swarm-deploy 0.0.0 → 0.2.0

package/dist/hooks-module.js

@@ -0,0 +1,118 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadHooksModule = loadHooksModule;
+const _path_1 = __importDefault(require("#path"));
+const errors_js_1 = require("./errors.js");
+const hooks_js_1 = require("./hooks.js");
+const HOOK_NAMES = ['beforeCommit', 'afterCommit', 'onFailure'];
+const HOOK_EXTENSIONS = ['.js', '.mjs', '.cjs'];
+function rejected(modulePath, reason) {
+    // Only the basename and a fixed reason: module text, stack traces, causes and
+    // directory names can carry secrets and must never reach the operator log.
+    return new errors_js_1.SwarmDeployError(errors_js_1.ERRORS.PROTOCOL_INVALID, `Unable to load hooks module ${_path_1.default.basename(modulePath)}: ${reason}`);
+}
+function fileUrl(file) {
+    if (/^[A-Za-z]:[\\/]/.test(file)) {
+        return `file:///${encodeURI(file.replace(/\\/g, '/')).replace(/[?#]/g, encodeURIComponent)}`;
+    }
+    return `file://${encodeURI(file).replace(/[?#]/g, encodeURIComponent)}`;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function hasOwn(value, name) {
+    return Object.prototype.hasOwnProperty.call(value, name);
+}
+/** Reads an error's string `code` without ever letting a hostile getter or proxy throw. */
+function errorCode(error) {
+    try {
+        if ((typeof error !== 'object' && typeof error !== 'function') || error === null) {
+            return undefined;
+        }
+        const code = error.code;
+        return typeof code === 'string' ? code : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The default export's hook object, or `undefined` when the default is absent or not
+ * a plain object (function, primitive, null, array). Unwraps exactly one explicit
+ * `__esModule` interop level (TypeScript-compiled CommonJS).
+ */
+function defaultHooks(namespace) {
+    if (!hasOwn(namespace, 'default'))
+        return undefined;
+    const fallback = namespace.default;
+    if (fallback === undefined)
+        return undefined;
+    if (!isRecord(fallback))
+        return undefined;
+    if (hasOwn(fallback, '__esModule') &&
+        fallback.__esModule === true &&
+        hasOwn(fallback, 'default')) {
+        const inner = fallback.default;
+        return isRecord(inner) ? inner : undefined;
+    }
+    return fallback;
+}
+/**
+ * Loads a JavaScript hooks module (`.js`, `.mjs` or `.cjs`) and returns the
+ * validated, frozen hook snapshot. Only `beforeCommit`, `afterCommit` and
+ * `onFailure` are picked, by own property name; other exports are ignored.
+ * Defined named exports take precedence over the default export's callbacks. Every failure is a fixed-message configuration
+ * error that never includes module content.
+ */
+async function loadHooksModule(modulePath, cwd) {
+    if (typeof modulePath !== 'string' || modulePath.length === 0) {
+        throw new errors_js_1.SwarmDeployError(errors_js_1.ERRORS.PROTOCOL_INVALID, 'Invalid hooks module path');
+    }
+    if (typeof cwd !== 'string' || cwd.length === 0) {
+        throw new errors_js_1.SwarmDeployError(errors_js_1.ERRORS.PROTOCOL_INVALID, 'Invalid working directory');
+    }
+    const resolved = _path_1.default.resolve(cwd, modulePath);
+    // Checked before the import so an unsupported extension gives a precise
+    // startup error instead of whatever the runtime's loader happens to say.
+    if (!HOOK_EXTENSIONS.includes(_path_1.default.extname(resolved))) {
+        throw rejected(modulePath, 'unsupported module extension');
+    }
+    let namespace;
+    try {
+        namespace = (await import(fileUrl(resolved)));
+    }
+    catch (error) {
+        const code = errorCode(error);
+        if (code === 'ERR_MODULE_NOT_FOUND' || code === 'MODULE_NOT_FOUND') {
+            throw rejected(modulePath, 'module not found');
+        }
+        throw rejected(modulePath, 'module failed to load');
+    }
+    try {
+        const merged = Object.create(null);
+        const fallback = defaultHooks(namespace);
+        for (const name of HOOK_NAMES) {
+            if (fallback !== undefined && hasOwn(fallback, name)) {
+                const value = fallback[name];
+                if (value !== undefined)
+                    merged[name] = value;
+            }
+            if (hasOwn(namespace, name)) {
+                const value = namespace[name];
+                if (value !== undefined)
+                    merged[name] = value;
+            }
+        }
+        const snapshot = (0, hooks_js_1.snapshotHooks)(merged);
+        if (Reflect.ownKeys(snapshot).length === 0)
+            throw new Error('empty');
+        return snapshot;
+    }
+    catch {
+        throw rejected(modulePath, 'invalid hooks exports');
+    }
+}
+//# sourceMappingURL=hooks-module.js.map

package/dist/hooks-module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks-module.js","sourceRoot":"","sources":["../src/hooks-module.ts"],"names":[],"mappings":";;;;;;AAAA,kDAAwB;AACxB,2CAAsD;AACtD,yCAA4D;AAE5D,MAAM,UAAU,GAAG,CAAC,cAAc,EAAE,aAAa,EAAE,WAAW,CAAU,CAAA;AACxE,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;AAE/C,SAAS,QAAQ,CAAC,UAAkB,EAAE,MAAc;IAClD,8EAA8E;IAC9E,2EAA2E;IAC3E,OAAO,IAAI,4BAAgB,CACzB,kBAAM,CAAC,gBAAgB,EACvB,+BAA+B,eAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,MAAM,EAAE,CACtE,CAAA;AACH,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,OAAO,WAAW,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,CAAA;IAC9F,CAAC;IACD,OAAO,UAAU,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,kBAAkB,CAAC,EAAE,CAAA;AACzE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,SAAS,MAAM,CAAC,KAAa,EAAE,IAAY;IACzC,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;AAC1D,CAAC;AAED,2FAA2F;AAC3F,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,CAAC;QACH,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,UAAU,CAAC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACjF,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,MAAM,IAAI,GAAa,KAA4B,CAAC,IAAI,CAAA;QACxD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,SAAkC;IACtD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC;QAAE,OAAO,SAAS,CAAA;IACnD,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAA;IAClC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC5C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAA;IACzC,IACE,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC;QAC9B,QAAQ,CAAC,UAAU,KAAK,IAAI;QAC5B,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,EAC3B,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAA;QAC9B,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5C,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;GAMG;AACI,KAAK,0BAA0B,UAAkB,EAAE,GAAW;IACnE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,4BAAgB,CAAC,kBAAM,CAAC,gBAAgB,EAAE,2BAA2B,CAAC,CAAA;IAClF,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,4BAAgB,CAAC,kBAAM,CAAC,gBAAgB,EAAE,2BAA2B,CAAC,CAAA;IAClF,CAAC;IACD,MAAM,QAAQ,GAAG,eAAI,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;IAC9C,wEAAwE;IACxE,yEAAyE;IACzE,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,eAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,QAAQ,CAAC,UAAU,EAAE,8BAA8B,CAAC,CAAA;IAC5D,CAAC;IAED,IAAI,SAAkC,CAAA;IACtC,IAAI,CAAC;QACH,SAAS,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAA4B,CAAA;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAA;QAC7B,IAAI,IAAI,KAAK,sBAAsB,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACnE,MAAM,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAA;QAChD,CAAC;QACD,MAAM,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAA;IACrD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAA4B,CAAA;QAC7D,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;QACxC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;gBACrD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;gBAC5B,IAAI,KAAK,KAAK,SAAS;oBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;YAC/C,CAAC;YACD,IAAI,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC5B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;gBAC7B,IAAI,KAAK,KAAK,SAAS;oBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;YAC/C,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,IAAA,wBAAa,EAAC,MAAqB,CAAC,CAAA;QACrD,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAA;QACpE,OAAO,QAAQ,CAAA;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,QAAQ,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAA;IACrD,CAAC;AACH,CAAC"}

package/dist/hooks.d.ts

@@ -0,0 +1,69 @@
+import { type AbortSignalLike } from './abort.js';
+import { SwarmDeployError } from './errors.js';
+import type { ReleaseCoordinates } from './release.js';
+import type { ArtifactKind } from './types.js';
+export type HookFailurePhase = 'offer' | 'transfer' | 'verification' | 'beforeCommit' | 'commit' | 'afterCommit';
+/** Immutable, secret-free description of the artifact a hook is observing. */
+export interface HookArtifact {
+    name: string;
+    kind: ArtifactKind;
+    size: number;
+    /** The file digest, or the canonical tree digest. */
+    sha256: string;
+    transferId: string;
+    /** Present only for a directory artifact. */
+    entryCount?: number;
+    sourceParent?: string;
+    release?: ReleaseCoordinates;
+}
+export interface BeforeCommitContext {
+    artifact: HookArtifact;
+    /** Absolute path of the verified staging file. */
+    path: string;
+    resumed: boolean;
+    alreadyCommitted: false;
+}
+export interface AfterCommitContext {
+    artifact: HookArtifact;
+    /** Absolute path of the durably committed artifact. */
+    path: string;
+    resumed: boolean;
+    alreadyCommitted: boolean;
+}
+export interface HookFailureContext {
+    artifact: HookArtifact;
+    /** The best known absolute path, or `null` before one exists. */
+    path: string | null;
+    phase: HookFailurePhase;
+    resumed: boolean;
+    alreadyCommitted: boolean;
+    error: unknown;
+}
+export interface ServerHooks {
+    beforeCommit?(context: BeforeCommitContext): void | Promise<void>;
+    afterCommit?(context: AfterCommitContext): void | Promise<void>;
+    onFailure?(context: HookFailureContext): void | Promise<void>;
+}
+/**
+ * Validates and freezes caller hooks. Each property is read exactly once and no
+ * receiver is bound, so later mutation of the caller's object cannot change the
+ * callbacks a running server invokes.
+ */
+export declare function snapshotHooks(hooks: ServerHooks | null | undefined): Readonly<ServerHooks>;
+/**
+ * Wraps a failed callback. The message is fixed so callback text (which may
+ * carry secrets) never reaches the wire; the original error stays on `cause`.
+ */
+export declare function hookError(phase: HookFailurePhase, cause: unknown): SwarmDeployError;
+/**
+ * The error an `onFailure` hook should see: the raw exception for failures this
+ * module wrapped, otherwise the error unchanged. Only identity-tracked wrappers
+ * unwrap, so a forged `HOOK_FAILED` error cannot masquerade as one.
+ */
+export declare function callbackError(error: unknown): unknown;
+/**
+ * Calls a callback with no receiver and settles when it does or when the
+ * server aborts, whichever is first. A callback that outlives an abort keeps
+ * running detached; its later rejection is swallowed.
+ */
+export declare function invokeHook<Context>(callback: (context: Context) => void | Promise<void>, context: Context, signal: AbortSignalLike): Promise<'completed' | 'aborted'>;

package/dist/hooks.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.snapshotHooks = snapshotHooks;
+exports.hookError = hookError;
+exports.callbackError = callbackError;
+exports.invokeHook = invokeHook;
+const abort_js_1 = require("./abort.js");
+const errors_js_1 = require("./errors.js");
+const WRAPPED_CALLBACK_ERRORS = new WeakMap();
+const HOOK_NAMES = ['beforeCommit', 'afterCommit', 'onFailure'];
+/**
+ * Validates and freezes caller hooks. Each property is read exactly once and no
+ * receiver is bound, so later mutation of the caller's object cannot change the
+ * callbacks a running server invokes.
+ */
+function snapshotHooks(hooks) {
+    if (hooks === null || hooks === undefined)
+        return Object.freeze({});
+    if (typeof hooks !== 'object') {
+        throw new errors_js_1.SwarmDeployError(errors_js_1.ERRORS.PROTOCOL_INVALID, 'Invalid hooks');
+    }
+    for (const name of Reflect.ownKeys(hooks)) {
+        if (!HOOK_NAMES.includes(name)) {
+            throw new errors_js_1.SwarmDeployError(errors_js_1.ERRORS.PROTOCOL_INVALID, 'Unknown hook');
+        }
+    }
+    const snapshot = {};
+    for (const name of HOOK_NAMES) {
+        const callback = hooks[name];
+        if (callback === undefined)
+            continue;
+        if (typeof callback !== 'function') {
+            throw new errors_js_1.SwarmDeployError(errors_js_1.ERRORS.PROTOCOL_INVALID, `Invalid ${name} hook`);
+        }
+        Object.defineProperty(snapshot, name, {
+            value: callback,
+            enumerable: true,
+            writable: false,
+            configurable: false
+        });
+    }
+    return Object.freeze(snapshot);
+}
+/**
+ * Wraps a failed callback. The message is fixed so callback text (which may
+ * carry secrets) never reaches the wire; the original error stays on `cause`.
+ */
+function hookError(phase, cause) {
+    const error = new errors_js_1.SwarmDeployError(errors_js_1.ERRORS.HOOK_FAILED, `Deployment hook failed during ${phase}`, cause);
+    WRAPPED_CALLBACK_ERRORS.set(error, cause);
+    return error;
+}
+/**
+ * The error an `onFailure` hook should see: the raw exception for failures this
+ * module wrapped, otherwise the error unchanged. Only identity-tracked wrappers
+ * unwrap, so a forged `HOOK_FAILED` error cannot masquerade as one.
+ */
+function callbackError(error) {
+    return error instanceof errors_js_1.SwarmDeployError && WRAPPED_CALLBACK_ERRORS.has(error)
+        ? WRAPPED_CALLBACK_ERRORS.get(error)
+        : error;
+}
+/**
+ * Calls a callback with no receiver and settles when it does or when the
+ * server aborts, whichever is first. A callback that outlives an abort keeps
+ * running detached; its later rejection is swallowed.
+ */
+async function invokeHook(callback, context, signal) {
+    let pending;
+    try {
+        pending = Promise.resolve(callback(context));
+    }
+    catch (cause) {
+        pending = Promise.reject(cause);
+    }
+    pending.catch(() => { });
+    let release = () => { };
+    const aborted = new Promise((resolve) => {
+        release = (0, abort_js_1.onAbort)(signal, () => resolve('aborted'));
+    });
+    try {
+        return await Promise.race([pending.then(() => 'completed'), aborted]);
+    }
+    finally {
+        release();
+    }
+}
+//# sourceMappingURL=hooks.js.map

package/dist/hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":";;;;;;AAAA,yCAA0D;AAC1D,2CAAsD;AAqDtD,MAAM,uBAAuB,GAAG,IAAI,OAAO,EAA6B,CAAA;AACxE,MAAM,UAAU,GAAG,CAAC,cAAc,EAAE,aAAa,EAAE,WAAW,CAAU,CAAA;AAExE;;;;GAIG;AACH,uBAA8B,KAAqC;IACjE,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACnE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,4BAAgB,CAAC,kBAAM,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAA;IACtE,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAE,UAA2C,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,4BAAgB,CAAC,kBAAM,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAA;QACrE,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAgB,EAAE,CAAA;IAChC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAY,KAAK,CAAC,IAAI,CAAC,CAAA;QACrC,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAQ;QACpC,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,4BAAgB,CAAC,kBAAM,CAAC,gBAAgB,EAAE,WAAW,IAAI,OAAO,CAAC,CAAA;QAC7E,CAAC;QACD,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,EAAE;YACpC,KAAK,EAAE,QAAQ;YACf,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,KAAK;YACf,YAAY,EAAE,KAAK;SACpB,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;AAChC,CAAC;AAED;;;GAGG;AACH,mBAA0B,KAAuB,EAAE,KAAc;IAC/D,MAAM,KAAK,GAAG,IAAI,4BAAgB,CAChC,kBAAM,CAAC,WAAW,EAClB,iCAAiC,KAAK,EAAE,EACxC,KAAK,CACN,CAAA;IACD,uBAAuB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACzC,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,uBAA8B,KAAc;IAC1C,OAAO,KAAK,YAAY,4BAAgB,IAAI,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC;QAC5E,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC;QACpC,CAAC,CAAC,KAAK,CAAA;AACX,CAAC;AAED;;;;GAIG;AACI,KAAK,qBACV,QAAoD,EACpD,OAAgB,EAChB,MAAuB;IAEvB,IAAI,OAAsB,CAAA;IAC1B,IAAI,CAAC;QACH,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACjC,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACvB,IAAI,OAAO,GAAG,GAAS,EAAE,GAAE,CAAC,CAAA;IAC5B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,EAAE;QACjD,OAAO,GAAG,IAAA,kBAAO,EAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IACF,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,WAAoB,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;IAChF,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC"}

package/dist/identity.d.ts

@@ -0,0 +1,7 @@
+import type { BinaryInput, KeyPair, PublicKey, Seed, SeedInput } from './types.js';
+export type { BinaryInput, KeyPair };
+export declare function parseSeed(value: string): Seed;
+export declare function parsePublicKey(value: string): PublicKey;
+export declare function generateSeed(): Seed;
+export declare function keyPairFromSeed(seed: SeedInput): KeyPair;
+export declare function publicKeyFromSeed(seed: SeedInput): PublicKey;

package/dist/identity.js

@@ -0,0 +1,50 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseSeed = parseSeed;
+exports.parsePublicKey = parsePublicKey;
+exports.generateSeed = generateSeed;
+exports.keyPairFromSeed = keyPairFromSeed;
+exports.publicKeyFromSeed = publicKeyFromSeed;
+const b4a_1 = __importDefault(require("b4a"));
+const sodium_native_1 = __importDefault(require("sodium-native"));
+const errors_js_1 = require("./errors.js");
+const CANONICAL_HEX64 = /^[0-9a-f]{64}$/;
+function parseCanonicalHex(value, code) {
+    if (typeof value !== 'string' || !CANONICAL_HEX64.test(value)) {
+        throw new errors_js_1.SwarmDeployError(code, `Expected lowercase 64-character hex string`);
+    }
+    return b4a_1.default.from(value, 'hex');
+}
+function parseSeed(value) {
+    return parseCanonicalHex(value, errors_js_1.ERRORS.INVALID_SEED);
+}
+function parsePublicKey(value) {
+    return parseCanonicalHex(value, errors_js_1.ERRORS.INVALID_PUBLIC_KEY);
+}
+function generateSeed() {
+    const seed = b4a_1.default.allocUnsafe(32);
+    sodium_native_1.default.randombytes_buf(seed);
+    return seed;
+}
+function normalizeSeed(seed) {
+    if (typeof seed === 'string')
+        return parseSeed(seed);
+    if (!b4a_1.default.isBuffer(seed) || seed.byteLength !== 32) {
+        throw new errors_js_1.SwarmDeployError(errors_js_1.ERRORS.INVALID_SEED, 'Expected 32-byte seed');
+    }
+    return b4a_1.default.from(seed);
+}
+function keyPairFromSeed(seed) {
+    const normalized = normalizeSeed(seed);
+    const publicKey = b4a_1.default.alloc(32);
+    const secretKey = b4a_1.default.alloc(64);
+    sodium_native_1.default.crypto_sign_seed_keypair(publicKey, secretKey, normalized);
+    return { publicKey, secretKey };
+}
+function publicKeyFromSeed(seed) {
+    return keyPairFromSeed(seed).publicKey;
+}
+//# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,8CAAqB;AACrB,kEAAkC;AAClC,2CAAsD;AAKtD,MAAM,eAAe,GAAG,gBAAgB,CAAA;AAExC,SAAS,iBAAiB,CACxB,KAAa,EACb,IAAmE;IAEnE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,4BAAgB,CAAC,IAAI,EAAE,4CAA4C,CAAC,CAAA;IAChF,CAAC;IACD,OAAO,aAAG,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;AAC/B,CAAC;AAED,mBAA0B,KAAa;IACrC,OAAO,iBAAiB,CAAC,KAAK,EAAE,kBAAM,CAAC,YAAY,CAAC,CAAA;AACtD,CAAC;AAED,wBAA+B,KAAa;IAC1C,OAAO,iBAAiB,CAAC,KAAK,EAAE,kBAAM,CAAC,kBAAkB,CAAC,CAAA;AAC5D,CAAC;AAED;IACE,MAAM,IAAI,GAAG,aAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;IAChC,uBAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;IAC5B,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,aAAa,CAAC,IAAe;IACpC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAA;IACpD,IAAI,CAAC,aAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,4BAAgB,CAAC,kBAAM,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,aAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACvB,CAAC;AAED,yBAAgC,IAAe;IAC7C,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IACtC,MAAM,SAAS,GAAG,aAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC/B,MAAM,SAAS,GAAG,aAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC/B,uBAAM,CAAC,wBAAwB,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;IACjE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAA;AACjC,CAAC;AAED,2BAAkC,IAAe;IAC/C,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,SAAS,CAAA;AACxC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+export { ERRORS, SwarmDeployError, type ErrorCode } from './errors.js';
+export type { Binary, BinaryInput, Digest, FingerprintEvent, KeyPair, Logger, PublicKey, PublicKeyInput, Seed, SeedInput, ServerScheduler } from './types.js';
+export { parseSeed, parsePublicKey, generateSeed, keyPairFromSeed, publicKeyFromSeed } from './identity.js';
+export type { AfterCommitContext, BeforeCommitContext, HookArtifact, HookFailureContext, HookFailurePhase, ServerHooks } from './hooks.js';
+export { fixedSeriesKey, type ReleaseCoordinates, type VersionGranularity } from './release.js';
+export { parseAllowlist } from './allowlist.js';
+export type { ArtifactKind } from './types.js';
+export type { UploadTarget } from './files.js';
+export type { SymlinkRule } from './symlinks.js';
+export { Server, type AllowlistKey, type RecoveryEvent, type RetentionEvent, type ServerCloseEvent, type ServerConnectionEvent, type ServerEvent, type ServerEventName, type ServerEventMap, type ServerListeningEvent, type ServerOfferEvent, type ServerOptions, type ServerProgressEvent, type ServerTransferLifecycleEvent } from './server.js';
+export { Client, type ClientEvent, type ClientEventMap, type ClientEventName, type ClientOfferEvent, type ClientOptions, type ClientProgressEvent, type ClientResultEvent, type ClientUploadResult, type UploadResult, type UploadStatus } from './client.js';
+export type { StorageAdapter, StorageFileHandle, StorageMkdirOptions, StorageReadResult, StorageRmOptions, StorageStatFs, StorageStats, StorageWriteResult, SymlinkCapableStorage } from './storage/types.js';

package/dist/index.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Client = exports.Server = exports.parseAllowlist = exports.fixedSeriesKey = exports.publicKeyFromSeed = exports.keyPairFromSeed = exports.generateSeed = exports.parsePublicKey = exports.parseSeed = exports.SwarmDeployError = exports.ERRORS = void 0;
+var errors_js_1 = require("./errors.js");
+Object.defineProperty(exports, "ERRORS", { enumerable: true, get: function () { return errors_js_1.ERRORS; } });
+Object.defineProperty(exports, "SwarmDeployError", { enumerable: true, get: function () { return errors_js_1.SwarmDeployError; } });
+var identity_js_1 = require("./identity.js");
+Object.defineProperty(exports, "parseSeed", { enumerable: true, get: function () { return identity_js_1.parseSeed; } });
+Object.defineProperty(exports, "parsePublicKey", { enumerable: true, get: function () { return identity_js_1.parsePublicKey; } });
+Object.defineProperty(exports, "generateSeed", { enumerable: true, get: function () { return identity_js_1.generateSeed; } });
+Object.defineProperty(exports, "keyPairFromSeed", { enumerable: true, get: function () { return identity_js_1.keyPairFromSeed; } });
+Object.defineProperty(exports, "publicKeyFromSeed", { enumerable: true, get: function () { return identity_js_1.publicKeyFromSeed; } });
+var release_js_1 = require("./release.js");
+Object.defineProperty(exports, "fixedSeriesKey", { enumerable: true, get: function () { return release_js_1.fixedSeriesKey; } });
+var allowlist_js_1 = require("./allowlist.js");
+Object.defineProperty(exports, "parseAllowlist", { enumerable: true, get: function () { return allowlist_js_1.parseAllowlist; } });
+var server_js_1 = require("./server.js");
+Object.defineProperty(exports, "Server", { enumerable: true, get: function () { return server_js_1.Server; } });
+var client_js_1 = require("./client.js");
+Object.defineProperty(exports, "Client", { enumerable: true, get: function () { return client_js_1.Client; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,yCAAsE;AAA7D,mGAAA,MAAM,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAcjC,6CAMsB;AALpB,wGAAA,SAAS,OAAA;AACT,6GAAA,cAAc,OAAA;AACd,2GAAA,YAAY,OAAA;AACZ,8GAAA,eAAe,OAAA;AACf,gHAAA,iBAAiB,OAAA;AAUnB,2CAA+F;AAAtF,4GAAA,cAAc,OAAA;AACvB,+CAA+C;AAAtC,8GAAA,cAAc,OAAA;AAIvB,yCAeoB;AAdlB,mGAAA,MAAM,OAAA;AAeR,yCAYoB;AAXlB,mGAAA,MAAM,OAAA"}

package/dist/os-node.d.ts

@@ -0,0 +1,2 @@
+import os from 'node:os';
+export = os;

package/dist/os-node.js

@@ -0,0 +1,7 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+const node_os_1 = __importDefault(require("node:os"));
+module.exports = node_os_1.default;
+//# sourceMappingURL=os-node.js.map

package/dist/os-node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"os-node.js","sourceRoot":"","sources":["../src/os-node.ts"],"names":[],"mappings":";;;;AAAA,sDAAwB;AAExB,iBAAS,iBAAE,CAAA"}

package/dist/path-node.d.ts

@@ -0,0 +1,2 @@
+import path from 'node:path';
+export = path;

package/dist/path-node.js

@@ -0,0 +1,7 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+const node_path_1 = __importDefault(require("node:path"));
+module.exports = node_path_1.default;
+//# sourceMappingURL=path-node.js.map

package/dist/path-node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-node.js","sourceRoot":"","sources":["../src/path-node.ts"],"names":[],"mappings":";;;;AAAA,0DAA4B;AAE5B,iBAAS,mBAAI,CAAA"}

package/dist/process-node.d.ts

@@ -0,0 +1,2 @@
+import process from 'node:process';
+export = process;

package/dist/process-node.js

@@ -0,0 +1,7 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+const node_process_1 = __importDefault(require("node:process"));
+module.exports = node_process_1.default;
+//# sourceMappingURL=process-node.js.map

package/dist/process-node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-node.js","sourceRoot":"","sources":["../src/process-node.ts"],"names":[],"mappings":";;;;AAAA,gEAAkC;AAElC,iBAAS,sBAAO,CAAA"}

package/dist/release.d.ts

@@ -0,0 +1,26 @@
+export type VersionGranularity = 'major' | 'minor';
+export interface ReleaseCoordinates {
+    series: string;
+    version?: string;
+}
+/** Protocol: artifact basenames are one safe path component, max 100 UTF-8 bytes (`+` disallowed). */
+export declare const MAX_RELEASE_COMPONENT_BYTES = 100;
+/**
+ * The persisted series of a template that captures no `{series}`.
+ *
+ * The template text itself cannot be the key: braces and slashes fail the
+ * commit-record basename rules, so every version-only pattern would reject at
+ * commit time. Hashing gives a safe 70-byte basename that is stable across
+ * restarts and identical on Node and Bare, and distinct templates that happen
+ * to describe the same literals stay distinct releases.
+ */
+export declare function fixedSeriesKey(template: string): string;
+export declare class ReleaseMatcher {
+    #private;
+    constructor(patterns: Iterable<string>);
+    get size(): number;
+    get hasVersionPattern(): boolean;
+    match(name: string, sourceParent?: string): ReleaseCoordinates | null;
+}
+export declare function compareReleaseVersions(left: string, right: string): number;
+export declare function releaseVersionGroup(version: string, granularity: VersionGranularity): string;