@xemahq/xema 0.2.4 → 0.4.0

package/dist/runtime/sources/credentials.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialResolver = exports.CREDENTIALS_FILE = void 0;
+exports.loadCredentialsFile = loadCredentialsFile;
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+exports.CREDENTIALS_FILE = (0, node_path_1.join)((0, node_os_1.homedir)(), '.xema', 'credentials.env');
+function loadCredentialsFile(path = exports.CREDENTIALS_FILE) {
+    const out = new Map();
+    if (!(0, node_fs_1.existsSync)(path)) {
+        return out;
+    }
+    const lines = (0, node_fs_1.readFileSync)(path, 'utf8').split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i] ?? '';
+        const line = raw.trim();
+        if (line.length === 0 || line.startsWith('#')) {
+            continue;
+        }
+        const eq = line.indexOf('=');
+        if (eq <= 0) {
+            throw new Error(`${path}:${String(i + 1)}: expected KEY=value, got: ${line}`);
+        }
+        const key = line.slice(0, eq).trim();
+        let value = line.slice(eq + 1).trim();
+        if ((value.startsWith('"') && value.endsWith('"')) ||
+            (value.startsWith("'") && value.endsWith("'"))) {
+            value = value.slice(1, -1);
+        }
+        out.set(key, value);
+    }
+    return out;
+}
+class CredentialResolver {
+    env;
+    fileCreds;
+    constructor(env = process.env, fileCreds) {
+        this.env = env;
+        this.fileCreds = fileCreds ?? loadCredentialsFile();
+    }
+    has(authTokenEnv) {
+        if (authTokenEnv === undefined) {
+            return true;
+        }
+        return this.lookup(authTokenEnv) !== undefined;
+    }
+    resolve(authTokenEnv, sourceName) {
+        if (authTokenEnv === undefined) {
+            return undefined;
+        }
+        const value = this.lookup(authTokenEnv);
+        if (value === undefined || value.length === 0) {
+            throw new Error(`Source "${sourceName}" needs a token: env var ${authTokenEnv} is unset/empty. ` +
+                `Export it, or add ${authTokenEnv}=<token> to ${exports.CREDENTIALS_FILE}.`);
+        }
+        return value;
+    }
+    lookup(name) {
+        const fromEnv = this.env[name];
+        if (fromEnv !== undefined && fromEnv.length > 0) {
+            return fromEnv;
+        }
+        return this.fileCreds.get(name);
+    }
+}
+exports.CredentialResolver = CredentialResolver;
+//# sourceMappingURL=credentials.js.map

package/dist/runtime/sources/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/runtime/sources/credentials.ts"],"names":[],"mappings":";;;AA0BA,kDA2BC;AArDD,qCAAmD;AACnD,qCAAkC;AAClC,yCAAiC;AAgBpB,QAAA,gBAAgB,GAAG,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;AAQ5E,SAAgB,mBAAmB,CAAC,OAAe,wBAAgB;IACjE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,KAAK,GAAG,IAAA,sBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAMD,MAAa,kBAAkB;IAIV;IAHF,SAAS,CAA8B;IAExD,YACmB,MAAyB,OAAO,CAAC,GAAG,EACrD,SAAuC;QADtB,QAAG,GAAH,GAAG,CAAiC;QAGrD,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,mBAAmB,EAAE,CAAC;IACtD,CAAC;IAOD,GAAG,CAAC,YAAgC;QAClC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,SAAS,CAAC;IACjD,CAAC;IAQD,OAAO,CAAC,YAAgC,EAAE,UAAkB;QAC1D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,WAAW,UAAU,4BAA4B,YAAY,mBAAmB;gBAC9E,qBAAqB,YAAY,eAAe,wBAAgB,GAAG,CACtE,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAGO,MAAM,CAAC,IAAY;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;CACF;AAlDD,gDAkDC"}

package/dist/runtime/sources/kinds/distribution.d.ts

@@ -0,0 +1,5 @@
+import { type LockIndex } from '../../roster';
+import type { DistributionSource } from '../schema';
+import type { SourceResolveContext } from '../types';
+export declare function resolveDistributionSource(spec: DistributionSource, ctx: SourceResolveContext): LockIndex;
+//# sourceMappingURL=distribution.d.ts.map

package/dist/runtime/sources/kinds/distribution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"distribution.d.ts","sourceRoot":"","sources":["../../../../src/runtime/sources/kinds/distribution.ts"],"names":[],"mappings":"AAGA,OAAO,EAAkB,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAYrD,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,kBAAkB,EACxB,GAAG,EAAE,oBAAoB,GACxB,SAAS,CAwBX"}

package/dist/runtime/sources/kinds/distribution.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveDistributionSource = resolveDistributionSource;
+const node_path_1 = require("node:path");
+const lock_loader_1 = require("../../lock-loader");
+const roster_1 = require("../../roster");
+function resolveDistributionSource(spec, ctx) {
+    const explicitDir = localRefDir(spec.ref);
+    if (spec.ref !== undefined && explicitDir === null) {
+        throw new Error(`source "${spec.name}" (distribution): remote ref "${spec.ref}" is not yet supported on ` +
+            `the launch path. Provide a local path to a distributions checkout, or use a vendored edition.`);
+    }
+    const lockExplicit = explicitDir !== null ? (0, node_path_1.join)(explicitDir, spec.edition, 'distribution.lock.json') : undefined;
+    const imageExplicit = explicitDir !== null ? (0, node_path_1.join)(explicitDir, spec.edition, 'images.lock.json') : undefined;
+    const { lock } = (0, lock_loader_1.loadDistributionLock)({ edition: spec.edition, explicit: lockExplicit });
+    let imagesByBiome;
+    if (ctx.usesImages) {
+        imagesByBiome = (0, lock_loader_1.loadImageLock)({ edition: spec.edition, explicit: imageExplicit }).imagesByBiome;
+    }
+    ctx.log?.(`source "${spec.name}" (distribution): edition "${spec.edition}", ` +
+        `${String(lock.biomes.length)} biome(s).`);
+    return (0, roster_1.buildLockIndex)(lock, imagesByBiome);
+}
+function localRefDir(ref) {
+    if (ref === undefined) {
+        return null;
+    }
+    if (ref.includes(':') && !(0, node_path_1.isAbsolute)(ref)) {
+        return null;
+    }
+    return (0, node_path_1.resolve)(process.cwd(), ref);
+}
+//# sourceMappingURL=distribution.js.map

package/dist/runtime/sources/kinds/distribution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"distribution.js","sourceRoot":"","sources":["../../../../src/runtime/sources/kinds/distribution.ts"],"names":[],"mappings":";;AAkBA,8DA2BC;AA7CD,yCAAsD;AAEtD,mDAAyF;AACzF,yCAA8D;AAe9D,SAAgB,yBAAyB,CACvC,IAAwB,EACxB,GAAyB;IAEzB,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,CAAC,IAAI,iCAAiC,IAAI,CAAC,GAAG,4BAA4B;YACvF,+FAA+F,CAClG,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAChB,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/F,MAAM,aAAa,GACjB,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAA,gBAAI,EAAC,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEzF,MAAM,EAAE,IAAI,EAAE,GAAG,IAAA,kCAAoB,EAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;IAEzF,IAAI,aAA0D,CAAC;IAC/D,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,aAAa,GAAG,IAAA,2BAAa,EAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,CAAC;IAClG,CAAC;IACD,GAAG,CAAC,GAAG,EAAE,CACP,WAAW,IAAI,CAAC,IAAI,8BAA8B,IAAI,CAAC,OAAO,KAAK;QACjE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAC5C,CAAC;IACF,OAAO,IAAA,uBAAc,EAAC,IAAI,EAAE,aAAa,CAAC,CAAC;AAC7C,CAAC;AAGD,SAAS,WAAW,CAAC,GAAuB;IAC1C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAA,sBAAU,EAAC,GAAG,CAAC,EAAE,CAAC;QAE1C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAA,mBAAO,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;AACrC,CAAC"}

package/dist/runtime/sources/kinds/git.d.ts

@@ -0,0 +1,5 @@
+import { type LockIndex } from '../../roster';
+import type { GitSource } from '../schema';
+import type { SourceResolveContext } from '../types';
+export declare function resolveGitSource(spec: GitSource, ctx: SourceResolveContext): LockIndex | null;
+//# sourceMappingURL=git.d.ts.map

package/dist/runtime/sources/kinds/git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../../../src/runtime/sources/kinds/git.ts"],"names":[],"mappings":"AAKA,OAAO,EAA6B,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAmBrD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,oBAAoB,GAAG,SAAS,GAAG,IAAI,CAmB7F"}

package/dist/runtime/sources/kinds/git.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveGitSource = resolveGitSource;
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const roster_1 = require("../../roster");
+const manifest_walk_1 = require("../manifest-walk");
+const GIT_CACHE_DIR = (0, node_path_1.join)((0, node_os_1.homedir)(), '.xema', 'cache', 'git');
+const REF_MARKER = '.xema-source-ref';
+const CLONE_TIMEOUT_MS = 120_000;
+function resolveGitSource(spec, ctx) {
+    if (ctx.usesImages) {
+        ctx.log?.(`source "${spec.name}" (git): inert on an image substrate ` +
+            `(a clone is source, not an image; use native substrate for git biomes).`);
+        return null;
+    }
+    const token = ctx.credentials.resolve(spec.authTokenEnv, spec.name);
+    const ref = spec.ref ?? 'HEAD';
+    const dir = (0, node_path_1.join)(GIT_CACHE_DIR, spec.name);
+    ensureClone(spec, dir, ref, token, ctx);
+    const { biomes } = (0, manifest_walk_1.walkBiomeManifests)(dir);
+    const serverBiomes = biomes.filter((b) => b.target === 'server' && b.services.length > 0);
+    ctx.log?.(`source "${spec.name}" (git): ${String(serverBiomes.length)} biome(s) from ${spec.url}@${ref}`);
+    return (0, roster_1.indexFromDiscoveredBiomes)(serverBiomes, { sourceName: spec.name, sourceRoot: dir });
+}
+function ensureClone(spec, dir, ref, token, ctx) {
+    if ((0, node_fs_1.existsSync)((0, node_path_1.join)(dir, REF_MARKER))) {
+        const cached = (0, node_fs_1.readFileSync)((0, node_path_1.join)(dir, REF_MARKER), 'utf8').trim();
+        if (cached === ref) {
+            ctx.log?.(`source "${spec.name}" (git): reusing cached clone (${ref}).`);
+            return;
+        }
+    }
+    if ((0, node_fs_1.existsSync)(dir)) {
+        (0, node_fs_1.rmSync)(dir, { recursive: true, force: true });
+    }
+    (0, node_fs_1.mkdirSync)(GIT_CACHE_DIR, { recursive: true });
+    const args = ['clone', '--depth', '1'];
+    if (spec.ref !== undefined) {
+        args.push('--branch', spec.ref);
+    }
+    args.push('--', spec.url, dir);
+    try {
+        (0, node_child_process_1.execFileSync)('git', args, {
+            stdio: 'pipe',
+            timeout: CLONE_TIMEOUT_MS,
+            env: gitEnvWithAuth(token),
+        });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`source "${spec.name}" (git): clone of ${spec.url}@${ref} failed: ${message}`);
+    }
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, REF_MARKER), ref, 'utf8');
+}
+function gitEnvWithAuth(token) {
+    const base = { ...process.env, GIT_TERMINAL_PROMPT: '0' };
+    if (token === undefined) {
+        return base;
+    }
+    return {
+        ...base,
+        GIT_CONFIG_COUNT: '1',
+        GIT_CONFIG_KEY_0: 'http.extraHeader',
+        GIT_CONFIG_VALUE_0: `Authorization: Bearer ${token}`,
+    };
+}
+//# sourceMappingURL=git.js.map

package/dist/runtime/sources/kinds/git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../../../../src/runtime/sources/kinds/git.ts"],"names":[],"mappings":";;AA4BA,4CAmBC;AA/CD,2DAAkD;AAClD,qCAAqF;AACrF,qCAAkC;AAClC,yCAAiC;AAEjC,yCAAyE;AACzE,oDAAsD;AAMtD,MAAM,aAAa,GAAG,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAE/D,MAAM,UAAU,GAAG,kBAAkB,CAAC;AACtC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAajC,SAAgB,gBAAgB,CAAC,IAAe,EAAE,GAAyB;IACzE,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CACP,WAAW,IAAI,CAAC,IAAI,uCAAuC;YACzD,yEAAyE,CAC5E,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAA,gBAAI,EAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAExC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,kCAAkB,EAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1F,GAAG,CAAC,GAAG,EAAE,CACP,WAAW,IAAI,CAAC,IAAI,YAAY,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,kBAAkB,IAAI,CAAC,GAAG,IAAI,GAAG,EAAE,CAC/F,CAAC;IACF,OAAO,IAAA,kCAAyB,EAAC,YAAY,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;AAC7F,CAAC;AAGD,SAAS,WAAW,CAClB,IAAe,EACf,GAAW,EACX,GAAW,EACX,KAAyB,EACzB,GAAyB;IAEzB,IAAI,IAAA,oBAAU,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAClE,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,IAAI,CAAC,IAAI,kCAAkC,GAAG,IAAI,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;IACH,CAAC;IACD,IAAI,IAAA,oBAAU,EAAC,GAAG,CAAC,EAAE,CAAC;QACpB,IAAA,gBAAM,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,IAAA,mBAAS,EAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAG9C,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACvC,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAE/B,IAAI,CAAC;QACH,IAAA,iCAAY,EAAC,KAAK,EAAE,IAAI,EAAE;YACxB,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,gBAAgB;YACzB,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,IAAI,qBAAqB,IAAI,CAAC,GAAG,IAAI,GAAG,YAAY,OAAO,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,UAAU,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC;AAQD,SAAS,cAAc,CAAC,KAAyB;IAC/C,MAAM,IAAI,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC;IAC7E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,GAAG,IAAI;QACP,gBAAgB,EAAE,GAAG;QACrB,gBAAgB,EAAE,kBAAkB;QACpC,kBAAkB,EAAE,yBAAyB,KAAK,EAAE;KACrD,CAAC;AACJ,CAAC"}

package/dist/runtime/sources/kinds/workspace.d.ts

@@ -0,0 +1,5 @@
+import { type LockIndex } from '../../roster';
+import type { WorkspaceSource } from '../schema';
+import type { SourceResolveContext } from '../types';
+export declare function resolveWorkspaceSource(spec: WorkspaceSource, ctx: SourceResolveContext): LockIndex | null;
+//# sourceMappingURL=workspace.d.ts.map

package/dist/runtime/sources/kinds/workspace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../../../../src/runtime/sources/kinds/workspace.ts"],"names":[],"mappings":"AAGA,OAAO,EAA6B,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAQrD,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,eAAe,EACrB,GAAG,EAAE,oBAAoB,GACxB,SAAS,GAAG,IAAI,CAqBlB"}

package/dist/runtime/sources/kinds/workspace.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveWorkspaceSource = resolveWorkspaceSource;
+const node_path_1 = require("node:path");
+const paths_1 = require("../../paths");
+const roster_1 = require("../../roster");
+const manifest_walk_1 = require("../manifest-walk");
+function resolveWorkspaceSource(spec, ctx) {
+    if (ctx.usesImages) {
+        ctx.log?.(`source "${spec.name}" (workspace): inert on an image substrate ` +
+            `(working-tree dirs have no images; use native substrate for local biomes).`);
+        return null;
+    }
+    const root = spec.root ? (0, node_path_1.resolve)(process.cwd(), spec.root) : (0, paths_1.findMonorepoRoot)();
+    if (root === null) {
+        ctx.log?.(`source "${spec.name}" (workspace): no monorepo root detected; nothing to contribute.`);
+        return null;
+    }
+    const { biomes } = (0, manifest_walk_1.walkBiomeManifests)(root);
+    const serverBiomes = biomes.filter((b) => b.target === 'server' && b.services.length > 0);
+    ctx.log?.(`source "${spec.name}" (workspace): ${String(serverBiomes.length)} biome(s) from ${root}`);
+    return (0, roster_1.indexFromDiscoveredBiomes)(serverBiomes, { sourceName: spec.name, sourceRoot: root });
+}
+//# sourceMappingURL=workspace.js.map

package/dist/runtime/sources/kinds/workspace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace.js","sourceRoot":"","sources":["../../../../src/runtime/sources/kinds/workspace.ts"],"names":[],"mappings":";;AAeA,wDAwBC;AAvCD,yCAAoC;AAEpC,uCAA+C;AAC/C,yCAAyE;AACzE,oDAAsD;AAWtD,SAAgB,sBAAsB,CACpC,IAAqB,EACrB,GAAyB;IAEzB,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,GAAG,CAAC,GAAG,EAAE,CACP,WAAW,IAAI,CAAC,IAAI,6CAA6C;YAC/D,4EAA4E,CAC/E,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,mBAAO,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,wBAAgB,GAAE,CAAC;IAChF,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,GAAG,CAAC,GAAG,EAAE,CACP,WAAW,IAAI,CAAC,IAAI,kEAAkE,CACvF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,kCAAkB,EAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1F,GAAG,CAAC,GAAG,EAAE,CACP,WAAW,IAAI,CAAC,IAAI,kBAAkB,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAC1F,CAAC;IACF,OAAO,IAAA,kCAAyB,EAAC,YAAY,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;AAC9F,CAAC"}

package/dist/runtime/sources/manifest-walk.d.ts

@@ -0,0 +1,22 @@
+import { type BiomeManifest } from '@xemahq/kernel-contracts/biome';
+export interface DiscoveredService {
+    readonly name: string;
+    readonly servicePath: string;
+}
+export interface DiscoveredBiome {
+    readonly id: string;
+    readonly tier: string;
+    readonly target: 'server' | 'web';
+    readonly version: string;
+    readonly packageName: string;
+    readonly biomeDir: string;
+    readonly requires: readonly string[];
+    readonly services: readonly DiscoveredService[];
+    readonly manifest: BiomeManifest;
+}
+export interface WalkResult {
+    readonly root: string;
+    readonly biomes: readonly DiscoveredBiome[];
+}
+export declare function walkBiomeManifests(root: string): WalkResult;
+//# sourceMappingURL=manifest-walk.d.ts.map

package/dist/runtime/sources/manifest-walk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-walk.d.ts","sourceRoot":"","sources":["../../../src/runtime/sources/manifest-walk.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,gCAAgC,CAAC;AA2CxC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAGD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,KAAK,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAErC,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IAEzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAC;CAC7C;AASD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAS3D"}

package/dist/runtime/sources/manifest-walk.js

@@ -0,0 +1,87 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.walkBiomeManifests = walkBiomeManifests;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const biome_1 = require("@xemahq/kernel-contracts/biome");
+const SKIP_DIRS = new Set([
+    'node_modules',
+    '.git',
+    'dist',
+    'build',
+    '.turbo',
+    'coverage',
+    '.next',
+    '.cache',
+    'templates',
+    'fixtures',
+    '__fixtures__',
+    '__mocks__',
+]);
+function walkBiomeManifests(root) {
+    if (!(0, node_fs_1.existsSync)(root)) {
+        throw new Error(`walkBiomeManifests: root does not exist: ${root}`);
+    }
+    const biomes = [];
+    visit(root, root, biomes);
+    biomes.sort((a, b) => a.id.localeCompare(b.id));
+    return { root, biomes };
+}
+function visit(dir, root, out) {
+    const manifestPath = (0, node_path_1.join)(dir, biome_1.BIOME_MANIFEST_FILENAME);
+    if ((0, node_fs_1.existsSync)(manifestPath)) {
+        out.push(projectManifest(manifestPath, root));
+        return;
+    }
+    let entries;
+    try {
+        entries = (0, node_fs_1.readdirSync)(dir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        if (!entry.isDirectory() || SKIP_DIRS.has(entry.name) || entry.name.startsWith('.')) {
+            continue;
+        }
+        visit((0, node_path_1.join)(dir, entry.name), root, out);
+    }
+}
+function projectManifest(manifestPath, root) {
+    const biomeAbsDir = manifestPath.slice(0, -(biome_1.BIOME_MANIFEST_FILENAME.length + 1));
+    let manifest;
+    try {
+        manifest = (0, biome_1.parseBiomeManifest)(JSON.parse((0, node_fs_1.readFileSync)(manifestPath, 'utf8')));
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Invalid biome manifest at ${manifestPath}: ${message}`);
+    }
+    const biomeDir = (0, node_path_1.relative)(root, biomeAbsDir);
+    const xema = manifest.xema;
+    const requires = Object.keys(xema.requires ?? {});
+    const services = xema.target === 'server'
+        ? (xema.ships?.apis ?? []).map((api) => ({
+            name: api.name,
+            servicePath: (0, node_path_1.join)(biomeDir, normalizeApiPath(api.path, api.name)),
+        }))
+        : [];
+    return {
+        id: xema.id,
+        tier: xema.scope,
+        target: xema.target,
+        version: manifest.version,
+        packageName: manifest.name,
+        biomeDir,
+        requires,
+        services,
+        manifest,
+    };
+}
+function normalizeApiPath(declared, name) {
+    if (declared !== undefined && declared.length > 0) {
+        return declared.replace(/^\.\//, '');
+    }
+    return (0, node_path_1.join)('api', name);
+}
+//# sourceMappingURL=manifest-walk.js.map

package/dist/runtime/sources/manifest-walk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-walk.js","sourceRoot":"","sources":["../../../src/runtime/sources/manifest-walk.ts"],"names":[],"mappings":";;AAsFA,gDASC;AA/FD,qCAA6E;AAC7E,yCAA2C;AAE3C,0DAIwC;AA2BxC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,cAAc;IACd,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,UAAU;IACV,OAAO;IACP,QAAQ;IACR,WAAW;IACX,UAAU;IACV,cAAc;IACd,WAAW;CACZ,CAAC,CAAC;AAuCH,SAAgB,kBAAkB,CAAC,IAAY;IAC7C,IAAI,CAAC,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAE1B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,KAAK,CAAC,GAAW,EAAE,IAAY,EAAE,GAAsB;IAC9D,MAAM,YAAY,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,+BAAuB,CAAC,CAAC;IACxD,IAAI,IAAA,oBAAU,EAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IACD,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,IAAA,qBAAW,EAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpF,SAAS;QACX,CAAC;QACD,KAAK,CAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,YAAoB,EAAE,IAAY;IACzD,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,+BAAuB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,QAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,QAAQ,GAAG,IAAA,0BAAkB,EAAC,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,6BAA6B,YAAY,KAAK,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,QAAQ,GAAG,IAAA,oBAAQ,EAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAElD,MAAM,QAAQ,GACZ,IAAI,CAAC,MAAM,KAAK,QAAQ;QACtB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACrC,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,IAAA,gBAAI,EAAC,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;SAClE,CAAC,CAAC;QACL,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,KAAK;QAChB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,WAAW,EAAE,QAAQ,CAAC,IAAI;QAC1B,QAAQ;QACR,QAAQ;QACR,QAAQ;QACR,QAAQ;KACT,CAAC;AACJ,CAAC;AAOD,SAAS,gBAAgB,CAAC,QAA4B,EAAE,IAAY;IAClE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,IAAA,gBAAI,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC"}

package/dist/runtime/sources/resolver.d.ts

@@ -0,0 +1,15 @@
+import { type LockIndex } from '../roster';
+import { CredentialResolver } from './credentials';
+import { SourceKind, type SourceSpec } from './schema';
+import type { SourceResolveContext } from './types';
+export declare function composeSourceIndex(base: LockIndex, sources: readonly SourceSpec[], ctx: SourceResolveContext): LockIndex;
+export interface SourceStatus {
+    readonly name: string;
+    readonly kind: SourceKind;
+    readonly detail: string;
+    readonly tokenEnv?: string;
+    readonly tokenPresent: boolean;
+    readonly launchTime: boolean;
+}
+export declare function describeSources(sources: readonly SourceSpec[], credentials?: CredentialResolver): SourceStatus[];
+//# sourceMappingURL=resolver.d.ts.map

package/dist/runtime/sources/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../src/runtime/sources/resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAInD,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAEvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAepD,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,GAAG,EAAE,oBAAoB,GACxB,SAAS,CAqBX;AAsBD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAE/B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAGD,wBAAgB,eAAe,CAC7B,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,WAAW,GAAE,kBAA6C,GACzD,YAAY,EAAE,CAahB"}

package/dist/runtime/sources/resolver.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.composeSourceIndex = composeSourceIndex;
+exports.describeSources = describeSources;
+const roster_1 = require("../roster");
+const credentials_1 = require("./credentials");
+const distribution_1 = require("./kinds/distribution");
+const git_1 = require("./kinds/git");
+const workspace_1 = require("./kinds/workspace");
+const schema_1 = require("./schema");
+function composeSourceIndex(base, sources, ctx) {
+    const workspace = [];
+    const other = [];
+    for (const spec of sources) {
+        (spec.kind === schema_1.SourceKind.Workspace ? workspace : other).push(spec);
+    }
+    let index = base;
+    for (const spec of [...other].reverse()) {
+        const contrib = resolveOne(spec, ctx);
+        if (contrib !== null) {
+            index = (0, roster_1.mergeIndices)(index, contrib);
+        }
+    }
+    for (const spec of [...workspace].reverse()) {
+        const contrib = resolveOne(spec, ctx);
+        if (contrib !== null) {
+            index = (0, roster_1.mergeIndices)(index, contrib);
+        }
+    }
+    return index;
+}
+function resolveOne(spec, ctx) {
+    switch (spec.kind) {
+        case schema_1.SourceKind.Workspace:
+            return (0, workspace_1.resolveWorkspaceSource)(spec, ctx);
+        case schema_1.SourceKind.Distribution:
+            return (0, distribution_1.resolveDistributionSource)(spec, ctx);
+        case schema_1.SourceKind.Git:
+            return (0, git_1.resolveGitSource)(spec, ctx);
+        case schema_1.SourceKind.Npm:
+        case schema_1.SourceKind.Oci:
+            ctx.log?.(`source "${spec.name}" (${spec.kind}): install-time source — install it into a running ` +
+                `platform with \`xema biome install\`; it does not boot directly from \`xema up\`.`);
+            return null;
+    }
+}
+function describeSources(sources, credentials = new credentials_1.CredentialResolver()) {
+    return sources.map((spec) => {
+        const tokenEnv = 'authTokenEnv' in spec ? spec.authTokenEnv : undefined;
+        const launchTime = spec.kind !== schema_1.SourceKind.Npm && spec.kind !== schema_1.SourceKind.Oci;
+        return {
+            name: spec.name,
+            kind: spec.kind,
+            detail: detailFor(spec),
+            ...(tokenEnv !== undefined ? { tokenEnv } : {}),
+            tokenPresent: credentials.has(tokenEnv),
+            launchTime,
+        };
+    });
+}
+function detailFor(spec) {
+    switch (spec.kind) {
+        case schema_1.SourceKind.Workspace:
+            return spec.root ?? '(auto-detected monorepo root)';
+        case schema_1.SourceKind.Distribution:
+            return `edition ${spec.edition}${spec.ref ? ` @ ${spec.ref}` : ''}`;
+        case schema_1.SourceKind.Git:
+            return `${spec.url}${spec.ref ? `@${spec.ref}` : ''}`;
+        case schema_1.SourceKind.Npm:
+            return spec.registryUrl ?? 'https://registry.npmjs.org';
+        case schema_1.SourceKind.Oci:
+            return spec.registry;
+    }
+}
+//# sourceMappingURL=resolver.js.map

package/dist/runtime/sources/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../../src/runtime/sources/resolver.ts"],"names":[],"mappings":";;AAsBA,gDAyBC;AAoCD,0CAgBC;AAnGD,sCAAyD;AACzD,+CAAmD;AACnD,uDAAiE;AACjE,qCAA+C;AAC/C,iDAA2D;AAC3D,qCAAuD;AAiBvD,SAAgB,kBAAkB,CAChC,IAAe,EACf,OAA8B,EAC9B,GAAyB;IAEzB,MAAM,SAAS,GAAiB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,CAAC,IAAI,CAAC,IAAI,KAAK,mBAAU,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,KAAK,GAAG,IAAA,qBAAY,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACtC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,KAAK,GAAG,IAAA,qBAAY,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAGD,SAAS,UAAU,CAAC,IAAgB,EAAE,GAAyB;IAC7D,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,mBAAU,CAAC,SAAS;YACvB,OAAO,IAAA,kCAAsB,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3C,KAAK,mBAAU,CAAC,YAAY;YAC1B,OAAO,IAAA,wCAAyB,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9C,KAAK,mBAAU,CAAC,GAAG;YACjB,OAAO,IAAA,sBAAgB,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrC,KAAK,mBAAU,CAAC,GAAG,CAAC;QACpB,KAAK,mBAAU,CAAC,GAAG;YACjB,GAAG,CAAC,GAAG,EAAE,CACP,WAAW,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,qDAAqD;gBACtF,mFAAmF,CACtF,CAAC;YACF,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAiBD,SAAgB,eAAe,CAC7B,OAA8B,EAC9B,cAAkC,IAAI,gCAAkB,EAAE;IAE1D,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1B,MAAM,QAAQ,GAAG,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,KAAK,mBAAU,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAU,CAAC,GAAG,CAAC;QAChF,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC;YACvB,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,YAAY,EAAE,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;YACvC,UAAU;SACX,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,IAAgB;IACjC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,mBAAU,CAAC,SAAS;YACvB,OAAO,IAAI,CAAC,IAAI,IAAI,+BAA+B,CAAC;QACtD,KAAK,mBAAU,CAAC,YAAY;YAC1B,OAAO,WAAW,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACtE,KAAK,mBAAU,CAAC,GAAG;YACjB,OAAO,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACxD,KAAK,mBAAU,CAAC,GAAG;YACjB,OAAO,IAAI,CAAC,WAAW,IAAI,4BAA4B,CAAC;QAC1D,KAAK,mBAAU,CAAC,GAAG;YACjB,OAAO,IAAI,CAAC,QAAQ,CAAC;IACzB,CAAC;AACH,CAAC"}

package/dist/runtime/sources/schema.d.ts

@@ -0,0 +1,101 @@
+import { z } from 'zod';
+export declare enum SourceKind {
+    Workspace = "workspace",
+    Distribution = "distribution",
+    Npm = "npm",
+    Oci = "oci",
+    Git = "git"
+}
+export declare const WorkspaceSourceSchema: z.ZodObject<{
+    kind: z.ZodLiteral<SourceKind.Workspace>;
+    root: z.ZodOptional<z.ZodString>;
+    name: z.ZodString;
+}, z.core.$strict>;
+export type WorkspaceSource = z.infer<typeof WorkspaceSourceSchema>;
+export declare const DistributionSourceSchema: z.ZodObject<{
+    kind: z.ZodLiteral<SourceKind.Distribution>;
+    edition: z.ZodString;
+    ref: z.ZodOptional<z.ZodString>;
+    name: z.ZodString;
+}, z.core.$strict>;
+export type DistributionSource = z.infer<typeof DistributionSourceSchema>;
+export declare const NpmSourceSchema: z.ZodObject<{
+    kind: z.ZodLiteral<SourceKind.Npm>;
+    registryUrl: z.ZodOptional<z.ZodString>;
+    scope: z.ZodOptional<z.ZodString>;
+    authTokenEnv: z.ZodOptional<z.ZodString>;
+    name: z.ZodString;
+}, z.core.$strict>;
+export type NpmSource = z.infer<typeof NpmSourceSchema>;
+export declare const OciSourceSchema: z.ZodObject<{
+    kind: z.ZodLiteral<SourceKind.Oci>;
+    registry: z.ZodString;
+    authTokenEnv: z.ZodOptional<z.ZodString>;
+    name: z.ZodString;
+}, z.core.$strict>;
+export type OciSource = z.infer<typeof OciSourceSchema>;
+export declare const GitSourceSchema: z.ZodObject<{
+    kind: z.ZodLiteral<SourceKind.Git>;
+    url: z.ZodString;
+    ref: z.ZodOptional<z.ZodString>;
+    authTokenEnv: z.ZodOptional<z.ZodString>;
+    name: z.ZodString;
+}, z.core.$strict>;
+export type GitSource = z.infer<typeof GitSourceSchema>;
+export declare const SourceSpecSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<SourceKind.Workspace>;
+    root: z.ZodOptional<z.ZodString>;
+    name: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<SourceKind.Distribution>;
+    edition: z.ZodString;
+    ref: z.ZodOptional<z.ZodString>;
+    name: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<SourceKind.Npm>;
+    registryUrl: z.ZodOptional<z.ZodString>;
+    scope: z.ZodOptional<z.ZodString>;
+    authTokenEnv: z.ZodOptional<z.ZodString>;
+    name: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<SourceKind.Oci>;
+    registry: z.ZodString;
+    authTokenEnv: z.ZodOptional<z.ZodString>;
+    name: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<SourceKind.Git>;
+    url: z.ZodString;
+    ref: z.ZodOptional<z.ZodString>;
+    authTokenEnv: z.ZodOptional<z.ZodString>;
+    name: z.ZodString;
+}, z.core.$strict>], "kind">;
+export type SourceSpec = z.infer<typeof SourceSpecSchema>;
+export declare const SourcesConfigSchema: z.ZodDefault<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<SourceKind.Workspace>;
+    root: z.ZodOptional<z.ZodString>;
+    name: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<SourceKind.Distribution>;
+    edition: z.ZodString;
+    ref: z.ZodOptional<z.ZodString>;
+    name: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<SourceKind.Npm>;
+    registryUrl: z.ZodOptional<z.ZodString>;
+    scope: z.ZodOptional<z.ZodString>;
+    authTokenEnv: z.ZodOptional<z.ZodString>;
+    name: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<SourceKind.Oci>;
+    registry: z.ZodString;
+    authTokenEnv: z.ZodOptional<z.ZodString>;
+    name: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<SourceKind.Git>;
+    url: z.ZodString;
+    ref: z.ZodOptional<z.ZodString>;
+    authTokenEnv: z.ZodOptional<z.ZodString>;
+    name: z.ZodString;
+}, z.core.$strict>], "kind">>>;
+export type SourcesConfig = z.infer<typeof SourcesConfigSchema>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/runtime/sources/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/runtime/sources/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAyBxB,oBAAY,UAAU;IAEpB,SAAS,cAAc;IAEvB,YAAY,iBAAiB;IAE7B,GAAG,QAAQ;IAEX,GAAG,QAAQ;IAEX,GAAG,QAAQ;CACZ;AAeD,eAAO,MAAM,qBAAqB;;;;kBAMvB,CAAC;AACZ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAQpE,eAAO,MAAM,wBAAwB;;;;;kBAO1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAQ1E,eAAO,MAAM,eAAe;;;;;;kBAWjB,CAAC;AACZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAGxD,eAAO,MAAM,eAAe;;;;;kBAOjB,CAAC;AACZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAQxD,eAAO,MAAM,eAAe;;;;;;kBAQjB,CAAC;AACZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;4BAM3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAQ1D,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;8BAAwC,CAAC;AACzE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}