@nylorun/runtime 0.6.0-beta → 0.7.0-beta

package/dist/mcp/connect.d.ts

@@ -0,0 +1,31 @@
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import type { McpServerManifest } from "@nylorun/core/define";
+import type { AuthorizeResult } from "../vault/service.js";
+import { type McpDiagnostic, type McpToolRecord } from "./snapshot.js";
+export interface LiveConnection {
+    readonly client: Client;
+    close(): Promise<void>;
+}
+export declare function openMcpServer(input: {
+    server: McpServerManifest;
+    authorize?: (url: string) => Promise<AuthorizeResult>;
+    pluginRoot?: string;
+    pluginData: string;
+}): Promise<LiveConnection>;
+export declare function listMcpTools(client: Client, input: {
+    capabilityId: string;
+    serverName: string;
+    taken: Set<string>;
+}): Promise<{
+    tools: McpToolRecord[];
+    omitted: string[];
+}>;
+export declare function callMcpTool(client: Client, serverToolName: string, args: unknown): Promise<{
+    kind: "completed";
+    output: unknown;
+} | {
+    kind: "failed";
+    code: string;
+    message: string;
+}>;
+export declare function diagnosticFromError(capabilityId: string, serverName: string, error: unknown): McpDiagnostic;

package/dist/mcp/connect.js

@@ -0,0 +1,190 @@
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { schemaFromJSON } from "@nylorun/core/define";
+import { modelToolName, } from "./snapshot.js";
+import { prepareStdioLaunch } from "./stdio.js";
+export async function openMcpServer(input) {
+    if (input.server.type === "stdio") {
+        const launch = prepareStdioLaunch(input.server, {
+            pluginRoot: input.pluginRoot,
+            pluginData: input.pluginData,
+        });
+        const transport = new StdioClientTransport({
+            command: launch.command,
+            args: [...launch.args],
+            cwd: launch.cwd,
+            env: { ...launch.env },
+            stderr: "pipe",
+        });
+        transport.stderr?.on("data", () => { });
+        const client = createClient();
+        await client.connect(transport);
+        return { client, close: () => client.close() };
+    }
+    const authorize = input.authorize;
+    if (!authorize)
+        throw new Error("HTTP MCP server requires authorization");
+    const initial = await authorize(input.server.url);
+    if (initial.status === "refused") {
+        const error = new Error(`MCP authorization refused: ${initial.reason}`);
+        error.credentialIds =
+            initial.credentialIds;
+        throw error;
+    }
+    const fetchImpl = authorizedFetch(input.server, authorize);
+    const url = new URL(input.server.url);
+    const transport = input.server.type === "sse"
+        ? new SSEClientTransport(url, { fetch: fetchImpl })
+        : new StreamableHTTPClientTransport(url, { fetch: fetchImpl });
+    const client = createClient();
+    await client.connect(transport);
+    return { client, close: () => client.close() };
+}
+export async function listMcpTools(client, input) {
+    const tools = [];
+    const omitted = [];
+    let cursor;
+    for (let page = 0; page < 100; page += 1) {
+        const listed = await client.listTools(cursor ? { cursor } : undefined);
+        for (const tool of listed.tools) {
+            if (typeof tool.name !== "string" || tool.name.length === 0)
+                continue;
+            const name = modelToolName(input.serverName, tool.name);
+            const inputSchema = usableSchema(tool.inputSchema);
+            if (!inputSchema || input.taken.has(name)) {
+                omitted.push(name);
+                continue;
+            }
+            const outputSchema = tool.outputSchema
+                ? usableSchema(tool.outputSchema)
+                : undefined;
+            input.taken.add(name);
+            tools.push({
+                capabilityId: input.capabilityId,
+                serverName: input.serverName,
+                serverToolName: tool.name,
+                name,
+                ...(typeof tool.description === "string" && tool.description.length > 0
+                    ? { description: tool.description }
+                    : {}),
+                inputSchema,
+                ...(outputSchema === undefined ? {} : { outputSchema }),
+            });
+        }
+        cursor = listed.nextCursor;
+        if (!cursor)
+            break;
+    }
+    return { tools, omitted };
+}
+export async function callMcpTool(client, serverToolName, args) {
+    const result = await client.callTool({
+        name: serverToolName,
+        arguments: args && typeof args === "object" && !Array.isArray(args)
+            ? args
+            : {},
+    });
+    if ("isError" in result && result.isError) {
+        return {
+            kind: "failed",
+            code: "mcp.tool",
+            message: textContent(result.content) || "MCP tool failed",
+        };
+    }
+    if ("structuredContent" in result && result.structuredContent !== undefined)
+        return { kind: "completed", output: result.structuredContent };
+    const text = "content" in result ? textContent(result.content) : undefined;
+    if (text !== undefined)
+        return { kind: "completed", output: text };
+    return {
+        kind: "completed",
+        output: "content" in result ? result.content : result,
+    };
+}
+export function diagnosticFromError(capabilityId, serverName, error) {
+    const credentialIds = error && typeof error === "object" && "credentialIds" in error
+        ? error.credentialIds
+        : undefined;
+    const refused = error instanceof Error && error.message.startsWith("MCP authorization refused");
+    if (refused) {
+        return {
+            capabilityId,
+            serverName,
+            outcome: "refused",
+            message: error.message,
+            ...(credentialIds === undefined ? {} : { credentialIds }),
+        };
+    }
+    const code = error && typeof error === "object" && "code" in error
+        ? error.code
+        : undefined;
+    const unauthorized = code === 401 ||
+        (error instanceof Error && /\b401\b/.test(error.message));
+    return {
+        capabilityId,
+        serverName,
+        outcome: "failed",
+        message: unauthorized
+            ? "MCP server returned 401"
+            : error instanceof Error
+                ? error.message.slice(0, 500)
+                : "MCP server connection failed",
+    };
+}
+function createClient() {
+    return new Client({ name: "nylorun-runtime", version: "0.6.0" }, { capabilities: {} });
+}
+function authorizedFetch(server, authorize) {
+    return async (url, init) => {
+        const target = typeof url === "string" ? url : url.href;
+        if (!sameOrigin(target, server.url))
+            throw new Error("MCP request origin does not match the declared server");
+        const result = await authorize(server.url);
+        if (result.status === "refused") {
+            const error = new Error(`MCP authorization refused: ${result.reason}`);
+            error.credentialIds =
+                result.credentialIds;
+            throw error;
+        }
+        const headers = new Headers();
+        for (const [key, value] of Object.entries(server.headers ?? {}))
+            headers.set(key, value);
+        new Headers(init?.headers).forEach((value, key) => headers.set(key, value));
+        if (result.status === "authorized")
+            headers.set("authorization", result.headers.authorization);
+        return fetch(target, { ...init, headers, redirect: "error" });
+    };
+}
+function sameOrigin(requestUrl, serverUrl) {
+    try {
+        return new URL(requestUrl).origin === new URL(serverUrl).origin;
+    }
+    catch {
+        return false;
+    }
+}
+function usableSchema(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const schema = JSON.parse(JSON.stringify(value));
+    try {
+        schemaFromJSON(schema);
+    }
+    catch {
+        return undefined;
+    }
+    return schema;
+}
+function textContent(content) {
+    if (!Array.isArray(content))
+        return undefined;
+    const text = content
+        .filter((part) => !!part &&
+        typeof part === "object" &&
+        part.type === "text" &&
+        typeof part.text === "string")
+        .map((part) => part.text);
+    return text.length === 0 ? undefined : text.join("\n");
+}

package/dist/mcp/pool.d.ts

@@ -0,0 +1,45 @@
+import type { AgentManifest } from "@nylorun/core/define";
+import type { AuthorizeResult } from "../vault/service.js";
+import { callMcpTool } from "./connect.js";
+import { type McpDiagnostic, type McpSnapshot, type McpToolRecord } from "./snapshot.js";
+export declare class McpPool {
+    private readonly options;
+    private readonly live;
+    constructor(options: {
+        readonly dataDir: string;
+        readonly authorize: (sessionId: string, request: {
+            url: string;
+            serverName: string;
+        }) => Promise<AuthorizeResult>;
+    });
+    discover(input: {
+        sessionId: string;
+        manifest: AgentManifest;
+        manifestHash: string;
+        pluginRoots: Readonly<Record<string, string>>;
+        signal?: AbortSignal;
+    }): Promise<{
+        snapshot: McpSnapshot;
+        diagnostics: McpDiagnostic[];
+    }>;
+    reconnect(input: {
+        sessionId: string;
+        manifest: AgentManifest;
+        pluginRoots: Readonly<Record<string, string>>;
+        tools: readonly McpToolRecord[];
+        signal?: AbortSignal;
+    }): Promise<McpDiagnostic[]>;
+    call(input: {
+        sessionId: string;
+        capabilityId: string;
+        serverName: string;
+        serverToolName: string;
+        args: unknown;
+        manifest: AgentManifest;
+        pluginRoots: Readonly<Record<string, string>>;
+    }): Promise<Awaited<ReturnType<typeof callMcpTool>>>;
+    close(): Promise<void>;
+    private remember;
+    private liveKey;
+    private connectDeclared;
+}

package/dist/mcp/pool.js

@@ -0,0 +1,143 @@
+import { join } from "node:path";
+import { callMcpTool, diagnosticFromError, listMcpTools, openMcpServer, } from "./connect.js";
+import { declaredToolNames, } from "./snapshot.js";
+export class McpPool {
+    options;
+    live = new Map();
+    constructor(options) {
+        this.options = options;
+    }
+    async discover(input) {
+        const taken = declaredToolNames(input.manifest);
+        const tools = [];
+        const diagnostics = [];
+        for (const declared of serversOf(input.manifest)) {
+            input.signal?.throwIfAborted();
+            const opened = await this.connectDeclared(input, declared);
+            if (!opened.ok) {
+                diagnostics.push(opened.diagnostic);
+                continue;
+            }
+            try {
+                const listed = await listMcpTools(opened.connection.client, {
+                    capabilityId: declared.capabilityId,
+                    serverName: declared.server.name,
+                    taken,
+                });
+                tools.push(...listed.tools);
+                diagnostics.push({
+                    capabilityId: declared.capabilityId,
+                    serverName: declared.server.name,
+                    outcome: "connected",
+                    message: listed.omitted.length === 0
+                        ? "Connected"
+                        : `Connected. Omitted ${listed.omitted.join(", ")}`,
+                });
+                this.remember(input.sessionId, declared, opened.connection);
+            }
+            catch (error) {
+                await opened.connection.close().catch(() => { });
+                diagnostics.push(diagnosticFromError(declared.capabilityId, declared.server.name, error));
+            }
+        }
+        return {
+            snapshot: {
+                snapshotSchemaVersion: 1,
+                manifestHash: input.manifestHash,
+                mcpTools: tools,
+            },
+            diagnostics,
+        };
+    }
+    async reconnect(input) {
+        const diagnostics = [];
+        const seen = new Set();
+        for (const tool of input.tools) {
+            const key = `${tool.capabilityId}\0${tool.serverName}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            if (this.live.has(this.liveKey(input.sessionId, tool.capabilityId, tool.serverName)))
+                continue;
+            input.signal?.throwIfAborted();
+            const declared = serversOf(input.manifest).find((item) => item.capabilityId === tool.capabilityId && item.server.name === tool.serverName);
+            if (!declared) {
+                diagnostics.push({
+                    capabilityId: tool.capabilityId,
+                    serverName: tool.serverName,
+                    outcome: "failed",
+                    message: "Declared MCP server is missing from the pinned manifest",
+                });
+                continue;
+            }
+            const opened = await this.connectDeclared(input, declared);
+            if (!opened.ok) {
+                diagnostics.push(opened.diagnostic);
+                continue;
+            }
+            this.remember(input.sessionId, declared, opened.connection);
+        }
+        return diagnostics;
+    }
+    async call(input) {
+        const key = this.liveKey(input.sessionId, input.capabilityId, input.serverName);
+        let live = this.live.get(key);
+        if (!live) {
+            const declared = serversOf(input.manifest).find((item) => item.capabilityId === input.capabilityId && item.server.name === input.serverName);
+            if (!declared)
+                throw new Error(`MCP server '${input.serverName}' is not declared`);
+            const opened = await this.connectDeclared(input, declared);
+            if (!opened.ok)
+                throw new Error(opened.diagnostic.message);
+            this.remember(input.sessionId, declared, opened.connection);
+            live = this.live.get(key);
+        }
+        if (!live)
+            throw new Error(`MCP server '${input.serverName}' is not connected`);
+        return callMcpTool(live.connection.client, input.serverToolName, input.args);
+    }
+    async close() {
+        const connections = [...this.live.values()];
+        this.live.clear();
+        await Promise.all(connections.map((item) => item.connection.close().catch(() => { })));
+    }
+    remember(sessionId, declared, connection) {
+        this.live.set(this.liveKey(sessionId, declared.capabilityId, declared.server.name), {
+            capabilityId: declared.capabilityId,
+            serverName: declared.server.name,
+            connection,
+        });
+    }
+    liveKey(sessionId, capabilityId, serverName) {
+        return JSON.stringify([sessionId, capabilityId, serverName]);
+    }
+    async connectDeclared(input, declared) {
+        try {
+            const connection = await openMcpServer({
+                server: declared.server,
+                pluginRoot: input.pluginRoots[declared.capabilityId],
+                pluginData: join(this.options.dataDir, "plugin-data", declared.capabilityId),
+                authorize: declared.server.type === "stdio"
+                    ? undefined
+                    : (url) => this.options.authorize(input.sessionId, {
+                        url,
+                        serverName: declared.server.name,
+                    }),
+            });
+            return { ok: true, connection };
+        }
+        catch (error) {
+            return {
+                ok: false,
+                diagnostic: diagnosticFromError(declared.capabilityId, declared.server.name, error),
+            };
+        }
+    }
+}
+function serversOf(manifest) {
+    const servers = [];
+    for (const capability of manifest.capabilities)
+        for (const server of Object.values(capability.mcpServers ?? {}))
+            servers.push({ capabilityId: capability.id, server });
+    return servers;
+}

package/dist/mcp/snapshot.d.ts

@@ -0,0 +1,25 @@
+import type { JsonObject } from "@nylorun/core/define";
+import type { AgentManifest } from "@nylorun/core/define";
+export interface McpToolRecord {
+    readonly capabilityId: string;
+    readonly serverName: string;
+    readonly serverToolName: string;
+    readonly name: string;
+    readonly description?: string;
+    readonly inputSchema: JsonObject;
+    readonly outputSchema?: JsonObject;
+}
+export interface McpSnapshot {
+    readonly snapshotSchemaVersion: 1;
+    readonly manifestHash: string;
+    readonly mcpTools: readonly McpToolRecord[];
+}
+export interface McpDiagnostic {
+    readonly capabilityId: string;
+    readonly serverName: string;
+    readonly outcome: "connected" | "refused" | "failed";
+    readonly message: string;
+    readonly credentialIds?: readonly string[];
+}
+export declare function modelToolName(serverName: string, serverToolName: string): string;
+export declare function declaredToolNames(manifest: AgentManifest): Set<string>;

package/dist/mcp/snapshot.js

@@ -0,0 +1,10 @@
+export function modelToolName(serverName, serverToolName) {
+    return `${serverName}__${serverToolName}`;
+}
+export function declaredToolNames(manifest) {
+    const names = new Set();
+    for (const capability of manifest.capabilities)
+        for (const tool of capability.tools ?? [])
+            names.add(tool.name);
+    return names;
+}

package/dist/mcp/stdio.d.ts

@@ -0,0 +1,15 @@
+import type { McpServerManifest } from "@nylorun/core/define";
+/** Single-pass replacement. Text inserted for a token is not scanned again. */
+export declare function expandPluginPlaceholders(value: string, pluginRoot: string, pluginData: string): string;
+export interface StdioLaunch {
+    readonly command: string;
+    readonly args: readonly string[];
+    readonly cwd: string;
+    readonly env: Readonly<Record<string, string>>;
+}
+export declare function prepareStdioLaunch(server: Extract<McpServerManifest, {
+    type: "stdio";
+}>, options: {
+    readonly pluginRoot?: string;
+    readonly pluginData: string;
+}): StdioLaunch;

package/dist/mcp/stdio.js

@@ -0,0 +1,80 @@
+import { mkdirSync } from "node:fs";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+const ROOT_TOKEN = "${PLUGIN_ROOT}";
+const DATA_TOKEN = "${PLUGIN_DATA}";
+/** Single-pass replacement. Text inserted for a token is not scanned again. */
+export function expandPluginPlaceholders(value, pluginRoot, pluginData) {
+    let out = "";
+    for (let index = 0; index < value.length;) {
+        if (value.startsWith(ROOT_TOKEN, index)) {
+            out += pluginRoot;
+            index += ROOT_TOKEN.length;
+            continue;
+        }
+        if (value.startsWith(DATA_TOKEN, index)) {
+            out += pluginData;
+            index += DATA_TOKEN.length;
+            continue;
+        }
+        out += value[index];
+        index += 1;
+    }
+    return out;
+}
+export function prepareStdioLaunch(server, options) {
+    const pluginData = options.pluginData;
+    mkdirSync(pluginData, { recursive: true });
+    const pluginRoot = options.pluginRoot;
+    if (needsPluginRoot(server) && !pluginRoot)
+        throw new Error("stdio server requires a plugin root");
+    for (const key of Object.keys(server.env ?? {})) {
+        if (key === "PLUGIN_ROOT" || key === "PLUGIN_DATA")
+            throw new Error(`stdio env must not set ${key}`);
+    }
+    const command = server.command.startsWith("./")
+        ? resolve(pluginRoot, server.command)
+        : server.command;
+    const args = (server.args ?? []).map((arg) => expand(arg, pluginRoot, pluginData));
+    const cwd = server.cwd
+        ? resolveContainedCwd(server.cwd, pluginRoot, pluginData)
+        : (pluginRoot ?? pluginData);
+    const env = {};
+    for (const [key, value] of Object.entries(server.env ?? {}))
+        env[key] = expand(value, pluginRoot, pluginData);
+    if (pluginRoot)
+        env.PLUGIN_ROOT = pluginRoot;
+    env.PLUGIN_DATA = pluginData;
+    return { command, args, cwd, env };
+}
+function needsPluginRoot(server) {
+    if (server.command.startsWith("./"))
+        return true;
+    const values = [
+        ...(server.args ?? []),
+        ...Object.values(server.env ?? {}),
+        ...(server.cwd === undefined ? [] : [server.cwd]),
+    ];
+    return values.some((value) => value.includes(ROOT_TOKEN));
+}
+function expand(value, pluginRoot, pluginData) {
+    if (value.includes(ROOT_TOKEN) && !pluginRoot)
+        throw new Error("stdio server requires a plugin root");
+    return expandPluginPlaceholders(value, pluginRoot ?? "", pluginData);
+}
+function resolveContainedCwd(cwd, pluginRoot, pluginData) {
+    const expanded = expand(cwd, pluginRoot, pluginData);
+    const base = cwdTargetsData(cwd) ? pluginData : pluginRoot;
+    if (!base)
+        throw new Error("stdio server requires a plugin root");
+    const absolute = isAbsolute(expanded) ? expanded : resolve(base, expanded);
+    if (!isInside(base, absolute))
+        throw new Error(`Working directory escapes ${base}`);
+    return absolute;
+}
+function cwdTargetsData(cwd) {
+    return cwd === DATA_TOKEN || cwd.startsWith(`${DATA_TOKEN}/`);
+}
+function isInside(root, target) {
+    const rel = relative(root, target);
+    return rel === "" || (!rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel));
+}

package/dist/vault/crypto.d.ts

@@ -0,0 +1,12 @@
+export declare class VaultCryptoError extends Error {
+    constructor();
+}
+export declare function kekId(kek: Buffer): string;
+export declare function parseKek(value: Buffer | string): Buffer;
+export declare function encryptSecret(kek: Buffer, aad: Buffer, plaintext: Buffer): {
+    nonce: Buffer;
+    ciphertext: Buffer;
+    wrappedDek: Buffer;
+    kekId: string;
+};
+export declare function decryptSecret(kek: Buffer, aad: Buffer, nonce: Buffer, ciphertext: Buffer, wrappedDek: Buffer, expectedKekId: string): Buffer;

package/dist/vault/crypto.js

@@ -0,0 +1,80 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes, } from "node:crypto";
+const IV_BYTES = 12;
+const TAG_BYTES = 16;
+export class VaultCryptoError extends Error {
+    constructor() {
+        super("Vault credential could not be read");
+    }
+}
+export function kekId(kek) {
+    return createHash("sha256").update(kek).digest("hex");
+}
+export function parseKek(value) {
+    const bytes = typeof value === "string" ? Buffer.from(value.trim(), "base64") : value;
+    if (bytes.length !== 32)
+        throw new Error("Vault key-encryption key must be 32 bytes");
+    return Buffer.from(bytes);
+}
+export function encryptSecret(kek, aad, plaintext) {
+    const dek = randomBytes(32);
+    try {
+        const nonce = randomBytes(IV_BYTES);
+        const cipher = createCipheriv("aes-256-gcm", dek, nonce);
+        cipher.setAAD(aad);
+        const body = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        return {
+            nonce,
+            ciphertext: Buffer.concat([body, tag]),
+            wrappedDek: wrapKey(kek, dek),
+            kekId: kekId(kek),
+        };
+    }
+    finally {
+        dek.fill(0);
+    }
+}
+export function decryptSecret(kek, aad, nonce, ciphertext, wrappedDek, expectedKekId) {
+    if (expectedKekId !== kekId(kek))
+        throw new VaultCryptoError();
+    const dek = unwrapKey(kek, wrappedDek);
+    try {
+        if (ciphertext.length < TAG_BYTES)
+            throw new VaultCryptoError();
+        const tag = ciphertext.subarray(ciphertext.length - TAG_BYTES);
+        const body = ciphertext.subarray(0, ciphertext.length - TAG_BYTES);
+        const decipher = createDecipheriv("aes-256-gcm", dek, nonce);
+        decipher.setAAD(aad);
+        decipher.setAuthTag(tag);
+        return Buffer.concat([decipher.update(body), decipher.final()]);
+    }
+    catch (error) {
+        if (error instanceof VaultCryptoError)
+            throw error;
+        throw new VaultCryptoError();
+    }
+    finally {
+        dek.fill(0);
+    }
+}
+function wrapKey(kek, dek) {
+    const nonce = randomBytes(IV_BYTES);
+    const cipher = createCipheriv("aes-256-gcm", kek, nonce);
+    const body = Buffer.concat([cipher.update(dek), cipher.final()]);
+    return Buffer.concat([nonce, body, cipher.getAuthTag()]);
+}
+function unwrapKey(kek, wrapped) {
+    try {
+        if (wrapped.length < IV_BYTES + TAG_BYTES)
+            throw new VaultCryptoError();
+        const nonce = wrapped.subarray(0, IV_BYTES);
+        const tag = wrapped.subarray(wrapped.length - TAG_BYTES);
+        const body = wrapped.subarray(IV_BYTES, wrapped.length - TAG_BYTES);
+        const decipher = createDecipheriv("aes-256-gcm", kek, nonce);
+        decipher.setAuthTag(tag);
+        return Buffer.concat([decipher.update(body), decipher.final()]);
+    }
+    catch {
+        throw new VaultCryptoError();
+    }
+}

package/dist/vault/error.d.ts

@@ -0,0 +1,4 @@
+export declare class VaultError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}

package/dist/vault/error.js

@@ -0,0 +1,7 @@
+export class VaultError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}

package/dist/vault/kek.d.ts

@@ -0,0 +1,6 @@
+export declare function defaultKekPath(): string;
+export declare function readVaultKek(options: {
+    vaultKek?: Buffer | string | null;
+    vaultKekPath?: string;
+}): Buffer | undefined;
+export declare function createKekFile(path: string): Buffer;