@astralyn/sash 0.1.0

package/dist/daemon-static.js

@@ -0,0 +1,106 @@
+import fs from "node:fs";
+import path from "node:path";
+import { resolveUiDir } from "./webui.js";
+const UI_SECURITY_HEADERS = {
+    "Content-Security-Policy": "frame-ancestors 'none'",
+    "X-Frame-Options": "DENY",
+    "X-Content-Type-Options": "nosniff",
+    "Referrer-Policy": "no-referrer",
+};
+const FINGERPRINTED_ASSET = /^assets\/.+-[A-Za-z0-9_-]{8}\.[^/\\]+$/;
+const MIME_TYPES = {
+    ".html": "text/html; charset=utf-8",
+    ".js": "application/javascript; charset=utf-8",
+    ".css": "text/css; charset=utf-8",
+    ".json": "application/json; charset=utf-8",
+    ".svg": "image/svg+xml",
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".webp": "image/webp",
+    ".ico": "image/x-icon",
+    ".wasm": "application/wasm",
+    ".woff": "font/woff",
+    ".woff2": "font/woff2",
+};
+export function serveStaticUi(req, res, pathname, layout) {
+    if (pathname !== "/ui" && !pathname.startsWith("/ui/")) {
+        return false;
+    }
+    const uiRoot = resolveUiDir(layout);
+    if (!uiRoot) {
+        return false;
+    }
+    let relative = pathname.startsWith("/ui/") ? pathname.slice("/ui/".length) : "";
+    if (!relative || relative === "ui")
+        relative = "index.html";
+    if (relative.split(/[\\/]/).includes("..")) {
+        res.writeHead(403, { ...UI_SECURITY_HEADERS, "Content-Type": "text/plain" });
+        res.end("Forbidden");
+        return true;
+    }
+    const candidate = path.join(uiRoot, relative);
+    const hasExt = Boolean(path.extname(relative));
+    const statFile = (file) => {
+        try {
+            const stats = fs.statSync(file);
+            return stats.isFile() ? stats : null;
+        }
+        catch {
+            return null;
+        }
+    };
+    let targetFile = null;
+    let targetStats = statFile(candidate);
+    if (targetStats) {
+        targetFile = candidate;
+    }
+    else if (!hasExt) {
+        targetFile = path.join(uiRoot, "index.html");
+        targetStats = statFile(targetFile);
+    }
+    if (targetFile && targetStats) {
+        const ext = path.extname(targetFile);
+        const mime = MIME_TYPES[ext] ?? "application/octet-stream";
+        const headers = {
+            ...UI_SECURITY_HEADERS,
+            "Content-Type": mime,
+            "Content-Length": String(targetStats.size),
+        };
+        if (ext === ".html") {
+            headers["Cache-Control"] = "no-cache, no-store, must-revalidate";
+            headers.Pragma = "no-cache";
+            headers.Expires = "0";
+        }
+        else if (FINGERPRINTED_ASSET.test(relative)) {
+            headers["Cache-Control"] = "public, max-age=31536000, immutable";
+        }
+        else {
+            headers["Cache-Control"] = "public, max-age=3600";
+        }
+        if (req.method === "HEAD") {
+            res.writeHead(200, headers);
+            res.end();
+            return true;
+        }
+        const stream = fs.createReadStream(targetFile);
+        stream.once("open", () => {
+            res.writeHead(200, headers);
+            stream.pipe(res);
+        });
+        stream.once("error", () => {
+            if (!res.headersSent) {
+                res.writeHead(500, {
+                    ...UI_SECURITY_HEADERS,
+                    "Content-Type": "text/plain; charset=utf-8",
+                });
+                res.end("Failed to read dashboard asset");
+            }
+            else {
+                res.destroy();
+            }
+        });
+        return true;
+    }
+    return false;
+}

package/dist/daemon.js

@@ -0,0 +1,3 @@
+export { runDaemon } from "./daemon/entry.js";
+export { createDaemonServer } from "./daemon/server.js";
+export { CoreSupervisor } from "./supervisor.js";

package/dist/error-utils.js

@@ -0,0 +1,14 @@
+export function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+export function errnoCode(error) {
+    if (typeof error !== "object" || error === null)
+        return undefined;
+    try {
+        const code = error.code;
+        return typeof code === "string" ? code : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/fs-atomic.js

@@ -0,0 +1,123 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { errnoCode } from "./error-utils.js";
+const WINDOWS_TRANSIENT_FILE_CODES = new Set(["EPERM", "EBUSY", "EACCES"]);
+const DEFAULT_RETRY_DELAYS = [0, 50, 100, 200, 400];
+function shouldRetryFileError(error, platform) {
+    const code = error.code;
+    return platform === "win32" && Boolean(code && WINDOWS_TRANSIENT_FILE_CODES.has(code));
+}
+export function renameWithRetrySync(from, to, options = {}) {
+    const platform = options.platform ?? process.platform;
+    const delays = options.delays?.length ? options.delays : DEFAULT_RETRY_DELAYS;
+    const sleep = options.sleep ?? sleepSync;
+    const rename = options.rename ?? fs.renameSync;
+    let lastError;
+    for (const delay of delays) {
+        if (delay > 0)
+            sleep(delay);
+        try {
+            rename(from, to);
+            return;
+        }
+        catch (err) {
+            lastError = err;
+            if (!shouldRetryFileError(err, platform))
+                break;
+        }
+    }
+    throw lastError;
+}
+export function removeWithRetrySync(target, options = {}) {
+    const platform = options.platform ?? process.platform;
+    const delays = options.delays?.length ? options.delays : DEFAULT_RETRY_DELAYS;
+    const sleep = options.sleep ?? sleepSync;
+    const unlink = options.unlink ?? fs.unlinkSync;
+    let lastError;
+    for (const delay of delays) {
+        if (delay > 0)
+            sleep(delay);
+        try {
+            unlink(target);
+            return true;
+        }
+        catch (err) {
+            if (err.code === "ENOENT")
+                return false;
+            lastError = err;
+            if (!shouldRetryFileError(err, platform))
+                break;
+        }
+    }
+    throw lastError;
+}
+export function pathEntryExists(target) {
+    try {
+        fs.lstatSync(target);
+        return true;
+    }
+    catch (err) {
+        if (errnoCode(err) === "ENOENT")
+            return false;
+        throw err;
+    }
+}
+export function atomicWriteFileSync(target, data, mode = 0o600) {
+    const dir = path.dirname(target);
+    fs.mkdirSync(dir, { recursive: true });
+    const tmp = path.join(dir, `.${path.basename(target)}.${process.pid}.${crypto.randomBytes(6).toString("hex")}.tmp`);
+    const fd = fs.openSync(tmp, "wx", mode);
+    try {
+        fs.writeFileSync(fd, data);
+        fs.fsyncSync(fd);
+    }
+    catch (err) {
+        try {
+            fs.closeSync(fd);
+            fs.rmSync(tmp, { force: true });
+        }
+        catch {
+        }
+        throw err;
+    }
+    fs.closeSync(fd);
+    try {
+        renameWithRetrySync(tmp, target);
+    }
+    catch (err) {
+        try {
+            fs.rmSync(tmp, { force: true });
+        }
+        catch {
+        }
+        throw err;
+    }
+    fsyncParentDirectory(dir);
+}
+export function durableRemoveFileSync(target) {
+    if (removeWithRetrySync(target))
+        fsyncParentDirectory(path.dirname(target));
+}
+export function durableRenameSync(from, to) {
+    renameWithRetrySync(from, to);
+    const sourceDir = path.dirname(from);
+    const destinationDir = path.dirname(to);
+    fsyncParentDirectory(destinationDir);
+    if (sourceDir !== destinationDir)
+        fsyncParentDirectory(sourceDir);
+}
+function fsyncParentDirectory(dir) {
+    if (process.platform === "win32")
+        return;
+    const fd = fs.openSync(dir, "r");
+    try {
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+function sleepSync(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}

package/dist/github.js

@@ -0,0 +1,187 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import { downloadToFile, ERROR_BODY_LIMIT, fetchWithRetry, USER_AGENT } from "./http.js";
+export const MIHOMO_REPO = "MetaCubeX/mihomo";
+export const GITHUB_MIRRORS = [
+    "",
+    "https://ghfast.top/",
+    "https://gh-proxy.com/",
+];
+export const GITHUB_DOWNLOAD_HOSTS = new Set([
+    "github.com",
+    "release-assets.githubusercontent.com",
+    "objects.githubusercontent.com",
+    "github-releases.githubusercontent.com",
+    ...GITHUB_MIRRORS.filter(Boolean).map((mirror) => new URL(mirror).hostname.toLowerCase()),
+]);
+function mirrorize(githubUrl) {
+    return GITHUB_MIRRORS.map((prefix) => (prefix ? `${prefix}${githubUrl}` : githubUrl));
+}
+function ghTokenHeaders() {
+    const token = process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN;
+    return token ? { authorization: `Bearer ${token}` } : {};
+}
+export async function resolveLatestTag(repo) {
+    const latestUrl = `https://github.com/${repo}/releases/latest`;
+    try {
+        const res = await fetchWithRetry(latestUrl, {
+            manualRedirect: true,
+            attempts: 2,
+            deadlineMs: 15_000,
+        });
+        if (res.statusCode >= 300 && res.statusCode < 400) {
+            const location = res.headers.location;
+            const loc = Array.isArray(location) ? location[0] : location;
+            await res.discard();
+            if (loc) {
+                const target = new URL(loc, latestUrl);
+                if (target.protocol === "https:" && target.hostname.toLowerCase() === "github.com") {
+                    const tag = target.pathname.match(/\/releases\/tag\/([^/]+)\/?$/)?.[1];
+                    if (tag)
+                        return decodeURIComponent(tag);
+                }
+            }
+        }
+        else {
+            await res.discard();
+        }
+    }
+    catch {
+    }
+    const apiUrl = `https://api.github.com/repos/${repo}/releases/latest`;
+    const res = await fetchWithRetry(apiUrl, {
+        headers: {
+            accept: "application/vnd.github+json",
+            ...ghTokenHeaders(),
+        },
+        attempts: 2,
+        deadlineMs: 15_000,
+        manualRedirect: true,
+    });
+    if (res.statusCode !== 200) {
+        await res.text(ERROR_BODY_LIMIT);
+        throw new Error(`Failed to resolve latest release for ${repo}: HTTP ${res.statusCode}`);
+    }
+    const text = await res.text(2 * 1024 * 1024);
+    let data;
+    try {
+        data = JSON.parse(text);
+    }
+    catch {
+    }
+    if (!data?.tag_name) {
+        throw new Error(`GitHub release response for ${repo} missing tag_name`);
+    }
+    return data.tag_name;
+}
+export async function listReleaseAssets(repo, tag) {
+    const apiUrl = `https://api.github.com/repos/${repo}/releases/tags/${encodeURIComponent(tag)}`;
+    const res = await fetchWithRetry(apiUrl, {
+        headers: {
+            accept: "application/vnd.github+json",
+            ...ghTokenHeaders(),
+        },
+        attempts: 2,
+        deadlineMs: 15_000,
+        manualRedirect: true,
+    });
+    if (res.statusCode !== 200) {
+        await res.text(ERROR_BODY_LIMIT);
+        throw new Error(`Failed to list release assets for ${repo}@${tag}: HTTP ${res.statusCode}`);
+    }
+    const text = await res.text(8 * 1024 * 1024);
+    let data;
+    try {
+        data = JSON.parse(text);
+    }
+    catch {
+    }
+    if (!Array.isArray(data?.assets)) {
+        throw new Error(`GitHub release response for ${repo}@${tag} is missing assets`);
+    }
+    return data.assets.flatMap((value) => {
+        if (typeof value !== "object" || value === null || Array.isArray(value))
+            return [];
+        const asset = value;
+        if (typeof asset.name !== "string" ||
+            typeof asset.browser_download_url !== "string" ||
+            typeof asset.size !== "number" ||
+            !Number.isSafeInteger(asset.size) ||
+            asset.size <= 0 ||
+            typeof asset.digest !== "string") {
+            return [];
+        }
+        return [
+            {
+                name: asset.name,
+                browser_download_url: asset.browser_download_url,
+                size: asset.size,
+                digest: asset.digest,
+            },
+        ];
+    });
+}
+export const RELEASE_ASSET_SIZE_LIMIT = 128 * 1024 * 1024;
+export function parseSha256Digest(value) {
+    const match = value.match(/^sha256:([0-9a-f]{64})$/i);
+    if (!match?.[1])
+        throw new Error(`Release asset has an invalid SHA-256 digest: ${value}`);
+    return match[1].toLowerCase();
+}
+export async function sha256File(file) {
+    const hash = crypto.createHash("sha256");
+    for await (const chunk of fs.createReadStream(file))
+        hash.update(chunk);
+    return hash.digest("hex");
+}
+export function selectReleaseAsset(assets, candidates) {
+    return candidates
+        .map((candidate) => assets.find((asset) => asset.name.toLowerCase() === candidate.toLowerCase()))
+        .find((asset) => asset !== undefined);
+}
+export async function downloadReleaseAsset(opts) {
+    const chosen = selectReleaseAsset(opts.assets, opts.candidates);
+    if (!chosen) {
+        throw new Error(`No trusted release asset matched ${opts.candidates.join(", ")} for ${opts.repo}@${opts.tag}`);
+    }
+    if (chosen.size > RELEASE_ASSET_SIZE_LIMIT) {
+        throw new Error(`Release asset ${chosen.name} exceeds the ${RELEASE_ASSET_SIZE_LIMIT} byte safety limit`);
+    }
+    const expectedDigest = parseSha256Digest(chosen.digest);
+    const directUrl = `https://github.com/${opts.repo}/releases/download/${opts.tag}/${chosen.name}`;
+    const urls = mirrorize(directUrl);
+    const deadlineMs = opts.deadlineMs ?? 15 * 60_000;
+    if (!Number.isSafeInteger(deadlineMs) || deadlineMs <= 0) {
+        throw new Error("Core asset deadlineMs must be a positive safe integer");
+    }
+    const deadlineAt = Date.now() + deadlineMs;
+    let lastError;
+    for (const url of urls) {
+        const remainingMs = deadlineAt - Date.now();
+        if (remainingMs <= 0) {
+            lastError = new Error(`Core asset download deadline exceeded after ${deadlineMs}ms`);
+            break;
+        }
+        try {
+            await downloadToFile(url, opts.dest, {
+                allowedHosts: GITHUB_DOWNLOAD_HOSTS,
+                maxBytes: RELEASE_ASSET_SIZE_LIMIT,
+                requireHttps: true,
+                onProgress: opts.onProgress,
+                stallMs: 60_000,
+                deadlineMs: remainingMs,
+            });
+            const actualDigest = await sha256File(opts.dest);
+            if (actualDigest !== expectedDigest) {
+                throw new Error(`SHA-256 mismatch for ${chosen.name}: expected ${expectedDigest}, got ${actualDigest}`);
+            }
+            return chosen.name;
+        }
+        catch (err) {
+            fs.rmSync(opts.dest, { force: true });
+            lastError = err;
+        }
+    }
+    throw new Error(`Failed to download and verify ${chosen.name} from all mirrors: ${lastError?.message ?? "unknown error"}`);
+}
+export { USER_AGENT };