@camstack/types 1.2.354 → 1.2.356

package/dist/node.mjs

@@ -1,14 +1,168 @@
-import { At as Fmp4BoxSplitter, Ct as FFMPEG_PATH_ENV, Dt as getFfmpegArtifact, Et as FFMPEG_RELEASE, Ot as getFfmpegDownloadUrl, P as compositionSourceKey, Pt as buildFfmpegArgs, Rt as isSoftwareDecode, Tt as ffmpegBinaryName, a as CUSTOMIZATION_BLOCK_NAME_PREFIX, kt as canonicalHash, wt as chooseFfmpegBinary } from "./composition-Bzr7GwgP.mjs";
+import { At as Fmp4BoxSplitter, Ct as FFMPEG_PATH_ENV, Dt as getFfmpegArtifact, Et as FFMPEG_RELEASE, Ot as getFfmpegDownloadUrl, P as compositionSourceKey, Pt as buildFfmpegArgs, Rt as isSoftwareDecode, Tt as ffmpegBinaryName, a as CUSTOMIZATION_BLOCK_NAME_PREFIX, kt as canonicalHash, wt as chooseFfmpegBinary } from "./composition-C-WpVYTX.mjs";
 import { t as errMsg } from "./err-msg-DX6i_MY4.mjs";
 import { createHash, createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import * as fs from "node:fs";
 import { chmodSync, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import * as path$1 from "node:path";
-import path, { basename, join } from "node:path";
+import path, { basename, dirname, join, resolve, sep } from "node:path";
 import { pipeline } from "node:stream/promises";
 import { Readable } from "node:stream";
 import { execFile, execFileSync, spawn } from "node:child_process";
+import { crc32, inflateRawSync } from "node:zlib";
+import { userInfo } from "node:os";
 import { readFile } from "node:fs/promises";
+//#region src/deps/zip-extract.ts
+/**
+* A zip extractor with no external binary behind it.
+*
+* Why it exists: on Windows there is no `unzip`, and the `tar` that is on PATH
+* is whichever the machine has (Git for Windows ships a GNU tar that cannot
+* read a zip). The two archives a Windows node downloads — the portable Python
+* and the ffmpeg build — are both zips, so the extraction is done here, with
+* `node:zlib`, instead of by a program the machine may not have.
+*
+* Scope is deliberately narrow: stored and deflated entries, no encryption, no
+* zip64. Both are refused by NAME rather than mis-read. Symlinks and unix modes
+* are not restored — POSIX hosts keep using `unzip`, which does.
+*/
+var EOCD_SIGNATURE = 101010256;
+var CENTRAL_SIGNATURE = 33639248;
+var LOCAL_SIGNATURE = 67324752;
+var EOCD_MIN_BYTES = 22;
+/** The end-of-central-directory record is within the last 22 + 65535 bytes. */
+var EOCD_SEARCH_BYTES = 65557;
+var ZIP64_SENTINEL = 4294967295;
+var METHOD_STORED = 0;
+var METHOD_DEFLATE = 8;
+var FLAG_ENCRYPTED = 1;
+function findEndOfCentralDirectory(buf) {
+	const lowest = Math.max(0, buf.length - EOCD_SEARCH_BYTES);
+	for (let i = buf.length - EOCD_MIN_BYTES; i >= lowest; i--) if (buf.readUInt32LE(i) === EOCD_SIGNATURE) return i;
+	throw new Error("not a zip archive: no end-of-central-directory record");
+}
+function readEntries(buf) {
+	const eocd = findEndOfCentralDirectory(buf);
+	const count = buf.readUInt16LE(eocd + 10);
+	let offset = buf.readUInt32LE(eocd + 16);
+	if (count === 65535 || offset === ZIP64_SENTINEL) throw new Error("zip64 archives are not supported");
+	const entries = [];
+	for (let n = 0; n < count; n++) {
+		if (buf.readUInt32LE(offset) !== CENTRAL_SIGNATURE) throw new Error(`corrupt zip: bad central directory entry ${n}`);
+		if ((buf.readUInt16LE(offset + 8) & FLAG_ENCRYPTED) !== 0) throw new Error("encrypted zip entries are not supported");
+		const compressedSize = buf.readUInt32LE(offset + 20);
+		const uncompressedSize = buf.readUInt32LE(offset + 24);
+		const localHeaderOffset = buf.readUInt32LE(offset + 42);
+		if (compressedSize === ZIP64_SENTINEL || uncompressedSize === ZIP64_SENTINEL || localHeaderOffset === ZIP64_SENTINEL) throw new Error("zip64 entries are not supported");
+		const nameLength = buf.readUInt16LE(offset + 28);
+		const extraLength = buf.readUInt16LE(offset + 30);
+		const commentLength = buf.readUInt16LE(offset + 32);
+		entries.push({
+			name: buf.toString("utf8", offset + 46, offset + 46 + nameLength),
+			method: buf.readUInt16LE(offset + 10),
+			crc: buf.readUInt32LE(offset + 16),
+			compressedSize,
+			uncompressedSize,
+			localHeaderOffset
+		});
+		offset += 46 + nameLength + extraLength + commentLength;
+	}
+	return entries;
+}
+function readEntryData(buf, entry) {
+	const at = entry.localHeaderOffset;
+	if (buf.readUInt32LE(at) !== LOCAL_SIGNATURE) throw new Error(`corrupt zip: bad local header for ${entry.name}`);
+	const start = at + 30 + buf.readUInt16LE(at + 26) + buf.readUInt16LE(at + 28);
+	const raw = buf.subarray(start, start + entry.compressedSize);
+	let data;
+	if (entry.method === METHOD_STORED) data = raw;
+	else if (entry.method === METHOD_DEFLATE) data = inflateRawSync(raw);
+	else throw new Error(`unsupported zip compression method ${entry.method} for ${entry.name}`);
+	if (data.length !== entry.uncompressedSize || crc32(data) !== entry.crc) throw new Error(`corrupt zip: ${entry.name} does not match its recorded size/CRC`);
+	return data;
+}
+/**
+* Where an entry lands, or a refusal when its name climbs out of `destDir`
+* (a "zip slip": `..\..\evil.dll`, an absolute path, a drive letter).
+*/
+function targetPath(destDir, entryName) {
+	const root = resolve(destDir);
+	const target = resolve(root, entryName.replace(/\\/g, "/"));
+	if (target !== root && !target.startsWith(root + sep)) throw new Error(`zip entry escapes the target directory: ${entryName}`);
+	return target;
+}
+function extractZipArchive(archivePath, destDir) {
+	const buf = readFileSync(archivePath);
+	mkdirSync(destDir, { recursive: true });
+	for (const entry of readEntries(buf)) {
+		const target = targetPath(destDir, entry.name);
+		if (entry.name.endsWith("/") || entry.name.endsWith("\\")) {
+			mkdirSync(target, { recursive: true });
+			continue;
+		}
+		mkdirSync(dirname(target), { recursive: true });
+		writeFileSync(target, readEntryData(buf, entry));
+	}
+}
+//#endregion
+//#region src/deps/archive-extract.ts
+/**
+* The one place an archive a node downloaded is unpacked.
+*
+* POSIX hosts keep their native tools (`unzip` restores modes and symlinks,
+* which the portable Python relies on). Windows has neither a guaranteed
+* `unzip` nor a guaranteed zip-capable `tar` on PATH, so a zip is unpacked by
+* the in-process extractor, and a tarball by the `tar.exe` Windows ships in
+* System32 (bsdtar) — addressed by absolute path so a GNU tar that Git for
+* Windows put earlier on PATH cannot shadow it.
+*/
+var defaultDeps = {
+	platform: process.platform,
+	systemRoot: process.env["SystemRoot"],
+	exec: (file, args) => execFileSync(file, [...args], { stdio: "pipe" }),
+	extractZip: extractZipArchive
+};
+/** The tar to run: Windows' own bsdtar by absolute path, `tar` elsewhere. */
+function tarExecutable(platform, systemRoot) {
+	if (platform !== "win32") return "tar";
+	return join(systemRoot ?? "C:\\Windows", "System32", "tar.exe");
+}
+function extractArchive(archivePath, format, destDir, overrides = {}) {
+	const deps = {
+		...defaultDeps,
+		...overrides
+	};
+	const tar = tarExecutable(deps.platform, deps.systemRoot);
+	if (format === "zip") {
+		if (deps.platform === "win32") {
+			deps.extractZip(archivePath, destDir);
+			return;
+		}
+		try {
+			deps.exec("unzip", [
+				"-o",
+				"-q",
+				archivePath,
+				"-d",
+				destDir
+			]);
+		} catch {
+			deps.exec(tar, [
+				"-xf",
+				archivePath,
+				"-C",
+				destDir
+			]);
+		}
+		return;
+	}
+	deps.exec(tar, [
+		format === "tar.xz" ? "-xJf" : "-xzf",
+		archivePath,
+		"-C",
+		destDir
+	]);
+}
+//#endregion
 //#region src/deps/binary-downloader.ts
 /**
 * Recursively find the first file named exactly `name` under `dir`. Used as the
@@ -57,7 +211,7 @@ function findInPath(name) {
 * verified" is the only state in which running this binary is worse than not
 * having it. The partial file is removed so a retry cannot pick it up.
 */
-function verifyChecksum(file, expected, name, url) {
+function verifySha256(file, expected, name, url) {
 	if (expected === void 0) return;
 	const actual = createHash("sha256").update(readFileSync(file)).digest("hex");
 	if (actual === expected) return;
@@ -91,42 +245,15 @@ async function downloadBinary(opts) {
 		const ext = archiveFormat ?? "tar.gz";
 		const tmpArchive = join(targetDir, `${name}-download.${ext}`);
 		await pipeline(Readable.fromWeb(response.body), createWriteStream(tmpArchive));
-		verifyChecksum(tmpArchive, opts.sha256, name, url);
+		verifySha256(tmpArchive, opts.sha256, name, url);
 		const tmpExtractDir = join(targetDir, `${name}-extract`);
 		mkdirSync(tmpExtractDir, { recursive: true });
-		if (ext === "zip") try {
-			execFileSync("unzip", [
-				"-o",
-				"-q",
-				tmpArchive,
-				"-d",
-				tmpExtractDir
-			], { stdio: "pipe" });
-		} catch {
-			execFileSync("tar", [
-				"-xf",
-				tmpArchive,
-				"-C",
-				tmpExtractDir
-			], { stdio: "pipe" });
-		}
-		else if (ext === "tar.xz") execFileSync("tar", [
-			"-xJf",
-			tmpArchive,
-			"-C",
-			tmpExtractDir
-		], { stdio: "pipe" });
-		else execFileSync("tar", [
-			"-xzf",
-			tmpArchive,
-			"-C",
-			tmpExtractDir
-		], { stdio: "pipe" });
+		extractArchive(tmpArchive, ext, tmpExtractDir);
 		if (archiveInnerPath) {
 			const { copyFileSync } = await import("node:fs");
 			let sourcePath = join(tmpExtractDir, archiveInnerPath);
 			if (!existsSync(sourcePath)) {
-				const found = findFileByName(tmpExtractDir, name);
+				const found = findFileByName(tmpExtractDir, targetName) ?? findFileByName(tmpExtractDir, name);
 				if (found === null) throw new Error(`Binary "${name}" not found in archive (tried inner path "${archiveInnerPath}" and a recursive search)`);
 				sourcePath = found;
 			}
@@ -140,7 +267,7 @@ async function downloadBinary(opts) {
 		});
 	} else {
 		await pipeline(Readable.fromWeb(response.body), createWriteStream(targetPath));
-		verifyChecksum(targetPath, opts.sha256, name, url);
+		verifySha256(targetPath, opts.sha256, name, url);
 	}
 	chmodSync(targetPath, 493);
 	logger.info("Binary downloaded", { meta: {
@@ -369,6 +496,135 @@ async function ensureFfmpeg(dataDir, logger) {
 	return path;
 }
 //#endregion
+//#region src/util/owner-only-file.ts
+/**
+* Files only their owner may read: the one place a secret-bearing file is
+* restricted, on every OS.
+*
+* `mode: 0o600` is a POSIX idea. On Windows Node maps it to the read-only
+* attribute and nothing else, and `chmod` is a no-op for permissions, so a
+* "0600" `agent.json` (the cluster secret, the mesh private key) would have
+* been readable by every local user. Windows has its own tool for this:
+* `icacls`. This module removes the inherited ACL entries and grants access to
+* the current user and SYSTEM only — the Windows reading of "0600".
+*
+* ZERO imports beyond Node built-ins, on purpose: the Electron shell bundles
+* this single file (see `packages/desktop/tsup.config.ts`) instead of the
+* whole `@camstack/types` barrel.
+*
+* Failure is NOT swallowed. A secret file that could not be restricted is a
+* secret file the caller must know about, so `OwnerOnlyError` propagates; the
+* write order below makes sure nothing sensitive is in the file yet when that
+* happens (the temp file is empty until it has been restricted).
+*
+* Out of scope on purpose: files that are only tidy, not secret (the job
+* journal, the addon manifest) keep a plain `mode`, since one `icacls` per
+* write would be a process spawn on a hot path.
+*/
+/** `*S-1-5-18` is SYSTEM in every locale — a name like "SYSTEM" is not. */
+var WINDOWS_SYSTEM_SID = "*S-1-5-18";
+var FILE_MODE = 384;
+var DIR_MODE = 448;
+var OwnerOnlyError = class extends Error {
+	target;
+	constructor(target, detail) {
+		super(`could not restrict ${target} to its owner: ${detail}`);
+		this.target = target;
+		this.name = "OwnerOnlyError";
+	}
+};
+function currentPrincipal() {
+	const user = process.env["USERNAME"] ?? userInfo().username;
+	const domain = process.env["USERDOMAIN"];
+	return domain !== void 0 && domain.length > 0 ? `${domain}\\${user}` : user;
+}
+/** Resolved per call, not at import: a platform stubbed by a test must be seen. */
+function resolveDeps(overrides) {
+	return {
+		platform: process.platform,
+		exec: (file, args) => {
+			execFileSync(file, [...args], {
+				stdio: "pipe",
+				windowsHide: true
+			});
+		},
+		principal: currentPrincipal,
+		systemRoot: process.env["SystemRoot"],
+		...overrides
+	};
+}
+/** The icacls argv for one path: no inheritance, owner + SYSTEM only. */
+function icaclsArgs(target, principal, isDirectory) {
+	const inherit = isDirectory ? "(OI)(CI)" : "";
+	return [
+		target,
+		"/inheritance:r",
+		"/grant:r",
+		`${principal}:${inherit}F`,
+		"/grant:r",
+		`${WINDOWS_SYSTEM_SID}:${inherit}F`
+	];
+}
+function restrictWindows(target, isDirectory, deps) {
+	const icacls = path$1.win32.join(deps.systemRoot ?? "C:\\Windows", "System32", "icacls.exe");
+	try {
+		deps.exec(icacls, icaclsArgs(target, deps.principal(), isDirectory));
+	} catch (err) {
+		throw new OwnerOnlyError(target, err instanceof Error ? err.message : String(err));
+	}
+}
+/** Restrict an existing file to its owner (chmod 0600 / owner+SYSTEM ACL). */
+function restrictFileToOwnerSync(target, overrides = {}) {
+	const deps = resolveDeps(overrides);
+	if (deps.platform === "win32") {
+		restrictWindows(target, false, deps);
+		return;
+	}
+	fs.chmodSync(target, FILE_MODE);
+}
+/** Restrict an existing directory to its owner (chmod 0700 / owner+SYSTEM, inherited). */
+function restrictDirToOwnerSync(target, overrides = {}) {
+	const deps = resolveDeps(overrides);
+	if (deps.platform === "win32") {
+		restrictWindows(target, true, deps);
+		return;
+	}
+	fs.chmodSync(target, DIR_MODE);
+}
+/** Create `dir` (and parents) readable by its owner only. */
+function mkdirOwnerOnlySync(dir, overrides = {}) {
+	const deps = resolveDeps(overrides);
+	fs.mkdirSync(dir, {
+		recursive: true,
+		mode: DIR_MODE
+	});
+	if (deps.platform === "win32") {
+		restrictWindows(dir, true, deps);
+		return;
+	}
+	fs.chmodSync(dir, DIR_MODE);
+}
+/**
+* Atomically write a secret-bearing file that only its owner can read.
+*
+* Order matters: the temp file is created EMPTY, restricted, and only then
+* given its content, so there is no moment at which the secret exists under a
+* permissive ACL. The rename carries the (already restricted) ACL with it.
+*/
+function writeOwnerOnlyFileSync(target, data, overrides = {}) {
+	fs.mkdirSync(path$1.dirname(target), { recursive: true });
+	const tmp = `${target}.tmp.${process.pid}`;
+	fs.writeFileSync(tmp, "", { mode: FILE_MODE });
+	try {
+		restrictFileToOwnerSync(tmp, overrides);
+		fs.writeFileSync(tmp, data);
+		fs.renameSync(tmp, target);
+	} catch (err) {
+		fs.rmSync(tmp, { force: true });
+		throw err;
+	}
+}
+//#endregion
 //#region src/deps/python-downloader.ts
 /**
 * Download portable Python (headless) from bjia56/portable-python.
@@ -384,11 +640,26 @@ async function ensureFfmpeg(dataDir, logger) {
 * The zip's top-level dir is platform-specific (e.g.
 * `python-headless-3.12.12-darwin-universal2/`); after extraction
 * we rename it to a stable `python/` so consumers can rely on
-* `<dataDir>/deps/python/bin/python3`.
+* `<dataDir>/deps/python/bin/python3` (`bin/python.exe` on Windows: that build
+* keeps its launcher in `bin/` beside the DLLs, with `Lib/` at the root, so
+* `<root>/bin/<interpreter>` holds on every platform).
 */
 var PYTHON_VERSION = "3.12.12";
 var PP_BASE = `https://github.com/bjia56/portable-python/releases/download/cpython-v${PYTHON_VERSION}-build.0`;
-function getPythonDownloadUrl(platform, arch) {
+/**
+* One pinned artifact per target. The publisher ships no checksums on its
+* assets, so these are ours, taken (`shasum -a 256`) when the version was
+* pinned; the download is verified against them before a byte is extracted.
+* The Windows build is the same upstream, release and `headless` variant.
+*/
+var PYTHON_SHA256 = {
+	"linux-x86_64": "b618bcf490ab24fcfcd8f69e091b9d6f3ba23279dd1255aa258617a4d2af6fb7",
+	"linux-aarch64": "de204124ee834851c77e3392b00c3950869d349f99dbc7345f8cd5959bdee5bf",
+	"darwin-universal2": "7de186d2f865c9c9544dab2cf56d38de99767e243ed21ed7e1b0c31451783584",
+	"windows-x86_64": "84c10dd1a202da4694f41a1f99aee359c7c1276355937401d2f8facd9567d026"
+};
+/** The upstream target token for a platform/arch, e.g. `windows-x86_64`. */
+function pythonTarget(platform, arch) {
 	switch (platform) {
 		case "linux": {
 			const a = {
@@ -396,12 +667,28 @@ function getPythonDownloadUrl(platform, arch) {
 				arm64: "aarch64"
 			}[arch];
 			if (!a) throw new Error(`Unsupported Linux architecture for Python: ${arch}`);
-			return `${PP_BASE}/python-headless-${PYTHON_VERSION}-linux-${a}.zip`;
+			return `linux-${a}`;
 		}
-		case "darwin": return `${PP_BASE}/python-headless-${PYTHON_VERSION}-darwin-universal2.zip`;
+		case "darwin": return "darwin-universal2";
+		case "win32":
+			if (arch !== "x64") throw new Error(`Unsupported Windows architecture for Python: ${arch}`);
+			return "windows-x86_64";
 		default: throw new Error(`Unsupported platform for portable Python: ${platform}`);
 	}
 }
+function getPythonDownloadUrl(platform, arch) {
+	return `${PP_BASE}/python-headless-${PYTHON_VERSION}-${pythonTarget(platform, arch)}.zip`;
+}
+/** The SHA-256 the archive for this platform/arch must have. */
+function getPythonSha256(platform, arch) {
+	const sha = PYTHON_SHA256[pythonTarget(platform, arch)];
+	if (sha === void 0) throw new Error(`No pinned checksum for Python on ${platform}-${arch}`);
+	return sha;
+}
+/** The interpreter's path relative to the install root. */
+function pythonInterpreterSegments(platform) {
+	return platform === "win32" ? ["bin", "python.exe"] : ["bin", "python3"];
+}
 /**
 * Ensure the embedded portable Python is available.
 *
@@ -416,7 +703,7 @@ function getPythonDownloadUrl(platform, arch) {
 */
 async function ensurePython(dataDir, logger) {
 	const pythonDir = join(dataDir, "deps", "python");
-	const pythonBin = join(pythonDir, "bin", "python3");
+	const pythonBin = join(pythonDir, ...pythonInterpreterSegments(process.platform));
 	if (existsSync(pythonBin)) {
 		logger.debug("Portable Python found", { meta: { pythonBin } });
 		return pythonBin;
@@ -433,27 +720,12 @@ async function ensurePython(dataDir, logger) {
 		return null;
 	}
 	await pipeline(Readable.fromWeb(response.body), createWriteStream(tmpArchive));
-	try {
-		execFileSync("unzip", [
-			"-o",
-			"-q",
-			tmpArchive,
-			"-d",
-			depsDir
-		], { stdio: "pipe" });
-	} catch {
-		execFileSync("python3", [
-			"-m",
-			"zipfile",
-			"-e",
-			tmpArchive,
-			depsDir
-		], { stdio: "pipe" });
-	}
+	verifySha256(tmpArchive, getPythonSha256(process.platform, process.arch), "python", url);
+	extractArchive(tmpArchive, "zip", depsDir);
 	const { unlinkSync } = await import("node:fs");
 	unlinkSync(tmpArchive);
 	if (!existsSync(pythonBin)) {
-		const candidates = readdirSync(depsDir).filter((name) => name.startsWith("python-") && existsSync(join(depsDir, name, "bin", "python3")));
+		const candidates = readdirSync(depsDir).filter((name) => name.startsWith("python-") && existsSync(join(depsDir, name, ...pythonInterpreterSegments(process.platform))));
 		if (candidates.length === 0) {
 			logger.warn("Python extraction succeeded but no python3 binary found in any subdir", { meta: { depsDir } });
 			return null;
@@ -1975,4 +2247,4 @@ function resolveExportFingerprint(input) {
 	return input.persisted ?? input.fresh;
 }
 //#endregion
-export { ChildCostRegistry, FFMPEG_RELEASE, FfmpegProcess, FilesystemStorageProvider, Fmp4FragmentChild, Fmp4FragmentPlane, NO_COST_CLAIM, NO_PINNED_FFMPEG_DETAIL, PYTHON_VERSION, buildBinaryPath, canonicalDeviceFingerprint, canonicalHash, containsOrEquals, customizationBlockName, diffExportTargets, downloadBinary, ensureBinary, ensureFfmpeg, ensurePython, findInPath, getFfmpegArtifact, getFfmpegDownloadUrl, getPlatformInfo, getPythonDownloadUrl, installPythonPackages, installPythonRequirements, nodeProcStatReader, parseFfmpegCapabilities, parseProcCpuSeconds, parseProcRssBytes, physicalRootOf, pinnedFfmpegSpawner, probeFfmpegBinary, readProcessCost, resolveExportFingerprint, resolvePinnedFfmpegSpawner, signExpiringUrl, verifyExpiringUrl, writeFileAtomic };
+export { ChildCostRegistry, FFMPEG_RELEASE, FfmpegProcess, FilesystemStorageProvider, Fmp4FragmentChild, Fmp4FragmentPlane, NO_COST_CLAIM, NO_PINNED_FFMPEG_DETAIL, OwnerOnlyError, PYTHON_VERSION, buildBinaryPath, canonicalDeviceFingerprint, canonicalHash, containsOrEquals, customizationBlockName, diffExportTargets, downloadBinary, ensureBinary, ensureFfmpeg, ensurePython, findInPath, getFfmpegArtifact, getFfmpegDownloadUrl, getPlatformInfo, getPythonDownloadUrl, icaclsArgs, installPythonPackages, installPythonRequirements, mkdirOwnerOnlySync, nodeProcStatReader, parseFfmpegCapabilities, parseProcCpuSeconds, parseProcRssBytes, physicalRootOf, pinnedFfmpegSpawner, probeFfmpegBinary, readProcessCost, resolveExportFingerprint, resolvePinnedFfmpegSpawner, restrictDirToOwnerSync, restrictFileToOwnerSync, signExpiringUrl, verifyExpiringUrl, writeFileAtomic, writeOwnerOnlyFileSync };