@yourrealm/sdk 0.0.0-alpha.1378.ce03c8dc

package/src/compile.ts

@@ -0,0 +1,100 @@
+// Compile-pipeline entry point, used by Home (and any other host driving the
+// realm.ts → resolved-state pipeline) but kept off `@yourrealm/sdk`'s default
+// entry so realm.ts bundles don't transitively pull in esbuild +
+// quickjs-emscripten through barrel re-exports.
+//
+// The renderer (realm.ts → docker-compose) lives in `@yourrealm/sdk/worker`;
+// this entry exposes only the resolution half: bundle + sandbox + ref walker +
+// crypto helpers.
+
+export { bundle, setBundleCacheDir, sweepBundleCache } from "./bundle.ts";
+export { bundleUiSurfaces, type UiSurfaceBundle } from "./bundle-ui.ts";
+export {
+  extractAppName,
+  extractSchema,
+  extractAppKind,
+  validateFetchData,
+  execute,
+  executeDeferred,
+  executeInfo,
+  sweepExecuteCache,
+  runAppGate,
+  disposeAllVms,
+  stitchLoaderRequests,
+  snapshot,
+  nestByPaths,
+  type ConfigContainerNode,
+  type ConfigField,
+  type ConfigFieldLeaf,
+  type ConfigFieldTree,
+  type GateRequest,
+  type GateResult,
+  type SerializablePermission,
+  type SurfaceDescriptor,
+  type VmPoolSnapshot,
+  type VmPoolEntrySnapshot,
+} from "./sandbox.ts";
+
+export { resolveRefs, buildAllowMap, type ResolutionContext } from "./generator/resolve-refs.ts";
+export { sha256Hex } from "./generator/hash.ts";
+// The packed-artifact reader, for hosts that show a source file by file (the
+// definition-update review). Same parser bundle() runs on install.
+export { isPacked, unpackFiles } from "./pack.ts";
+export { serviceUrl, structuredHost, firstPublicDomain } from "./service-url.ts";
+// Icon specs: the schema Home validates a router icon with and the one URL
+// it fetches that icon from.
+export { type AppIcon, appIconSchema, iconSourceUrl } from "./app-icon.ts";
+export { normalizeInfo, type ResolvedInfoEntry } from "./info.ts";
+
+// Wire-side manifest types, inferred from the zod schemas in resolve.ts.
+// Home-side consumers narrow their inline shapes against these so the
+// widget-entry shape lives in exactly one place.
+export type {
+  LoaderManifest,
+  ManifestHeader,
+  RequestManifest,
+  SurfaceManifest,
+  UiManifest,
+  WidgetManifest,
+} from "./resolve.ts";
+
+// The per-worker envelope Home wraps each fanned-out response in. Type-only,
+// so this doesn't drag the render-side of ui-surface.ts into the Home bundle.
+export type { WorkerResult } from "./ui-surface.ts";
+
+export { deriveAppPassword, toHex } from "./keys.ts";
+
+/**
+ * Replace secret config values with structured ref markers. The sandbox
+ * sees `{__realmRef: {kind: "secret", path}}` instead of the raw secret,
+ * so the sandbox never touches plaintext and the walker can resolve the
+ * marker wherever it lands in the resolved state. Returns the cloned,
+ * marker-rewritten config and a map of `path → plaintext` for the walker.
+ */
+export function replaceSecrets(
+  config: Record<string, unknown>,
+  secretPaths: string[],
+): { sanitized: Record<string, unknown>; secrets: Record<string, string> } {
+  if (secretPaths.length === 0) return { sanitized: config, secrets: {} };
+
+  const secrets: Record<string, string> = {};
+  const sanitized = structuredClone(config);
+
+  for (const path of secretPaths) {
+    const segments = path.split(".");
+    let parent: Record<string, unknown> = sanitized;
+    for (let i = 0; i < segments.length - 1; i++) {
+      const next = parent[segments[i]!];
+      if (next == null || typeof next !== "object") break;
+      parent = next as Record<string, unknown>;
+    }
+    const leaf = segments[segments.length - 1]!;
+    const value = parent[leaf];
+    if (typeof value === "string") {
+      secrets[path] = value;
+      parent[leaf] = { __realmRef: { kind: "secret", path } };
+    }
+  }
+
+  return { sanitized, secrets };
+}