '../../lib/exit-codes';
+export interface StreamOutcome {
+    readonly code: number | null;
+    readonly signal: NodeJS.Signals | null;
+}
+export declare function exitCodeForStream(outcome: StreamOutcome): XemaCliExitCode;
+//# sourceMappingURL=stream-outcome.d.ts.map

package/dist/runtime/runner/stream-outcome.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-outcome.d.ts","sourceRoot":"","sources":["../../../src/runtime/runner/stream-outcome.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAGvD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;CACxC;AAYD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,aAAa,GAAG,eAAe,CAOzE"}

package/dist/runtime/runner/stream-outcome.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exitCodeForStream = exitCodeForStream;
+const exit_codes_1 = require("../../lib/exit-codes");
+function exitCodeForStream(outcome) {
+    if (outcome.signal !== null) {
+        return exit_codes_1.XemaCliExitCode.Ok;
+    }
+    return outcome.code === 0
+        ? exit_codes_1.XemaCliExitCode.Ok
+        : exit_codes_1.XemaCliExitCode.GenericError;
+}
+//# sourceMappingURL=stream-outcome.js.map

package/dist/runtime/runner/stream-outcome.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-outcome.js","sourceRoot":"","sources":["../../../src/runtime/runner/stream-outcome.ts"],"names":[],"mappings":";;AAkBA,8CAOC;AAzBD,qDAAuD;AAkBvD,SAAgB,iBAAiB,CAAC,OAAsB;IACtD,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO,4BAAe,CAAC,EAAE,CAAC;IAC5B,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,KAAK,CAAC;QACvB,CAAC,CAAC,4BAAe,CAAC,EAAE;QACpB,CAAC,CAAC,4BAAe,CAAC,YAAY,CAAC;AACnC,CAAC"}

package/dist/runtime/secrets/managed-local-cipher.d.ts

@@ -0,0 +1,18 @@
+import type { ManagedLocalKeyProvider } from './managed-local-key-provider';
+declare const RECORD_VERSION = 2;
+declare const CIPHER = "aes-256-gcm";
+export interface EncryptedManagedLocalRecord {
+    readonly version: typeof RECORD_VERSION;
+    readonly installationId: string;
+    readonly context: string;
+    readonly cipher: typeof CIPHER;
+    readonly keyRef: string;
+    readonly iv: string;
+    readonly authTag: string;
+    readonly ciphertext: string;
+}
+export declare function managedLocalInstallationId(identity: string): string;
+export declare function encryptManagedLocalRecord(payload: unknown, installationId: string, context: string, keyProvider: ManagedLocalKeyProvider): Promise<EncryptedManagedLocalRecord>;
+export declare function decryptManagedLocalRecord(raw: string, installationId: string, context: string, path: string, keyProvider: ManagedLocalKeyProvider): Promise<unknown>;
+export {};
+//# sourceMappingURL=managed-local-cipher.d.ts.map

package/dist/runtime/secrets/managed-local-cipher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-local-cipher.d.ts","sourceRoot":"","sources":["../../../src/runtime/secrets/managed-local-cipher.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAE5E,QAAA,MAAM,cAAc,IAAI,CAAC;AACzB,QAAA,MAAM,MAAM,gBAAgB,CAAC;AAI7B,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,OAAO,cAAc,CAAC;IACxC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,OAAO,MAAM,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQnE;AAED,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,OAAO,EAChB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,uBAAuB,GACnC,OAAO,CAAC,2BAA2B,CAAC,CA8BtC;AAED,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,uBAAuB,GACnC,OAAO,CAAC,OAAO,CAAC,CAyClB"}

package/dist/runtime/secrets/managed-local-cipher.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.managedLocalInstallationId = managedLocalInstallationId;
+exports.encryptManagedLocalRecord = encryptManagedLocalRecord;
+exports.decryptManagedLocalRecord = decryptManagedLocalRecord;
+const node_crypto_1 = require("node:crypto");
+const RECORD_VERSION = 2;
+const CIPHER = 'aes-256-gcm';
+const IV_BYTES = 12;
+const KEY_BYTES = 32;
+function managedLocalInstallationId(identity) {
+    const normalized = identity.trim();
+    if (normalized.length === 0) {
+        throw new Error('Managed-local installation identity must not be empty.');
+    }
+    return (0, node_crypto_1.createHash)('sha256').update(normalized).digest('hex');
+}
+async function encryptManagedLocalRecord(payload, installationId, context, keyProvider) {
+    const key = Buffer.from(await keyProvider.getOrCreateKey(installationId));
+    assertKeyLength(key);
+    const keyRef = keyProvider.keyReference(installationId);
+    let plaintext;
+    try {
+        const iv = (0, node_crypto_1.randomBytes)(IV_BYTES);
+        const cipher = (0, node_crypto_1.createCipheriv)(CIPHER, key, iv);
+        cipher.setAAD(Buffer.from(aad(installationId, context, keyRef), 'utf8'));
+        plaintext = Buffer.from(JSON.stringify(payload), 'utf8');
+        const ciphertext = Buffer.concat([
+            cipher.update(plaintext),
+            cipher.final(),
+        ]);
+        return {
+            version: RECORD_VERSION,
+            installationId,
+            context,
+            cipher: CIPHER,
+            keyRef,
+            iv: iv.toString('base64url'),
+            authTag: cipher.getAuthTag().toString('base64url'),
+            ciphertext: ciphertext.toString('base64url'),
+        };
+    }
+    finally {
+        plaintext?.fill(0);
+        key.fill(0);
+    }
+}
+async function decryptManagedLocalRecord(raw, installationId, context, path, keyProvider) {
+    const value = parseRecord(raw, path);
+    const expectedKeyRef = keyProvider.keyReference(installationId);
+    if (value.version !== RECORD_VERSION ||
+        value.installationId !== installationId ||
+        value.context !== context ||
+        value.cipher !== CIPHER ||
+        value.keyRef !== expectedKeyRef ||
+        typeof value.iv !== 'string' ||
+        typeof value.authTag !== 'string' ||
+        typeof value.ciphertext !== 'string') {
+        throw invalidRecord(path);
+    }
+    const key = Buffer.from(await keyProvider.loadKey(installationId));
+    assertKeyLength(key);
+    let plaintext;
+    try {
+        const decipher = (0, node_crypto_1.createDecipheriv)(CIPHER, key, Buffer.from(value.iv, 'base64url'));
+        decipher.setAAD(Buffer.from(aad(installationId, context, value.keyRef), 'utf8'));
+        decipher.setAuthTag(Buffer.from(value.authTag, 'base64url'));
+        plaintext = Buffer.concat([
+            decipher.update(Buffer.from(value.ciphertext, 'base64url')),
+            decipher.final(),
+        ]);
+        return JSON.parse(plaintext.toString('utf8'));
+    }
+    catch {
+        throw new Error(`Managed-local record could not be decrypted or authenticated at ${path}.`);
+    }
+    finally {
+        key.fill(0);
+        plaintext?.fill(0);
+    }
+}
+function parseRecord(raw, path) {
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        throw new Error(`Managed-local record is invalid JSON at ${path}.`);
+    }
+    if (!isRecord(value)) {
+        throw invalidRecord(path);
+    }
+    return value;
+}
+function aad(installationId, context, keyRef) {
+    return `xema-managed-local:${String(RECORD_VERSION)}:${installationId}:${context}:${keyRef}`;
+}
+function assertKeyLength(key) {
+    if (key.length !== KEY_BYTES) {
+        key.fill(0);
+        throw new Error('Managed-local key provider returned a key that is not 32 bytes.');
+    }
+}
+function invalidRecord(path) {
+    return new Error(`Managed-local record has an unsupported or incomplete format at ${path}.`);
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=managed-local-cipher.js.map

package/dist/runtime/secrets/managed-local-cipher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-local-cipher.js","sourceRoot":"","sources":["../../../src/runtime/secrets/managed-local-cipher.ts"],"names":[],"mappings":";;AAyBA,gEAQC;AAED,8DAmCC;AAED,8DA+CC;AAvHD,6CAKqB;AAIrB,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,MAAM,GAAG,aAAa,CAAC;AAC7B,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,SAAS,GAAG,EAAE,CAAC;AAarB,SAAgB,0BAA0B,CAAC,QAAgB;IACzD,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,wDAAwD,CACzD,CAAC;IACJ,CAAC;IACD,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAC7C,OAAgB,EAChB,cAAsB,EACtB,OAAe,EACf,WAAoC;IAEpC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,CAAC;IAC1E,eAAe,CAAC,GAAG,CAAC,CAAC;IACrB,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;IACxD,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,IAAA,yBAAW,EAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CACX,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAC1D,CAAC;QACF,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;YACxB,MAAM,CAAC,KAAK,EAAE;SACf,CAAC,CAAC;QACH,OAAO;YACL,OAAO,EAAE,cAAc;YACvB,cAAc;YACd,OAAO;YACP,MAAM,EAAE,MAAM;YACd,MAAM;YACN,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC5B,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;YAClD,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC;SAC7C,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAC7C,GAAW,EACX,cAAsB,EACtB,OAAe,EACf,IAAY,EACZ,WAAoC;IAEpC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrC,MAAM,cAAc,GAAG,WAAW,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;IAChE,IACE,KAAK,CAAC,OAAO,KAAK,cAAc;QAChC,KAAK,CAAC,cAAc,KAAK,cAAc;QACvC,KAAK,CAAC,OAAO,KAAK,OAAO;QACzB,KAAK,CAAC,MAAM,KAAK,MAAM;QACvB,KAAK,CAAC,MAAM,KAAK,cAAc;QAC/B,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;QAC5B,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QACjC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,EACpC,CAAC;QACD,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IACnE,eAAe,CAAC,GAAG,CAAC,CAAC;IACrB,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAA,8BAAgB,EAC/B,MAAM,EACN,GAAG,EACH,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,CAAC,CACnC,CAAC;QACF,QAAQ,CAAC,MAAM,CACb,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAChE,CAAC;QACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QAC7D,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YACxB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YAC3D,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,mEAAmE,IAAI,GAAG,CAC3E,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,GAAW,EACX,IAAY;IAEZ,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,GAAG,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,GAAG,CACV,cAAsB,EACtB,OAAe,EACf,MAAc;IAEd,OAAO,sBAAsB,MAAM,CAAC,cAAc,CAAC,IAAI,cAAc,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;AAC/F,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,KAAK,CACd,mEAAmE,IAAI,GAAG,CAC3E,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/runtime/secrets/managed-local-files.d.ts

@@ -0,0 +1,4 @@
+export declare function readManagedLocalFile(directory: string, path: string, label: string): Promise<string | undefined>;
+export declare function createManagedLocalFile(directory: string, path: string, content: string, label: string): Promise<boolean>;
+export declare function deleteManagedLocalFile(directory: string, path: string, label: string): Promise<boolean>;
+//# sourceMappingURL=managed-local-files.d.ts.map

package/dist/runtime/secrets/managed-local-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-local-files.d.ts","sourceRoot":"","sources":["../../../src/runtime/secrets/managed-local-files.ts"],"names":[],"mappings":"AAgBA,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAkD7B;AAED,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAkClB;AAED,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAgBlB"}

package/dist/runtime/secrets/managed-local-files.js

@@ -0,0 +1,132 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readManagedLocalFile = readManagedLocalFile;
+exports.createManagedLocalFile = createManagedLocalFile;
+exports.deleteManagedLocalFile = deleteManagedLocalFile;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+const PRIVATE_DIRECTORY_MODE = 0o700;
+const PRIVATE_FILE_MODE = 0o600;
+async function readManagedLocalFile(directory, path, label) {
+    let directoryStat;
+    try {
+        directoryStat = await (0, promises_1.lstat)(directory);
+    }
+    catch (error) {
+        if (errorCode(error) === 'ENOENT') {
+            return undefined;
+        }
+        throw new Error(`${label} directory could not be inspected.`);
+    }
+    if (!directoryStat.isDirectory() ||
+        (directoryStat.mode & 0o077) !== 0 ||
+        !ownedByCurrentUser(directoryStat.uid)) {
+        throw new Error(`${label} directory is unsafe; expected an installer-owned directory with mode 0700.`);
+    }
+    let handle;
+    try {
+        handle = await (0, promises_1.open)(path, node_fs_1.constants.O_RDONLY | (node_fs_1.constants.O_NOFOLLOW ?? 0));
+    }
+    catch (error) {
+        if (errorCode(error) === 'ENOENT') {
+            return undefined;
+        }
+        throw new Error(`${label} could not be inspected.`);
+    }
+    try {
+        const fileStat = await handle.stat();
+        if (!fileStat.isFile() || !ownedByCurrentUser(fileStat.uid)) {
+            throw new Error(`${label} is not an installer-owned regular file.`);
+        }
+        if ((fileStat.mode & 0o077) !== 0) {
+            throw new Error(`${label} permissions are unsafe; expected mode 0600.`);
+        }
+        try {
+            return await handle.readFile('utf8');
+        }
+        catch {
+            throw new Error(`${label} could not be read.`);
+        }
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function createManagedLocalFile(directory, path, content, label) {
+    await (0, promises_1.mkdir)(directory, {
+        recursive: true,
+        mode: PRIVATE_DIRECTORY_MODE,
+    });
+    await (0, promises_1.chmod)(directory, PRIVATE_DIRECTORY_MODE);
+    const candidatePath = (0, node_path_1.join)(directory, `.managed-local.${String(process.pid)}.${(0, node_crypto_1.randomBytes)(12).toString('hex')}.tmp`);
+    const handle = await (0, promises_1.open)(candidatePath, 'wx', PRIVATE_FILE_MODE);
+    try {
+        await handle.writeFile(content, 'utf8');
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+    try {
+        await (0, promises_1.link)(candidatePath, path);
+        await syncDirectory(directory);
+        return true;
+    }
+    catch (error) {
+        if (errorCode(error) === 'EEXIST') {
+            return false;
+        }
+        throw new Error(`${label} could not be created.`);
+    }
+    finally {
+        await (0, promises_1.unlink)(candidatePath).catch((error) => {
+            if (errorCode(error) !== 'ENOENT') {
+                throw error;
+            }
+        });
+    }
+}
+async function deleteManagedLocalFile(directory, path, label) {
+    try {
+        await (0, promises_1.unlink)(path);
+        await syncDirectory(directory);
+    }
+    catch (error) {
+        if (errorCode(error) === 'ENOENT') {
+            return false;
+        }
+        throw new Error(`${label} could not be removed.`);
+    }
+    await (0, promises_1.rmdir)(directory).catch((error) => {
+        if (errorCode(error) !== 'ENOTEMPTY' && errorCode(error) !== 'ENOENT') {
+            throw error;
+        }
+    });
+    return true;
+}
+async function syncDirectory(directory) {
+    if (process.platform === 'win32') {
+        return;
+    }
+    const handle = await (0, promises_1.open)(directory, node_fs_1.constants.O_RDONLY);
+    try {
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+}
+function errorCode(error) {
+    return isRecord(error) && typeof error.code === 'string'
+        ? error.code
+        : undefined;
+}
+function ownedByCurrentUser(uid) {
+    return typeof process.getuid !== 'function' || process.getuid() === uid;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=managed-local-files.js.map

package/dist/runtime/secrets/managed-local-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-local-files.js","sourceRoot":"","sources":["../../../src/runtime/secrets/managed-local-files.ts"],"names":[],"mappings":";;AAgBA,oDAsDC;AAED,wDAuCC;AAED,wDAoBC;AArID,6CAA0C;AAC1C,qCAAoC;AACpC,+CAQ0B;AAC1B,yCAAiC;AAEjC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AACrC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAEzB,KAAK,UAAU,oBAAoB,CACxC,SAAiB,EACjB,IAAY,EACZ,KAAa;IAEb,IAAI,aAAa,CAAC;IAClB,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,IAAA,gBAAK,EAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;IAChE,CAAC;IACD,IACE,CAAC,aAAa,CAAC,WAAW,EAAE;QAC5B,CAAC,aAAa,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;QAClC,CAAC,kBAAkB,CAAC,aAAa,CAAC,GAAG,CAAC,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,6EAA6E,CACtF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAA,eAAI,EACjB,IAAI,EACJ,mBAAS,CAAC,QAAQ,GAAG,CAAC,mBAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CACjD,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0BAA0B,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,0CAA0C,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,8CAA8C,CACvD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,sBAAsB,CAC1C,SAAiB,EACjB,IAAY,EACZ,OAAe,EACf,KAAa;IAEb,MAAM,IAAA,gBAAK,EAAC,SAAS,EAAE;QACrB,SAAS,EAAE,IAAI;QACf,IAAI,EAAE,sBAAsB;KAC7B,CAAC,CAAC;IACH,MAAM,IAAA,gBAAK,EAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAG,IAAA,gBAAI,EACxB,SAAS,EACT,kBAAkB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAC/E,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,eAAI,EAAC,aAAa,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAA,eAAI,EAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAChC,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wBAAwB,CAAC,CAAC;IACpD,CAAC;YAAS,CAAC;QACT,MAAM,IAAA,iBAAM,EAAC,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACnD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,sBAAsB,CAC1C,SAAiB,EACjB,IAAY,EACZ,KAAa;IAEb,IAAI,CAAC;QACH,MAAM,IAAA,iBAAM,EAAC,IAAI,CAAC,CAAC;QACnB,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wBAAwB,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,IAAA,gBAAK,EAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC9C,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,WAAW,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;YACtE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,SAAiB;IAC5C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAA,eAAI,EAAC,SAAS,EAAE,mBAAS,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QACtD,CAAC,CAAC,KAAK,CAAC,IAAI;QACZ,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,OAAO,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC;AAC1E,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/runtime/secrets/managed-local-key-provider.d.ts

@@ -0,0 +1,27 @@
+export declare enum ManagedLocalKeyProviderKind {
+    MacOsKeychain = "macos-keychain",
+    RecoveryKey = "recovery-key"
+}
+export interface ManagedLocalKeyProvider {
+    readonly kind: ManagedLocalKeyProviderKind;
+    keyReference(installationId: string): string;
+    loadKey(installationId: string): Promise<Buffer>;
+    getOrCreateKey(installationId: string): Promise<Buffer>;
+}
+export declare class EnvironmentRecoveryKeyProvider implements ManagedLocalKeyProvider {
+    private readonly env;
+    private readonly variable;
+    readonly kind = ManagedLocalKeyProviderKind.RecoveryKey;
+    constructor(env?: NodeJS.ProcessEnv, variable?: string);
+    keyReference(_installationId: string): string;
+    loadKey(_installationId: string): Promise<Buffer>;
+    getOrCreateKey(installationId: string): Promise<Buffer>;
+}
+export declare class MacOsKeychainKeyProvider implements ManagedLocalKeyProvider {
+    readonly kind = ManagedLocalKeyProviderKind.MacOsKeychain;
+    keyReference(installationId: string): string;
+    loadKey(installationId: string): Promise<Buffer>;
+    getOrCreateKey(installationId: string): Promise<Buffer>;
+}
+export declare function configuredManagedLocalKeyProvider(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): ManagedLocalKeyProvider;
+//# sourceMappingURL=managed-local-key-provider.d.ts.map

package/dist/runtime/secrets/managed-local-key-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-local-key-provider.d.ts","sourceRoot":"","sources":["../../../src/runtime/secrets/managed-local-key-provider.ts"],"names":[],"mappings":"AAUA,oBAAY,2BAA2B;IACrC,aAAa,mBAAmB;IAChC,WAAW,iBAAiB;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;IAC3C,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7C,OAAO,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,cAAc,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACzD;AAED,qBAAa,8BACX,YAAW,uBAAuB;IAKhC,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAJ3B,QAAQ,CAAC,IAAI,2CAA2C;gBAGrC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,QAAQ,SAA2B;IAGtD,YAAY,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM;IAIvC,OAAO,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgBjD,cAAc,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAG9D;AAED,qBAAa,wBAAyB,YAAW,uBAAuB;IACtE,QAAQ,CAAC,IAAI,6CAA6C;IAE1D,YAAY,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM;IAItC,OAAO,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAWhD,cAAc,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAoB9D;AA2ED,wBAAgB,iCAAiC,CAC/C,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,uBAAuB,CAsBzB"}

package/dist/runtime/secrets/managed-local-key-provider.js

@@ -0,0 +1,144 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MacOsKeychainKeyProvider = exports.EnvironmentRecoveryKeyProvider = exports.ManagedLocalKeyProviderKind = void 0;
+exports.configuredManagedLocalKeyProvider = configuredManagedLocalKeyProvider;
+const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
+const node_util_1 = require("node:util");
+const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
+const KEY_BYTES = 32;
+const DEFAULT_RECOVERY_KEY_ENV = 'XEMA_MANAGED_LOCAL_RECOVERY_KEY';
+const PROVIDER_ENV = 'XEMA_MANAGED_LOCAL_KEY_PROVIDER';
+const KEYCHAIN_SERVICE = 'dev.xema.managed-local';
+var ManagedLocalKeyProviderKind;
+(function (ManagedLocalKeyProviderKind) {
+    ManagedLocalKeyProviderKind["MacOsKeychain"] = "macos-keychain";
+    ManagedLocalKeyProviderKind["RecoveryKey"] = "recovery-key";
+})(ManagedLocalKeyProviderKind || (exports.ManagedLocalKeyProviderKind = ManagedLocalKeyProviderKind = {}));
+class EnvironmentRecoveryKeyProvider {
+    env;
+    variable;
+    kind = ManagedLocalKeyProviderKind.RecoveryKey;
+    constructor(env = process.env, variable = DEFAULT_RECOVERY_KEY_ENV) {
+        this.env = env;
+        this.variable = variable;
+    }
+    keyReference(_installationId) {
+        return `environment:${this.variable}`;
+    }
+    async loadKey(_installationId) {
+        const encoded = this.env[this.variable];
+        if (encoded === undefined || encoded.length === 0) {
+            throw new Error(`Managed-local recovery key provider requires ${this.variable}; no fallback provider was attempted.`);
+        }
+        const key = Buffer.from(encoded, 'base64url');
+        if (key.length !== KEY_BYTES) {
+            throw new Error(`Managed-local recovery key in ${this.variable} must be a base64url-encoded 32-byte key.`);
+        }
+        return key;
+    }
+    async getOrCreateKey(installationId) {
+        return this.loadKey(installationId);
+    }
+}
+exports.EnvironmentRecoveryKeyProvider = EnvironmentRecoveryKeyProvider;
+class MacOsKeychainKeyProvider {
+    kind = ManagedLocalKeyProviderKind.MacOsKeychain;
+    keyReference(installationId) {
+        return `macos-keychain:${KEYCHAIN_SERVICE}/${installationId}`;
+    }
+    async loadKey(installationId) {
+        assertMacOs();
+        const existing = await findKeychainValue(installationId);
+        if (existing !== undefined) {
+            return decodeKeychainValue(existing, installationId);
+        }
+        throw new Error(`No managed-local key is available in macOS Keychain for installation ${installationId}; no fallback provider was attempted.`);
+    }
+    async getOrCreateKey(installationId) {
+        assertMacOs();
+        const existing = await findKeychainValue(installationId);
+        if (existing !== undefined) {
+            return decodeKeychainValue(existing, installationId);
+        }
+        const generated = (0, node_crypto_1.randomBytes)(KEY_BYTES).toString('base64url');
+        try {
+            await addKeychainValue(installationId, generated);
+            return Buffer.from(generated, 'base64url');
+        }
+        catch {
+            const winner = await findKeychainValue(installationId);
+            if (winner !== undefined) {
+                return decodeKeychainValue(winner, installationId);
+            }
+            throw new Error(`No managed-local key could be created in macOS Keychain for installation ${installationId}; no fallback provider was attempted.`);
+        }
+    }
+}
+exports.MacOsKeychainKeyProvider = MacOsKeychainKeyProvider;
+function assertMacOs() {
+    if (process.platform !== 'darwin') {
+        throw new Error('The macos-keychain managed-local key provider is unavailable on this operating system.');
+    }
+}
+async function findKeychainValue(installationId) {
+    try {
+        const { stdout } = await execFileAsync('security', [
+            'find-generic-password',
+            '-w',
+            '-s',
+            KEYCHAIN_SERVICE,
+            '-a',
+            installationId,
+        ]);
+        return stdout.trim();
+    }
+    catch {
+        return undefined;
+    }
+}
+function decodeKeychainValue(encoded, installationId) {
+    const key = Buffer.from(encoded, 'base64url');
+    if (key.length !== KEY_BYTES) {
+        throw new Error(`The macOS Keychain entry for installation ${installationId} is not a base64url-encoded 32-byte key.`);
+    }
+    return key;
+}
+async function addKeychainValue(installationId, encoded) {
+    await new Promise((resolvePromise, rejectPromise) => {
+        const child = (0, node_child_process_1.spawn)('security', [
+            'add-generic-password',
+            '-s',
+            KEYCHAIN_SERVICE,
+            '-a',
+            installationId,
+            '-w',
+        ], { stdio: ['pipe', 'ignore', 'ignore'] });
+        child.once('error', rejectPromise);
+        child.once('exit', (code) => {
+            if (code === 0) {
+                resolvePromise();
+            }
+            else {
+                rejectPromise(new Error('macOS Keychain rejected the key entry.'));
+            }
+        });
+        child.stdin.end(`${encoded}\n`);
+    });
+}
+function configuredManagedLocalKeyProvider(env = process.env, platform = process.platform) {
+    switch (env[PROVIDER_ENV]) {
+        case ManagedLocalKeyProviderKind.MacOsKeychain:
+            return new MacOsKeychainKeyProvider();
+        case ManagedLocalKeyProviderKind.RecoveryKey:
+            return new EnvironmentRecoveryKeyProvider(env);
+        case undefined:
+            if (platform === 'darwin') {
+                return new MacOsKeychainKeyProvider();
+            }
+            throw new Error(`Managed-local custody requires an explicit ${PROVIDER_ENV} (${Object.values(ManagedLocalKeyProviderKind).join(' | ')}).`);
+        default:
+            throw new Error(`Unsupported ${PROVIDER_ENV} selection; expected ${Object.values(ManagedLocalKeyProviderKind).join(' or ')}.`);
+    }
+}
+//# sourceMappingURL=managed-local-key-provider.js.map