@camstack/types 1.2.354 → 1.2.356

package/dist/node.js

@@ -21,7 +21,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
-const require_composition = require("./composition-BLWAivB2.js");
+const require_composition = require("./composition-DCYnv4I6.js");
 const require_err_msg = require("./err-msg-Dx2Kor0g.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
@@ -31,7 +31,161 @@ node_path = __toESM(node_path);
 let node_stream_promises = require("node:stream/promises");
 let node_stream = require("node:stream");
 let node_child_process = require("node:child_process");
+let node_zlib = require("node:zlib");
+let node_os = require("node:os");
 let node_fs_promises = require("node:fs/promises");
+//#region src/deps/zip-extract.ts
+/**
+* A zip extractor with no external binary behind it.
+*
+* Why it exists: on Windows there is no `unzip`, and the `tar` that is on PATH
+* is whichever the machine has (Git for Windows ships a GNU tar that cannot
+* read a zip). The two archives a Windows node downloads — the portable Python
+* and the ffmpeg build — are both zips, so the extraction is done here, with
+* `node:zlib`, instead of by a program the machine may not have.
+*
+* Scope is deliberately narrow: stored and deflated entries, no encryption, no
+* zip64. Both are refused by NAME rather than mis-read. Symlinks and unix modes
+* are not restored — POSIX hosts keep using `unzip`, which does.
+*/
+var EOCD_SIGNATURE = 101010256;
+var CENTRAL_SIGNATURE = 33639248;
+var LOCAL_SIGNATURE = 67324752;
+var EOCD_MIN_BYTES = 22;
+/** The end-of-central-directory record is within the last 22 + 65535 bytes. */
+var EOCD_SEARCH_BYTES = 65557;
+var ZIP64_SENTINEL = 4294967295;
+var METHOD_STORED = 0;
+var METHOD_DEFLATE = 8;
+var FLAG_ENCRYPTED = 1;
+function findEndOfCentralDirectory(buf) {
+	const lowest = Math.max(0, buf.length - EOCD_SEARCH_BYTES);
+	for (let i = buf.length - EOCD_MIN_BYTES; i >= lowest; i--) if (buf.readUInt32LE(i) === EOCD_SIGNATURE) return i;
+	throw new Error("not a zip archive: no end-of-central-directory record");
+}
+function readEntries(buf) {
+	const eocd = findEndOfCentralDirectory(buf);
+	const count = buf.readUInt16LE(eocd + 10);
+	let offset = buf.readUInt32LE(eocd + 16);
+	if (count === 65535 || offset === ZIP64_SENTINEL) throw new Error("zip64 archives are not supported");
+	const entries = [];
+	for (let n = 0; n < count; n++) {
+		if (buf.readUInt32LE(offset) !== CENTRAL_SIGNATURE) throw new Error(`corrupt zip: bad central directory entry ${n}`);
+		if ((buf.readUInt16LE(offset + 8) & FLAG_ENCRYPTED) !== 0) throw new Error("encrypted zip entries are not supported");
+		const compressedSize = buf.readUInt32LE(offset + 20);
+		const uncompressedSize = buf.readUInt32LE(offset + 24);
+		const localHeaderOffset = buf.readUInt32LE(offset + 42);
+		if (compressedSize === ZIP64_SENTINEL || uncompressedSize === ZIP64_SENTINEL || localHeaderOffset === ZIP64_SENTINEL) throw new Error("zip64 entries are not supported");
+		const nameLength = buf.readUInt16LE(offset + 28);
+		const extraLength = buf.readUInt16LE(offset + 30);
+		const commentLength = buf.readUInt16LE(offset + 32);
+		entries.push({
+			name: buf.toString("utf8", offset + 46, offset + 46 + nameLength),
+			method: buf.readUInt16LE(offset + 10),
+			crc: buf.readUInt32LE(offset + 16),
+			compressedSize,
+			uncompressedSize,
+			localHeaderOffset
+		});
+		offset += 46 + nameLength + extraLength + commentLength;
+	}
+	return entries;
+}
+function readEntryData(buf, entry) {
+	const at = entry.localHeaderOffset;
+	if (buf.readUInt32LE(at) !== LOCAL_SIGNATURE) throw new Error(`corrupt zip: bad local header for ${entry.name}`);
+	const start = at + 30 + buf.readUInt16LE(at + 26) + buf.readUInt16LE(at + 28);
+	const raw = buf.subarray(start, start + entry.compressedSize);
+	let data;
+	if (entry.method === METHOD_STORED) data = raw;
+	else if (entry.method === METHOD_DEFLATE) data = (0, node_zlib.inflateRawSync)(raw);
+	else throw new Error(`unsupported zip compression method ${entry.method} for ${entry.name}`);
+	if (data.length !== entry.uncompressedSize || (0, node_zlib.crc32)(data) !== entry.crc) throw new Error(`corrupt zip: ${entry.name} does not match its recorded size/CRC`);
+	return data;
+}
+/**
+* Where an entry lands, or a refusal when its name climbs out of `destDir`
+* (a "zip slip": `..\..\evil.dll`, an absolute path, a drive letter).
+*/
+function targetPath(destDir, entryName) {
+	const root = (0, node_path.resolve)(destDir);
+	const target = (0, node_path.resolve)(root, entryName.replace(/\\/g, "/"));
+	if (target !== root && !target.startsWith(root + node_path.sep)) throw new Error(`zip entry escapes the target directory: ${entryName}`);
+	return target;
+}
+function extractZipArchive(archivePath, destDir) {
+	const buf = (0, node_fs.readFileSync)(archivePath);
+	(0, node_fs.mkdirSync)(destDir, { recursive: true });
+	for (const entry of readEntries(buf)) {
+		const target = targetPath(destDir, entry.name);
+		if (entry.name.endsWith("/") || entry.name.endsWith("\\")) {
+			(0, node_fs.mkdirSync)(target, { recursive: true });
+			continue;
+		}
+		(0, node_fs.mkdirSync)((0, node_path.dirname)(target), { recursive: true });
+		(0, node_fs.writeFileSync)(target, readEntryData(buf, entry));
+	}
+}
+//#endregion
+//#region src/deps/archive-extract.ts
+/**
+* The one place an archive a node downloaded is unpacked.
+*
+* POSIX hosts keep their native tools (`unzip` restores modes and symlinks,
+* which the portable Python relies on). Windows has neither a guaranteed
+* `unzip` nor a guaranteed zip-capable `tar` on PATH, so a zip is unpacked by
+* the in-process extractor, and a tarball by the `tar.exe` Windows ships in
+* System32 (bsdtar) — addressed by absolute path so a GNU tar that Git for
+* Windows put earlier on PATH cannot shadow it.
+*/
+var defaultDeps = {
+	platform: process.platform,
+	systemRoot: process.env["SystemRoot"],
+	exec: (file, args) => (0, node_child_process.execFileSync)(file, [...args], { stdio: "pipe" }),
+	extractZip: extractZipArchive
+};
+/** The tar to run: Windows' own bsdtar by absolute path, `tar` elsewhere. */
+function tarExecutable(platform, systemRoot) {
+	if (platform !== "win32") return "tar";
+	return (0, node_path.join)(systemRoot ?? "C:\\Windows", "System32", "tar.exe");
+}
+function extractArchive(archivePath, format, destDir, overrides = {}) {
+	const deps = {
+		...defaultDeps,
+		...overrides
+	};
+	const tar = tarExecutable(deps.platform, deps.systemRoot);
+	if (format === "zip") {
+		if (deps.platform === "win32") {
+			deps.extractZip(archivePath, destDir);
+			return;
+		}
+		try {
+			deps.exec("unzip", [
+				"-o",
+				"-q",
+				archivePath,
+				"-d",
+				destDir
+			]);
+		} catch {
+			deps.exec(tar, [
+				"-xf",
+				archivePath,
+				"-C",
+				destDir
+			]);
+		}
+		return;
+	}
+	deps.exec(tar, [
+		format === "tar.xz" ? "-xJf" : "-xzf",
+		archivePath,
+		"-C",
+		destDir
+	]);
+}
+//#endregion
 //#region src/deps/binary-downloader.ts
 /**
 * Recursively find the first file named exactly `name` under `dir`. Used as the
@@ -80,7 +234,7 @@ function findInPath(name) {
 * verified" is the only state in which running this binary is worse than not
 * having it. The partial file is removed so a retry cannot pick it up.
 */
-function verifyChecksum(file, expected, name, url) {
+function verifySha256(file, expected, name, url) {
 	if (expected === void 0) return;
 	const actual = (0, node_crypto.createHash)("sha256").update((0, node_fs.readFileSync)(file)).digest("hex");
 	if (actual === expected) return;
@@ -114,42 +268,15 @@ async function downloadBinary(opts) {
 		const ext = archiveFormat ?? "tar.gz";
 		const tmpArchive = (0, node_path.join)(targetDir, `${name}-download.${ext}`);
 		await (0, node_stream_promises.pipeline)(node_stream.Readable.fromWeb(response.body), (0, node_fs.createWriteStream)(tmpArchive));
-		verifyChecksum(tmpArchive, opts.sha256, name, url);
+		verifySha256(tmpArchive, opts.sha256, name, url);
 		const tmpExtractDir = (0, node_path.join)(targetDir, `${name}-extract`);
 		(0, node_fs.mkdirSync)(tmpExtractDir, { recursive: true });
-		if (ext === "zip") try {
-			(0, node_child_process.execFileSync)("unzip", [
-				"-o",
-				"-q",
-				tmpArchive,
-				"-d",
-				tmpExtractDir
-			], { stdio: "pipe" });
-		} catch {
-			(0, node_child_process.execFileSync)("tar", [
-				"-xf",
-				tmpArchive,
-				"-C",
-				tmpExtractDir
-			], { stdio: "pipe" });
-		}
-		else if (ext === "tar.xz") (0, node_child_process.execFileSync)("tar", [
-			"-xJf",
-			tmpArchive,
-			"-C",
-			tmpExtractDir
-		], { stdio: "pipe" });
-		else (0, node_child_process.execFileSync)("tar", [
-			"-xzf",
-			tmpArchive,
-			"-C",
-			tmpExtractDir
-		], { stdio: "pipe" });
+		extractArchive(tmpArchive, ext, tmpExtractDir);
 		if (archiveInnerPath) {
 			const { copyFileSync } = await import("node:fs");
 			let sourcePath = (0, node_path.join)(tmpExtractDir, archiveInnerPath);
 			if (!(0, node_fs.existsSync)(sourcePath)) {
-				const found = findFileByName(tmpExtractDir, name);
+				const found = findFileByName(tmpExtractDir, targetName) ?? findFileByName(tmpExtractDir, name);
 				if (found === null) throw new Error(`Binary "${name}" not found in archive (tried inner path "${archiveInnerPath}" and a recursive search)`);
 				sourcePath = found;
 			}
@@ -163,7 +290,7 @@ async function downloadBinary(opts) {
 		});
 	} else {
 		await (0, node_stream_promises.pipeline)(node_stream.Readable.fromWeb(response.body), (0, node_fs.createWriteStream)(targetPath));
-		verifyChecksum(targetPath, opts.sha256, name, url);
+		verifySha256(targetPath, opts.sha256, name, url);
 	}
 	(0, node_fs.chmodSync)(targetPath, 493);
 	logger.info("Binary downloaded", { meta: {
@@ -392,6 +519,135 @@ async function ensureFfmpeg(dataDir, logger) {
 	return path;
 }
 //#endregion
+//#region src/util/owner-only-file.ts
+/**
+* Files only their owner may read: the one place a secret-bearing file is
+* restricted, on every OS.
+*
+* `mode: 0o600` is a POSIX idea. On Windows Node maps it to the read-only
+* attribute and nothing else, and `chmod` is a no-op for permissions, so a
+* "0600" `agent.json` (the cluster secret, the mesh private key) would have
+* been readable by every local user. Windows has its own tool for this:
+* `icacls`. This module removes the inherited ACL entries and grants access to
+* the current user and SYSTEM only — the Windows reading of "0600".
+*
+* ZERO imports beyond Node built-ins, on purpose: the Electron shell bundles
+* this single file (see `packages/desktop/tsup.config.ts`) instead of the
+* whole `@camstack/types` barrel.
+*
+* Failure is NOT swallowed. A secret file that could not be restricted is a
+* secret file the caller must know about, so `OwnerOnlyError` propagates; the
+* write order below makes sure nothing sensitive is in the file yet when that
+* happens (the temp file is empty until it has been restricted).
+*
+* Out of scope on purpose: files that are only tidy, not secret (the job
+* journal, the addon manifest) keep a plain `mode`, since one `icacls` per
+* write would be a process spawn on a hot path.
+*/
+/** `*S-1-5-18` is SYSTEM in every locale — a name like "SYSTEM" is not. */
+var WINDOWS_SYSTEM_SID = "*S-1-5-18";
+var FILE_MODE = 384;
+var DIR_MODE = 448;
+var OwnerOnlyError = class extends Error {
+	target;
+	constructor(target, detail) {
+		super(`could not restrict ${target} to its owner: ${detail}`);
+		this.target = target;
+		this.name = "OwnerOnlyError";
+	}
+};
+function currentPrincipal() {
+	const user = process.env["USERNAME"] ?? (0, node_os.userInfo)().username;
+	const domain = process.env["USERDOMAIN"];
+	return domain !== void 0 && domain.length > 0 ? `${domain}\\${user}` : user;
+}
+/** Resolved per call, not at import: a platform stubbed by a test must be seen. */
+function resolveDeps(overrides) {
+	return {
+		platform: process.platform,
+		exec: (file, args) => {
+			(0, node_child_process.execFileSync)(file, [...args], {
+				stdio: "pipe",
+				windowsHide: true
+			});
+		},
+		principal: currentPrincipal,
+		systemRoot: process.env["SystemRoot"],
+		...overrides
+	};
+}
+/** The icacls argv for one path: no inheritance, owner + SYSTEM only. */
+function icaclsArgs(target, principal, isDirectory) {
+	const inherit = isDirectory ? "(OI)(CI)" : "";
+	return [
+		target,
+		"/inheritance:r",
+		"/grant:r",
+		`${principal}:${inherit}F`,
+		"/grant:r",
+		`${WINDOWS_SYSTEM_SID}:${inherit}F`
+	];
+}
+function restrictWindows(target, isDirectory, deps) {
+	const icacls = node_path.win32.join(deps.systemRoot ?? "C:\\Windows", "System32", "icacls.exe");
+	try {
+		deps.exec(icacls, icaclsArgs(target, deps.principal(), isDirectory));
+	} catch (err) {
+		throw new OwnerOnlyError(target, err instanceof Error ? err.message : String(err));
+	}
+}
+/** Restrict an existing file to its owner (chmod 0600 / owner+SYSTEM ACL). */
+function restrictFileToOwnerSync(target, overrides = {}) {
+	const deps = resolveDeps(overrides);
+	if (deps.platform === "win32") {
+		restrictWindows(target, false, deps);
+		return;
+	}
+	node_fs.chmodSync(target, FILE_MODE);
+}
+/** Restrict an existing directory to its owner (chmod 0700 / owner+SYSTEM, inherited). */
+function restrictDirToOwnerSync(target, overrides = {}) {
+	const deps = resolveDeps(overrides);
+	if (deps.platform === "win32") {
+		restrictWindows(target, true, deps);
+		return;
+	}
+	node_fs.chmodSync(target, DIR_MODE);
+}
+/** Create `dir` (and parents) readable by its owner only. */
+function mkdirOwnerOnlySync(dir, overrides = {}) {
+	const deps = resolveDeps(overrides);
+	node_fs.mkdirSync(dir, {
+		recursive: true,
+		mode: DIR_MODE
+	});
+	if (deps.platform === "win32") {
+		restrictWindows(dir, true, deps);
+		return;
+	}
+	node_fs.chmodSync(dir, DIR_MODE);
+}
+/**
+* Atomically write a secret-bearing file that only its owner can read.
+*
+* Order matters: the temp file is created EMPTY, restricted, and only then
+* given its content, so there is no moment at which the secret exists under a
+* permissive ACL. The rename carries the (already restricted) ACL with it.
+*/
+function writeOwnerOnlyFileSync(target, data, overrides = {}) {
+	node_fs.mkdirSync(node_path.dirname(target), { recursive: true });
+	const tmp = `${target}.tmp.${process.pid}`;
+	node_fs.writeFileSync(tmp, "", { mode: FILE_MODE });
+	try {
+		restrictFileToOwnerSync(tmp, overrides);
+		node_fs.writeFileSync(tmp, data);
+		node_fs.renameSync(tmp, target);
+	} catch (err) {
+		node_fs.rmSync(tmp, { force: true });
+		throw err;
+	}
+}
+//#endregion
 //#region src/deps/python-downloader.ts
 /**
 * Download portable Python (headless) from bjia56/portable-python.
@@ -407,11 +663,26 @@ async function ensureFfmpeg(dataDir, logger) {
 * The zip's top-level dir is platform-specific (e.g.
 * `python-headless-3.12.12-darwin-universal2/`); after extraction
 * we rename it to a stable `python/` so consumers can rely on
-* `<dataDir>/deps/python/bin/python3`.
+* `<dataDir>/deps/python/bin/python3` (`bin/python.exe` on Windows: that build
+* keeps its launcher in `bin/` beside the DLLs, with `Lib/` at the root, so
+* `<root>/bin/<interpreter>` holds on every platform).
 */
 var PYTHON_VERSION = "3.12.12";
 var PP_BASE = `https://github.com/bjia56/portable-python/releases/download/cpython-v${PYTHON_VERSION}-build.0`;
-function getPythonDownloadUrl(platform, arch) {
+/**
+* One pinned artifact per target. The publisher ships no checksums on its
+* assets, so these are ours, taken (`shasum -a 256`) when the version was
+* pinned; the download is verified against them before a byte is extracted.
+* The Windows build is the same upstream, release and `headless` variant.
+*/
+var PYTHON_SHA256 = {
+	"linux-x86_64": "b618bcf490ab24fcfcd8f69e091b9d6f3ba23279dd1255aa258617a4d2af6fb7",
+	"linux-aarch64": "de204124ee834851c77e3392b00c3950869d349f99dbc7345f8cd5959bdee5bf",
+	"darwin-universal2": "7de186d2f865c9c9544dab2cf56d38de99767e243ed21ed7e1b0c31451783584",
+	"windows-x86_64": "84c10dd1a202da4694f41a1f99aee359c7c1276355937401d2f8facd9567d026"
+};
+/** The upstream target token for a platform/arch, e.g. `windows-x86_64`. */
+function pythonTarget(platform, arch) {
 	switch (platform) {
 		case "linux": {
 			const a = {
@@ -419,12 +690,28 @@ function getPythonDownloadUrl(platform, arch) {
 				arm64: "aarch64"
 			}[arch];
 			if (!a) throw new Error(`Unsupported Linux architecture for Python: ${arch}`);
-			return `${PP_BASE}/python-headless-${PYTHON_VERSION}-linux-${a}.zip`;
+			return `linux-${a}`;
 		}
-		case "darwin": return `${PP_BASE}/python-headless-${PYTHON_VERSION}-darwin-universal2.zip`;
+		case "darwin": return "darwin-universal2";
+		case "win32":
+			if (arch !== "x64") throw new Error(`Unsupported Windows architecture for Python: ${arch}`);
+			return "windows-x86_64";
 		default: throw new Error(`Unsupported platform for portable Python: ${platform}`);
 	}
 }
+function getPythonDownloadUrl(platform, arch) {
+	return `${PP_BASE}/python-headless-${PYTHON_VERSION}-${pythonTarget(platform, arch)}.zip`;
+}
+/** The SHA-256 the archive for this platform/arch must have. */
+function getPythonSha256(platform, arch) {
+	const sha = PYTHON_SHA256[pythonTarget(platform, arch)];
+	if (sha === void 0) throw new Error(`No pinned checksum for Python on ${platform}-${arch}`);
+	return sha;
+}
+/** The interpreter's path relative to the install root. */
+function pythonInterpreterSegments(platform) {
+	return platform === "win32" ? ["bin", "python.exe"] : ["bin", "python3"];
+}
 /**
 * Ensure the embedded portable Python is available.
 *
@@ -439,7 +726,7 @@ function getPythonDownloadUrl(platform, arch) {
 */
 async function ensurePython(dataDir, logger) {
 	const pythonDir = (0, node_path.join)(dataDir, "deps", "python");
-	const pythonBin = (0, node_path.join)(pythonDir, "bin", "python3");
+	const pythonBin = (0, node_path.join)(pythonDir, ...pythonInterpreterSegments(process.platform));
 	if ((0, node_fs.existsSync)(pythonBin)) {
 		logger.debug("Portable Python found", { meta: { pythonBin } });
 		return pythonBin;
@@ -456,27 +743,12 @@ async function ensurePython(dataDir, logger) {
 		return null;
 	}
 	await (0, node_stream_promises.pipeline)(node_stream.Readable.fromWeb(response.body), (0, node_fs.createWriteStream)(tmpArchive));
-	try {
-		(0, node_child_process.execFileSync)("unzip", [
-			"-o",
-			"-q",
-			tmpArchive,
-			"-d",
-			depsDir
-		], { stdio: "pipe" });
-	} catch {
-		(0, node_child_process.execFileSync)("python3", [
-			"-m",
-			"zipfile",
-			"-e",
-			tmpArchive,
-			depsDir
-		], { stdio: "pipe" });
-	}
+	verifySha256(tmpArchive, getPythonSha256(process.platform, process.arch), "python", url);
+	extractArchive(tmpArchive, "zip", depsDir);
 	const { unlinkSync } = await import("node:fs");
 	unlinkSync(tmpArchive);
 	if (!(0, node_fs.existsSync)(pythonBin)) {
-		const candidates = (0, node_fs.readdirSync)(depsDir).filter((name) => name.startsWith("python-") && (0, node_fs.existsSync)((0, node_path.join)(depsDir, name, "bin", "python3")));
+		const candidates = (0, node_fs.readdirSync)(depsDir).filter((name) => name.startsWith("python-") && (0, node_fs.existsSync)((0, node_path.join)(depsDir, name, ...pythonInterpreterSegments(process.platform))));
 		if (candidates.length === 0) {
 			logger.warn("Python extraction succeeded but no python3 binary found in any subdir", { meta: { depsDir } });
 			return null;
@@ -2006,6 +2278,7 @@ exports.Fmp4FragmentChild = Fmp4FragmentChild;
 exports.Fmp4FragmentPlane = Fmp4FragmentPlane;
 exports.NO_COST_CLAIM = NO_COST_CLAIM;
 exports.NO_PINNED_FFMPEG_DETAIL = NO_PINNED_FFMPEG_DETAIL;
+exports.OwnerOnlyError = OwnerOnlyError;
 exports.PYTHON_VERSION = PYTHON_VERSION;
 exports.buildBinaryPath = buildBinaryPath;
 exports.canonicalDeviceFingerprint = canonicalDeviceFingerprint;
@@ -2022,8 +2295,10 @@ exports.getFfmpegArtifact = require_composition.getFfmpegArtifact;
 exports.getFfmpegDownloadUrl = require_composition.getFfmpegDownloadUrl;
 exports.getPlatformInfo = getPlatformInfo;
 exports.getPythonDownloadUrl = getPythonDownloadUrl;
+exports.icaclsArgs = icaclsArgs;
 exports.installPythonPackages = installPythonPackages;
 exports.installPythonRequirements = installPythonRequirements;
+exports.mkdirOwnerOnlySync = mkdirOwnerOnlySync;
 exports.nodeProcStatReader = nodeProcStatReader;
 exports.parseFfmpegCapabilities = parseFfmpegCapabilities;
 exports.parseProcCpuSeconds = parseProcCpuSeconds;
@@ -2034,6 +2309,9 @@ exports.probeFfmpegBinary = probeFfmpegBinary;
 exports.readProcessCost = readProcessCost;
 exports.resolveExportFingerprint = resolveExportFingerprint;
 exports.resolvePinnedFfmpegSpawner = resolvePinnedFfmpegSpawner;
+exports.restrictDirToOwnerSync = restrictDirToOwnerSync;
+exports.restrictFileToOwnerSync = restrictFileToOwnerSync;
 exports.signExpiringUrl = signExpiringUrl;
 exports.verifyExpiringUrl = verifyExpiringUrl;
 exports.writeFileAtomic = writeFileAtomic;
+exports.writeOwnerOnlyFileSync = writeOwnerOnlyFileSync;