@north-light/crouter 0.3.318 → 0.3.320

package/dist/commands/sys/support/submit.js

@@ -1,524 +1,6 @@
-// Explicit private egress for a bundle produced by `crtr sys support prepare`.
-// The core returns or throws without writing output; the command leaf only wires argv/env/gh.
-import { spawnSync } from 'node:child_process';
-import { randomBytes } from 'node:crypto';
-import { closeSync, constants as fsConstants, fstatSync, fsyncSync, lstatSync, openSync, readdirSync, readSync, realpathSync, renameSync, unlinkSync, writeSync, } from 'node:fs';
-import { basename, dirname, join } from 'node:path';
-import { defineLeaf } from '../../../core/command.js';
-import { general, network, notFound, usage } from '../../../core/errors.js';
-import { userScopeRoot } from '../../../core/scope.js';
-const MANIFEST_NAME = 'manifest.json';
-const BUNDLE_NAME = 'bundle.jsonl';
-const MARKER_NAME = 'submitted.json';
-const CAP_BYTES = 2_097_152;
-const REFERENCE_PATTERN = /^\d{8}T\d{9}Z-[0-9a-f]{8}$/;
-const REPO_PATTERN = /^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/;
-const ISO_TIMESTAMP_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
-const CATEGORIES = ['events', 'runtime_state', 'raw_residue'];
-const STATUSES = ['absent', 'read', 'unreadable', 'raced'];
-const GH_MAX_BUFFER = 8 * 1024 * 1024;
-function splitIncludedResponse(stdout) {
-    const crlfBoundary = stdout.indexOf('\r\n\r\n');
-    const lfBoundary = stdout.indexOf('\n\n');
-    const boundary = crlfBoundary >= 0 ? crlfBoundary : lfBoundary;
-    if (boundary < 0)
-        return { body: stdout };
-    const separatorBytes = crlfBoundary >= 0 ? 4 : 2;
-    const header = stdout.subarray(0, boundary).toString('ascii');
-    const match = /^HTTP\/\S+ ([0-9]{3})(?: |\r?$)/m.exec(header);
-    if (match === null)
-        return { body: stdout };
-    return { body: stdout.subarray(boundary + separatorBytes), httpStatus: Number(match[1]) };
-}
-export function defaultGhRunner(args, input) {
-    const result = spawnSync('gh', args, {
-        input,
-        maxBuffer: GH_MAX_BUFFER,
-        env: { ...process.env, GH_HOST: 'github.com' },
-    });
-    if (result.error !== undefined)
-        return { code: null, stdout: Buffer.alloc(0), stderr: '', error: result.error };
-    const raw = Buffer.isBuffer(result.stdout) ? result.stdout : Buffer.from(String(result.stdout ?? ''), 'utf8');
-    const stderr = Buffer.isBuffer(result.stderr) ? result.stderr.toString('utf8') : String(result.stderr ?? '');
-    const included = args.includes('--include') ? splitIncludedResponse(raw) : { body: raw, httpStatus: undefined };
-    return { code: result.status, stdout: included.body, stderr, httpStatus: included.httpStatus };
-}
-// symlink-free, TOCTOU-safe filesystem access
-// `~/.crouter/support/<reference>/` is user-writable, so every open here rejects symlinks
-// and confirms the thing opened is the thing later read/uploaded — never an arbitrary path.
-function closeSafe(fd) {
-    try {
-        closeSync(fd);
-    }
-    catch {
-        // Best effort after the operation has already succeeded or failed.
-    }
-}
-function sameIdentity(actual, expected) {
-    return actual.dev === expected.dev && actual.ino === expected.ino;
-}
-/**
- * Every pathname-based list/open/create/rename against a held directory races the possibility
- * that its pathname was swapped (renamed away, replaced by a symlink, replaced by another
- * directory) since it was opened. Call this immediately before each such operation — it is the
- * one place that re-proves the pathname still names the exact directory the fd identifies.
- */
-function reconfirmDir(dir) {
-    const held = fstatSync(dir.fd);
-    let current;
-    try {
-        current = lstatSync(dir.path);
-    }
-    catch (error) {
-        throw general(`${dir.path} identity changed since it was opened: ${error.message}`);
-    }
-    if (!held.isDirectory() || !sameIdentity(held, dir) || current.isSymbolicLink() || !current.isDirectory() || !sameIdentity(current, dir)) {
-        throw general(`${dir.path} identity changed since it was opened — refusing further access`);
-    }
-}
-function openSafeDirectory(path) {
-    let lst;
-    try {
-        lst = lstatSync(path);
-    }
-    catch (error) {
-        throw notFound(`${path} does not exist: ${error.message}`);
-    }
-    if (lst.isSymbolicLink() || !lst.isDirectory())
-        throw general(`${path} must be a real, non-symlink directory`);
-    const fd = openSync(path, fsConstants.O_RDONLY | fsConstants.O_DIRECTORY | fsConstants.O_NOFOLLOW);
-    try {
-        const fst = fstatSync(fd);
-        if (!fst.isDirectory() || !sameIdentity(fst, lst))
-            throw general(`${path} identity changed while it was opened`);
-        return { path, realPath: realpathSync(path), fd, dev: fst.dev, ino: fst.ino };
-    }
-    catch (error) {
-        closeSafe(fd);
-        throw error;
-    }
-}
-function openSafeFile(dir, name) {
-    reconfirmDir(dir);
-    const path = join(dir.path, name);
-    let lst;
-    try {
-        lst = lstatSync(path);
-    }
-    catch (error) {
-        throw notFound(`${path} does not exist: ${error.message}`);
-    }
-    if (lst.isSymbolicLink() || !lst.isFile())
-        throw general(`${path} must be a regular, non-symlink file`);
-    const fd = openSync(path, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
-    try {
-        const fst = fstatSync(fd);
-        if (!fst.isFile() || !sameIdentity(fst, lst))
-            throw general(`${path} identity changed while it was opened`);
-        if (!Number.isSafeInteger(fst.size) || fst.size < 0 || fst.size > CAP_BYTES) {
-            throw general(`${name} size ${fst.size} is outside the allowed 0..${CAP_BYTES}-byte range`);
-        }
-        return { path, fd, dev: fst.dev, ino: fst.ino, size: fst.size, mtimeMs: fst.mtimeMs, ctimeMs: fst.ctimeMs };
-    }
-    catch (error) {
-        closeSafe(fd);
-        throw error;
-    }
-}
-function readAll(file) {
-    const buffer = Buffer.alloc(file.size);
-    let offset = 0;
-    while (offset < buffer.length) {
-        const read = readSync(file.fd, buffer, offset, buffer.length - offset, offset);
-        if (read <= 0)
-            throw general(`${file.path} could not be read in full`);
-        offset += read;
-    }
-    return buffer;
-}
-/** A simple, direct re-check that a held file is still exactly what it was when opened. */
-function unchanged(file) {
-    const held = fstatSync(file.fd);
-    let current;
-    try {
-        current = lstatSync(file.path);
-    }
-    catch {
-        return false;
-    }
-    return (held.size === file.size &&
-        held.mtimeMs === file.mtimeMs &&
-        held.ctimeMs === file.ctimeMs &&
-        sameIdentity(held, file) &&
-        !current.isSymbolicLink() &&
-        current.isFile() &&
-        sameIdentity(current, file));
-}
-function checkEntries(dir) {
-    reconfirmDir(dir);
-    const entries = readdirSync(dir.path, { withFileTypes: true });
-    const names = new Set();
-    for (const entry of entries) {
-        if (entry.name !== MANIFEST_NAME && entry.name !== BUNDLE_NAME && entry.name !== MARKER_NAME) {
-            throw general(`unexpected entry in prepared bundle directory: ${entry.name}`);
-        }
-        if (!entry.isFile())
-            throw general(`${entry.name} must be a regular file, not a directory or symlink`);
-        names.add(entry.name);
-    }
-    if (!names.has(MANIFEST_NAME))
-        throw notFound(`prepared bundle directory is missing ${MANIFEST_NAME}`);
-    if (!names.has(BUNDLE_NAME))
-        throw notFound(`prepared bundle directory is missing ${BUNDLE_NAME}`);
-}
-function openReference(reference) {
-    const rootPath = join(userScopeRoot(), 'support');
-    let root;
-    try {
-        root = openSafeDirectory(rootPath);
-    }
-    catch (error) {
-        throw notFound(`no trustworthy support root at ${rootPath} — run \`crtr sys support prepare\` first: ${error.message}`);
-    }
-    try {
-        reconfirmDir(root);
-        const dir = openSafeDirectory(join(root.path, reference));
-        if (dirname(dir.realPath) !== root.realPath || basename(dir.realPath) !== reference) {
-            closeSafe(dir.fd);
-            throw general(`prepared bundle directory for ${reference} is not directly contained in the opened support root`);
-        }
-        return { root, dir };
-    }
-    catch (error) {
-        closeSafe(root.fd);
-        throw error;
-    }
-}
-// manifest and bundle validation
-// An ordinary manifest: every field is either fixed input (the reference) or independently
-// checked against its own declared shape. Nothing here is self-referential — the cap is
-// enforced by directly measuring the two files, not by trusting a declared byte count.
-function exactKeySet(value, keys, label) {
-    const actual = Object.keys(value).sort();
-    const expected = [...keys].sort();
-    if (actual.length !== expected.length || actual.some((key, index) => key !== expected[index])) {
-        throw general(`${label} has an unexpected set of fields: ${actual.join(',')}`);
-    }
-}
-function isoTimestamp(value, label) {
-    if (typeof value !== 'string' || !ISO_TIMESTAMP_PATTERN.test(value) || !Number.isFinite(Date.parse(value))) {
-        throw general(`${label} must be a valid finite ISO timestamp`);
-    }
-    return value;
-}
-function safeNodeId(value, label) {
-    if (typeof value !== 'string' || value === '' || value === '.' || value === '..' || Buffer.byteLength(value) > 128 || /[\\/\0]/.test(value)) {
-        throw general(`${label} is not a safe node identifier`);
-    }
-    return value;
-}
-function safeSourceLabel(value, label) {
-    if (typeof value !== 'string' || value === '' || value.startsWith('/') || value.includes('\\') || value.includes('\0')) {
-        throw general(`${label} must be a nonempty relative slash path`);
-    }
-    const segments = value.split('/');
-    if (segments.some((segment) => segment === '' || segment === '.' || segment === '..'))
-        throw general(`${label} contains an unsafe path segment`);
-    return value;
-}
-function categoryValue(value, label) {
-    if (typeof value !== 'string' || !CATEGORIES.includes(value))
-        throw general(`${label} must be one of ${CATEGORIES.join(', ')}`);
-    return value;
-}
-function statusValue(value, label) {
-    if (typeof value !== 'string' || !STATUSES.includes(value))
-        throw general(`${label} must be one of ${STATUSES.join(', ')}`);
-    return value;
-}
-function parseManifest(buffer, reference) {
-    let parsed;
-    try {
-        parsed = JSON.parse(buffer.toString('utf8'));
-    }
-    catch (error) {
-        throw general(`${MANIFEST_NAME} is not valid JSON: ${error.message}`);
-    }
-    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
-        throw general(`${MANIFEST_NAME} must be a JSON object`);
-    const obj = parsed;
-    exactKeySet(obj, ['reference', 'created_at', 'node_id', 'sources'], MANIFEST_NAME);
-    if (obj.reference !== reference)
-        throw general(`${MANIFEST_NAME} reference does not match ${reference}`);
-    const createdAt = isoTimestamp(obj.created_at, `${MANIFEST_NAME} created_at`);
-    const nodeId = safeNodeId(obj.node_id, `${MANIFEST_NAME} node_id`);
-    if (!Array.isArray(obj.sources))
-        throw general(`${MANIFEST_NAME} sources must be an array`);
-    const sources = [];
-    const seen = new Set();
-    for (let index = 0; index < obj.sources.length; index += 1) {
-        const raw = obj.sources[index];
-        if (typeof raw !== 'object' || raw === null || Array.isArray(raw))
-            throw general(`${MANIFEST_NAME} sources[${index}] must be an object`);
-        const record = raw;
-        exactKeySet(record, ['source', 'category', 'status', 'truncated'], `${MANIFEST_NAME} sources[${index}]`);
-        const source = safeSourceLabel(record.source, `${MANIFEST_NAME} sources[${index}].source`);
-        if (seen.has(source))
-            throw general(`${MANIFEST_NAME} contains duplicate source ${source}`);
-        seen.add(source);
-        const sourceCategory = categoryValue(record.category, `${MANIFEST_NAME} sources[${index}].category`);
-        const status = statusValue(record.status, `${MANIFEST_NAME} sources[${index}].status`);
-        if (typeof record.truncated !== 'boolean')
-            throw general(`${MANIFEST_NAME} sources[${index}].truncated must be a boolean`);
-        sources.push({ source, category: sourceCategory, status, truncated: record.truncated });
-    }
-    return { reference, created_at: createdAt, node_id: nodeId, sources };
-}
-function validateBundle(buffer, manifest) {
-    const bySource = new Map(manifest.sources.map((source) => [source.source, source]));
-    let start = 0;
-    while (start < buffer.length) {
-        const lf = buffer.indexOf(0x0a, start);
-        if (lf < 0)
-            throw general(`${BUNDLE_NAME} contains an unterminated record`);
-        const line = buffer.subarray(start, lf);
-        if (line.length === 0 || lf + 1 - start > CAP_BYTES)
-            throw general(`${BUNDLE_NAME} contains an empty or oversized record`);
-        let raw;
-        try {
-            raw = JSON.parse(line.toString('utf8'));
-        }
-        catch (error) {
-            throw general(`${BUNDLE_NAME} contains invalid JSON: ${error.message}`);
-        }
-        if (typeof raw !== 'object' || raw === null || Array.isArray(raw))
-            throw general(`${BUNDLE_NAME} record must be an object`);
-        const record = raw;
-        exactKeySet(record, ['category', 'source', 'ts', 'content'], `${BUNDLE_NAME} record`);
-        const recordCategory = categoryValue(record.category, `${BUNDLE_NAME} record category`);
-        const source = safeSourceLabel(record.source, `${BUNDLE_NAME} record source`);
-        isoTimestamp(record.ts, `${BUNDLE_NAME} record ts`);
-        const declared = bySource.get(source);
-        if (declared === undefined || declared.category !== recordCategory) {
-            throw general(`${BUNDLE_NAME} record references an undeclared manifest source or mismatched category`);
-        }
-        start = lf + 1;
-    }
-}
-function validatePreparedArtifact(manifestBuffer, bundleBuffer, reference) {
-    if (manifestBuffer.length === 0 || manifestBuffer.at(-1) !== 0x0a)
-        throw general(`${MANIFEST_NAME} must be nonempty and LF-terminated`);
-    if (bundleBuffer.length > 0 && bundleBuffer.at(-1) !== 0x0a)
-        throw general(`${BUNDLE_NAME} must be LF-terminated when nonempty`);
-    if (manifestBuffer.length + bundleBuffer.length > CAP_BYTES)
-        throw general(`combined prepared bytes exceed the ${CAP_BYTES}-byte cap`);
-    const manifest = parseManifest(manifestBuffer, reference);
-    validateBundle(bundleBuffer, manifest);
-}
-function requireSupportRepo(env) {
-    const raw = env.CRTR_SUPPORT_REPO;
-    if (typeof raw !== 'string')
-        throw usage('CRTR_SUPPORT_REPO must be set to exactly "owner/name" — there is no default or public destination.');
-    const match = REPO_PATTERN.exec(raw);
-    if (match === null)
-        throw usage(`CRTR_SUPPORT_REPO must be exactly "owner/name"; got ${JSON.stringify(raw)}.`);
-    return { owner: match[1], name: match[2] };
-}
-function requireGhAuth(ghRunner) {
-    const result = ghRunner(['auth', 'status', '--hostname', 'github.com']);
-    if (result.error !== undefined)
-        throw network(`gh CLI is not available: ${result.error.message}`);
-    if (result.code !== 0)
-        throw network(`gh is not authenticated for github.com: ${result.stderr.trim() || 'gh auth status failed'}`);
-}
-function requirePrivateRepo(ghRunner, requested) {
-    const result = ghRunner(['api', '--hostname', 'github.com', `repos/${requested.owner}/${requested.name}`]);
-    if (result.error !== undefined)
-        throw network(`gh repository lookup failed: ${result.error.message}`);
-    if (result.code !== 0)
-        throw network(`could not read repository metadata: ${result.stderr.trim() || `gh exited ${result.code}`}`);
-    let raw;
-    try {
-        raw = JSON.parse(result.stdout.toString('utf8'));
-    }
-    catch (error) {
-        throw network(`repository metadata was not valid JSON: ${error.message}`);
-    }
-    if (typeof raw !== 'object' || raw === null || Array.isArray(raw))
-        throw network('repository metadata was not an object');
-    const meta = raw;
-    if (meta.private !== true)
-        throw usage('CRTR_SUPPORT_REPO must resolve to a repository proven private on github.com.');
-    if (typeof meta.full_name !== 'string' ||
-        typeof meta.html_url !== 'string' ||
-        typeof meta.default_branch !== 'string' ||
-        meta.default_branch.length === 0 ||
-        meta.default_branch.length > 255 ||
-        /[\0-\x1f\x7f]/.test(meta.default_branch)) {
-        throw network('repository metadata lacks a valid canonical full_name, html_url, or default_branch');
-    }
-    const match = REPO_PATTERN.exec(meta.full_name);
-    if (match === null || meta.full_name.toLowerCase() !== `${requested.owner}/${requested.name}`.toLowerCase()) {
-        throw network('repository metadata did not prove the requested canonical repository identity');
-    }
-    if (meta.html_url !== `https://github.com/${meta.full_name}`)
-        throw network('repository metadata did not prove a canonical github.com URL');
-    return { owner: match[1], name: match[2], fullName: meta.full_name, htmlUrl: meta.html_url, defaultBranch: meta.default_branch };
-}
-function rawGet(ghRunner, repo, path) {
-    const result = ghRunner([
-        'api',
-        '--hostname',
-        'github.com',
-        '--include',
-        `repos/${repo.owner}/${repo.name}/contents/${path}`,
-        '-H',
-        'Accept: application/vnd.github.raw',
-    ]);
-    if (result.error !== undefined)
-        return { kind: 'ambiguous', detail: result.error.message };
-    if (result.code === 0 && result.httpStatus === 200)
-        return { kind: 'found', bytes: result.stdout };
-    if (result.code !== 0 && result.httpStatus === 404)
-        return { kind: 'absent' };
-    return { kind: 'ambiguous', detail: `HTTP ${result.httpStatus ?? 'unknown'}; ${result.stderr.trim() || `gh exited ${result.code}`}` };
-}
-function putContent(ghRunner, repo, path, bytes, message) {
-    const input = Buffer.from(JSON.stringify({ message, content: bytes.toString('base64') }), 'utf8');
-    const result = ghRunner(['api', '--hostname', 'github.com', '--method', 'PUT', `repos/${repo.owner}/${repo.name}/contents/${path}`, '--input', '-'], input);
-    if (result.error !== undefined)
-        throw network(`gh PUT failed for ${path}: ${result.error.message}`);
-    if (result.code !== 0)
-        throw network(`gh PUT rejected ${path}: ${result.stderr.trim() || `gh exited ${result.code}`}`);
-}
-function uploadAndVerify(ghRunner, repo, reference, filename, bytes) {
-    const path = `support/${reference}/${filename}`;
-    const before = rawGet(ghRunner, repo, path);
-    if (before.kind === 'found') {
-        if (before.bytes.equals(bytes))
-            return;
-        throw general(`remote ${path} already exists with different content — refusing to overwrite`);
-    }
-    if (before.kind === 'ambiguous')
-        throw network(`could not determine whether remote ${path} exists: ${before.detail}`);
-    putContent(ghRunner, repo, path, bytes, `support: add ${filename} for ${reference}`);
-    const after = rawGet(ghRunner, repo, path);
-    if (after.kind !== 'found')
-        throw network(`post-upload verification of ${path} failed${after.kind === 'ambiguous' ? `: ${after.detail}` : ': still absent'}`);
-    if (!after.bytes.equals(bytes))
-        throw general(`post-upload verification of ${path} found mismatched bytes`);
-}
-function publishMarker(dir, marker) {
-    reconfirmDir(dir);
-    const tempName = `.submitted-${randomBytes(8).toString('hex')}.tmp`;
-    const tempPath = join(dir.path, tempName);
-    const markerPath = join(dir.path, MARKER_NAME);
-    const bytes = Buffer.from(JSON.stringify(marker, null, 2) + '\n', 'utf8');
-    let renamed = false;
-    try {
-        const fd = openSync(tempPath, fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_NOFOLLOW, 0o600);
-        try {
-            let offset = 0;
-            while (offset < bytes.length)
-                offset += writeSync(fd, bytes, offset, bytes.length - offset, offset);
-            fsyncSync(fd);
-        }
-        finally {
-            closeSafe(fd);
-        }
-        renameSync(tempPath, markerPath); // Atomic; never follows an existing marker symlink.
-        renamed = true;
-    }
-    catch (error) {
-        throw general(`could not publish ${MARKER_NAME}: ${error.message}`);
-    }
-    finally {
-        // One outer boundary: any failure after the temp file was created (write/fsync/rename)
-        // best-effort removes it so a later retry's checkEntries() does not see a forbidden entry.
-        if (!renamed) {
-            try {
-                unlinkSync(tempPath);
-            }
-            catch {
-                // Best-effort; ENOENT here just means the temp file was never created.
-            }
-        }
-    }
-}
-export async function submitPreparedBundle(reference, env, ghRunner = defaultGhRunner) {
-    if (!REFERENCE_PATTERN.test(reference)) {
-        throw usage(`invalid support reference ${JSON.stringify(reference)} — expected YYYYMMDDTHHmmssSSSZ-xxxxxxxx.`);
-    }
-    const ref = openReference(reference);
-    let manifestFile;
-    let bundleFile;
-    try {
-        checkEntries(ref.dir);
-        manifestFile = openSafeFile(ref.dir, MANIFEST_NAME);
-        bundleFile = openSafeFile(ref.dir, BUNDLE_NAME);
-        if (manifestFile.size + bundleFile.size > CAP_BYTES)
-            throw general(`captured prepared file sizes exceed the ${CAP_BYTES}-byte cap`);
-        const manifestBuffer = readAll(manifestFile);
-        const bundleBuffer = readAll(bundleFile);
-        validatePreparedArtifact(manifestBuffer, bundleBuffer, reference);
-        const requested = requireSupportRepo(env);
-        requireGhAuth(ghRunner);
-        const repo = requirePrivateRepo(ghRunner, requested);
-        uploadAndVerify(ghRunner, repo, reference, MANIFEST_NAME, manifestBuffer);
-        uploadAndVerify(ghRunner, repo, reference, BUNDLE_NAME, bundleBuffer);
-        if (!unchanged(manifestFile) || !unchanged(bundleFile)) {
-            throw general(`prepared files changed during submission — refusing to write ${MARKER_NAME}`);
-        }
-        checkEntries(ref.dir);
-        const url = `${repo.htmlUrl}/tree/${encodeURIComponent(repo.defaultBranch)}/support/${reference}`;
-        publishMarker(ref.dir, {
-            reference,
-            repository: repo.fullName,
-            submitted_at: new Date().toISOString(),
-            url,
-        });
-        return { status: 'submitted', reference, repository: repo.fullName, url };
-    }
-    finally {
-        if (manifestFile !== undefined)
-            closeSafe(manifestFile.fd);
-        if (bundleFile !== undefined)
-            closeSafe(bundleFile.fd);
-        closeSafe(ref.dir.fd);
-        closeSafe(ref.root.fd);
-    }
-}
-export const supportSubmitLeaf = defineLeaf({
-    name: 'submit',
-    description: 'submit a prepared local support bundle to a private GitHub repository',
-    whenToUse: 'you already ran `crtr sys support prepare` and have decided to share its printed reference with maintainers. Requires exact CRTR_SUPPORT_REPO=owner/name naming a private github.com repository plus working `gh` auth; fails closed before egress and never re-collects or transforms prepared files.',
-    help: {
-        name: 'sys support submit',
-        summary: 'Validate a prepared bundle locally, then upload manifest.json and bundle.jsonl to support/<reference>/ in the canonical private github.com repository named by CRTR_SUPPORT_REPO, verifying each remote file byte-for-byte',
-        params: [
-            {
-                kind: 'positional',
-                name: 'reference',
-                required: true,
-                constraint: 'The exact reference `crtr sys support prepare` printed — YYYYMMDDTHHmmssSSSZ-xxxxxxxx.',
-            },
-        ],
-        output: [
-            { name: 'repository', type: 'string', required: true, constraint: 'Canonical owner/name of the private destination.' },
-            { name: 'url', type: 'string', required: true, constraint: 'Canonical github.com URL of support/<reference>/.' },
-        ],
-        outputKind: 'object',
-        effects: [
-            'Reads and revalidates the two prepared files under ~/.crouter/support/<reference>/; it never recollects diagnostic sources.',
-            'Uploads manifest.json then bundle.jsonl through the GitHub Contents API; equal remote bytes resume, unequal bytes reject, and only a structured exact HTTP 404 authorizes creation.',
-            'After confirming the local files are unchanged, atomically writes/replaces submitted.json in the reference directory; prepared files remain unchanged.',
-        ],
-    },
-    run: async (input) => {
-        const reference = input.reference;
-        if (reference === undefined || reference === '')
-            throw usage('reference is required. Run `crtr sys support submit -h`.');
-        const result = await submitPreparedBundle(reference, process.env, defaultGhRunner);
-        return { repository: result.repository, url: result.url };
-    },
-});
+var J=Object.defineProperty;var c=(t,r)=>J(t,"name",{value:r,configurable:!0});import{spawnSync as G}from"node:child_process";import{randomBytes as Z}from"node:crypto";import{closeSync as W,constants as y,fstatSync as x,fsyncSync as V,lstatSync as R,openSync as A,readdirSync as K,readSync as X,realpathSync as Q,renameSync as tt,unlinkSync as et,writeSync as rt}from"node:fs";import{basename as ot,dirname as nt,join as S}from"node:path";import{defineLeaf as st}from"../../../core/command.js";import{general as i,network as m,notFound as _,usage as O}from"../../../core/errors.js";import{userScopeRoot as it}from"../../../core/scope.js";const f="manifest.json",l="bundle.jsonl",T="submitted.json",g=2097152,at=/^\d{8}T\d{9}Z-[0-9a-f]{8}$/,E=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/,ct=/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/,k=["events","runtime_state","raw_residue"],L=["absent","read","unreadable","raced"],ut=8*1024*1024;function dt(t){const r=t.indexOf(`\r
+\r
+`),o=t.indexOf(`
+
+`),e=r>=0?r:o;if(e<0)return{body:t};const s=r>=0?4:2,n=t.subarray(0,e).toString("ascii"),a=/^HTTP\/\S+ ([0-9]{3})(?: |\r?$)/m.exec(n);return a===null?{body:t}:{body:t.subarray(e+s),httpStatus:Number(a[1])}}c(dt,"splitIncludedResponse");function j(t,r){const o=G("gh",t,{input:r,maxBuffer:ut,env:{...process.env,GH_HOST:"github.com"}});if(o.error!==void 0)return{code:null,stdout:Buffer.alloc(0),stderr:"",error:o.error};const e=Buffer.isBuffer(o.stdout)?o.stdout:Buffer.from(String(o.stdout??""),"utf8"),s=Buffer.isBuffer(o.stderr)?o.stderr.toString("utf8"):String(o.stderr??""),n=t.includes("--include")?dt(e):{body:e,httpStatus:void 0};return{code:o.status,stdout:n.body,stderr:s,httpStatus:n.httpStatus}}c(j,"defaultGhRunner");function b(t){try{W(t)}catch{}}c(b,"closeSafe");function $(t,r){return t.dev===r.dev&&t.ino===r.ino}c($,"sameIdentity");function P(t){const r=x(t.fd);let o;try{o=R(t.path)}catch(e){throw i(`${t.path} identity changed since it was opened: ${e.message}`)}if(!r.isDirectory()||!$(r,t)||o.isSymbolicLink()||!o.isDirectory()||!$(o,t))throw i(`${t.path} identity changed since it was opened \u2014 refusing further access`)}c(P,"reconfirmDir");function C(t){let r;try{r=R(t)}catch(e){throw _(`${t} does not exist: ${e.message}`)}if(r.isSymbolicLink()||!r.isDirectory())throw i(`${t} must be a real, non-symlink directory`);const o=A(t,y.O_RDONLY|y.O_DIRECTORY|y.O_NOFOLLOW);try{const e=x(o);if(!e.isDirectory()||!$(e,r))throw i(`${t} identity changed while it was opened`);return{path:t,realPath:Q(t),fd:o,dev:e.dev,ino:e.ino}}catch(e){throw b(o),e}}c(C,"openSafeDirectory");function M(t,r){P(t);const o=S(t.path,r);let e;try{e=R(o)}catch(n){throw _(`${o} does not exist: ${n.message}`)}if(e.isSymbolicLink()||!e.isFile())throw i(`${o} must be a regular, non-symlink file`);const s=A(o,y.O_RDONLY|y.O_NOFOLLOW);try{const n=x(s);if(!n.isFile()||!$(n,e))throw i(`${o} identity changed while it was opened`);if(!Number.isSafeInteger(n.size)||n.size<0||n.size>g)throw i(`${r} size ${n.size} is outside the allowed 0..${g}-byte range`);return{path:o,fd:s,dev:n.dev,ino:n.ino,size:n.size,mtimeMs:n.mtimeMs,ctimeMs:n.ctimeMs}}catch(n){throw b(s),n}}c(M,"openSafeFile");function v(t){const r=Buffer.alloc(t.size);let o=0;for(;o<r.length;){const e=X(t.fd,r,o,r.length-o,o);if(e<=0)throw i(`${t.path} could not be read in full`);o+=e}return r}c(v,"readAll");function F(t){const r=x(t.fd);let o;try{o=R(t.path)}catch{return!1}return r.size===t.size&&r.mtimeMs===t.mtimeMs&&r.ctimeMs===t.ctimeMs&&$(r,t)&&!o.isSymbolicLink()&&o.isFile()&&$(o,t)}c(F,"unchanged");function U(t){P(t);const r=K(t.path,{withFileTypes:!0}),o=new Set;for(const e of r){if(e.name!==f&&e.name!==l&&e.name!==T)throw i(`unexpected entry in prepared bundle directory: ${e.name}`);if(!e.isFile())throw i(`${e.name} must be a regular file, not a directory or symlink`);o.add(e.name)}if(!o.has(f))throw _(`prepared bundle directory is missing ${f}`);if(!o.has(l))throw _(`prepared bundle directory is missing ${l}`)}c(U,"checkEntries");function ft(t){const r=S(it(),"support");let o;try{o=C(r)}catch(e){throw _(`no trustworthy support root at ${r} \u2014 run \`crtr sys support prepare\` first: ${e.message}`)}try{P(o);const e=C(S(o.path,t));if(nt(e.realPath)!==o.realPath||ot(e.realPath)!==t)throw b(e.fd),i(`prepared bundle directory for ${t} is not directly contained in the opened support root`);return{root:o,dir:e}}catch(e){throw b(o.fd),e}}c(ft,"openReference");function N(t,r,o){const e=Object.keys(t).sort(),s=[...r].sort();if(e.length!==s.length||e.some((n,a)=>n!==s[a]))throw i(`${o} has an unexpected set of fields: ${e.join(",")}`)}c(N,"exactKeySet");function B(t,r){if(typeof t!="string"||!ct.test(t)||!Number.isFinite(Date.parse(t)))throw i(`${r} must be a valid finite ISO timestamp`);return t}c(B,"isoTimestamp");function lt(t,r){if(typeof t!="string"||t===""||t==="."||t===".."||Buffer.byteLength(t)>128||/[\\/\0]/.test(t))throw i(`${r} is not a safe node identifier`);return t}c(lt,"safeNodeId");function z(t,r){if(typeof t!="string"||t===""||t.startsWith("/")||t.includes("\\")||t.includes("\0"))throw i(`${r} must be a nonempty relative slash path`);if(t.split("/").some(e=>e===""||e==="."||e===".."))throw i(`${r} contains an unsafe path segment`);return t}c(z,"safeSourceLabel");function D(t,r){if(typeof t!="string"||!k.includes(t))throw i(`${r} must be one of ${k.join(", ")}`);return t}c(D,"categoryValue");function ht(t,r){if(typeof t!="string"||!L.includes(t))throw i(`${r} must be one of ${L.join(", ")}`);return t}c(ht,"statusValue");function mt(t,r){let o;try{o=JSON.parse(t.toString("utf8"))}catch(d){throw i(`${f} is not valid JSON: ${d.message}`)}if(typeof o!="object"||o===null||Array.isArray(o))throw i(`${f} must be a JSON object`);const e=o;if(N(e,["reference","created_at","node_id","sources"],f),e.reference!==r)throw i(`${f} reference does not match ${r}`);const s=B(e.created_at,`${f} created_at`),n=lt(e.node_id,`${f} node_id`);if(!Array.isArray(e.sources))throw i(`${f} sources must be an array`);const a=[],u=new Set;for(let d=0;d<e.sources.length;d+=1){const h=e.sources[d];if(typeof h!="object"||h===null||Array.isArray(h))throw i(`${f} sources[${d}] must be an object`);const p=h;N(p,["source","category","status","truncated"],`${f} sources[${d}]`);const w=z(p.source,`${f} sources[${d}].source`);if(u.has(w))throw i(`${f} contains duplicate source ${w}`);u.add(w);const Y=D(p.category,`${f} sources[${d}].category`),q=ht(p.status,`${f} sources[${d}].status`);if(typeof p.truncated!="boolean")throw i(`${f} sources[${d}].truncated must be a boolean`);a.push({source:w,category:Y,status:q,truncated:p.truncated})}return{reference:r,created_at:s,node_id:n,sources:a}}c(mt,"parseManifest");function pt(t,r){const o=new Map(r.sources.map(s=>[s.source,s]));let e=0;for(;e<t.length;){const s=t.indexOf(10,e);if(s<0)throw i(`${l} contains an unterminated record`);const n=t.subarray(e,s);if(n.length===0||s+1-e>g)throw i(`${l} contains an empty or oversized record`);let a;try{a=JSON.parse(n.toString("utf8"))}catch(w){throw i(`${l} contains invalid JSON: ${w.message}`)}if(typeof a!="object"||a===null||Array.isArray(a))throw i(`${l} record must be an object`);const u=a;N(u,["category","source","ts","content"],`${l} record`);const d=D(u.category,`${l} record category`),h=z(u.source,`${l} record source`);B(u.ts,`${l} record ts`);const p=o.get(h);if(p===void 0||p.category!==d)throw i(`${l} record references an undeclared manifest source or mismatched category`);e=s+1}}c(pt,"validateBundle");function yt(t,r,o){if(t.length===0||t.at(-1)!==10)throw i(`${f} must be nonempty and LF-terminated`);if(r.length>0&&r.at(-1)!==10)throw i(`${l} must be LF-terminated when nonempty`);if(t.length+r.length>g)throw i(`combined prepared bytes exceed the ${g}-byte cap`);const e=mt(t,o);pt(r,e)}c(yt,"validatePreparedArtifact");function bt(t){const r=t.CRTR_SUPPORT_REPO;if(typeof r!="string")throw O('CRTR_SUPPORT_REPO must be set to exactly "owner/name" \u2014 there is no default or public destination.');const o=E.exec(r);if(o===null)throw O(`CRTR_SUPPORT_REPO must be exactly "owner/name"; got ${JSON.stringify(r)}.`);return{owner:o[1],name:o[2]}}c(bt,"requireSupportRepo");function gt(t){const r=t(["auth","status","--hostname","github.com"]);if(r.error!==void 0)throw m(`gh CLI is not available: ${r.error.message}`);if(r.code!==0)throw m(`gh is not authenticated for github.com: ${r.stderr.trim()||"gh auth status failed"}`)}c(gt,"requireGhAuth");function wt(t,r){const o=t(["api","--hostname","github.com",`repos/${r.owner}/${r.name}`]);if(o.error!==void 0)throw m(`gh repository lookup failed: ${o.error.message}`);if(o.code!==0)throw m(`could not read repository metadata: ${o.stderr.trim()||`gh exited ${o.code}`}`);let e;try{e=JSON.parse(o.stdout.toString("utf8"))}catch(a){throw m(`repository metadata was not valid JSON: ${a.message}`)}if(typeof e!="object"||e===null||Array.isArray(e))throw m("repository metadata was not an object");const s=e;if(s.private!==!0)throw O("CRTR_SUPPORT_REPO must resolve to a repository proven private on github.com.");if(typeof s.full_name!="string"||typeof s.html_url!="string"||typeof s.default_branch!="string"||s.default_branch.length===0||s.default_branch.length>255||/[\0-\x1f\x7f]/.test(s.default_branch))throw m("repository metadata lacks a valid canonical full_name, html_url, or default_branch");const n=E.exec(s.full_name);if(n===null||s.full_name.toLowerCase()!==`${r.owner}/${r.name}`.toLowerCase())throw m("repository metadata did not prove the requested canonical repository identity");if(s.html_url!==`https://github.com/${s.full_name}`)throw m("repository metadata did not prove a canonical github.com URL");return{owner:n[1],name:n[2],fullName:s.full_name,htmlUrl:s.html_url,defaultBranch:s.default_branch}}c(wt,"requirePrivateRepo");function I(t,r,o){const e=t(["api","--hostname","github.com","--include",`repos/${r.owner}/${r.name}/contents/${o}`,"-H","Accept: application/vnd.github.raw"]);return e.error!==void 0?{kind:"ambiguous",detail:e.error.message}:e.code===0&&e.httpStatus===200?{kind:"found",bytes:e.stdout}:e.code!==0&&e.httpStatus===404?{kind:"absent"}:{kind:"ambiguous",detail:`HTTP ${e.httpStatus??"unknown"}; ${e.stderr.trim()||`gh exited ${e.code}`}`}}c(I,"rawGet");function $t(t,r,o,e,s){const n=Buffer.from(JSON.stringify({message:s,content:e.toString("base64")}),"utf8"),a=t(["api","--hostname","github.com","--method","PUT",`repos/${r.owner}/${r.name}/contents/${o}`,"--input","-"],n);if(a.error!==void 0)throw m(`gh PUT failed for ${o}: ${a.error.message}`);if(a.code!==0)throw m(`gh PUT rejected ${o}: ${a.stderr.trim()||`gh exited ${a.code}`}`)}c($t,"putContent");function H(t,r,o,e,s){const n=`support/${o}/${e}`,a=I(t,r,n);if(a.kind==="found"){if(a.bytes.equals(s))return;throw i(`remote ${n} already exists with different content \u2014 refusing to overwrite`)}if(a.kind==="ambiguous")throw m(`could not determine whether remote ${n} exists: ${a.detail}`);$t(t,r,n,s,`support: add ${e} for ${o}`);const u=I(t,r,n);if(u.kind!=="found")throw m(`post-upload verification of ${n} failed${u.kind==="ambiguous"?`: ${u.detail}`:": still absent"}`);if(!u.bytes.equals(s))throw i(`post-upload verification of ${n} found mismatched bytes`)}c(H,"uploadAndVerify");function St(t,r){P(t);const o=`.submitted-${Z(8).toString("hex")}.tmp`,e=S(t.path,o),s=S(t.path,T),n=Buffer.from(JSON.stringify(r,null,2)+`
+`,"utf8");let a=!1;try{const u=A(e,y.O_WRONLY|y.O_CREAT|y.O_EXCL|y.O_NOFOLLOW,384);try{let d=0;for(;d<n.length;)d+=rt(u,n,d,n.length-d,d);V(u)}finally{b(u)}tt(e,s),a=!0}catch(u){throw i(`could not publish ${T}: ${u.message}`)}finally{if(!a)try{et(e)}catch{}}}c(St,"publishMarker");async function _t(t,r,o=j){if(!at.test(t))throw O(`invalid support reference ${JSON.stringify(t)} \u2014 expected YYYYMMDDTHHmmssSSSZ-xxxxxxxx.`);const e=ft(t);let s,n;try{if(U(e.dir),s=M(e.dir,f),n=M(e.dir,l),s.size+n.size>g)throw i(`captured prepared file sizes exceed the ${g}-byte cap`);const a=v(s),u=v(n);yt(a,u,t);const d=bt(r);gt(o);const h=wt(o,d);if(H(o,h,t,f,a),H(o,h,t,l,u),!F(s)||!F(n))throw i(`prepared files changed during submission \u2014 refusing to write ${T}`);U(e.dir);const p=`${h.htmlUrl}/tree/${encodeURIComponent(h.defaultBranch)}/support/${t}`;return St(e.dir,{reference:t,repository:h.fullName,submitted_at:new Date().toISOString(),url:p}),{status:"submitted",reference:t,repository:h.fullName,url:p}}finally{s!==void 0&&b(s.fd),n!==void 0&&b(n.fd),b(e.dir.fd),b(e.root.fd)}}c(_t,"submitPreparedBundle");const kt=st({name:"submit",description:"submit a prepared local support bundle to a private GitHub repository",whenToUse:"you already ran `crtr sys support prepare` and have decided to share its printed reference with maintainers. Requires exact CRTR_SUPPORT_REPO=owner/name naming a private github.com repository plus working `gh` auth; fails closed before egress and never re-collects or transforms prepared files.",help:{name:"sys support submit",summary:"Validate a prepared bundle locally, then upload manifest.json and bundle.jsonl to support/<reference>/ in the canonical private github.com repository named by CRTR_SUPPORT_REPO, verifying each remote file byte-for-byte",params:[{kind:"positional",name:"reference",required:!0,constraint:"The exact reference `crtr sys support prepare` printed \u2014 YYYYMMDDTHHmmssSSSZ-xxxxxxxx."}],output:[{name:"repository",type:"string",required:!0,constraint:"Canonical owner/name of the private destination."},{name:"url",type:"string",required:!0,constraint:"Canonical github.com URL of support/<reference>/."}],outputKind:"object",effects:["Reads and revalidates the two prepared files under ~/.crouter/support/<reference>/; it never recollects diagnostic sources.","Uploads manifest.json then bundle.jsonl through the GitHub Contents API; equal remote bytes resume, unequal bytes reject, and only a structured exact HTTP 404 authorizes creation.","After confirming the local files are unchanged, atomically writes/replaces submitted.json in the reference directory; prepared files remain unchanged."]},run:c(async t=>{const r=t.reference;if(r===void 0||r==="")throw O("reference is required. Run `crtr sys support submit -h`.");const o=await _t(r,process.env,j);return{repository:o.repository,url:o.url}},"run")});export{j as defaultGhRunner,_t as submitPreparedBundle,kt as supportSubmitLeaf};

package/dist/commands/sys/support.js

@@ -1,18 +1 @@
-// `crtr sys support` — the two-step diagnostics-sharing flow: `prepare`
-// collects a bounded local bundle for one node (zero egress), `submit`
-// uploads an already-prepared bundle to an explicit private repository.
-// Both leaves are landed elsewhere; this file only assembles them.
-import { defineBranch } from '../../core/command.js';
-import { supportPrepareLeaf } from './support/prepare.js';
-import { supportSubmitLeaf } from './support/submit.js';
-export const supportBranch = defineBranch({
-    name: 'support',
-    description: 'prepare and submit a bounded local diagnostics bundle for one node',
-    whenToUse: 'a maintainer asked for diagnostics on a node — prepare collects them locally with zero egress, submit is the one explicit step that shares them privately',
-    help: {
-        name: 'sys support',
-        summary: 'locally prepare a node\u2019s diagnostics, then optionally submit them to a private repository',
-        model: 'prepare is local and zero-egress: it writes manifest.json + bundle.jsonl under ~/.crouter/support/<reference>/ and touches no network. submit is the only step that leaves the machine — it uploads that exact prepared bundle to the private GitHub repository named by CRTR_SUPPORT_REPO. Nothing submits automatically.',
-    },
-    children: [supportPrepareLeaf, supportSubmitLeaf],
-});
+import{defineBranch as e}from"../../core/command.js";import{supportPrepareLeaf as t}from"./support/prepare.js";import{supportSubmitLeaf as o}from"./support/submit.js";const i=e({name:"support",description:"prepare and submit a bounded local diagnostics bundle for one node",whenToUse:"a maintainer asked for diagnostics on a node \u2014 prepare collects them locally with zero egress, submit is the one explicit step that shares them privately",help:{name:"sys support",summary:"locally prepare a node\u2019s diagnostics, then optionally submit them to a private repository",model:"prepare is local and zero-egress: it writes manifest.json + bundle.jsonl under ~/.crouter/support/<reference>/ and touches no network. submit is the only step that leaves the machine \u2014 it uploads that exact prepared bundle to the private GitHub repository named by CRTR_SUPPORT_REPO. Nothing submits automatically."},children:[t,o]});export{i as supportBranch};