@0xrama/bnpm 0.0.1

package/README.md

@@ -0,0 +1,83 @@
+# Better NPM
+
+Better NPM (`bnpm`) is an npm-compatible package manager designed for fast installs and explicit supply-chain security decisions.
+
+> Better NPM has a functional alpha command surface. It is not production-qualified yet; review the limitations below before using it for critical projects.
+
+## Commands
+
+- `bnpm install [spec...]` resolves and installs dependencies with bounded resolve, fetch/cache, byte-download, inspection, and linking progress; explicit specs are saved by default. Lockfile-only, non-mutating dry-run, and dev/optional/peer omit/include modes are supported.
+- `bnpm ci` recreates the installation exactly from `bnpm-lock.yaml`.
+- `bnpm add <spec...>` updates `package.json` and installs.
+- `bnpm remove <name...>` removes dependencies and updates the installation.
+- `bnpm update [name...]` refreshes all or selected dependencies within declared ranges.
+- `bnpm outdated [name...]` reports current, wanted, and latest versions.
+- `bnpm list [name...]` displays the installed graph; `bnpm why <name>` explains installation paths.
+- `bnpm query <selector>` supports npm-style graph combinators, dependency groups, semver/manifest selectors, registry-enriched outdated and vulnerability filters, and expected-result assertions. `bnpm diff` emits verified unified patches for the local package or two registry, directory, remote-tarball, or secure Git sources with path, context, whitespace, prefix, and name-only controls; `bnpm find-dupes` reports duplicate identities.
+- `bnpm bin`, `bnpm prefix`, and `bnpm root` print local or global installation paths.
+- `bnpm run [--workspaces|--workspace <name>] [script] [-- args...]` lists scripts or analyzes and runs a project, selected workspaces, or every workspace; install mutations accept the same workspace selection and `--if-present` safely skips missing scripts. Scripts receive npm-compatible lifecycle and package environment variables.
+- `bnpm test`, `start`, `stop`, `restart`, `install-test`, and `install-ci-test` provide npm-compatible script workflows.
+- `bnpm audit` combines local static findings with npm registry advisories; `bnpm audit fix` applies safe in-range re-resolution and supports dry-run.
+- `bnpm exec <bin> [-- args...]` runs an installed binary; repeated `--package <spec>` options install inspected packages ephemerally before execution.
+- `bnpm explore <package> [-- command...]` runs a command inside an installed package.
+- `bnpm edit <package>` opens a project-local installed instance and invalidates it for verified replacement on the next install.
+- `bnpm pack [directory]` creates a deterministic npm-compatible tarball; use `--dry-run` or `--pack-destination` as needed.
+- `bnpm publish [directory]` packs and publishes the exact verified artifact with scoped auth, tag, access, OTP, trusted-publisher OIDC, Sigstore provenance, and dry-run support.
+- `bnpm stage` safely publishes, lists, inspects, downloads, approves, or rejects staged artifacts; `bnpm unpublish` handles exact registry removals.
+- `bnpm access`, `owner`, `token`, `star`, `org`, `team`, `profile`, and `trust` expose bounded package and account administration, granular tokens, trusted publishers, passwords, and 2FA. Passwords use masked prompts and are never accepted as CLI operands.
+- `bnpm login`, `bnpm logout`, and `bnpm whoami` manage web authentication, explicit legacy authentication, and identity.
+- `bnpm view`, `bnpm search`, `bnpm dist-tag`, and `bnpm deprecate` provide bounded registry metadata and package-maintenance workflows.
+- `bnpm init`/`bnpm create` creates default packages, safely registers new workspaces, or resolves and executes inspected `create-*` initializer packages with npm-compatible naming and argument forwarding. `bnpm version` runs npm-compatible authoring lifecycles, semantic/prerelease calculation, lockfile synchronization, transactional workspace selection, clean-tree checks, Git commits and tags (or manifest-only mode); `bnpm config` manages safe user settings.
+- `bnpm shrinkwrap` exports the verified registry graph as deterministic npm lockfile v3 data.
+- `bnpm approve-scripts` and `bnpm deny-scripts` explicitly mutate exact lockfile-bound lifecycle approvals.
+- `bnpm prune`, `bnpm dedupe`, `bnpm rebuild`, `bnpm fund`, `bnpm cache add|ls|info|verify|clean`, `bnpm ping`, and `bnpm doctor` maintain and diagnose verified installations, storage, and registry access. Cache cleanup can target one package identity instead of deleting the entire store.
+- `bnpm install-scripts approve|deny|ls|prune` manages exact integrity- and content-hash-bound lifecycle approvals; `approve-scripts` and `deny-scripts` remain concise aliases.
+- `bnpm pkg`, `bnpm sbom`, `bnpm link`/`unlink`, and `bnpm completion` cover manifest updates, software bills of materials, live development links, and shell integration.
+- `bnpmx <spec> [-- args...]` installs and inspects an ephemeral package, gives a decision-first summary of detected execution capabilities across its dependency graph, and requires confirmation before starting it. Use `bnpmx --details <spec>` for raw package and file evidence.
+- `bnpmx check` scans every direct and transitive package recorded for the current project, reports runtime capabilities, lifecycle scripts, static findings, and registry advisories, and never executes package code.
+
+Install, remove, update, outdated, list, why, audit, exec, bin, and prefix support `-g`/`--global` where applicable. Registry selection supports user/project `.npmrc`, scoped registries, path-scoped bearer/basic credentials, environment expansion, and one-shot `--registry` overrides. Dependency sources include registry packages, workspaces, bare, absolute, or `file:` local directories and package archives (saved canonically as relative `file:` requirements), HTTPS tarballs, and HTTPS/SSH Git repositories and hosted shortcuts, including semver tag selection, package subdirectories, validated recursive submodules, and approved prepare builds.
+
+## Implemented safeguards
+
+- Full-graph recent-publication checks with a first-use 1/6/24-hour policy, mature-version fallback during direct and transitive resolution, and exact non-cascading overrides.
+- Bounded HTTPS metadata/tarball requests, redirects, retries, deadlines, archive sizes, and extraction ratios.
+- Strong integrity verification before safe extraction and content-addressable promotion.
+- Explainable high-confidence static findings for reverse shells, remote payload execution, miners, credential targeting, persistence, destructive commands, and obfuscated process execution.
+- Pre-execution capability disclosure for ephemeral binaries, including AI-session history, credential/config access, network requests, local writes, subprocesses, and opaque native code.
+- Lifecycle approval bound to package version, integrity, stage, command hash, and referenced-content hash.
+- Deterministic lockfile security records, isolated package instances, offline/frozen installs, and interrupted-layout recovery.
+
+Approved lifecycle scripts are **not sandboxed**. They run with the current user's normal operating-system permissions after an exact approval.
+
+## Current limitations
+
+- The implementation is still alpha. Initial live-project, adversarial-archive, concurrency, corruption-repair, and controlled performance checks pass, but the broader production matrix is not complete.
+- The latest controlled isolated-cache fixture puts cold installs in pnpm's range while retaining static inspection; verified warm installs are about twice as fast. Results vary with registry conditions, and larger-project qualification remains incomplete.
+- macOS is the primary development target. Linux and Windows interfaces exist, but neither is advertised as production-qualified.
+- Native-platform release qualification is not complete. Web authentication is the default; password-only registries require the explicit `--auth-type=legacy` flow.
+
+## Principles
+
+- Resolve and install packages without delegating to another package manager.
+- Use a global content-addressable store and isolated symlink layout.
+- Quarantine and inspect package archives before linking them into a project.
+- Never run dependency lifecycle scripts without informed approval.
+- Warn about newly published versions throughout the dependency graph.
+- Produce concrete, explainable findings rather than an opaque risk score.
+
+## Development
+
+Requires Node.js 22.22.2 or newer.
+
+```sh
+npm install
+npm run check
+npm test
+npm run build
+npm run benchmark
+npm run verify:package
+node dist/src/cli.js --help
+```
+
+See [`docs/product-spec.md`](docs/product-spec.md), [`docs/threat-model.md`](docs/threat-model.md), [`docs/architecture.md`](docs/architecture.md), and [`docs/releasing.md`](docs/releasing.md).

package/dist/package.json

@@ -0,0 +1,45 @@
+{
+    "name": "@0xrama/bnpm",
+    "version": "0.0.1",
+    "description": "A fast, security-focused npm-compatible package manager",
+    "type": "module",
+    "bin": {
+        "bnpm": "dist/src/cli.js",
+        "bnpmx": "dist/src/cli.js"
+    },
+    "files": [
+        "dist/src",
+        "dist/package.json",
+        "README.md"
+    ],
+    "engines": {
+        "node": ">=22.22.2"
+    },
+    "publishConfig": {
+        "access": "public"
+    },
+    "scripts": {
+        "build": "tsc -p tsconfig.json",
+        "check": "tsc -p tsconfig.json --noEmit",
+        "test": "npm run build && node --test dist/test/*.test.js",
+        "benchmark": "npm run build && node scripts/benchmark.mjs",
+        "verify:package": "npm run build && node scripts/verify-package.mjs",
+        "start": "node dist/src/cli.js"
+    },
+    "dependencies": {
+        "npm-package-arg": "13.0.2",
+        "node-gyp": "13.0.1",
+        "npm-packlist": "11.3.0",
+        "semver": "7.8.5",
+        "sigstore": "5.0.0",
+        "tar-stream": "3.2.0",
+        "yaml": "^2.9.0"
+    },
+    "devDependencies": {
+        "@types/node": "^22.0.0",
+        "@types/npm-package-arg": "6.1.4",
+        "@types/semver": "7.7.1",
+        "@types/tar-stream": "3.1.4",
+        "typescript": "^7.0.2"
+    }
+}

package/dist/src/cache/archive.d.ts

@@ -0,0 +1,15 @@
+export interface ArchiveLimits {
+    readonly maxEntries?: number;
+    readonly maxExpandedBytes?: number;
+    readonly maxFileBytes?: number;
+    readonly maxCompressionRatio?: number;
+}
+export interface ExtractedArchive {
+    readonly path: string;
+    readonly entries: number;
+    readonly expandedBytes: number;
+}
+export declare class ArchiveError extends Error {
+    constructor(message: string);
+}
+export declare function extractPackageArchive(tarballPath: string, destination: string, limits?: ArchiveLimits): Promise<ExtractedArchive>;

package/dist/src/cache/archive.js

@@ -0,0 +1,163 @@
+import { createReadStream } from "node:fs";
+import { mkdir, open, realpath, rm, stat } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { dirname, join, posix, resolve, sep } from "node:path";
+import { createGunzip } from "node:zlib";
+import tar from "tar-stream";
+export class ArchiveError extends Error {
+    constructor(message) {
+        super(`Archive error: ${message}`);
+        this.name = "ArchiveError";
+    }
+}
+const defaults = {
+    maxEntries: 100_000,
+    maxExpandedBytes: 1024 * 1024 * 1024,
+    maxFileBytes: 128 * 1024 * 1024,
+    maxCompressionRatio: 200,
+};
+function safeRelativePath(name, expectedPrefix) {
+    if (name.includes("\0") || name.includes("\\") || name.startsWith("/") || /^[A-Za-z]:/.test(name)) {
+        throw new ArchiveError(`unsafe entry path ${JSON.stringify(name)}`);
+    }
+    const normalized = posix.normalize(name);
+    if (normalized === ".." || normalized.startsWith("../"))
+        throw new ArchiveError(`entry escapes package root: ${name}`);
+    const parts = normalized.split("/").filter(Boolean);
+    const prefix = parts[0];
+    if (!prefix)
+        throw new ArchiveError(`archive entry has no package prefix: ${name}`);
+    if (expectedPrefix !== undefined && prefix !== expectedPrefix)
+        throw new ArchiveError(`entry is outside the archive package prefix: ${name}`);
+    const relative = parts.slice(1).join("/");
+    return relative.length === 0 ? { prefix } : { prefix, relative };
+}
+function contained(root, relative) {
+    const target = resolve(root, ...relative.split("/"));
+    if (target !== root && !target.startsWith(`${root}${sep}`))
+        throw new ArchiveError(`entry escapes extraction root: ${relative}`);
+    return target;
+}
+export async function extractPackageArchive(tarballPath, destination, limits = {}) {
+    const compressedBytes = (await stat(tarballPath)).size;
+    const maxEntries = limits.maxEntries ?? defaults.maxEntries;
+    const maxExpandedBytes = limits.maxExpandedBytes ?? defaults.maxExpandedBytes;
+    const maxFileBytes = limits.maxFileBytes ?? defaults.maxFileBytes;
+    const maxCompressionRatio = limits.maxCompressionRatio ?? defaults.maxCompressionRatio;
+    await mkdir(destination, { recursive: false, mode: 0o700 });
+    const root = await realpath(destination);
+    let entries = 0;
+    let expandedBytes = 0;
+    let archivePrefix;
+    const seen = new Map();
+    const extract = tar.extract();
+    let rejectCompletion = () => undefined;
+    const completion = new Promise((resolvePromise, reject) => {
+        rejectCompletion = reject;
+        extract.once("finish", resolvePromise);
+        extract.once("error", reject);
+        extract.on("entry", (header, stream, next) => {
+            void (async () => {
+                entries += 1;
+                if (entries > maxEntries)
+                    throw new ArchiveError(`archive exceeds ${maxEntries} entries`);
+                const safePath = safeRelativePath(header.name, archivePrefix);
+                archivePrefix ??= safePath.prefix;
+                const relative = safePath.relative;
+                if (relative === undefined) {
+                    stream.resume();
+                    stream.once("end", next);
+                    return;
+                }
+                const target = contained(root, relative);
+                const prior = seen.get(relative);
+                if (header.type === "directory") {
+                    if (prior && prior.type !== "directory")
+                        throw new ArchiveError(`conflicting duplicate archive entry ${relative}`);
+                    seen.set(relative, { type: "directory", size: 0, executable: false });
+                    await mkdir(target, { recursive: true, mode: 0o755 });
+                    stream.resume();
+                    stream.once("end", next);
+                    return;
+                }
+                if (header.type !== "file")
+                    throw new ArchiveError(`unsupported ${header.type} entry ${relative}`);
+                const declaredSize = header.size ?? 0;
+                const executable = ((header.mode ?? 0) & 0o111) !== 0;
+                if (declaredSize > maxFileBytes)
+                    throw new ArchiveError(`${relative} exceeds the per-file size limit`);
+                if (prior) {
+                    if (prior.type !== "file" || prior.size !== declaredSize || prior.executable !== executable) {
+                        throw new ArchiveError(`conflicting duplicate archive entry ${relative}`);
+                    }
+                    const duplicateHash = createHash("sha256");
+                    let duplicateBytes = 0;
+                    for await (const value of stream) {
+                        const chunk = Buffer.from(value);
+                        duplicateBytes += chunk.length;
+                        expandedBytes += chunk.length;
+                        if (duplicateBytes > maxFileBytes || expandedBytes > maxExpandedBytes)
+                            throw new ArchiveError("archive exceeds expanded-size limits");
+                        if (compressedBytes === 0 || expandedBytes > compressedBytes * maxCompressionRatio) {
+                            throw new ArchiveError(`archive exceeds the ${maxCompressionRatio}:1 compression-ratio limit`);
+                        }
+                        duplicateHash.update(chunk);
+                    }
+                    if (duplicateBytes !== declaredSize || duplicateHash.digest("hex") !== prior.digest) {
+                        throw new ArchiveError(`conflicting duplicate archive entry ${relative}`);
+                    }
+                    next();
+                    return;
+                }
+                await mkdir(dirname(target), { recursive: true, mode: 0o755 });
+                const file = await open(target, "wx", executable ? 0o755 : 0o644);
+                const contentHash = createHash("sha256");
+                try {
+                    let fileBytes = 0;
+                    for await (const value of stream) {
+                        const chunk = Buffer.from(value);
+                        fileBytes += chunk.length;
+                        expandedBytes += chunk.length;
+                        if (fileBytes > maxFileBytes || expandedBytes > maxExpandedBytes)
+                            throw new ArchiveError("archive exceeds expanded-size limits");
+                        if (compressedBytes === 0 || expandedBytes > compressedBytes * maxCompressionRatio) {
+                            throw new ArchiveError(`archive exceeds the ${maxCompressionRatio}:1 compression-ratio limit`);
+                        }
+                        contentHash.update(chunk);
+                        await file.write(chunk);
+                    }
+                    if (fileBytes !== declaredSize)
+                        throw new ArchiveError(`archive entry size mismatch for ${relative}`);
+                    seen.set(relative, { type: "file", size: fileBytes, executable, digest: contentHash.digest("hex") });
+                }
+                finally {
+                    await file.close();
+                }
+                next();
+            })().catch((error) => {
+                stream.resume();
+                extract.destroy();
+                rejectCompletion(error);
+            });
+        });
+    });
+    const source = createReadStream(tarballPath);
+    const gunzip = createGunzip();
+    source.once("error", (error) => extract.destroy(error));
+    gunzip.once("error", (error) => extract.destroy(error));
+    source.pipe(gunzip).pipe(extract);
+    try {
+        await completion;
+        await stat(join(root, "package.json"));
+        return { path: root, entries, expandedBytes };
+    }
+    catch (error) {
+        source.destroy();
+        gunzip.destroy();
+        await rm(destination, { recursive: true, force: true });
+        if (error.code === "ENOENT")
+            throw new ArchiveError("archive does not contain package/package.json");
+        throw error;
+    }
+}
+//# sourceMappingURL=archive.js.map

package/dist/src/cache/archive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive.js","sourceRoot":"","sources":["../../../src/cache/archive.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,GAAG,MAAM,YAAY,CAAC;AAe7B,MAAM,OAAO,YAAa,SAAQ,KAAK;IACrC,YAAY,OAAe;QACzB,KAAK,CAAC,kBAAkB,OAAO,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,QAAQ,GAAG;IACf,UAAU,EAAE,OAAO;IACnB,gBAAgB,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI;IACpC,YAAY,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;IAC/B,mBAAmB,EAAE,GAAG;CAChB,CAAC;AAEX,SAAS,gBAAgB,CAAC,IAAY,EAAE,cAAkC;IACxE,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClG,MAAM,IAAI,YAAY,CAAC,qBAAqB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IACvH,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,YAAY,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;IACpF,IAAI,cAAc,KAAK,SAAS,IAAI,MAAM,KAAK,cAAc;QAAE,MAAM,IAAI,YAAY,CAAC,gDAAgD,IAAI,EAAE,CAAC,CAAC;IAC9I,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACnE,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,QAAgB;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAC;IACjI,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,WAAmB,EAAE,WAAmB,EAAE,MAAM,GAAkB,EAAE;IAC9G,MAAM,eAAe,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC;IAC5D,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,QAAQ,CAAC,gBAAgB,CAAC;IAC9E,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,QAAQ,CAAC,YAAY,CAAC;IAClE,MAAM,mBAAmB,GAAG,MAAM,CAAC,mBAAmB,IAAI,QAAQ,CAAC,mBAAmB,CAAC;IACvF,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,aAAiC,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkI,CAAC;IACvJ,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC9B,IAAI,gBAAgB,GAA6B,GAAG,EAAE,CAAC,SAAS,CAAC;IAEjE,MAAM,UAAU,GAAG,IAAI,OAAO,CAAO,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QAC9D,gBAAgB,GAAG,MAAM,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9B,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YAC3C,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,OAAO,IAAI,CAAC,CAAC;gBACb,IAAI,OAAO,GAAG,UAAU;oBAAE,MAAM,IAAI,YAAY,CAAC,mBAAmB,UAAU,UAAU,CAAC,CAAC;gBAC1F,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;gBAC9D,aAAa,KAAK,QAAQ,CAAC,MAAM,CAAC;gBAClC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;gBACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC3B,MAAM,CAAC,MAAM,EAAE,CAAC;oBAChB,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;oBACzB,OAAO;gBACT,CAAC;gBACD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBACzC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACjC,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;oBAChC,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;wBAAE,MAAM,IAAI,YAAY,CAAC,uCAAuC,QAAQ,EAAE,CAAC,CAAC;oBACnH,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;oBACtE,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;oBACtD,MAAM,CAAC,MAAM,EAAE,CAAC;oBAChB,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;oBACzB,OAAO;gBACT,CAAC;gBACD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;oBAAE,MAAM,IAAI,YAAY,CAAC,eAAe,MAAM,CAAC,IAAI,UAAU,QAAQ,EAAE,CAAC,CAAC;gBACnG,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;gBACtC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;gBACtD,IAAI,YAAY,GAAG,YAAY;oBAAE,MAAM,IAAI,YAAY,CAAC,GAAG,QAAQ,kCAAkC,CAAC,CAAC;gBACvG,IAAI,KAAK,EAAE,CAAC;oBACV,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;wBAC5F,MAAM,IAAI,YAAY,CAAC,uCAAuC,QAAQ,EAAE,CAAC,CAAC;oBAC5E,CAAC;oBACD,MAAM,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;oBAC3C,IAAI,cAAc,GAAG,CAAC,CAAC;oBACvB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;wBACjC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBACjC,cAAc,IAAI,KAAK,CAAC,MAAM,CAAC;wBAC/B,aAAa,IAAI,KAAK,CAAC,MAAM,CAAC;wBAC9B,IAAI,cAAc,GAAG,YAAY,IAAI,aAAa,GAAG,gBAAgB;4BAAE,MAAM,IAAI,YAAY,CAAC,sCAAsC,CAAC,CAAC;wBACtI,IAAI,eAAe,KAAK,CAAC,IAAI,aAAa,GAAG,eAAe,GAAG,mBAAmB,EAAE,CAAC;4BACnF,MAAM,IAAI,YAAY,CAAC,uBAAuB,mBAAmB,4BAA4B,CAAC,CAAC;wBACjG,CAAC;wBACD,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBAC9B,CAAC;oBACD,IAAI,cAAc,KAAK,YAAY,IAAI,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;wBACpF,MAAM,IAAI,YAAY,CAAC,uCAAuC,QAAQ,EAAE,CAAC,CAAC;oBAC5E,CAAC;oBACD,IAAI,EAAE,CAAC;oBACP,OAAO;gBACT,CAAC;gBACD,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC/D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBAClE,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACzC,IAAI,CAAC;oBACH,IAAI,SAAS,GAAG,CAAC,CAAC;oBAClB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;wBACjC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBACjC,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;wBAC1B,aAAa,IAAI,KAAK,CAAC,MAAM,CAAC;wBAC9B,IAAI,SAAS,GAAG,YAAY,IAAI,aAAa,GAAG,gBAAgB;4BAAE,MAAM,IAAI,YAAY,CAAC,sCAAsC,CAAC,CAAC;wBACjI,IAAI,eAAe,KAAK,CAAC,IAAI,aAAa,GAAG,eAAe,GAAG,mBAAmB,EAAE,CAAC;4BACnF,MAAM,IAAI,YAAY,CAAC,uBAAuB,mBAAmB,4BAA4B,CAAC,CAAC;wBACjG,CAAC;wBACD,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;wBAC1B,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;oBAC1B,CAAC;oBACD,IAAI,SAAS,KAAK,YAAY;wBAAE,MAAM,IAAI,YAAY,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAC;oBACtG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACvG,CAAC;wBAAS,CAAC;oBACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;gBACrB,CAAC;gBACD,IAAI,EAAE,CAAC;YACT,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAC5B,MAAM,CAAC,MAAM,EAAE,CAAC;gBAChB,OAAO,CAAC,OAAO,EAAE,CAAC;gBAClB,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,UAAU,CAAC;QACjB,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;QACvC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,YAAY,CAAC,+CAA+C,CAAC,CAAC;QAChI,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/src/cache/commands.d.ts

@@ -0,0 +1,15 @@
+import type { BnpmPaths } from "../config/paths.js";
+export interface CacheVerification {
+    readonly entries: number;
+    readonly valid: number;
+    readonly corrupt: readonly string[];
+}
+export interface CacheEntry {
+    readonly id: string;
+    readonly integrity: string;
+}
+export declare function listCache(paths: BnpmPaths, filter?: string): Promise<readonly CacheEntry[]>;
+export declare function verifyCache(paths: BnpmPaths): Promise<CacheVerification>;
+export declare function ensureCacheOwnership(paths: BnpmPaths): Promise<void>;
+export declare function cleanCache(paths: BnpmPaths): Promise<readonly string[]>;
+export declare function cleanCacheEntries(paths: BnpmPaths, filter: string): Promise<readonly CacheEntry[]>;

package/dist/src/cache/commands.js

@@ -0,0 +1,168 @@
+import { chmod, mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
+import { basename, dirname, resolve } from "node:path";
+import { randomBytes } from "node:crypto";
+import { verifyStoreEntry } from "./store.js";
+import { storePath } from "./store.js";
+export async function listCache(paths, filter) {
+    const entries = [];
+    try {
+        for (const algorithm of await readdir(paths.store, { withFileTypes: true })) {
+            if (!algorithm.isDirectory())
+                continue;
+            const parent = resolve(paths.store, algorithm.name);
+            for (const digest of await readdir(parent, { withFileTypes: true })) {
+                if (!digest.isDirectory() || digest.name.endsWith(".lock") || digest.name.includes(".tmp"))
+                    continue;
+                const root = resolve(parent, digest.name);
+                try {
+                    const metadata = JSON.parse(await readFile(resolve(root, ".bnpm-store.json"), "utf8"));
+                    const manifest = JSON.parse(await readFile(resolve(root, "package.json"), "utf8"));
+                    if (typeof metadata.integrity !== "string" || typeof manifest.name !== "string" || typeof manifest.version !== "string")
+                        continue;
+                    const id = `${manifest.name}@${manifest.version}`;
+                    if (filter === undefined || id === filter || manifest.name === filter)
+                        entries.push({ id, integrity: metadata.integrity });
+                    if (entries.length > 100_000)
+                        throw new Error("Cache contains more than 100000 store entries");
+                }
+                catch (error) {
+                    if (error.code !== "ENOENT")
+                        throw error;
+                }
+            }
+        }
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return [];
+        throw error;
+    }
+    return entries.sort((left, right) => left.id.localeCompare(right.id) || left.integrity.localeCompare(right.integrity));
+}
+export async function verifyCache(paths) {
+    const entries = [];
+    try {
+        for (const algorithm of await readdir(paths.store, { withFileTypes: true })) {
+            if (!algorithm.isDirectory())
+                continue;
+            const parent = resolve(paths.store, algorithm.name);
+            for (const digest of await readdir(parent, { withFileTypes: true })) {
+                if (!digest.isDirectory() || digest.name.endsWith(".lock") || digest.name.includes(".tmp"))
+                    continue;
+                entries.push(resolve(parent, digest.name));
+                if (entries.length > 100_000)
+                    throw new Error("Cache contains more than 100000 store entries");
+            }
+        }
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return { entries: 0, valid: 0, corrupt: [] };
+        throw error;
+    }
+    const corrupt = [];
+    let valid = 0;
+    for (const entry of entries.sort()) {
+        try {
+            const metadata = JSON.parse(await readFile(resolve(entry, ".bnpm-store.json"), "utf8"));
+            if (typeof metadata.integrity !== "string" || !await verifyStoreEntry(entry, metadata.integrity))
+                corrupt.push(entry);
+            else
+                valid += 1;
+        }
+        catch {
+            corrupt.push(entry);
+        }
+    }
+    return { entries: entries.length, valid, corrupt };
+}
+function confined(path, expected) {
+    const absolute = resolve(path);
+    if (basename(absolute) !== expected || absolute === resolve("/") || dirname(absolute) === absolute)
+        throw new Error(`Refusing unsafe cache path ${absolute}`);
+}
+function cacheRoot(paths) {
+    const parents = [paths.store, paths.cache, paths.quarantine].map((path) => dirname(resolve(path)));
+    if (!parents.every((parent) => parent === parents[0]))
+        throw new Error("Refusing cache paths that do not share one root");
+    const root = parents[0] ?? resolve("/");
+    if (root === resolve("/") || (process.env.HOME && root === resolve(process.env.HOME)))
+        throw new Error(`Refusing unsafe cache root ${root}`);
+    return root;
+}
+export async function ensureCacheOwnership(paths) {
+    const root = cacheRoot(paths);
+    await mkdir(root, { recursive: true, mode: 0o700 });
+    const marker = resolve(root, ".bnpm-cache-root");
+    try {
+        await writeFile(marker, "bnpm-cache-v1\n", { flag: "wx", mode: 0o600 });
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw error;
+        if (await readFile(marker, "utf8") !== "bnpm-cache-v1\n")
+            throw new Error(`Cache ownership marker is invalid at ${marker}`);
+    }
+}
+export async function cleanCache(paths) {
+    const targets = [[paths.store, "store"], [paths.cache, "cache"], [paths.quarantine, "quarantine"]];
+    for (const [path, expected] of targets)
+        confined(path, expected);
+    const root = cacheRoot(paths);
+    if (await readFile(resolve(root, ".bnpm-cache-root"), "utf8").catch(() => "") !== "bnpm-cache-v1\n")
+        throw new Error(`Refusing unowned cache root ${root}`);
+    const removed = [];
+    for (const [path] of targets) {
+        const trash = `${path}.clean-${process.pid}-${randomBytes(6).toString("hex")}`;
+        try {
+            await rename(path, trash);
+            removed.push(path);
+            await rm(trash, { recursive: true, force: true });
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        await mkdir(path, { recursive: true, mode: 0o700 });
+    }
+    return removed;
+}
+async function makeRemovable(path) {
+    try {
+        await chmod(path, 0o700);
+        for (const entry of await readdir(path, { withFileTypes: true })) {
+            const child = resolve(path, entry.name);
+            if (entry.isDirectory())
+                await makeRemovable(child);
+            else
+                await chmod(child, 0o600);
+        }
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+}
+export async function cleanCacheEntries(paths, filter) {
+    if (!filter || filter.includes("\0"))
+        throw new Error("A cache package name or exact name@version is required");
+    const root = cacheRoot(paths);
+    if (await readFile(resolve(root, ".bnpm-cache-root"), "utf8").catch(() => "") !== "bnpm-cache-v1\n")
+        throw new Error(`Refusing unowned cache root ${root}`);
+    const entries = await listCache(paths, filter);
+    for (const entry of entries) {
+        const stored = storePath(paths.store, entry.integrity);
+        const trash = `${stored}.clean-${process.pid}-${randomBytes(6).toString("hex")}`;
+        try {
+            await rename(stored, trash);
+            await makeRemovable(trash);
+            await rm(trash, { recursive: true, force: true });
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
+    return entries;
+}
+//# sourceMappingURL=commands.js.map

package/dist/src/cache/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../../../src/cache/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAUvC,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAgB,EAAE,MAAe;IAC/D,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,KAAK,MAAM,SAAS,IAAI,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5E,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE;gBAAE,SAAS;YACvC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YACpD,KAAK,MAAM,MAAM,IAAI,MAAM,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBACpE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,SAAS;gBACrG,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAA4B,CAAC;oBAClH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAA0C,CAAC;oBAC5H,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;wBAAE,SAAS;oBAClI,MAAM,EAAE,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;oBAClD,IAAI,MAAM,KAAK,SAAS,IAAI,EAAE,KAAK,MAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM;wBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;oBAC3H,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO;wBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;gBACjG,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;wBAAE,MAAM,KAAK,CAAC;gBAAC,CAAC;YAC1F,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;IACnG,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;AACzH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAgB;IAChD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,KAAK,MAAM,SAAS,IAAI,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5E,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE;gBAAE,SAAS;YACvC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YACpD,KAAK,MAAM,MAAM,IAAI,MAAM,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBACpE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,SAAS;gBACrG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC3C,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACrG,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAA4B,CAAC;YACnH,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;;gBACjH,KAAK,IAAI,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,QAAgB;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,QAAQ,KAAK,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,EAAE,CAAC,CAAC;AAChK,CAAC;AAED,SAAS,SAAS,CAAC,KAAgB;IACjC,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC1H,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,IAAI,KAAK,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;IAC7I,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAgB;IACzD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,MAAM,EAAE,iBAAiB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;QACpE,IAAI,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,iBAAiB;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,MAAM,EAAE,CAAC,CAAC;IAC9H,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAgB;IAC/C,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAU,CAAC;IAC5G,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,OAAO;QAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,iBAAiB;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IAC5J,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,GAAG,IAAI,UAAU,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/E,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACtE,CAAC;QACD,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACzB,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACjE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;;gBAC/C,MAAM,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IACtE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAgB,EAAE,MAAc;IACtE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAChH,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,iBAAiB;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;IAC5J,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,GAAG,MAAM,UAAU,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACjF,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC5B,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;YAC3B,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACtE,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/src/cache/quarantine.d.ts

@@ -0,0 +1,18 @@
+export interface QuarantineOptions {
+    root: string;
+    maxCompressedBytes?: number;
+    fetch?: typeof globalThis.fetch;
+    signal?: AbortSignal;
+    maxRedirects?: number;
+    maxRetries?: number;
+    timeoutMilliseconds?: number;
+    headers?: (url: URL) => Readonly<Record<string, string>>;
+    onProgress?: (bytes: number, totalBytes?: number) => void;
+}
+export interface QuarantinedTarball {
+    path: string;
+    bytes: number;
+    integrity: string;
+}
+export declare function downloadToQuarantine(tarball: URL, integrity: string, options: QuarantineOptions): Promise<QuarantinedTarball>;
+export declare function downloadUnverifiedToQuarantine(tarball: URL, options: QuarantineOptions): Promise<QuarantinedTarball>;

package/dist/src/cache/quarantine.js

@@ -0,0 +1,104 @@
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, open, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { assertDigest, selectExpectedIntegrity } from "../security/integrity.js";
+const defaultMaxCompressedBytes = 100 * 1024 * 1024;
+export async function downloadToQuarantine(tarball, integrity, options) {
+    return download(tarball, options, integrity);
+}
+export async function downloadUnverifiedToQuarantine(tarball, options) {
+    return download(tarball, options);
+}
+async function download(tarball, options, integrity) {
+    if (tarball.protocol !== "https:")
+        throw new Error("Tarball URL must use HTTPS");
+    const expected = integrity === undefined ? undefined : selectExpectedIntegrity(integrity);
+    const maxBytes = options.maxCompressedBytes ?? defaultMaxCompressedBytes;
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    await mkdir(options.root, { recursive: true });
+    const directory = join(options.root, randomUUID());
+    const path = join(directory, "package.tgz");
+    await mkdir(directory, { mode: 0o700 });
+    let file;
+    try {
+        const response = await fetchTarball(tarball, fetchImpl, options);
+        if (!response.ok || !response.body) {
+            throw new Error(`Tarball download failed with ${response.status}`);
+        }
+        const declaredLength = Number(response.headers.get("content-length"));
+        if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {
+            throw new Error(`Tarball exceeds the ${maxBytes} byte compressed-size limit`);
+        }
+        file = await open(path, "wx", 0o600);
+        const hash = createHash(expected?.algorithm ?? "sha512");
+        let bytes = 0;
+        options.onProgress?.(0, Number.isFinite(declaredLength) && declaredLength >= 0 ? declaredLength : undefined);
+        for await (const value of response.body) {
+            const chunk = Buffer.from(value);
+            bytes += chunk.length;
+            if (bytes > maxBytes)
+                throw new Error(`Tarball exceeds the ${maxBytes} byte compressed-size limit`);
+            hash.update(chunk);
+            await writeAll(file, chunk);
+            options.onProgress?.(bytes, Number.isFinite(declaredLength) && declaredLength >= 0 ? declaredLength : undefined);
+        }
+        const digest = hash.digest();
+        if (expected)
+            assertDigest(expected, digest);
+        await file.close();
+        file = undefined;
+        return { path, bytes, integrity: expected?.serialized ?? `sha512-${digest.toString("base64")}` };
+    }
+    catch (error) {
+        await file?.close().catch(() => undefined);
+        await rm(directory, { recursive: true, force: true });
+        throw error;
+    }
+}
+async function fetchTarball(url, fetchImpl, options) {
+    const maxRetries = options.maxRetries ?? 2;
+    const maxRedirects = options.maxRedirects ?? 5;
+    for (let attempt = 0; attempt <= maxRetries; attempt += 1) {
+        let current = url;
+        try {
+            for (let redirects = 0; redirects <= maxRedirects; redirects += 1) {
+                const timeout = AbortSignal.timeout(options.timeoutMilliseconds ?? 60_000);
+                const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;
+                const headers = options.headers?.(current);
+                const response = await fetchImpl(current, { ...(headers === undefined ? {} : { headers }), redirect: "manual", signal });
+                if ([301, 302, 303, 307, 308].includes(response.status)) {
+                    if (redirects === maxRedirects)
+                        throw new Error("Tarball download exceeded the redirect limit");
+                    const location = response.headers.get("location");
+                    if (!location)
+                        throw new Error("Tarball redirect did not provide a location");
+                    current = new URL(location, current);
+                    if (current.protocol !== "https:")
+                        throw new Error("Tarball redirect must use HTTPS");
+                    continue;
+                }
+                if ([408, 429, 500, 502, 503, 504].includes(response.status) && attempt < maxRetries) {
+                    await response.body?.cancel();
+                    break;
+                }
+                return response;
+            }
+        }
+        catch (error) {
+            if (attempt === maxRetries || options.signal?.aborted || (error instanceof Error && error.message.includes("redirect")))
+                throw error;
+            continue;
+        }
+    }
+    throw new Error("Tarball download failed after bounded retries");
+}
+async function writeAll(file, buffer) {
+    let offset = 0;
+    while (offset < buffer.length) {
+        const { bytesWritten } = await file.write(buffer, offset, buffer.length - offset);
+        if (bytesWritten === 0)
+            throw new Error("Unable to write quarantined tarball");
+        offset += bytesWritten;
+    }
+}
+//# sourceMappingURL=quarantine.js.map