@fabrika/app 0.3.2 → 0.4.0

package/src/files/archive.ts

@@ -0,0 +1,292 @@
+// The archive check of the scan pass. ClamAV answers OK for a ZIP whose entries it skipped (LZMA, a damaged deflate
+// stream), so its OK cannot vouch for an archive. Before a scanning collection's file reaches the scanner, the
+// framework reads every ZIP itself — an Office Open XML document is one — and admits only what ClamAV reads in full:
+// stored or deflated entries, no encryption, a layout in which every byte belongs to an entry or the directory, sizes
+// and CRCs that match, bounded counts and sizes, and nested ZIPs to a small depth. Any other archive is refused.
+
+import { inflateRawSync } from 'node:zlib'
+
+export const ARCHIVE_LIMITS = {
+	/** Entries of one archive, nested ones counted with their parent's. */
+	maxEntries: 1000,
+	/** Uncompressed bytes of one archive and everything nested in it. */
+	maxUnpackedBytes: 256 * 1024 * 1024,
+	/** The outer archive is depth 0; an archive inside it is 1; one inside that is refused. */
+	maxDepth: 1,
+} as const
+
+/** Why an archive is refused. Each is a reject, never a retry: the bytes will not change. */
+export type ArchiveRefusal =
+	| 'encrypted'
+	| 'unsupported_method'
+	| 'zip64'
+	| 'malformed'
+	| 'too_many_entries'
+	| 'too_large_unpacked'
+	| 'nested_too_deep'
+	| 'unsupported_archive'
+	/** A ZIP signature inside a file that is no ZIP, or before a ZIP's first entry. */
+	| 'embedded_archive'
+	/** More than one end record a scanner could pick, or one whose comment does not end the file. */
+	| 'ambiguous_directory'
+
+export type ArchiveCheck = { readonly ok: true } | { readonly ok: false; readonly refusal: ArchiveRefusal }
+
+const LOCAL = 0x04034b50
+const CENTRAL = 0x02014b50
+const END = 0x06054b50
+const DESCRIPTOR = 0x08074b50
+const STORED = 0
+const DEFLATED = 8
+/** Bit 0: encrypted; bit 6: strong encryption; bit 13: the directory is encrypted. */
+const ENCRYPTION_FLAGS = 0x0001 | 0x0040 | 0x2000
+const HAS_DESCRIPTOR = 0x0008
+
+/** Other archive and compression formats, by their first bytes: the scan cannot vouch for what they hold. */
+const OTHER_ARCHIVES: readonly (readonly number[])[] = [
+	[0x1f, 0x8b], // gzip
+	[0x42, 0x5a, 0x68], // bzip2
+	[0xfd, 0x37, 0x7a, 0x58, 0x5a, 0x00], // xz
+	[0x37, 0x7a, 0xbc, 0xaf, 0x27, 0x1c], // 7z
+	[0x52, 0x61, 0x72, 0x21, 0x1a, 0x07], // rar
+	[0x4d, 0x53, 0x43, 0x46], // cab
+	[0x28, 0xb5, 0x2f, 0xfd], // zstd
+	[0x4c, 0x5a, 0x49, 0x50], // lzip
+	[0x5d, 0x00, 0x00], // lzma
+]
+
+class Refused extends Error {
+	readonly refusal: ArchiveRefusal
+
+	constructor(refusal: ArchiveRefusal) {
+		super(refusal)
+		this.refusal = refusal
+	}
+}
+
+function startsWith(bytes: Uint8Array, prefix: readonly number[], at = 0): boolean {
+	return bytes.length >= at + prefix.length && prefix.every((byte, index) => bytes[at + index] === byte)
+}
+
+function isZip(bytes: Uint8Array): boolean {
+	return startsWith(bytes, [0x50, 0x4b, 0x03, 0x04]) || startsWith(bytes, [0x50, 0x4b, 0x05, 0x06])
+}
+
+/** `ustar` at offset 257: a tar archive, which ClamAV opens but this check does not. */
+function isTar(bytes: Uint8Array): boolean {
+	return startsWith(bytes, [0x75, 0x73, 0x74, 0x61, 0x72], 257)
+}
+
+function isOtherArchive(bytes: Uint8Array): boolean {
+	return isTar(bytes) || OTHER_ARCHIVES.some((magic) => startsWith(bytes, magic))
+}
+
+/** A ZIP's local header, central header and end record: ClamAV opens a ZIP it finds by any of them, wherever it sits. */
+const ZIP_SIGNATURES = [Buffer.from([0x50, 0x4b, 0x03, 0x04]), Buffer.from([0x50, 0x4b, 0x01, 0x02]), Buffer.from([0x50, 0x4b, 0x05, 0x06])]
+
+/**
+ * Whether a ZIP signature appears anywhere: in a file that is no ZIP, it is a ZIP embedded where the check does not
+ * look, so it is refused. Random bytes hold one with a chance of about three in 2^32 per byte (roughly one in 1400 for
+ * 1 MB of compressed data); such a file is rejected too, which fails closed.
+ */
+function containsZipSignature(bytes: Uint8Array): boolean {
+	const buffer = Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength)
+	return ZIP_SIGNATURES.some((signature) => buffer.includes(signature))
+}
+
+/** How often `signature` occurs in `bytes`. */
+function occurrences(bytes: Uint8Array, signature: Buffer): number {
+	const buffer = Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength)
+	let count = 0
+	for (let at = buffer.indexOf(signature); at !== -1; at = buffer.indexOf(signature, at + 1)) count++
+	return count
+}
+
+class Reader {
+	readonly #view: DataView
+
+	constructor(readonly bytes: Uint8Array) {
+		this.#view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength)
+	}
+
+	u16(at: number): number {
+		if (at < 0 || at + 2 > this.bytes.length) throw new Refused('malformed')
+		return this.#view.getUint16(at, true)
+	}
+
+	u32(at: number): number {
+		if (at < 0 || at + 4 > this.bytes.length) throw new Refused('malformed')
+		return this.#view.getUint32(at, true)
+	}
+
+	slice(start: number, end: number): Uint8Array {
+		if (start < 0 || end < start || end > this.bytes.length) throw new Refused('malformed')
+		return this.bytes.subarray(start, end)
+	}
+}
+
+interface Entry {
+	readonly flags: number
+	readonly method: number
+	readonly crc: number
+	readonly compressed: number
+	readonly uncompressed: number
+	readonly name: Uint8Array
+	readonly offset: number
+}
+
+interface Budget {
+	entries: number
+	unpacked: number
+}
+
+/**
+ * The end-of-directory record: the only one a scanner could find in the tail, its comment ending the file exactly and
+ * holding no ZIP signature, one disk, no ZIP64. A scanner that picked another record would read another directory.
+ */
+function endRecord(zip: Reader): { readonly entries: number; readonly directoryStart: number; readonly directoryEnd: number } {
+	const length = zip.bytes.length
+	const tail = zip.bytes.subarray(Math.max(0, length - 22 - 0xffff))
+	if (occurrences(tail, ZIP_SIGNATURES[2] ?? Buffer.alloc(0)) !== 1) throw new Refused('ambiguous_directory')
+	for (let at = length - 22; at >= Math.max(0, length - 22 - 0xffff); at--) {
+		if (zip.u32(at) !== END) continue
+		if (at + 22 + zip.u16(at + 20) !== length) throw new Refused('ambiguous_directory')
+		if (containsZipSignature(zip.slice(at + 22, length))) throw new Refused('ambiguous_directory')
+		const entries = zip.u16(at + 10)
+		const size = zip.u32(at + 12)
+		const start = zip.u32(at + 16)
+		if (entries === 0xffff || size === 0xffffffff || start === 0xffffffff) throw new Refused('zip64')
+		if (zip.u16(at + 4) !== 0 || zip.u16(at + 6) !== 0 || zip.u16(at + 8) !== entries) throw new Refused('malformed')
+		if (start + size !== at) throw new Refused('malformed')
+		return { entries, directoryStart: start, directoryEnd: at }
+	}
+	throw new Refused('malformed')
+}
+
+function directory(zip: Reader, end: ReturnType<typeof endRecord>): Entry[] {
+	const entries: Entry[] = []
+	let at = end.directoryStart
+	for (let index = 0; index < end.entries; index++) {
+		if (zip.u32(at) !== CENTRAL) throw new Refused('malformed')
+		const flags = zip.u16(at + 8)
+		const method = zip.u16(at + 10)
+		const compressed = zip.u32(at + 20)
+		const uncompressed = zip.u32(at + 24)
+		const nameLength = zip.u16(at + 28)
+		const next = at + 46 + nameLength + zip.u16(at + 30) + zip.u16(at + 32)
+		if ((flags & ENCRYPTION_FLAGS) !== 0) throw new Refused('encrypted')
+		if (method !== STORED && method !== DEFLATED) throw new Refused('unsupported_method')
+		if (compressed === 0xffffffff || uncompressed === 0xffffffff || zip.u32(at + 42) === 0xffffffff) throw new Refused('zip64')
+		if (zip.u16(at + 34) !== 0 || (method === STORED && compressed !== uncompressed)) throw new Refused('malformed')
+		entries.push({
+			flags,
+			method,
+			crc: zip.u32(at + 16),
+			compressed,
+			uncompressed,
+			name: zip.slice(at + 46, at + 46 + nameLength),
+			offset: zip.u32(at + 42),
+		})
+		at = next
+	}
+	if (at !== end.directoryEnd) throw new Refused('malformed')
+	return entries
+}
+
+const sameBytes = (left: Uint8Array, right: Uint8Array): boolean => left.length === right.length && left.every((byte, index) => byte === right[index])
+
+/** The entry's compressed bytes, after a local header that agrees with the directory; and where the entry ends. */
+function localData(zip: Reader, entry: Entry): { readonly data: Uint8Array; readonly end: number } {
+	const at = entry.offset
+	if (zip.u32(at) !== LOCAL) throw new Refused('malformed')
+	const flags = zip.u16(at + 6)
+	if ((flags & ENCRYPTION_FLAGS) !== 0) throw new Refused('encrypted')
+	if (zip.u16(at + 8) !== entry.method || (flags & HAS_DESCRIPTOR) !== (entry.flags & HAS_DESCRIPTOR)) throw new Refused('malformed')
+	const nameLength = zip.u16(at + 26)
+	if (!sameBytes(zip.slice(at + 30, at + 30 + nameLength), entry.name)) throw new Refused('malformed')
+	const start = at + 30 + nameLength + zip.u16(at + 28)
+	const dataEnd = start + entry.compressed
+	const data = zip.slice(start, dataEnd)
+	if ((flags & HAS_DESCRIPTOR) === 0) {
+		if (zip.u32(at + 14) !== entry.crc || zip.u32(at + 18) !== entry.compressed || zip.u32(at + 22) !== entry.uncompressed) {
+			throw new Refused('malformed')
+		}
+		return { data, end: dataEnd }
+	}
+	// A data descriptor follows the data, with or without its signature.
+	const signed = dataEnd + 4 <= zip.bytes.length && zip.u32(dataEnd) === DESCRIPTOR
+	const fields = signed ? dataEnd + 4 : dataEnd
+	if (zip.u32(fields) !== entry.crc || zip.u32(fields + 4) !== entry.compressed || zip.u32(fields + 8) !== entry.uncompressed) {
+		throw new Refused('malformed')
+	}
+	return { data, end: fields + 12 }
+}
+
+function unpacked(entry: Entry, data: Uint8Array, budget: Budget): Uint8Array {
+	budget.unpacked += entry.uncompressed
+	if (budget.unpacked > ARCHIVE_LIMITS.maxUnpackedBytes) throw new Refused('too_large_unpacked')
+	let content: Uint8Array
+	if (entry.method === STORED) {
+		content = data
+	} else {
+		try {
+			// One byte more than the directory claims: a longer stream lies about its size.
+			content = inflateRawSync(data, { maxOutputLength: entry.uncompressed + 1 })
+		} catch {
+			throw new Refused('malformed')
+		}
+	}
+	if (content.length !== entry.uncompressed || Bun.hash.crc32(content) !== entry.crc) throw new Refused('malformed')
+	return content
+}
+
+function checkZip(bytes: Uint8Array, depth: number, budget: Budget): void {
+	const zip = new Reader(bytes)
+	const end = endRecord(zip)
+	const entries = directory(zip, end).sort((left, right) => left.offset - right.offset)
+	budget.entries += entries.length
+	if (budget.entries > ARCHIVE_LIMITS.maxEntries) throw new Refused('too_many_entries')
+	// Every byte belongs to an entry or the directory: nothing hides between them, before the first or after the last.
+	let expected = 0
+	for (const entry of entries) {
+		if (entry.offset !== expected) throw new Refused('malformed')
+		const { data, end: entryEnd } = localData(zip, entry)
+		expected = entryEnd
+		checkContent(unpacked(entry, data, budget), depth, budget)
+	}
+	if (expected !== end.directoryStart) throw new Refused('malformed')
+}
+
+/** A nested entry's content: a ZIP from its first byte is checked in turn; any other archive or ZIP signature is refused. */
+function checkContent(content: Uint8Array, depth: number, budget: Budget): void {
+	if (isZip(content)) {
+		if (depth + 1 > ARCHIVE_LIMITS.maxDepth) throw new Refused('nested_too_deep')
+		checkZip(content, depth + 1, budget)
+	} else if (isOtherArchive(content)) {
+		throw new Refused('unsupported_archive')
+	} else if (containsZipSignature(content)) {
+		throw new Refused('embedded_archive')
+	}
+}
+
+/**
+ * Whether the scanner can vouch for these bytes. A file of a ZIP-based type (`zipBased`: ZIP and Office Open XML) must
+ * be a ZIP from its first byte whose every entry, nested ZIPs included, ClamAV reads in full. Any other file passes
+ * only when it holds no archive: no other archive format, and no ZIP signature at any offset.
+ */
+export function checkArchive(bytes: Uint8Array, zipBased: boolean): ArchiveCheck {
+	try {
+		if (zipBased) {
+			if (!isZip(bytes)) throw new Refused('embedded_archive')
+			checkZip(bytes, 0, { entries: 0, unpacked: 0 })
+		} else if (isOtherArchive(bytes)) {
+			throw new Refused('unsupported_archive')
+		} else if (containsZipSignature(bytes)) {
+			throw new Refused('embedded_archive')
+		}
+		return { ok: true }
+	} catch (error) {
+		if (error instanceof Refused) return { ok: false, refusal: error.refusal }
+		throw error
+	}
+}

package/src/files/clamscan.ts

@@ -0,0 +1,253 @@
+// The ClamAV scanner of the scan pass, on Bun: one `clamscan` over a batch written to a private temporary directory,
+// so the signatures load once per batch. Its limits make every unscannable file an alert rather than a silent pass:
+// an encrypted file, one past a size, recursion or time limit, all come back FOUND and are rejected. Signatures older
+// than `maxSignatureAgeDays` make clamscan refuse the batch. Only an exact `<path>: OK` line is a clean verdict.
+
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { FILE_LIMITS } from '../contract/defaults'
+import { type FileScanner, SCAN_LIMITS, type ScanBatchResult, type ScanFailure, type ScanObject, type ScanVerdict } from './scan'
+
+export const CLAMSCAN_LIMITS = {
+	/** The scanner refuses signatures older than this; the provider refreshes them at start and daily. */
+	maxSignatureAgeDays: 3,
+	/** One file's scan time, after which ClamAV alerts instead of passing it. */
+	maxScanTimeMs: 120_000,
+	maxRecursion: 10,
+	maxFilesPerContainer: 1000,
+	/** What clamscan may print; past it the run is stopped and the batch gets no verdict. */
+	maxOutputBytes: 1024 * 1024,
+} as const
+
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
+
+export interface ClamscanOptions {
+	/** The `clamscan` binary; by default the one on `PATH`. */
+	readonly binary?: string
+	/** The signature directory; by default ClamAV's configured one. */
+	readonly database?: string
+	/** Where the batch's directory is made; by default the system's temporary directory. */
+	readonly directory?: string
+	readonly timeoutMs?: number
+	/** The largest file ClamAV reads in full; a larger one alerts. By default `FILE_LIMITS.maxScannedBytes`. */
+	readonly maxFileBytes?: number
+}
+
+/** The arguments of one run; every limit alerts, so a file ClamAV could not read in full is never reported OK. */
+export function clamscanArguments(database: string | undefined, size: number = FILE_LIMITS.maxScannedBytes): readonly string[] {
+	return [
+		'--no-summary',
+		'--stdout',
+		'--alert-encrypted=yes',
+		'--alert-exceeds-max=yes',
+		`--fail-if-cvd-older-than=${CLAMSCAN_LIMITS.maxSignatureAgeDays}`,
+		`--max-filesize=${size}`,
+		`--max-scansize=${size * 4}`,
+		`--max-scantime=${CLAMSCAN_LIMITS.maxScanTimeMs}`,
+		`--max-recursion=${CLAMSCAN_LIMITS.maxRecursion}`,
+		`--max-files=${CLAMSCAN_LIMITS.maxFilesPerContainer}`,
+		...(database === undefined ? [] : [`--database=${database}`]),
+	]
+}
+
+/**
+ * The verdicts of one finished run. Exit 0 (nothing found) and 1 (something found) carry per-file lines; any other exit
+ * is a failed batch, classified from stderr. A file without exactly one `<path>: OK` or `<path>: <name> FOUND` line,
+ * a conflicting second line included, gets no clean verdict.
+ */
+export function clamscanVerdicts(paths: ReadonlyMap<string, string>, exitCode: number, stdout: string, stderr: string): ScanBatchResult {
+	if (exitCode !== 0 && exitCode !== 1) {
+		// `--stdout` moves clamscan's own errors to stdout; libclamav's stay on stderr.
+		return { ok: false, failure: failureOf(`${stdout}\n${stderr}`) }
+	}
+	const verdicts = new Map<string, ScanVerdict>()
+	const seen = new Set<string>()
+	for (const line of stdout.split('\n')) {
+		for (const [id, path] of paths) {
+			const prefix = `${path}: `
+			if (!line.startsWith(prefix)) {
+				continue
+			}
+			const answer = line.slice(prefix.length)
+			const found = /^(\S+) FOUND$/.exec(answer)
+			const verdict: ScanVerdict = answer === 'OK'
+				? { kind: 'clean' }
+				: found?.[1] !== undefined
+				? { kind: 'infected', signature: found[1] }
+				: { kind: 'unscanned' }
+			verdicts.set(id, seen.has(id) ? { kind: 'unscanned' } : verdict)
+			seen.add(id)
+		}
+	}
+	return { ok: true, verdicts }
+}
+
+function failureOf(output: string): ScanFailure {
+	if (output.includes('Virus database is older than')) {
+		return 'signatures_stale'
+	}
+	if (output.includes('cl_load') || output.includes('No supported database files')) {
+		return 'signatures_missing'
+	}
+	return 'scanner_failed'
+}
+
+/**
+ * The stream's text, or `null` once it passes `limit` bytes (when `overflow` runs) or `halt` aborts: a process the run
+ * killed may have left a child holding the pipe open.
+ */
+async function bounded(stream: ReadableStream<Uint8Array>, limit: number, overflow: () => void, halt: AbortSignal): Promise<string | null> {
+	const decoder = new TextDecoder()
+	let text = ''
+	let length = 0
+	const reader = stream.getReader()
+	const halted = new Promise<null>((resolve) => halt.addEventListener('abort', () => resolve(null), { once: true }))
+	const read = () => Promise.race([reader.read(), halted])
+	for (let next = await read(); next !== null && !next.done; next = await read()) {
+		length += next.value.byteLength
+		if (length > limit) {
+			overflow()
+			await reader.cancel()
+			return null
+		}
+		text += decoder.decode(next.value, { stream: true })
+	}
+	if (halt.aborted) {
+		await reader.cancel()
+		return null
+	}
+	return text + decoder.decode()
+}
+
+/** `promise`'s value, or `null` once `signal` aborts first: a read that never answers does not hold the run. */
+function unlessAborted<T>(promise: Promise<T>, signal: AbortSignal): Promise<T | null> {
+	if (signal.aborted) return Promise.resolve(null)
+	return new Promise((resolve, reject) => {
+		const stop = () => resolve(null)
+		signal.addEventListener('abort', stop, { once: true })
+		promise.then(
+			(value) => {
+				signal.removeEventListener('abort', stop)
+				resolve(value)
+			},
+			(error: unknown) => {
+				signal.removeEventListener('abort', stop)
+				reject(error)
+			},
+		)
+	})
+}
+
+/**
+ * Streams `body` to `path`; `false` when `signal` aborted it, which cancels the reader. A reader and a file sink:
+ * `Bun.write` of a stream that errors never settles (Bun 1.3).
+ */
+async function writeStream(path: string, body: ReadableStream<Uint8Array>, signal: AbortSignal): Promise<boolean> {
+	const sink = Bun.file(path).writer()
+	const reader = body.getReader()
+	try {
+		for (let next = await unlessAborted(reader.read(), signal); next !== null; next = await unlessAborted(reader.read(), signal)) {
+			if (next.done) return true
+			sink.write(next.value)
+		}
+		return false
+	} finally {
+		await reader.cancel().catch(() => undefined)
+		await sink.end()
+	}
+}
+
+/** Writes each object to `<directory>/<id>`; a file whose object could not be read in full is left out. */
+async function write(directory: string, objects: readonly ScanObject[], signal: AbortSignal): Promise<Map<string, string>> {
+	const paths = new Map<string, string>()
+	for (const object of objects) {
+		if (signal.aborted) break
+		if (!UUID.test(object.id)) continue
+		const path = join(directory, object.id)
+		try {
+			const body = await unlessAborted(object.open(signal), signal)
+			if (body !== null && (await writeStream(path, body, signal))) paths.set(object.id, path)
+		} catch {
+			await rm(path, { force: true })
+		}
+	}
+	return paths
+}
+
+interface Finished {
+	readonly exitCode: number
+	readonly stdout: string
+	readonly stderr: string
+}
+
+/** One clamscan run, stopped on `signal` or once its output passes the bound; never started once `signal` aborted. */
+async function run(binary: string, args: readonly string[], signal: AbortSignal): Promise<Finished | ScanFailure> {
+	if (signal.aborted) return 'timeout'
+	let child: Bun.Subprocess<'ignore', 'pipe', 'pipe'>
+	try {
+		// Only PATH: the job's own environment carries the application's secrets.
+		child = Bun.spawn([binary, ...args], { stdin: 'ignore', stdout: 'pipe', stderr: 'pipe', env: { PATH: process.env['PATH'] ?? '/usr/bin:/bin' } })
+	} catch {
+		return 'scanner_missing'
+	}
+	let stopped = false
+	const halt = new AbortController()
+	const stop = (): void => {
+		stopped = true
+		child.kill('SIGKILL')
+		halt.abort()
+	}
+	signal.addEventListener('abort', stop, { once: true })
+	try {
+		let overflowed = false
+		const overflow = (): void => {
+			overflowed = true
+			child.kill('SIGKILL')
+			halt.abort()
+		}
+		const [stdout, stderr, exitCode] = await Promise.all([
+			bounded(child.stdout, CLAMSCAN_LIMITS.maxOutputBytes, overflow, halt.signal),
+			bounded(child.stderr, CLAMSCAN_LIMITS.maxOutputBytes, overflow, halt.signal),
+			child.exited,
+		])
+		if (overflowed) {
+			return 'output_overflow'
+		}
+		if (stopped || stdout === null || stderr === null) {
+			return 'timeout'
+		}
+		return { exitCode, stdout, stderr }
+	} finally {
+		signal.removeEventListener('abort', stop)
+	}
+}
+
+/** ClamAV's `clamscan` as the scan pass's scanner. Fails closed: see `ScanFailure` for what makes a batch fail. */
+export function clamscanScanner(options: ClamscanOptions = {}): FileScanner {
+	const binary = options.binary ?? 'clamscan'
+	const timeoutMs = options.timeoutMs ?? SCAN_LIMITS.scanTimeoutMs
+	return {
+		async scan(objects, signal) {
+			// One deadline over the whole run: reading the objects, writing them, the scan and the cleanup.
+			const deadline = AbortSignal.any([signal, AbortSignal.timeout(timeoutMs)])
+			const directory = await mkdtemp(join(options.directory ?? tmpdir(), 'fabrika-scan-'))
+			try {
+				const paths = await write(directory, objects, deadline)
+				if (deadline.aborted) {
+					return { ok: false, failure: 'timeout' }
+				}
+				if (paths.size === 0) {
+					return { ok: true, verdicts: new Map() }
+				}
+				const args = [...clamscanArguments(options.database, options.maxFileBytes), ...paths.values()]
+				const finished = await run(binary, args, deadline)
+				return typeof finished === 'string'
+					? { ok: false, failure: finished }
+					: clamscanVerdicts(paths, finished.exitCode, finished.stdout, finished.stderr)
+			} finally {
+				await rm(directory, { recursive: true, force: true })
+			}
+		},
+	}
+}