@0xrama/bnpm 0.0.1

package/dist/src/security/script-runner.js

@@ -0,0 +1,73 @@
+import { spawn } from "node:child_process";
+import { delimiter, dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import packageMetadata from "../../package.json" with { type: "json" };
+export class ScriptExecutionError extends Error {
+    constructor(message) {
+        super(`Lifecycle script failed: ${message}`);
+        this.name = "ScriptExecutionError";
+    }
+}
+const removedEnvironment = /(?:TOKEN|PASSWORD|SECRET|AUTH|COOKIE|NPM_CONFIG_USERCONFIG)/i;
+const bundledToolBin = resolve(dirname(fileURLToPath(import.meta.url)), "../../..", "node_modules", ".bin");
+export async function runLifecycle(options) {
+    const environment = {};
+    for (const [key, value] of Object.entries(process.env))
+        if (!removedEnvironment.test(key))
+            environment[key] = value;
+    environment.npm_lifecycle_event = options.fact.stage;
+    environment.npm_package_name = options.fact.packageName;
+    environment.npm_package_version = options.fact.packageVersion;
+    environment.npm_package_json = join(options.cwd, "package.json");
+    environment.npm_command = "install";
+    environment.npm_node_execpath = process.execPath;
+    environment.npm_execpath = process.argv[1] ?? "bnpm";
+    environment.npm_config_user_agent = `bnpm/${packageMetadata.version} node/${process.versions.node} ${process.platform} ${process.arch}`;
+    environment.INIT_CWD = options.initialCwd ?? options.cwd;
+    environment.PATH = [join(options.cwd, "node_modules", ".bin"), bundledToolBin, environment.PATH].filter((value) => Boolean(value)).join(delimiter);
+    const child = spawn(options.fact.command, {
+        cwd: options.cwd,
+        env: environment,
+        shell: true,
+        stdio: ["ignore", "pipe", "pipe"],
+        windowsHide: true,
+    });
+    const maxOutput = options.maxOutputBytes ?? 1024 * 1024;
+    let outputBytes = 0;
+    let truncated = false;
+    const consume = (stream, chunk) => {
+        if (truncated)
+            return;
+        outputBytes += chunk.length;
+        if (outputBytes > maxOutput) {
+            truncated = true;
+            options.onOutput?.("stderr", `[output truncated after ${maxOutput} bytes]`);
+            child.kill("SIGTERM");
+            return;
+        }
+        options.onOutput?.(stream, chunk.toString("utf8"));
+    };
+    child.stdout.on("data", (chunk) => consume("stdout", chunk));
+    child.stderr.on("data", (chunk) => consume("stderr", chunk));
+    const abort = () => { child.kill("SIGTERM"); };
+    options.signal?.addEventListener("abort", abort, { once: true });
+    const timer = setTimeout(() => child.kill("SIGTERM"), options.timeoutMilliseconds ?? 5 * 60_000);
+    timer.unref();
+    try {
+        const result = await new Promise((resolve, reject) => {
+            child.once("error", reject);
+            child.once("close", (code, signal) => resolve({ code, signal }));
+        });
+        if (options.signal?.aborted)
+            throw options.signal.reason;
+        if (truncated)
+            throw new ScriptExecutionError(`${options.fact.packageName}@${options.fact.packageVersion} ${options.fact.stage} exceeded output limits`);
+        if (result.code !== 0)
+            throw new ScriptExecutionError(`${options.fact.packageName}@${options.fact.packageVersion} ${options.fact.stage} exited with ${result.code ?? result.signal}`);
+    }
+    finally {
+        clearTimeout(timer);
+        options.signal?.removeEventListener("abort", abort);
+    }
+}
+//# sourceMappingURL=script-runner.js.map

package/dist/src/security/script-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"script-runner.js","sourceRoot":"","sources":["../../../src/security/script-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,eAAe,MAAM,oBAAoB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAEvE,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,kBAAkB,GAAG,8DAA8D,CAAC;AAC1F,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;AAE5G,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAQlC;IACC,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACpH,WAAW,CAAC,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;IACrD,WAAW,CAAC,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;IACxD,WAAW,CAAC,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;IAC9D,WAAW,CAAC,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACjE,WAAW,CAAC,WAAW,GAAG,SAAS,CAAC;IACpC,WAAW,CAAC,iBAAiB,GAAG,OAAO,CAAC,QAAQ,CAAC;IACjD,WAAW,CAAC,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IACrD,WAAW,CAAC,qBAAqB,GAAG,QAAQ,eAAe,CAAC,OAAO,SAAS,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IACxI,WAAW,CAAC,QAAQ,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC;IACzD,WAAW,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,cAAc,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpK,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE;QACxC,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,WAAW;QAChB,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;QACjC,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,GAAG,IAAI,CAAC;IACxD,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,MAAM,OAAO,GAAG,CAAC,MAA2B,EAAE,KAAa,EAAQ,EAAE;QACnE,IAAI,SAAS;YAAE,OAAO;QACtB,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;QAC5B,IAAI,WAAW,GAAG,SAAS,EAAE,CAAC;YAC5B,SAAS,GAAG,IAAI,CAAC;YACjB,OAAO,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,2BAA2B,SAAS,SAAS,CAAC,CAAC;YAC5E,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,OAAO,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC;IACF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IACrE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,GAAS,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,mBAAmB,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;IACjG,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAyD,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3G,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;QACzD,IAAI,SAAS;YAAE,MAAM,IAAI,oBAAoB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,yBAAyB,CAAC,CAAC;QACzJ,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,oBAAoB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,gBAAgB,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACxL,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACtD,CAAC;AACH,CAAC"}

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@0xrama/bnpm",
+  "version": "0.0.1",
+  "description": "A fast, security-focused npm-compatible package manager",
+  "type": "module",
+  "bin": {
+    "bnpm": "dist/src/cli.js",
+    "bnpmx": "dist/src/cli.js"
+  },
+  "files": [
+    "dist/src",
+    "dist/package.json",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=22.22.2"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "check": "tsc -p tsconfig.json --noEmit",
+    "test": "npm run build && node --test dist/test/*.test.js",
+    "benchmark": "npm run build && node scripts/benchmark.mjs",
+    "verify:package": "npm run build && node scripts/verify-package.mjs",
+    "start": "node dist/src/cli.js"
+  },
+  "dependencies": {
+    "npm-package-arg": "13.0.2",
+    "node-gyp": "13.0.1",
+    "npm-packlist": "11.3.0",
+    "semver": "7.8.5",
+    "sigstore": "5.0.0",
+    "tar-stream": "3.2.0",
+    "yaml": "^2.9.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "@types/npm-package-arg": "6.1.4",
+    "@types/semver": "7.7.1",
+    "@types/tar-stream": "3.1.4",
+    "typescript": "^7.0.2"
+  }
+}