@xemahq/xema 0.25.1 → 0.27.0

package/dist/runtime/backing-registration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backing-registration.d.ts","sourceRoot":"","sources":["../../src/runtime/backing-registration.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,0BAA0B,EAEhC,MAAM,oCAAoC,CAAC;AAwD5C,MAAM,WAAW,yBAAyB;IAKxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IAErC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAW1C,QAAQ,CAAC,YAAY,EAAE,SAAS,0BAA0B,EAAE,CAAC;IAE7D,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC;AAmBD,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,yBAAyB,CAAC,CAyFpC"}
+{"version":3,"file":"backing-registration.d.ts","sourceRoot":"","sources":["../../src/runtime/backing-registration.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,0BAA0B,EAEhC,MAAM,oCAAoC,CAAC;AA2D5C,MAAM,WAAW,yBAAyB;IAKxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IAErC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAW1C,QAAQ,CAAC,YAAY,EAAE,SAAS,0BAA0B,EAAE,CAAC;IAE7D,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC;AAmCD,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,yBAAyB,CAAC,CAyFpC"}

package/dist/runtime/backing-registration.js

@@ -6,6 +6,11 @@ const kernel_state_runtime_1 = require("@xemahq/kernel-state-runtime");
 const service_registry_nest_1 = require("@xemahq/service-registry-nest");
 const RENEW_INTERVAL_SECONDS = 15;
 const MAX_CONSECUTIVE_RENEW_FAILURES = 3;
+function launcherEnvReader(etcdEndpoints) {
+    return (name) => name === kernel_state_runtime_1.KERNEL_STATE_ETCD_ENV_VARS.endpoints
+        ? etcdEndpoints.join(',')
+        : process.env[name];
+}
 async function registerBackingSubmodules(opts) {
     if (opts.etcdEndpoints.length === 0) {
         throw new Error('registerBackingSubmodules: no etcd endpoints provided — cannot register backing submodules.');
@@ -16,7 +21,7 @@ async function registerBackingSubmodules(opts) {
     const warn = opts.log ?? ((line) => console.warn(line));
     const kernelState = (0, kernel_state_runtime_1.createKernelState)({
         profile: kernel_state_runtime_1.KernelStateProfile.Cluster,
-        etcd: { endpoints: [...opts.etcdEndpoints] },
+        etcd: (0, kernel_state_runtime_1.etcdKernelStateOptionsFromEnv)(launcherEnvReader(opts.etcdEndpoints)),
     });
     if (!(kernelState instanceof kernel_state_runtime_1.EtcdKernelState)) {
         throw new Error('registerBackingSubmodules: expected an EtcdKernelState from the Cluster profile.');
@@ -56,7 +61,7 @@ async function registerBackingSubmodules(opts) {
             }
         });
     }, RENEW_INTERVAL_SECONDS * 1000);
-    renewTimer.unref?.();
+    renewTimer.unref();
     let closed = false;
     return {
         async close() {

package/dist/runtime/backing-registration.js.map

@@ -1 +1 @@
-{"version":3,"file":"backing-registration.js","sourceRoot":"","sources":["../../src/runtime/backing-registration.ts"],"names":[],"mappings":";;AAuGA,8DA2FC;AAlMD,yEAI4C;AAC5C,uEAIsC;AACtC,yEAA2E;AAyC3E,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAOlC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AA6ClC,KAAK,UAAU,yBAAyB,CAC7C,IAA4B;IAE5B,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAItE,MAAM,WAAW,GAAG,IAAA,wCAAiB,EAAC;QACpC,OAAO,EAAE,yCAAkB,CAAC,OAAO;QACnC,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,EAAE;KAC7C,CAAC,CAAC;IAIH,IAAI,CAAC,CAAC,WAAW,YAAY,sCAAe,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,kDAA0B,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAwB,EAAE,CAAC;IAE3C,IAAI,CAAC;QAEH,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3C,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5C,MAAM,UAAU,GAAG,IAAA,0CAAuB,EAAC,WAAW,EAAE,cAAc,CAAC,CAAC;YACxE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAClD,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,KAAK;aACN,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QAGb,MAAM,aAAa,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QAChD,WAAW,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE;QAClC,KAAK,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,IAAI,CACtC,GAAG,EAAE;YACH,mBAAmB,GAAG,CAAC,CAAC;QAC1B,CAAC,EACD,CAAC,GAAY,EAAE,EAAE;YACf,mBAAmB,IAAI,CAAC,CAAC;YACzB,IAAI,CACF,2CAA2C;gBACzC,IAAI,MAAM,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC,8BAA8B,CAAC,KAAK;gBAC9E,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACxD,CAAC;YACF,IAAI,mBAAmB,IAAI,8BAA8B,EAAE,CAAC;gBAC1D,IAAI,CACF,iCAAiC,MAAM,CAAC,8BAA8B,CAAC,GAAG;oBACxE,iGAAiG,CACpG,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAElC,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;IAErB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,OAAO;QACL,KAAK,CAAC,KAAK;YACT,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO;YACT,CAAC;YACD,MAAM,GAAG,IAAI,CAAC;YACd,aAAa,CAAC,UAAU,CAAC,CAAC;YAC1B,MAAM,aAAa,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;YAChD,WAAW,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,QAAoC,EACpC,UAAwC;IAExC,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,KAAK,CAAC,KAAK,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAAoC,EACpC,UAAwC,EACxC,IAA4B;IAE5B,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAIb,IAAI,CACF,wCAAwC,KAAK,CAAC,IAAI,YAAY;gBAC5D,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"backing-registration.js","sourceRoot":"","sources":["../../src/runtime/backing-registration.ts"],"names":[],"mappings":";;AA0HA,8DA2FC;AArND,yEAI4C;AAC5C,uEAOsC;AACtC,yEAA2E;AAyC3E,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAOlC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AAyCzC,SAAS,iBAAiB,CACxB,aAAgC;IAEhC,OAAO,CAAC,IAAI,EAAE,EAAE,CACd,IAAI,KAAK,iDAA0B,CAAC,SAAS;QAC3C,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QACzB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAaM,KAAK,UAAU,yBAAyB,CAC7C,IAA4B;IAE5B,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAItE,MAAM,WAAW,GAAG,IAAA,wCAAiB,EAAC;QACpC,OAAO,EAAE,yCAAkB,CAAC,OAAO;QACnC,IAAI,EAAE,IAAA,oDAA6B,EAAC,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;KAC3E,CAAC,CAAC;IAIH,IAAI,CAAC,CAAC,WAAW,YAAY,sCAAe,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,kDAA0B,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAwB,EAAE,CAAC;IAE3C,IAAI,CAAC;QAEH,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3C,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5C,MAAM,UAAU,GAAG,IAAA,0CAAuB,EAAC,WAAW,EAAE,cAAc,CAAC,CAAC;YACxE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAClD,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,KAAK;aACN,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QAGb,MAAM,aAAa,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QAChD,WAAW,CAAC,KAAK,EAAE,CAAC;QACpB,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE;QAClC,KAAK,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,IAAI,CACtC,GAAG,EAAE;YACH,mBAAmB,GAAG,CAAC,CAAC;QAC1B,CAAC,EACD,CAAC,GAAY,EAAE,EAAE;YACf,mBAAmB,IAAI,CAAC,CAAC;YACzB,IAAI,CACF,2CAA2C;gBACzC,IAAI,MAAM,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC,8BAA8B,CAAC,KAAK;gBAC9E,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACxD,CAAC;YACF,IAAI,mBAAmB,IAAI,8BAA8B,EAAE,CAAC;gBAC1D,IAAI,CACF,iCAAiC,MAAM,CAAC,8BAA8B,CAAC,GAAG;oBACxE,iGAAiG,CACpG,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC,EAAE,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAElC,UAAU,CAAC,KAAK,EAAE,CAAC;IAEnB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,OAAO;QACL,KAAK,CAAC,KAAK;YACT,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO;YACT,CAAC;YACD,MAAM,GAAG,IAAI,CAAC;YACd,aAAa,CAAC,UAAU,CAAC,CAAC;YAC1B,MAAM,aAAa,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;YAChD,WAAW,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,QAAoC,EACpC,UAAwC;IAExC,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,KAAK,CAAC,KAAK,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,QAAoC,EACpC,UAAwC,EACxC,IAA4B;IAE5B,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAIb,IAAI,CACF,wCAAwC,KAAK,CAAC,IAAI,YAAY;gBAC5D,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/runtime/config/schema.d.ts

@@ -223,6 +223,7 @@ export declare const XemaConfigSchema: z.ZodObject<{
         url: z.ZodString;
         ref: z.ZodOptional<z.ZodString>;
         authTokenEnv: z.ZodOptional<z.ZodString>;
+        authUsername: z.ZodOptional<z.ZodString>;
         name: z.ZodString;
     }, z.core.$strict>], "kind">>>;
     cli: z.ZodOptional<z.ZodObject<{

package/dist/runtime/config/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/runtime/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB,oBAAY,SAAS;IAEnB,OAAO,YAAY;IAEnB,QAAQ,aAAa;IAMrB,QAAQ,aAAa;CACtB;AAGD,oBAAY,SAAS;IACnB,SAAS,cAAc;IACvB,MAAM,WAAW;IAEjB,IAAI,SAAS;CACd;AASD,oBAAY,YAAY;IACtB,WAAW,gBAAgB;CAC5B;AAGD,oBAAY,cAAc;IACxB,QAAQ,aAAa;IACrB,KAAK,UAAU;IACf,IAAI,SAAS;IACb,QAAQ,aAAa;IACrB,WAAW,gBAAgB;IAC3B,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,QAAQ,aAAa;CACtB;AAGD,oBAAY,eAAe;IAEzB,WAAW,iBAAiB;IAE5B,QAAQ,cAAc;CACvB;AAGD,oBAAY,YAAY;IACtB,MAAM,WAAW;IACjB,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAWD,oBAAY,kBAAkB;IAM5B,IAAI,SAAS;IAKb,IAAI,SAAS;IAKb,WAAW,iBAAiB;CAC7B;AAQD,oBAAY,4BAA4B;IACtC,QAAQ,cAAc;IACtB,WAAW,iBAAiB;IAC5B,IAAI,SAAS;CACd;AAgBD,QAAA,MAAM,0BAA0B;;;;;;;;;kBASrB,CAAC;AACZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AA+E9E,QAAA,MAAM,eAAe;;;;;;;;;;kBAeV,CAAC;AACZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,QAAA,MAAM,iBAAiB;;;;;;;;kBAcZ,CAAC;AACZ,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,QAAA,MAAM,kBAAkB;;;;kBA6BpB,CAAC;AACL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAY9D,QAAA,MAAM,eAAe;;kBAIV,CAAC;AACZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AASxD,QAAA,MAAM,kBAAkB;;kBAIb,CAAC;AACZ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAQ9D,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,YAAY,GAAG,SAAS,GAC/B,4BAA4B,CAG9B;AAED,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmClB,CAAC;AAEZ,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAG1D,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,CAUxD"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/runtime/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB,oBAAY,SAAS;IAEnB,OAAO,YAAY;IAEnB,QAAQ,aAAa;IAMrB,QAAQ,aAAa;CACtB;AAGD,oBAAY,SAAS;IACnB,SAAS,cAAc;IACvB,MAAM,WAAW;IAEjB,IAAI,SAAS;CACd;AASD,oBAAY,YAAY;IACtB,WAAW,gBAAgB;CAC5B;AAGD,oBAAY,cAAc;IACxB,QAAQ,aAAa;IACrB,KAAK,UAAU;IACf,IAAI,SAAS;IACb,QAAQ,aAAa;IACrB,WAAW,gBAAgB;IAC3B,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,QAAQ,aAAa;CACtB;AAGD,oBAAY,eAAe;IAEzB,WAAW,iBAAiB;IAE5B,QAAQ,cAAc;CACvB;AAGD,oBAAY,YAAY;IACtB,MAAM,WAAW;IACjB,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAWD,oBAAY,kBAAkB;IAM5B,IAAI,SAAS;IAKb,IAAI,SAAS;IAKb,WAAW,iBAAiB;CAC7B;AAQD,oBAAY,4BAA4B;IACtC,QAAQ,cAAc;IACtB,WAAW,iBAAiB;IAC5B,IAAI,SAAS;CACd;AAgBD,QAAA,MAAM,0BAA0B;;;;;;;;;kBASrB,CAAC;AACZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AA+E9E,QAAA,MAAM,eAAe;;;;;;;;;;kBAeV,CAAC;AACZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,QAAA,MAAM,iBAAiB;;;;;;;;kBAcZ,CAAC;AACZ,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,QAAA,MAAM,kBAAkB;;;;kBA6BpB,CAAC;AACL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAY9D,QAAA,MAAM,eAAe;;kBAIV,CAAC;AACZ,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AASxD,QAAA,MAAM,kBAAkB;;kBAIb,CAAC;AACZ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAQ9D,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,YAAY,GAAG,SAAS,GAC/B,4BAA4B,CAG9B;AAED,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAmClB,CAAC;AAEZ,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAG1D,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,UAAU,CAUxD"}

package/dist/runtime/custody/local-custody.d.ts

@@ -0,0 +1,12 @@
+import { DockerCli } from '../runner/docker-cli';
+export interface LocalCustodyBinding {
+    readonly brokerToken: string;
+}
+export interface ProvisionLocalCustodyOptions {
+    readonly network: string;
+    readonly installationId: string;
+    readonly installationIdentity: string;
+    readonly docker?: DockerCli;
+}
+export declare function provisionLocalCustody(opts: ProvisionLocalCustodyOptions): Promise<LocalCustodyBinding>;
+//# sourceMappingURL=local-custody.d.ts.map

package/dist/runtime/custody/local-custody.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-custody.d.ts","sourceRoot":"","sources":["../../../src/runtime/custody/local-custody.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGjD,MAAM,WAAW,mBAAmB;IAElC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;CAC7B;AAMD,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,4BAA4B,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAe9B"}

package/dist/runtime/custody/local-custody.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.provisionLocalCustody = provisionLocalCustody;
+const openbao_custody_bootstrap_1 = require("./openbao-custody-bootstrap");
+const openbao_custody_store_1 = require("./openbao-custody-store");
+const openbao_http_client_1 = require("./openbao-http-client");
+const openbao_local_runner_1 = require("./openbao-local-runner");
+const docker_cli_1 = require("../runner/docker-cli");
+async function provisionLocalCustody(opts) {
+    const client = new openbao_http_client_1.OpenBaoHttpClient();
+    await new openbao_local_runner_1.OpenBaoLocalRunner({
+        docker: opts.docker ?? new docker_cli_1.DockerCli(),
+        network: opts.network,
+        installationId: opts.installationId,
+        health: () => client.health(),
+    }).start();
+    const brokerToken = await (0, openbao_custody_bootstrap_1.ensureLocalOpenBaoCustody)(client, new openbao_custody_store_1.OpenBaoCustodyStore({
+        installationIdentity: opts.installationIdentity,
+    }));
+    return { brokerToken };
+}
+//# sourceMappingURL=local-custody.js.map

package/dist/runtime/custody/local-custody.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-custody.js","sourceRoot":"","sources":["../../../src/runtime/custody/local-custody.ts"],"names":[],"mappings":";;AAwBA,sDAiBC;AAzCD,2EAAwE;AACxE,mEAA8D;AAC9D,+DAA0D;AAC1D,iEAA4D;AAC5D,qDAAiD;AAoB1C,KAAK,UAAU,qBAAqB,CACzC,IAAkC;IAElC,MAAM,MAAM,GAAG,IAAI,uCAAiB,EAAE,CAAC;IACvC,MAAM,IAAI,yCAAkB,CAAC;QAC3B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,sBAAS,EAAE;QACtC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE;KAC9B,CAAC,CAAC,KAAK,EAAE,CAAC;IACX,MAAM,WAAW,GAAG,MAAM,IAAA,qDAAyB,EACjD,MAAM,EACN,IAAI,2CAAmB,CAAC;QACtB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;KAChD,CAAC,CACH,CAAC;IACF,OAAO,EAAE,WAAW,EAAE,CAAC;AACzB,CAAC"}

package/dist/runtime/custody/openbao-custody-bootstrap.d.ts

@@ -0,0 +1,18 @@
+import type { OpenBaoHealth, OpenBaoInitMaterial, OpenBaoScopedToken } from './openbao-http-client';
+export interface OpenBaoBootstrapApi {
+    health(): Promise<OpenBaoHealth>;
+    initialize(shares: number, threshold: number): Promise<OpenBaoInitMaterial>;
+    unseal(key: string): Promise<boolean>;
+    ensureKvV2Mount(token: string, mountPath: string): Promise<void>;
+    putPolicy(token: string, name: string, hcl: string): Promise<void>;
+    createScopedToken(token: string, policy: string, ttl: string): Promise<OpenBaoScopedToken>;
+    listTokenAccessors(token: string): Promise<string[]>;
+    lookupTokenPolicies(token: string, accessor: string): Promise<string[]>;
+    revokeTokenAccessor(token: string, accessor: string): Promise<void>;
+}
+export interface OpenBaoInitMaterialStore {
+    load(): Promise<OpenBaoInitMaterial | undefined>;
+    create(material: OpenBaoInitMaterial): Promise<boolean>;
+}
+export declare function ensureLocalOpenBaoCustody(api: OpenBaoBootstrapApi, store: OpenBaoInitMaterialStore): Promise<string>;
+//# sourceMappingURL=openbao-custody-bootstrap.d.ts.map

package/dist/runtime/custody/openbao-custody-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openbao-custody-bootstrap.d.ts","sourceRoot":"","sources":["../../../src/runtime/custody/openbao-custody-bootstrap.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EACnB,MAAM,uBAAuB,CAAC;AAG/B,MAAM,WAAW,mBAAmB;IAClC,MAAM,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IACjC,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC5E,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACtC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,iBAAiB,CACf,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/B,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrE;AAGD,MAAM,WAAW,wBAAwB;IACvC,IAAI,IAAI,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAAC;IACjD,MAAM,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzD;AAuBD,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,mBAAmB,EACxB,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,MAAM,CAAC,CA+CjB"}

package/dist/runtime/custody/openbao-custody-bootstrap.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureLocalOpenBaoCustody = ensureLocalOpenBaoCustody;
+const openbao_local_constants_1 = require("./openbao-local-constants");
+const PURGE_HINT = 'Run `xema down --purge` to discard the local vault and its keys, then launch again.';
+async function ensureLocalOpenBaoCustody(api, store) {
+    const health = await api.health();
+    let material = await store.load();
+    if (!health.initialized) {
+        if (material !== undefined) {
+            throw new Error('The local OpenBao is uninitialised but its init material is still on disk, ' +
+                `so its data volume was removed outside the launcher. ${PURGE_HINT}`);
+        }
+        const created = await api.initialize(openbao_local_constants_1.UNSEAL_SHARES, openbao_local_constants_1.UNSEAL_THRESHOLD);
+        if (!(await store.create(created))) {
+            throw new Error('The local OpenBao was initialised but another launcher already stored init ' +
+                `material for this installation; the keys just created are lost. ${PURGE_HINT}`);
+        }
+        material = created;
+    }
+    else if (material === undefined) {
+        throw new Error('The local OpenBao is already initialised but this installation holds no ' +
+            `unseal key or root token for it. ${PURGE_HINT}`);
+    }
+    const current = await api.health();
+    if (current.sealed) {
+        const stillSealed = await api.unseal(material.unsealKey);
+        if (stillSealed) {
+            throw new Error('The local OpenBao stayed sealed after the stored unseal key was applied. ' +
+                PURGE_HINT);
+        }
+    }
+    await api.ensureKvV2Mount(material.rootToken, openbao_local_constants_1.LOCAL_OPENBAO_MOUNT_PATH);
+    await api.putPolicy(material.rootToken, openbao_local_constants_1.BROKER_POLICY_NAME, openbao_local_constants_1.BROKER_POLICY_HCL);
+    const minted = await api.createScopedToken(material.rootToken, openbao_local_constants_1.BROKER_POLICY_NAME, openbao_local_constants_1.BROKER_TOKEN_TTL);
+    await revokeSupersededBrokerTokens(api, material.rootToken, minted.accessor);
+    return minted.token;
+}
+async function revokeSupersededBrokerTokens(api, rootToken, keepAccessor) {
+    for (const accessor of await api.listTokenAccessors(rootToken)) {
+        if (accessor === keepAccessor) {
+            continue;
+        }
+        const policies = await api.lookupTokenPolicies(rootToken, accessor);
+        if (policies.includes(openbao_local_constants_1.BROKER_POLICY_NAME)) {
+            await api.revokeTokenAccessor(rootToken, accessor);
+        }
+    }
+}
+//# sourceMappingURL=openbao-custody-bootstrap.js.map

package/dist/runtime/custody/openbao-custody-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openbao-custody-bootstrap.js","sourceRoot":"","sources":["../../../src/runtime/custody/openbao-custody-bootstrap.ts"],"names":[],"mappings":";;AA2DA,8DAkDC;AA7GD,uEAOmC;AA+BnC,MAAM,UAAU,GACd,qFAAqF,CAAC;AAoBjF,KAAK,UAAU,yBAAyB,CAC7C,GAAwB,EACxB,KAA+B;IAE/B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;IAClC,IAAI,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IAElC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,6EAA6E;gBAC3E,wDAAwD,UAAU,EAAE,CACvE,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,uCAAa,EAAE,0CAAgB,CAAC,CAAC;QAEtE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACb,6EAA6E;gBAC3E,mEAAmE,UAAU,EAAE,CAClF,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,OAAO,CAAC;IACrB,CAAC;SAAM,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,0EAA0E;YACxE,oCAAoC,UAAU,EAAE,CACnD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;IACnC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACb,2EAA2E;gBACzE,UAAU,CACb,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC,SAAS,EAAE,kDAAwB,CAAC,CAAC;IACxE,MAAM,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,EAAE,4CAAkB,EAAE,2CAAiB,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,iBAAiB,CACxC,QAAQ,CAAC,SAAS,EAClB,4CAAkB,EAClB,0CAAgB,CACjB,CAAC;IACF,MAAM,4BAA4B,CAAC,GAAG,EAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7E,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,GAAwB,EACxB,SAAiB,EACjB,YAAoB;IAEpB,KAAK,MAAM,QAAQ,IAAI,MAAM,GAAG,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/D,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,mBAAmB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACpE,IAAI,QAAQ,CAAC,QAAQ,CAAC,4CAAkB,CAAC,EAAE,CAAC;YAE1C,MAAM,GAAG,CAAC,mBAAmB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/runtime/custody/openbao-custody-store.d.ts

@@ -0,0 +1,18 @@
+import { type ManagedLocalKeyProvider } from '../secrets/managed-local-key-provider';
+import type { OpenBaoInitMaterial } from './openbao-http-client';
+export interface OpenBaoCustodyStoreOptions {
+    readonly installationIdentity: string;
+    readonly stateRoot?: string;
+    readonly keyProvider?: ManagedLocalKeyProvider;
+}
+export declare class OpenBaoCustodyStore {
+    readonly installationId: string;
+    readonly directory: string;
+    readonly path: string;
+    private readonly keyProvider;
+    constructor(opts: OpenBaoCustodyStoreOptions);
+    load(): Promise<OpenBaoInitMaterial | undefined>;
+    create(material: OpenBaoInitMaterial): Promise<boolean>;
+    purge(): Promise<boolean>;
+}
+//# sourceMappingURL=openbao-custody-store.d.ts.map

package/dist/runtime/custody/openbao-custody-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openbao-custody-store.d.ts","sourceRoot":"","sources":["../../../src/runtime/custody/openbao-custody-store.ts"],"names":[],"mappings":"AAaA,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,uCAAuC,CAAC;AAE/C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAMjE,MAAM,WAAW,0BAA0B;IAEzC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IAEtC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,uBAAuB,CAAC;CAChD;AAWD,qBAAa,mBAAmB;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA0B;gBAE1C,IAAI,EAAE,0BAA0B;IAWtC,IAAI,IAAI,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAoBhD,MAAM,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC;IAgBvD,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC;CAGhC"}

package/dist/runtime/custody/openbao-custody-store.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OpenBaoCustodyStore = void 0;
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const managed_local_cipher_1 = require("../secrets/managed-local-cipher");
+const managed_local_files_1 = require("../secrets/managed-local-files");
+const managed_local_key_provider_1 = require("../secrets/managed-local-key-provider");
+const CUSTODY_FILE = 'openbao-custody.json';
+const CUSTODY_LABEL = 'Local OpenBao init material';
+const CUSTODY_CONTEXT = 'openbao-init-material';
+class OpenBaoCustodyStore {
+    installationId;
+    directory;
+    path;
+    keyProvider;
+    constructor(opts) {
+        this.installationId = (0, managed_local_cipher_1.managedLocalInstallationId)(opts.installationIdentity);
+        const root = opts.stateRoot ?? (0, node_path_1.join)((0, node_os_1.homedir)(), '.xema', 'installations');
+        this.directory = (0, node_path_1.join)(root, this.installationId);
+        this.path = (0, node_path_1.join)(this.directory, CUSTODY_FILE);
+        this.keyProvider =
+            opts.keyProvider ?? (0, managed_local_key_provider_1.configuredManagedLocalKeyProvider)(process.env);
+    }
+    async load() {
+        const raw = await (0, managed_local_files_1.readManagedLocalFile)(this.directory, this.path, CUSTODY_LABEL);
+        if (raw === undefined) {
+            return undefined;
+        }
+        const value = await (0, managed_local_cipher_1.decryptManagedLocalRecord)(raw, this.installationId, CUSTODY_CONTEXT, this.path, this.keyProvider);
+        return parseMaterial(value, this.path);
+    }
+    async create(material) {
+        const record = await (0, managed_local_cipher_1.encryptManagedLocalRecord)(material, this.installationId, CUSTODY_CONTEXT, this.keyProvider);
+        return (0, managed_local_files_1.createManagedLocalFile)(this.directory, this.path, `${JSON.stringify(record)}\n`, CUSTODY_LABEL);
+    }
+    async purge() {
+        return (0, managed_local_files_1.deleteManagedLocalFile)(this.directory, this.path, CUSTODY_LABEL);
+    }
+}
+exports.OpenBaoCustodyStore = OpenBaoCustodyStore;
+function parseMaterial(value, path) {
+    const record = (typeof value === 'object' ? value : null);
+    const unsealKey = record?.unsealKey;
+    const rootToken = record?.rootToken;
+    if (typeof unsealKey !== 'string' ||
+        unsealKey.length === 0 ||
+        typeof rootToken !== 'string' ||
+        rootToken.length === 0) {
+        throw new Error(`Local OpenBao init material has an unsupported or incomplete format at ${path}. ` +
+            'Run `xema down --purge` to discard the local vault and launch again.');
+    }
+    return { unsealKey, rootToken };
+}
+//# sourceMappingURL=openbao-custody-store.js.map

package/dist/runtime/custody/openbao-custody-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openbao-custody-store.js","sourceRoot":"","sources":["../../../src/runtime/custody/openbao-custody-store.ts"],"names":[],"mappings":";;;AAAA,qCAAkC;AAClC,yCAAiC;AAEjC,0EAIyC;AACzC,wEAIwC;AACxC,sFAG+C;AAI/C,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAC5C,MAAM,aAAa,GAAG,6BAA6B,CAAC;AACpD,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAmBhD,MAAa,mBAAmB;IACrB,cAAc,CAAS;IACvB,SAAS,CAAS;IAClB,IAAI,CAAS;IACL,WAAW,CAA0B;IAEtD,YAAY,IAAgC;QAC1C,IAAI,CAAC,cAAc,GAAG,IAAA,iDAA0B,EAC9C,IAAI,CAAC,oBAAoB,CAC1B,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,IAAI,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;QACzE,IAAI,CAAC,SAAS,GAAG,IAAA,gBAAI,EAAC,IAAI,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,IAAA,gBAAI,EAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAC/C,IAAI,CAAC,WAAW;YACd,IAAI,CAAC,WAAW,IAAI,IAAA,8DAAiC,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,GAAG,GAAG,MAAM,IAAA,0CAAoB,EACpC,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,IAAI,EACT,aAAa,CACd,CAAC;QACF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAA,gDAAyB,EAC3C,GAAG,EACH,IAAI,CAAC,cAAc,EACnB,eAAe,EACf,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,WAAW,CACjB,CAAC;QACF,OAAO,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAGD,KAAK,CAAC,MAAM,CAAC,QAA6B;QACxC,MAAM,MAAM,GAAG,MAAM,IAAA,gDAAyB,EAC5C,QAAQ,EACR,IAAI,CAAC,cAAc,EACnB,eAAe,EACf,IAAI,CAAC,WAAW,CACjB,CAAC;QACF,OAAO,IAAA,4CAAsB,EAC3B,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,IAAI,EACT,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAC7B,aAAa,CACd,CAAC;IACJ,CAAC;IAGD,KAAK,CAAC,KAAK;QACT,OAAO,IAAA,4CAAsB,EAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC1E,CAAC;CACF;AAxDD,kDAwDC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,IAAY;IACjD,MAAM,MAAM,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAGhD,CAAC;IACT,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,CAAC;IACpC,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,CAAC;IACpC,IACE,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,CAAC,MAAM,KAAK,CAAC;QACtB,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,CAAC,MAAM,KAAK,CAAC,EACtB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,0EAA0E,IAAI,IAAI;YAChF,sEAAsE,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAClC,CAAC"}

package/dist/runtime/custody/openbao-http-client.d.ts

@@ -0,0 +1,34 @@
+export interface OpenBaoHealth {
+    readonly initialized: boolean;
+    readonly sealed: boolean;
+}
+export interface OpenBaoInitMaterial {
+    readonly unsealKey: string;
+    readonly rootToken: string;
+}
+export interface OpenBaoScopedToken {
+    readonly token: string;
+    readonly accessor: string;
+}
+export type OpenBaoFetch = typeof fetch;
+export declare class OpenBaoHttpError extends Error {
+    readonly operation: string;
+    readonly status: number | undefined;
+    constructor(operation: string, status: number | undefined);
+}
+export declare class OpenBaoHttpClient {
+    private readonly baseUrl;
+    private readonly fetchImpl;
+    constructor(baseUrl?: string, fetchImpl?: OpenBaoFetch);
+    health(): Promise<OpenBaoHealth>;
+    initialize(shares: number, threshold: number): Promise<OpenBaoInitMaterial>;
+    unseal(key: string): Promise<boolean>;
+    ensureKvV2Mount(token: string, mountPath: string): Promise<void>;
+    putPolicy(token: string, name: string, hcl: string): Promise<void>;
+    createScopedToken(token: string, policy: string, ttl: string): Promise<OpenBaoScopedToken>;
+    listTokenAccessors(token: string): Promise<string[]>;
+    lookupTokenPolicies(token: string, accessor: string): Promise<string[]>;
+    revokeTokenAccessor(token: string, accessor: string): Promise<void>;
+    private call;
+}
+//# sourceMappingURL=openbao-http-client.d.ts.map

package/dist/runtime/custody/openbao-http-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openbao-http-client.d.ts","sourceRoot":"","sources":["../../../src/runtime/custody/openbao-http-client.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAGD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,YAAY,GAAG,OAAO,KAAK,CAAC;AAWxC,qBAAa,gBAAiB,SAAQ,KAAK;IAEvC,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS;gBAD1B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GAAG,SAAS;CAStC;AAED,qBAAa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,OAAO,GAAE,MAAyD,EAClE,SAAS,GAAE,YAAoB;IAI5C,MAAM,IAAI,OAAO,CAAC,aAAa,CAAC;IAehC,UAAU,CACd,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,mBAAmB,CAAC;IAezB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYrC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBhE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQlE,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,kBAAkB,CAAC;IA0BxB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAkBpD,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAiBvE,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAS3D,IAAI;CA8BnB"}

package/dist/runtime/custody/openbao-http-client.js

@@ -0,0 +1,154 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OpenBaoHttpClient = exports.OpenBaoHttpError = void 0;
+const openbao_local_constants_1 = require("./openbao-local-constants");
+const REQUEST_TIMEOUT_MS = 5_000;
+const INIT_TIMEOUT_MS = 60_000;
+const TOKEN_HEADER = 'X-Vault-Token';
+class OpenBaoHttpError extends Error {
+    operation;
+    status;
+    constructor(operation, status) {
+        super(status === undefined
+            ? `OpenBao ${operation} could not reach the server.`
+            : `OpenBao ${operation} failed with HTTP ${String(status)}.`);
+        this.operation = operation;
+        this.status = status;
+        this.name = 'OpenBaoHttpError';
+    }
+}
+exports.OpenBaoHttpError = OpenBaoHttpError;
+class OpenBaoHttpClient {
+    baseUrl;
+    fetchImpl;
+    constructor(baseUrl = `http://127.0.0.1:${String(openbao_local_constants_1.LOCAL_OPENBAO_PORT)}`, fetchImpl = fetch) {
+        this.baseUrl = baseUrl;
+        this.fetchImpl = fetchImpl;
+    }
+    async health() {
+        const body = await this.call('health', 'GET', '/v1/sys/health?standbyok=true&sealedcode=200&uninitcode=200');
+        const initialized = field(body, 'initialized');
+        const sealed = field(body, 'sealed');
+        if (typeof initialized !== 'boolean' || typeof sealed !== 'boolean') {
+            throw new OpenBaoHttpError('health (unexpected response shape)', 200);
+        }
+        return { initialized, sealed };
+    }
+    async initialize(shares, threshold) {
+        const body = await this.call('init', 'PUT', '/v1/sys/init', {
+            body: { secret_shares: shares, secret_threshold: threshold },
+            timeoutMs: INIT_TIMEOUT_MS,
+        });
+        const keys = field(body, 'keys_base64');
+        const rootToken = field(body, 'root_token');
+        const unsealKey = Array.isArray(keys) ? keys[0] : undefined;
+        if (typeof unsealKey !== 'string' || typeof rootToken !== 'string') {
+            throw new OpenBaoHttpError('init (unexpected response shape)', 200);
+        }
+        return { unsealKey, rootToken };
+    }
+    async unseal(key) {
+        const body = await this.call('unseal', 'PUT', '/v1/sys/unseal', {
+            body: { key },
+        });
+        const sealed = field(body, 'sealed');
+        if (typeof sealed !== 'boolean') {
+            throw new OpenBaoHttpError('unseal (unexpected response shape)', 200);
+        }
+        return sealed;
+    }
+    async ensureKvV2Mount(token, mountPath) {
+        const mounts = await this.call('list mounts', 'GET', '/v1/sys/mounts', {
+            token,
+        });
+        const existing = field(field(mounts, 'data'), `${mountPath}/`);
+        if (existing !== undefined) {
+            const options = field(existing, 'options');
+            if (field(existing, 'type') !== 'kv' || field(options, 'version') !== '2') {
+                throw new Error(`OpenBao mount "${mountPath}/" exists but is not a KV v2 engine; ` +
+                    'run `xema down --purge` to discard the local vault and launch again.');
+            }
+            return;
+        }
+        await this.call('mount kv v2', 'POST', `/v1/sys/mounts/${mountPath}`, {
+            token,
+            body: { type: 'kv', options: { version: '2' } },
+        });
+    }
+    async putPolicy(token, name, hcl) {
+        await this.call('write policy', 'PUT', `/v1/sys/policies/acl/${name}`, {
+            token,
+            body: { policy: hcl },
+        });
+    }
+    async createScopedToken(token, policy, ttl) {
+        const body = await this.call('create token', 'POST', '/v1/auth/token/create', {
+            token,
+            body: {
+                policies: [policy],
+                ttl,
+                renewable: false,
+                no_parent: true,
+                display_name: 'xema-credential-broker',
+            },
+        });
+        const auth = field(body, 'auth');
+        const clientToken = field(auth, 'client_token');
+        const accessor = field(auth, 'accessor');
+        if (typeof clientToken !== 'string' ||
+            clientToken.length === 0 ||
+            typeof accessor !== 'string' ||
+            accessor.length === 0) {
+            throw new OpenBaoHttpError('create token (unexpected response shape)', 200);
+        }
+        return { token: clientToken, accessor };
+    }
+    async listTokenAccessors(token) {
+        const body = await this.call('list token accessors', 'GET', '/v1/auth/token/accessors?list=true', { token });
+        const keys = field(field(body, 'data'), 'keys');
+        if (!Array.isArray(keys) || keys.some((k) => typeof k !== 'string')) {
+            throw new OpenBaoHttpError('list token accessors (unexpected response shape)', 200);
+        }
+        return keys;
+    }
+    async lookupTokenPolicies(token, accessor) {
+        const body = await this.call('lookup token accessor', 'POST', '/v1/auth/token/lookup-accessor', { token, body: { accessor } });
+        const policies = field(field(body, 'data'), 'policies');
+        if (!Array.isArray(policies) || policies.some((p) => typeof p !== 'string')) {
+            throw new OpenBaoHttpError('lookup token accessor (unexpected response shape)', 200);
+        }
+        return policies;
+    }
+    async revokeTokenAccessor(token, accessor) {
+        await this.call('revoke token accessor', 'POST', '/v1/auth/token/revoke-accessor', { token, body: { accessor } });
+    }
+    async call(operation, method, path, opts = {}) {
+        let response;
+        try {
+            response = await this.fetchImpl(`${this.baseUrl}${path}`, {
+                method,
+                headers: {
+                    'content-type': 'application/json',
+                    ...(opts.token === undefined ? {} : { [TOKEN_HEADER]: opts.token }),
+                },
+                ...(opts.body === undefined ? {} : { body: JSON.stringify(opts.body) }),
+                signal: AbortSignal.timeout(opts.timeoutMs ?? REQUEST_TIMEOUT_MS),
+            });
+        }
+        catch {
+            throw new OpenBaoHttpError(operation, undefined);
+        }
+        if (!response.ok) {
+            throw new OpenBaoHttpError(operation, response.status);
+        }
+        const text = await response.text();
+        return text.length === 0 ? undefined : JSON.parse(text);
+    }
+}
+exports.OpenBaoHttpClient = OpenBaoHttpClient;
+function field(value, name) {
+    return typeof value === 'object' && value !== null
+        ? value[name]
+        : undefined;
+}
+//# sourceMappingURL=openbao-http-client.js.map

package/dist/runtime/custody/openbao-http-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openbao-http-client.js","sourceRoot":"","sources":["../../../src/runtime/custody/openbao-http-client.ts"],"names":[],"mappings":";;;AAAA,uEAA+D;AAyB/D,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAMjC,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,YAAY,GAAG,eAAe,CAAC;AAErC,MAAa,gBAAiB,SAAQ,KAAK;IAE9B;IACA;IAFX,YACW,SAAiB,EACjB,MAA0B;QAEnC,KAAK,CACH,MAAM,KAAK,SAAS;YAClB,CAAC,CAAC,WAAW,SAAS,8BAA8B;YACpD,CAAC,CAAC,WAAW,SAAS,qBAAqB,MAAM,CAAC,MAAM,CAAC,GAAG,CAC/D,CAAC;QAPO,cAAS,GAAT,SAAS,CAAQ;QACjB,WAAM,GAAN,MAAM,CAAoB;QAOnC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAZD,4CAYC;AAED,MAAa,iBAAiB;IAET;IACA;IAFnB,YACmB,UAAkB,oBAAoB,MAAM,CAAC,4CAAkB,CAAC,EAAE,EAClE,YAA0B,KAAK;QAD/B,YAAO,GAAP,OAAO,CAA2D;QAClE,cAAS,GAAT,SAAS,CAAsB;IAC/C,CAAC;IAGJ,KAAK,CAAC,MAAM;QACV,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAC1B,QAAQ,EACR,KAAK,EACL,6DAA6D,CAC9D,CAAC;QACF,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACrC,IAAI,OAAO,WAAW,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE,CAAC;YACpE,MAAM,IAAI,gBAAgB,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IACjC,CAAC;IAGD,KAAK,CAAC,UAAU,CACd,MAAc,EACd,SAAiB;QAEjB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE;YAC1D,IAAI,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE;YAC5D,SAAS,EAAE,eAAe;SAC3B,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,CAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YACnE,MAAM,IAAI,gBAAgB,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAClC,CAAC;IAGD,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,gBAAgB,EAAE;YAC9D,IAAI,EAAE,EAAE,GAAG,EAAE;SACd,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACrC,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,gBAAgB,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAGD,KAAK,CAAC,eAAe,CAAC,KAAa,EAAE,SAAiB;QACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,gBAAgB,EAAE;YACrE,KAAK;SACN,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,SAAS,GAAG,CAAC,CAAC;QAC/D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YAC3C,IAAI,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC1E,MAAM,IAAI,KAAK,CACb,kBAAkB,SAAS,uCAAuC;oBAChE,sEAAsE,CACzE,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,kBAAkB,SAAS,EAAE,EAAE;YACpE,KAAK;YACL,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;SAChD,CAAC,CAAC;IACL,CAAC;IAGD,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,IAAY,EAAE,GAAW;QACtD,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,wBAAwB,IAAI,EAAE,EAAE;YACrE,KAAK;YACL,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IAGD,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,MAAc,EACd,GAAW;QAEX,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,uBAAuB,EAAE;YAC5E,KAAK;YACL,IAAI,EAAE;gBACJ,QAAQ,EAAE,CAAC,MAAM,CAAC;gBAClB,GAAG;gBACH,SAAS,EAAE,KAAK;gBAChB,SAAS,EAAE,IAAI;gBACf,YAAY,EAAE,wBAAwB;aACvC;SACF,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACjC,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACzC,IACE,OAAO,WAAW,KAAK,QAAQ;YAC/B,WAAW,CAAC,MAAM,KAAK,CAAC;YACxB,OAAO,QAAQ,KAAK,QAAQ;YAC5B,QAAQ,CAAC,MAAM,KAAK,CAAC,EACrB,CAAC;YACD,MAAM,IAAI,gBAAgB,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;IAC1C,CAAC;IAGD,KAAK,CAAC,kBAAkB,CAAC,KAAa;QACpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAC1B,sBAAsB,EACtB,KAAK,EACL,oCAAoC,EACpC,EAAE,KAAK,EAAE,CACV,CAAC;QACF,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,gBAAgB,CACxB,kDAAkD,EAClD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,OAAO,IAAgB,CAAC;IAC1B,CAAC;IAGD,KAAK,CAAC,mBAAmB,CAAC,KAAa,EAAE,QAAgB;QACvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAC1B,uBAAuB,EACvB,MAAM,EACN,gCAAgC,EAChC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAC9B,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,gBAAgB,CACxB,mDAAmD,EACnD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,OAAO,QAAoB,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAAa,EAAE,QAAgB;QACvD,MAAM,IAAI,CAAC,IAAI,CACb,uBAAuB,EACvB,MAAM,EACN,gCAAgC,EAChC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,CAC9B,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,SAAiB,EACjB,MAAc,EACd,IAAY,EACZ,OAII,EAAE;QAEN,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;gBACxD,MAAM;gBACN,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;iBACpE;gBACD,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;aAClE,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC;IACvE,CAAC;CACF;AA1LD,8CA0LC;AAED,SAAS,KAAK,CAAC,KAAc,EAAE,IAAY;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAChD,CAAC,CAAE,KAAiC,CAAC,IAAI,CAAC;QAC1C,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC"}

package/dist/runtime/custody/openbao-local-constants.d.ts

@@ -0,0 +1,22 @@
+export declare enum CustodyProviderRef {
+    OpenBao = "openbao"
+}
+export declare enum OpenBaoAuthMethod {
+    Token = "token"
+}
+export declare const CREDENTIAL_BROKER_SERVICE_NAME = "credential-broker-api";
+export declare const LOCAL_OPENBAO_IMAGE = "openbao/openbao:2.7.1@sha256:6d2b93856e3fcf7b18ad855a0b51eaba474dc8b79cf554379ea32034797d2acf";
+export declare const LOCAL_OPENBAO_CONTAINER = "xema-openbao";
+export declare const LOCAL_OPENBAO_PORT = 8200;
+export declare const LOCAL_OPENBAO_VOLUME = "xema-openbao-data";
+export declare const LOCAL_OPENBAO_DATA_PATH = "/openbao/file";
+export declare const LOCAL_OPENBAO_MOUNT_PATH = "xema-local";
+export declare const LOCAL_OPENBAO_PATH_PREFIX = "xema";
+export declare const BROKER_POLICY_NAME = "xema-credential-broker";
+export declare const BROKER_TOKEN_TTL = "768h";
+export declare const UNSEAL_SHARES = 1;
+export declare const UNSEAL_THRESHOLD = 1;
+export declare const BROKER_POLICY_HCL: string;
+export declare const LOCAL_OPENBAO_SERVER_CONFIG: string;
+export declare function localOpenBaoAddress(containerNetwork: boolean): string;
+//# sourceMappingURL=openbao-local-constants.d.ts.map

package/dist/runtime/custody/openbao-local-constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openbao-local-constants.d.ts","sourceRoot":"","sources":["../../../src/runtime/custody/openbao-local-constants.ts"],"names":[],"mappings":"AAaA,oBAAY,kBAAkB;IAC5B,OAAO,YAAY;CACpB;AAGD,oBAAY,iBAAiB;IAC3B,KAAK,UAAU;CAChB;AAGD,eAAO,MAAM,8BAA8B,0BAA0B,CAAC;AAOtE,eAAO,MAAM,mBAAmB,kGACiE,CAAC;AAElG,eAAO,MAAM,uBAAuB,iBAAiB,CAAC;AACtD,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC,eAAO,MAAM,oBAAoB,sBAAsB,CAAC;AAExD,eAAO,MAAM,uBAAuB,kBAAkB,CAAC;AAGvD,eAAO,MAAM,wBAAwB,eAAe,CAAC;AAErD,eAAO,MAAM,yBAAyB,SAAS,CAAC;AAChD,eAAO,MAAM,kBAAkB,2BAA2B,CAAC;AAE3D,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAEvC,eAAO,MAAM,aAAa,IAAI,CAAC;AAC/B,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAOlC,eAAO,MAAM,iBAAiB,QAMvB,CAAC;AAOR,eAAO,MAAM,2BAA2B,QAYtC,CAAC;AAGH,wBAAgB,mBAAmB,CAAC,gBAAgB,EAAE,OAAO,GAAG,MAAM,CAGrE"}

package/dist/runtime/custody/openbao-local-constants.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LOCAL_OPENBAO_SERVER_CONFIG = exports.BROKER_POLICY_HCL = exports.UNSEAL_THRESHOLD = exports.UNSEAL_SHARES = exports.BROKER_TOKEN_TTL = exports.BROKER_POLICY_NAME = exports.LOCAL_OPENBAO_PATH_PREFIX = exports.LOCAL_OPENBAO_MOUNT_PATH = exports.LOCAL_OPENBAO_DATA_PATH = exports.LOCAL_OPENBAO_VOLUME = exports.LOCAL_OPENBAO_PORT = exports.LOCAL_OPENBAO_CONTAINER = exports.LOCAL_OPENBAO_IMAGE = exports.CREDENTIAL_BROKER_SERVICE_NAME = exports.OpenBaoAuthMethod = exports.CustodyProviderRef = void 0;
+exports.localOpenBaoAddress = localOpenBaoAddress;
+var CustodyProviderRef;
+(function (CustodyProviderRef) {
+    CustodyProviderRef["OpenBao"] = "openbao";
+})(CustodyProviderRef || (exports.CustodyProviderRef = CustodyProviderRef = {}));
+var OpenBaoAuthMethod;
+(function (OpenBaoAuthMethod) {
+    OpenBaoAuthMethod["Token"] = "token";
+})(OpenBaoAuthMethod || (exports.OpenBaoAuthMethod = OpenBaoAuthMethod = {}));
+exports.CREDENTIAL_BROKER_SERVICE_NAME = 'credential-broker-api';
+exports.LOCAL_OPENBAO_IMAGE = 'openbao/openbao:2.7.1@sha256:6d2b93856e3fcf7b18ad855a0b51eaba474dc8b79cf554379ea32034797d2acf';
+exports.LOCAL_OPENBAO_CONTAINER = 'xema-openbao';
+exports.LOCAL_OPENBAO_PORT = 8200;
+exports.LOCAL_OPENBAO_VOLUME = 'xema-openbao-data';
+exports.LOCAL_OPENBAO_DATA_PATH = '/openbao/file';
+exports.LOCAL_OPENBAO_MOUNT_PATH = 'xema-local';
+exports.LOCAL_OPENBAO_PATH_PREFIX = 'xema';
+exports.BROKER_POLICY_NAME = 'xema-credential-broker';
+exports.BROKER_TOKEN_TTL = '768h';
+exports.UNSEAL_SHARES = 1;
+exports.UNSEAL_THRESHOLD = 1;
+exports.BROKER_POLICY_HCL = `path "${exports.LOCAL_OPENBAO_MOUNT_PATH}/data/${exports.LOCAL_OPENBAO_PATH_PREFIX}/*" {\n` +
+    '  capabilities = ["create", "read", "update", "delete"]\n' +
+    '}\n' +
+    `path "${exports.LOCAL_OPENBAO_MOUNT_PATH}/metadata/${exports.LOCAL_OPENBAO_PATH_PREFIX}/*" {\n` +
+    '  capabilities = ["read", "delete", "list"]\n' +
+    '}\n';
+exports.LOCAL_OPENBAO_SERVER_CONFIG = JSON.stringify({
+    storage: { raft: { path: exports.LOCAL_OPENBAO_DATA_PATH, node_id: 'xema-local' } },
+    listener: {
+        tcp: {
+            address: `0.0.0.0:${String(exports.LOCAL_OPENBAO_PORT)}`,
+            tls_disable: true,
+        },
+    },
+    api_addr: `http://127.0.0.1:${String(exports.LOCAL_OPENBAO_PORT)}`,
+    cluster_addr: `http://127.0.0.1:${String(exports.LOCAL_OPENBAO_PORT + 1)}`,
+    ui: false,
+    disable_mlock: true,
+});
+function localOpenBaoAddress(containerNetwork) {
+    const host = containerNetwork ? exports.LOCAL_OPENBAO_CONTAINER : '127.0.0.1';
+    return `http://${host}:${String(exports.LOCAL_OPENBAO_PORT)}`;
+}
+//# sourceMappingURL=openbao-local-constants.js.map

package/dist/runtime/custody/openbao-local-constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openbao-local-constants.js","sourceRoot":"","sources":["../../../src/runtime/custody/openbao-local-constants.ts"],"names":[],"mappings":";;;AAoFA,kDAGC;AA1ED,IAAY,kBAEX;AAFD,WAAY,kBAAkB;IAC5B,yCAAmB,CAAA;AACrB,CAAC,EAFW,kBAAkB,kCAAlB,kBAAkB,QAE7B;AAGD,IAAY,iBAEX;AAFD,WAAY,iBAAiB;IAC3B,oCAAe,CAAA;AACjB,CAAC,EAFW,iBAAiB,iCAAjB,iBAAiB,QAE5B;AAGY,QAAA,8BAA8B,GAAG,uBAAuB,CAAC;AAOzD,QAAA,mBAAmB,GAC9B,+FAA+F,CAAC;AAErF,QAAA,uBAAuB,GAAG,cAAc,CAAC;AACzC,QAAA,kBAAkB,GAAG,IAAI,CAAC;AAE1B,QAAA,oBAAoB,GAAG,mBAAmB,CAAC;AAE3C,QAAA,uBAAuB,GAAG,eAAe,CAAC;AAG1C,QAAA,wBAAwB,GAAG,YAAY,CAAC;AAExC,QAAA,yBAAyB,GAAG,MAAM,CAAC;AACnC,QAAA,kBAAkB,GAAG,wBAAwB,CAAC;AAE9C,QAAA,gBAAgB,GAAG,MAAM,CAAC;AAE1B,QAAA,aAAa,GAAG,CAAC,CAAC;AAClB,QAAA,gBAAgB,GAAG,CAAC,CAAC;AAOrB,QAAA,iBAAiB,GAC5B,SAAS,gCAAwB,SAAS,iCAAyB,SAAS;IAC5E,2DAA2D;IAC3D,KAAK;IACL,SAAS,gCAAwB,aAAa,iCAAyB,SAAS;IAChF,+CAA+C;IAC/C,KAAK,CAAC;AAOK,QAAA,2BAA2B,GAAG,IAAI,CAAC,SAAS,CAAC;IACxD,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,+BAAuB,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE;IAC3E,QAAQ,EAAE;QACR,GAAG,EAAE;YACH,OAAO,EAAE,WAAW,MAAM,CAAC,0BAAkB,CAAC,EAAE;YAChD,WAAW,EAAE,IAAI;SAClB;KACF;IACD,QAAQ,EAAE,oBAAoB,MAAM,CAAC,0BAAkB,CAAC,EAAE;IAC1D,YAAY,EAAE,oBAAoB,MAAM,CAAC,0BAAkB,GAAG,CAAC,CAAC,EAAE;IAClE,EAAE,EAAE,KAAK;IACT,aAAa,EAAE,IAAI;CACpB,CAAC,CAAC;AAGH,SAAgB,mBAAmB,CAAC,gBAAyB;IAC3D,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,+BAAuB,CAAC,CAAC,CAAC,WAAW,CAAC;IACtE,OAAO,UAAU,IAAI,IAAI,MAAM,CAAC,0BAAkB,CAAC,EAAE,CAAC;AACxD,CAAC"}

package/dist/runtime/custody/openbao-local-runner.d.ts

@@ -0,0 +1,16 @@
+import { type DockerCli } from '../runner/docker-cli';
+import type { OpenBaoHealth } from './openbao-http-client';
+export interface OpenBaoLocalRunnerOptions {
+    readonly docker: Pick<DockerCli, 'run' | 'runQuiet' | 'ensureNetwork' | 'launcherInfraContainersStrict'>;
+    readonly network: string;
+    readonly installationId: string;
+    readonly health: () => Promise<OpenBaoHealth>;
+    readonly sleep?: (ms: number) => Promise<void>;
+}
+export declare class OpenBaoLocalRunner {
+    private readonly opts;
+    constructor(opts: OpenBaoLocalRunnerOptions);
+    start(): Promise<void>;
+    private waitForApi;
+}
+//# sourceMappingURL=openbao-local-runner.d.ts.map

package/dist/runtime/custody/openbao-local-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openbao-local-runner.d.ts","sourceRoot":"","sources":["../../../src/runtime/custody/openbao-local-runner.ts"],"names":[],"mappings":"AAQA,OAAO,EAGL,KAAK,SAAS,EACf,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAU3D,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,GAAG,UAAU,GAAG,eAAe,GAAG,+BAA+B,CAAC,CAAC;IACzG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC;IAE9C,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAGD,qBAAa,kBAAkB;IACjB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,yBAAyB;IAEtD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YA2Cd,UAAU;CAiCzB"}