kustodian 1.0.0

package/dist/sources/fetchers/git.js

@@ -0,0 +1,165 @@
+import { exec } from 'node:child_process';
+import * as fs from 'node:fs/promises';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { promisify } from 'node:util';
+import { Errors, failure, success, } from '../../core/index.js';
+import { is_git_source } from '../../schema/index.js';
+const exec_async = promisify(exec);
+const DEFAULT_TIMEOUT = 120_000; // 2 minutes
+/**
+ * Creates a Git source fetcher.
+ */
+export function create_git_fetcher() {
+    return new GitFetcher();
+}
+class GitFetcher {
+    type = 'git';
+    is_mutable(source) {
+        if (!is_git_source(source))
+            return true;
+        // Branches are mutable, tags and commits are immutable
+        return source.git.ref.branch !== undefined;
+    }
+    async fetch(source, options) {
+        if (!is_git_source(source)) {
+            return failure(Errors.invalid_argument('source', 'Expected a git source'));
+        }
+        const { url, ref, path: subpath } = source.git;
+        const timeout = options?.timeout ?? DEFAULT_TIMEOUT;
+        // Determine the ref to fetch
+        const git_ref = ref.branch ?? ref.tag ?? ref.commit;
+        if (!git_ref) {
+            return failure(Errors.invalid_argument('source', 'No git ref specified'));
+        }
+        // Create temp directory for clone
+        const temp_dir = await fs.mkdtemp(path.join(os.tmpdir(), 'kustodian-git-'));
+        try {
+            // Clone with depth=1 for efficiency (shallow clone)
+            // For commits, we need a full clone to checkout specific commits
+            const is_commit = ref.commit !== undefined;
+            const depth_flag = is_commit ? '' : '--depth=1';
+            const branch_flag = ref.branch || ref.tag ? `--branch=${git_ref}` : '';
+            const clone_cmd = `git clone ${depth_flag} ${branch_flag} --single-branch "${url}" "${temp_dir}"`.trim();
+            await this.exec_git(clone_cmd, timeout, source.name);
+            // If fetching a specific commit, checkout that commit
+            if (is_commit) {
+                await this.exec_git(`git -C "${temp_dir}" checkout ${git_ref}`, timeout, source.name);
+            }
+            // Get the actual commit SHA for versioning
+            const version = await this.get_commit_sha(temp_dir, timeout, source.name);
+            if (!version.success) {
+                return failure(version.error);
+            }
+            // Determine final content path
+            let content_path = temp_dir;
+            if (subpath) {
+                content_path = path.join(temp_dir, subpath);
+                // Verify subpath exists
+                try {
+                    await fs.access(content_path);
+                }
+                catch {
+                    return failure(Errors.not_found('path', `${url}:${subpath}`));
+                }
+            }
+            // Create a clean output directory with just the templates
+            const output_dir = await fs.mkdtemp(path.join(os.tmpdir(), 'kustodian-templates-'));
+            // Copy content (excluding .git directory)
+            await this.copy_excluding_git(content_path, output_dir);
+            // Cleanup original clone
+            await fs.rm(temp_dir, { recursive: true, force: true });
+            return success({
+                path: output_dir,
+                version: version.value,
+                from_cache: false,
+                fetched_at: new Date(),
+            });
+        }
+        catch (error) {
+            // Cleanup on error
+            await fs.rm(temp_dir, { recursive: true, force: true }).catch(() => { });
+            if (error instanceof Error && error.message.includes('Authentication')) {
+                return failure(Errors.source_auth_error(source.name, error));
+            }
+            return failure(Errors.source_fetch_error(source.name, error));
+        }
+    }
+    async list_versions(source) {
+        if (!is_git_source(source)) {
+            return failure(Errors.invalid_argument('source', 'Expected a git source'));
+        }
+        const { url } = source.git;
+        try {
+            // Use ls-remote to list refs without cloning
+            const { stdout } = await exec_async(`git ls-remote --tags --heads "${url}"`, {
+                timeout: DEFAULT_TIMEOUT,
+            });
+            const versions = [];
+            for (const line of stdout.split('\n')) {
+                if (!line.trim())
+                    continue;
+                const [sha, ref] = line.split('\t');
+                if (!sha || !ref)
+                    continue;
+                // Parse ref name
+                let version;
+                if (ref.startsWith('refs/tags/')) {
+                    version = ref.replace('refs/tags/', '').replace(/\^{}$/, '');
+                }
+                else if (ref.startsWith('refs/heads/')) {
+                    version = ref.replace('refs/heads/', '');
+                }
+                else {
+                    continue;
+                }
+                // Deduplicate (annotated tags appear twice)
+                if (!versions.some((v) => v.version === version)) {
+                    versions.push({
+                        version,
+                        digest: sha,
+                    });
+                }
+            }
+            return success(versions);
+        }
+        catch (error) {
+            return failure(Errors.source_fetch_error(source.name, error));
+        }
+    }
+    async exec_git(command, timeout, source_name) {
+        try {
+            const { stdout } = await exec_async(command, { timeout });
+            return success(stdout);
+        }
+        catch (error) {
+            if (error instanceof Error && 'killed' in error && error.killed) {
+                return failure(Errors.source_timeout(source_name, timeout));
+            }
+            throw error;
+        }
+    }
+    async get_commit_sha(repo_path, timeout, source_name) {
+        const result = await this.exec_git(`git -C "${repo_path}" rev-parse HEAD`, timeout, source_name);
+        if (!result.success)
+            return result;
+        return success(result.value.trim());
+    }
+    async copy_excluding_git(src, dest) {
+        const entries = await fs.readdir(src, { withFileTypes: true });
+        for (const entry of entries) {
+            if (entry.name === '.git')
+                continue;
+            const src_path = path.join(src, entry.name);
+            const dest_path = path.join(dest, entry.name);
+            if (entry.isDirectory()) {
+                await fs.mkdir(dest_path, { recursive: true });
+                await this.copy_excluding_git(src_path, dest_path);
+            }
+            else {
+                await fs.copyFile(src_path, dest_path);
+            }
+        }
+    }
+}
+//# sourceMappingURL=git.js.map

package/dist/sources/fetchers/git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../../../src/sources/fetchers/git.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EACL,MAAM,EAGN,OAAO,EACP,OAAO,GACR,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAA2B,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAI/E,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;AAEnC,MAAM,eAAe,GAAG,OAAO,CAAC,CAAC,YAAY;AAE7C;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,UAAU,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU;IACL,IAAI,GAAG,KAAc,CAAC;IAE/B,UAAU,CAAC,MAA0B;QACnC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,uDAAuD;QACvD,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,KAAK,CACT,MAA0B,EAC1B,OAA0B;QAE1B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC;QAC/C,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,eAAe,CAAC;QAEpD,6BAA6B;QAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC;QACpD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAC5E,CAAC;QAED,kCAAkC;QAClC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAE5E,IAAI,CAAC;YACH,oDAAoD;YACpD,iEAAiE;YACjE,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC;YAC3C,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;YAChD,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAEvE,MAAM,SAAS,GACb,aAAa,UAAU,IAAI,WAAW,qBAAqB,GAAG,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;YAEzF,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAErD,sDAAsD;YACtD,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,QAAQ,cAAc,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YACxF,CAAC;YAED,2CAA2C;YAC3C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1E,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBACrB,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAChC,CAAC;YAED,+BAA+B;YAC/B,IAAI,YAAY,GAAG,QAAQ,CAAC;YAC5B,IAAI,OAAO,EAAE,CAAC;gBACZ,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAC5C,wBAAwB;gBACxB,IAAI,CAAC;oBACH,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBAChC,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,GAAG,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC;gBAChE,CAAC;YACH,CAAC;YAED,0DAA0D;YAC1D,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;YAEpF,0CAA0C;YAC1C,MAAM,IAAI,CAAC,kBAAkB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAExD,yBAAyB;YACzB,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAExD,OAAO,OAAO,CAAC;gBACb,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,OAAO,CAAC,KAAK;gBACtB,UAAU,EAAE,KAAK;gBACjB,UAAU,EAAE,IAAI,IAAI,EAAE;aACvB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mBAAmB;YACnB,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAExE,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACvE,OAAO,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,MAA0B;QAE1B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC;QAE3B,IAAI,CAAC;YACH,6CAA6C;YAC7C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,iCAAiC,GAAG,GAAG,EAAE;gBAC3E,OAAO,EAAE,eAAe;aACzB,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAwB,EAAE,CAAC;YAEzC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;oBAAE,SAAS;gBAE3B,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACpC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;oBAAE,SAAS;gBAE3B,iBAAiB;gBACjB,IAAI,OAAe,CAAC;gBACpB,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;oBACjC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC/D,CAAC;qBAAM,IAAI,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;oBACzC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;gBAC3C,CAAC;qBAAM,CAAC;oBACN,SAAS;gBACX,CAAC;gBAED,4CAA4C;gBAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,CAAC;oBACjD,QAAQ,CAAC,IAAI,CAAC;wBACZ,OAAO;wBACP,MAAM,EAAE,GAAG;qBACZ,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,OAAe,EACf,OAAe,EACf,WAAmB;QAEnB,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1D,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,QAAQ,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBAChE,OAAO,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,SAAiB,EACjB,OAAe,EACf,WAAmB;QAEnB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAChC,WAAW,SAAS,kBAAkB,EACtC,OAAO,EACP,WAAW,CACZ,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QACnC,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,GAAW,EAAE,IAAY;QACxD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAE/D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;gBAAE,SAAS;YAEpC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAE9C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/C,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACrD,CAAC;iBAAM,CAAC;gBACN,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/sources/fetchers/http.d.ts

@@ -0,0 +1,6 @@
+import type { SourceFetcherType } from './types.js';
+/**
+ * Creates an HTTP source fetcher.
+ */
+export declare function create_http_fetcher(): SourceFetcherType;
+//# sourceMappingURL=http.d.ts.map

package/dist/sources/fetchers/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/sources/fetchers/http.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAMpD;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,iBAAiB,CAEvD"}

package/dist/sources/fetchers/http.js

@@ -0,0 +1,159 @@
+import { exec } from 'node:child_process';
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs/promises';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { promisify } from 'node:util';
+import { Errors, failure, success, } from '../../core/index.js';
+import { is_http_source } from '../../schema/index.js';
+const exec_async = promisify(exec);
+const DEFAULT_TIMEOUT = 120_000; // 2 minutes
+/**
+ * Creates an HTTP source fetcher.
+ */
+export function create_http_fetcher() {
+    return new HttpFetcher();
+}
+class HttpFetcher {
+    type = 'http';
+    is_mutable(source) {
+        if (!is_http_source(source))
+            return true;
+        // HTTP sources with checksums are immutable (content is verified)
+        // Without checksum, we assume mutable
+        return source.http.checksum === undefined;
+    }
+    async fetch(source, options) {
+        if (!is_http_source(source)) {
+            return failure(Errors.invalid_argument('source', 'Expected an http source'));
+        }
+        const { url, checksum, headers } = source.http;
+        const timeout = options?.timeout ?? DEFAULT_TIMEOUT;
+        // Create temp directory for download
+        const temp_dir = await fs.mkdtemp(path.join(os.tmpdir(), 'kustodian-http-'));
+        const archive_path = path.join(temp_dir, 'archive');
+        try {
+            // Download the archive
+            const controller = new AbortController();
+            const timeout_id = setTimeout(() => controller.abort(), timeout);
+            const fetch_options = {
+                signal: controller.signal,
+            };
+            if (headers) {
+                fetch_options.headers = headers;
+            }
+            const response = await fetch(url, fetch_options);
+            clearTimeout(timeout_id);
+            if (!response.ok) {
+                if (response.status === 401 || response.status === 403) {
+                    return failure(Errors.source_auth_error(source.name));
+                }
+                return failure(Errors.source_fetch_error(source.name, new Error(`HTTP ${response.status}: ${response.statusText}`)));
+            }
+            // Write to file
+            const buffer = await response.arrayBuffer();
+            await fs.writeFile(archive_path, new Uint8Array(buffer));
+            // Verify checksum if provided
+            if (checksum) {
+                const verify_result = await this.verify_checksum(archive_path, checksum, source.name);
+                if (!verify_result.success) {
+                    return verify_result;
+                }
+            }
+            // Compute checksum for version identifier
+            const actual_checksum = await this.compute_checksum(archive_path);
+            // Extract archive
+            const extract_dir = path.join(temp_dir, 'extracted');
+            await fs.mkdir(extract_dir, { recursive: true });
+            const extract_result = await this.extract_archive(archive_path, extract_dir, url, source.name);
+            if (!extract_result.success) {
+                return extract_result;
+            }
+            // Find the actual content directory (archives often have a root folder)
+            const content_dir = await this.find_content_dir(extract_dir);
+            // Create clean output directory
+            const output_dir = await fs.mkdtemp(path.join(os.tmpdir(), 'kustodian-templates-'));
+            await fs.cp(content_dir, output_dir, { recursive: true });
+            // Cleanup
+            await fs.rm(temp_dir, { recursive: true, force: true });
+            return success({
+                path: output_dir,
+                version: checksum ?? `sha256:${actual_checksum.slice(0, 16)}`,
+                from_cache: false,
+                fetched_at: new Date(),
+            });
+        }
+        catch (error) {
+            // Cleanup on error
+            await fs.rm(temp_dir, { recursive: true, force: true }).catch(() => { });
+            if (error instanceof Error && error.name === 'AbortError') {
+                return failure(Errors.source_timeout(source.name, timeout));
+            }
+            return failure(Errors.source_fetch_error(source.name, error));
+        }
+    }
+    async list_versions(_source) {
+        // HTTP sources don't have version listing capability
+        return success([]);
+    }
+    async verify_checksum(file_path, expected, source_name) {
+        // Parse expected checksum (format: algorithm:hash or just hash for sha256)
+        const [algorithm, hash] = expected.includes(':')
+            ? expected.split(':')
+            : ['sha256', expected];
+        const actual = await this.compute_checksum(file_path, algorithm);
+        if (actual.toLowerCase() !== hash.toLowerCase()) {
+            return failure(Errors.source_checksum_mismatch(source_name, expected, `${algorithm}:${actual}`));
+        }
+        return success(undefined);
+    }
+    async compute_checksum(file_path, algorithm = 'sha256') {
+        const content = await fs.readFile(file_path);
+        return crypto.createHash(algorithm).update(new Uint8Array(content)).digest('hex');
+    }
+    async extract_archive(archive_path, dest_dir, url, source_name) {
+        const lower_url = url.toLowerCase();
+        try {
+            if (lower_url.endsWith('.tar.gz') || lower_url.endsWith('.tgz')) {
+                await exec_async(`tar -xzf "${archive_path}" -C "${dest_dir}"`);
+            }
+            else if (lower_url.endsWith('.tar')) {
+                await exec_async(`tar -xf "${archive_path}" -C "${dest_dir}"`);
+            }
+            else if (lower_url.endsWith('.zip')) {
+                await exec_async(`unzip -q "${archive_path}" -d "${dest_dir}"`);
+            }
+            else {
+                // Try to detect format from content
+                const { stdout } = await exec_async(`file "${archive_path}"`);
+                if (stdout.includes('gzip')) {
+                    await exec_async(`tar -xzf "${archive_path}" -C "${dest_dir}"`);
+                }
+                else if (stdout.includes('Zip')) {
+                    await exec_async(`unzip -q "${archive_path}" -d "${dest_dir}"`);
+                }
+                else if (stdout.includes('tar')) {
+                    await exec_async(`tar -xf "${archive_path}" -C "${dest_dir}"`);
+                }
+                else {
+                    return failure(Errors.invalid_argument('source', `Unknown archive format for ${url}`));
+                }
+            }
+            return success(undefined);
+        }
+        catch (error) {
+            return failure(Errors.source_fetch_error(source_name, error));
+        }
+    }
+    async find_content_dir(extract_dir) {
+        const entries = await fs.readdir(extract_dir, { withFileTypes: true });
+        const dirs = entries.filter((e) => e.isDirectory());
+        // If there's exactly one directory, assume it's the content root
+        if (dirs.length === 1 && entries.length === 1 && dirs[0]) {
+            return path.join(extract_dir, dirs[0].name);
+        }
+        // Otherwise, use the extract directory itself
+        return extract_dir;
+    }
+}
+//# sourceMappingURL=http.js.map

package/dist/sources/fetchers/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../../src/sources/fetchers/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EACL,MAAM,EAGN,OAAO,EACP,OAAO,GACR,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAA2B,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAIhF,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;AAEnC,MAAM,eAAe,GAAG,OAAO,CAAC,CAAC,YAAY;AAE7C;;GAEG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,IAAI,WAAW,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,WAAW;IACN,IAAI,GAAG,MAAe,CAAC;IAEhC,UAAU,CAAC,MAA0B;QACnC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,kEAAkE;QAClE,sCAAsC;QACtC,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,KAAK,CACT,MAA0B,EAC1B,OAA0B;QAE1B,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,OAAO,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAC/C,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,eAAe,CAAC;QAEpD,qCAAqC;QACrC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAC7E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAEpD,IAAI,CAAC;YACH,uBAAuB;YACvB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;YAEjE,MAAM,aAAa,GAAgB;gBACjC,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC;YAEF,IAAI,OAAO,EAAE,CAAC;gBACZ,aAAa,CAAC,OAAO,GAAG,OAAO,CAAC;YAClC,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;YACjD,YAAY,CAAC,UAAU,CAAC,CAAC;YAEzB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACvD,OAAO,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBACxD,CAAC;gBACD,OAAO,OAAO,CACZ,MAAM,CAAC,kBAAkB,CACvB,MAAM,CAAC,IAAI,EACX,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC,CAC7D,CACF,CAAC;YACJ,CAAC;YAED,gBAAgB;YAChB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YAEzD,8BAA8B;YAC9B,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBACtF,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;oBAC3B,OAAO,aAAa,CAAC;gBACvB,CAAC;YACH,CAAC;YAED,0CAA0C;YAC1C,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAElE,kBAAkB;YAClB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YACrD,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAEjD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,eAAe,CAC/C,YAAY,EACZ,WAAW,EACX,GAAG,EACH,MAAM,CAAC,IAAI,CACZ,CAAC;YACF,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;gBAC5B,OAAO,cAAc,CAAC;YACxB,CAAC;YAED,wEAAwE;YACxE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAE7D,gCAAgC;YAChC,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAC;YACpF,MAAM,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAE1D,UAAU;YACV,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAExD,OAAO,OAAO,CAAC;gBACb,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,QAAQ,IAAI,UAAU,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;gBAC7D,UAAU,EAAE,KAAK;gBACjB,UAAU,EAAE,IAAI,IAAI,EAAE;aACvB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mBAAmB;YACnB,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAExE,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC1D,OAAO,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9D,CAAC;YACD,OAAO,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,OAA2B;QAE3B,qDAAqD;QACrD,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,SAAiB,EACjB,QAAgB,EAChB,WAAmB;QAEnB,2EAA2E;QAC3E,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC9C,CAAC,CAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAsB;YAC3C,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAEzB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAEjE,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAChD,OAAO,OAAO,CACZ,MAAM,CAAC,wBAAwB,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,SAAS,IAAI,MAAM,EAAE,CAAC,CACjF,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,SAAiB,EAAE,SAAS,GAAG,QAAQ;QACpE,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpF,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,YAAoB,EACpB,QAAgB,EAChB,GAAW,EACX,WAAmB;QAEnB,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAEpC,IAAI,CAAC;YACH,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChE,MAAM,UAAU,CAAC,aAAa,YAAY,SAAS,QAAQ,GAAG,CAAC,CAAC;YAClE,CAAC;iBAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,MAAM,UAAU,CAAC,YAAY,YAAY,SAAS,QAAQ,GAAG,CAAC,CAAC;YACjE,CAAC;iBAAM,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,MAAM,UAAU,CAAC,aAAa,YAAY,SAAS,QAAQ,GAAG,CAAC,CAAC;YAClE,CAAC;iBAAM,CAAC;gBACN,oCAAoC;gBACpC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,SAAS,YAAY,GAAG,CAAC,CAAC;gBAC9D,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC5B,MAAM,UAAU,CAAC,aAAa,YAAY,SAAS,QAAQ,GAAG,CAAC,CAAC;gBAClE,CAAC;qBAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBAClC,MAAM,UAAU,CAAC,aAAa,YAAY,SAAS,QAAQ,GAAG,CAAC,CAAC;gBAClE,CAAC;qBAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;oBAClC,MAAM,UAAU,CAAC,YAAY,YAAY,SAAS,QAAQ,GAAG,CAAC,CAAC;gBACjE,CAAC;qBAAM,CAAC;oBACN,OAAO,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,8BAA8B,GAAG,EAAE,CAAC,CAAC,CAAC;gBACzF,CAAC;YACH,CAAC;YACD,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,WAAmB;QAChD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAEpD,iEAAiE;QACjE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;QAED,8CAA8C;QAC9C,OAAO,WAAW,CAAC;IACrB,CAAC;CACF"}

package/dist/sources/fetchers/index.d.ts

@@ -0,0 +1,11 @@
+export { create_git_fetcher } from './git.js';
+export { create_http_fetcher } from './http.js';
+export { create_oci_fetcher } from './oci.js';
+export type { SourceFetcherType } from './types.js';
+import { type TemplateSourceType } from '../../schema/index.js';
+import type { SourceFetcherType } from './types.js';
+/**
+ * Gets the appropriate fetcher for a source type.
+ */
+export declare function get_fetcher_for_source(source: TemplateSourceType): SourceFetcherType;
+//# sourceMappingURL=index.d.ts.map

package/dist/sources/fetchers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/sources/fetchers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,OAAO,EACL,KAAK,kBAAkB,EAIxB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,kBAAkB,GAAG,iBAAiB,CAYpF"}

package/dist/sources/fetchers/index.js

@@ -0,0 +1,24 @@
+export { create_git_fetcher } from './git.js';
+export { create_http_fetcher } from './http.js';
+export { create_oci_fetcher } from './oci.js';
+import { is_git_source, is_http_source, is_oci_source, } from '../../schema/index.js';
+import { create_git_fetcher } from './git.js';
+import { create_http_fetcher } from './http.js';
+import { create_oci_fetcher } from './oci.js';
+/**
+ * Gets the appropriate fetcher for a source type.
+ */
+export function get_fetcher_for_source(source) {
+    if (is_git_source(source)) {
+        return create_git_fetcher();
+    }
+    if (is_http_source(source)) {
+        return create_http_fetcher();
+    }
+    if (is_oci_source(source)) {
+        return create_oci_fetcher();
+    }
+    // This should never happen due to schema validation
+    throw new Error(`Unknown source type for source: ${source.name}`);
+}
+//# sourceMappingURL=index.js.map

package/dist/sources/fetchers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/sources/fetchers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAG9C,OAAO,EAEL,aAAa,EACb,cAAc,EACd,aAAa,GACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAG9C;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAA0B;IAC/D,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,kBAAkB,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,mBAAmB,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,kBAAkB,EAAE,CAAC;IAC9B,CAAC;IACD,oDAAoD;IACpD,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;AACpE,CAAC"}

package/dist/sources/fetchers/oci.d.ts

@@ -0,0 +1,6 @@
+import type { SourceFetcherType } from './types.js';
+/**
+ * Creates an OCI source fetcher.
+ */
+export declare function create_oci_fetcher(): SourceFetcherType;
+//# sourceMappingURL=oci.d.ts.map

package/dist/sources/fetchers/oci.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oci.d.ts","sourceRoot":"","sources":["../../../src/sources/fetchers/oci.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAMpD;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,iBAAiB,CAEtD"}

package/dist/sources/fetchers/oci.js

@@ -0,0 +1,156 @@
+import { exec } from 'node:child_process';
+import * as fs from 'node:fs/promises';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { promisify } from 'node:util';
+import { Errors, failure, success, } from '../../core/index.js';
+import { is_oci_source } from '../../schema/index.js';
+const exec_async = promisify(exec);
+const DEFAULT_TIMEOUT = 120_000; // 2 minutes
+/**
+ * Creates an OCI source fetcher.
+ */
+export function create_oci_fetcher() {
+    return new OciFetcher();
+}
+class OciFetcher {
+    type = 'oci';
+    is_mutable(source) {
+        if (!is_oci_source(source))
+            return true;
+        // Digests are immutable, 'latest' tag is mutable, other tags are treated as immutable
+        if (source.oci.digest)
+            return false;
+        return source.oci.tag === 'latest';
+    }
+    async fetch(source, options) {
+        if (!is_oci_source(source)) {
+            return failure(Errors.invalid_argument('source', 'Expected an oci source'));
+        }
+        const { registry, repository, tag, digest } = source.oci;
+        const timeout = options?.timeout ?? DEFAULT_TIMEOUT;
+        // Build OCI reference
+        const ref = digest ?? tag;
+        if (!ref) {
+            return failure(Errors.invalid_argument('source', 'No OCI tag or digest specified'));
+        }
+        const oci_ref = `${registry}/${repository}:${ref}`;
+        // Create temp directory for pull
+        const output_dir = await fs.mkdtemp(path.join(os.tmpdir(), 'kustodian-oci-'));
+        try {
+            // Try flux first, then oras
+            let pull_result = await this.try_flux_pull(oci_ref, output_dir, timeout, source.name);
+            if (!pull_result.success && pull_result.error.code === 'SOURCE_FETCH_ERROR') {
+                // Flux not available, try oras
+                pull_result = await this.try_oras_pull(oci_ref, output_dir, timeout, source.name);
+            }
+            if (!pull_result.success) {
+                return pull_result;
+            }
+            // Get the actual digest for version identifier
+            const version = digest ?? (await this.get_digest(registry, repository, ref, timeout, source.name));
+            return success({
+                path: output_dir,
+                version: version ?? ref,
+                from_cache: false,
+                fetched_at: new Date(),
+            });
+        }
+        catch (error) {
+            // Cleanup on error
+            await fs.rm(output_dir, { recursive: true, force: true }).catch(() => { });
+            return failure(Errors.source_fetch_error(source.name, error));
+        }
+    }
+    async list_versions(source) {
+        if (!is_oci_source(source)) {
+            return failure(Errors.invalid_argument('source', 'Expected an oci source'));
+        }
+        const { registry, repository } = source.oci;
+        try {
+            // Try using oras to list tags
+            const { stdout } = await exec_async(`oras repo tags ${registry}/${repository}`, {
+                timeout: DEFAULT_TIMEOUT,
+            });
+            const versions = stdout
+                .split('\n')
+                .map((line) => line.trim())
+                .filter((line) => line.length > 0)
+                .map((version) => ({ version }));
+            return success(versions);
+        }
+        catch {
+            // If oras fails, try crane
+            try {
+                const { stdout } = await exec_async(`crane ls ${registry}/${repository}`, {
+                    timeout: DEFAULT_TIMEOUT,
+                });
+                const versions = stdout
+                    .split('\n')
+                    .map((line) => line.trim())
+                    .filter((line) => line.length > 0)
+                    .map((version) => ({ version }));
+                return success(versions);
+            }
+            catch (error) {
+                return failure(Errors.source_fetch_error(source.name, error));
+            }
+        }
+    }
+    async try_flux_pull(oci_ref, output_dir, timeout, source_name) {
+        try {
+            await exec_async(`flux pull artifact oci://${oci_ref} --output="${output_dir}"`, { timeout });
+            return success(undefined);
+        }
+        catch (error) {
+            if (error instanceof Error && error.message.includes('not found')) {
+                return failure(Errors.source_fetch_error(source_name, new Error('flux CLI not found')));
+            }
+            if (error instanceof Error && error.message.includes('unauthorized')) {
+                return failure(Errors.source_auth_error(source_name, error));
+            }
+            if (error instanceof Error && 'killed' in error && error.killed) {
+                return failure(Errors.source_timeout(source_name, timeout));
+            }
+            return failure(Errors.source_fetch_error(source_name, error));
+        }
+    }
+    async try_oras_pull(oci_ref, output_dir, timeout, source_name) {
+        try {
+            await exec_async(`oras pull ${oci_ref} --output="${output_dir}"`, { timeout });
+            return success(undefined);
+        }
+        catch (error) {
+            if (error instanceof Error && error.message.includes('not found')) {
+                return failure(Errors.source_fetch_error(source_name, new Error('Neither flux nor oras CLI found')));
+            }
+            if (error instanceof Error && error.message.includes('unauthorized')) {
+                return failure(Errors.source_auth_error(source_name, error));
+            }
+            if (error instanceof Error && 'killed' in error && error.killed) {
+                return failure(Errors.source_timeout(source_name, timeout));
+            }
+            return failure(Errors.source_fetch_error(source_name, error));
+        }
+    }
+    async get_digest(registry, repository, tag, timeout, _source_name) {
+        try {
+            // Try crane first
+            const { stdout } = await exec_async(`crane digest ${registry}/${repository}:${tag}`, {
+                timeout,
+            });
+            return stdout.trim();
+        }
+        catch {
+            // If crane fails, try oras
+            try {
+                const { stdout } = await exec_async(`oras manifest fetch ${registry}/${repository}:${tag} --descriptor | jq -r .digest`, { timeout });
+                return stdout.trim() || null;
+            }
+            catch {
+                return null;
+            }
+        }
+    }
+}
+//# sourceMappingURL=oci.js.map

package/dist/sources/fetchers/oci.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oci.js","sourceRoot":"","sources":["../../../src/sources/fetchers/oci.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EACL,MAAM,EAGN,OAAO,EACP,OAAO,GACR,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAA2B,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAI/E,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;AAEnC,MAAM,eAAe,GAAG,OAAO,CAAC,CAAC,YAAY;AAE7C;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,IAAI,UAAU,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU;IACL,IAAI,GAAG,KAAc,CAAC;IAE/B,UAAU,CAAC,MAA0B;QACnC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,sFAAsF;QACtF,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACpC,OAAO,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,KAAK,CACT,MAA0B,EAC1B,OAA0B;QAE1B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC;QACzD,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,eAAe,CAAC;QAEpD,sBAAsB;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,GAAG,CAAC;QAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,gCAAgC,CAAC,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;QAEnD,iCAAiC;QACjC,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAE9E,IAAI,CAAC;YACH,4BAA4B;YAC5B,IAAI,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YAEtF,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBAC5E,+BAA+B;gBAC/B,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YACpF,CAAC;YAED,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBACzB,OAAO,WAAW,CAAC;YACrB,CAAC;YAED,+CAA+C;YAC/C,MAAM,OAAO,GACX,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAErF,OAAO,OAAO,CAAC;gBACb,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,OAAO,IAAI,GAAG;gBACvB,UAAU,EAAE,KAAK;gBACjB,UAAU,EAAE,IAAI,IAAI,EAAE;aACvB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mBAAmB;YACnB,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC1E,OAAO,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,MAA0B;QAE1B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC;QAE5C,IAAI,CAAC;YACH,8BAA8B;YAC9B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,kBAAkB,QAAQ,IAAI,UAAU,EAAE,EAAE;gBAC9E,OAAO,EAAE,eAAe;aACzB,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAwB,MAAM;iBACzC,KAAK,CAAC,IAAI,CAAC;iBACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;iBAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;iBACjC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YAEnC,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;YAC3B,IAAI,CAAC;gBACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,YAAY,QAAQ,IAAI,UAAU,EAAE,EAAE;oBACxE,OAAO,EAAE,eAAe;iBACzB,CAAC,CAAC;gBAEH,MAAM,QAAQ,GAAwB,MAAM;qBACzC,KAAK,CAAC,IAAI,CAAC;qBACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;qBAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;qBACjC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;gBAEnC,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,OAAe,EACf,UAAkB,EAClB,OAAe,EACf,WAAmB;QAEnB,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,4BAA4B,OAAO,cAAc,UAAU,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAC9F,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClE,OAAO,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;YAC1F,CAAC;YACD,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBACrE,OAAO,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,KAAK,YAAY,KAAK,IAAI,QAAQ,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBAChE,OAAO,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9D,CAAC;YACD,OAAO,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,aAAa,CACzB,OAAe,EACf,UAAkB,EAClB,OAAe,EACf,WAAmB;QAEnB,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,aAAa,OAAO,cAAc,UAAU,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAC/E,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClE,OAAO,OAAO,CACZ,MAAM,CAAC,kBAAkB,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC,CACrF,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBACrE,OAAO,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,KAAK,YAAY,KAAK,IAAI,QAAQ,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBAChE,OAAO,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9D,CAAC;YACD,OAAO,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,QAAgB,EAChB,UAAkB,EAClB,GAAW,EACX,OAAe,EACf,YAAoB;QAEpB,IAAI,CAAC;YACH,kBAAkB;YAClB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,gBAAgB,QAAQ,IAAI,UAAU,IAAI,GAAG,EAAE,EAAE;gBACnF,OAAO;aACR,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;YAC3B,IAAI,CAAC;gBACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CACjC,uBAAuB,QAAQ,IAAI,UAAU,IAAI,GAAG,+BAA+B,EACnF,EAAE,OAAO,EAAE,CACZ,CAAC;gBACF,OAAO,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/sources/fetchers/types.d.ts

@@ -0,0 +1,25 @@
+import type { KustodianErrorType, ResultType } from '../../core/index.js';
+import type { TemplateSourceType } from '../../schema/index.js';
+import type { FetchOptionsType, FetchResultType, RemoteVersionType } from '../types.js';
+/**
+ * Base interface for source fetchers.
+ * Each source type (git, http, oci) implements this interface.
+ */
+export interface SourceFetcherType {
+    /** Unique identifier for this fetcher type */
+    readonly type: 'git' | 'http' | 'oci';
+    /**
+     * Fetches templates from the source to a temporary directory.
+     * The caller is responsible for caching the result.
+     */
+    fetch(source: TemplateSourceType, options?: FetchOptionsType): Promise<ResultType<FetchResultType, KustodianErrorType>>;
+    /**
+     * Lists available versions from the remote.
+     */
+    list_versions(source: TemplateSourceType): Promise<ResultType<RemoteVersionType[], KustodianErrorType>>;
+    /**
+     * Determines if this source reference is mutable.
+     */
+    is_mutable(source: TemplateSourceType): boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/sources/fetchers/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/sources/fetchers/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAExF;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;IAEtC;;;OAGG;IACH,KAAK,CACH,MAAM,EAAE,kBAAkB,EAC1B,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,UAAU,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAE5D;;OAEG;IACH,aAAa,CACX,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,UAAU,CAAC,iBAAiB,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAEhE;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC;CACjD"}

package/dist/sources/fetchers/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/sources/fetchers/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/sources/fetchers/types.ts"],"names":[],"mappings":""}

package/dist/sources/index.d.ts

@@ -0,0 +1,6 @@
+export { type CacheMetaType, cache_meta_schema, calculate_expiry, create_cache_manager, DEFAULT_TTL, is_expired, META_FILENAME, parse_ttl, TEMPLATES_DIRNAME, } from './cache/index.js';
+export { create_git_fetcher, create_http_fetcher, create_oci_fetcher, get_fetcher_for_source, } from './fetchers/index.js';
+export { type LoadedSourcesResultType, type LoadSourcesOptionsType, load_templates_from_sources, type SourcedTemplateType, } from './loader.js';
+export { type CreateResolverOptionsType, create_source_resolver, DEFAULT_CACHE_DIR, } from './resolver.js';
+export type { CacheEntryType, CacheManagerType, FetchOptionsType, FetchResultType, RemoteVersionType, ResolvedSourceType, ResolverOptionsType, SourceFetcherType, SourceResolverType, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/sources/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sources/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,aAAa,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,WAAW,EACX,UAAU,EACV,aAAa,EACb,SAAS,EACT,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,2BAA2B,EAC3B,KAAK,mBAAmB,GACzB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,KAAK,yBAAyB,EAC9B,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,YAAY,CAAC"}