@adea-ai/plugins 3.0.4 → 3.0.5

package/dist/staged-file.d.ts

@@ -0,0 +1,2 @@
+/** Read an already validated flat name without following a final-component symlink. */
+export declare function readStagedFile(directory: string, name: string): Promise<Buffer>;

package/dist/staged-file.js

@@ -0,0 +1,43 @@
+import { constants } from 'node:fs';
+import { open } from 'node:fs/promises';
+import { join } from 'node:path';
+import { createRequire } from 'node:module';
+/** Read an already validated flat name without following a final-component symlink. */
+export async function readStagedFile(directory, name) {
+    if (process.platform === 'win32') {
+        // The binary is built and qualified separately for each supported Windows architecture.
+        // Failure to load it is fatal: falling back to a path check would introduce a race.
+        let reader;
+        try {
+            if (process.arch !== 'x64' && process.arch !== 'arm64')
+                throw new Error('unsupported architecture');
+            reader = createRequire(import.meta.url)(`../native/staged-reader-win32-${process.arch}.node`);
+            if (typeof reader.read !== 'function')
+                throw new Error('invalid native reader');
+        }
+        catch (cause) {
+            throw new Error('STAGED_NOFOLLOW_UNSUPPORTED', { cause });
+        }
+        return reader.read(join(directory, name));
+    }
+    if (typeof constants.O_NOFOLLOW !== 'number' || constants.O_NOFOLLOW === 0)
+        throw new Error('STAGED_NOFOLLOW_UNSUPPORTED');
+    let file;
+    try {
+        file = await open(join(directory, name), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    }
+    catch (error) {
+        if (error.code === 'ELOOP')
+            throw new Error(`STAGED_FILE_UNSAFE: ${name}`, { cause: error });
+        throw error;
+    }
+    try {
+        if (!(await file.stat()).isFile())
+            throw new Error(`STAGED_FILE_UNSAFE: ${name}`);
+        return await file.readFile();
+    }
+    finally {
+        await file.close();
+    }
+}
+//# sourceMappingURL=staged-file.js.map

package/dist/staged-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"staged-file.js","sourceRoot":"","sources":["../src/staged-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3C,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,SAAiB,EAAE,IAAY;IAClE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,wFAAwF;QACxF,oFAAoF;QACpF,IAAI,MAA+C,CAAA;QACnD,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;gBACpD,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;YAC7C,MAAM,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CACrC,iCAAiC,OAAO,CAAC,IAAI,OAAO,CACpC,CAAA;YAClB,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;QACjF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QAC3D,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAA;IAC3C,CAAC;IACD,IAAI,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ,IAAI,SAAS,CAAC,UAAU,KAAK,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;IAChD,IAAI,IAAI,CAAA;IACR,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,IAAI,CACf,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EACrB,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CACjE,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,OAAO;YACnD,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QAClE,MAAM,KAAK,CAAA;IACb,CAAC;IACD,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAA;QACjF,OAAO,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAA;IAC9B,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;IACpB,CAAC;AACH,CAAC"}

package/native/build-provenance.txt

@@ -0,0 +1,6 @@
+source_commit a07c59531cff4fff1b33a24fbdadc04b518d07b1
+12125c7ab1a1e2d7cbe538343e2a11ef4d7fb0fa0310c5251d8606bf20f26834  packages/plugins/native/staged-reader.c
+b30da86114de32626299f459d5bbbcaee66c59e797ddc7f53ede7ddc4f780706  packages/plugins/native/staged-reader-test-win32-arm64.node
+26cbe37e84fa1159f95dd72f2d9aae7b0fa71ad087bc31375fa3a47fe33d5d0f  packages/plugins/native/staged-reader-test-win32-x64.node
+1ffe35095afa9ca50501397eecfee1245c4c350cb59de233b8153285737445e7  packages/plugins/native/staged-reader-win32-arm64.node
+6c2bf64413436ba11e5696d88bf4baf07d5233a58bd85206a57e9df9bd32db79  packages/plugins/native/staged-reader-win32-x64.node

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adea-ai/plugins",
-  "version": "3.0.4",
+  "version": "3.0.5",
   "description": "Deterministic compiler for AI agent plugin marketplaces: schemas, source parsing, provenance verification, per-harness materialization, and provenance-checked static artifacts.",
   "keywords": [
     "agents",
@@ -26,6 +26,8 @@
   "files": [
     "dist",
     "src",
+    "native/staged-reader-win32-*.node",
+    "native/build-provenance.txt",
     "schemas",
     "README.md"
   ],

package/src/staged-file.ts

@@ -0,0 +1,43 @@
+import { constants } from 'node:fs'
+import { open } from 'node:fs/promises'
+import { join } from 'node:path'
+import { createRequire } from 'node:module'
+
+/** Read an already validated flat name without following a final-component symlink. */
+export async function readStagedFile(directory: string, name: string): Promise<Buffer> {
+  if (process.platform === 'win32') {
+    // The binary is built and qualified separately for each supported Windows architecture.
+    // Failure to load it is fatal: falling back to a path check would introduce a race.
+    let reader: { read(path: string): Promise<Buffer> }
+    try {
+      if (process.arch !== 'x64' && process.arch !== 'arm64')
+        throw new Error('unsupported architecture')
+      reader = createRequire(import.meta.url)(
+        `../native/staged-reader-win32-${process.arch}.node`
+      ) as typeof reader
+      if (typeof reader.read !== 'function') throw new Error('invalid native reader')
+    } catch (cause) {
+      throw new Error('STAGED_NOFOLLOW_UNSUPPORTED', { cause })
+    }
+    return reader.read(join(directory, name))
+  }
+  if (typeof constants.O_NOFOLLOW !== 'number' || constants.O_NOFOLLOW === 0)
+    throw new Error('STAGED_NOFOLLOW_UNSUPPORTED')
+  let file
+  try {
+    file = await open(
+      join(directory, name),
+      constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK
+    )
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ELOOP')
+      throw new Error(`STAGED_FILE_UNSAFE: ${name}`, { cause: error })
+    throw error
+  }
+  try {
+    if (!(await file.stat()).isFile()) throw new Error(`STAGED_FILE_UNSAFE: ${name}`)
+    return await file.readFile()
+  } finally {
+    await file.close()
+  }
+}