spell-runtime 1.0.0 → 1.1.0

package/dist/cli/index.js

@@ -5,12 +5,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runCli = runCli;
+const node_crypto_1 = require("node:crypto");
 const promises_1 = require("node:fs/promises");
 const node_path_1 = __importDefault(require("node:path"));
 const commander_1 = require("commander");
 const install_1 = require("../bundle/install");
 const store_1 = require("../bundle/store");
 const cast_1 = require("../runner/cast");
+const trustStore_1 = require("../signature/trustStore");
 const errors_1 = require("../util/errors");
 const paths_1 = require("../util/paths");
 async function runCli(argv = process.argv) {
@@ -90,6 +92,7 @@ async function runCli(argv = process.argv) {
         .option("--dry-run", "Validate and summarize only", false)
         .option("--yes", "Acknowledge high or critical risk", false)
         .option("--allow-billing", "Allow billing-enabled spells", false)
+        .option("--require-signature", "Require verified signature", false)
         .option("--verbose", "Verbose logs", false)
         .option("--profile <name>", "Reserved for future use")
         .action(async (id, options) => {
@@ -101,12 +104,62 @@ async function runCli(argv = process.argv) {
             dryRun: options.dryRun,
             yes: options.yes,
             allowBilling: options.allowBilling,
+            requireSignature: options.requireSignature,
             verbose: options.verbose,
             profile: options.profile
         });
         process.stdout.write(`execution_id: ${result.executionId}\n`);
         process.stdout.write(`log: ${result.logPath}\n`);
     });
+    const trust = program.command("trust").description("Manage trusted publisher keys");
+    trust
+        .command("add")
+        .description("Add or update a trusted publisher public key")
+        .argument("<publisher>", "Publisher (id prefix before first slash)")
+        .argument("<public-key>", "ed25519 public key (spki der) as base64url")
+        .option("--key-id <id>", "Key id", "default")
+        .action(async (publisher, publicKey, options) => {
+        const trimmed = publicKey.trim();
+        try {
+            const der = Buffer.from(trimmed, "base64url");
+            (0, node_crypto_1.createPublicKey)({ key: der, format: "der", type: "spki" });
+        }
+        catch (error) {
+            throw new errors_1.SpellError(`invalid public key: ${error.message}`);
+        }
+        await (0, trustStore_1.upsertTrustedPublisherKey)(publisher, {
+            key_id: options.keyId,
+            algorithm: "ed25519",
+            public_key: trimmed
+        });
+        process.stdout.write(`trusted publisher=${publisher} key_id=${options.keyId}\n`);
+    });
+    trust
+        .command("list")
+        .description("List trusted publishers")
+        .action(async () => {
+        const publishers = await (0, trustStore_1.listTrustedPublishers)();
+        if (publishers.length === 0) {
+            process.stdout.write("No trusted publishers\n");
+            return;
+        }
+        process.stdout.write("publisher\tkey_ids\n");
+        for (const entry of publishers) {
+            const ids = entry.keys.map((k) => k.key_id).sort().join(",");
+            process.stdout.write(`${entry.publisher}\t${ids}\n`);
+        }
+    });
+    trust
+        .command("remove")
+        .description("Remove a trusted publisher (all keys)")
+        .argument("<publisher>", "Publisher")
+        .action(async (publisher) => {
+        const removed = await (0, trustStore_1.removeTrustedPublisher)(publisher);
+        if (!removed) {
+            throw new errors_1.SpellError(`trusted publisher not found: ${publisher}`);
+        }
+        process.stdout.write(`removed publisher=${publisher}\n`);
+    });
     program
         .command("log")
         .description("Show execution log")

package/dist/cli/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";;;;;;AAUA,wBA0JC;AAnKD,+CAA4C;AAC5C,0DAA6B;AAC7B,yCAAoC;AACpC,+CAAkD;AAClD,2CAAuH;AACvH,yCAA2C;AAC3C,2CAA4C;AAC5C,yCAAyC;AAElC,KAAK,UAAU,MAAM,CAAC,OAAiB,OAAO,CAAC,IAAI;IACxD,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;IAE9B,OAAO;SACJ,IAAI,CAAC,OAAO,CAAC;SACb,WAAW,CAAC,oCAAoC,CAAC;SACjD,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAE5B,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,8BAA8B,CAAC;SAC3C,QAAQ,CAAC,cAAc,EAAE,4BAA4B,CAAC;SACtD,MAAM,CAAC,KAAK,EAAE,SAAiB,EAAE,EAAE;QAClC,MAAM,MAAM,GAAG,MAAM,IAAA,uBAAa,EAAC,SAAS,CAAC,CAAC;QAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,uBAAuB,CAAC;SACpC,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,MAAM,GAAG,MAAM,IAAA,2BAAmB,GAAE,CAAC;QAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;QACrF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,gBAAgB,IAAI,CACnH,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,yBAAyB,CAAC;SACtC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;SAC5B,MAAM,CAAC,qBAAqB,EAAE,kBAAkB,CAAC;SACjD,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,OAA6B,EAAE,EAAE;QAC1D,MAAM,MAAM,GAAG,MAAM,IAAA,8BAAsB,EAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,IAAA,8BAAsB,EAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAChF,MAAM,aAAa,GAAG,IAAA,uBAAe,EAAC,MAAM,CAAC,CAAC;QAE9C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;QAC3E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC;QACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;QAEzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,IAAI,CAAC,CAAC;QACtF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,IAAI,CAAC,CAAC;QAEvF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,UAAU,CAAC,SAAS,WAAW,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtG,CAAC;QACH,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,MAAM,CAAC,IAAI,WAAW,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;QACpG,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,aAAa,QAAQ,CAAC,OAAO,CAAC,OAAO,SAAS,QAAQ,CAAC,OAAO,CAAC,IAAI,eAAe,QAAQ,CAAC,OAAO,CAAC,UAAU,aAAa,QAAQ,CAAC,OAAO,CAAC,QAAQ,IAAI,CACxJ,CAAC;QAEF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,eAAe,QAAQ,CAAC,OAAO,CAAC,SAAS,iBAAiB,QAAQ,CAAC,OAAO,CAAC,YAAY,IAAI,GAAG,cAAc,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CACrJ,CAAC;QAEF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,KAAK,CAAC,IAAI,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxF,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,cAAc,CAAC;SAC3B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;SAC5B,MAAM,CAAC,qBAAqB,EAAE,kBAAkB,CAAC;SACjD,MAAM,CAAC,yBAAyB,EAAE,gBAAgB,EAAE,aAAa,EAAE,EAAE,CAAC;SACtE,MAAM,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;SAC3C,MAAM,CAAC,WAAW,EAAE,6BAA6B,EAAE,KAAK,CAAC;SACzD,MAAM,CAAC,OAAO,EAAE,mCAAmC,EAAE,KAAK,CAAC;SAC3D,MAAM,CAAC,iBAAiB,EAAE,8BAA8B,EAAE,KAAK,CAAC;SAChE,MAAM,CAAC,WAAW,EAAE,cAAc,EAAE,KAAK,CAAC;SAC1C,MAAM,CAAC,kBAAkB,EAAE,yBAAyB,CAAC;SACrD,MAAM,CACL,KAAK,EACH,EAAU,EACV,OASC,EACD,EAAE;QACF,MAAM,MAAM,GAAG,MAAM,IAAA,gBAAS,EAAC;YAC7B,EAAE;YACF,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,UAAU,EAAE,OAAO,CAAC,KAAK;YACzB,SAAS,EAAE,OAAO,CAAC,KAAK;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QAEH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;QAC9D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;IACnD,CAAC,CACF,CAAC;IAEJ,OAAO;SACJ,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,oBAAoB,CAAC;SACjC,QAAQ,CAAC,gBAAgB,EAAE,yBAAyB,CAAC;SACrD,MAAM,CAAC,KAAK,EAAE,WAAmB,EAAE,EAAE;QACpC,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,OAAO,CAAC;QACrF,MAAM,QAAQ,GAAG,mBAAI,CAAC,IAAI,CAAC,IAAA,gBAAQ,GAAE,EAAE,QAAQ,CAAC,CAAC;QAEjD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAA,mBAAQ,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,mBAAU,CAAC,kBAAkB,WAAW,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEL,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACrC,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,QAAkB;IACtD,OAAO,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC5B,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACrB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";;;;;;AAYA,wBAoNC;AA/ND,6CAA8C;AAC9C,+CAA4C;AAC5C,0DAA6B;AAC7B,yCAAoC;AACpC,+CAAkD;AAClD,2CAAuH;AACvH,yCAA2C;AAC3C,wDAAmH;AACnH,2CAA4C;AAC5C,yCAAyC;AAElC,KAAK,UAAU,MAAM,CAAC,OAAiB,OAAO,CAAC,IAAI;IACxD,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;IAE9B,OAAO;SACJ,IAAI,CAAC,OAAO,CAAC;SACb,WAAW,CAAC,oCAAoC,CAAC;SACjD,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAE5B,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,8BAA8B,CAAC;SAC3C,QAAQ,CAAC,cAAc,EAAE,4BAA4B,CAAC;SACtD,MAAM,CAAC,KAAK,EAAE,SAAiB,EAAE,EAAE;QAClC,MAAM,MAAM,GAAG,MAAM,IAAA,uBAAa,EAAC,SAAS,CAAC,CAAC;QAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,uBAAuB,CAAC;SACpC,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,MAAM,GAAG,MAAM,IAAA,2BAAmB,GAAE,CAAC;QAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;QACrF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,gBAAgB,IAAI,CACnH,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,yBAAyB,CAAC;SACtC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;SAC5B,MAAM,CAAC,qBAAqB,EAAE,kBAAkB,CAAC;SACjD,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,OAA6B,EAAE,EAAE;QAC1D,MAAM,MAAM,GAAG,MAAM,IAAA,8BAAsB,EAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,IAAA,8BAAsB,EAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QAChF,MAAM,aAAa,GAAG,IAAA,uBAAe,EAAC,MAAM,CAAC,CAAC;QAE9C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;QAC3E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC;QACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,QAAQ,CAAC,OAAO,IAAI,CAAC,CAAC;QAEzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,IAAI,CAAC,CAAC;QACtF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,IAAI,CAAC,CAAC;QAEvF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,UAAU,CAAC,SAAS,WAAW,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtG,CAAC;QACH,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,MAAM,CAAC,IAAI,WAAW,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;QACpG,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,aAAa,QAAQ,CAAC,OAAO,CAAC,OAAO,SAAS,QAAQ,CAAC,OAAO,CAAC,IAAI,eAAe,QAAQ,CAAC,OAAO,CAAC,UAAU,aAAa,QAAQ,CAAC,OAAO,CAAC,QAAQ,IAAI,CACxJ,CAAC;QAEF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,eAAe,QAAQ,CAAC,OAAO,CAAC,SAAS,iBAAiB,QAAQ,CAAC,OAAO,CAAC,YAAY,IAAI,GAAG,cAAc,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CACrJ,CAAC;QAEF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,KAAK,CAAC,IAAI,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxF,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,cAAc,CAAC;SAC3B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;SAC5B,MAAM,CAAC,qBAAqB,EAAE,kBAAkB,CAAC;SACjD,MAAM,CAAC,yBAAyB,EAAE,gBAAgB,EAAE,aAAa,EAAE,EAAE,CAAC;SACtE,MAAM,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;SAC3C,MAAM,CAAC,WAAW,EAAE,6BAA6B,EAAE,KAAK,CAAC;SACzD,MAAM,CAAC,OAAO,EAAE,mCAAmC,EAAE,KAAK,CAAC;SAC3D,MAAM,CAAC,iBAAiB,EAAE,8BAA8B,EAAE,KAAK,CAAC;SAChE,MAAM,CAAC,qBAAqB,EAAE,4BAA4B,EAAE,KAAK,CAAC;SAClE,MAAM,CAAC,WAAW,EAAE,cAAc,EAAE,KAAK,CAAC;SAC1C,MAAM,CAAC,kBAAkB,EAAE,yBAAyB,CAAC;SACrD,MAAM,CACL,KAAK,EACH,EAAU,EACV,OAUC,EACD,EAAE;QACF,MAAM,MAAM,GAAG,MAAM,IAAA,gBAAS,EAAC;YAC7B,EAAE;YACF,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,UAAU,EAAE,OAAO,CAAC,KAAK;YACzB,SAAS,EAAE,OAAO,CAAC,KAAK;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QAEH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;QAC9D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;IACnD,CAAC,CACF,CAAC;IAEJ,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,+BAA+B,CAAC,CAAC;IAEpF,KAAK;SACF,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,8CAA8C,CAAC;SAC3D,QAAQ,CAAC,aAAa,EAAE,0CAA0C,CAAC;SACnE,QAAQ,CAAC,cAAc,EAAE,4CAA4C,CAAC;SACtE,MAAM,CAAC,eAAe,EAAE,QAAQ,EAAE,SAAS,CAAC;SAC5C,MAAM,CAAC,KAAK,EAAE,SAAiB,EAAE,SAAiB,EAAE,OAA0B,EAAE,EAAE;QACjF,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAC9C,IAAA,6BAAe,EAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,mBAAU,CAAC,uBAAwB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,IAAA,sCAAyB,EAAC,SAAS,EAAE;YACzC,MAAM,EAAE,OAAO,CAAC,KAAK;YACrB,SAAS,EAAE,SAAS;YACpB,UAAU,EAAE,OAAO;SACpB,CAAC,CAAC;QAEH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,SAAS,WAAW,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,yBAAyB,CAAC;SACtC,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,UAAU,GAAG,MAAM,IAAA,kCAAqB,GAAE,CAAC;QACjD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC7C,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,SAAS,KAAK,GAAG,IAAI,CAAC,CAAC;QACvD,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,uCAAuC,CAAC;SACpD,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC;SACpC,MAAM,CAAC,KAAK,EAAE,SAAiB,EAAE,EAAE;QAClC,MAAM,OAAO,GAAG,MAAM,IAAA,mCAAsB,EAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,mBAAU,CAAC,gCAAgC,SAAS,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,SAAS,IAAI,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,oBAAoB,CAAC;SACjC,QAAQ,CAAC,gBAAgB,EAAE,yBAAyB,CAAC;SACrD,MAAM,CAAC,KAAK,EAAE,WAAmB,EAAE,EAAE;QACpC,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,OAAO,CAAC;QACrF,MAAM,QAAQ,GAAG,mBAAI,CAAC,IAAI,CAAC,IAAA,gBAAQ,GAAE,EAAE,QAAQ,CAAC,CAAC;QAEjD,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAA,mBAAQ,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,mBAAU,CAAC,kBAAkB,WAAW,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEL,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;QACrC,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,QAAkB;IACtD,OAAO,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC5B,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACrB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/contract/buttonRegistry.d.ts

@@ -0,0 +1,21 @@
+export interface ButtonRequiredConfirmations {
+    risk: boolean;
+    billing: boolean;
+}
+export interface ButtonRegistryEntry {
+    button_id: string;
+    spell_id: string;
+    version: string;
+    defaults: Record<string, unknown>;
+    required_confirmations: ButtonRequiredConfirmations;
+    require_signature?: boolean;
+    allowed_roles: string[];
+    label?: string;
+    description?: string;
+}
+export interface ButtonRegistryV1 {
+    version: "v1";
+    buttons: ButtonRegistryEntry[];
+}
+export declare function loadButtonRegistryFromFile(filePath: string): Promise<ButtonRegistryV1>;
+export declare function resolveButtonEntry(registry: ButtonRegistryV1, buttonId: string): ButtonRegistryEntry;

package/dist/contract/buttonRegistry.js

@@ -0,0 +1,103 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadButtonRegistryFromFile = loadButtonRegistryFromFile;
+exports.resolveButtonEntry = resolveButtonEntry;
+const promises_1 = require("node:fs/promises");
+const _2020_1 = __importDefault(require("ajv/dist/2020"));
+const errors_1 = require("../util/errors");
+const ajv = new _2020_1.default({ allErrors: true, strict: false });
+const registrySchema = {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    type: "object",
+    additionalProperties: false,
+    required: ["version", "buttons"],
+    properties: {
+        version: { const: "v1" },
+        buttons: {
+            type: "array",
+            minItems: 1,
+            items: {
+                type: "object",
+                additionalProperties: false,
+                required: [
+                    "button_id",
+                    "spell_id",
+                    "version",
+                    "defaults",
+                    "required_confirmations",
+                    "allowed_roles"
+                ],
+                properties: {
+                    button_id: { type: "string", minLength: 1 },
+                    spell_id: { type: "string", minLength: 1 },
+                    version: { type: "string", minLength: 1 },
+                    defaults: { type: "object" },
+                    required_confirmations: {
+                        type: "object",
+                        additionalProperties: false,
+                        required: ["risk", "billing"],
+                        properties: {
+                            risk: { type: "boolean" },
+                            billing: { type: "boolean" }
+                        }
+                    },
+                    require_signature: { type: "boolean" },
+                    allowed_roles: {
+                        type: "array",
+                        minItems: 1,
+                        items: { type: "string", minLength: 1 }
+                    },
+                    label: { type: "string" },
+                    description: { type: "string" }
+                }
+            }
+        }
+    }
+};
+const validateRegistry = ajv.compile(registrySchema);
+async function loadButtonRegistryFromFile(filePath) {
+    let raw;
+    try {
+        raw = await (0, promises_1.readFile)(filePath, "utf8");
+    }
+    catch {
+        throw new errors_1.SpellError(`button registry file not found: ${filePath}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (error) {
+        throw new errors_1.SpellError(`failed to parse button registry JSON: ${error.message}`);
+    }
+    const ok = validateRegistry(parsed);
+    if (!ok) {
+        const details = (validateRegistry.errors ?? [])
+            .map((e) => `${e.instancePath || "/"} ${e.message}`.trim())
+            .join("; ");
+        throw new errors_1.SpellError(`button registry validation failed: ${details}`);
+    }
+    const registry = parsed;
+    assertUniqueButtonIds(registry.buttons);
+    return registry;
+}
+function resolveButtonEntry(registry, buttonId) {
+    const found = registry.buttons.find((entry) => entry.button_id === buttonId);
+    if (!found) {
+        throw new errors_1.SpellError(`unknown button_id: ${buttonId}`);
+    }
+    return found;
+}
+function assertUniqueButtonIds(buttons) {
+    const seen = new Set();
+    for (const entry of buttons) {
+        if (seen.has(entry.button_id)) {
+            throw new errors_1.SpellError(`duplicate button_id in registry: ${entry.button_id}`);
+        }
+        seen.add(entry.button_id);
+    }
+}
+//# sourceMappingURL=buttonRegistry.js.map

package/dist/contract/buttonRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"buttonRegistry.js","sourceRoot":"","sources":["../../src/contract/buttonRegistry.ts"],"names":[],"mappings":";;;;;AA+EA,gEA2BC;AAED,gDAMC;AAlHD,+CAA4C;AAC5C,0DAAwD;AACxD,2CAA4C;AAwB5C,MAAM,GAAG,GAAG,IAAI,eAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAE5D,MAAM,cAAc,GAAG;IACrB,OAAO,EAAE,8CAA8C;IACvD,IAAI,EAAE,QAAQ;IACd,oBAAoB,EAAE,KAAK;IAC3B,QAAQ,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;IAChC,UAAU,EAAE;QACV,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;QACxB,OAAO,EAAE;YACP,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,CAAC;YACX,KAAK,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,oBAAoB,EAAE,KAAK;gBAC3B,QAAQ,EAAE;oBACR,WAAW;oBACX,UAAU;oBACV,SAAS;oBACT,UAAU;oBACV,wBAAwB;oBACxB,eAAe;iBAChB;gBACD,UAAU,EAAE;oBACV,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;oBAC3C,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;oBAC1C,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;oBACzC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC5B,sBAAsB,EAAE;wBACtB,IAAI,EAAE,QAAQ;wBACd,oBAAoB,EAAE,KAAK;wBAC3B,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;wBAC7B,UAAU,EAAE;4BACV,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;4BACzB,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;yBAC7B;qBACF;oBACD,iBAAiB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;oBACtC,aAAa,EAAE;wBACb,IAAI,EAAE,OAAO;wBACb,QAAQ,EAAE,CAAC;wBACX,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;qBACxC;oBACD,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACzB,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAChC;aACF;SACF;KACF;CACO,CAAC;AAEX,MAAM,gBAAgB,GAAG,GAAG,CAAC,OAAO,CAAC,cAA2B,CAAC,CAAC;AAE3D,KAAK,UAAU,0BAA0B,CAAC,QAAgB;IAC/D,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,IAAA,mBAAQ,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAU,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,mBAAU,CAAC,yCAA0C,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,OAAO,GAAG,CAAC,gBAAgB,CAAC,MAAM,IAAI,EAAE,CAAC;aAC5C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,YAAY,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC;aAC1D,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,mBAAU,CAAC,sCAAsC,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,QAAQ,GAAG,MAA0B,CAAC;IAC5C,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAExC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAgB,kBAAkB,CAAC,QAA0B,EAAE,QAAgB;IAC7E,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC;IAC7E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,mBAAU,CAAC,sBAAsB,QAAQ,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,OAA8B;IAC3D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,mBAAU,CAAC,oCAAoC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC"}

package/dist/logging/executionLog.js

@@ -9,6 +9,7 @@ const promises_1 = require("node:fs/promises");
 const node_path_1 = __importDefault(require("node:path"));
 const idKey_1 = require("../util/idKey");
 const paths_1 = require("../util/paths");
+const redact_1 = require("../util/redact");
 function makeExecutionId(id, version, now = new Date()) {
     const ts = toTimestamp(now);
     return `${ts}_${(0, idKey_1.sanitizeIdForFilename)(id)}_${(0, idKey_1.sanitizeIdForFilename)(version)}.json`;
@@ -16,7 +17,8 @@ function makeExecutionId(id, version, now = new Date()) {
 async function writeExecutionLog(log) {
     await (0, paths_1.ensureSpellDirs)();
     const filePath = node_path_1.default.join((0, paths_1.logsRoot)(), log.execution_id);
-    await (0, promises_1.writeFile)(filePath, `${JSON.stringify(log, null, 2)}\n`, "utf8");
+    const sanitized = (0, redact_1.redactSecrets)(log);
+    await (0, promises_1.writeFile)(filePath, `${JSON.stringify(sanitized, null, 2)}\n`, "utf8");
     return filePath;
 }
 function toTimestamp(date) {

package/dist/logging/executionLog.js.map

@@ -1 +1 @@
-{"version":3,"file":"executionLog.js","sourceRoot":"","sources":["../../src/logging/executionLog.ts"],"names":[],"mappings":";;;;;AAMA,0CAGC;AAED,8CAKC;AAhBD,+CAA6C;AAC7C,0DAA6B;AAE7B,yCAAsD;AACtD,yCAA0D;AAE1D,SAAgB,eAAe,CAAC,EAAU,EAAE,OAAe,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IAC3E,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,GAAG,EAAE,IAAI,IAAA,6BAAqB,EAAC,EAAE,CAAC,IAAI,IAAA,6BAAqB,EAAC,OAAO,CAAC,OAAO,CAAC;AACrF,CAAC;AAEM,KAAK,UAAU,iBAAiB,CAAC,GAAiB;IACvD,MAAM,IAAA,uBAAe,GAAE,CAAC;IACxB,MAAM,QAAQ,GAAG,mBAAI,CAAC,IAAI,CAAC,IAAA,gBAAQ,GAAE,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,MAAM,IAAA,oBAAS,EAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,IAAU;IAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzD,OAAO,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;AACzC,CAAC"}
+{"version":3,"file":"executionLog.js","sourceRoot":"","sources":["../../src/logging/executionLog.ts"],"names":[],"mappings":";;;;;AAOA,0CAGC;AAED,8CAMC;AAlBD,+CAA6C;AAC7C,0DAA6B;AAE7B,yCAAsD;AACtD,yCAA0D;AAC1D,2CAA+C;AAE/C,SAAgB,eAAe,CAAC,EAAU,EAAE,OAAe,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IAC3E,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,GAAG,EAAE,IAAI,IAAA,6BAAqB,EAAC,EAAE,CAAC,IAAI,IAAA,6BAAqB,EAAC,OAAO,CAAC,OAAO,CAAC;AACrF,CAAC;AAEM,KAAK,UAAU,iBAAiB,CAAC,GAAiB;IACvD,MAAM,IAAA,uBAAe,GAAE,CAAC;IACxB,MAAM,QAAQ,GAAG,mBAAI,CAAC,IAAI,CAAC,IAAA,gBAAQ,GAAE,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,IAAA,sBAAa,EAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAA,oBAAS,EAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,IAAU;IAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzD,OAAO,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;AACzC,CAAC"}

package/dist/runner/cast.js

@@ -12,7 +12,10 @@ const errors_1 = require("../util/errors");
 const platform_1 = require("../util/platform");
 const input_1 = require("./input");
 const hostRunner_1 = require("./hostRunner");
+const dockerRunner_1 = require("./dockerRunner");
 const summary_1 = require("./summary");
+const verify_1 = require("../signature/verify");
+const trustStore_1 = require("../signature/trustStore");
 async function castSpell(options) {
     const logger = (0, pino_1.default)({ level: options.verbose ? "debug" : "info" });
     const startedAt = new Date().toISOString();
@@ -54,13 +57,38 @@ async function castSpell(options) {
             billing: manifest.billing,
             runtime: manifest.runtime
         };
+        log.signature = {
+            required: options.requireSignature,
+            status: "skipped"
+        };
         const input = await (0, input_1.buildInput)(options.inputFile, options.paramPairs);
         log.input = input;
         const schema = await (0, store_1.readSchemaFromManifest)(manifest, bundlePath);
         (0, input_1.validateInputAgainstSchema)(schema, input);
+        const sigResult = await (0, verify_1.verifyBundleSignature)(manifest, bundlePath).catch((error) => ({
+            ok: false,
+            status: "invalid",
+            publisher: (0, trustStore_1.publisherFromId)(manifest.id),
+            key_id: undefined,
+            digest: undefined,
+            message: error.message
+        }));
+        log.signature = {
+            required: options.requireSignature,
+            status: sigResult.status,
+            publisher: sigResult.publisher,
+            key_id: sigResult.key_id,
+            digest: sigResult.digest
+        };
+        if (options.requireSignature) {
+            (0, verify_1.enforceSignatureOrThrow)(sigResult);
+        }
         const hostPlatform = (0, platform_1.detectHostPlatform)();
-        if (!manifest.runtime.platforms.includes(hostPlatform)) {
-            throw new errors_1.SpellError(`platform mismatch: host=${hostPlatform}, spell supports=${manifest.runtime.platforms.join(",")}`);
+        const dockerPlatform = (0, platform_1.detectDockerPlatformForHost)();
+        const platformTarget = manifest.runtime.execution === "docker" ? dockerPlatform : hostPlatform;
+        const platformOk = (0, platform_1.platformMatches)(manifest.runtime.platforms, platformTarget);
+        if (!platformOk) {
+            throw new errors_1.SpellError(`platform mismatch: host=${hostPlatform}, runtime=${manifest.runtime.execution}, target=${platformTarget}, spell supports=${manifest.runtime.platforms.join(",")}`);
         }
         if ((manifest.risk === "high" || manifest.risk === "critical") && !options.yes) {
             throw new errors_1.SpellError(`risk ${manifest.risk} requires --yes`);
@@ -86,7 +114,19 @@ async function castSpell(options) {
             };
         }
         if (manifest.runtime.execution === "docker") {
-            throw new errors_1.SpellError("docker execution is not supported in v1");
+            logger.debug({ id: manifest.id, version: manifest.version }, "starting docker execution");
+            const dockerResult = await (0, dockerRunner_1.runDocker)(manifest, bundlePath, input);
+            log.steps = dockerResult.stepResults;
+            log.outputs = dockerResult.outputs;
+            log.checks = dockerResult.checks;
+            log.success = true;
+            log.finished_at = new Date().toISOString();
+            const logPath = await (0, executionLog_1.writeExecutionLog)(log);
+            return {
+                executionId,
+                logPath,
+                outputs: dockerResult.outputs
+            };
         }
         logger.debug({ id: manifest.id, version: manifest.version }, "starting host execution");
         const runResult = await (0, hostRunner_1.runHost)(manifest, bundlePath, input);

package/dist/runner/cast.js.map

@@ -1 +1 @@
-{"version":3,"file":"cast.js","sourceRoot":"","sources":["../../src/runner/cast.ts"],"names":[],"mappings":";;;;;AAiBA,8BAwHC;AAzID,gDAAwB;AACxB,iDAAoD;AACpD,2CAAiF;AACjF,0DAA6E;AAE7E,2CAA4C;AAC5C,+CAAsD;AACtD,mCAAiE;AACjE,6CAAuC;AACvC,uCAAmD;AAQ5C,KAAK,UAAU,SAAS,CAAC,OAAoB;IAClD,MAAM,MAAM,GAAG,IAAA,cAAI,EAAC,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3C,IAAI,WAAW,GAAG,IAAA,8BAAe,EAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,CAAC;IAE3E,MAAM,GAAG,GAAiB;QACxB,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,SAAS;QACrB,WAAW,EAAE,SAAS;QACtB,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,QAAQ;QACpC,KAAK,EAAE,EAAE;QACT,OAAO,EAAE;YACP,IAAI,EAAE,KAAK;YACX,OAAO,EAAE;gBACP,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,CAAC;aACd;YACD,OAAO,EAAE;gBACP,SAAS,EAAE,MAAM;gBACjB,SAAS,EAAE,EAAE;aACd;SACF;QACD,KAAK,EAAE,EAAE;QACT,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,KAAK;KACf,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,8BAAsB,EAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACzE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;QAExC,WAAW,GAAG,IAAA,8BAAe,EAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7D,GAAG,CAAC,YAAY,GAAG,WAAW,CAAC;QAC/B,GAAG,CAAC,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;QACrB,GAAG,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QAC/B,GAAG,CAAC,OAAO,GAAG;YACZ,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;SAC1B,CAAC;QAEF,MAAM,KAAK,GAAG,MAAM,IAAA,kBAAU,EAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACtE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;QAElB,MAAM,MAAM,GAAG,MAAM,IAAA,8BAAsB,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAClE,IAAA,kCAA0B,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAE1C,MAAM,YAAY,GAAG,IAAA,6BAAkB,GAAE,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,mBAAU,CAClB,2BAA2B,YAAY,oBAAoB,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAClG,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YAC/E,MAAM,IAAI,mBAAU,CAAC,QAAQ,QAAQ,CAAC,IAAI,iBAAiB,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YACtD,MAAM,IAAI,mBAAU,CAAC,0CAA0C,CAAC,CAAC;QACnE,CAAC;QAED,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC9C,MAAM,QAAQ,GAAG,aAAa,UAAU,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC;YACpG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,mBAAU,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAA,gCAAsB,EAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAE9D,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;YACnB,GAAG,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAG,MAAM,IAAA,gCAAiB,EAAC,GAAG,CAAC,CAAC;YAC7C,OAAO;gBACL,WAAW,EAAE,WAAW;gBACxB,OAAO;gBACP,OAAO,EAAE,EAAE;aACZ,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,mBAAU,CAAC,yCAAyC,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,yBAAyB,CAAC,CAAC;QAExF,MAAM,SAAS,GAAG,MAAM,IAAA,oBAAO,EAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QAC7D,GAAG,CAAC,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC;QAClC,GAAG,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;QAEhC,MAAM,YAAY,GAAG,MAAM,IAAA,yBAAc,EAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAChG,GAAG,CAAC,MAAM,GAAG,YAAY,CAAC;QAE1B,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,mBAAU,CAAC,iBAAiB,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;QACnB,GAAG,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,IAAA,gCAAiB,EAAC,GAAG,CAAC,CAAC;QAE7C,OAAO;YACL,WAAW;YACX,OAAO;YACP,OAAO,EAAE,SAAS,CAAC,OAAO;SAC3B,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,KAAK,GAAI,KAAe,CAAC,OAAO,CAAC;QACrC,GAAG,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,IAAA,gCAAiB,EAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"cast.js","sourceRoot":"","sources":["../../src/runner/cast.ts"],"names":[],"mappings":";;;;;AAoBA,8BAoKC;AAxLD,gDAAwB;AACxB,iDAAoD;AACpD,2CAAiF;AACjF,0DAA6E;AAE7E,2CAA4C;AAC5C,+CAAoG;AACpG,mCAAiE;AACjE,6CAAuC;AACvC,iDAA2C;AAC3C,uCAAmD;AACnD,gDAAqF;AACrF,wDAA0D;AAQnD,KAAK,UAAU,SAAS,CAAC,OAAoB;IAClD,MAAM,MAAM,GAAG,IAAA,cAAI,EAAC,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAE3C,IAAI,WAAW,GAAG,IAAA,8BAAe,EAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,CAAC;IAE3E,MAAM,GAAG,GAAiB;QACxB,YAAY,EAAE,WAAW;QACzB,UAAU,EAAE,SAAS;QACrB,WAAW,EAAE,SAAS;QACtB,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,QAAQ;QACpC,KAAK,EAAE,EAAE;QACT,OAAO,EAAE;YACP,IAAI,EAAE,KAAK;YACX,OAAO,EAAE;gBACP,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,CAAC;aACd;YACD,OAAO,EAAE;gBACP,SAAS,EAAE,MAAM;gBACjB,SAAS,EAAE,EAAE;aACd;SACF;QACD,KAAK,EAAE,EAAE;QACT,OAAO,EAAE,EAAE;QACX,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,KAAK;KACf,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,8BAAsB,EAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACzE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;QAExC,WAAW,GAAG,IAAA,8BAAe,EAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7D,GAAG,CAAC,YAAY,GAAG,WAAW,CAAC;QAC/B,GAAG,CAAC,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;QACrB,GAAG,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QAC/B,GAAG,CAAC,OAAO,GAAG;YACZ,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;SAC1B,CAAC;QAEF,GAAG,CAAC,SAAS,GAAG;YACd,QAAQ,EAAE,OAAO,CAAC,gBAAgB;YAClC,MAAM,EAAE,SAAS;SAClB,CAAC;QAEF,MAAM,KAAK,GAAG,MAAM,IAAA,kBAAU,EAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACtE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;QAElB,MAAM,MAAM,GAAG,MAAM,IAAA,8BAAsB,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAClE,IAAA,kCAA0B,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAE1C,MAAM,SAAS,GAAG,MAAM,IAAA,8BAAqB,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACpF,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,SAAkB;YAC1B,SAAS,EAAE,IAAA,4BAAe,EAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,SAAS;YACjB,OAAO,EAAG,KAAe,CAAC,OAAO;SAClC,CAAC,CAAC,CAAC;QAEJ,GAAG,CAAC,SAAS,GAAG;YACd,QAAQ,EAAE,OAAO,CAAC,gBAAgB;YAClC,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,MAAM,EAAE,SAAS,CAAC,MAAM;SACzB,CAAC;QAEF,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC7B,IAAA,gCAAuB,EAAC,SAAS,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,YAAY,GAAG,IAAA,6BAAkB,GAAE,CAAC;QAC1C,MAAM,cAAc,GAAG,IAAA,sCAA2B,GAAE,CAAC;QACrD,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC;QAC/F,MAAM,UAAU,GAAG,IAAA,0BAAe,EAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QAC/E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,mBAAU,CAClB,2BAA2B,YAAY,aAAa,QAAQ,CAAC,OAAO,CAAC,SAAS,YAAY,cAAc,oBAAoB,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CACnK,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YAC/E,MAAM,IAAI,mBAAU,CAAC,QAAQ,QAAQ,CAAC,IAAI,iBAAiB,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YACtD,MAAM,IAAI,mBAAU,CAAC,0CAA0C,CAAC,CAAC;QACnE,CAAC;QAED,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC9C,MAAM,QAAQ,GAAG,aAAa,UAAU,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC;YACpG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,mBAAU,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAA,gCAAsB,EAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAE9D,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;YACnB,GAAG,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAG,MAAM,IAAA,gCAAiB,EAAC,GAAG,CAAC,CAAC;YAC7C,OAAO;gBACL,WAAW,EAAE,WAAW;gBACxB,OAAO;gBACP,OAAO,EAAE,EAAE;aACZ,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,2BAA2B,CAAC,CAAC;YAE1F,MAAM,YAAY,GAAG,MAAM,IAAA,wBAAS,EAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;YAClE,GAAG,CAAC,KAAK,GAAG,YAAY,CAAC,WAAW,CAAC;YACrC,GAAG,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;YACnC,GAAG,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;YAEjC,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;YACnB,GAAG,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAG,MAAM,IAAA,gCAAiB,EAAC,GAAG,CAAC,CAAC;YAE7C,OAAO;gBACL,WAAW;gBACX,OAAO;gBACP,OAAO,EAAE,YAAY,CAAC,OAAO;aAC9B,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,EAAE,yBAAyB,CAAC,CAAC;QAExF,MAAM,SAAS,GAAG,MAAM,IAAA,oBAAO,EAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QAC7D,GAAG,CAAC,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC;QAClC,GAAG,CAAC,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;QAEhC,MAAM,YAAY,GAAG,MAAM,IAAA,yBAAc,EAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAChG,GAAG,CAAC,MAAM,GAAG,YAAY,CAAC;QAE1B,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,mBAAU,CAAC,iBAAiB,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;QACnB,GAAG,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,IAAA,gCAAiB,EAAC,GAAG,CAAC,CAAC;QAE7C,OAAO;YACL,WAAW;YACX,OAAO;YACP,OAAO,EAAE,SAAS,CAAC,OAAO;SAC3B,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,KAAK,GAAI,KAAe,CAAC,OAAO,CAAC;QACrC,GAAG,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,IAAA,gCAAiB,EAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/runner/dockerRunner.d.ts

@@ -0,0 +1,9 @@
+import { SpellBundleManifest, CheckResult, StepResult } from "../types";
+export interface DockerRunnerResult {
+    success: boolean;
+    error?: string;
+    stepResults: StepResult[];
+    outputs: Record<string, unknown>;
+    checks: CheckResult[];
+}
+export declare function runDocker(manifest: SpellBundleManifest, bundlePath: string, input: Record<string, unknown>): Promise<DockerRunnerResult>;

package/dist/runner/dockerRunner.js

@@ -0,0 +1,121 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runDocker = runDocker;
+const promises_1 = require("node:fs/promises");
+const node_os_1 = require("node:os");
+const node_path_1 = __importDefault(require("node:path"));
+const node_child_process_1 = require("node:child_process");
+const errors_1 = require("../util/errors");
+async function runDocker(manifest, bundlePath, input) {
+    const dockerImage = manifest.runtime.docker_image;
+    if (!dockerImage) {
+        throw new errors_1.SpellError("runtime.docker_image is required when runtime.execution=docker");
+    }
+    const tempDir = await (0, promises_1.mkdtemp)(node_path_1.default.join((0, node_os_1.tmpdir)(), "spell-docker-"));
+    const inputPath = node_path_1.default.join(tempDir, "input.json");
+    await (0, promises_1.writeFile)(inputPath, JSON.stringify(input), "utf8");
+    try {
+        const args = buildDockerArgs(dockerImage, bundlePath, tempDir, manifest);
+        const { code, stdout, stderr } = await runProcess("docker", args, process.cwd());
+        if (code !== 0) {
+            throw new errors_1.SpellError(stderr.trim() || `docker exited with code ${code}`);
+        }
+        const parsed = parseRunnerJson(stdout);
+        if (!parsed.success) {
+            throw new errors_1.SpellError(parsed.error ?? "docker spell failed");
+        }
+        return parsed;
+    }
+    catch (error) {
+        const message = error.message;
+        if (message.includes("ENOENT") || message.includes("spawn docker")) {
+            throw new errors_1.SpellError("docker not found: install docker and ensure it is on PATH");
+        }
+        throw error;
+    }
+    finally {
+        await (0, promises_1.rm)(tempDir, { recursive: true, force: true });
+    }
+}
+function buildDockerArgs(dockerImage, bundlePath, tempDir, manifest) {
+    const inputInContainer = "/tmp/spell-input/input.json";
+    const envVars = collectEnvVarsToPass(manifest);
+    const args = [
+        "run",
+        "--rm",
+        "-i",
+        "--workdir",
+        "/spell",
+        "-v",
+        `${node_path_1.default.resolve(bundlePath)}:/spell:ro`,
+        "-v",
+        `${node_path_1.default.resolve(tempDir)}:/tmp/spell-input:ro`,
+        "-e",
+        `INPUT_JSON=${inputInContainer}`
+    ];
+    for (const [key, value] of envVars) {
+        args.push("-e", `${key}=${value}`);
+    }
+    args.push(dockerImage, "spell-runner", "/spell/spell.yaml", inputInContainer);
+    return args;
+}
+function collectEnvVarsToPass(manifest) {
+    const out = [];
+    // pass connector tokens only (and fail earlier if missing)
+    for (const permission of manifest.permissions) {
+        const tokenKey = `CONNECTOR_${permission.connector.toUpperCase().replace(/[^A-Z0-9]/g, "_")}_TOKEN`;
+        const value = process.env[tokenKey];
+        if (typeof value === "string" && value.trim() !== "") {
+            out.push([tokenKey, value]);
+        }
+    }
+    return out;
+}
+function parseRunnerJson(stdout) {
+    const trimmed = stdout.trim();
+    if (!trimmed) {
+        throw new errors_1.SpellError("docker runner produced no output");
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(trimmed);
+    }
+    catch {
+        throw new errors_1.SpellError("failed to parse docker runner output JSON");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new errors_1.SpellError("docker runner output must be a JSON object");
+    }
+    const obj = parsed;
+    return {
+        success: Boolean(obj.success),
+        error: typeof obj.error === "string" ? obj.error : undefined,
+        stepResults: Array.isArray(obj.stepResults) ? obj.stepResults : [],
+        outputs: obj.outputs && typeof obj.outputs === "object" && !Array.isArray(obj.outputs) ? obj.outputs : {},
+        checks: Array.isArray(obj.checks) ? obj.checks : []
+    };
+}
+async function runProcess(command, args, cwd) {
+    const child = (0, node_child_process_1.spawn)(command, args, {
+        shell: false,
+        cwd,
+        env: process.env
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (chunk) => {
+        stdout += chunk.toString();
+    });
+    child.stderr.on("data", (chunk) => {
+        stderr += chunk.toString();
+    });
+    const code = await new Promise((resolve, reject) => {
+        child.once("error", reject);
+        child.once("close", (exitCode) => resolve(exitCode ?? 1));
+    });
+    return { code, stdout, stderr };
+}
+//# sourceMappingURL=dockerRunner.js.map

package/dist/runner/dockerRunner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dockerRunner.js","sourceRoot":"","sources":["../../src/runner/dockerRunner.ts"],"names":[],"mappings":";;;;;AAeA,8BAqCC;AApDD,+CAA0D;AAC1D,qCAAiC;AACjC,0DAA6B;AAC7B,2DAA2C;AAE3C,2CAA4C;AAUrC,KAAK,UAAU,SAAS,CAC7B,QAA6B,EAC7B,UAAkB,EAClB,KAA8B;IAE9B,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC;IAClD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,mBAAU,CAAC,gEAAgE,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,IAAA,kBAAO,EAAC,mBAAI,CAAC,IAAI,CAAC,IAAA,gBAAM,GAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,mBAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACnD,MAAM,IAAA,oBAAS,EAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;IAE1D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACzE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAEjF,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,MAAM,IAAI,mBAAU,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,2BAA2B,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,mBAAU,CAAC,MAAM,CAAC,KAAK,IAAI,qBAAqB,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAI,KAAe,CAAC,OAAO,CAAC;QACzC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,mBAAU,CAAC,2DAA2D,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,IAAA,aAAE,EAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,WAAmB,EAAE,UAAkB,EAAE,OAAe,EAAE,QAA6B;IAC9G,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;IACvD,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAE/C,MAAM,IAAI,GAAa;QACrB,KAAK;QACL,MAAM;QACN,IAAI;QACJ,WAAW;QACX,QAAQ;QACR,IAAI;QACJ,GAAG,mBAAI,CAAC,OAAO,CAAC,UAAU,CAAC,YAAY;QACvC,IAAI;QACJ,GAAG,mBAAI,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB;QAC9C,IAAI;QACJ,cAAc,gBAAgB,EAAE;KACjC,CAAC;IAEF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,QAA6B;IACzD,MAAM,GAAG,GAA4B,EAAE,CAAC;IAExC,2DAA2D;IAC3D,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,aAAa,UAAU,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,QAAQ,CAAC;QACpG,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,mBAAU,CAAC,kCAAkC,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAY,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,mBAAU,CAAC,2CAA2C,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,mBAAU,CAAC,4CAA4C,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QAC7B,KAAK,EAAE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QAC5D,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,WAA4B,CAAC,CAAC,CAAC,EAAE;QACpF,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,OAAmC,CAAC,CAAC,CAAC,EAAE;QACtI,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,MAAwB,CAAC,CAAC,CAAC,EAAE;KACvE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,OAAe,EACf,IAAc,EACd,GAAW;IAEX,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,OAAO,EAAE,IAAI,EAAE;QACjC,KAAK,EAAE,KAAK;QACZ,GAAG;QACH,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IAEH,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;QAChC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;QAChC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACzD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC"}

package/dist/runner/spell-runner.d.ts

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import { CheckResult, StepResult } from "../types";
+interface RunnerResult {
+    success: boolean;
+    error?: string;
+    stepResults: StepResult[];
+    outputs: Record<string, unknown>;
+    checks: CheckResult[];
+}
+export declare function runSpellRunner(manifestPath: string, inputPath: string): Promise<RunnerResult>;
+export {};