@mutmutco/installer-launcher 1.0.1 → 1.2.0

package/dist/refresh.js

@@ -0,0 +1,335 @@
+// src/refresh.ts
+import { execFile } from "node:child_process";
+import { chmodSync, existsSync as existsSync2, lstatSync, readdirSync, readFileSync as readFileSync2, renameSync, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname as dirname2, join as join3 } from "node:path";
+
+// src/acquisition.ts
+import { createHash as createHash2, randomUUID } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync, realpathSync } from "node:fs";
+import { join as join2, resolve, relative, isAbsolute, dirname } from "node:path";
+
+// src/download.ts
+async function readDownload(response, onProgress, expectedSize) {
+  const length = expectedSize ?? Number(response.headers.get("content-length"));
+  const total = Number.isSafeInteger(length) && length > 0 ? length : void 0;
+  let done = 0;
+  const report = () => onProgress?.({ done, ...total === void 0 ? {} : { total } });
+  report();
+  const chunks = [];
+  if (response.body) {
+    for await (const chunk of response.body) {
+      chunks.push(chunk);
+      done += chunk.length;
+      report();
+    }
+  }
+  return Buffer.concat(chunks);
+}
+
+// src/store.ts
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+function defaultProductDir(product) {
+  if (process.platform === "win32") {
+    const base = process.env.LOCALAPPDATA ?? join(tmpdir(), "launcher-fallback");
+    return join(base, product);
+  }
+  const home = process.env.HOME ?? tmpdir();
+  return join(home, `.${product}`);
+}
+
+// src/payload.ts
+import { createHash, createPublicKey, verify } from "node:crypto";
+
+// src/canonical.ts
+function canonicalJson(value) {
+  return encode(value);
+}
+function encode(value) {
+  if (value === null) return "null";
+  if (typeof value === "string") return JSON.stringify(value);
+  if (typeof value === "boolean") return value ? "true" : "false";
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new TypeError("canonicalJson: cannot encode a non-finite number");
+    }
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((entry) => encode(entry)).join(",")}]`;
+  }
+  if (typeof value === "object") {
+    const record = value;
+    const keys = Object.keys(record).filter((key) => record[key] !== void 0).sort();
+    return `{${keys.map((key) => `${JSON.stringify(key)}:${encode(record[key])}`).join(",")}}`;
+  }
+  throw new TypeError(`canonicalJson: cannot encode a value of type ${typeof value}`);
+}
+
+// src/config.ts
+import { getAsset } from "node:sea";
+function publicKeyBytes(config) {
+  const raw = Buffer.from(config.publicKey, "base64");
+  if (raw.length !== 32) {
+    throw new Error(`product config for "${config.product}" has a bad publicKey (want 32 raw bytes)`);
+  }
+  return raw;
+}
+
+// src/payload.ts
+function canonicalManifestBytes(manifest) {
+  return Buffer.from(
+    canonicalJson({
+      created: manifest.created,
+      files: manifest.files.map((file) => ({ path: file.path, sha256: file.sha256, size: file.size })),
+      version: manifest.version
+    }),
+    "utf8"
+  );
+}
+function ed25519PublicKey(config) {
+  const raw = publicKeyBytes(config);
+  return createPublicKey({
+    key: { kty: "OKP", crv: "Ed25519", x: raw.toString("base64url") },
+    format: "jwk"
+  });
+}
+function verifyManifest(manifest, signature, config) {
+  try {
+    const signatureBytes = Buffer.from(signature, "base64");
+    if (signatureBytes.length === 0) return false;
+    return verify(null, canonicalManifestBytes(manifest), ed25519PublicKey(config), signatureBytes);
+  } catch {
+    return false;
+  }
+}
+function verifyFileBytes(entry, bytes) {
+  if (entry.size !== bytes.length) return false;
+  return createHash("sha256").update(bytes).digest("hex") === entry.sha256.toLowerCase();
+}
+function parseManifest(json) {
+  if (typeof json !== "object" || json === null) throw new Error("the release manifest is not an object");
+  const record = json;
+  if (typeof record.version !== "string" || !record.version) throw new Error("the release manifest has no version");
+  if (typeof record.created !== "string" || !record.created) throw new Error("the release manifest has no created stamp");
+  if (!Array.isArray(record.files)) throw new Error("the release manifest has no files list");
+  if (typeof record.signature !== "string" || !record.signature) {
+    throw new Error("the release manifest is unsigned");
+  }
+  const files = record.files.map((entry) => {
+    const file = entry;
+    if (typeof file.path !== "string" || typeof file.sha256 !== "string" || typeof file.size !== "number") {
+      throw new Error("the release manifest lists a malformed file");
+    }
+    const safe = safeManifestPath(file.path);
+    if (safe === null) throw new Error(`the release manifest lists an unsafe path: ${file.path}`);
+    return { path: safe, sha256: file.sha256, size: file.size };
+  });
+  return { version: record.version, created: record.created, files, signature: record.signature };
+}
+function safeManifestPath(rawPath) {
+  if (rawPath.length === 0 || rawPath.includes("\0") || rawPath.includes("\\")) return null;
+  if (rawPath.startsWith("/")) return null;
+  const segments = rawPath.split("/");
+  for (const segment of segments) {
+    if (segment === "" || segment === "." || segment === "..") return null;
+  }
+  return segments.join("/");
+}
+
+// src/acquisition.ts
+function lockInstallation(dir) {
+  mkdirSync(dir, { recursive: true });
+  const path = join2(dir, "installation.lock");
+  const owner = `${process.pid}:${randomUUID()}`;
+  try {
+    writeFileSync(path, owner, { flag: "wx", mode: 384 });
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    const recovery = `${path}.recovery`;
+    try {
+      writeFileSync(recovery, owner, { flag: "wx", mode: 384, flush: true });
+    } catch {
+      throw new Error("installation lock recovery is already pending");
+    }
+    try {
+      const previous = readFileSync(path, "utf8");
+      const pid = Number(previous.split(":")[0]);
+      if (!Number.isInteger(pid) || pid <= 0) throw new Error("installation lock is malformed; recovery required");
+      try {
+        process.kill(pid, 0);
+        throw new Error("another installer is running");
+      } catch (probe) {
+        if (probe.code !== "ESRCH") throw probe;
+      }
+      unlinkSync(path);
+      writeFileSync(path, owner, { flag: "wx", mode: 384, flush: true });
+    } finally {
+      unlinkSync(recovery);
+    }
+  }
+  let released = false;
+  return () => {
+    if (!released && readFileSync(path, "utf8") === owner) unlinkSync(path);
+    released = true;
+  };
+}
+
+// src/refresh.ts
+var LAUNCHER_RECORD_FILE = "launcher.json";
+var RECORD_TIMEOUT_MS = 1e4;
+function platformKey(platform, arch) {
+  if (platform === "win32") return arch === "x64" || arch === "arm64" ? `win-${arch}` : null;
+  return platform === "darwin" && arch === "arm64" ? "darwin-arm64" : null;
+}
+function verifierFor(target) {
+  return { product: target.product, host: target.host, loginKind: "github", publicKey: target.key, binName: target.bin };
+}
+async function fetchRecord(target, options) {
+  let json;
+  try {
+    const response = await (options.fetch ?? fetch)(
+      `${target.host.replace(/\/+$/u, "")}/release/launcher`,
+      { signal: AbortSignal.timeout(options.timeoutMs ?? RECORD_TIMEOUT_MS) }
+    );
+    if (!response.ok) return null;
+    json = await response.json();
+  } catch {
+    return null;
+  }
+  let record;
+  try {
+    record = parseManifest(json);
+  } catch {
+    return null;
+  }
+  if (!verifyManifest(record, record.signature, verifierFor(target))) return "bad-signature";
+  return { version: record.version, files: record.files };
+}
+async function readLauncherRecord(target, options = {}) {
+  const record = await fetchRecord(target, options);
+  return record === "bad-signature" ? null : record;
+}
+function compareVersions(a, b) {
+  const split = (v) => {
+    const [core, pre = ""] = v.split("-", 2);
+    return { nums: core.split(".").map((n) => Number.parseInt(n, 10) || 0), pre };
+  };
+  const x = split(a);
+  const y = split(b);
+  for (let i = 0; i < 3; i++) if ((x.nums[i] ?? 0) !== (y.nums[i] ?? 0)) return (x.nums[i] ?? 0) > (y.nums[i] ?? 0) ? 1 : -1;
+  if (x.pre === y.pre) return 0;
+  if (!x.pre) return 1;
+  if (!y.pre) return -1;
+  return x.pre > y.pre ? 1 : -1;
+}
+function recordedPath(productDir) {
+  try {
+    const saved = JSON.parse(readFileSync2(join3(productDir, LAUNCHER_RECORD_FILE), "utf8"));
+    return typeof saved.path === "string" && saved.path ? saved.path : null;
+  } catch {
+    return null;
+  }
+}
+function installedPath(target, productDir, platform) {
+  return platform === "win32" ? join3(productDir, "bin", `${target.bin}.exe`) : join3(homedir(), ".local", "bin", target.bin);
+}
+function parseLauncherVersion(stdout, bin) {
+  const text = String(stdout).trim();
+  if (!text.startsWith(`${bin} `)) return null;
+  return text.match(/launcher (\d+\.\d+\.\d+[^\s)]*)/u)?.[1] ?? null;
+}
+function runVersion(path, bin) {
+  return new Promise((resolve2) => {
+    execFile(path, ["--version"], { timeout: 3e4, windowsHide: true, encoding: "utf8" }, (error, stdout) => {
+      resolve2(error ? null : parseLauncherVersion(stdout, bin));
+    });
+  });
+}
+function removeStale(file) {
+  const prefix = `${basename(file)}.old-`;
+  let names;
+  try {
+    names = readdirSync(dirname2(file));
+  } catch {
+    return;
+  }
+  for (const name of names) {
+    if (!name.startsWith(prefix)) continue;
+    try {
+      rmSync(join3(dirname2(file), name), { force: true });
+    } catch {
+    }
+  }
+}
+async function refreshLauncher(target, options = {}) {
+  const started = Date.now();
+  const platform = options.platform ?? process.platform;
+  const key = platformKey(platform, options.arch ?? process.arch);
+  if (!key) return null;
+  const productDir = options.productDir ?? defaultProductDir(target.product);
+  const recorded = recordedPath(productDir);
+  const file = options.path ?? (recorded && existsSync2(recorded) ? recorded : installedPath(target, productDir, platform));
+  if (!existsSync2(file) || lstatSync(file).isSymbolicLink()) return null;
+  if (!options.dryRun) removeStale(file);
+  const from = await (options.readVersion ?? ((path) => runVersion(path, target.bin)))(file);
+  if (!from) return null;
+  const arm = (verdict, to, detail) => ({ surface: "launcher", from, to, verdict, detail, durationMs: Date.now() - started });
+  const record = await fetchRecord(target, options);
+  if (record === "bad-signature") return arm("fail", from, "The launcher record failed its signature check.");
+  const entry = record?.files.find((candidate) => candidate.path === key);
+  if (!record || !entry) return arm("skip", from, "No launcher update is offered yet.");
+  if (compareVersions(record.version, from) <= 0) return arm("ok", from, "");
+  if (options.dryRun) return arm("ok", record.version, "");
+  let unlock;
+  if (!options.lockHeld) {
+    try {
+      unlock = lockInstallation(productDir);
+    } catch {
+      return arm("defer", from, "Another install is running; the launcher updates next time.");
+    }
+  }
+  const next = `${file}.new-${process.pid}`;
+  let moved;
+  try {
+    let bytes;
+    try {
+      const response = await (options.fetch ?? fetch)(
+        `${(target.dl ?? target.host).replace(/\/+$/u, "")}/dl/${target.product}/${key}`,
+        { signal: AbortSignal.timeout(3e5) }
+      );
+      if (!response.ok) return arm("defer", from, "The launcher download did not complete; it retries next time.");
+      bytes = await readDownload(response, void 0, entry.size);
+    } catch {
+      return arm("defer", from, "The launcher download did not complete; it retries next time.");
+    }
+    if (!verifyFileBytes(entry, bytes)) return arm("fail", from, "The downloaded launcher failed its checksum.");
+    try {
+      writeFileSync2(next, bytes, { mode: 493 });
+      if (platform !== "win32") chmodSync(next, 493);
+      if (platform === "win32") {
+        moved = `${file}.old-${process.pid}-${Date.now()}`;
+        renameSync(file, moved);
+      }
+      renameSync(next, file);
+    } catch {
+      try {
+        if (moved && !existsSync2(file)) renameSync(moved, file);
+      } catch {
+      }
+      rmSync(next, { force: true });
+      return arm("fail", from, "The launcher could not be replaced.");
+    }
+    return arm("ok", record.version, "");
+  } finally {
+    unlock?.();
+  }
+}
+export {
+  LAUNCHER_RECORD_FILE,
+  compareVersions,
+  parseLauncherVersion,
+  readLauncherRecord,
+  refreshLauncher
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/installer-launcher",
-  "version": "1.0.1",
+  "version": "1.2.0",
   "description": "Single-executable (SEA) launcher: sign-in, gated payload fetch, self-update. One copy ships per product.",
   "type": "module",
   "license": "UNLICENSED",
@@ -13,7 +13,8 @@
   "main": "dist/launcher.js",
   "exports": {
     ".": "./dist/launcher.js",
-    "./acquisition-required": "./dist/acquisition-required.mjs"
+    "./acquisition-required": "./dist/acquisition-required.mjs",
+    "./refresh": "./dist/refresh.js"
   },
   "files": [
     "dist",