terminay 4.2.0

package/dist/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../src/platform.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAEpD,MAAM,uBAAuB,GAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAQpE,MAAM,UAAU,aAAa;IAC5B,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,UAAU,CAAC,cAAc,CAAC;KACtC,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;CAAG;AAElD,MAAM,UAAU,mBAAmB,CAAC,QAAmB,aAAa,EAAE;IACrE,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,MAAM,IAAI,oBAAoB,CAC7B,mEAAmE,KAAK,CAAC,QAAQ,8CAA8C,CAC/H,CAAC;IACH,CAAC;IACD,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,oBAAoB,CAC7B,0EAA0E,KAAK,CAAC,IAAI,GAAG,CACvF,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,IAAI,oBAAoB,CAC7B,4DAA4D,cAAc,0BAA0B,CACpG,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC/B,QAAmB,aAAa,EAAE;IAElC,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC3B,OAAO,KAAK,CAAC,IAAuB,CAAC;AACtC,CAAC"}

package/dist/prompt.d.ts

@@ -0,0 +1,20 @@
+import type { Readable, Writable } from 'node:stream';
+/**
+ * The few questions the installer asks.
+ *
+ * A prompt appears only when standard input is a terminal and the answer was
+ * not given as a flag. Without a terminal the CLI requires the flag instead of
+ * choosing for the operator, because both questions it asks — install scope
+ * and the account terminals run as — decide what the daemon can reach.
+ */
+export interface PromptStreams {
+    readonly input: Readable & {
+        isTTY?: boolean;
+    };
+    readonly output: Writable;
+}
+export declare function defaultStreams(): PromptStreams;
+export declare function isInteractive(streams?: PromptStreams): boolean;
+/** Enter accepts the first choice, which is always the safer default. */
+export declare function choose<T extends string>(question: string, choices: readonly (readonly [T, string])[], streams?: PromptStreams): Promise<T>;
+export declare function confirm(question: string, streams?: PromptStreams, fallback?: boolean): Promise<boolean>;

package/dist/prompt.js

@@ -0,0 +1,47 @@
+import { createInterface } from 'node:readline';
+export function defaultStreams() {
+    return { input: process.stdin, output: process.stdout };
+}
+export function isInteractive(streams = defaultStreams()) {
+    return streams.input.isTTY === true;
+}
+async function ask(question, streams) {
+    const rl = createInterface({ input: streams.input, output: streams.output });
+    try {
+        return await new Promise((resolve) => rl.question(question, resolve));
+    }
+    finally {
+        rl.close();
+    }
+}
+/** Enter accepts the first choice, which is always the safer default. */
+export async function choose(question, choices, streams = defaultStreams()) {
+    const [first] = choices;
+    if (first === undefined)
+        throw new Error('a choice needs at least one option');
+    const lines = choices.map(([value, label], index) => `  ${index + 1}) ${label}${index === 0 ? ' [default]' : ''}  (${value})`);
+    for (;;) {
+        const answer = (await ask(`${question}\n${lines.join('\n')}\n> `, streams))
+            .trim()
+            .toLowerCase();
+        if (answer.length === 0)
+            return first[0];
+        const byNumber = choices[Number(answer) - 1];
+        if (/^\d+$/u.test(answer) && byNumber !== undefined)
+            return byNumber[0];
+        const byName = choices.find(([value]) => value === answer);
+        if (byName !== undefined)
+            return byName[0];
+        streams.output.write(`Please answer with a number from 1 to ${choices.length}, or a name.\n`);
+    }
+}
+export async function confirm(question, streams = defaultStreams(), fallback = false) {
+    const suffix = fallback ? '[Y/n]' : '[y/N]';
+    const answer = (await ask(`${question} ${suffix} `, streams))
+        .trim()
+        .toLowerCase();
+    if (answer.length === 0)
+        return fallback;
+    return answer === 'y' || answer === 'yes';
+}
+//# sourceMappingURL=prompt.js.map

package/dist/prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.js","sourceRoot":"","sources":["../src/prompt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAiBhD,MAAM,UAAU,cAAc;IAC7B,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,aAAa,CAC5B,UAAyB,cAAc,EAAE;IAEzC,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,QAAgB,EAAE,OAAsB;IAC1D,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC;QACJ,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE,CAC5C,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAC9B,CAAC;IACH,CAAC;YAAS,CAAC;QACV,EAAE,CAAC,KAAK,EAAE,CAAC;IACZ,CAAC;AACF,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,MAAM,CAC3B,QAAgB,EAChB,OAA0C,EAC1C,UAAyB,cAAc,EAAE;IAEzC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IACxB,IAAI,KAAK,KAAK,SAAS;QACtB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CACxB,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,CACzB,KAAK,KAAK,GAAG,CAAC,KAAK,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,GAAG,CACzE,CAAC;IACF,SAAS,CAAC;QACT,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,QAAQ,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;aACzE,IAAI,EAAE;aACN,WAAW,EAAE,CAAC;QAChB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7C,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC;QAC3D,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,yCAAyC,OAAO,CAAC,MAAM,gBAAgB,CACvE,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC5B,QAAgB,EAChB,UAAyB,cAAc,EAAE,EACzC,QAAQ,GAAG,KAAK;IAEhB,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5C,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,QAAQ,IAAI,MAAM,GAAG,EAAE,OAAO,CAAC,CAAC;SAC3D,IAAI,EAAE;SACN,WAAW,EAAE,CAAC;IAChB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK,CAAC;AAC3C,CAAC"}

package/dist/resolve.d.ts

@@ -0,0 +1,35 @@
+export declare const DEFAULT_REPOSITORY = "markwylde/terminay";
+/**
+ * The rolling channel is tagged `main-latest`, not `main`: a release tag named
+ * for the default branch makes the ref ambiguous in every clone, so
+ * `git fetch main` resolves the tag instead of the branch.
+ */
+export declare const ROLLING_TAG = "main-latest";
+export type ReleaseChannel = 'tag' | 'main' | 'source';
+export type Architecture = 'x64' | 'arm64';
+export interface ResolvedAssets {
+    readonly archive: string;
+    readonly sha256: string;
+    readonly signature: string;
+}
+export interface ResolvedRef {
+    readonly channel: ReleaseChannel;
+    /** Release version for `tag`, the channel name for `main`, the short commit for `source`. */
+    readonly version: string;
+    /** Known up front only for `source`; otherwise read from the signed manifest after install. */
+    readonly revision?: string;
+    readonly tag?: string;
+    readonly publishedAt?: string;
+    readonly assets?: ResolvedAssets;
+    /** Set for `source`: the reference to clone and build. */
+    readonly sourceRef?: string;
+}
+export interface ResolveOptions {
+    readonly repository?: string;
+    readonly architecture: Architecture;
+    /** Overridden by tests to point at a local server. */
+    readonly apiBase?: string;
+    readonly webBase?: string;
+}
+export declare function archiveName(version: string, architecture: Architecture): string;
+export declare function resolveRef(ref: string | undefined, options: ResolveOptions): Promise<ResolvedRef>;

package/dist/resolve.js

@@ -0,0 +1,194 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { request, requestJson } from './http.js';
+/**
+ * Turning an operator's reference into something installable.
+ *
+ * Four shapes are accepted, and the shape decides the channel the install
+ * follows afterwards. The channel matters more than the version: an upgrade
+ * with no reference re-resolves whatever channel the machine is already on,
+ * so a box tracking `main` never silently jumps onto the tag stream.
+ */
+const execFileAsync = promisify(execFile);
+export const DEFAULT_REPOSITORY = 'markwylde/terminay';
+/**
+ * The rolling channel is tagged `main-latest`, not `main`: a release tag named
+ * for the default branch makes the ref ambiguous in every clone, so
+ * `git fetch main` resolves the tag instead of the branch.
+ */
+export const ROLLING_TAG = 'main-latest';
+/** Assets on the rolling release are named for the channel, not a version. */
+const ROLLING_ASSET_VERSION = 'main';
+const SEMVER_TAG = /^v\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/u;
+const COMMIT_SHA = /^[0-9a-f]{7,40}$/u;
+function apiBase(options) {
+    return options.apiBase ?? 'https://api.github.com';
+}
+function webBase(options) {
+    return options.webBase ?? 'https://github.com';
+}
+function repository(options) {
+    return options.repository ?? DEFAULT_REPOSITORY;
+}
+export function archiveName(version, architecture) {
+    return `terminay-server-${version}-linux-${architecture}.tar.gz`;
+}
+function assetUrls(options, tag, version) {
+    const base = `${webBase(options)}/${repository(options)}/releases/download/${encodeURIComponent(tag)}`;
+    const name = archiveName(version, options.architecture);
+    return Object.freeze({
+        archive: `${base}/${name}`,
+        sha256: `${base}/${name}.sha256`,
+        signature: `${base}/${name}.sig`,
+    });
+}
+function readReleaseJson(document) {
+    if (typeof document !== 'object' || document === null)
+        return undefined;
+    const release = document;
+    if (typeof release.tag_name !== 'string')
+        return undefined;
+    const assets = Array.isArray(release.assets) ? release.assets : [];
+    return Object.freeze({
+        tagName: release.tag_name,
+        publishedAt: typeof release.published_at === 'string'
+            ? release.published_at
+            : undefined,
+        assetNames: Object.freeze(assets
+            .map((asset) => typeof asset === 'object' && asset !== null
+            ? asset.name
+            : undefined)
+            .filter((name) => typeof name === 'string')),
+    });
+}
+/**
+ * The release page's asset fragment is plain HTML and is not rate limited, so
+ * it answers when an anonymous `npx` install has exhausted the API budget.
+ */
+async function readReleaseHtml(options, tag) {
+    const url = `${webBase(options)}/${repository(options)}/releases/expanded_assets/${encodeURIComponent(tag)}`;
+    const response = await request(url, 'text/html');
+    if (response.status !== 200)
+        throw new Error(`release ${tag} was not found (GitHub returned ${response.status})`);
+    const names = new Set();
+    const pattern = /\/releases\/download\/[^"'/]+\/([^"'?#]+)/gu;
+    for (const match of response.body.matchAll(pattern)) {
+        const name = match[1];
+        if (name !== undefined)
+            names.add(decodeURIComponent(name));
+    }
+    return Object.freeze({
+        tagName: tag,
+        publishedAt: undefined,
+        assetNames: Object.freeze([...names]),
+    });
+}
+async function readRelease(options, path, tag) {
+    try {
+        const payload = readReleaseJson(await requestJson(`${apiBase(options)}/repos/${repository(options)}/releases/${path}`));
+        if (payload !== undefined)
+            return payload;
+    }
+    catch {
+        // Falls through to the release page, which is the documented fallback
+        // for a rate-limited or unavailable API.
+    }
+    return readReleaseHtml(options, tag);
+}
+/** `latest` has no fixed tag, so the redirect on the web release page names it. */
+async function readLatestTag(options) {
+    try {
+        const payload = readReleaseJson(await requestJson(`${apiBase(options)}/repos/${repository(options)}/releases/latest`));
+        if (payload !== undefined)
+            return payload.tagName;
+    }
+    catch {
+        // Falls through to the redirect below.
+    }
+    const response = await request(`${webBase(options)}/${repository(options)}/releases/latest`, 'text/html', false);
+    const location = response.headers.location;
+    const target = typeof location === 'string' ? location : response.body;
+    const match = /\/releases\/tag\/([^"'?#\s]+)/u.exec(target);
+    if (match?.[1] === undefined)
+        throw new Error('no tagged release could be resolved for this repository');
+    return decodeURIComponent(match[1]);
+}
+function requireArchitectureAsset(payload, options, version) {
+    const name = archiveName(version, options.architecture);
+    if (payload.assetNames.length > 0 && !payload.assetNames.includes(name)) {
+        throw new Error(`release ${payload.tagName} has no server archive for the ${options.architecture} architecture (expected ${name})`);
+    }
+}
+async function resolveTag(options, tag) {
+    const payload = await readRelease(options, `tags/${encodeURIComponent(tag)}`, tag);
+    const version = payload.tagName.replace(/^v/u, '');
+    requireArchitectureAsset(payload, options, version);
+    return Object.freeze({
+        channel: 'tag',
+        version,
+        tag: payload.tagName,
+        ...(payload.publishedAt === undefined
+            ? {}
+            : { publishedAt: payload.publishedAt }),
+        assets: assetUrls(options, payload.tagName, version),
+    });
+}
+async function resolveRolling(options) {
+    const payload = await readRelease(options, `tags/${ROLLING_TAG}`, ROLLING_TAG);
+    requireArchitectureAsset(payload, options, ROLLING_ASSET_VERSION);
+    return Object.freeze({
+        channel: 'main',
+        version: ROLLING_ASSET_VERSION,
+        tag: ROLLING_TAG,
+        ...(payload.publishedAt === undefined
+            ? {}
+            : { publishedAt: payload.publishedAt }),
+        assets: assetUrls(options, ROLLING_TAG, ROLLING_ASSET_VERSION),
+    });
+}
+async function resolveSource(options, ref) {
+    const remote = `${webBase(options)}/${repository(options)}.git`;
+    if (COMMIT_SHA.test(ref)) {
+        return Object.freeze({
+            channel: 'source',
+            version: ref.slice(0, 12),
+            revision: ref,
+            sourceRef: ref,
+        });
+    }
+    let stdout;
+    try {
+        ({ stdout } = await execFileAsync('git', ['ls-remote', remote, ref], {
+            timeout: 60_000,
+        }));
+    }
+    catch (error) {
+        throw new Error(`could not resolve "${ref}" as a release, a branch, or a commit: ${message(error)}`);
+    }
+    const line = stdout.split('\n').find((entry) => entry.trim().length > 0);
+    const revision = line?.split(/\s+/u)[0];
+    if (revision === undefined || !/^[0-9a-f]{40}$/u.test(revision)) {
+        throw new Error(`could not resolve "${ref}" as a release, a branch, or a commit`);
+    }
+    return Object.freeze({
+        channel: 'source',
+        version: revision.slice(0, 12),
+        revision,
+        sourceRef: ref,
+    });
+}
+function message(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+export async function resolveRef(ref, options) {
+    if (ref === undefined)
+        return resolveTag(options, await readLatestTag(options));
+    if (ref === 'latest')
+        return resolveTag(options, await readLatestTag(options));
+    if (SEMVER_TAG.test(ref))
+        return resolveTag(options, ref);
+    if (ref === 'main')
+        return resolveRolling(options);
+    return resolveSource(options, ref);
+}
+//# sourceMappingURL=resolve.js.map

package/dist/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAEjD;;;;;;;GAOG;AAEH,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEvD;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC;AAEzC,8EAA8E;AAC9E,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAsCrC,MAAM,UAAU,GAAG,0CAA0C,CAAC;AAC9D,MAAM,UAAU,GAAG,mBAAmB,CAAC;AAEvC,SAAS,OAAO,CAAC,OAAuB;IACvC,OAAO,OAAO,CAAC,OAAO,IAAI,wBAAwB,CAAC;AACpD,CAAC;AAED,SAAS,OAAO,CAAC,OAAuB;IACvC,OAAO,OAAO,CAAC,OAAO,IAAI,oBAAoB,CAAC;AAChD,CAAC;AAED,SAAS,UAAU,CAAC,OAAuB;IAC1C,OAAO,OAAO,CAAC,UAAU,IAAI,kBAAkB,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,WAAW,CAC1B,OAAe,EACf,YAA0B;IAE1B,OAAO,mBAAmB,OAAO,UAAU,YAAY,SAAS,CAAC;AAClE,CAAC;AAED,SAAS,SAAS,CACjB,OAAuB,EACvB,GAAW,EACX,OAAe;IAEf,MAAM,IAAI,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,sBAAsB,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;IACvG,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,OAAO,EAAE,GAAG,IAAI,IAAI,IAAI,EAAE;QAC1B,MAAM,EAAE,GAAG,IAAI,IAAI,IAAI,SAAS;QAChC,SAAS,EAAE,GAAG,IAAI,IAAI,IAAI,MAAM;KAChC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAAiB;IACzC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxE,MAAM,OAAO,GAAG,QAAmC,CAAC;IACpD,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,OAAO,EAAE,OAAO,CAAC,QAAQ;QACzB,WAAW,EACV,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ;YACvC,CAAC,CAAC,OAAO,CAAC,YAAY;YACtB,CAAC,CAAC,SAAS;QACb,UAAU,EAAE,MAAM,CAAC,MAAM,CACxB,MAAM;aACJ,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACd,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAC1C,CAAC,CAAE,KAAiC,CAAC,IAAI;YACzC,CAAC,CAAC,SAAS,CACZ;aACA,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAC5D;KACD,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAC7B,OAAuB,EACvB,GAAW;IAEX,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,6BAA6B,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;IAC7G,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAC1B,MAAM,IAAI,KAAK,CACd,WAAW,GAAG,mCAAmC,QAAQ,CAAC,MAAM,GAAG,CACnE,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,OAAO,GAAG,6CAA6C,CAAC;IAC9D,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,OAAO,EAAE,GAAG;QACZ,WAAW,EAAE,SAAS;QACtB,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;KACrC,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CACzB,OAAuB,EACvB,IAAY,EACZ,GAAW;IAEX,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,eAAe,CAC9B,MAAM,WAAW,CAChB,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,UAAU,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CACnE,CACD,CAAC;QACF,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACR,sEAAsE;QACtE,yCAAyC;IAC1C,CAAC;IACD,OAAO,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,mFAAmF;AACnF,KAAK,UAAU,aAAa,CAAC,OAAuB;IACnD,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,eAAe,CAC9B,MAAM,WAAW,CAChB,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,UAAU,CAAC,OAAO,CAAC,kBAAkB,CAClE,CACD,CAAC;QACF,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACR,uCAAuC;IACxC,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC7B,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,kBAAkB,EAC5D,WAAW,EACX,KAAK,CACL,CAAC;IACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IACvE,MAAM,KAAK,GAAG,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5D,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;QAC3B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC5E,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,wBAAwB,CAChC,OAAuB,EACvB,OAAuB,EACvB,OAAe;IAEf,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CACd,WAAW,OAAO,CAAC,OAAO,kCAAkC,OAAO,CAAC,YAAY,2BAA2B,IAAI,GAAG,CAClH,CAAC;IACH,CAAC;AACF,CAAC;AAED,KAAK,UAAU,UAAU,CACxB,OAAuB,EACvB,GAAW;IAEX,MAAM,OAAO,GAAG,MAAM,WAAW,CAChC,OAAO,EACP,QAAQ,kBAAkB,CAAC,GAAG,CAAC,EAAE,EACjC,GAAG,CACH,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnD,wBAAwB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACpD,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,OAAO,EAAE,KAAc;QACvB,OAAO;QACP,GAAG,EAAE,OAAO,CAAC,OAAO;QACpB,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS;YACpC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,EAAE,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC;KACpD,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,OAAuB;IACpD,MAAM,OAAO,GAAG,MAAM,WAAW,CAChC,OAAO,EACP,QAAQ,WAAW,EAAE,EACrB,WAAW,CACX,CAAC;IACF,wBAAwB,CAAC,OAAO,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,OAAO,EAAE,MAAe;QACxB,OAAO,EAAE,qBAAqB;QAC9B,GAAG,EAAE,WAAW;QAChB,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS;YACpC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,EAAE,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,qBAAqB,CAAC;KAC9D,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC3B,OAAuB,EACvB,GAAW;IAEX,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC;IAChE,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,MAAM,CAAC;YACpB,OAAO,EAAE,QAAiB;YAC1B,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YACzB,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,GAAG;SACd,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACJ,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE;YACpE,OAAO,EAAE,MAAM;SACf,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACd,sBAAsB,GAAG,0CAA0C,OAAO,CAAC,KAAK,CAAC,EAAE,CACnF,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CACd,sBAAsB,GAAG,uCAAuC,CAChE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,OAAO,EAAE,QAAiB;QAC1B,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAC9B,QAAQ;QACR,SAAS,EAAE,GAAG;KACd,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC9B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,GAAuB,EACvB,OAAuB;IAEvB,IAAI,GAAG,KAAK,SAAS;QACpB,OAAO,UAAU,CAAC,OAAO,EAAE,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,IAAI,GAAG,KAAK,QAAQ;QACnB,OAAO,UAAU,CAAC,OAAO,EAAE,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC1D,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;IACnD,OAAO,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC"}

package/dist/socket.d.ts

@@ -0,0 +1,55 @@
+export declare const APPROVAL_SOCKET_FILENAME = "approval.sock";
+export type ApprovalRequest = Readonly<{
+    op: 'list';
+}> | Readonly<{
+    op: 'approve';
+    approvalId: string;
+}> | Readonly<{
+    op: 'deny';
+    approvalId: string;
+}> | Readonly<{
+    op: 'pairing';
+    rotate?: boolean;
+}>;
+export interface PendingApproval {
+    readonly approvalId: string;
+    readonly deviceName: string;
+    readonly matchCode: string;
+    readonly expiresAt: number;
+}
+export interface PairingHandoff {
+    readonly mode: string;
+    readonly pairingUrl: string;
+    readonly pairingExpiresAt: string;
+    readonly serverId: string;
+}
+export type ApprovalResponse = Readonly<{
+    ok: true;
+    pending: readonly PendingApproval[];
+}> | Readonly<{
+    ok: true;
+    approvalId: string;
+    outcome: 'approved' | 'denied';
+    deviceName: string;
+}> | Readonly<{
+    ok: true;
+    exposure: readonly string[] | 'off';
+    handoffs: readonly PairingHandoff[];
+}> | Readonly<{
+    ok: false;
+    error: string;
+}>;
+export declare function approvalSocketPath(dataRoot: string): string;
+export declare class SocketError extends Error {
+}
+export declare function sendApprovalRequest(socketPath: string, request: ApprovalRequest): Promise<ApprovalResponse>;
+/**
+ * The socket is owner-only, so root cannot simply open a socket owned by the
+ * run-as account without dropping to it first. Re-executing this one call
+ * under `sudo -u` keeps the server's ownership check meaningful instead of
+ * relaxing the socket's permissions to work around it.
+ */
+export declare function sendAsUser(socketPath: string, request: ApprovalRequest, runAs: string, currentUid?: number | undefined): Promise<ApprovalResponse>;
+export declare function requireOk(response: ApprovalResponse): Extract<ApprovalResponse, {
+    ok: true;
+}>;

package/dist/socket.js

@@ -0,0 +1,98 @@
+import { execFile } from 'node:child_process';
+import { createConnection } from 'node:net';
+import { join } from 'node:path';
+import { promisify } from 'node:util';
+/**
+ * The client side of the server's owner-only approval socket.
+ *
+ * The socket lives inside the data root, which is the trust boundary: it is
+ * mode 0600 and owned by the account the server runs as, so being able to open
+ * it is the authority. No token crosses it, and nothing it returns carries a
+ * host key or a device key.
+ *
+ * The CLI speaks this protocol itself rather than importing the server,
+ * because the published package must not pull a native addon along with it.
+ */
+const execFileAsync = promisify(execFile);
+export const APPROVAL_SOCKET_FILENAME = 'approval.sock';
+const MAX_FRAME_BYTES = 4 * 1024;
+const REQUEST_TIMEOUT_MS = 10_000;
+export function approvalSocketPath(dataRoot) {
+    return join(dataRoot, APPROVAL_SOCKET_FILENAME);
+}
+export class SocketError extends Error {
+}
+export function sendApprovalRequest(socketPath, request) {
+    return new Promise((resolve, reject) => {
+        let buffered = '';
+        let settled = false;
+        const socket = createConnection(socketPath);
+        const timer = setTimeout(() => {
+            if (settled)
+                return;
+            settled = true;
+            socket.destroy();
+            reject(new SocketError('the running server did not answer'));
+        }, REQUEST_TIMEOUT_MS);
+        timer.unref?.();
+        socket.setEncoding('utf8');
+        socket.on('connect', () => socket.write(`${JSON.stringify(request)}\n`));
+        socket.on('data', (chunk) => {
+            buffered += chunk;
+            if (buffered.length > MAX_FRAME_BYTES)
+                socket.destroy();
+        });
+        socket.on('error', () => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            reject(new SocketError('no running server accepts commands at this data root. Start it with `terminay daemon start`.'));
+        });
+        socket.on('close', () => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            try {
+                resolve(JSON.parse(buffered.trim()));
+            }
+            catch {
+                reject(new SocketError('the running server returned an unreadable response'));
+            }
+        });
+    });
+}
+/**
+ * The socket is owner-only, so root cannot simply open a socket owned by the
+ * run-as account without dropping to it first. Re-executing this one call
+ * under `sudo -u` keeps the server's ownership check meaningful instead of
+ * relaxing the socket's permissions to work around it.
+ */
+export async function sendAsUser(socketPath, request, runAs, currentUid = process.getuid?.()) {
+    const needsDrop = currentUid === 0 && runAs !== 'root';
+    if (!needsDrop)
+        return sendApprovalRequest(socketPath, request);
+    const script = new URL('./socketClient.js', import.meta.url).pathname;
+    try {
+        const { stdout } = await execFileAsync('sudo', [
+            '-n',
+            '-u',
+            runAs,
+            process.execPath,
+            script,
+            socketPath,
+            JSON.stringify(request),
+        ], { timeout: REQUEST_TIMEOUT_MS + 5_000, maxBuffer: MAX_FRAME_BYTES });
+        return JSON.parse(stdout.trim());
+    }
+    catch (error) {
+        throw new SocketError(`could not reach the server's socket as ${runAs}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+export function requireOk(response) {
+    if (response.ok !== true)
+        throw new SocketError(response.error);
+    return response;
+}
+//# sourceMappingURL=socket.js.map

package/dist/socket.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"socket.js","sourceRoot":"","sources":["../src/socket.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC;;;;;;;;;;GAUG;AAEH,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,CAAC,MAAM,wBAAwB,GAAG,eAAe,CAAC;AACxD,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,CAAC;AACjC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAqClC,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IAClD,OAAO,IAAI,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,KAAK;CAAG;AAEzC,MAAM,UAAU,mBAAmB,CAClC,UAAkB,EAClB,OAAwB;IAExB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,WAAW,CAAC,mCAAmC,CAAC,CAAC,CAAC;QAC9D,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACvB,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACzE,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACnC,QAAQ,IAAI,KAAK,CAAC;YAClB,IAAI,QAAQ,CAAC,MAAM,GAAG,eAAe;gBAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QACzD,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CACL,IAAI,WAAW,CACd,8FAA8F,CAC9F,CACD,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,CAAC;gBACJ,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAqB,CAAC,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACR,MAAM,CACL,IAAI,WAAW,CAAC,oDAAoD,CAAC,CACrE,CAAC;YACH,CAAC;QACF,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC/B,UAAkB,EAClB,OAAwB,EACxB,KAAa,EACb,aAAiC,OAAO,CAAC,MAAM,EAAE,EAAE;IAEnD,MAAM,SAAS,GAAG,UAAU,KAAK,CAAC,IAAI,KAAK,KAAK,MAAM,CAAC;IACvD,IAAI,CAAC,SAAS;QAAE,OAAO,mBAAmB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IACtE,IAAI,CAAC;QACJ,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CACrC,MAAM,EACN;YACC,IAAI;YACJ,IAAI;YACJ,KAAK;YACL,OAAO,CAAC,QAAQ;YAChB,MAAM;YACN,UAAU;YACV,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SACvB,EACD,EAAE,OAAO,EAAE,kBAAkB,GAAG,KAAK,EAAE,SAAS,EAAE,eAAe,EAAE,CACnE,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAqB,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,WAAW,CACpB,0CAA0C,KAAK,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC5G,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,UAAU,SAAS,CACxB,QAA0B;IAE1B,IAAI,QAAQ,CAAC,EAAE,KAAK,IAAI;QAAE,MAAM,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChE,OAAO,QAAQ,CAAC;AACjB,CAAC"}

package/dist/socketClient.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/socketClient.js

@@ -0,0 +1,22 @@
+import { sendApprovalRequest } from './socket.js';
+/**
+ * The one-shot helper `sendAsUser` re-executes under `sudo -u <run-as>`.
+ *
+ * It exists so a root operator can reach a socket that only the run-as account
+ * may open, without the CLI ever loosening the socket's permissions. It writes
+ * exactly the server's response to stdout and nothing else.
+ */
+const [socketPath, encodedRequest] = process.argv.slice(2);
+if (socketPath === undefined || encodedRequest === undefined) {
+    process.stderr.write('usage: socketClient.js <socket-path> <json-request>\n');
+    process.exit(2);
+}
+try {
+    const response = await sendApprovalRequest(socketPath, JSON.parse(encodedRequest));
+    process.stdout.write(`${JSON.stringify(response)}\n`);
+}
+catch (error) {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exit(1);
+}
+//# sourceMappingURL=socketClient.js.map

package/dist/socketClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"socketClient.js","sourceRoot":"","sources":["../src/socketClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD;;;;;;GAMG;AAEH,MAAM,CAAC,UAAU,EAAE,cAAc,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAE3D,IAAI,UAAU,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;IAC9D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,IAAI,CAAC;IACJ,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CACzC,UAAU,EACV,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAC1B,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAC7D,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC"}

package/dist/source.d.ts

@@ -0,0 +1,24 @@
+export declare const REQUIRED_TOOLS: readonly string[];
+export declare class ToolchainError extends Error {
+}
+export declare class SourceBuildError extends Error {
+}
+export declare function preflightToolchain(tools?: readonly string[], env?: NodeJS.ProcessEnv): Promise<void>;
+export interface SourceBuildOptions {
+    readonly ref: string;
+    readonly revision?: string;
+    readonly repository?: string;
+    readonly write?: (line: string) => void;
+    readonly workingDirectory?: string;
+    /** Where the finished archive is placed before the build tree is removed. */
+    readonly destination?: string;
+    readonly env?: Readonly<Record<string, string | undefined>>;
+    readonly architecture?: 'x64' | 'arm64';
+    readonly keepOnFailure?: boolean;
+}
+export interface SourceBuildResult {
+    readonly archivePath: string;
+    readonly revision: string;
+    readonly buildDirectory: string;
+}
+export declare function buildFromSource(options: SourceBuildOptions): Promise<SourceBuildResult>;