@elpapi42/pi-fleet 0.1.0-beta.0

package/dist/installer-meta.json

@@ -0,0 +1,274 @@
+{
+  "inputs": {
+    "src/platform/install/service-definition.ts": {
+      "bytes": 2243,
+      "imports": [
+        {
+          "path": "node:path",
+          "kind": "import-statement",
+          "external": true
+        }
+      ],
+      "format": "esm"
+    },
+    "src/platform/install/service-installer.ts": {
+      "bytes": 5091,
+      "imports": [
+        {
+          "path": "node:fs",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "node:fs/promises",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "node:os",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "node:path",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "src/platform/install/service-definition.ts",
+          "kind": "import-statement",
+          "original": "./service-definition.js"
+        }
+      ],
+      "format": "esm"
+    },
+    "src/platform/install/tree-integrity.ts": {
+      "bytes": 2225,
+      "imports": [
+        {
+          "path": "node:crypto",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "node:fs/promises",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "node:path",
+          "kind": "import-statement",
+          "external": true
+        }
+      ],
+      "format": "esm"
+    },
+    "src/platform/install/runtime-release.ts": {
+      "bytes": 4620,
+      "imports": [
+        {
+          "path": "node:crypto",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "node:fs/promises",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "node:path",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "src/platform/install/tree-integrity.ts",
+          "kind": "import-statement",
+          "original": "./tree-integrity.js"
+        }
+      ],
+      "format": "esm"
+    },
+    "src/platform/shared/paths.ts": {
+      "bytes": 1440,
+      "imports": [
+        {
+          "path": "node:os",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "node:path",
+          "kind": "import-statement",
+          "external": true
+        }
+      ],
+      "format": "esm"
+    },
+    "src/entry/installer.ts": {
+      "bytes": 2140,
+      "imports": [
+        {
+          "path": "node:child_process",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "node:path",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "node:url",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "node:util",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "src/platform/install/service-installer.ts",
+          "kind": "import-statement",
+          "original": "../platform/install/service-installer.js"
+        },
+        {
+          "path": "src/platform/install/runtime-release.ts",
+          "kind": "import-statement",
+          "original": "../platform/install/runtime-release.js"
+        },
+        {
+          "path": "src/platform/shared/paths.ts",
+          "kind": "import-statement",
+          "original": "../platform/shared/paths.js"
+        }
+      ],
+      "format": "esm"
+    }
+  },
+  "outputs": {
+    "dist/installer.mjs.map": {
+      "imports": [],
+      "exports": [],
+      "inputs": {},
+      "bytes": 29042
+    },
+    "dist/installer.mjs": {
+      "imports": [
+        {
+          "path": "node:child_process",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "node:path",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "node:url",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "node:util",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "node:fs",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "node:fs/promises",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "node:os",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "node:path",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "node:path",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "node:crypto",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "node:fs/promises",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "node:path",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "node:crypto",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "node:fs/promises",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "node:path",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "node:os",
+          "kind": "import-statement",
+          "external": true
+        },
+        {
+          "path": "node:path",
+          "kind": "import-statement",
+          "external": true
+        }
+      ],
+      "exports": [
+        "installRuntimeService",
+        "repairRuntimeService",
+        "uninstallRuntimeService"
+      ],
+      "entryPoint": "src/entry/installer.ts",
+      "inputs": {
+        "src/entry/installer.ts": {
+          "bytesInOutput": 1705
+        },
+        "src/platform/install/service-installer.ts": {
+          "bytesInOutput": 4151
+        },
+        "src/platform/install/service-definition.ts": {
+          "bytesInOutput": 1889
+        },
+        "src/platform/install/runtime-release.ts": {
+          "bytesInOutput": 4023
+        },
+        "src/platform/install/tree-integrity.ts": {
+          "bytesInOutput": 1890
+        },
+        "src/platform/shared/paths.ts": {
+          "bytesInOutput": 1207
+        }
+      },
+      "bytes": 15347
+    }
+  }
+}

package/dist/installer.mjs

@@ -0,0 +1,391 @@
+// src/entry/installer.ts
+import { execFile } from "node:child_process";
+import { dirname as dirname2, join as join5 } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { promisify } from "node:util";
+
+// src/platform/install/service-installer.ts
+import { constants } from "node:fs";
+import { access, chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+
+// src/platform/install/service-definition.ts
+import { isAbsolute } from "node:path";
+function systemdUserUnit(options) {
+  validate(options);
+  const environment = options.stateRoot === void 0 ? "" : `Environment=PIFLEET_STATE_ROOT=${systemdEscape(options.stateRoot)}
+`;
+  return `[Unit]
+Description=Pi Fleet user runtime
+After=default.target
+
+[Service]
+Type=simple
+ExecStart=${systemdEscape(options.nodePath)} ${systemdEscape(options.runtimePath)}
+${environment}Restart=on-failure
+RestartSec=1
+TimeoutStopSec=10
+UMask=0077
+KillMode=control-group
+
+[Install]
+WantedBy=default.target
+`;
+}
+function launchdAgentPlist(options) {
+  validate(options);
+  const environment = options.stateRoot === void 0 ? "" : `    <key>EnvironmentVariables</key>
+    <dict><key>PIFLEET_STATE_ROOT</key><string>${xmlEscape(options.stateRoot)}</string></dict>
+`;
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key><string>works.elpapi.pifleet</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>${xmlEscape(options.nodePath)}</string>
+        <string>${xmlEscape(options.runtimePath)}</string>
+    </array>
+${environment}    <key>RunAtLoad</key><true/>
+    <key>KeepAlive</key><dict><key>SuccessfulExit</key><false/></dict>
+    <key>ProcessType</key><string>Background</string>
+</dict>
+</plist>
+`;
+}
+function validate(options) {
+  if (!isAbsolute(options.nodePath) || !isAbsolute(options.runtimePath)) {
+    throw new Error("Service executables must use absolute paths");
+  }
+}
+function systemdEscape(value) {
+  if (!/^[A-Za-z0-9_./:@-]+$/.test(value)) throw new Error(`Unsafe systemd path ${value}`);
+  return value;
+}
+function xmlEscape(value) {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
+}
+
+// src/platform/install/service-installer.ts
+async function installUserService(options) {
+  const home = options.home ?? homedir();
+  if (options.platform === "linux") {
+    const path = join(home, ".config", "systemd", "user", "pi-fleet.service");
+    const effectiveDefinition = await preserveInstalledStateRoot(path, options.definition, "linux");
+    const definition = systemdUserUnit(effectiveDefinition);
+    const needsRepair = await serviceDefinitionNeedsRepair(path, definition, effectiveDefinition);
+    if (needsRepair) {
+      await atomicWrite(path, definition);
+      await options.executor.run("systemctl", ["--user", "daemon-reload"]);
+    }
+    await options.executor.run("systemctl", ["--user", "enable", "--now", "pi-fleet.service"]);
+    if (needsRepair) {
+      await options.executor.run("systemctl", ["--user", "restart", "pi-fleet.service"]);
+    }
+    return path;
+  }
+  if (options.platform === "darwin") {
+    const path = join(home, "Library", "LaunchAgents", "works.elpapi.pifleet.plist");
+    const effectiveDefinition = await preserveInstalledStateRoot(
+      path,
+      options.definition,
+      "darwin"
+    );
+    await atomicWrite(path, launchdAgentPlist(effectiveDefinition));
+    const domain = `gui/${options.uid ?? process.getuid?.() ?? 0}`;
+    await options.executor.run("launchctl", ["bootout", domain, path]).catch(() => void 0);
+    await options.executor.run("launchctl", ["bootstrap", domain, path]);
+    await options.executor.run("launchctl", ["kickstart", `${domain}/works.elpapi.pifleet`]);
+    return path;
+  }
+  throw new Error(`Native Pi Fleet supervision is unsupported on ${options.platform}`);
+}
+async function uninstallUserService(options) {
+  const home = options.home ?? homedir();
+  if (options.platform === "linux") {
+    const path = join(home, ".config", "systemd", "user", "pi-fleet.service");
+    await options.executor.run("systemctl", ["--user", "disable", "--now", "pi-fleet.service"]);
+    await rm(path, { force: true });
+    await options.executor.run("systemctl", ["--user", "daemon-reload"]);
+    return;
+  }
+  if (options.platform === "darwin") {
+    const path = join(home, "Library", "LaunchAgents", "works.elpapi.pifleet.plist");
+    const domain = `gui/${options.uid ?? process.getuid?.() ?? 0}`;
+    await options.executor.run("launchctl", ["bootout", domain, path]).catch(() => void 0);
+    await rm(path, { force: true });
+    return;
+  }
+  throw new Error(`Native Pi Fleet supervision is unsupported on ${options.platform}`);
+}
+async function serviceDefinitionNeedsRepair(path, expectedContents, definition) {
+  const current = await readFile(path, "utf8").catch((error) => {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  });
+  if (current !== expectedContents) return true;
+  try {
+    await access(definition.nodePath, constants.X_OK);
+    await access(definition.runtimePath, constants.R_OK);
+    return false;
+  } catch {
+    return true;
+  }
+}
+async function preserveInstalledStateRoot(path, definition, platform) {
+  if (definition.stateRoot !== void 0) return definition;
+  const current = await readFile(path, "utf8").catch((error) => {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  });
+  if (current === null) return definition;
+  const encoded = platform === "linux" ? /^Environment=PIFLEET_STATE_ROOT=(.+)$/m.exec(current)?.[1] : /<key>PIFLEET_STATE_ROOT<\/key><string>([^<]+)<\/string>/.exec(current)?.[1];
+  if (encoded === void 0) return definition;
+  const stateRoot = platform === "linux" ? encoded : encoded.replaceAll("&apos;", "'").replaceAll("&quot;", '"').replaceAll("&gt;", ">").replaceAll("&lt;", "<").replaceAll("&amp;", "&");
+  return { ...definition, stateRoot };
+}
+async function atomicWrite(path, contents) {
+  await mkdir(dirname(path), { recursive: true, mode: 448 });
+  const temporary = `${path}.tmp-${process.pid}`;
+  await writeFile(temporary, contents, { mode: 384 });
+  await chmod(temporary, 384);
+  await rename(temporary, path);
+}
+
+// src/platform/install/runtime-release.ts
+import { createHash as createHash2, randomUUID } from "node:crypto";
+import { chmod as chmod2, cp, lstat as lstat2, mkdir as mkdir2, readFile as readFile3, rename as rename2, rm as rm2, stat as stat2 } from "node:fs/promises";
+import { join as join3, resolve as resolve2, sep as sep2 } from "node:path";
+
+// src/platform/install/tree-integrity.ts
+import { createHash } from "node:crypto";
+import { lstat, readFile as readFile2, readdir, stat } from "node:fs/promises";
+import { join as join2, relative, resolve, sep } from "node:path";
+async function hashDirectoryTree(root, manifestPath) {
+  const resolvedRoot = resolve(root);
+  const entries = await collectFiles(resolvedRoot, resolvedRoot);
+  const hash = createHash("sha256");
+  let bytes = 0;
+  for (const entry of entries) {
+    const contents = await readFile2(entry.absolutePath);
+    bytes += contents.length;
+    hash.update(entry.relativePath);
+    hash.update("\0");
+    hash.update(String(contents.length));
+    hash.update("\0");
+    hash.update(contents);
+    hash.update("\0");
+  }
+  return {
+    path: manifestPath,
+    files: entries.length,
+    bytes,
+    sha256: hash.digest("hex")
+  };
+}
+async function collectFiles(root, directory) {
+  const output = [];
+  for (const name of (await readdir(directory)).sort()) {
+    const absolutePath = join2(directory, name);
+    const linkInfo = await lstat(absolutePath);
+    const info = linkInfo.isSymbolicLink() ? await stat(absolutePath) : linkInfo;
+    if (info.isDirectory()) {
+      if (linkInfo.isSymbolicLink()) {
+        throw new Error(`Runtime dependency tree contains a directory symlink: ${absolutePath}`);
+      }
+      output.push(...await collectFiles(root, absolutePath));
+      continue;
+    }
+    if (!info.isFile()) {
+      throw new Error(`Runtime dependency tree contains an unsupported entry: ${absolutePath}`);
+    }
+    const relativePath = relative(root, absolutePath).split(sep).join("/");
+    if (relativePath.length === 0 || relativePath.startsWith("../")) {
+      throw new Error(`Runtime dependency path escapes its root: ${absolutePath}`);
+    }
+    output.push({ absolutePath, relativePath });
+  }
+  return output.sort((left, right) => left.relativePath.localeCompare(right.relativePath));
+}
+
+// src/platform/install/runtime-release.ts
+async function materializeRuntime(options) {
+  const sourceRoot = resolve2(options.sourceRoot);
+  const applicationRoot = resolve2(options.applicationRoot);
+  await ensurePrivateDirectory(applicationRoot);
+  const manifestBytes = await readFile3(join3(sourceRoot, "dist", "runtime-manifest.json"));
+  const manifest = JSON.parse(manifestBytes.toString("utf8"));
+  const manifestHash = createHash2("sha256").update(manifestBytes).digest("hex").slice(0, 16);
+  const releasesRoot = join3(applicationRoot, "releases");
+  await ensurePrivateDirectory(releasesRoot);
+  const destination = join3(releasesRoot, `${manifest.package.version}-${manifestHash}`);
+  if (await pathExists(destination)) {
+    await verifyRuntime(destination, manifest);
+    return destination;
+  }
+  const staging = join3(releasesRoot, `.staging-${randomUUID()}`);
+  await mkdir2(staging, { mode: 448 });
+  try {
+    await cp(join3(sourceRoot, "dist"), join3(staging, "dist"), {
+      recursive: true,
+      dereference: true
+    });
+    await cp(join3(sourceRoot, "bin"), join3(staging, "bin"), { recursive: true, dereference: true });
+    await cp(join3(sourceRoot, "package.json"), join3(staging, "package.json"));
+    for (const tree of manifest.trees) {
+      const source = resolveInside(sourceRoot, tree.path);
+      const destination2 = resolveInside(staging, tree.path);
+      await mkdir2(resolve2(destination2, ".."), { recursive: true, mode: 448 });
+      await cp(source, destination2, { recursive: true, dereference: true });
+    }
+    await verifyRuntime(staging, manifest);
+    await chmod2(staging, 448);
+    await rename2(staging, destination);
+    return destination;
+  } catch (error) {
+    await rm2(staging, { recursive: true, force: true });
+    throw error;
+  }
+}
+async function verifyRuntime(root, manifest) {
+  const expected = manifest ?? JSON.parse(
+    await readFile3(join3(root, "dist", "runtime-manifest.json"), "utf8")
+  );
+  const resolvedRoot = resolve2(root);
+  for (const file of expected.files) {
+    const path = resolveInside(resolvedRoot, file.path);
+    const info = await stat2(path);
+    if (!info.isFile() || info.size !== file.bytes) {
+      throw new Error(`Runtime artifact ${file.path} has changed`);
+    }
+    const hash = createHash2("sha256").update(await readFile3(path)).digest("hex");
+    if (hash !== file.sha256) {
+      throw new Error(`Runtime artifact ${file.path} failed verification`);
+    }
+  }
+  for (const expectedTree of expected.trees) {
+    const treeRoot = resolveInside(resolvedRoot, expectedTree.path);
+    const actualTree = await hashDirectoryTree(treeRoot, expectedTree.path);
+    if (actualTree.files !== expectedTree.files || actualTree.bytes !== expectedTree.bytes || actualTree.sha256 !== expectedTree.sha256) {
+      throw new Error(`Runtime dependency tree ${expectedTree.path} failed verification`);
+    }
+  }
+}
+function resolveInside(root, path) {
+  const resolved = resolve2(root, path);
+  if (!resolved.startsWith(`${root}${sep2}`)) {
+    throw new Error(`Runtime manifest contains an unsafe path ${path}`);
+  }
+  return resolved;
+}
+async function ensurePrivateDirectory(path) {
+  await mkdir2(path, { recursive: true, mode: 448 });
+  const info = await lstat2(path);
+  if (!info.isDirectory() || info.isSymbolicLink()) {
+    throw new Error(`Refusing unsafe runtime release path ${path}`);
+  }
+  if (typeof process.getuid === "function" && info.uid !== process.getuid()) {
+    throw new Error(`Runtime release path ${path} is not owned by the current user`);
+  }
+  await chmod2(path, 448);
+}
+async function pathExists(path) {
+  try {
+    await lstat2(path);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+}
+
+// src/platform/shared/paths.ts
+import { homedir as homedir2, tmpdir } from "node:os";
+import { join as join4, resolve as resolve3 } from "node:path";
+function resolveApplicationRoot(env = process.env) {
+  return env.PIFLEET_APPLICATION_ROOT ?? (process.platform === "darwin" ? join4(homedir2(), "Library", "Application Support", "Pi Fleet", "runtime") : join4(env.XDG_DATA_HOME ?? join4(homedir2(), ".local", "share"), "pi-fleet"));
+}
+function resolveFleetPaths(env = process.env) {
+  const explicitRoot = env.PIFLEET_STATE_ROOT;
+  if (explicitRoot !== void 0) {
+    const root = resolve3(explicitRoot);
+    return {
+      runtimeRoot: root,
+      stateRoot: root,
+      socketPath: join4(root, "control.sock"),
+      databasePath: join4(root, "fleet.sqlite")
+    };
+  }
+  const runtimeRoot = join4(
+    env.XDG_RUNTIME_DIR ?? tmpdir(),
+    `pifleet-${process.getuid?.() ?? "user"}`
+  );
+  const stateRoot = process.platform === "darwin" ? join4(homedir2(), "Library", "Application Support", "Pi Fleet") : join4(env.XDG_STATE_HOME ?? join4(homedir2(), ".local", "state"), "pi-fleet");
+  return {
+    runtimeRoot,
+    stateRoot,
+    socketPath: join4(runtimeRoot, "control.sock"),
+    databasePath: join4(stateRoot, "fleet.sqlite")
+  };
+}
+
+// src/entry/installer.ts
+var executor = {
+  async run(command, args) {
+    await promisify(execFile)(command, [...args]);
+  }
+};
+async function installRuntimeService() {
+  return installMaterializedService(resolveFleetPaths().stateRoot);
+}
+async function repairRuntimeService() {
+  return installMaterializedService(process.env.PIFLEET_STATE_ROOT);
+}
+async function installMaterializedService(stateRoot) {
+  const sourceRoot = dirname2(dirname2(fileURLToPath(import.meta.url)));
+  const release = await materializeRuntime({
+    sourceRoot,
+    applicationRoot: resolveApplicationRoot()
+  });
+  return installUserService({
+    platform: process.platform,
+    definition: {
+      nodePath: process.execPath,
+      runtimePath: join5(release, "bin", "pifleet-runtime.mjs"),
+      ...stateRoot === void 0 ? {} : { stateRoot }
+    },
+    executor
+  });
+}
+async function uninstallRuntimeService() {
+  await uninstallUserService({ platform: process.platform, executor });
+}
+async function main() {
+  const command = process.argv[2];
+  if (command === "install") {
+    process.stdout.write(`${await installRuntimeService()}
+`);
+    return;
+  }
+  if (command === "repair") {
+    process.stdout.write(`${await repairRuntimeService()}
+`);
+    return;
+  }
+  if (command === "uninstall") {
+    await uninstallRuntimeService();
+    return;
+  }
+  throw new Error("Usage: node dist/installer.mjs <install|repair|uninstall>");
+}
+if (process.argv[1] !== void 0 && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  await main();
+}
+export {
+  installRuntimeService,
+  repairRuntimeService,
+  uninstallRuntimeService
+};
+//# sourceMappingURL=installer.mjs.map