@joe-broadhead/messaging 0.0.0-stage → 0.7.1

package/dist/lib/modules/ipc/windows-acl.js

@@ -0,0 +1,275 @@
+/**
+ * Windows access control for the Messaging home (spec §8.1, §8.2): the analogue of "a real directory owned by
+ * this user that no group or other user can write", and of `mkdir 0700` / `chmod 0700`.
+ *
+ * Node has no API for Windows ACLs, so this reads and writes them with the system's own tools, run by absolute
+ * path (never through PATH): `icacls <path> /save` writes a DACL as SDDL, which is locale-independent, and
+ * `whoami /user` names this user's SID. The parser and the policy are pure functions, tested on every
+ * platform; only `readDacl`, `currentUserSid` and `securePrivate` run the tools, and only on Windows.
+ *
+ * The policy (`daclProblem`), "private" on Windows:
+ *  1. the object has a DACL (a NULL DACL lets everyone do anything);
+ *  2. no allow entry that applies to the object grants a write-class right to anyone but this user, SYSTEM
+ *     or Administrators (Windows' root equivalents);
+ *  3. with `pinnedOwner`, an OWNER RIGHTS (S-1-3-4) entry applies to the object and grants no write-class
+ *     right. Node cannot read an object's owner cheaply; an OWNER RIGHTS entry replaces the owner's implicit
+ *     WRITE_DAC, so whoever owns the directory (for example someone who created a shared MESSAGING_HOME
+ *     first) cannot rewrite its DACL later. That is what the POSIX owner check is for.
+ */
+import { spawnSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { existsSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { MessagingError } from "../core/index.js";
+export const SID_SYSTEM = "S-1-5-18";
+export const SID_ADMINISTRATORS = "S-1-5-32-544";
+export const SID_OWNER_RIGHTS = "S-1-3-4";
+/** SDDL account aliases this module needs to tell apart; any other alias is some other principal. */
+const ALIASES = {
+    SY: SID_SYSTEM,
+    BA: SID_ADMINISTRATORS,
+    OW: SID_OWNER_RIGHTS,
+    CO: "S-1-3-0",
+    WD: "S-1-1-0",
+    AU: "S-1-5-11",
+    BU: "S-1-5-32-545",
+    AN: "S-1-5-7",
+    NU: "S-1-5-2",
+    IU: "S-1-5-4",
+};
+/** SDDL right codes and their masks. An unknown code is taken as every right (refused as a write). */
+const RIGHTS = {
+    GA: 0x1000_0000,
+    GR: 0x8000_0000,
+    GW: 0x4000_0000,
+    GX: 0x2000_0000,
+    RC: 0x0002_0000,
+    SD: 0x0001_0000,
+    WD: 0x0004_0000,
+    WO: 0x0008_0000,
+    RP: 0x10,
+    WP: 0x20,
+    CC: 0x1,
+    DC: 0x2,
+    LC: 0x4,
+    SW: 0x8,
+    LO: 0x80,
+    DT: 0x40,
+    CR: 0x100,
+    FA: 0x001f_01ff,
+    FR: 0x0012_0089,
+    FW: 0x0012_0116,
+    FX: 0x0012_00a0,
+    KA: 0x000f_003f,
+    KR: 0x0002_0019,
+    KW: 0x0002_0006,
+    KX: 0x0002_0019,
+    NR: 0,
+    NW: 0,
+    NX: 0,
+};
+/**
+ * Rights that let a principal change a file or directory, its entries, or who may: write data or add a file
+ * (0x2), append or add a subdirectory (0x4), write extended attributes (0x10), delete a child (0x40), write
+ * attributes (0x100), DELETE, WRITE_DAC, WRITE_OWNER, GENERIC_WRITE and GENERIC_ALL.
+ */
+export const WRITE_RIGHTS = 0x2 | 0x4 | 0x10 | 0x40 | 0x100 | 0x0001_0000 | 0x0004_0000 | 0x0008_0000 | 0x4000_0000 | 0x1000_0000;
+const ALLOW_TYPES = new Set(["A", "OA", "XA", "ZA"]);
+/** The DACL part of an SDDL string, or undefined when it has none. Throws on text that is not SDDL. */
+export function parseSddlDacl(sddl) {
+    const text = sddl.trim();
+    let i = 0;
+    let dacl;
+    while (i < text.length) {
+        const tag = text[i];
+        if (text[i + 1] !== ":" || (tag !== "O" && tag !== "G" && tag !== "D" && tag !== "S"))
+            throw new Error("not SDDL");
+        i += 2;
+        if (tag === "O" || tag === "G") {
+            const sid = /^(S-1-[0-9-]+|[A-Z]{2})/.exec(text.slice(i));
+            if (!sid)
+                throw new Error("not SDDL: owner or group");
+            i += sid[0].length;
+            continue;
+        }
+        // A component's flags end where its first entry starts, or where the next component's tag starts.
+        let flagText = /^[A-Z_]*/.exec(text.slice(i))[0];
+        if (text[i + flagText.length] === ":")
+            flagText = flagText.slice(0, -1);
+        i += flagText.length;
+        const aces = [];
+        while (text[i] === "(") {
+            let depth = 0;
+            let end = i;
+            for (; end < text.length; end++) {
+                if (text[end] === "(")
+                    depth++;
+                else if (text[end] === ")" && --depth === 0)
+                    break;
+            }
+            if (end >= text.length)
+                throw new Error("not SDDL: an unclosed entry");
+            aces.push(parseAce(text.slice(i + 1, end)));
+            i = end + 1;
+        }
+        if (tag === "D")
+            dacl = { nullDacl: flagText.includes("NO_ACCESS_CONTROL"), protected: flagText.replace("NO_ACCESS_CONTROL", "").includes("P"), aces };
+    }
+    return dacl;
+}
+function parseAce(body) {
+    const fields = body.split(";");
+    if (fields.length < 6)
+        throw new Error("not SDDL: an entry");
+    const [type = "", flagText = "", rightsText = "", , , sidText = ""] = fields;
+    const flags = flagText.match(/.{1,2}/g) ?? [];
+    return { type, flags, rights: parseRights(rightsText), sid: ALIASES[sidText] ?? sidText };
+}
+function parseRights(text) {
+    if (/^0[xX][0-9a-fA-F]+$/.test(text))
+        return Number.parseInt(text.slice(2), 16);
+    if (/^\d+$/.test(text))
+        return Number(text);
+    let mask = 0;
+    for (const code of text.match(/.{1,2}/g) ?? [])
+        mask |= RIGHTS[code] ?? 0xffff_ffff;
+    return mask >>> 0;
+}
+/**
+ * Aliases SDDL writes for accounts of the user's own machine or domain: `LA` is its Administrator account (RID
+ * 500), `LG` its Guest (501). This user may be one of them (a CI runner's user is often the built-in
+ * Administrator), so they are resolved against the domain part of `self`'s SID; any other alias stays as written.
+ */
+const DOMAIN_RIDS = { LA: 500, LG: 501 };
+/** `sid` as a full SID when it is a domain-relative alias of `self`'s domain; otherwise unchanged. */
+export function resolveSid(sid, self) {
+    const rid = DOMAIN_RIDS[sid];
+    const domain = /^(S-1-5-21-\d+-\d+-\d+)-\d+$/.exec(self)?.[1];
+    return rid !== undefined && domain !== undefined ? `${domain}-${rid}` : sid;
+}
+/** Whether an entry applies to the object itself (not only to what inherits it). */
+function applies(ace) {
+    return !ace.flags.includes("IO");
+}
+/**
+ * Why `dacl` is not private to `self` (a SID), or undefined when it is (the rules in this module's comment).
+ * `pinnedOwner`: also require an OWNER RIGHTS entry that grants no write-class right.
+ */
+export function daclProblem(dacl, self, { pinnedOwner }) {
+    if (dacl === undefined || dacl.nullDacl)
+        return "has no access control list, so anyone may write it";
+    const trusted = new Set([self, SID_SYSTEM, SID_ADMINISTRATORS]);
+    let ownerPinned = false;
+    for (const ace of dacl.aces) {
+        if (!ALLOW_TYPES.has(ace.type) || !applies(ace))
+            continue;
+        const writes = (ace.rights & WRITE_RIGHTS) !== 0;
+        const sid = resolveSid(ace.sid, self);
+        if (sid === SID_OWNER_RIGHTS) {
+            if (writes)
+                return "lets its owner write it";
+            ownerPinned = true;
+            continue;
+        }
+        if (writes && !trusted.has(sid))
+            return `is writable by ${/^S-1-[0-9-]+$/.test(sid) ? sid : `another principal (${sid.slice(0, 8)})`}`;
+    }
+    if (pinnedOwner && !ownerPinned)
+        return "does not pin its owner's rights (no OWNER RIGHTS entry)";
+    return undefined;
+}
+/** `%SystemRoot%\System32\<exe>`: the system's own tools, never one found on PATH. */
+function system32(exe) {
+    return join(process.env.SystemRoot || process.env.windir || "C:\\Windows", "System32", exe);
+}
+/** A system tool that failed, with its exit status (a Win32 error code for icacls: 2 file not found, 3 path not found). */
+class ToolFailed extends MessagingError {
+    status;
+    constructor(exe, status, why) {
+        super("forbidden", `${exe} failed (${why})`);
+        this.status = status;
+    }
+}
+function run(exe, args) {
+    const result = spawnSync(system32(exe), args, { encoding: "utf8", windowsHide: true, timeout: 15_000 });
+    if (result.error)
+        throw new ToolFailed(exe, null, result.error.code ?? "error");
+    if (result.status !== 0)
+        throw new ToolFailed(exe, result.status, `exit ${result.status}`);
+    return result.stdout;
+}
+let userSid;
+/** This process's user SID (`whoami /user`), read once. */
+export function currentUserSid() {
+    if (userSid !== undefined)
+        return userSid;
+    const out = run("whoami.exe", ["/user", "/fo", "csv", "/nh"]);
+    const sid = /"(S-1-[0-9-]+)"\s*$/.exec(out.trim())?.[1];
+    if (!sid)
+        throw new MessagingError("forbidden", "cannot tell this user's SID");
+    userSid = sid;
+    return sid;
+}
+/**
+ * The DACL of `path`, read with `icacls /save` (SDDL; locale-independent). A path that is gone by the time icacls
+ * reads it is `daemon_unavailable`, not `forbidden`: a daemon that stops or restarts removes its pipe file between a
+ * client's `lstat` and this read, and that client has found no daemon, not an unsafe one.
+ */
+export function readDacl(path) {
+    const out = join(tmpdir(), `messaging-acl-${process.pid}-${randomBytes(8).toString("hex")}.txt`);
+    try {
+        run("icacls.exe", [path, "/save", out, "/q"]);
+        return parseSddlDacl(sddlLine(readFileSync(out)));
+    }
+    catch (error) {
+        if (error instanceof ToolFailed && (error.status === 2 || error.status === 3 || !existsSync(path))) {
+            throw new MessagingError("daemon_unavailable", `${path} does not exist`);
+        }
+        if (error instanceof MessagingError)
+            throw error;
+        throw new MessagingError("forbidden", "cannot read an access control list");
+    }
+    finally {
+        rmSync(out, { force: true });
+    }
+}
+/** The SDDL line of an `icacls /save` file: the object's name, then its SDDL (UTF-16LE, with or without a BOM). */
+export function sddlLine(bytes) {
+    const utf16 = bytes.length >= 2 && (bytes[0] === 0xff && bytes[1] === 0xfe ? true : bytes.includes(0));
+    const text = (utf16 ? bytes.toString("utf16le") : bytes.toString("utf8")).replace(/^\uFEFF/, "");
+    const line = text.split(/\r?\n/).find((l) => /^(?:[OGDS]:)/.test(l.trim()));
+    if (line === undefined)
+        throw new MessagingError("forbidden", "cannot read an access control list");
+    return line.trim();
+}
+/** Why `path`'s ACL is not private to this user (see `daclProblem`), or undefined. */
+export function aclProblem(path, options) {
+    return daclProblem(readDacl(path), currentUserSid(), options);
+}
+/**
+ * Makes `path` (a directory) private to this user, as `chmod 0700` does on POSIX: inheritance from the parent
+ * removed, full control to this user and an OWNER RIGHTS entry that only reads the ACL, both inherited by
+ * everything created inside, and every other entry removed. Then reads the ACL back and checks it. Fails with
+ * `forbidden` when this user may not change the ACL.
+ */
+export function securePrivate(path, what) {
+    const self = currentUserSid();
+    let others;
+    try {
+        others = [...new Set((readDacl(path)?.aces ?? []).map((ace) => resolveSid(ace.sid, self)))].filter((sid) => sid !== self && sid !== SID_OWNER_RIGHTS && /^S-1-[0-9-]+$/.test(sid));
+        run("icacls.exe", [path, "/inheritance:r", "/grant:r", `*${self}:(OI)(CI)(F)`, `*${SID_OWNER_RIGHTS}:(OI)(CI)(RC)`, "/q"]);
+        if (others.length > 0)
+            run("icacls.exe", [path, "/remove", ...others.map((sid) => `*${sid}`), "/q"]);
+    }
+    catch (error) {
+        throw new MessagingError("forbidden", `cannot make ${what} private: ${error instanceof Error ? error.message : "icacls failed"}`);
+    }
+    const dacl = readDacl(path);
+    const problem = daclProblem(dacl, self, { pinnedOwner: true });
+    if (problem !== undefined)
+        throw new MessagingError("forbidden", `${what} is not private: it ${problem}`);
+    const strangers = (dacl?.aces ?? []).map((ace) => resolveSid(ace.sid, self)).filter((sid) => sid !== self && sid !== SID_OWNER_RIGHTS);
+    if (strangers.length > 0)
+        throw new MessagingError("forbidden", `${what} is not private: other entries remain in its access control list`);
+}

package/dist/lib/modules/vendor/zod/index.js

@@ -0,0 +1,7 @@
+import * as z from "./v4/classic/external.js";
+export * from "./v4/classic/external.js";
+// Aliasing the binding, instead of `export default z`, keeps the default export a
+// re-export of `z` rather than a fresh namespace value. Rollup and Webpack can then
+// shake `import z from "zod"` as they already shake `import { z } from "zod"` — without
+// this they pull in every locale. See #6050.
+export { z, z as default };

package/dist/lib/modules/vendor/zod/v4/classic/checks.js

@@ -0,0 +1 @@
+export { _lt as lt, _lte as lte, _gt as gt, _gte as gte, _positive as positive, _negative as negative, _nonpositive as nonpositive, _nonnegative as nonnegative, _multipleOf as multipleOf, _maxSize as maxSize, _minSize as minSize, _size as size, _maxLength as maxLength, _minLength as minLength, _length as length, _regex as regex, _lowercase as lowercase, _uppercase as uppercase, _includes as includes, _startsWith as startsWith, _endsWith as endsWith, _property as property, _properties as properties, _mime as mime, _overwrite as overwrite, _normalize as normalize, _trim as trim, _toLowerCase as toLowerCase, _toUpperCase as toUpperCase, _slugify as slugify, } from "../core/index.js";

package/dist/lib/modules/vendor/zod/v4/classic/coerce.js

@@ -0,0 +1,17 @@
+import * as core from "../core/index.js";
+import * as schemas from "./schemas.js";
+export function string(params) {
+    return core._coercedString(schemas.ZodString, params);
+}
+export function number(params) {
+    return core._coercedNumber(schemas.ZodNumber, params);
+}
+export function boolean(params) {
+    return core._coercedBoolean(schemas.ZodBoolean, params);
+}
+export function bigint(params) {
+    return core._coercedBigint(schemas.ZodBigInt, params);
+}
+export function date(params) {
+    return core._coercedDate(schemas.ZodDate, params);
+}

package/dist/lib/modules/vendor/zod/v4/classic/compat.js

@@ -0,0 +1,31 @@
+// Zod 3 compat layer
+import * as core from "../core/index.js";
+/** @deprecated Use the raw string literal codes instead, e.g. "invalid_type". */
+export const ZodIssueCode = {
+    invalid_type: "invalid_type",
+    too_big: "too_big",
+    too_small: "too_small",
+    invalid_format: "invalid_format",
+    not_multiple_of: "not_multiple_of",
+    unrecognized_keys: "unrecognized_keys",
+    invalid_union: "invalid_union",
+    invalid_key: "invalid_key",
+    invalid_element: "invalid_element",
+    invalid_value: "invalid_value",
+    custom: "custom",
+};
+export { $brand, config } from "../core/index.js";
+/** @deprecated Use `z.config(params)` instead. */
+export function setErrorMap(map) {
+    core.config({
+        customError: map,
+    });
+}
+/** @deprecated Use `z.config()` instead. */
+export function getErrorMap() {
+    return core.config().customError;
+}
+/** @deprecated Do not use. Stub definition, only included for zod-to-json-schema compatibility. */
+export var ZodFirstPartyTypeKind;
+(function (ZodFirstPartyTypeKind) {
+})(ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {}));

package/dist/lib/modules/vendor/zod/v4/classic/deep-partial.js

@@ -0,0 +1,13 @@
+import { visit } from "../core/visit.js";
+import * as schemas from "./schemas.js";
+/** Returns a copy of the schema with every nested object's properties made optional. */
+export function deepPartial(schema) {
+    return visit(schema, {
+        object: (s) => s.partial(),
+        // Every partialed option now admits `undefined`, which the constructor rejects as a duplicate.
+        union: (s) => {
+            const def = s._zod.def;
+            return def.discriminator === undefined ? s : schemas.union(def.options);
+        },
+    });
+}

package/dist/lib/modules/vendor/zod/v4/classic/errors.js

@@ -0,0 +1,57 @@
+import * as core from "../core/index.js";
+import { $ZodError } from "../core/index.js";
+import * as util from "../core/util.js";
+/* Prototypes that already carry the lazy helper methods. Seeded with the
+ * intrinsics so that `init` on a foreign object — it accepts any object —
+ * can never install an accessor onto a prototype we do not own. */
+const _installedErrorProtos = /* @__PURE__ */ new WeakSet([Object.prototype, Error.prototype]);
+/* Helper methods live as non-enumerable lazy getters on the shared
+ * prototype instead of own properties on every instance. On first
+ * access the getter allocates the per-instance closure and caches it
+ * as a non-enumerable own property, so detached usage still works and
+ * the allocation only happens for methods actually touched. */
+function _lazyMethod(proto, key, make) {
+    Object.defineProperty(proto, key, {
+        configurable: true,
+        enumerable: false,
+        get() {
+            const value = make(this);
+            Object.defineProperty(this, key, { value, configurable: true, writable: true });
+            return value;
+        },
+        set(value) {
+            Object.defineProperty(this, key, { value, configurable: true, writable: true });
+        },
+    });
+}
+const initializer = (inst, issues) => {
+    $ZodError.init(inst, issues);
+    inst.name = "ZodError";
+    const proto = Object.getPrototypeOf(inst);
+    if (_installedErrorProtos.has(proto))
+        return;
+    _installedErrorProtos.add(proto);
+    _lazyMethod(proto, "format", (self) => (mapper) => core.formatError(self, mapper));
+    _lazyMethod(proto, "flatten", (self) => (mapper) => core.flattenError(self, mapper));
+    _lazyMethod(proto, "addIssue", (self) => (issue) => {
+        self.issues.push(issue);
+        self.message = JSON.stringify(self.issues, util.jsonStringifyReplacer, 2);
+    });
+    _lazyMethod(proto, "addIssues", (self) => (issues) => {
+        self.issues.push(...issues);
+        self.message = JSON.stringify(self.issues, util.jsonStringifyReplacer, 2);
+    });
+    Object.defineProperty(proto, "isEmpty", {
+        configurable: true,
+        enumerable: false,
+        get() {
+            return this.issues.length === 0;
+        },
+    });
+};
+export const ZodError = /*@__PURE__*/ core.$constructor("ZodError", initializer);
+export const ZodRealError = /*@__PURE__*/ core.$constructor("ZodError", initializer, undefined, {
+    Parent: Error,
+});
+// /** @deprecated Use `z.core.$ZodErrorMapCtx` instead. */
+// export type ErrorMapCtx = core.$ZodErrorMapCtx;

package/dist/lib/modules/vendor/zod/v4/classic/external.js

@@ -0,0 +1,17 @@
+export * as core from "../core/index.js";
+export * from "./schemas.js";
+export * from "./checks.js";
+export * from "./errors.js";
+export * from "./parse.js";
+export * from "./compat.js";
+export { globalRegistry, registry, config, memoizer, $output, $input, $brand, clone, regexes, treeifyError, prettifyError, formatError, flattenError, TimePrecision, util, NEVER, INVALID, toZod, compile, withParser, ZodCompileAsyncError, ZodCompileUnsupportedError, getDiscriminatedOption, } from "../core/index.js";
+export { toJSONSchema } from "../core/json-schema-processors.js";
+export { fromJSONSchema } from "./from-json-schema.js";
+export { deepPartial } from "./deep-partial.js";
+// Types and values both, from one module — re-exporting the types from core would collide.
+export { input, output } from "./in-out.js";
+export * as locales from "../locales/index.js";
+// iso must be exported from top-level https://github.com/colinhacks/zod/issues/4491
+export { ZodISODateTime, ZodISODate, ZodISOTime, ZodISODuration } from "./iso.js";
+export * as iso from "./iso.js";
+export * as coerce from "./coerce.js";