@bun-native/cli 0.0.0-stage → 0.33.0

package/src/scripts/native/package-archive.ts

@@ -0,0 +1,103 @@
+import { createHash } from 'node:crypto'
+import { gunzipSync } from 'node:zlib'
+import type { FileDigest } from './artifact.ts'
+import { packageArchivePath } from './paths.ts'
+
+const block = 512
+const maximumBytes = 64 * 1024 * 1024
+
+function text(field: Buffer): string {
+  const end = field.indexOf(0)
+  if (end !== -1 && field.subarray(end).some((byte) => byte !== 0))
+    throw new Error('Invalid package tar text padding')
+  return field.subarray(0, end === -1 ? undefined : end).toString('latin1')
+}
+
+function octal(field: Buffer): number {
+  const value = field.toString('latin1')
+  if (!/^[\0 ]*[0-7]+[\0 ]*$/.test(value)) throw new Error('Invalid package tar numeric field')
+  const number = Number.parseInt(value.replaceAll('\0', '').trim(), 8)
+  if (!Number.isSafeInteger(number)) throw new Error('Invalid package tar size')
+  return number
+}
+
+/** Inspect original USTAR members before any map can erase duplicates or link metadata. */
+export async function verifyPackageArchive(
+  path: string,
+  expected: Record<string, FileDigest>
+): Promise<void> {
+  const files = new Map<string, FileDigest>()
+  const directories = new Set<string>()
+  let paddedContents = 0
+  for (const [name, digest] of Object.entries(expected)) {
+    if (!packageArchivePath(name) || !Number.isSafeInteger(digest.bytes) || digest.bytes < 0)
+      throw new Error('Invalid expected package archive inventory')
+    const full = `package/${name}`
+    files.set(full, digest)
+    const parts = full.split('/')
+    for (let index = 1; index < parts.length; index += 1)
+      directories.add(parts.slice(0, index).join('/'))
+    paddedContents += Math.ceil(digest.bytes / block) * block
+  }
+  // Permit the declared files, directory headers, end blocks and one conventional
+  // 10 KiB blocking pad. Bound decompression before parsing any member contents.
+  const limit = paddedContents + (files.size + directories.size + 2) * block + 10_240
+  if (!Number.isSafeInteger(limit) || limit > maximumBytes || Bun.file(path).size > maximumBytes)
+    throw new Error('Package archive exceeds the bounded source-package inspection limit')
+  const data = gunzipSync(await Bun.file(path).bytes(), { maxOutputLength: limit })
+  if (data.length % block !== 0) throw new Error('Truncated package tar blocks')
+  const seen = new Set<string>()
+  const regular = new Set<string>()
+  let ended = false
+  for (let offset = 0; offset + block <= data.length;) {
+    const header = data.subarray(offset, offset + block)
+    if (header.every((byte) => byte === 0)) {
+      if (data.length - offset < block * 2 || data.subarray(offset).some((byte) => byte !== 0))
+        throw new Error('Invalid package tar end records or trailing data')
+      ended = true
+      break
+    }
+    const checksum = octal(header.subarray(148, 156))
+    let sum = 0
+    for (let index = 0; index < block; index += 1)
+      sum += index >= 148 && index < 156 ? 32 : header[index]!
+    if (sum !== checksum) throw new Error('Invalid package tar header checksum')
+    if (!['ustar\0', 'ustar '].includes(header.subarray(257, 263).toString('latin1')))
+      throw new Error('Package archive must use the supported USTAR format')
+    const kind = header[156] === 0 ? '0' : String.fromCharCode(header[156]!)
+    if (!['0', '5'].includes(kind) || text(header.subarray(157, 257)) !== '')
+      throw new Error(`Unsupported package tar member type or link: ${kind}`)
+    const size = octal(header.subarray(124, 136))
+    const prefix = text(header.subarray(345, 500))
+    const raw = (prefix ? prefix + '/' : '') + text(header.subarray(0, 100))
+    const name = kind === '5' ? raw.replace(/\/$/, '') : raw
+    if (!packageArchivePath(name))
+      throw new Error(`Package archive inventory contains an invalid path: ${raw}`)
+    if (seen.has(name)) throw new Error(`Duplicate package tar member: ${name}`)
+    seen.add(name)
+    const start = offset + block
+    const end = start + size
+    const next = start + Math.ceil(size / block) * block
+    if (!Number.isSafeInteger(next) || next > data.length)
+      throw new Error('Truncated package tar member')
+    if (data.subarray(end, next).some((byte) => byte !== 0))
+      throw new Error('Invalid package tar member padding')
+    if (kind === '5') {
+      if (size !== 0 || !directories.has(name))
+        throw new Error(`Unexpected package tar directory: ${name}`)
+    } else {
+      const expected = files.get(name)
+      if (!expected) throw new Error(`Packed archive file inventory differs: ${name}`)
+      if (
+        size !== expected.bytes ||
+        createHash('sha256').update(data.subarray(start, end)).digest('hex') !== expected.sha256
+      )
+        throw new Error(`Packed archive digest mismatch: ${name}`)
+      regular.add(name)
+    }
+    offset = next
+  }
+  if (!ended) throw new Error('Package tar has no end records')
+  if (regular.size !== files.size)
+    throw new Error('Packed archive file inventory differs from the staged package')
+}

package/src/scripts/native/package-lock.ts

@@ -0,0 +1,220 @@
+import { isDeepStrictEqual } from 'node:util'
+import { packagePath } from './paths.ts'
+
+type LockedPackage = [string, string, Record<string, unknown>, string]
+export type DependencyLock = {
+  lockfileVersion: 2
+  configVersion: 1
+  packages: Record<string, LockedPackage>
+}
+type ArchiveInfo = { dependencies?: Record<string, string>; bin?: Record<string, string> }
+type LocalArchiveLock = {
+  packages: Record<string, [string, ArchiveInfo, string]>
+  overrides: Record<string, string>
+}
+
+/** Pinned Bun text locks use raw tarball paths; file: denotes a folder in this field. */
+export function localArchiveLock(
+  archives: readonly {
+    name: string
+    file: string
+    sha256: string
+    dependencies?: Record<string, string>
+    bin?: Record<string, string>
+  }[]
+): LocalArchiveLock {
+  const packages: LocalArchiveLock['packages'] = Object.create(null)
+  const overrides: Record<string, string> = Object.create(null)
+  for (const archive of archives) {
+    if (
+      !archive.name.startsWith('@bun-native/') ||
+      !packagePath(archive.file) ||
+      !archive.file.endsWith('.tgz') ||
+      !/^[a-f0-9]{64}$/.test(archive.sha256) ||
+      Object.hasOwn(packages, archive.name)
+    )
+      throw new Error(`Invalid or duplicate local archive lock input: ${archive.name}`)
+    const info: ArchiveInfo = {
+      ...(archive.dependencies ? { dependencies: archive.dependencies } : {}),
+      ...(archive.bin ? { bin: archive.bin } : {}),
+    }
+    packages[archive.name] = [
+      `${archive.name}@${archive.file}`,
+      info,
+      `sha256-${Buffer.from(archive.sha256, 'hex').toString('base64')}`,
+    ]
+    overrides[archive.name] = `file:${archive.file}`
+  }
+  return {
+    packages: Object.fromEntries(Object.entries(packages)),
+    overrides: Object.fromEntries(Object.entries(overrides)),
+  }
+}
+
+function record(value: unknown): Record<string, unknown> {
+  if (!value || typeof value !== 'object' || Array.isArray(value))
+    throw new Error('Invalid dependency lock record')
+  return value as Record<string, unknown>
+}
+
+export function lockedPackages(value: unknown, local?: LocalArchiveLock): DependencyLock {
+  const lock = record(value)
+  if (lock['lockfileVersion'] !== 2 || lock['configVersion'] !== 1)
+    throw new Error('Expected the pinned Bun dependency lock format')
+  const supplied = record(lock['packages'])
+  if (local)
+    for (const [name, expected] of Object.entries(local.packages))
+      if (!Object.hasOwn(supplied, name) || !isDeepStrictEqual(supplied[name], expected))
+        throw new Error(`Installed local archive lock differs: ${name}`)
+  const packages: DependencyLock['packages'] = Object.create(null)
+  for (const [key, value] of Object.entries(supplied)) {
+    if (local && Object.hasOwn(local.packages, key)) continue
+    if (!Array.isArray(value) || typeof value[0] !== 'string')
+      throw new Error(`Invalid locked package: ${key}`)
+    if (value[0].includes('@workspace:') || value[0].includes('@file:')) {
+      if (local || !key.startsWith('@bun-native/') || value[0].includes('@file:'))
+        throw new Error(`Unexpected local dependency in lock: ${key}`)
+      continue
+    }
+    if (
+      value.length !== 4 ||
+      value[1] !== '' ||
+      typeof value[3] !== 'string' ||
+      !/^sha512-[A-Za-z0-9+/]+={0,2}$/.test(value[3])
+    )
+      throw new Error(`Expected an integrity-bound registry dependency: ${key}`)
+    packages[key] = [value[0], value[1], record(value[2]), value[3]]
+  }
+  return {
+    lockfileVersion: 2,
+    configVersion: 1,
+    packages: Object.fromEntries(Object.entries(packages)),
+  }
+}
+
+function identity(entry: LockedPackage): { name: string; version: string } {
+  const separator = entry[0].lastIndexOf('@')
+  const name = entry[0].slice(0, separator)
+  const version = entry[0].slice(separator + 1)
+  if (separator <= 0 || !/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(version))
+    throw new Error(`Expected an exact registry version: ${entry[0]}`)
+  return { name, version }
+}
+
+/** Preserve nested resolutions; a global name override would collapse distinct versions. */
+export function dependencyClosure(
+  lock: DependencyLock,
+  roots: Record<string, string>,
+  includeInstalledOptionalPeers = false
+): DependencyLock {
+  const packages: DependencyLock['packages'] = Object.create(null)
+  const pending: string[] = []
+  for (const [name, version] of Object.entries(roots)) {
+    const entry = Object.hasOwn(lock.packages, name) ? lock.packages[name] : undefined
+    if (!entry || identity(entry).name !== name || identity(entry).version !== version)
+      throw new Error(`Source lock does not pin ${name}@${version}`)
+    pending.push(name)
+  }
+  const resolve = (from: string, name: string, required: boolean): string | undefined => {
+    let ancestor = from
+    while (ancestor) {
+      const candidate = `${ancestor}/${name}`
+      if (Object.hasOwn(lock.packages, candidate)) return candidate
+      const current = Object.hasOwn(lock.packages, ancestor) ? lock.packages[ancestor] : undefined
+      if (!current || !ancestor.endsWith(identity(current).name))
+        throw new Error(`Invalid nested dependency locator: ${ancestor}`)
+      ancestor = ancestor.slice(0, -identity(current).name.length).replace(/\/$/, '')
+    }
+    if (Object.hasOwn(lock.packages, name)) return name
+    if (required) throw new Error(`Source lock is missing ${name}, required by ${from}`)
+    return undefined
+  }
+  for (let index = 0; index < pending.length; index += 1) {
+    const key = pending[index]!
+    if (packages[key]) continue
+    const entry = lock.packages[key]!
+    identity(entry)
+    packages[key] = entry
+    const optionalPeers = entry[2]['optionalPeers'] ?? []
+    if (!Array.isArray(optionalPeers) || optionalPeers.some((name) => typeof name !== 'string'))
+      throw new Error(`Invalid optional peer metadata: ${key}`)
+    for (const field of ['dependencies', 'peerDependencies', 'optionalDependencies']) {
+      const dependencies = entry[2][field]
+      if (dependencies === undefined) continue
+      for (const [name, version] of Object.entries(record(dependencies))) {
+        if (typeof version !== 'string') throw new Error(`Invalid ${key} dependency ${name}`)
+        // Optional peer declarations remain byte-identical in the retained
+        // tuple. They do not add an installation root that the source lacked.
+        const optionalPeer = field === 'peerDependencies' && optionalPeers.includes(name)
+        if (optionalPeer && !includeInstalledOptionalPeers) continue
+        const target = resolve(key, name, !optionalPeer && field !== 'optionalDependencies')
+        if (target) pending.push(target)
+      }
+    }
+  }
+  return {
+    lockfileVersion: 2,
+    configVersion: 1,
+    packages: Object.fromEntries(
+      Object.entries(packages).sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
+    ),
+  }
+}
+
+/** Keep a complete lock graph; Bun rejects missing local roots before installation. */
+export function seedConsumerLock(
+  lock: DependencyLock,
+  manifest: {
+    name: string
+    dependencies: Record<string, string>
+    devDependencies: Record<string, string>
+  },
+  local: LocalArchiveLock = { packages: {}, overrides: {} }
+) {
+  const packages = { ...lock.packages, ...local.packages }
+  for (const name of Object.keys({ ...manifest.dependencies, ...manifest.devDependencies }))
+    if (!Object.hasOwn(packages, name))
+      throw new Error(`Consumer lock is missing a root package: ${name}`)
+  return {
+    lockfileVersion: lock.lockfileVersion,
+    configVersion: lock.configVersion,
+    workspaces: { '': manifest },
+    overrides: local.overrides,
+    packages,
+  }
+}
+
+/** No new tuple, changed version/integrity/edge, or omitted required nested tuple is accepted. */
+export function verifyConsumerLock(
+  value: unknown,
+  expected: DependencyLock,
+  allowAdditional = false,
+  local?: LocalArchiveLock
+): void {
+  // Applications may add unrelated dependencies. The fixed qualification cohort
+  // uses the exact comparison; runtime validation still pins every required tuple.
+  const packages = record(record(value)['packages'])
+  const localRoots = Object.keys(local?.packages ?? {})
+  if (Object.keys(packages).some((key) => localRoots.some((root) => key.startsWith(root + '/'))))
+    throw new Error(
+      'Installed dependency lock introduces a nested locator beneath a required local package'
+    )
+  const supplied = lockedPackages(value, local)
+  const roots = Object.fromEntries(
+    Object.entries(expected.packages)
+      .filter(([key, entry]) => key === identity(entry).name)
+      .map(([key, entry]) => [key, identity(entry).version])
+  )
+  const actual = allowAdditional ? dependencyClosure(supplied, roots, true) : supplied
+  if (!isDeepStrictEqual(actual, expected))
+    throw new Error('Installed dependency lock differs from the supplied pinned package set')
+  if (local) {
+    const overrides = record(record(value)['overrides'])
+    // Selector/parent override forms can affect required packages too. Keep the
+    // complete override map exact, while permitting unrelated registry roots.
+    if (!isDeepStrictEqual(overrides, local.overrides))
+      throw new Error(
+        'Installed local archive overrides differ from the supplied pinned package set'
+      )
+  }
+}