@better-media/plugin-virus-scan 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 abenezeratnafu
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,34 @@
+# @better-media/plugin-virus-scan
+
+Virus scanning plugin for the Better Media framework.
+
+## Features
+
+- **ClamAV Integration**: Local or remote ClamAV server scanning.
+- **VirusTotal Integration**: API-based multi-engine scanning.
+- **Background Execution**: Scan in the background to avoid blocking ingest.
+- **Hook Integration**: Automatically blocks access to files containing malware.
+
+## Installation
+
+```bash
+pnpm add @better-media/plugin-virus-scan
+```
+
+## Usage
+
+```ts
+import { virusScanPlugin } from "@better-media/plugin-virus-scan";
+
+const media = createBetterMedia({
+  plugins: [
+    virusScanPlugin({
+      strategy: "clamav",
+      clamav: { host: "localhost", port: 3310 },
+      failureAction: "reject",
+    }),
+  ],
+});
+```
+
+See [better-media.dev/docs/plugins/virus-scan](https://better-media.dev/docs/plugins/virus-scan) for all strategies and options.

package/dist/index.d.mts

@@ -0,0 +1,166 @@
+import { PipelinePlugin } from '@better-media/core';
+
+/** Result of a single virus scan operation. */
+interface ScanResult {
+    /** Whether the file was found to be infected. */
+    infected: boolean;
+    /** Names of viruses detected (empty if clean). */
+    viruses: string[];
+    /** Raw output from the scanner engine, if available. */
+    raw?: unknown;
+}
+/** Persisted scan record written to the database adapter. */
+interface ScanRecord {
+    recordId: string;
+    fileKey: string;
+    infected: boolean;
+    viruses: string[];
+    scannedAt: string;
+    scannerName: string;
+    durationMs: number;
+}
+
+/** Abstract virus scanner contract. Implementations can wrap ClamAV, VirusTotal, etc. */
+interface VirusScanner {
+    /** Human-readable name of the scanner engine (e.g. "clamav"). */
+    readonly name: string;
+    /** One-time initialization (connect to daemon, load definitions, etc.). */
+    init(): Promise<void>;
+    /** Scan a file buffer in memory. */
+    scanBuffer(buffer: Buffer): Promise<ScanResult>;
+    /** Scan a file on disk by absolute path. */
+    scanFile(filePath: string): Promise<ScanResult>;
+}
+
+/** Failure handling modes (mirrors validation plugin). */
+type VirusScanFailureMode = "abort" | "continue" | "custom";
+/** Callback invoked when onFailure is "custom". */
+type VirusScanFailureCallback = (fileKey: string, viruses: string[]) => void | Promise<{
+    valid: boolean;
+    message?: string;
+} | void>;
+/**
+ * Configuration for the virus scan plugin.
+ * All fields are optional with sensible defaults.
+ */
+interface VirusScanPluginOptions {
+    /**
+     * Execution mode: "sync" runs inline, "background" enqueues via job adapter.
+     * Default: "background".
+     */
+    executionMode?: "sync" | "background";
+    /**
+     * Behavior when a virus is detected:
+     * - "abort": return a failed ValidationResult, stopping the pipeline.
+     * - "continue": record to DB, let the pipeline proceed.
+     * - "custom": invoke onFailureCallback.
+     * Default: "abort".
+     */
+    onFailure?: VirusScanFailureMode;
+    /** Called when onFailure is "custom". */
+    onFailureCallback?: VirusScanFailureCallback;
+    /**
+     * Injectable scanner implementation satisfying the VirusScanner interface.
+     * Defaults to the built-in ClamAV scanner if omitted.
+     */
+    scanner?: VirusScanner;
+    /** Timeout in milliseconds for a single scan operation. Default: 30_000. */
+    scanTimeoutMs?: number;
+    /**
+     * Retry configuration for transient scanner failures (e.g. daemon unavailable).
+     */
+    retryOptions?: {
+        /** Maximum number of attempts. Default: 3. */
+        maxAttempts?: number;
+        /** Base delay between retries in ms. Default: 1000. */
+        delayMs?: number;
+        /** Backoff strategy. Default: "exponential". */
+        backoff?: "linear" | "exponential";
+    };
+}
+
+/** ClamAV daemon connection options. */
+interface ClamScannerOptions {
+    /** Remove infected files after detection. Default: false. */
+    removeInfected?: boolean;
+    /** Quarantine path for infected files. */
+    quarantinePath?: string;
+    /** Log scan output to console. Default: false. */
+    debugMode?: boolean;
+    /** Path to clamscan binary. */
+    clamscanPath?: string;
+    /** Path to clamdscan binary. */
+    clamdscanPath?: string;
+    /** ClamAV daemon connection settings. */
+    clamdscan?: {
+        /** Use clamd for scanning. Default: true. */
+        active?: boolean;
+        /** Daemon host. Default: "127.0.0.1". */
+        host?: string;
+        /** Daemon port. Default: 3310. */
+        port?: number;
+        /** Socket path (overrides host/port). */
+        socket?: string;
+        /** Connection timeout in ms. Default: 5000. */
+        timeout?: number;
+    };
+}
+/**
+ * ClamAV implementation of the VirusScanner interface.
+ * Wraps the `clamscan` npm package.
+ */
+declare class ClamScanner implements VirusScanner {
+    readonly name = "clamav";
+    private instance;
+    private readonly options;
+    constructor(options?: ClamScannerOptions);
+    init(): Promise<void>;
+    scanBuffer(buffer: Buffer): Promise<ScanResult>;
+    scanFile(filePath: string): Promise<ScanResult>;
+    private getScanner;
+    private buildClamConfig;
+}
+
+interface VirusTotalScannerOptions {
+    /** VirusTotal API Key */
+    apiKey: string;
+    /** Max time to poll for analysis completion in ms. Default: 120,000 (2 minutes) */
+    pollingTimeoutMs?: number;
+    /** Polling interval in ms. Default: 5000 (5 seconds) */
+    pollingIntervalMs?: number;
+}
+/**
+ * VirusTotal API v3 implementation of the VirusScanner interface.
+ * Uses the native global `fetch` API available in Node 18+.
+ */
+declare class VirusTotalScanner implements VirusScanner {
+    readonly name = "virustotal";
+    private readonly options;
+    constructor(options: VirusTotalScannerOptions);
+    init(): Promise<void>;
+    scanBuffer(buffer: Buffer): Promise<ScanResult>;
+    scanFile(filePath: string): Promise<ScanResult>;
+    private uploadAndAnalyze;
+    private pollAnalysis;
+}
+
+/**
+ * Virus scan plugin for the Better Media pipeline.
+ *
+ * Scans uploaded files for malware using a configurable scanner engine.
+ * Defaults to ClamAV via the built-in ClamScanner.
+ *
+ * @example
+ * ```ts
+ * import { virusScanPlugin } from "@better-media/plugin-virus-scan";
+ *
+ * // With defaults (ClamAV daemon on localhost:3310)
+ * const plugin = virusScanPlugin();
+ *
+ * // With custom scanner
+ * const plugin = virusScanPlugin({ scanner: myCustomScanner });
+ * ```
+ */
+declare function virusScanPlugin(opts?: VirusScanPluginOptions): PipelinePlugin;
+
+export { ClamScanner, type ClamScannerOptions, type ScanRecord, type ScanResult, type VirusScanPluginOptions, type VirusScanner, VirusTotalScanner, type VirusTotalScannerOptions, virusScanPlugin };

package/dist/index.d.ts

@@ -0,0 +1,166 @@
+import { PipelinePlugin } from '@better-media/core';
+
+/** Result of a single virus scan operation. */
+interface ScanResult {
+    /** Whether the file was found to be infected. */
+    infected: boolean;
+    /** Names of viruses detected (empty if clean). */
+    viruses: string[];
+    /** Raw output from the scanner engine, if available. */
+    raw?: unknown;
+}
+/** Persisted scan record written to the database adapter. */
+interface ScanRecord {
+    recordId: string;
+    fileKey: string;
+    infected: boolean;
+    viruses: string[];
+    scannedAt: string;
+    scannerName: string;
+    durationMs: number;
+}
+
+/** Abstract virus scanner contract. Implementations can wrap ClamAV, VirusTotal, etc. */
+interface VirusScanner {
+    /** Human-readable name of the scanner engine (e.g. "clamav"). */
+    readonly name: string;
+    /** One-time initialization (connect to daemon, load definitions, etc.). */
+    init(): Promise<void>;
+    /** Scan a file buffer in memory. */
+    scanBuffer(buffer: Buffer): Promise<ScanResult>;
+    /** Scan a file on disk by absolute path. */
+    scanFile(filePath: string): Promise<ScanResult>;
+}
+
+/** Failure handling modes (mirrors validation plugin). */
+type VirusScanFailureMode = "abort" | "continue" | "custom";
+/** Callback invoked when onFailure is "custom". */
+type VirusScanFailureCallback = (fileKey: string, viruses: string[]) => void | Promise<{
+    valid: boolean;
+    message?: string;
+} | void>;
+/**
+ * Configuration for the virus scan plugin.
+ * All fields are optional with sensible defaults.
+ */
+interface VirusScanPluginOptions {
+    /**
+     * Execution mode: "sync" runs inline, "background" enqueues via job adapter.
+     * Default: "background".
+     */
+    executionMode?: "sync" | "background";
+    /**
+     * Behavior when a virus is detected:
+     * - "abort": return a failed ValidationResult, stopping the pipeline.
+     * - "continue": record to DB, let the pipeline proceed.
+     * - "custom": invoke onFailureCallback.
+     * Default: "abort".
+     */
+    onFailure?: VirusScanFailureMode;
+    /** Called when onFailure is "custom". */
+    onFailureCallback?: VirusScanFailureCallback;
+    /**
+     * Injectable scanner implementation satisfying the VirusScanner interface.
+     * Defaults to the built-in ClamAV scanner if omitted.
+     */
+    scanner?: VirusScanner;
+    /** Timeout in milliseconds for a single scan operation. Default: 30_000. */
+    scanTimeoutMs?: number;
+    /**
+     * Retry configuration for transient scanner failures (e.g. daemon unavailable).
+     */
+    retryOptions?: {
+        /** Maximum number of attempts. Default: 3. */
+        maxAttempts?: number;
+        /** Base delay between retries in ms. Default: 1000. */
+        delayMs?: number;
+        /** Backoff strategy. Default: "exponential". */
+        backoff?: "linear" | "exponential";
+    };
+}
+
+/** ClamAV daemon connection options. */
+interface ClamScannerOptions {
+    /** Remove infected files after detection. Default: false. */
+    removeInfected?: boolean;
+    /** Quarantine path for infected files. */
+    quarantinePath?: string;
+    /** Log scan output to console. Default: false. */
+    debugMode?: boolean;
+    /** Path to clamscan binary. */
+    clamscanPath?: string;
+    /** Path to clamdscan binary. */
+    clamdscanPath?: string;
+    /** ClamAV daemon connection settings. */
+    clamdscan?: {
+        /** Use clamd for scanning. Default: true. */
+        active?: boolean;
+        /** Daemon host. Default: "127.0.0.1". */
+        host?: string;
+        /** Daemon port. Default: 3310. */
+        port?: number;
+        /** Socket path (overrides host/port). */
+        socket?: string;
+        /** Connection timeout in ms. Default: 5000. */
+        timeout?: number;
+    };
+}
+/**
+ * ClamAV implementation of the VirusScanner interface.
+ * Wraps the `clamscan` npm package.
+ */
+declare class ClamScanner implements VirusScanner {
+    readonly name = "clamav";
+    private instance;
+    private readonly options;
+    constructor(options?: ClamScannerOptions);
+    init(): Promise<void>;
+    scanBuffer(buffer: Buffer): Promise<ScanResult>;
+    scanFile(filePath: string): Promise<ScanResult>;
+    private getScanner;
+    private buildClamConfig;
+}
+
+interface VirusTotalScannerOptions {
+    /** VirusTotal API Key */
+    apiKey: string;
+    /** Max time to poll for analysis completion in ms. Default: 120,000 (2 minutes) */
+    pollingTimeoutMs?: number;
+    /** Polling interval in ms. Default: 5000 (5 seconds) */
+    pollingIntervalMs?: number;
+}
+/**
+ * VirusTotal API v3 implementation of the VirusScanner interface.
+ * Uses the native global `fetch` API available in Node 18+.
+ */
+declare class VirusTotalScanner implements VirusScanner {
+    readonly name = "virustotal";
+    private readonly options;
+    constructor(options: VirusTotalScannerOptions);
+    init(): Promise<void>;
+    scanBuffer(buffer: Buffer): Promise<ScanResult>;
+    scanFile(filePath: string): Promise<ScanResult>;
+    private uploadAndAnalyze;
+    private pollAnalysis;
+}
+
+/**
+ * Virus scan plugin for the Better Media pipeline.
+ *
+ * Scans uploaded files for malware using a configurable scanner engine.
+ * Defaults to ClamAV via the built-in ClamScanner.
+ *
+ * @example
+ * ```ts
+ * import { virusScanPlugin } from "@better-media/plugin-virus-scan";
+ *
+ * // With defaults (ClamAV daemon on localhost:3310)
+ * const plugin = virusScanPlugin();
+ *
+ * // With custom scanner
+ * const plugin = virusScanPlugin({ scanner: myCustomScanner });
+ * ```
+ */
+declare function virusScanPlugin(opts?: VirusScanPluginOptions): PipelinePlugin;
+
+export { ClamScanner, type ClamScannerOptions, type ScanRecord, type ScanResult, type VirusScanPluginOptions, type VirusScanner, VirusTotalScanner, type VirusTotalScannerOptions, virusScanPlugin };

package/dist/index.js

@@ -0,0 +1,315 @@
+'use strict';
+
+var stream = require('stream');
+var crypto = require('crypto');
+var fs = require('fs/promises');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var fs__default = /*#__PURE__*/_interopDefault(fs);
+
+// src/scanners/clam.scanner.ts
+var ClamScanner = class {
+  name = "clamav";
+  instance = null;
+  options;
+  constructor(options = {}) {
+    this.options = options;
+  }
+  async init() {
+    if (this.instance) return;
+    const NodeClam = (await import('clamscan')).default;
+    this.instance = await new NodeClam().init(this.buildClamConfig());
+  }
+  async scanBuffer(buffer) {
+    const scanner = await this.getScanner();
+    const stream$1 = stream.Readable.from(buffer);
+    const result = await scanner.scanStream(stream$1);
+    return {
+      infected: result.isInfected === true,
+      viruses: result.viruses ?? []
+    };
+  }
+  async scanFile(filePath) {
+    const scanner = await this.getScanner();
+    const result = await scanner.isInfected(filePath);
+    return {
+      infected: result.isInfected === true,
+      viruses: result.viruses ?? []
+    };
+  }
+  async getScanner() {
+    if (!this.instance) await this.init();
+    return this.instance;
+  }
+  buildClamConfig() {
+    return {
+      removeInfected: this.options.removeInfected ?? false,
+      quarantineInfected: this.options.quarantinePath ?? false,
+      debugMode: this.options.debugMode ?? false,
+      clamscan: {
+        path: this.options.clamscanPath ?? "/usr/bin/clamscan"
+      },
+      clamdscan: {
+        path: this.options.clamdscanPath ?? "/usr/bin/clamdscan",
+        active: this.options.clamdscan?.active ?? true,
+        host: this.options.clamdscan?.host ?? "127.0.0.1",
+        port: this.options.clamdscan?.port ?? 3310,
+        socket: this.options.clamdscan?.socket ?? null,
+        timeout: this.options.clamdscan?.timeout ?? 5e3
+      }
+    };
+  }
+};
+async function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function withTimeout(promise, ms, label) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error(`${label} timed out after ${ms}ms`)), ms);
+    promise.then(
+      (val) => {
+        clearTimeout(timer);
+        resolve(val);
+      },
+      (err) => {
+        clearTimeout(timer);
+        reject(err);
+      }
+    );
+  });
+}
+async function recordScanResult(database, record) {
+  const model = "media_virus_scan_results";
+  const status = record.infected ? "infected" : "clean";
+  const data = {
+    mediaId: record.recordId,
+    status,
+    threats: record.viruses,
+    scanner: record.scannerName,
+    createdAt: record.scannedAt
+  };
+  const existing = await database.findOne({
+    model,
+    where: [{ field: "mediaId", value: record.recordId }]
+  });
+  if (existing) {
+    await database.update({
+      model,
+      where: [{ field: "id", value: existing.id }],
+      update: data
+    });
+  } else {
+    await database.create({
+      model,
+      data: { id: crypto.randomUUID(), ...data }
+    });
+  }
+}
+async function scanWithRetry(scanner, buffer, tempPath, opts) {
+  const maxAttempts = opts.retryOptions?.maxAttempts ?? 3;
+  const delayMs = opts.retryOptions?.delayMs ?? 1e3;
+  const backoff = opts.retryOptions?.backoff ?? "exponential";
+  const timeoutMs = opts.scanTimeoutMs ?? 3e4;
+  let lastError;
+  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+    try {
+      const scanPromise = tempPath ? scanner.scanFile(tempPath) : scanner.scanBuffer(buffer);
+      const result = await withTimeout(scanPromise, timeoutMs, "Virus scan");
+      return { infected: result.infected, viruses: result.viruses };
+    } catch (err) {
+      lastError = err instanceof Error ? err : new Error(String(err));
+      if (attempt < maxAttempts) {
+        const wait = backoff === "exponential" ? delayMs * Math.pow(2, attempt - 1) : delayMs * attempt;
+        await sleep(wait);
+      }
+    }
+  }
+  throw lastError ?? new Error("Virus scan failed after retries");
+}
+async function runVirusScan(context, api, scanner, opts) {
+  const { file, database } = context;
+  const fileKey = file.key;
+  const fileContent = context.utilities?.fileContent;
+  if (!fileContent || !fileContent.buffer && !fileContent.tempPath) {
+    throw new Error(
+      "Virus scan plugin requires fileContent (buffer or tempPath) to be available in context.utilities"
+    );
+  }
+  const tempPath = fileContent.tempPath;
+  const buffer = tempPath ? void 0 : fileContent.buffer ?? null;
+  if (!buffer && !tempPath) {
+    throw new Error("Unable to resolve file content for virus scanning");
+  }
+  let infected;
+  let viruses;
+  try {
+    const result = await scanWithRetry(
+      scanner,
+      buffer ?? Buffer.alloc(0),
+      // scanWithRetry will use tempPath if available
+      tempPath,
+      opts
+    );
+    infected = result.infected;
+    viruses = result.viruses;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { valid: false, message: `Virus scan failed: ${message}` };
+  }
+  const scannedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const record = {
+    recordId: context.recordId,
+    infected,
+    viruses,
+    scannedAt,
+    scannerName: scanner.name};
+  await recordScanResult(database, record);
+  api.emitMetadata({ infected, viruses, scannedAt });
+  if (!infected) return;
+  const failureMessage = `Virus detected in "${fileKey}": ${viruses.join(", ")}`;
+  switch (opts.onFailure ?? "abort") {
+    case "continue":
+      return;
+    case "custom":
+      if (opts.onFailureCallback) {
+        const customResult = await opts.onFailureCallback(fileKey, viruses);
+        if (customResult && customResult.valid === false) return customResult;
+      }
+      return;
+    case "abort":
+    default:
+      return { valid: false, message: failureMessage };
+  }
+}
+var VirusTotalScanner = class {
+  name = "virustotal";
+  options;
+  constructor(options) {
+    if (!options.apiKey) {
+      throw new Error("VirusTotalScanner requires an apiKey");
+    }
+    this.options = {
+      pollingTimeoutMs: 12e4,
+      pollingIntervalMs: 5e3,
+      ...options
+    };
+  }
+  async init() {
+  }
+  async scanBuffer(buffer) {
+    const blob = new Blob([new Uint8Array(buffer)]);
+    return this.uploadAndAnalyze(blob, "upload.bin");
+  }
+  async scanFile(filePath) {
+    const buffer = await fs__default.default.readFile(filePath);
+    const blob = new Blob([new Uint8Array(buffer)]);
+    const filename = filePath.split("/").pop() || "upload.bin";
+    return this.uploadAndAnalyze(blob, filename);
+  }
+  async uploadAndAnalyze(blob, filename) {
+    const size = blob.size;
+    let uploadUrl = "https://www.virustotal.com/api/v3/files";
+    if (size > 32 * 1024 * 1024) {
+      const urlRes = await fetch("https://www.virustotal.com/api/v3/files/upload_url", {
+        headers: { "x-apikey": this.options.apiKey }
+      });
+      if (!urlRes.ok) {
+        throw new Error(`VirusTotal failed to get upload URL: ${urlRes.statusText}`);
+      }
+      const urlData = await urlRes.json();
+      uploadUrl = urlData.data;
+    }
+    const formData = new FormData();
+    formData.append("file", blob, filename);
+    const uploadRes = await fetch(uploadUrl, {
+      method: "POST",
+      headers: { "x-apikey": this.options.apiKey },
+      body: formData
+    });
+    if (!uploadRes.ok) {
+      const errText = await uploadRes.text().catch(() => "");
+      throw new Error(`VirusTotal upload failed: ${uploadRes.status} ${errText}`);
+    }
+    const uploadData = await uploadRes.json();
+    const analysisId = uploadData.data.id;
+    return this.pollAnalysis(analysisId);
+  }
+  async pollAnalysis(analysisId) {
+    const startTime = Date.now();
+    const timeout = this.options.pollingTimeoutMs;
+    const interval = this.options.pollingIntervalMs;
+    while (Date.now() - startTime < timeout) {
+      const res = await fetch(`https://www.virustotal.com/api/v3/analyses/${analysisId}`, {
+        headers: { "x-apikey": this.options.apiKey }
+      });
+      if (!res.ok) {
+        throw new Error(`VirusTotal polling failed: ${res.statusText}`);
+      }
+      const data = await res.json();
+      const status = data.data.attributes.status;
+      if (status === "completed") {
+        const stats = data.data.attributes.stats;
+        let infected = false;
+        const viruses = [];
+        if (stats.malicious > 0 || stats.suspicious > 0) {
+          infected = true;
+          const results = data.data.attributes.results;
+          for (const [engine, info] of Object.entries(
+            results
+          )) {
+            if (info.category === "malicious" || info.category === "suspicious") {
+              viruses.push(`${engine}:${info.result}`);
+            }
+          }
+        }
+        return {
+          infected,
+          viruses,
+          raw: data.data
+        };
+      }
+      await new Promise((resolve) => setTimeout(resolve, interval));
+    }
+    throw new Error(`VirusTotal scan timed out waiting for analysis ${analysisId} to complete`);
+  }
+};
+
+// src/index.ts
+function virusScanPlugin(opts = {}) {
+  const executionMode = opts.executionMode ?? "background";
+  const isBackground = executionMode === "background";
+  const scanner = opts.scanner ?? new ClamScanner();
+  return {
+    name: "virus-scan",
+    runtimeManifest: {
+      id: "better-media-virus-scan",
+      version: "1.0.0",
+      trustLevel: "untrusted",
+      capabilities: ["file.read", "metadata.write.own", "processing.write.own"],
+      namespace: "antivirus"
+    },
+    executionMode,
+    intensive: isBackground,
+    apply(runtime) {
+      let initPromise = null;
+      runtime.hooks["scan:run"].tap(
+        "virus-scan",
+        async (context, api) => {
+          if (!initPromise) {
+            initPromise = scanner.init();
+          }
+          await initPromise;
+          return runVirusScan(context, api, scanner, opts);
+        },
+        { mode: executionMode }
+      );
+    }
+  };
+}
+
+exports.ClamScanner = ClamScanner;
+exports.VirusTotalScanner = VirusTotalScanner;
+exports.virusScanPlugin = virusScanPlugin;
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/scanners/clam.scanner.ts","../src/runtime/runner.ts","../src/scanners/virustotal.scanner.ts","../src/index.ts"],"names":["stream","Readable","randomUUID","fs"],"mappings":";;;;;;;;;;;AAkDO,IAAM,cAAN,MAA0C;AAAA,EACtC,IAAA,GAAO,QAAA;AAAA,EACR,QAAA,GAAoC,IAAA;AAAA,EAC3B,OAAA;AAAA,EAEjB,WAAA,CAAY,OAAA,GAA8B,EAAC,EAAG;AAC5C,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AAAA,EAEA,MAAM,IAAA,GAAsB;AAC1B,IAAA,IAAI,KAAK,QAAA,EAAU;AAGnB,IAAA,MAAM,QAAA,GAAA,CAAY,MAAM,OAAO,UAAU,CAAA,EAAG,OAAA;AAC5C,IAAA,IAAA,CAAK,QAAA,GAAW,MAAM,IAAI,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,iBAAiB,CAAA;AAAA,EAClE;AAAA,EAEA,MAAM,WAAW,MAAA,EAAqC;AACpD,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,UAAA,EAAW;AACtC,IAAA,MAAMA,QAAA,GAASC,eAAA,CAAS,IAAA,CAAK,MAAM,CAAA;AACnC,IAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,UAAA,CAAWD,QAAM,CAAA;AAE9C,IAAA,OAAO;AAAA,MACL,QAAA,EAAU,OAAO,UAAA,KAAe,IAAA;AAAA,MAChC,OAAA,EAAS,MAAA,CAAO,OAAA,IAAW;AAAC,KAC9B;AAAA,EACF;AAAA,EAEA,MAAM,SAAS,QAAA,EAAuC;AACpD,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,UAAA,EAAW;AACtC,IAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,UAAA,CAAW,QAAQ,CAAA;AAEhD,IAAA,OAAO;AAAA,MACL,QAAA,EAAU,OAAO,UAAA,KAAe,IAAA;AAAA,MAChC,OAAA,EAAS,MAAA,CAAO,OAAA,IAAW;AAAC,KAC9B;AAAA,EACF;AAAA,EAEA,MAAc,UAAA,GAAwC;AACpD,IAAA,IAAI,CAAC,IAAA,CAAK,QAAA,EAAU,MAAM,KAAK,IAAA,EAAK;AACpC,IAAA,OAAO,IAAA,CAAK,QAAA;AAAA,EACd;AAAA,EAEQ,eAAA,GAA2C;AACjD,IAAA,OAAO;AAAA,MACL,cAAA,EAAgB,IAAA,CAAK,OAAA,CAAQ,cAAA,IAAkB,KAAA;AAAA,MAC/C,kBAAA,EAAoB,IAAA,CAAK,OAAA,CAAQ,cAAA,IAAkB,KAAA;AAAA,MACnD,SAAA,EAAW,IAAA,CAAK,OAAA,CAAQ,SAAA,IAAa,KAAA;AAAA,MACrC,QAAA,EAAU;AAAA,QACR,IAAA,EAAM,IAAA,CAAK,OAAA,CAAQ,YAAA,IAAgB;AAAA,OACrC;AAAA,MACA,SAAA,EAAW;AAAA,QACT,IAAA,EAAM,IAAA,CAAK,OAAA,CAAQ,aAAA,IAAiB,oBAAA;AAAA,QACpC,MAAA,EAAQ,IAAA,CAAK,OAAA,CAAQ,SAAA,EAAW,MAAA,IAAU,IAAA;AAAA,QAC1C,IAAA,EAAM,IAAA,CAAK,OAAA,CAAQ,SAAA,EAAW,IAAA,IAAQ,WAAA;AAAA,QACtC,IAAA,EAAM,IAAA,CAAK,OAAA,CAAQ,SAAA,EAAW,IAAA,IAAQ,IAAA;AAAA,QACtC,MAAA,EAAQ,IAAA,CAAK,OAAA,CAAQ,SAAA,EAAW,MAAA,IAAU,IAAA;AAAA,QAC1C,OAAA,EAAS,IAAA,CAAK,OAAA,CAAQ,SAAA,EAAW,OAAA,IAAW;AAAA;AAC9C,KACF;AAAA,EACF;AACF;ACpGA,eAAe,MAAM,EAAA,EAA2B;AAC9C,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AACzD;AAKA,SAAS,WAAA,CAAe,OAAA,EAAqB,EAAA,EAAY,KAAA,EAA2B;AAClF,EAAA,OAAO,IAAI,OAAA,CAAW,CAAC,OAAA,EAAS,MAAA,KAAW;AACzC,IAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,MAAM,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA,iBAAA,EAAoB,EAAE,CAAA,EAAA,CAAI,CAAC,GAAG,EAAE,CAAA;AACxF,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,CAAC,GAAA,KAAQ;AACP,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,OAAA,CAAQ,GAAG,CAAA;AAAA,MACb,CAAA;AAAA,MACA,CAAC,GAAA,KAAQ;AACP,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,MAAA,CAAO,GAAG,CAAA;AAAA,MACZ;AAAA,KACF;AAAA,EACF,CAAC,CAAA;AACH;AAEA,eAAe,gBAAA,CAAiB,UAA2B,MAAA,EAAmC;AAC5F,EAAA,MAAM,KAAA,GAAQ,0BAAA;AACd,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,QAAA,GAAW,UAAA,GAAa,OAAA;AAE9C,EAAA,MAAM,IAAA,GAAO;AAAA,IACX,SAAS,MAAA,CAAO,QAAA;AAAA,IAChB,MAAA;AAAA,IACA,SAAS,MAAA,CAAO,OAAA;AAAA,IAChB,SAAS,MAAA,CAAO,WAAA;AAAA,IAChB,WAAW,MAAA,CAAO;AAAA,GACpB;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,QAAA,CAAS,OAAA,CAAQ;AAAA,IACtC,KAAA;AAAA,IACA,KAAA,EAAO,CAAC,EAAE,KAAA,EAAO,WAAW,KAAA,EAAO,MAAA,CAAO,UAAU;AAAA,GACrD,CAAA;AAED,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,MAAM,SAAS,MAAA,CAAO;AAAA,MACpB,KAAA;AAAA,MACA,KAAA,EAAO,CAAC,EAAE,KAAA,EAAO,MAAM,KAAA,EAAO,QAAA,CAAS,IAAI,CAAA;AAAA,MAC3C,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH,CAAA,MAAO;AACL,IAAA,MAAM,SAAS,MAAA,CAAO;AAAA,MACpB,KAAA;AAAA,MACA,MAAM,EAAE,EAAA,EAAIE,iBAAA,EAAW,EAAG,GAAG,IAAA;AAAK,KACnC,CAAA;AAAA,EACH;AACF;AAKA,eAAe,aAAA,CACb,OAAA,EACA,MAAA,EACA,QAAA,EACA,IAAA,EACmD;AACnD,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,YAAA,EAAc,WAAA,IAAe,CAAA;AACtD,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,YAAA,EAAc,OAAA,IAAW,GAAA;AAC9C,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,YAAA,EAAc,OAAA,IAAW,aAAA;AAC9C,EAAA,MAAM,SAAA,GAAY,KAAK,aAAA,IAAiB,GAAA;AAExC,EAAA,IAAI,SAAA;AAEJ,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,WAAA,EAAa,OAAA,EAAA,EAAW;AACvD,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,GAAc,WAAW,OAAA,CAAQ,QAAA,CAAS,QAAQ,CAAA,GAAI,OAAA,CAAQ,WAAW,MAAM,CAAA;AAErF,MAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,WAAA,EAAa,WAAW,YAAY,CAAA;AACrE,MAAA,OAAO,EAAE,QAAA,EAAU,MAAA,CAAO,QAAA,EAAU,OAAA,EAAS,OAAO,OAAA,EAAQ;AAAA,IAC9D,SAAS,GAAA,EAAc;AACrB,MAAA,SAAA,GAAY,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAC9D,MAAA,IAAI,UAAU,WAAA,EAAa;AACzB,QAAA,MAAM,IAAA,GACJ,OAAA,KAAY,aAAA,GAAgB,OAAA,GAAU,IAAA,CAAK,IAAI,CAAA,EAAG,OAAA,GAAU,CAAC,CAAA,GAAI,OAAA,GAAU,OAAA;AAC7E,QAAA,MAAM,MAAM,IAAI,CAAA;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,IAAa,IAAI,KAAA,CAAM,iCAAiC,CAAA;AAChE;AAKA,eAAsB,YAAA,CACpB,OAAA,EACA,GAAA,EACA,OAAA,EACA,IAAA,EACkC;AAClC,EAAA,MAAM,EAAE,IAAA,EAAM,QAAA,EAAS,GAAI,OAAA;AAC3B,EAAA,MAAM,UAAU,IAAA,CAAK,GAAA;AACrB,EAAA,MAAM,WAAA,GAAc,QAAQ,SAAA,EAAW,WAAA;AAEvC,EAAA,IAAI,CAAC,WAAA,IAAgB,CAAC,YAAY,MAAA,IAAU,CAAC,YAAY,QAAA,EAAW;AAClE,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAGA,EAAA,MAAM,WAAW,WAAA,CAAY,QAAA;AAC7B,EAAA,MAAM,MAAA,GAAS,QAAA,GAAW,MAAA,GAAa,WAAA,CAAY,MAAA,IAAU,IAAA;AAE7D,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,QAAA,EAAU;AACxB,IAAA,MAAM,IAAI,MAAM,mDAAmD,CAAA;AAAA,EACrE;AAGA,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI,OAAA;AAEJ,EAAA,IAAI;AACF,IAAA,MAAM,SAAS,MAAM,aAAA;AAAA,MACnB,OAAA;AAAA,MACA,MAAA,IAAU,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAAA;AAAA,MACxB,QAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,QAAA,GAAW,MAAA,CAAO,QAAA;AAClB,IAAA,OAAA,GAAU,MAAA,CAAO,OAAA;AAAA,EACnB,SAAS,GAAA,EAAc;AACrB,IAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAE/D,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,OAAA,EAAS,CAAA,mBAAA,EAAsB,OAAO,CAAA,CAAA,EAAG;AAAA,EAClE;AAIA,EAAA,MAAM,SAAA,GAAA,iBAAY,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAGzC,EAAA,MAAM,MAAA,GAAqB;AAAA,IACzB,UAAU,OAAA,CAAQ,QAAA;AAAA,IAElB,QAAA;AAAA,IACA,OAAA;AAAA,IACA,SAAA;AAAA,IACA,aAAa,OAAA,CAAQ,IAEvB,CAAA;AACA,EAAA,MAAM,gBAAA,CAAiB,UAAU,MAAM,CAAA;AAGvC,EAAA,GAAA,CAAI,YAAA,CAAa,EAAE,QAAA,EAAU,OAAA,EAAS,WAAW,CAAA;AAEjD,EAAA,IAAI,CAAC,QAAA,EAAU;AAGf,EAAA,MAAM,iBAAiB,CAAA,mBAAA,EAAsB,OAAO,MAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAE5E,EAAA,QAAQ,IAAA,CAAK,aAAa,OAAA;AAAS,IACjC,KAAK,UAAA;AACH,MAAA;AAAA,IACF,KAAK,QAAA;AACH,MAAA,IAAI,KAAK,iBAAA,EAAmB;AAC1B,QAAA,MAAM,YAAA,GAAe,MAAM,IAAA,CAAK,iBAAA,CAAkB,SAAS,OAAO,CAAA;AAClE,QAAA,IAAI,YAAA,IAAgB,YAAA,CAAa,KAAA,KAAU,KAAA,EAAO,OAAO,YAAA;AAAA,MAC3D;AACA,MAAA;AAAA,IACF,KAAK,OAAA;AAAA,IACL;AACE,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,OAAA,EAAS,cAAA,EAAe;AAAA;AAErD;ACtKO,IAAM,oBAAN,MAAgD;AAAA,EAC5C,IAAA,GAAO,YAAA;AAAA,EACC,OAAA;AAAA,EAEjB,YAAY,OAAA,EAAmC;AAC7C,IAAA,IAAI,CAAC,QAAQ,MAAA,EAAQ;AACnB,MAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,IACxD;AACA,IAAA,IAAA,CAAK,OAAA,GAAU;AAAA,MACb,gBAAA,EAAkB,IAAA;AAAA,MAClB,iBAAA,EAAmB,GAAA;AAAA,MACnB,GAAG;AAAA,KACL;AAAA,EACF;AAAA,EAEA,MAAM,IAAA,GAAsB;AAAA,EAE5B;AAAA,EAEA,MAAM,WAAW,MAAA,EAAqC;AACpD,IAAA,MAAM,IAAA,GAAO,IAAI,IAAA,CAAK,CAAC,IAAI,UAAA,CAAW,MAAM,CAAC,CAAC,CAAA;AAC9C,IAAA,OAAO,IAAA,CAAK,gBAAA,CAAiB,IAAA,EAAM,YAAY,CAAA;AAAA,EACjD;AAAA,EAEA,MAAM,SAAS,QAAA,EAAuC;AACpD,IAAA,MAAM,MAAA,GAAS,MAAMC,mBAAA,CAAG,QAAA,CAAS,QAAQ,CAAA;AACzC,IAAA,MAAM,IAAA,GAAO,IAAI,IAAA,CAAK,CAAC,IAAI,UAAA,CAAW,MAAM,CAAC,CAAC,CAAA;AAC9C,IAAA,MAAM,WAAW,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA,CAAE,KAAI,IAAK,YAAA;AAC9C,IAAA,OAAO,IAAA,CAAK,gBAAA,CAAiB,IAAA,EAAM,QAAQ,CAAA;AAAA,EAC7C;AAAA,EAEA,MAAc,gBAAA,CAAiB,IAAA,EAAY,QAAA,EAAuC;AAChF,IAAA,MAAM,OAAO,IAAA,CAAK,IAAA;AAClB,IAAA,IAAI,SAAA,GAAY,yCAAA;AAGhB,IAAA,IAAI,IAAA,GAAO,EAAA,GAAK,IAAA,GAAO,IAAA,EAAM;AAC3B,MAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,oDAAA,EAAsD;AAAA,QAC/E,OAAA,EAAS,EAAE,UAAA,EAAY,IAAA,CAAK,QAAQ,MAAA;AAAO,OAC5C,CAAA;AACD,MAAA,IAAI,CAAC,OAAO,EAAA,EAAI;AACd,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qCAAA,EAAwC,MAAA,CAAO,UAAU,CAAA,CAAE,CAAA;AAAA,MAC7E;AACA,MAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,IAAA,EAAK;AAClC,MAAA,SAAA,GAAY,OAAA,CAAQ,IAAA;AAAA,IACtB;AAEA,IAAA,MAAM,QAAA,GAAW,IAAI,QAAA,EAAS;AAC9B,IAAA,QAAA,CAAS,MAAA,CAAO,MAAA,EAAQ,IAAA,EAAM,QAAQ,CAAA;AAEtC,IAAA,MAAM,SAAA,GAAY,MAAM,KAAA,CAAM,SAAA,EAAW;AAAA,MACvC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,UAAA,EAAY,IAAA,CAAK,QAAQ,MAAA,EAAO;AAAA,MAC3C,IAAA,EAAM;AAAA,KACP,CAAA;AAED,IAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,MAAA,MAAM,UAAU,MAAM,SAAA,CAAU,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AACrD,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,UAAU,MAAM,CAAA,CAAA,EAAI,OAAO,CAAA,CAAE,CAAA;AAAA,IAC5E;AAEA,IAAA,MAAM,UAAA,GAAa,MAAM,SAAA,CAAU,IAAA,EAAK;AACxC,IAAA,MAAM,UAAA,GAAa,WAAW,IAAA,CAAK,EAAA;AAEnC,IAAA,OAAO,IAAA,CAAK,aAAa,UAAU,CAAA;AAAA,EACrC;AAAA,EAEA,MAAc,aAAa,UAAA,EAAyC;AAClE,IAAA,MAAM,SAAA,GAAY,KAAK,GAAA,EAAI;AAC3B,IAAA,MAAM,OAAA,GAAU,KAAK,OAAA,CAAQ,gBAAA;AAC7B,IAAA,MAAM,QAAA,GAAW,KAAK,OAAA,CAAQ,iBAAA;AAE9B,IAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,OAAA,EAAS;AACvC,MAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,CAAA,2CAAA,EAA8C,UAAU,CAAA,CAAA,EAAI;AAAA,QAClF,OAAA,EAAS,EAAE,UAAA,EAAY,IAAA,CAAK,QAAQ,MAAA;AAAO,OAC5C,CAAA;AAED,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,MAChE;AAEA,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,CAAK,UAAA,CAAW,MAAA;AAEpC,MAAA,IAAI,WAAW,WAAA,EAAa;AAC1B,QAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,UAAA,CAAW,KAAA;AACnC,QAAA,IAAI,QAAA,GAAW,KAAA;AACf,QAAA,MAAM,UAAoB,EAAC;AAE3B,QAAA,IAAI,KAAA,CAAM,SAAA,GAAY,CAAA,IAAK,KAAA,CAAM,aAAa,CAAA,EAAG;AAC/C,UAAA,QAAA,GAAW,IAAA;AACX,UAAA,MAAM,OAAA,GAAU,IAAA,CAAK,IAAA,CAAK,UAAA,CAAW,OAAA;AACrC,UAAA,KAAA,MAAW,CAAC,MAAA,EAAQ,IAAI,CAAA,IAAK,MAAA,CAAO,OAAA;AAAA,YAClC;AAAA,WACF,EAAG;AACD,YAAA,IAAI,IAAA,CAAK,QAAA,KAAa,WAAA,IAAe,IAAA,CAAK,aAAa,YAAA,EAAc;AACnE,cAAA,OAAA,CAAQ,KAAK,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAAA,YACzC;AAAA,UACF;AAAA,QACF;AAEA,QAAA,OAAO;AAAA,UACL,QAAA;AAAA,UACA,OAAA;AAAA,UACA,KAAK,IAAA,CAAK;AAAA,SACZ;AAAA,MACF;AAGA,MAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,QAAQ,CAAC,CAAA;AAAA,IAC9D;AAEA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,+CAAA,EAAkD,UAAU,CAAA,YAAA,CAAc,CAAA;AAAA,EAC5F;AACF;;;ACrGO,SAAS,eAAA,CAAgB,IAAA,GAA+B,EAAC,EAAmB;AACjF,EAAA,MAAM,aAAA,GAAgB,KAAK,aAAA,IAAiB,YAAA;AAC5C,EAAA,MAAM,eAAe,aAAA,KAAkB,YAAA;AACvC,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,IAAW,IAAI,WAAA,EAAY;AAEhD,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,YAAA;AAAA,IACN,eAAA,EAAiB;AAAA,MACf,EAAA,EAAI,yBAAA;AAAA,MACJ,OAAA,EAAS,OAAA;AAAA,MACT,UAAA,EAAY,WAAA;AAAA,MACZ,YAAA,EAAc,CAAC,WAAA,EAAa,oBAAA,EAAsB,sBAAsB,CAAA;AAAA,MACxE,SAAA,EAAW;AAAA,KACb;AAAA,IACA,aAAA;AAAA,IACA,SAAA,EAAW,YAAA;AAAA,IAEX,MAAM,OAAA,EAAuB;AAE3B,MAAA,IAAI,WAAA,GAAoC,IAAA;AAExC,MAAA,OAAA,CAAQ,KAAA,CAAM,UAAU,CAAA,CAAE,GAAA;AAAA,QACxB,YAAA;AAAA,QACA,OAAO,SAA0B,GAAA,KAAmB;AAElD,UAAA,IAAI,CAAC,WAAA,EAAa;AAChB,YAAA,WAAA,GAAc,QAAQ,IAAA,EAAK;AAAA,UAC7B;AACA,UAAA,MAAM,WAAA;AAEN,UAAA,OAAO,YAAA,CAAa,OAAA,EAAS,GAAA,EAAK,OAAA,EAAS,IAAI,CAAA;AAAA,QACjD,CAAA;AAAA,QACA,EAAE,MAAM,aAAA;AAAc,OACxB;AAAA,IACF;AAAA,GACF;AACF","file":"index.js","sourcesContent":["import { Readable } from \"node:stream\";\nimport type { VirusScanner } from \"../interfaces/scanner.interface\";\nimport type { ScanResult } from \"../interfaces/scan-result.interface\";\n\n/** ClamAV daemon connection options. */\nexport interface ClamScannerOptions {\n  /** Remove infected files after detection. Default: false. */\n  removeInfected?: boolean;\n  /** Quarantine path for infected files. */\n  quarantinePath?: string;\n  /** Log scan output to console. Default: false. */\n  debugMode?: boolean;\n  /** Path to clamscan binary. */\n  clamscanPath?: string;\n  /** Path to clamdscan binary. */\n  clamdscanPath?: string;\n  /** ClamAV daemon connection settings. */\n  clamdscan?: {\n    /** Use clamd for scanning. Default: true. */\n    active?: boolean;\n    /** Daemon host. Default: \"127.0.0.1\". */\n    host?: string;\n    /** Daemon port. Default: 3310. */\n    port?: number;\n    /** Socket path (overrides host/port). */\n    socket?: string;\n    /** Connection timeout in ms. Default: 5000. */\n    timeout?: number;\n  };\n}\n\ninterface ClamScanInstance {\n  isInfected(filePath: string): Promise<{\n    isInfected: boolean | null;\n    viruses: string[];\n  }>;\n  scanStream(stream: Readable): Promise<{\n    isInfected: boolean | null;\n    viruses: string[];\n  }>;\n}\n\ninterface ClamScanConstructor {\n  new (): { init(options: Record<string, unknown>): Promise<ClamScanInstance> };\n}\n\n/**\n * ClamAV implementation of the VirusScanner interface.\n * Wraps the `clamscan` npm package.\n */\nexport class ClamScanner implements VirusScanner {\n  readonly name = \"clamav\";\n  private instance: ClamScanInstance | null = null;\n  private readonly options: ClamScannerOptions;\n\n  constructor(options: ClamScannerOptions = {}) {\n    this.options = options;\n  }\n\n  async init(): Promise<void> {\n    if (this.instance) return;\n\n    // Dynamic import to avoid hard dependency when using a different scanner\n    const NodeClam = (await import(\"clamscan\")).default as unknown as ClamScanConstructor;\n    this.instance = await new NodeClam().init(this.buildClamConfig());\n  }\n\n  async scanBuffer(buffer: Buffer): Promise<ScanResult> {\n    const scanner = await this.getScanner();\n    const stream = Readable.from(buffer);\n    const result = await scanner.scanStream(stream);\n\n    return {\n      infected: result.isInfected === true,\n      viruses: result.viruses ?? [],\n    };\n  }\n\n  async scanFile(filePath: string): Promise<ScanResult> {\n    const scanner = await this.getScanner();\n    const result = await scanner.isInfected(filePath);\n\n    return {\n      infected: result.isInfected === true,\n      viruses: result.viruses ?? [],\n    };\n  }\n\n  private async getScanner(): Promise<ClamScanInstance> {\n    if (!this.instance) await this.init();\n    return this.instance!;\n  }\n\n  private buildClamConfig(): Record<string, unknown> {\n    return {\n      removeInfected: this.options.removeInfected ?? false,\n      quarantineInfected: this.options.quarantinePath ?? false,\n      debugMode: this.options.debugMode ?? false,\n      clamscan: {\n        path: this.options.clamscanPath ?? \"/usr/bin/clamscan\",\n      },\n      clamdscan: {\n        path: this.options.clamdscanPath ?? \"/usr/bin/clamdscan\",\n        active: this.options.clamdscan?.active ?? true,\n        host: this.options.clamdscan?.host ?? \"127.0.0.1\",\n        port: this.options.clamdscan?.port ?? 3310,\n        socket: this.options.clamdscan?.socket ?? null,\n        timeout: this.options.clamdscan?.timeout ?? 5000,\n      },\n    };\n  }\n}\n","import { randomUUID } from \"node:crypto\";\nimport type {\n  PipelineContext,\n  ValidationResult,\n  DatabaseAdapter,\n  PluginApi,\n} from \"@better-media/core\";\nimport type { VirusScanPluginOptions } from \"../interfaces/options.interface\";\nimport type { VirusScanner } from \"../interfaces/scanner.interface\";\nimport type { ScanRecord } from \"../interfaces/scan-result.interface\";\n\nasync function sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\n/**\n * Wrap a promise with a timeout.\n */\nfunction withTimeout<T>(promise: Promise<T>, ms: number, label: string): Promise<T> {\n  return new Promise<T>((resolve, reject) => {\n    const timer = setTimeout(() => reject(new Error(`${label} timed out after ${ms}ms`)), ms);\n    promise.then(\n      (val) => {\n        clearTimeout(timer);\n        resolve(val);\n      },\n      (err) => {\n        clearTimeout(timer);\n        reject(err);\n      }\n    );\n  });\n}\n\nasync function recordScanResult(database: DatabaseAdapter, record: ScanRecord): Promise<void> {\n  const model = \"media_virus_scan_results\";\n  const status = record.infected ? \"infected\" : \"clean\";\n\n  const data = {\n    mediaId: record.recordId,\n    status,\n    threats: record.viruses,\n    scanner: record.scannerName,\n    createdAt: record.scannedAt,\n  };\n\n  const existing = await database.findOne({\n    model,\n    where: [{ field: \"mediaId\", value: record.recordId }],\n  });\n\n  if (existing) {\n    await database.update({\n      model,\n      where: [{ field: \"id\", value: existing.id }],\n      update: data,\n    });\n  } else {\n    await database.create({\n      model,\n      data: { id: randomUUID(), ...data },\n    });\n  }\n}\n\n/**\n * Execute the scan with retry logic for transient failures.\n */\nasync function scanWithRetry(\n  scanner: VirusScanner,\n  buffer: Buffer,\n  tempPath: string | undefined,\n  opts: VirusScanPluginOptions\n): Promise<{ infected: boolean; viruses: string[] }> {\n  const maxAttempts = opts.retryOptions?.maxAttempts ?? 3;\n  const delayMs = opts.retryOptions?.delayMs ?? 1000;\n  const backoff = opts.retryOptions?.backoff ?? \"exponential\";\n  const timeoutMs = opts.scanTimeoutMs ?? 30_000;\n\n  let lastError: Error | undefined;\n\n  for (let attempt = 1; attempt <= maxAttempts; attempt++) {\n    try {\n      const scanPromise = tempPath ? scanner.scanFile(tempPath) : scanner.scanBuffer(buffer);\n\n      const result = await withTimeout(scanPromise, timeoutMs, \"Virus scan\");\n      return { infected: result.infected, viruses: result.viruses };\n    } catch (err: unknown) {\n      lastError = err instanceof Error ? err : new Error(String(err));\n      if (attempt < maxAttempts) {\n        const wait =\n          backoff === \"exponential\" ? delayMs * Math.pow(2, attempt - 1) : delayMs * attempt;\n        await sleep(wait);\n      }\n    }\n  }\n\n  throw lastError ?? new Error(\"Virus scan failed after retries\");\n}\n\n/**\n * Core virus scan runner. Called from the plugin's hook tap.\n */\nexport async function runVirusScan(\n  context: PipelineContext,\n  api: PluginApi,\n  scanner: VirusScanner,\n  opts: VirusScanPluginOptions\n): Promise<void | ValidationResult> {\n  const { file, database } = context;\n  const fileKey = file.key;\n  const fileContent = context.utilities?.fileContent;\n\n  if (!fileContent || (!fileContent.buffer && !fileContent.tempPath)) {\n    throw new Error(\n      \"Virus scan plugin requires fileContent (buffer or tempPath) to be available in context.utilities\"\n    );\n  }\n\n  // Prefer tempPath for scanFile; only read buffer when no tempPath is available\n  const tempPath = fileContent.tempPath;\n  const buffer = tempPath ? undefined : (fileContent.buffer ?? null);\n\n  if (!buffer && !tempPath) {\n    throw new Error(\"Unable to resolve file content for virus scanning\");\n  }\n\n  const startTime = Date.now();\n  let infected: boolean;\n  let viruses: string[];\n\n  try {\n    const result = await scanWithRetry(\n      scanner,\n      buffer ?? Buffer.alloc(0), // scanWithRetry will use tempPath if available\n      tempPath,\n      opts\n    );\n    infected = result.infected;\n    viruses = result.viruses;\n  } catch (err: unknown) {\n    const message = err instanceof Error ? err.message : String(err);\n    // Scanner failure is treated as an abort — we don't know if the file is safe\n    return { valid: false, message: `Virus scan failed: ${message}` };\n  }\n\n  const durationMs = Date.now() - startTime;\n\n  const scannedAt = new Date().toISOString();\n\n  // Persist scan result to DB\n  const record: ScanRecord = {\n    recordId: context.recordId,\n    fileKey,\n    infected,\n    viruses,\n    scannedAt,\n    scannerName: scanner.name,\n    durationMs,\n  };\n  await recordScanResult(database, record);\n\n  // Write scan metadata to plugin metadata via PluginApi\n  api.emitMetadata({ infected, viruses, scannedAt });\n\n  if (!infected) return;\n\n  // Infected file — handle according to failure mode\n  const failureMessage = `Virus detected in \"${fileKey}\": ${viruses.join(\", \")}`;\n\n  switch (opts.onFailure ?? \"abort\") {\n    case \"continue\":\n      return;\n    case \"custom\":\n      if (opts.onFailureCallback) {\n        const customResult = await opts.onFailureCallback(fileKey, viruses);\n        if (customResult && customResult.valid === false) return customResult;\n      }\n      return;\n    case \"abort\":\n    default:\n      return { valid: false, message: failureMessage };\n  }\n}\n","import fs from \"node:fs/promises\";\nimport type { VirusScanner } from \"../interfaces/scanner.interface\";\nimport type { ScanResult } from \"../interfaces/scan-result.interface\";\n\nexport interface VirusTotalScannerOptions {\n  /** VirusTotal API Key */\n  apiKey: string;\n  /** Max time to poll for analysis completion in ms. Default: 120,000 (2 minutes) */\n  pollingTimeoutMs?: number;\n  /** Polling interval in ms. Default: 5000 (5 seconds) */\n  pollingIntervalMs?: number;\n}\n\n/**\n * VirusTotal API v3 implementation of the VirusScanner interface.\n * Uses the native global `fetch` API available in Node 18+.\n */\nexport class VirusTotalScanner implements VirusScanner {\n  readonly name = \"virustotal\";\n  private readonly options: VirusTotalScannerOptions;\n\n  constructor(options: VirusTotalScannerOptions) {\n    if (!options.apiKey) {\n      throw new Error(\"VirusTotalScanner requires an apiKey\");\n    }\n    this.options = {\n      pollingTimeoutMs: 120_000,\n      pollingIntervalMs: 5_000,\n      ...options,\n    };\n  }\n\n  async init(): Promise<void> {\n    // REST API doesn't require initialization connection\n  }\n\n  async scanBuffer(buffer: Buffer): Promise<ScanResult> {\n    const blob = new Blob([new Uint8Array(buffer)]);\n    return this.uploadAndAnalyze(blob, \"upload.bin\");\n  }\n\n  async scanFile(filePath: string): Promise<ScanResult> {\n    const buffer = await fs.readFile(filePath);\n    const blob = new Blob([new Uint8Array(buffer)]);\n    const filename = filePath.split(\"/\").pop() || \"upload.bin\";\n    return this.uploadAndAnalyze(blob, filename);\n  }\n\n  private async uploadAndAnalyze(blob: Blob, filename: string): Promise<ScanResult> {\n    const size = blob.size;\n    let uploadUrl = \"https://www.virustotal.com/api/v3/files\";\n\n    // VirusTotal v3 requires a special URL for files > 32MB\n    if (size > 32 * 1024 * 1024) {\n      const urlRes = await fetch(\"https://www.virustotal.com/api/v3/files/upload_url\", {\n        headers: { \"x-apikey\": this.options.apiKey },\n      });\n      if (!urlRes.ok) {\n        throw new Error(`VirusTotal failed to get upload URL: ${urlRes.statusText}`);\n      }\n      const urlData = await urlRes.json();\n      uploadUrl = urlData.data;\n    }\n\n    const formData = new FormData();\n    formData.append(\"file\", blob, filename);\n\n    const uploadRes = await fetch(uploadUrl, {\n      method: \"POST\",\n      headers: { \"x-apikey\": this.options.apiKey },\n      body: formData,\n    });\n\n    if (!uploadRes.ok) {\n      const errText = await uploadRes.text().catch(() => \"\");\n      throw new Error(`VirusTotal upload failed: ${uploadRes.status} ${errText}`);\n    }\n\n    const uploadData = await uploadRes.json();\n    const analysisId = uploadData.data.id;\n\n    return this.pollAnalysis(analysisId);\n  }\n\n  private async pollAnalysis(analysisId: string): Promise<ScanResult> {\n    const startTime = Date.now();\n    const timeout = this.options.pollingTimeoutMs!;\n    const interval = this.options.pollingIntervalMs!;\n\n    while (Date.now() - startTime < timeout) {\n      const res = await fetch(`https://www.virustotal.com/api/v3/analyses/${analysisId}`, {\n        headers: { \"x-apikey\": this.options.apiKey },\n      });\n\n      if (!res.ok) {\n        throw new Error(`VirusTotal polling failed: ${res.statusText}`);\n      }\n\n      const data = await res.json();\n      const status = data.data.attributes.status;\n\n      if (status === \"completed\") {\n        const stats = data.data.attributes.stats;\n        let infected = false;\n        const viruses: string[] = [];\n\n        if (stats.malicious > 0 || stats.suspicious > 0) {\n          infected = true;\n          const results = data.data.attributes.results;\n          for (const [engine, info] of Object.entries<{ category: string; result: string | null }>(\n            results\n          )) {\n            if (info.category === \"malicious\" || info.category === \"suspicious\") {\n              viruses.push(`${engine}:${info.result}`);\n            }\n          }\n        }\n\n        return {\n          infected,\n          viruses,\n          raw: data.data,\n        };\n      }\n\n      // Wait interval before polling again\n      await new Promise((resolve) => setTimeout(resolve, interval));\n    }\n\n    throw new Error(`VirusTotal scan timed out waiting for analysis ${analysisId} to complete`);\n  }\n}\n","import type { PipelinePlugin, MediaRuntime, PipelineContext, PluginApi } from \"@better-media/core\";\nimport type { VirusScanPluginOptions } from \"./interfaces/options.interface\";\nimport { ClamScanner } from \"./scanners/clam.scanner\";\nimport { runVirusScan } from \"./runtime/runner\";\n\nexport type { VirusScanPluginOptions } from \"./interfaces/options.interface\";\nexport type { VirusScanner } from \"./interfaces/scanner.interface\";\nexport type { ScanResult, ScanRecord } from \"./interfaces/scan-result.interface\";\nexport { ClamScanner } from \"./scanners/clam.scanner\";\nexport type { ClamScannerOptions } from \"./scanners/clam.scanner\";\nexport { VirusTotalScanner } from \"./scanners/virustotal.scanner\";\nexport type { VirusTotalScannerOptions } from \"./scanners/virustotal.scanner\";\n\n/**\n * Virus scan plugin for the Better Media pipeline.\n *\n * Scans uploaded files for malware using a configurable scanner engine.\n * Defaults to ClamAV via the built-in ClamScanner.\n *\n * @example\n * ```ts\n * import { virusScanPlugin } from \"@better-media/plugin-virus-scan\";\n *\n * // With defaults (ClamAV daemon on localhost:3310)\n * const plugin = virusScanPlugin();\n *\n * // With custom scanner\n * const plugin = virusScanPlugin({ scanner: myCustomScanner });\n * ```\n */\nexport function virusScanPlugin(opts: VirusScanPluginOptions = {}): PipelinePlugin {\n  const executionMode = opts.executionMode ?? \"background\";\n  const isBackground = executionMode === \"background\";\n  const scanner = opts.scanner ?? new ClamScanner();\n\n  return {\n    name: \"virus-scan\",\n    runtimeManifest: {\n      id: \"better-media-virus-scan\",\n      version: \"1.0.0\",\n      trustLevel: \"untrusted\",\n      capabilities: [\"file.read\", \"metadata.write.own\", \"processing.write.own\"],\n      namespace: \"antivirus\",\n    },\n    executionMode,\n    intensive: isBackground,\n\n    apply(runtime: MediaRuntime) {\n      // Initialize scanner eagerly on first apply\n      let initPromise: Promise<void> | null = null;\n\n      runtime.hooks[\"scan:run\"].tap(\n        \"virus-scan\",\n        async (context: PipelineContext, api: PluginApi) => {\n          // Lazy init — only once across all invocations\n          if (!initPromise) {\n            initPromise = scanner.init();\n          }\n          await initPromise;\n\n          return runVirusScan(context, api, scanner, opts);\n        },\n        { mode: executionMode }\n      );\n    },\n  };\n}\n"]}

package/dist/index.mjs

@@ -0,0 +1,307 @@
+import { Readable } from 'stream';
+import { randomUUID } from 'crypto';
+import fs from 'fs/promises';
+
+// src/scanners/clam.scanner.ts
+var ClamScanner = class {
+  name = "clamav";
+  instance = null;
+  options;
+  constructor(options = {}) {
+    this.options = options;
+  }
+  async init() {
+    if (this.instance) return;
+    const NodeClam = (await import('clamscan')).default;
+    this.instance = await new NodeClam().init(this.buildClamConfig());
+  }
+  async scanBuffer(buffer) {
+    const scanner = await this.getScanner();
+    const stream = Readable.from(buffer);
+    const result = await scanner.scanStream(stream);
+    return {
+      infected: result.isInfected === true,
+      viruses: result.viruses ?? []
+    };
+  }
+  async scanFile(filePath) {
+    const scanner = await this.getScanner();
+    const result = await scanner.isInfected(filePath);
+    return {
+      infected: result.isInfected === true,
+      viruses: result.viruses ?? []
+    };
+  }
+  async getScanner() {
+    if (!this.instance) await this.init();
+    return this.instance;
+  }
+  buildClamConfig() {
+    return {
+      removeInfected: this.options.removeInfected ?? false,
+      quarantineInfected: this.options.quarantinePath ?? false,
+      debugMode: this.options.debugMode ?? false,
+      clamscan: {
+        path: this.options.clamscanPath ?? "/usr/bin/clamscan"
+      },
+      clamdscan: {
+        path: this.options.clamdscanPath ?? "/usr/bin/clamdscan",
+        active: this.options.clamdscan?.active ?? true,
+        host: this.options.clamdscan?.host ?? "127.0.0.1",
+        port: this.options.clamdscan?.port ?? 3310,
+        socket: this.options.clamdscan?.socket ?? null,
+        timeout: this.options.clamdscan?.timeout ?? 5e3
+      }
+    };
+  }
+};
+async function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function withTimeout(promise, ms, label) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error(`${label} timed out after ${ms}ms`)), ms);
+    promise.then(
+      (val) => {
+        clearTimeout(timer);
+        resolve(val);
+      },
+      (err) => {
+        clearTimeout(timer);
+        reject(err);
+      }
+    );
+  });
+}
+async function recordScanResult(database, record) {
+  const model = "media_virus_scan_results";
+  const status = record.infected ? "infected" : "clean";
+  const data = {
+    mediaId: record.recordId,
+    status,
+    threats: record.viruses,
+    scanner: record.scannerName,
+    createdAt: record.scannedAt
+  };
+  const existing = await database.findOne({
+    model,
+    where: [{ field: "mediaId", value: record.recordId }]
+  });
+  if (existing) {
+    await database.update({
+      model,
+      where: [{ field: "id", value: existing.id }],
+      update: data
+    });
+  } else {
+    await database.create({
+      model,
+      data: { id: randomUUID(), ...data }
+    });
+  }
+}
+async function scanWithRetry(scanner, buffer, tempPath, opts) {
+  const maxAttempts = opts.retryOptions?.maxAttempts ?? 3;
+  const delayMs = opts.retryOptions?.delayMs ?? 1e3;
+  const backoff = opts.retryOptions?.backoff ?? "exponential";
+  const timeoutMs = opts.scanTimeoutMs ?? 3e4;
+  let lastError;
+  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+    try {
+      const scanPromise = tempPath ? scanner.scanFile(tempPath) : scanner.scanBuffer(buffer);
+      const result = await withTimeout(scanPromise, timeoutMs, "Virus scan");
+      return { infected: result.infected, viruses: result.viruses };
+    } catch (err) {
+      lastError = err instanceof Error ? err : new Error(String(err));
+      if (attempt < maxAttempts) {
+        const wait = backoff === "exponential" ? delayMs * Math.pow(2, attempt - 1) : delayMs * attempt;
+        await sleep(wait);
+      }
+    }
+  }
+  throw lastError ?? new Error("Virus scan failed after retries");
+}
+async function runVirusScan(context, api, scanner, opts) {
+  const { file, database } = context;
+  const fileKey = file.key;
+  const fileContent = context.utilities?.fileContent;
+  if (!fileContent || !fileContent.buffer && !fileContent.tempPath) {
+    throw new Error(
+      "Virus scan plugin requires fileContent (buffer or tempPath) to be available in context.utilities"
+    );
+  }
+  const tempPath = fileContent.tempPath;
+  const buffer = tempPath ? void 0 : fileContent.buffer ?? null;
+  if (!buffer && !tempPath) {
+    throw new Error("Unable to resolve file content for virus scanning");
+  }
+  let infected;
+  let viruses;
+  try {
+    const result = await scanWithRetry(
+      scanner,
+      buffer ?? Buffer.alloc(0),
+      // scanWithRetry will use tempPath if available
+      tempPath,
+      opts
+    );
+    infected = result.infected;
+    viruses = result.viruses;
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { valid: false, message: `Virus scan failed: ${message}` };
+  }
+  const scannedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const record = {
+    recordId: context.recordId,
+    infected,
+    viruses,
+    scannedAt,
+    scannerName: scanner.name};
+  await recordScanResult(database, record);
+  api.emitMetadata({ infected, viruses, scannedAt });
+  if (!infected) return;
+  const failureMessage = `Virus detected in "${fileKey}": ${viruses.join(", ")}`;
+  switch (opts.onFailure ?? "abort") {
+    case "continue":
+      return;
+    case "custom":
+      if (opts.onFailureCallback) {
+        const customResult = await opts.onFailureCallback(fileKey, viruses);
+        if (customResult && customResult.valid === false) return customResult;
+      }
+      return;
+    case "abort":
+    default:
+      return { valid: false, message: failureMessage };
+  }
+}
+var VirusTotalScanner = class {
+  name = "virustotal";
+  options;
+  constructor(options) {
+    if (!options.apiKey) {
+      throw new Error("VirusTotalScanner requires an apiKey");
+    }
+    this.options = {
+      pollingTimeoutMs: 12e4,
+      pollingIntervalMs: 5e3,
+      ...options
+    };
+  }
+  async init() {
+  }
+  async scanBuffer(buffer) {
+    const blob = new Blob([new Uint8Array(buffer)]);
+    return this.uploadAndAnalyze(blob, "upload.bin");
+  }
+  async scanFile(filePath) {
+    const buffer = await fs.readFile(filePath);
+    const blob = new Blob([new Uint8Array(buffer)]);
+    const filename = filePath.split("/").pop() || "upload.bin";
+    return this.uploadAndAnalyze(blob, filename);
+  }
+  async uploadAndAnalyze(blob, filename) {
+    const size = blob.size;
+    let uploadUrl = "https://www.virustotal.com/api/v3/files";
+    if (size > 32 * 1024 * 1024) {
+      const urlRes = await fetch("https://www.virustotal.com/api/v3/files/upload_url", {
+        headers: { "x-apikey": this.options.apiKey }
+      });
+      if (!urlRes.ok) {
+        throw new Error(`VirusTotal failed to get upload URL: ${urlRes.statusText}`);
+      }
+      const urlData = await urlRes.json();
+      uploadUrl = urlData.data;
+    }
+    const formData = new FormData();
+    formData.append("file", blob, filename);
+    const uploadRes = await fetch(uploadUrl, {
+      method: "POST",
+      headers: { "x-apikey": this.options.apiKey },
+      body: formData
+    });
+    if (!uploadRes.ok) {
+      const errText = await uploadRes.text().catch(() => "");
+      throw new Error(`VirusTotal upload failed: ${uploadRes.status} ${errText}`);
+    }
+    const uploadData = await uploadRes.json();
+    const analysisId = uploadData.data.id;
+    return this.pollAnalysis(analysisId);
+  }
+  async pollAnalysis(analysisId) {
+    const startTime = Date.now();
+    const timeout = this.options.pollingTimeoutMs;
+    const interval = this.options.pollingIntervalMs;
+    while (Date.now() - startTime < timeout) {
+      const res = await fetch(`https://www.virustotal.com/api/v3/analyses/${analysisId}`, {
+        headers: { "x-apikey": this.options.apiKey }
+      });
+      if (!res.ok) {
+        throw new Error(`VirusTotal polling failed: ${res.statusText}`);
+      }
+      const data = await res.json();
+      const status = data.data.attributes.status;
+      if (status === "completed") {
+        const stats = data.data.attributes.stats;
+        let infected = false;
+        const viruses = [];
+        if (stats.malicious > 0 || stats.suspicious > 0) {
+          infected = true;
+          const results = data.data.attributes.results;
+          for (const [engine, info] of Object.entries(
+            results
+          )) {
+            if (info.category === "malicious" || info.category === "suspicious") {
+              viruses.push(`${engine}:${info.result}`);
+            }
+          }
+        }
+        return {
+          infected,
+          viruses,
+          raw: data.data
+        };
+      }
+      await new Promise((resolve) => setTimeout(resolve, interval));
+    }
+    throw new Error(`VirusTotal scan timed out waiting for analysis ${analysisId} to complete`);
+  }
+};
+
+// src/index.ts
+function virusScanPlugin(opts = {}) {
+  const executionMode = opts.executionMode ?? "background";
+  const isBackground = executionMode === "background";
+  const scanner = opts.scanner ?? new ClamScanner();
+  return {
+    name: "virus-scan",
+    runtimeManifest: {
+      id: "better-media-virus-scan",
+      version: "1.0.0",
+      trustLevel: "untrusted",
+      capabilities: ["file.read", "metadata.write.own", "processing.write.own"],
+      namespace: "antivirus"
+    },
+    executionMode,
+    intensive: isBackground,
+    apply(runtime) {
+      let initPromise = null;
+      runtime.hooks["scan:run"].tap(
+        "virus-scan",
+        async (context, api) => {
+          if (!initPromise) {
+            initPromise = scanner.init();
+          }
+          await initPromise;
+          return runVirusScan(context, api, scanner, opts);
+        },
+        { mode: executionMode }
+      );
+    }
+  };
+}
+
+export { ClamScanner, VirusTotalScanner, virusScanPlugin };
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/scanners/clam.scanner.ts","../src/runtime/runner.ts","../src/scanners/virustotal.scanner.ts","../src/index.ts"],"names":[],"mappings":";;;;;AAkDO,IAAM,cAAN,MAA0C;AAAA,EACtC,IAAA,GAAO,QAAA;AAAA,EACR,QAAA,GAAoC,IAAA;AAAA,EAC3B,OAAA;AAAA,EAEjB,WAAA,CAAY,OAAA,GAA8B,EAAC,EAAG;AAC5C,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAAA,EACjB;AAAA,EAEA,MAAM,IAAA,GAAsB;AAC1B,IAAA,IAAI,KAAK,QAAA,EAAU;AAGnB,IAAA,MAAM,QAAA,GAAA,CAAY,MAAM,OAAO,UAAU,CAAA,EAAG,OAAA;AAC5C,IAAA,IAAA,CAAK,QAAA,GAAW,MAAM,IAAI,QAAA,GAAW,IAAA,CAAK,IAAA,CAAK,iBAAiB,CAAA;AAAA,EAClE;AAAA,EAEA,MAAM,WAAW,MAAA,EAAqC;AACpD,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,UAAA,EAAW;AACtC,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,CAAK,MAAM,CAAA;AACnC,IAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,UAAA,CAAW,MAAM,CAAA;AAE9C,IAAA,OAAO;AAAA,MACL,QAAA,EAAU,OAAO,UAAA,KAAe,IAAA;AAAA,MAChC,OAAA,EAAS,MAAA,CAAO,OAAA,IAAW;AAAC,KAC9B;AAAA,EACF;AAAA,EAEA,MAAM,SAAS,QAAA,EAAuC;AACpD,IAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,UAAA,EAAW;AACtC,IAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,UAAA,CAAW,QAAQ,CAAA;AAEhD,IAAA,OAAO;AAAA,MACL,QAAA,EAAU,OAAO,UAAA,KAAe,IAAA;AAAA,MAChC,OAAA,EAAS,MAAA,CAAO,OAAA,IAAW;AAAC,KAC9B;AAAA,EACF;AAAA,EAEA,MAAc,UAAA,GAAwC;AACpD,IAAA,IAAI,CAAC,IAAA,CAAK,QAAA,EAAU,MAAM,KAAK,IAAA,EAAK;AACpC,IAAA,OAAO,IAAA,CAAK,QAAA;AAAA,EACd;AAAA,EAEQ,eAAA,GAA2C;AACjD,IAAA,OAAO;AAAA,MACL,cAAA,EAAgB,IAAA,CAAK,OAAA,CAAQ,cAAA,IAAkB,KAAA;AAAA,MAC/C,kBAAA,EAAoB,IAAA,CAAK,OAAA,CAAQ,cAAA,IAAkB,KAAA;AAAA,MACnD,SAAA,EAAW,IAAA,CAAK,OAAA,CAAQ,SAAA,IAAa,KAAA;AAAA,MACrC,QAAA,EAAU;AAAA,QACR,IAAA,EAAM,IAAA,CAAK,OAAA,CAAQ,YAAA,IAAgB;AAAA,OACrC;AAAA,MACA,SAAA,EAAW;AAAA,QACT,IAAA,EAAM,IAAA,CAAK,OAAA,CAAQ,aAAA,IAAiB,oBAAA;AAAA,QACpC,MAAA,EAAQ,IAAA,CAAK,OAAA,CAAQ,SAAA,EAAW,MAAA,IAAU,IAAA;AAAA,QAC1C,IAAA,EAAM,IAAA,CAAK,OAAA,CAAQ,SAAA,EAAW,IAAA,IAAQ,WAAA;AAAA,QACtC,IAAA,EAAM,IAAA,CAAK,OAAA,CAAQ,SAAA,EAAW,IAAA,IAAQ,IAAA;AAAA,QACtC,MAAA,EAAQ,IAAA,CAAK,OAAA,CAAQ,SAAA,EAAW,MAAA,IAAU,IAAA;AAAA,QAC1C,OAAA,EAAS,IAAA,CAAK,OAAA,CAAQ,SAAA,EAAW,OAAA,IAAW;AAAA;AAC9C,KACF;AAAA,EACF;AACF;ACpGA,eAAe,MAAM,EAAA,EAA2B;AAC9C,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,EAAE,CAAC,CAAA;AACzD;AAKA,SAAS,WAAA,CAAe,OAAA,EAAqB,EAAA,EAAY,KAAA,EAA2B;AAClF,EAAA,OAAO,IAAI,OAAA,CAAW,CAAC,OAAA,EAAS,MAAA,KAAW;AACzC,IAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,MAAM,MAAA,CAAO,IAAI,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA,iBAAA,EAAoB,EAAE,CAAA,EAAA,CAAI,CAAC,GAAG,EAAE,CAAA;AACxF,IAAA,OAAA,CAAQ,IAAA;AAAA,MACN,CAAC,GAAA,KAAQ;AACP,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,OAAA,CAAQ,GAAG,CAAA;AAAA,MACb,CAAA;AAAA,MACA,CAAC,GAAA,KAAQ;AACP,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,MAAA,CAAO,GAAG,CAAA;AAAA,MACZ;AAAA,KACF;AAAA,EACF,CAAC,CAAA;AACH;AAEA,eAAe,gBAAA,CAAiB,UAA2B,MAAA,EAAmC;AAC5F,EAAA,MAAM,KAAA,GAAQ,0BAAA;AACd,EAAA,MAAM,MAAA,GAAS,MAAA,CAAO,QAAA,GAAW,UAAA,GAAa,OAAA;AAE9C,EAAA,MAAM,IAAA,GAAO;AAAA,IACX,SAAS,MAAA,CAAO,QAAA;AAAA,IAChB,MAAA;AAAA,IACA,SAAS,MAAA,CAAO,OAAA;AAAA,IAChB,SAAS,MAAA,CAAO,WAAA;AAAA,IAChB,WAAW,MAAA,CAAO;AAAA,GACpB;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,QAAA,CAAS,OAAA,CAAQ;AAAA,IACtC,KAAA;AAAA,IACA,KAAA,EAAO,CAAC,EAAE,KAAA,EAAO,WAAW,KAAA,EAAO,MAAA,CAAO,UAAU;AAAA,GACrD,CAAA;AAED,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,MAAM,SAAS,MAAA,CAAO;AAAA,MACpB,KAAA;AAAA,MACA,KAAA,EAAO,CAAC,EAAE,KAAA,EAAO,MAAM,KAAA,EAAO,QAAA,CAAS,IAAI,CAAA;AAAA,MAC3C,MAAA,EAAQ;AAAA,KACT,CAAA;AAAA,EACH,CAAA,MAAO;AACL,IAAA,MAAM,SAAS,MAAA,CAAO;AAAA,MACpB,KAAA;AAAA,MACA,MAAM,EAAE,EAAA,EAAI,UAAA,EAAW,EAAG,GAAG,IAAA;AAAK,KACnC,CAAA;AAAA,EACH;AACF;AAKA,eAAe,aAAA,CACb,OAAA,EACA,MAAA,EACA,QAAA,EACA,IAAA,EACmD;AACnD,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,YAAA,EAAc,WAAA,IAAe,CAAA;AACtD,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,YAAA,EAAc,OAAA,IAAW,GAAA;AAC9C,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,YAAA,EAAc,OAAA,IAAW,aAAA;AAC9C,EAAA,MAAM,SAAA,GAAY,KAAK,aAAA,IAAiB,GAAA;AAExC,EAAA,IAAI,SAAA;AAEJ,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,WAAA,EAAa,OAAA,EAAA,EAAW;AACvD,IAAA,IAAI;AACF,MAAA,MAAM,WAAA,GAAc,WAAW,OAAA,CAAQ,QAAA,CAAS,QAAQ,CAAA,GAAI,OAAA,CAAQ,WAAW,MAAM,CAAA;AAErF,MAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,WAAA,EAAa,WAAW,YAAY,CAAA;AACrE,MAAA,OAAO,EAAE,QAAA,EAAU,MAAA,CAAO,QAAA,EAAU,OAAA,EAAS,OAAO,OAAA,EAAQ;AAAA,IAC9D,SAAS,GAAA,EAAc;AACrB,MAAA,SAAA,GAAY,eAAe,KAAA,GAAQ,GAAA,GAAM,IAAI,KAAA,CAAM,MAAA,CAAO,GAAG,CAAC,CAAA;AAC9D,MAAA,IAAI,UAAU,WAAA,EAAa;AACzB,QAAA,MAAM,IAAA,GACJ,OAAA,KAAY,aAAA,GAAgB,OAAA,GAAU,IAAA,CAAK,IAAI,CAAA,EAAG,OAAA,GAAU,CAAC,CAAA,GAAI,OAAA,GAAU,OAAA;AAC7E,QAAA,MAAM,MAAM,IAAI,CAAA;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,SAAA,IAAa,IAAI,KAAA,CAAM,iCAAiC,CAAA;AAChE;AAKA,eAAsB,YAAA,CACpB,OAAA,EACA,GAAA,EACA,OAAA,EACA,IAAA,EACkC;AAClC,EAAA,MAAM,EAAE,IAAA,EAAM,QAAA,EAAS,GAAI,OAAA;AAC3B,EAAA,MAAM,UAAU,IAAA,CAAK,GAAA;AACrB,EAAA,MAAM,WAAA,GAAc,QAAQ,SAAA,EAAW,WAAA;AAEvC,EAAA,IAAI,CAAC,WAAA,IAAgB,CAAC,YAAY,MAAA,IAAU,CAAC,YAAY,QAAA,EAAW;AAClE,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAGA,EAAA,MAAM,WAAW,WAAA,CAAY,QAAA;AAC7B,EAAA,MAAM,MAAA,GAAS,QAAA,GAAW,MAAA,GAAa,WAAA,CAAY,MAAA,IAAU,IAAA;AAE7D,EAAA,IAAI,CAAC,MAAA,IAAU,CAAC,QAAA,EAAU;AACxB,IAAA,MAAM,IAAI,MAAM,mDAAmD,CAAA;AAAA,EACrE;AAGA,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI,OAAA;AAEJ,EAAA,IAAI;AACF,IAAA,MAAM,SAAS,MAAM,aAAA;AAAA,MACnB,OAAA;AAAA,MACA,MAAA,IAAU,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAAA;AAAA,MACxB,QAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,QAAA,GAAW,MAAA,CAAO,QAAA;AAClB,IAAA,OAAA,GAAU,MAAA,CAAO,OAAA;AAAA,EACnB,SAAS,GAAA,EAAc;AACrB,IAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAE/D,IAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,OAAA,EAAS,CAAA,mBAAA,EAAsB,OAAO,CAAA,CAAA,EAAG;AAAA,EAClE;AAIA,EAAA,MAAM,SAAA,GAAA,iBAAY,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAGzC,EAAA,MAAM,MAAA,GAAqB;AAAA,IACzB,UAAU,OAAA,CAAQ,QAAA;AAAA,IAElB,QAAA;AAAA,IACA,OAAA;AAAA,IACA,SAAA;AAAA,IACA,aAAa,OAAA,CAAQ,IAEvB,CAAA;AACA,EAAA,MAAM,gBAAA,CAAiB,UAAU,MAAM,CAAA;AAGvC,EAAA,GAAA,CAAI,YAAA,CAAa,EAAE,QAAA,EAAU,OAAA,EAAS,WAAW,CAAA;AAEjD,EAAA,IAAI,CAAC,QAAA,EAAU;AAGf,EAAA,MAAM,iBAAiB,CAAA,mBAAA,EAAsB,OAAO,MAAM,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAE5E,EAAA,QAAQ,IAAA,CAAK,aAAa,OAAA;AAAS,IACjC,KAAK,UAAA;AACH,MAAA;AAAA,IACF,KAAK,QAAA;AACH,MAAA,IAAI,KAAK,iBAAA,EAAmB;AAC1B,QAAA,MAAM,YAAA,GAAe,MAAM,IAAA,CAAK,iBAAA,CAAkB,SAAS,OAAO,CAAA;AAClE,QAAA,IAAI,YAAA,IAAgB,YAAA,CAAa,KAAA,KAAU,KAAA,EAAO,OAAO,YAAA;AAAA,MAC3D;AACA,MAAA;AAAA,IACF,KAAK,OAAA;AAAA,IACL;AACE,MAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,OAAA,EAAS,cAAA,EAAe;AAAA;AAErD;ACtKO,IAAM,oBAAN,MAAgD;AAAA,EAC5C,IAAA,GAAO,YAAA;AAAA,EACC,OAAA;AAAA,EAEjB,YAAY,OAAA,EAAmC;AAC7C,IAAA,IAAI,CAAC,QAAQ,MAAA,EAAQ;AACnB,MAAA,MAAM,IAAI,MAAM,sCAAsC,CAAA;AAAA,IACxD;AACA,IAAA,IAAA,CAAK,OAAA,GAAU;AAAA,MACb,gBAAA,EAAkB,IAAA;AAAA,MAClB,iBAAA,EAAmB,GAAA;AAAA,MACnB,GAAG;AAAA,KACL;AAAA,EACF;AAAA,EAEA,MAAM,IAAA,GAAsB;AAAA,EAE5B;AAAA,EAEA,MAAM,WAAW,MAAA,EAAqC;AACpD,IAAA,MAAM,IAAA,GAAO,IAAI,IAAA,CAAK,CAAC,IAAI,UAAA,CAAW,MAAM,CAAC,CAAC,CAAA;AAC9C,IAAA,OAAO,IAAA,CAAK,gBAAA,CAAiB,IAAA,EAAM,YAAY,CAAA;AAAA,EACjD;AAAA,EAEA,MAAM,SAAS,QAAA,EAAuC;AACpD,IAAA,MAAM,MAAA,GAAS,MAAM,EAAA,CAAG,QAAA,CAAS,QAAQ,CAAA;AACzC,IAAA,MAAM,IAAA,GAAO,IAAI,IAAA,CAAK,CAAC,IAAI,UAAA,CAAW,MAAM,CAAC,CAAC,CAAA;AAC9C,IAAA,MAAM,WAAW,QAAA,CAAS,KAAA,CAAM,GAAG,CAAA,CAAE,KAAI,IAAK,YAAA;AAC9C,IAAA,OAAO,IAAA,CAAK,gBAAA,CAAiB,IAAA,EAAM,QAAQ,CAAA;AAAA,EAC7C;AAAA,EAEA,MAAc,gBAAA,CAAiB,IAAA,EAAY,QAAA,EAAuC;AAChF,IAAA,MAAM,OAAO,IAAA,CAAK,IAAA;AAClB,IAAA,IAAI,SAAA,GAAY,yCAAA;AAGhB,IAAA,IAAI,IAAA,GAAO,EAAA,GAAK,IAAA,GAAO,IAAA,EAAM;AAC3B,MAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,oDAAA,EAAsD;AAAA,QAC/E,OAAA,EAAS,EAAE,UAAA,EAAY,IAAA,CAAK,QAAQ,MAAA;AAAO,OAC5C,CAAA;AACD,MAAA,IAAI,CAAC,OAAO,EAAA,EAAI;AACd,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,qCAAA,EAAwC,MAAA,CAAO,UAAU,CAAA,CAAE,CAAA;AAAA,MAC7E;AACA,MAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,IAAA,EAAK;AAClC,MAAA,SAAA,GAAY,OAAA,CAAQ,IAAA;AAAA,IACtB;AAEA,IAAA,MAAM,QAAA,GAAW,IAAI,QAAA,EAAS;AAC9B,IAAA,QAAA,CAAS,MAAA,CAAO,MAAA,EAAQ,IAAA,EAAM,QAAQ,CAAA;AAEtC,IAAA,MAAM,SAAA,GAAY,MAAM,KAAA,CAAM,SAAA,EAAW;AAAA,MACvC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,UAAA,EAAY,IAAA,CAAK,QAAQ,MAAA,EAAO;AAAA,MAC3C,IAAA,EAAM;AAAA,KACP,CAAA;AAED,IAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,MAAA,MAAM,UAAU,MAAM,SAAA,CAAU,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AACrD,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,UAAU,MAAM,CAAA,CAAA,EAAI,OAAO,CAAA,CAAE,CAAA;AAAA,IAC5E;AAEA,IAAA,MAAM,UAAA,GAAa,MAAM,SAAA,CAAU,IAAA,EAAK;AACxC,IAAA,MAAM,UAAA,GAAa,WAAW,IAAA,CAAK,EAAA;AAEnC,IAAA,OAAO,IAAA,CAAK,aAAa,UAAU,CAAA;AAAA,EACrC;AAAA,EAEA,MAAc,aAAa,UAAA,EAAyC;AAClE,IAAA,MAAM,SAAA,GAAY,KAAK,GAAA,EAAI;AAC3B,IAAA,MAAM,OAAA,GAAU,KAAK,OAAA,CAAQ,gBAAA;AAC7B,IAAA,MAAM,QAAA,GAAW,KAAK,OAAA,CAAQ,iBAAA;AAE9B,IAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,OAAA,EAAS;AACvC,MAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,CAAA,2CAAA,EAA8C,UAAU,CAAA,CAAA,EAAI;AAAA,QAClF,OAAA,EAAS,EAAE,UAAA,EAAY,IAAA,CAAK,QAAQ,MAAA;AAAO,OAC5C,CAAA;AAED,MAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,MAChE;AAEA,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,IAAA,CAAK,UAAA,CAAW,MAAA;AAEpC,MAAA,IAAI,WAAW,WAAA,EAAa;AAC1B,QAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,IAAA,CAAK,UAAA,CAAW,KAAA;AACnC,QAAA,IAAI,QAAA,GAAW,KAAA;AACf,QAAA,MAAM,UAAoB,EAAC;AAE3B,QAAA,IAAI,KAAA,CAAM,SAAA,GAAY,CAAA,IAAK,KAAA,CAAM,aAAa,CAAA,EAAG;AAC/C,UAAA,QAAA,GAAW,IAAA;AACX,UAAA,MAAM,OAAA,GAAU,IAAA,CAAK,IAAA,CAAK,UAAA,CAAW,OAAA;AACrC,UAAA,KAAA,MAAW,CAAC,MAAA,EAAQ,IAAI,CAAA,IAAK,MAAA,CAAO,OAAA;AAAA,YAClC;AAAA,WACF,EAAG;AACD,YAAA,IAAI,IAAA,CAAK,QAAA,KAAa,WAAA,IAAe,IAAA,CAAK,aAAa,YAAA,EAAc;AACnE,cAAA,OAAA,CAAQ,KAAK,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AAAA,YACzC;AAAA,UACF;AAAA,QACF;AAEA,QAAA,OAAO;AAAA,UACL,QAAA;AAAA,UACA,OAAA;AAAA,UACA,KAAK,IAAA,CAAK;AAAA,SACZ;AAAA,MACF;AAGA,MAAA,MAAM,IAAI,OAAA,CAAQ,CAAC,YAAY,UAAA,CAAW,OAAA,EAAS,QAAQ,CAAC,CAAA;AAAA,IAC9D;AAEA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,+CAAA,EAAkD,UAAU,CAAA,YAAA,CAAc,CAAA;AAAA,EAC5F;AACF;;;ACrGO,SAAS,eAAA,CAAgB,IAAA,GAA+B,EAAC,EAAmB;AACjF,EAAA,MAAM,aAAA,GAAgB,KAAK,aAAA,IAAiB,YAAA;AAC5C,EAAA,MAAM,eAAe,aAAA,KAAkB,YAAA;AACvC,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,IAAW,IAAI,WAAA,EAAY;AAEhD,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,YAAA;AAAA,IACN,eAAA,EAAiB;AAAA,MACf,EAAA,EAAI,yBAAA;AAAA,MACJ,OAAA,EAAS,OAAA;AAAA,MACT,UAAA,EAAY,WAAA;AAAA,MACZ,YAAA,EAAc,CAAC,WAAA,EAAa,oBAAA,EAAsB,sBAAsB,CAAA;AAAA,MACxE,SAAA,EAAW;AAAA,KACb;AAAA,IACA,aAAA;AAAA,IACA,SAAA,EAAW,YAAA;AAAA,IAEX,MAAM,OAAA,EAAuB;AAE3B,MAAA,IAAI,WAAA,GAAoC,IAAA;AAExC,MAAA,OAAA,CAAQ,KAAA,CAAM,UAAU,CAAA,CAAE,GAAA;AAAA,QACxB,YAAA;AAAA,QACA,OAAO,SAA0B,GAAA,KAAmB;AAElD,UAAA,IAAI,CAAC,WAAA,EAAa;AAChB,YAAA,WAAA,GAAc,QAAQ,IAAA,EAAK;AAAA,UAC7B;AACA,UAAA,MAAM,WAAA;AAEN,UAAA,OAAO,YAAA,CAAa,OAAA,EAAS,GAAA,EAAK,OAAA,EAAS,IAAI,CAAA;AAAA,QACjD,CAAA;AAAA,QACA,EAAE,MAAM,aAAA;AAAc,OACxB;AAAA,IACF;AAAA,GACF;AACF","file":"index.mjs","sourcesContent":["import { Readable } from \"node:stream\";\nimport type { VirusScanner } from \"../interfaces/scanner.interface\";\nimport type { ScanResult } from \"../interfaces/scan-result.interface\";\n\n/** ClamAV daemon connection options. */\nexport interface ClamScannerOptions {\n  /** Remove infected files after detection. Default: false. */\n  removeInfected?: boolean;\n  /** Quarantine path for infected files. */\n  quarantinePath?: string;\n  /** Log scan output to console. Default: false. */\n  debugMode?: boolean;\n  /** Path to clamscan binary. */\n  clamscanPath?: string;\n  /** Path to clamdscan binary. */\n  clamdscanPath?: string;\n  /** ClamAV daemon connection settings. */\n  clamdscan?: {\n    /** Use clamd for scanning. Default: true. */\n    active?: boolean;\n    /** Daemon host. Default: \"127.0.0.1\". */\n    host?: string;\n    /** Daemon port. Default: 3310. */\n    port?: number;\n    /** Socket path (overrides host/port). */\n    socket?: string;\n    /** Connection timeout in ms. Default: 5000. */\n    timeout?: number;\n  };\n}\n\ninterface ClamScanInstance {\n  isInfected(filePath: string): Promise<{\n    isInfected: boolean | null;\n    viruses: string[];\n  }>;\n  scanStream(stream: Readable): Promise<{\n    isInfected: boolean | null;\n    viruses: string[];\n  }>;\n}\n\ninterface ClamScanConstructor {\n  new (): { init(options: Record<string, unknown>): Promise<ClamScanInstance> };\n}\n\n/**\n * ClamAV implementation of the VirusScanner interface.\n * Wraps the `clamscan` npm package.\n */\nexport class ClamScanner implements VirusScanner {\n  readonly name = \"clamav\";\n  private instance: ClamScanInstance | null = null;\n  private readonly options: ClamScannerOptions;\n\n  constructor(options: ClamScannerOptions = {}) {\n    this.options = options;\n  }\n\n  async init(): Promise<void> {\n    if (this.instance) return;\n\n    // Dynamic import to avoid hard dependency when using a different scanner\n    const NodeClam = (await import(\"clamscan\")).default as unknown as ClamScanConstructor;\n    this.instance = await new NodeClam().init(this.buildClamConfig());\n  }\n\n  async scanBuffer(buffer: Buffer): Promise<ScanResult> {\n    const scanner = await this.getScanner();\n    const stream = Readable.from(buffer);\n    const result = await scanner.scanStream(stream);\n\n    return {\n      infected: result.isInfected === true,\n      viruses: result.viruses ?? [],\n    };\n  }\n\n  async scanFile(filePath: string): Promise<ScanResult> {\n    const scanner = await this.getScanner();\n    const result = await scanner.isInfected(filePath);\n\n    return {\n      infected: result.isInfected === true,\n      viruses: result.viruses ?? [],\n    };\n  }\n\n  private async getScanner(): Promise<ClamScanInstance> {\n    if (!this.instance) await this.init();\n    return this.instance!;\n  }\n\n  private buildClamConfig(): Record<string, unknown> {\n    return {\n      removeInfected: this.options.removeInfected ?? false,\n      quarantineInfected: this.options.quarantinePath ?? false,\n      debugMode: this.options.debugMode ?? false,\n      clamscan: {\n        path: this.options.clamscanPath ?? \"/usr/bin/clamscan\",\n      },\n      clamdscan: {\n        path: this.options.clamdscanPath ?? \"/usr/bin/clamdscan\",\n        active: this.options.clamdscan?.active ?? true,\n        host: this.options.clamdscan?.host ?? \"127.0.0.1\",\n        port: this.options.clamdscan?.port ?? 3310,\n        socket: this.options.clamdscan?.socket ?? null,\n        timeout: this.options.clamdscan?.timeout ?? 5000,\n      },\n    };\n  }\n}\n","import { randomUUID } from \"node:crypto\";\nimport type {\n  PipelineContext,\n  ValidationResult,\n  DatabaseAdapter,\n  PluginApi,\n} from \"@better-media/core\";\nimport type { VirusScanPluginOptions } from \"../interfaces/options.interface\";\nimport type { VirusScanner } from \"../interfaces/scanner.interface\";\nimport type { ScanRecord } from \"../interfaces/scan-result.interface\";\n\nasync function sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\n/**\n * Wrap a promise with a timeout.\n */\nfunction withTimeout<T>(promise: Promise<T>, ms: number, label: string): Promise<T> {\n  return new Promise<T>((resolve, reject) => {\n    const timer = setTimeout(() => reject(new Error(`${label} timed out after ${ms}ms`)), ms);\n    promise.then(\n      (val) => {\n        clearTimeout(timer);\n        resolve(val);\n      },\n      (err) => {\n        clearTimeout(timer);\n        reject(err);\n      }\n    );\n  });\n}\n\nasync function recordScanResult(database: DatabaseAdapter, record: ScanRecord): Promise<void> {\n  const model = \"media_virus_scan_results\";\n  const status = record.infected ? \"infected\" : \"clean\";\n\n  const data = {\n    mediaId: record.recordId,\n    status,\n    threats: record.viruses,\n    scanner: record.scannerName,\n    createdAt: record.scannedAt,\n  };\n\n  const existing = await database.findOne({\n    model,\n    where: [{ field: \"mediaId\", value: record.recordId }],\n  });\n\n  if (existing) {\n    await database.update({\n      model,\n      where: [{ field: \"id\", value: existing.id }],\n      update: data,\n    });\n  } else {\n    await database.create({\n      model,\n      data: { id: randomUUID(), ...data },\n    });\n  }\n}\n\n/**\n * Execute the scan with retry logic for transient failures.\n */\nasync function scanWithRetry(\n  scanner: VirusScanner,\n  buffer: Buffer,\n  tempPath: string | undefined,\n  opts: VirusScanPluginOptions\n): Promise<{ infected: boolean; viruses: string[] }> {\n  const maxAttempts = opts.retryOptions?.maxAttempts ?? 3;\n  const delayMs = opts.retryOptions?.delayMs ?? 1000;\n  const backoff = opts.retryOptions?.backoff ?? \"exponential\";\n  const timeoutMs = opts.scanTimeoutMs ?? 30_000;\n\n  let lastError: Error | undefined;\n\n  for (let attempt = 1; attempt <= maxAttempts; attempt++) {\n    try {\n      const scanPromise = tempPath ? scanner.scanFile(tempPath) : scanner.scanBuffer(buffer);\n\n      const result = await withTimeout(scanPromise, timeoutMs, \"Virus scan\");\n      return { infected: result.infected, viruses: result.viruses };\n    } catch (err: unknown) {\n      lastError = err instanceof Error ? err : new Error(String(err));\n      if (attempt < maxAttempts) {\n        const wait =\n          backoff === \"exponential\" ? delayMs * Math.pow(2, attempt - 1) : delayMs * attempt;\n        await sleep(wait);\n      }\n    }\n  }\n\n  throw lastError ?? new Error(\"Virus scan failed after retries\");\n}\n\n/**\n * Core virus scan runner. Called from the plugin's hook tap.\n */\nexport async function runVirusScan(\n  context: PipelineContext,\n  api: PluginApi,\n  scanner: VirusScanner,\n  opts: VirusScanPluginOptions\n): Promise<void | ValidationResult> {\n  const { file, database } = context;\n  const fileKey = file.key;\n  const fileContent = context.utilities?.fileContent;\n\n  if (!fileContent || (!fileContent.buffer && !fileContent.tempPath)) {\n    throw new Error(\n      \"Virus scan plugin requires fileContent (buffer or tempPath) to be available in context.utilities\"\n    );\n  }\n\n  // Prefer tempPath for scanFile; only read buffer when no tempPath is available\n  const tempPath = fileContent.tempPath;\n  const buffer = tempPath ? undefined : (fileContent.buffer ?? null);\n\n  if (!buffer && !tempPath) {\n    throw new Error(\"Unable to resolve file content for virus scanning\");\n  }\n\n  const startTime = Date.now();\n  let infected: boolean;\n  let viruses: string[];\n\n  try {\n    const result = await scanWithRetry(\n      scanner,\n      buffer ?? Buffer.alloc(0), // scanWithRetry will use tempPath if available\n      tempPath,\n      opts\n    );\n    infected = result.infected;\n    viruses = result.viruses;\n  } catch (err: unknown) {\n    const message = err instanceof Error ? err.message : String(err);\n    // Scanner failure is treated as an abort — we don't know if the file is safe\n    return { valid: false, message: `Virus scan failed: ${message}` };\n  }\n\n  const durationMs = Date.now() - startTime;\n\n  const scannedAt = new Date().toISOString();\n\n  // Persist scan result to DB\n  const record: ScanRecord = {\n    recordId: context.recordId,\n    fileKey,\n    infected,\n    viruses,\n    scannedAt,\n    scannerName: scanner.name,\n    durationMs,\n  };\n  await recordScanResult(database, record);\n\n  // Write scan metadata to plugin metadata via PluginApi\n  api.emitMetadata({ infected, viruses, scannedAt });\n\n  if (!infected) return;\n\n  // Infected file — handle according to failure mode\n  const failureMessage = `Virus detected in \"${fileKey}\": ${viruses.join(\", \")}`;\n\n  switch (opts.onFailure ?? \"abort\") {\n    case \"continue\":\n      return;\n    case \"custom\":\n      if (opts.onFailureCallback) {\n        const customResult = await opts.onFailureCallback(fileKey, viruses);\n        if (customResult && customResult.valid === false) return customResult;\n      }\n      return;\n    case \"abort\":\n    default:\n      return { valid: false, message: failureMessage };\n  }\n}\n","import fs from \"node:fs/promises\";\nimport type { VirusScanner } from \"../interfaces/scanner.interface\";\nimport type { ScanResult } from \"../interfaces/scan-result.interface\";\n\nexport interface VirusTotalScannerOptions {\n  /** VirusTotal API Key */\n  apiKey: string;\n  /** Max time to poll for analysis completion in ms. Default: 120,000 (2 minutes) */\n  pollingTimeoutMs?: number;\n  /** Polling interval in ms. Default: 5000 (5 seconds) */\n  pollingIntervalMs?: number;\n}\n\n/**\n * VirusTotal API v3 implementation of the VirusScanner interface.\n * Uses the native global `fetch` API available in Node 18+.\n */\nexport class VirusTotalScanner implements VirusScanner {\n  readonly name = \"virustotal\";\n  private readonly options: VirusTotalScannerOptions;\n\n  constructor(options: VirusTotalScannerOptions) {\n    if (!options.apiKey) {\n      throw new Error(\"VirusTotalScanner requires an apiKey\");\n    }\n    this.options = {\n      pollingTimeoutMs: 120_000,\n      pollingIntervalMs: 5_000,\n      ...options,\n    };\n  }\n\n  async init(): Promise<void> {\n    // REST API doesn't require initialization connection\n  }\n\n  async scanBuffer(buffer: Buffer): Promise<ScanResult> {\n    const blob = new Blob([new Uint8Array(buffer)]);\n    return this.uploadAndAnalyze(blob, \"upload.bin\");\n  }\n\n  async scanFile(filePath: string): Promise<ScanResult> {\n    const buffer = await fs.readFile(filePath);\n    const blob = new Blob([new Uint8Array(buffer)]);\n    const filename = filePath.split(\"/\").pop() || \"upload.bin\";\n    return this.uploadAndAnalyze(blob, filename);\n  }\n\n  private async uploadAndAnalyze(blob: Blob, filename: string): Promise<ScanResult> {\n    const size = blob.size;\n    let uploadUrl = \"https://www.virustotal.com/api/v3/files\";\n\n    // VirusTotal v3 requires a special URL for files > 32MB\n    if (size > 32 * 1024 * 1024) {\n      const urlRes = await fetch(\"https://www.virustotal.com/api/v3/files/upload_url\", {\n        headers: { \"x-apikey\": this.options.apiKey },\n      });\n      if (!urlRes.ok) {\n        throw new Error(`VirusTotal failed to get upload URL: ${urlRes.statusText}`);\n      }\n      const urlData = await urlRes.json();\n      uploadUrl = urlData.data;\n    }\n\n    const formData = new FormData();\n    formData.append(\"file\", blob, filename);\n\n    const uploadRes = await fetch(uploadUrl, {\n      method: \"POST\",\n      headers: { \"x-apikey\": this.options.apiKey },\n      body: formData,\n    });\n\n    if (!uploadRes.ok) {\n      const errText = await uploadRes.text().catch(() => \"\");\n      throw new Error(`VirusTotal upload failed: ${uploadRes.status} ${errText}`);\n    }\n\n    const uploadData = await uploadRes.json();\n    const analysisId = uploadData.data.id;\n\n    return this.pollAnalysis(analysisId);\n  }\n\n  private async pollAnalysis(analysisId: string): Promise<ScanResult> {\n    const startTime = Date.now();\n    const timeout = this.options.pollingTimeoutMs!;\n    const interval = this.options.pollingIntervalMs!;\n\n    while (Date.now() - startTime < timeout) {\n      const res = await fetch(`https://www.virustotal.com/api/v3/analyses/${analysisId}`, {\n        headers: { \"x-apikey\": this.options.apiKey },\n      });\n\n      if (!res.ok) {\n        throw new Error(`VirusTotal polling failed: ${res.statusText}`);\n      }\n\n      const data = await res.json();\n      const status = data.data.attributes.status;\n\n      if (status === \"completed\") {\n        const stats = data.data.attributes.stats;\n        let infected = false;\n        const viruses: string[] = [];\n\n        if (stats.malicious > 0 || stats.suspicious > 0) {\n          infected = true;\n          const results = data.data.attributes.results;\n          for (const [engine, info] of Object.entries<{ category: string; result: string | null }>(\n            results\n          )) {\n            if (info.category === \"malicious\" || info.category === \"suspicious\") {\n              viruses.push(`${engine}:${info.result}`);\n            }\n          }\n        }\n\n        return {\n          infected,\n          viruses,\n          raw: data.data,\n        };\n      }\n\n      // Wait interval before polling again\n      await new Promise((resolve) => setTimeout(resolve, interval));\n    }\n\n    throw new Error(`VirusTotal scan timed out waiting for analysis ${analysisId} to complete`);\n  }\n}\n","import type { PipelinePlugin, MediaRuntime, PipelineContext, PluginApi } from \"@better-media/core\";\nimport type { VirusScanPluginOptions } from \"./interfaces/options.interface\";\nimport { ClamScanner } from \"./scanners/clam.scanner\";\nimport { runVirusScan } from \"./runtime/runner\";\n\nexport type { VirusScanPluginOptions } from \"./interfaces/options.interface\";\nexport type { VirusScanner } from \"./interfaces/scanner.interface\";\nexport type { ScanResult, ScanRecord } from \"./interfaces/scan-result.interface\";\nexport { ClamScanner } from \"./scanners/clam.scanner\";\nexport type { ClamScannerOptions } from \"./scanners/clam.scanner\";\nexport { VirusTotalScanner } from \"./scanners/virustotal.scanner\";\nexport type { VirusTotalScannerOptions } from \"./scanners/virustotal.scanner\";\n\n/**\n * Virus scan plugin for the Better Media pipeline.\n *\n * Scans uploaded files for malware using a configurable scanner engine.\n * Defaults to ClamAV via the built-in ClamScanner.\n *\n * @example\n * ```ts\n * import { virusScanPlugin } from \"@better-media/plugin-virus-scan\";\n *\n * // With defaults (ClamAV daemon on localhost:3310)\n * const plugin = virusScanPlugin();\n *\n * // With custom scanner\n * const plugin = virusScanPlugin({ scanner: myCustomScanner });\n * ```\n */\nexport function virusScanPlugin(opts: VirusScanPluginOptions = {}): PipelinePlugin {\n  const executionMode = opts.executionMode ?? \"background\";\n  const isBackground = executionMode === \"background\";\n  const scanner = opts.scanner ?? new ClamScanner();\n\n  return {\n    name: \"virus-scan\",\n    runtimeManifest: {\n      id: \"better-media-virus-scan\",\n      version: \"1.0.0\",\n      trustLevel: \"untrusted\",\n      capabilities: [\"file.read\", \"metadata.write.own\", \"processing.write.own\"],\n      namespace: \"antivirus\",\n    },\n    executionMode,\n    intensive: isBackground,\n\n    apply(runtime: MediaRuntime) {\n      // Initialize scanner eagerly on first apply\n      let initPromise: Promise<void> | null = null;\n\n      runtime.hooks[\"scan:run\"].tap(\n        \"virus-scan\",\n        async (context: PipelineContext, api: PluginApi) => {\n          // Lazy init — only once across all invocations\n          if (!initPromise) {\n            initPromise = scanner.init();\n          }\n          await initPromise;\n\n          return runVirusScan(context, api, scanner, opts);\n        },\n        { mode: executionMode }\n      );\n    },\n  };\n}\n"]}

package/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "@better-media/plugin-virus-scan",
+  "version": "0.1.0",
+  "description": "Virus scanning plugin for Better Media pipeline",
+  "main": "./dist/index.js",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "dependencies": {
+    "@better-media/core": "0.1.0"
+  },
+  "peerDependencies": {
+    "clamscan": "^2.4.0"
+  },
+  "keywords": [],
+  "author": "Abenezer Atnafu",
+  "license": "MIT",
+  "devDependencies": {
+    "@types/clamscan": "^2.4.1",
+    "clamscan": "^2.4.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/AbenezerAtnafu/better-media.git"
+  },
+  "homepage": "https://better-media.dev",
+  "bugs": {
+    "url": "https://github.com/AbenezerAtnafu/better-media/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint .",
+    "test": "jest"
+  }
+}