@canonmsg/agent-sdk 12.4.1 → 12.6.1

package/dist/chunks/chunk-HH7KR22P.js

@@ -0,0 +1,406 @@
+import {
+  MAX_OUTPUT,
+  NodeMlsDevCustodyError,
+  custodyFailure,
+  custodyValue,
+  frame,
+  requireValue,
+  typedNodeMlsDevCustody
+} from "./chunk-FVYKLH6I.js";
+import {
+  __name,
+  parseMlsDevDeviceContext
+} from "./chunk-S7BV74DN.js";
+
+// src/runner/home.ts
+import { randomBytes } from "node:crypto";
+import { closeSync, constants, existsSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync as mkdirSync2, openSync, readSync, renameSync, rmSync, writeFileSync, writeSync } from "node:fs";
+import { lstat, mkdir, realpath } from "node:fs/promises";
+import { dirname as dirname2 } from "node:path";
+
+// src/runner/windows-acl.ts
+import { execFileSync } from "node:child_process";
+import { mkdirSync, readdirSync, realpathSync } from "node:fs";
+import { dirname, join } from "node:path";
+var SYSTEM = "S-1-5-18";
+var ADMINISTRATORS = "S-1-5-32-544";
+var TRUSTED_INSTALLER = "S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464";
+var ALIASES = { SY: SYSTEM, BA: ADMINISTRATORS };
+var RIGHTS = {
+  GA: 268435456,
+  GX: 536870912,
+  GW: 1073741824,
+  GR: 2147483648,
+  SD: 65536,
+  RC: 131072,
+  WD: 262144,
+  WO: 524288,
+  FA: 2032127,
+  FR: 1179785,
+  FW: 1179926,
+  FX: 1179808,
+  CC: 1,
+  DC: 2,
+  LC: 4,
+  SW: 8,
+  RP: 16,
+  WP: 32,
+  DT: 64,
+  LO: 128,
+  CR: 256
+};
+var MOVE = 65536 | 262144 | 524288 | 64 | 268435456;
+var WRITE = MOVE | 2 | 4 | 16 | 256 | 1073741824;
+function rights(text) {
+  if (/^0x[0-9a-f]+$/i.test(text)) return Number(text);
+  let mask = 0;
+  for (const code of text.match(/../g) ?? []) mask |= RIGHTS[code] ?? 4294967295;
+  return mask;
+}
+__name(rights, "rights");
+function sddlProblem(sddl, self, rule) {
+  const parts = /^O:(.+?)G:.+?D:([A-Z_]*)((?:\([^()]*\))*)(?:S:.*)?$/.exec(sddl.trim());
+  if (!parts || parts[2].includes("NO_ACCESS_CONTROL")) return "has an access list this cannot read";
+  const sid = /* @__PURE__ */ __name((value) => ALIASES[value] ?? (value === "LA" && self.endsWith("-500") ? self : value), "sid");
+  const trusted = /* @__PURE__ */ new Set([self, SYSTEM, ADMINISTRATORS, ...rule === "private" ? [] : [TRUSTED_INSTALLER]]);
+  if (!trusted.has(sid(parts[1]))) return `is owned by ${sid(parts[1])}`;
+  for (const [, type, flags, mask, , , account] of parts[3].matchAll(/\(([A-Z]+);([A-Z]*);([^;]*);([^;]*);([^;]*);([^;)]*)\)/g)) {
+    if (type === "D") continue;
+    if (type !== "A") return "has an access list this cannot read";
+    if (trusted.has(sid(account))) continue;
+    if (rule !== "private" && /^(..)*IO/.test(flags)) continue;
+    if (rule === "private" || rights(mask) & (rule === "ancestor" ? MOVE : WRITE)) return `gives ${sid(account)} access`;
+  }
+  return void 0;
+}
+__name(sddlProblem, "sddlProblem");
+var tool = /* @__PURE__ */ __name((...path) => join(process.env.SystemRoot ?? "C:\\Windows", "System32", ...path), "tool");
+var run = /* @__PURE__ */ __name((file, args, env) => execFileSync(
+  file,
+  args,
+  { encoding: "utf8", windowsHide: true, stdio: ["ignore", "pipe", "pipe"], ...env ? { env } : {} }
+), "run");
+var current;
+function userSid() {
+  current ??= /"(S-1-[\d-]+)"\s*$/.exec(run(tool("whoami.exe"), ["/user", "/fo", "csv", "/nh"]).trim())?.[1];
+  if (!current) throw new Error("Refusing to start: whoami did not name this user's SID.");
+  return current;
+}
+__name(userSid, "userSid");
+function descriptors(paths) {
+  const output = run(
+    tool("WindowsPowerShell", "v1.0", "powershell.exe"),
+    [
+      "-NoLogo",
+      "-NoProfile",
+      "-NonInteractive",
+      "-Command",
+      '$ErrorActionPreference = "Stop"; foreach ($path in ($env:CANON_ACL_PATHS -split "`n")) { (Get-Acl -LiteralPath $path).Sddl }'
+    ],
+    { ...process.env, CANON_ACL_PATHS: paths.join("\n") }
+  );
+  const lines = output.split(/\r?\n/).filter(Boolean);
+  if (lines.length !== paths.length) throw new Error(`Refusing to start: could not read the access list of ${paths.join(", ")}.`);
+  return lines;
+}
+__name(descriptors, "descriptors");
+function windowsAclProblems(paths) {
+  const self = userSid(), found = descriptors(paths.map(([path]) => path));
+  return paths.flatMap(([path, rule], index) => {
+    const problem = sddlProblem(found[index], self, rule);
+    return problem ? [`${path} ${problem}`] : [];
+  });
+}
+__name(windowsAclProblems, "windowsAclProblems");
+function restrict(path, inherit) {
+  const grant = inherit ? ":(OI)(CI)F" : ":F";
+  run(tool("icacls.exe"), [path, "/inheritance:r", "/grant:r", `*${userSid()}${grant}`, `*${SYSTEM}${grant}`, `*${ADMINISTRATORS}${grant}`, "/Q"]);
+}
+__name(restrict, "restrict");
+var restrictWindowsFile = /* @__PURE__ */ __name((file) => restrict(file, false), "restrictWindowsFile");
+function assertPrivateWindowsFile(file) {
+  const [problem] = windowsAclProblems([[file, "private"], [dirname(file), "private"]]);
+  if (problem) throw new Error(`Refusing to start: ${problem}. It must be reachable only by this user, SYSTEM and Administrators.`);
+}
+__name(assertPrivateWindowsFile, "assertPrivateWindowsFile");
+function secureWindowsDirectory(directory) {
+  mkdirSync(directory, { recursive: true });
+  restrict(directory, true);
+  const [problem] = windowsAclProblems([[directory, "private"]]);
+  if (problem) throw new Error(`Refusing to start: ${problem}. It must be reachable only by this user, SYSTEM and Administrators.`);
+}
+__name(secureWindowsDirectory, "secureWindowsDirectory");
+function assertPrivateWindowsHome(home) {
+  const fail = /* @__PURE__ */ __name((problem2) => {
+    throw new Error(`Refusing to start: ${problem2}. CANON_HOME must be a local directory only this user, SYSTEM and Administrators can reach, whose parents no one else can replace, and hold nothing anyone else can reach. Remove what you did not put there. To limit one you own: icacls <directory> /inheritance:r /grant:r "%USERNAME%:(OI)(CI)F" *S-1-5-18:(OI)(CI)F *S-1-5-32-544:(OI)(CI)F /T`);
+  }, "fail");
+  if (!/^[a-z]:\\/i.test(home)) fail(`${home} is not on a local drive`);
+  if (mkdirSync(home, { recursive: true }) !== void 0) restrict(home, true);
+  const resolved = realpathSync.native(home);
+  if (resolved.toLowerCase() !== home.toLowerCase()) fail(`${home} is not canonical (it resolves to ${resolved})`);
+  const paths = [[home, "private"], ...readdirSync(home).map((name) => [join(home, name), "private"])];
+  for (let path = dirname(home); ; path = dirname(path)) {
+    paths.push([path, "ancestor"]);
+    if (path === dirname(path)) break;
+  }
+  const [problem] = windowsAclProblems(paths);
+  if (problem) fail(problem);
+}
+__name(assertPrivateWindowsHome, "assertPrivateWindowsHome");
+
+// src/runner/home.ts
+var runnerLockName = /* @__PURE__ */ __name((environmentId, agentId) => `runner-${environmentId}-${agentId}`.replace(/[^\w.-]/g, "_"), "runnerLockName");
+function writeDurable(file, text) {
+  const directory = dirname2(file);
+  const created = mkdirSync2(directory, { recursive: true, mode: 448 });
+  const temporary = `${file}.${process.pid}.tmp`;
+  const fd = openSync(temporary, "w", 384);
+  try {
+    writeFileSync(fd, text);
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+  renameSync(temporary, file);
+  if (process.platform === "win32") return;
+  const last = created ? dirname2(created) : directory;
+  for (let path = directory; ; path = dirname2(path)) {
+    const dir = openSync(path, "r");
+    try {
+      fsyncSync(dir);
+    } finally {
+      closeSync(dir);
+    }
+    if (path === last) break;
+  }
+}
+__name(writeDurable, "writeDurable");
+function privateKey(file, bytes = 32) {
+  if (process.platform !== "win32") return keyFile(file, bytes);
+  if (existsSync(file)) {
+    assertPrivateWindowsFile(file);
+    return keyFile(file, bytes);
+  }
+  secureWindowsDirectory(dirname2(file));
+  const key = keyFile(file, bytes);
+  restrictWindowsFile(file);
+  assertPrivateWindowsFile(file);
+  return key;
+}
+__name(privateKey, "privateKey");
+function keyFile(file, bytes = 32) {
+  const refuse = /* @__PURE__ */ __name(() => {
+    throw new Error(`Refusing to start: ${file} must be a regular file of ${bytes} bytes, owned by this user and private to it (0600).`);
+  }, "refuse");
+  const read = /* @__PURE__ */ __name(() => {
+    let fd2;
+    try {
+      if (process.platform === "win32" && lstatSync(file).isSymbolicLink()) refuse();
+      fd2 = openSync(file, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    } catch (error) {
+      return error.code === "ENOENT" ? void 0 : refuse();
+    }
+    try {
+      const info = fstatSync(fd2);
+      const uid = process.getuid?.();
+      if (!info.isFile() || info.size !== bytes || uid !== void 0 && (info.uid !== uid || (info.mode & 63) !== 0)) refuse();
+      const key = Buffer.alloc(bytes);
+      if (readSync(fd2, key, 0, bytes, 0) !== bytes) refuse();
+      return key;
+    } finally {
+      closeSync(fd2);
+    }
+  }, "read");
+  const existing = read();
+  if (existing) return existing;
+  const directory = dirname2(file);
+  mkdirSync2(directory, { recursive: true, mode: 448 });
+  const temporary = `${file}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`;
+  const fd = openSync(temporary, "wx", 384);
+  try {
+    writeSync(fd, randomBytes(bytes));
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+  try {
+    linkSync(temporary, file);
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+  } finally {
+    rmSync(temporary, { force: true });
+  }
+  if (process.platform !== "win32") {
+    const dir = openSync(directory, "r");
+    try {
+      fsyncSync(dir);
+    } finally {
+      closeSync(dir);
+    }
+  }
+  return read() ?? refuse();
+}
+__name(keyFile, "keyFile");
+async function assertPrivateHome(home) {
+  if (process.platform === "win32") return assertPrivateWindowsHome(home);
+  const uid = process.getuid();
+  const fail = /* @__PURE__ */ __name((path, problem) => {
+    throw new Error(`Refusing to start: ${path} ${problem}. CANON_HOME must be a private 0700 directory whose ancestors only its owner or root can modify.`);
+  }, "fail");
+  await mkdir(home, { recursive: true, mode: 448 }).catch(() => void 0);
+  let resolved;
+  try {
+    resolved = await realpath(home);
+  } catch {
+    return fail(home, "does not exist");
+  }
+  if (resolved !== home) fail(home, `is not canonical (it resolves to ${resolved})`);
+  const stat = await lstat(home);
+  if (!stat.isDirectory() || stat.uid !== uid) fail(home, "is not a directory owned by this user");
+  if (stat.mode & 63) fail(home, `is accessible to other users (mode ${(stat.mode & 511).toString(8)})`);
+  for (let path = dirname2(home); ; path = dirname2(path)) {
+    const ancestor = await lstat(path);
+    if (ancestor.uid !== uid && ancestor.uid !== 0) fail(path, "is owned by another user");
+    if (ancestor.mode & 18) fail(path, "is writable by other users");
+    if (path === dirname2(path)) return;
+  }
+}
+__name(assertPrivateHome, "assertPrivateHome");
+
+// src/runner/mls-wasm.ts
+import { spawn } from "node:child_process";
+var WASM_HOST_CONFIGURE = 0;
+var WASM_HOST_PROVISION = 5;
+var lengthPrefixed = /* @__PURE__ */ __name((message) => {
+  const length = Buffer.alloc(4);
+  length.writeUInt32BE(message.length);
+  return Buffer.concat([length, message]);
+}, "lengthPrefixed");
+function wasmMlsCustody(options) {
+  const { core, context, keyPath, issuerKeys, receiptKeys, timeoutMs = 3e4 } = options;
+  const configuration = frame(WASM_HOST_CONFIGURE, [JSON.stringify({
+    context,
+    keyPath,
+    issuerKeys,
+    receiptKeys,
+    wasmPath: core.wasmPath,
+    wasmSha256: core.wasmSha256,
+    gluePath: core.gluePath,
+    glueSha256: core.glueSha256
+  })]);
+  const jobs = /* @__PURE__ */ new Set();
+  let closed = false, host;
+  function start() {
+    const child = spawn(process.execPath, [core.hostPath], {
+      stdio: ["pipe", "pipe", "ignore"],
+      windowsHide: true,
+      env: process.platform === "win32" ? { SystemRoot: process.env.SystemRoot } : {}
+    });
+    let done = /* @__PURE__ */ __name(() => void 0, "done");
+    const started = { child, waiting: [], exited: new Promise((resolve) => {
+      done = resolve;
+    }) };
+    let buffered = Buffer.alloc(0);
+    child.stdout.on("data", (chunk) => {
+      buffered = Buffer.concat([buffered, chunk]);
+      while (buffered.length >= 4) {
+        const length = buffered.readUInt32BE(0);
+        if (length > MAX_OUTPUT) {
+          child.kill("SIGKILL");
+          return;
+        }
+        if (buffered.length < 4 + length) return;
+        started.waiting.shift()?.resolve(buffered.subarray(4, 4 + length));
+        buffered = buffered.subarray(4 + length);
+      }
+    });
+    const gone = /* @__PURE__ */ __name(() => {
+      if (host === started) host = void 0;
+      for (const waiter of started.waiting.splice(0)) waiter.reject(new NodeMlsDevCustodyError());
+      done();
+    }, "gone");
+    child.once("error", gone);
+    child.once("close", gone);
+    child.stdin.on("error", () => void 0);
+    started.waiting.push({ resolve() {
+    }, reject() {
+    } });
+    child.stdin.write(lengthPrefixed(configuration));
+    return started;
+  }
+  __name(start, "start");
+  function call(message, signal) {
+    requireValue(!closed && !signal.aborted);
+    const current2 = host ??= start();
+    return new Promise((resolve, reject) => {
+      const kill = /* @__PURE__ */ __name(() => {
+        if (host === current2) host = void 0;
+        current2.child.kill("SIGKILL");
+      }, "kill");
+      signal.addEventListener("abort", kill, { once: true });
+      current2.waiting.push({
+        resolve(output) {
+          signal.removeEventListener("abort", kill);
+          resolve(output);
+        },
+        reject(error) {
+          signal.removeEventListener("abort", kill);
+          reject(error);
+        }
+      });
+      current2.child.stdin.write(lengthPrefixed(message));
+    });
+  }
+  __name(call, "call");
+  async function job(work) {
+    const controller = new AbortController(), timer = setTimeout(() => controller.abort(), timeoutMs);
+    jobs.add(controller);
+    try {
+      requireValue(!closed);
+      const cancelled = new Promise((_, reject) => {
+        controller.signal.addEventListener("abort", () => reject(new NodeMlsDevCustodyError()), { once: true });
+      });
+      return await Promise.race([work(controller.signal), cancelled]);
+    } catch (error) {
+      return custodyFailure(error);
+    } finally {
+      clearTimeout(timer);
+      controller.abort();
+      jobs.delete(controller);
+    }
+  }
+  __name(job, "job");
+  const custody = typedNodeMlsDevCustody(
+    job,
+    async (operation, values, signal) => custodyValue(await call(frame(operation, values), signal), operation),
+    async () => {
+      closed = true;
+      for (const running of jobs) running.abort();
+      const current2 = host;
+      if (current2) {
+        current2.child.kill("SIGKILL");
+        await current2.exited;
+      }
+    }
+  );
+  return Object.freeze({ ...custody, provision: /* @__PURE__ */ __name((device) => job(async (signal) => {
+    const message = frame(WASM_HOST_PROVISION, [JSON.stringify(parseMlsDevDeviceContext(device))]);
+    requireValue(custodyValue(await call(message, signal), WASM_HOST_PROVISION) === null);
+  }), "provision") });
+}
+__name(wasmMlsCustody, "wasmMlsCustody");
+
+export {
+  windowsAclProblems,
+  restrictWindowsFile,
+  assertPrivateWindowsFile,
+  secureWindowsDirectory,
+  runnerLockName,
+  writeDurable,
+  privateKey,
+  keyFile,
+  assertPrivateHome,
+  WASM_HOST_CONFIGURE,
+  WASM_HOST_PROVISION,
+  wasmMlsCustody
+};

package/dist/chunks/chunk-QK37HAHC.js

@@ -0,0 +1,118 @@
+import {
+  __name,
+  decodeCanonicalMlsBase64Url,
+  isMlsEnvironmentId,
+  mlsEnvironmentOfIssuerKeyVersion,
+  mlsEnvironmentOfReceiptKeyVersion,
+  parseMlsDevCredentialReceipt,
+  parseMlsDevCredentialToken,
+  parseMlsDevEnrollmentPrincipal,
+  parseMlsDevIssuerKeyVersion,
+  parseMlsDevReceiptKeyVersion
+} from "./chunk-S7BV74DN.js";
+
+// ../endpoint/src/mls-crypto.ts
+import { ed25519 } from "@noble/curves/ed25519.js";
+
+// ../endpoint/src/runtime-api-origins.generated.ts
+var RUNTIME_API_ORIGINS = {
+  "canon-dev-v1": "https://dev.api.canonmail.com",
+  "canon-prod-v1": "https://api.canonmail.com"
+};
+
+// ../endpoint/src/mls-crypto.ts
+function mlsDevDeviceHttpConfiguration(environmentId) {
+  if (!isMlsEnvironmentId(environmentId)) invalid();
+  const origin = RUNTIME_API_ORIGINS[environmentId];
+  return Object.freeze({
+    enrollmentUrl: `${origin}/mls/enrollment`,
+    credentialUrl: `${origin}/mls/credential`,
+    reconciliationUrl: `${origin}/mls/reconciliation`,
+    keyPackagesUrl: `${origin}/mls/key-packages`,
+    trustedOrigins: Object.freeze([origin])
+  });
+}
+__name(mlsDevDeviceHttpConfiguration, "mlsDevDeviceHttpConfiguration");
+function invalid() {
+  throw new Error("MLS_DEV_CLIENT_CONFIGURATION_INVALID");
+}
+__name(invalid, "invalid");
+function record(value, keys) {
+  if (!value || typeof value !== "object" || Array.isArray(value) || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) invalid();
+  const fields = Object.getOwnPropertyDescriptors(value);
+  if (Reflect.ownKeys(fields).length !== keys.length || keys.some((key) => !Object.hasOwn(fields, key) || !Object.hasOwn(fields[key], "value"))) invalid();
+  return value;
+}
+__name(record, "record");
+function primeOrderPoint(value) {
+  const point = ed25519.Point.fromBytes(value, false);
+  return !point.isSmallOrder() && point.isTorsionFree();
+}
+__name(primeOrderPoint, "primeOrderPoint");
+function issuerKeys(value, environmentId, receipt = false) {
+  if (!Array.isArray(value) || value.length < 1 || value.length > 8) invalid();
+  const seen = /* @__PURE__ */ new Set();
+  let environment = environmentId;
+  return Object.freeze(Array.from(value, (item) => {
+    const key = record(item, ["keyVersion", "signaturePublicKey"]);
+    const keyVersion = receipt ? parseMlsDevReceiptKeyVersion(key.keyVersion, environment) : parseMlsDevIssuerKeyVersion(key.keyVersion, environment);
+    environment ??= receipt ? mlsEnvironmentOfReceiptKeyVersion(keyVersion) : mlsEnvironmentOfIssuerKeyVersion(keyVersion);
+    if (seen.has(keyVersion) || typeof key.signaturePublicKey !== "string" || !primeOrderPoint(decodeCanonicalMlsBase64Url(key.signaturePublicKey, 32))) invalid();
+    seen.add(keyVersion);
+    return Object.freeze({ keyVersion, signaturePublicKey: key.signaturePublicKey });
+  }));
+}
+__name(issuerKeys, "issuerKeys");
+function parseMlsDevClientConfiguration(value) {
+  try {
+    const listed = !!value && typeof value === "object" && Object.hasOwn(value, "principalIds");
+    const input = record(value, ["version", "environmentId", "enabled", ...listed ? ["principalIds"] : [], "issuerKeys", "receiptKeys"]);
+    if (input.version !== 1 || !isMlsEnvironmentId(input.environmentId) || input.enabled !== true || listed && (!Array.isArray(input.principalIds) || input.principalIds.length < 1 || input.principalIds.length > 100)) invalid();
+    const environmentId = input.environmentId;
+    const principalIds = listed ? Array.from(input.principalIds, (id) => parseMlsDevEnrollmentPrincipal({ type: "human", id }).id) : void 0;
+    if (principalIds && new Set(principalIds).size !== principalIds.length) invalid();
+    return Object.freeze({
+      version: 1,
+      environmentId,
+      enabled: true,
+      ...principalIds ? { principalIds: Object.freeze(principalIds) } : {},
+      issuerKeys: issuerKeys(input.issuerKeys, environmentId),
+      receiptKeys: issuerKeys(input.receiptKeys, environmentId, true)
+    });
+  } catch {
+    return invalid();
+  }
+}
+__name(parseMlsDevClientConfiguration, "parseMlsDevClientConfiguration");
+function createMlsDevCredentialVerifier(options) {
+  let trusted;
+  try {
+    trusted = new Map(issuerKeys(options.issuerKeys).map((key) => [key.keyVersion, key.signaturePublicKey]));
+  } catch {
+    return invalid();
+  }
+  const clock = options.clock ?? Date.now;
+  return async (value) => {
+    try {
+      const receipt = parseMlsDevCredentialReceipt(value);
+      const parsed = parseMlsDevCredentialToken(receipt.credential);
+      const key = trusted.get(parsed.unsigned.keyVersion);
+      const now = clock();
+      const { issuedAtMs, expiresAtMs } = parsed.unsigned.claims;
+      if (!key || !Number.isSafeInteger(now) || now < issuedAtMs || now >= expiresAtMs) return false;
+      const publicKey = decodeCanonicalMlsBase64Url(key, 32);
+      const signature = decodeCanonicalMlsBase64Url(parsed.signature, 64);
+      if (!primeOrderPoint(publicKey) || !primeOrderPoint(signature.subarray(0, 32))) return false;
+      return ed25519.verify(signature, new TextEncoder().encode(parsed.signingInput), publicKey, { zip215: false });
+    } catch {
+      return false;
+    }
+  };
+}
+__name(createMlsDevCredentialVerifier, "createMlsDevCredentialVerifier");
+
+export {
+  mlsDevDeviceHttpConfiguration,
+  parseMlsDevClientConfiguration,
+  createMlsDevCredentialVerifier
+};