hammerkit 1.23.0 → 1.24.0

package/build.schema.json

@@ -261,6 +261,10 @@
                     "additionalProperties": false,
                     "description": "cpu and memory requests and limits"
                   },
+                  "runner": {
+                    "type": "string",
+                    "minLength": 1
+                  },
                   "image": {
                     "type": "string"
                   },
@@ -331,6 +335,9 @@
                   "resources": {
                     "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/resources"
                   },
+                  "runner": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/runner"
+                  },
                   "platform": {
                     "type": "object",
                     "properties": {
@@ -830,6 +837,9 @@
         },
         "labels": {
           "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/labels"
+        },
+        "runner": {
+          "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/runner"
         }
       },
       "additionalProperties": false,

package/dist/cli.js

@@ -13,6 +13,7 @@ const check_for_loop_1 = require("./executer/scheduler/check-for-loop");
 const state_1 = require("./executer/state");
 const get_scheduler_execute_result_1 = require("./executer/get-scheduler-execute-result");
 const reset_work_tree_1 = require("./executer/reset-work-tree");
+const location_1 = require("./remote/location");
 const execute_work_tree_1 = require("./executer/execute-work-tree");
 const package_1 = require("./docker/package");
 const explain_1 = require("./cache/explain");
@@ -53,6 +54,11 @@ class Cli {
                     await this.prepareSecrets(true);
                 }
                 (0, check_for_loop_1.checkForLoop)(workTree);
+                const location = await (0, location_1.resolveRunLocation)(workTree, this.environment);
+                if (location.type === 'server') {
+                    throw new Error(`this run is meant for server ${location.name}, but running on a server is not available yet. ` +
+                        'Remove the runner, or run locally with: hammerkit remote use local');
+                }
                 const capacity = (0, plan_work_tasks_1.hasError)(workTree) ? null : await (0, resource_budget_1.getResourceCapacity)(workTree, this.environment);
                 if (capacity && type !== 'down' && (options?.resourceCheck ?? true)) {
                     rejectOversizedWork(workTree, capacity, type === 'up');

package/dist/executer/execute-command.js

@@ -12,11 +12,17 @@ const environment_config_1 = require("../utils/environment-config");
 function getStopTimeout() {
     return (0, environment_config_1.getEnvironmentConfig)('HAMMERKIT_STOP_TIMEOUT_MS', 10000);
 }
+// powershell takes about half a minute to start when it has to work out its module
+// path itself, so the one of the process is passed on
+function shellEnvs(windows, environment) {
+    const value = environment.processEnvs['PSModulePath'];
+    return windows && value !== undefined ? { PSModulePath: value } : {};
+}
 async function executeCommand(status, abortSignal, cwd, command, envs, environment) {
     const windows = (0, os_1.platform)() === 'win32';
     return new Promise((resolve, reject) => {
         const ps = (0, child_process_1.spawn)(command, {
-            env: { ...envs, PATH: environment.processEnvs['PATH'] },
+            env: { ...envs, ...shellEnvs(windows, environment), PATH: environment.processEnvs['PATH'] },
             cwd,
             shell: windows ? 'powershell.exe' : true,
             // its own process group, so an abort reaches every process the command

package/dist/planner/utils/append-work-task.js

@@ -72,6 +72,7 @@ function parseTask(cwd, task, environment, context) {
         timeout: task.schema.timeout ? (0, units_1.parseDuration)(task.schema.timeout) : null,
         secrets: (0, work_secret_1.parseWorkSecrets)(cwd, context.projectRoot, task.schema.secrets, envs, environment, context.secrets, task.schema.account),
         resources: (0, work_resources_1.parseWorkResources)(task.schema.resources),
+        runner: task.schema.runner ?? task.scope.schema.runner ?? null,
     };
     if ((0, build_file_task_schema_1.isBuildFileContainerTaskSchema)(task.schema)) {
         return {

package/dist/program.js

@@ -25,6 +25,8 @@ const version_1 = require("./version");
 const read_only_1 = require("./cache/read-only");
 const units_1 = require("./utils/units");
 const cache_inventory_1 = require("./cache/cache-inventory");
+const remote_commands_1 = require("./remote/remote-commands");
+const server_command_1 = require("./server/server-command");
 async function createCli(fileName, environment, workScope) {
     const { ctx, scope } = await (0, schema_parser_1.createParseContext)(fileName, environment);
     const referencedScope = await (0, reference_parser_1.parseReferences)(ctx, scope, environment);
@@ -102,6 +104,7 @@ function parseWorkLabelScope(options) {
 }
 async function getProgram(environment, argv) {
     const program = new commander_1.Command();
+    (0, server_command_1.registerServerCommand)(program, environment);
     const parsed = (0, parse_set_arguments_1.parseSetArguments)(argv);
     const args = parsed.args;
     environment.processEnvs = { ...environment.processEnvs, ...parsed.values };
@@ -110,6 +113,7 @@ async function getProgram(environment, argv) {
     if (fileIndex >= 0) {
         args.splice(fileIndex, 2);
     }
+    (0, remote_commands_1.registerRemoteCommands)(program, environment, fileName);
     if (await environment.file.exists(fileName)) {
         program
             .command('ls')

package/dist/remote/bundle.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HASH_PATTERN = exports.hashBundle = exports.bundleSchema = exports.isBundlePath = exports.MAX_BUNDLE_BYTES = exports.MAX_BUNDLE_FILES = exports.DEFAULT_ENTRY = void 0;
+const crypto_1 = require("crypto");
+const zod_1 = require("zod");
+exports.DEFAULT_ENTRY = '.hammerkit.yaml';
+exports.MAX_BUNDLE_FILES = 200;
+exports.MAX_BUNDLE_BYTES = 1024 * 1024;
+// A path inside the bundle: relative, forward slashes, nothing that climbs out.
+function isBundlePath(path) {
+    return (path.length > 0 &&
+        path.length <= 200 &&
+        !path.startsWith('/') &&
+        !path.includes('\\') &&
+        !path.includes('\0') &&
+        !path.split('/').some((part) => part === '' || part === '.' || part === '..'));
+}
+exports.isBundlePath = isBundlePath;
+exports.bundleSchema = zod_1.z
+    .object({
+    entry: zod_1.z.string().default(exports.DEFAULT_ENTRY),
+    files: zod_1.z.record(zod_1.z.string()),
+})
+    .strict()
+    .superRefine((bundle, ctx) => {
+    const paths = Object.keys(bundle.files);
+    const bad = paths.find((path) => !isBundlePath(path));
+    if (bad !== undefined) {
+        ctx.addIssue({
+            code: zod_1.z.ZodIssueCode.custom,
+            path: ['files'],
+            message: `"${bad}" is not a path inside the bundle`,
+        });
+    }
+    if (paths.length > exports.MAX_BUNDLE_FILES) {
+        ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, path: ['files'], message: `more than ${exports.MAX_BUNDLE_FILES} files` });
+    }
+    const bytes = paths.reduce((sum, path) => sum + Buffer.byteLength(bundle.files[path]), 0);
+    if (bytes > exports.MAX_BUNDLE_BYTES) {
+        ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, path: ['files'], message: `larger than ${exports.MAX_BUNDLE_BYTES} bytes` });
+    }
+    if (!isBundlePath(bundle.entry) || !Object.prototype.hasOwnProperty.call(bundle.files, bundle.entry)) {
+        ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, path: ['entry'], message: `${bundle.entry} is not one of the files` });
+    }
+});
+// The version of a bundle: the hash of its entry and of every file, in path order,
+// so the same files always have the same version, wherever it is computed. It is
+// the sha-256 of the JSON `[entry, [[path, sha-256 of the content], ...]]`.
+function hashBundle(bundle) {
+    const files = Object.keys(bundle.files)
+        .sort()
+        .map((path) => [path, (0, crypto_1.createHash)('sha256').update(bundle.files[path]).digest('hex')]);
+    return `sha256:${(0, crypto_1.createHash)('sha256')
+        .update(JSON.stringify([bundle.entry, files]))
+        .digest('hex')}`;
+}
+exports.hashBundle = hashBundle;
+exports.HASH_PATTERN = /^sha256:[0-9a-f]{64}$/;
+//# sourceMappingURL=bundle.js.map

package/dist/remote/collect-bundle.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.collectBundle = void 0;
+const path_1 = require("path");
+const resolve_git_source_1 = require("../includes/resolve-git-source");
+const schema_parser_1 = require("../schema/schema-parser");
+const bundle_1 = require("./bundle");
+// The bundle of a build file on this machine: the file itself and every local
+// file it includes or references, as the server reads them when it is published.
+// The build file is read with the parser of a run, so what it pulls in is what a
+// run would read. Git includes are not part of it (the server fetches them, at
+// the commit they are pinned to), and neither is anything outside of the
+// directory of the build file, which a server could not reproduce.
+async function collectBundle(fileName, environment) {
+    if (!(await environment.file.exists(fileName))) {
+        throw new Error(`there is no build file at ${fileName}`);
+    }
+    const entryPath = (0, path_1.resolve)(fileName);
+    const root = (0, path_1.dirname)(entryPath);
+    const { ctx } = await (0, schema_parser_1.createParseContext)(entryPath, environment);
+    const paths = new Set([entryPath]);
+    for (const scope of Object.values(ctx.files)) {
+        if (!scope.remote) {
+            paths.add((0, path_1.resolve)(scope.fileName));
+        }
+    }
+    const files = {};
+    for (const path of [...paths].sort()) {
+        if (!(0, resolve_git_source_1.isWithin)(root, path)) {
+            throw new Error(`${path} is outside of ${root}: a published build file can only include files below its own directory`);
+        }
+        files[(0, path_1.relative)(root, path).split(path_1.sep).join('/')] = await environment.file.read(path);
+    }
+    const result = bundle_1.bundleSchema.safeParse({ entry: (0, path_1.relative)(root, entryPath).split(path_1.sep).join('/'), files });
+    if (!result.success) {
+        throw new Error(`the build file can't be published: ${result.error.issues[0].message}`);
+    }
+    return result.data;
+}
+exports.collectBundle = collectBundle;
+//# sourceMappingURL=collect-bundle.js.map

package/dist/remote/credentials.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAccessToken = exports.removeToken = exports.saveToken = exports.getCredentialsPath = void 0;
+const crypto_1 = require("crypto");
+const promises_1 = require("fs/promises");
+const path_1 = require("path");
+const get_cache_directory_1 = require("../optimizer/get-cache-directory");
+function getCredentialsPath(environment) {
+    return environment.processEnvs.HAMMERKIT_CREDENTIALS ?? (0, path_1.join)((0, get_cache_directory_1.getHammerkitDirectory)(), 'credentials.json');
+}
+exports.getCredentialsPath = getCredentialsPath;
+async function readAll(environment) {
+    const path = getCredentialsPath(environment);
+    if (!(await environment.file.exists(path))) {
+        return {};
+    }
+    try {
+        const parsed = JSON.parse(await environment.file.read(path));
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : {};
+    }
+    catch {
+        // a damaged file only costs a new sign-in
+        return {};
+    }
+}
+// Only the owner may read it, and it is replaced atomically. The temporary file
+// has a name nobody can guess and is created exclusively (never through a link
+// someone left behind), already private.
+async function writeAll(environment, all) {
+    const path = getCredentialsPath(environment);
+    await (0, promises_1.mkdir)((0, path_1.dirname)(path), { recursive: true, mode: 0o700 });
+    const temporary = `${path}.${(0, crypto_1.randomBytes)(8).toString('hex')}.tmp`;
+    const file = await (0, promises_1.open)(temporary, 'wx', 0o600);
+    try {
+        await file.writeFile(JSON.stringify(all, null, 2));
+    }
+    finally {
+        await file.close();
+    }
+    try {
+        await (0, promises_1.rename)(temporary, path);
+    }
+    catch (e) {
+        await (0, promises_1.unlink)(temporary).catch(() => undefined);
+        throw e;
+    }
+}
+// A token that others can read is as good as published: it isn't used.
+async function assertPrivate(environment) {
+    const path = getCredentialsPath(environment);
+    if (process.platform === 'win32' || !(await environment.file.exists(path))) {
+        return;
+    }
+    const info = await (0, promises_1.stat)(path);
+    if ((info.mode & 0o077) !== 0 || (process.getuid && info.uid !== process.getuid())) {
+        throw new Error(`${path} must belong to you and be private, fix it with: chmod 600 ${path}, or sign in again`);
+    }
+}
+async function saveToken(environment, name, token) {
+    const all = await readAll(environment);
+    all[name] = token;
+    await writeAll(environment, all);
+}
+exports.saveToken = saveToken;
+async function removeToken(environment, name) {
+    const all = await readAll(environment);
+    if (!all[name]) {
+        return false;
+    }
+    delete all[name];
+    await writeAll(environment, all);
+    return true;
+}
+exports.removeToken = removeToken;
+// The access token for a registered server, or the reason there is none.
+async function getAccessToken(environment, name, server, now = Date.now()) {
+    await assertPrivate(environment);
+    const all = await readAll(environment);
+    const stored = Object.prototype.hasOwnProperty.call(all, name) ? all[name] : undefined;
+    const signIn = `sign in with: hammerkit remote login ${name}`;
+    if (!stored) {
+        throw new Error(`not signed in to ${name}, ${signIn}`);
+    }
+    if (stored.url !== server.url || stored.issuer !== server.issuer) {
+        throw new Error(`the sign-in to ${name} was made for another server, ${signIn}`);
+    }
+    if (stored.expiresAt <= now) {
+        throw new Error(`the sign-in to ${name} has expired, ${signIn}`);
+    }
+    return stored.accessToken;
+}
+exports.getAccessToken = getAccessToken;
+//# sourceMappingURL=credentials.js.map

package/dist/remote/device-login.js

@@ -0,0 +1,177 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deviceLogin = void 0;
+const server_client_1 = require("./server-client");
+const GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';
+const DEFAULT_INTERVAL_SECONDS = 5;
+const SLOW_DOWN_SECONDS = 5;
+const FETCH_TIMEOUT_MS = 10000;
+const MIN_INTERVAL_SECONDS = 1;
+const MAX_LIFETIME_SECONDS = 30 * 60;
+const isLoopbackHost = (hostname) => ['localhost', '127.0.0.1', '[::1]'].includes(hostname);
+// An endpoint must use the scheme of the issuer: loopback http is for a test
+// identity provider on this machine only, never beside an https issuer.
+function isSecure(url, issuer) {
+    if (typeof url !== 'string') {
+        return false;
+    }
+    try {
+        const parsed = new URL(url);
+        const issuerHost = new URL(issuer);
+        return (parsed.protocol === 'https:' ||
+            (parsed.protocol === 'http:' && isLoopbackHost(parsed.hostname) && issuerHost.protocol === 'http:'));
+    }
+    catch {
+        return false;
+    }
+}
+// Redirects are refused: a 307 would send the device code to another place.
+async function fetchJson(url, init = {}) {
+    let response;
+    try {
+        response = await fetch(url, { ...init, redirect: 'error', signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+    }
+    catch (e) {
+        throw new server_client_1.ServerError(`unable to reach ${url}: ${(0, server_client_1.printable)(e instanceof Error ? e.message : e)}`);
+    }
+    return { status: response.status, body: await response.json().catch(() => ({})) };
+}
+function postForm(url, form) {
+    return fetchJson(url, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+        body: new URLSearchParams(form),
+    });
+}
+// `offline_access` asks for a refresh token, which is never kept.
+function normalizeScope(scope) {
+    return scope
+        .split(/\s+/)
+        .filter((part) => part && part !== 'offline_access')
+        .join(' ');
+}
+// The token is sent to the hammerkit server next, so it has to be meant for it:
+// a server that talked the user into a token for another service (Graph, a
+// cloud API) gets nothing.
+function checkToken(token, issuer, audience) {
+    let payload;
+    try {
+        payload = JSON.parse(Buffer.from(token.split('.')[1] ?? '', 'base64url').toString('utf8'));
+    }
+    catch {
+        // handled below
+    }
+    const audiences = Array.isArray(payload?.aud) ? payload.aud : [payload?.aud];
+    if (payload?.iss !== issuer || !audiences.includes(audience)) {
+        throw new server_client_1.ServerError(`the identity provider issued a token that is not meant for ${(0, server_client_1.printable)(audience)}, it is not sent to the server`);
+    }
+}
+function abortable(sleep, signal) {
+    return async (ms) => {
+        if (signal?.aborted) {
+            throw new server_client_1.ServerError('login was cancelled');
+        }
+        await sleep(ms);
+    };
+}
+// OAuth device authorization grant (RFC 8628) against the issuer the server
+// names for the issuer registered with `remote add`. Works headless: nothing is
+// opened, the user visits the address on any device. The refresh token, if the
+// issuer sends one, is dropped on purpose: what is kept is one short-lived
+// access token, and signing in again is the way to renew it.
+async function deviceLogin(server, options) {
+    const sleep = abortable(options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms))), options.signal);
+    const now = options.now ?? Date.now;
+    const discovery = await (0, server_client_1.getDiscovery)(server);
+    const offered = discovery.issuers.find((i) => i.issuer === server.issuer);
+    if (!offered) {
+        const accepted = discovery.issuers.map((i) => (0, server_client_1.printable)(i.issuer)).join(', ');
+        throw new server_client_1.ServerError(`${server.url} does not accept tokens from ${server.issuer} (it accepts ${accepted})`);
+    }
+    if (!offered.clientId) {
+        throw new server_client_1.ServerError(`${server.url} offers no sign-in for ${server.issuer}, it needs a token obtained elsewhere`);
+    }
+    // What was pinned (by `remote add` or an earlier login) wins; the server can
+    // only offer the same, never something else to sign in with.
+    const wanted = {
+        clientId: offered.clientId,
+        audience: offered.audience,
+        scope: normalizeScope(offered.scope),
+    };
+    const pinned = {
+        clientId: server.clientId ?? wanted.clientId,
+        audience: server.audience ?? wanted.audience,
+        scope: normalizeScope(server.scope ?? wanted.scope),
+    };
+    for (const key of ['clientId', 'audience', 'scope']) {
+        if (pinned[key] !== wanted[key]) {
+            throw new server_client_1.ServerError(`${server.url} now asks for ${key} "${(0, server_client_1.printable)(wanted[key])}", but "${(0, server_client_1.printable)(pinned[key])}" is pinned. ` +
+                `If that is expected, register the server again with: hammerkit remote add <name> ${server.url} ` +
+                `--issuer ${server.issuer} --force`);
+        }
+    }
+    options.prompt(`signing in to ${server.url} through ${server.issuer}\n` +
+        `  client ${(0, server_client_1.printable)(pinned.clientId)}, audience ${(0, server_client_1.printable)(pinned.audience)}, scope ${(0, server_client_1.printable)(pinned.scope)}`);
+    const base = server.issuer.replace(/\/+$/, '');
+    const described = await fetchJson(`${base}/.well-known/openid-configuration`);
+    const metadata = described.body;
+    if (described.status !== 200) {
+        throw new server_client_1.ServerError(`${server.issuer} answered ${described.status} for its configuration`);
+    }
+    if (metadata.issuer !== server.issuer) {
+        throw new server_client_1.ServerError(`${server.issuer} describes itself as ${(0, server_client_1.printable)(metadata.issuer)}`);
+    }
+    if (!isSecure(metadata.device_authorization_endpoint, server.issuer) ||
+        !isSecure(metadata.token_endpoint, server.issuer)) {
+        throw new server_client_1.ServerError(`${server.issuer} does not support the device authorization grant over https`);
+    }
+    const started = await postForm(metadata.device_authorization_endpoint, {
+        client_id: pinned.clientId,
+        scope: pinned.scope,
+        audience: pinned.audience,
+    });
+    const device = started.body;
+    if (started.status !== 200 || typeof device.device_code !== 'string' || typeof device.user_code !== 'string') {
+        throw new server_client_1.ServerError(`${server.issuer} refused the sign-in: ${(0, server_client_1.printable)(device.error_description ?? device.error ?? started.status)}`);
+    }
+    const address = device.verification_uri_complete ?? device.verification_uri;
+    if (!isSecure(address, server.issuer)) {
+        throw new server_client_1.ServerError(`${server.issuer} sent a sign-in address that is not https`);
+    }
+    options.prompt(`To sign in, open ${(0, server_client_1.printable)(address)} and enter the code ${(0, server_client_1.printable)(device.user_code)}`);
+    const lifetimeSeconds = typeof device.expires_in === 'number' ? device.expires_in : 600;
+    const deadline = now() + Math.min(Math.max(lifetimeSeconds, 0), MAX_LIFETIME_SECONDS) * 1000;
+    const intervalSeconds = typeof device.interval === 'number' ? device.interval : DEFAULT_INTERVAL_SECONDS;
+    let interval = Math.max(intervalSeconds, MIN_INTERVAL_SECONDS) * 1000;
+    for (;;) {
+        await sleep(interval);
+        if (now() > deadline) {
+            throw new server_client_1.ServerError('the code expired, run the login again');
+        }
+        const answer = await postForm(metadata.token_endpoint, {
+            grant_type: GRANT_TYPE,
+            device_code: device.device_code,
+            client_id: pinned.clientId,
+        });
+        if (answer.status === 200 && typeof answer.body.access_token === 'string') {
+            checkToken(answer.body.access_token, server.issuer, pinned.audience);
+            const lifetime = typeof answer.body.expires_in === 'number' ? answer.body.expires_in : 3600;
+            return { accessToken: answer.body.access_token, expiresAt: now() + lifetime * 1000, pinned };
+        }
+        switch (answer.body.error) {
+            case 'authorization_pending':
+                break;
+            case 'slow_down':
+                interval += SLOW_DOWN_SECONDS * 1000;
+                break;
+            case 'access_denied':
+                throw new server_client_1.ServerError('the sign-in was denied');
+            case 'expired_token':
+                throw new server_client_1.ServerError('the code expired, run the login again');
+            default:
+                throw new server_client_1.ServerError(`${server.issuer} refused the sign-in: ${(0, server_client_1.printable)(answer.body.error_description ?? answer.body.error ?? answer.status)}`);
+        }
+    }
+}
+exports.deviceLogin = deviceLogin;
+//# sourceMappingURL=device-login.js.map

package/dist/remote/host-config.js

@@ -0,0 +1,170 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pinLogin = exports.setDefaultLocation = exports.removeServer = exports.addServer = exports.normalizeServerUrl = exports.validateServerName = exports.writeHostConfig = exports.readHostConfig = exports.getHostConfigPath = exports.hasServer = exports.hostConfigSchema = exports.hostServerSchema = exports.RESERVED_SERVER_NAMES = void 0;
+const path_1 = require("path");
+const zod_1 = require("zod");
+const yaml_1 = require("yaml");
+const get_cache_directory_1 = require("../optimizer/get-cache-directory");
+// Names with a meaning of their own in `run.on` / `--on`
+exports.RESERVED_SERVER_NAMES = ['local', 'auto'];
+const serverNamePattern = /^[a-z0-9][a-z0-9._-]*$/i;
+const checked = (what) => (value, ctx) => {
+    try {
+        normalizeServerUrl(value, what);
+    }
+    catch (e) {
+        ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, message: e.message });
+    }
+};
+// `clientId`, `audience` and `scope` are what a login asks the identity provider
+// for. They are pinned the first time a login happens (or given to `remote add`),
+// so a server can't change them later, see device-login.ts.
+exports.hostServerSchema = zod_1.z
+    .object({
+    url: zod_1.z.string().superRefine(checked('url')),
+    issuer: zod_1.z.string().superRefine(checked('issuer')),
+    clientId: zod_1.z.string().min(1).optional(),
+    audience: zod_1.z.string().min(1).optional(),
+    scope: zod_1.z.string().min(1).optional(),
+})
+    .strict();
+// Unknown top-level keys are kept when the file is written back, so a newer
+// hammerkit's settings survive an older one editing the file.
+exports.hostConfigSchema = zod_1.z
+    .object({
+    servers: zod_1.z.record(exports.hostServerSchema).default({}),
+    run: zod_1.z.object({ on: zod_1.z.string().optional() }).passthrough().default({}),
+})
+    .passthrough();
+// Names like "constructor" must not find inherited members.
+function hasServer(servers, name) {
+    return Object.prototype.hasOwnProperty.call(servers, name);
+}
+exports.hasServer = hasServer;
+function getHostConfigPath(environment) {
+    return environment.processEnvs.HAMMERKIT_CONFIG ?? (0, path_1.join)((0, get_cache_directory_1.getHammerkitDirectory)(), 'config.yaml');
+}
+exports.getHostConfigPath = getHostConfigPath;
+async function readHostConfig(environment) {
+    const path = getHostConfigPath(environment);
+    if (!(await environment.file.exists(path))) {
+        return exports.hostConfigSchema.parse({});
+    }
+    let raw;
+    try {
+        raw = (0, yaml_1.parse)(await environment.file.read(path));
+    }
+    catch (e) {
+        throw new Error(`unable to read ${path}: ${e.message}`);
+    }
+    const result = exports.hostConfigSchema.safeParse(raw ?? {});
+    if (!result.success) {
+        const issue = result.error.issues[0];
+        throw new Error(`invalid ${path}: ${issue.path.join('.') || 'config'}: ${issue.message}`);
+    }
+    return result.data;
+}
+exports.readHostConfig = readHostConfig;
+async function writeHostConfig(environment, config) {
+    const path = getHostConfigPath(environment);
+    await environment.file.createDirectory((0, path_1.join)(path, '..'));
+    await environment.file.writeFile(path, (0, yaml_1.stringify)(config));
+}
+exports.writeHostConfig = writeHostConfig;
+function validateServerName(name) {
+    if (exports.RESERVED_SERVER_NAMES.includes(name.toLowerCase())) {
+        throw new Error(`"${name}" is reserved and cannot be used as a server name`);
+    }
+    if (!serverNamePattern.test(name)) {
+        throw new Error(`invalid server name "${name}": use letters, digits, ".", "_" and "-", starting with a letter or digit`);
+    }
+    return name;
+}
+exports.validateServerName = validateServerName;
+function isLoopback(hostname) {
+    return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]';
+}
+// A server receives the source of a run and the caller's OAuth token, so it must
+// be reached over https; plain http is only for a server on this machine. The
+// result has no trailing slash, so one server has one spelling.
+// An issuer is compared as a string with the `iss` of tokens, so it keeps the
+// spelling it was given (some providers end it with a slash, some don't).
+function normalizeServerUrl(value, what = 'url') {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error(`invalid ${what} "${value}"`);
+    }
+    if (url.username || url.password) {
+        throw new Error(`the ${what} must not contain credentials`);
+    }
+    if (url.search || url.hash) {
+        throw new Error(`the ${what} must not contain a query or fragment`);
+    }
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && isLoopback(url.hostname))) {
+        throw new Error(`the ${what} must use https (http is only allowed for localhost), got "${value}"`);
+    }
+    return what === 'issuer' ? value : url.toString().replace(/\/+$/, '');
+}
+exports.normalizeServerUrl = normalizeServerUrl;
+const PINNED = ['clientId', 'audience', 'scope'];
+async function addServer(environment, name, url, options) {
+    validateServerName(name);
+    const server = {
+        url: normalizeServerUrl(url),
+        issuer: normalizeServerUrl(options.issuer, 'issuer'),
+    };
+    for (const key of PINNED) {
+        if (options[key]) {
+            server[key] = options[key];
+        }
+    }
+    const config = await readHostConfig(environment);
+    const existing = hasServer(config.servers, name) ? config.servers[name] : undefined;
+    const changed = (a, b) => a.url !== b.url || a.issuer !== b.issuer || PINNED.some((key) => a[key] !== b[key]);
+    if (existing && changed(existing, server) && !options.force) {
+        throw new Error(`server "${name}" is already registered as ${existing.url} (issuer ${existing.issuer}); ` +
+            `use --force to point it somewhere else`);
+    }
+    config.servers[name] = server;
+    await writeHostConfig(environment, config);
+    return server;
+}
+exports.addServer = addServer;
+async function removeServer(environment, name) {
+    const config = await readHostConfig(environment);
+    if (!hasServer(config.servers, name)) {
+        throw new Error(`server "${name}" is not registered`);
+    }
+    delete config.servers[name];
+    const resetDefault = config.run.on === name;
+    if (resetDefault) {
+        delete config.run.on;
+    }
+    await writeHostConfig(environment, config);
+    return { resetDefault };
+}
+exports.removeServer = removeServer;
+async function setDefaultLocation(environment, on) {
+    const config = await readHostConfig(environment);
+    if (!exports.RESERVED_SERVER_NAMES.includes(on) && !hasServer(config.servers, on)) {
+        throw new Error(`server "${on}" is not registered; add it with: hammerkit remote add ${on} <url> --issuer <url>`);
+    }
+    config.run.on = on;
+    await writeHostConfig(environment, config);
+}
+exports.setDefaultLocation = setDefaultLocation;
+// Remember what the first login asked the identity provider for; later logins
+// have to ask for the same.
+async function pinLogin(environment, name, pins) {
+    const config = await readHostConfig(environment);
+    if (!hasServer(config.servers, name)) {
+        return;
+    }
+    Object.assign(config.servers[name], pins);
+    await writeHostConfig(environment, config);
+}
+exports.pinLogin = pinLogin;
+//# sourceMappingURL=host-config.js.map