@raidiant/notifai 11.7.1 → 12.0.0-beta.13

package/dist/credentials.js

@@ -1,342 +0,0 @@
-import { execFileSync, spawnSync } from 'node:child_process';
-import { existsSync, readFileSync, rmSync } from 'node:fs';
-import path from 'node:path';
-import { atomicWriteFileSync } from './atomic-file.js';
-import { globalConfigDir } from './config.js';
-const SERVICE = 'io.notifai.cli';
-const CREDENTIAL_FORMAT = 'notifai.machine-credential.v1';
-const DPAPI_FORMAT = 'notifai.dpapi.current-user.v1';
-const DPAPI_ENTROPY = 'io.notifai.cli';
-// Inbox Windows PowerShell can have a slow first start on a newly provisioned
-// or heavily loaded machine. Keep the helper bounded without rejecting a
-// valid DPAPI operation during that cold-start window.
-const DPAPI_TIMEOUT_MS = 30_000;
-const DPAPI_FILE = 'credentials.dpapi';
-const KEYCHAIN_TIMEOUT_MS = 15_000;
-// Use .NET directly: loading PowerShell's Utility module for Add-Type or
-// New-Object can exceed the helper timeout under Git Bash on Windows ARM.
-// The inbox Windows PowerShell host uses .NET Framework's System.Security.
-const PROTECT_SCRIPT = [
-    "$ErrorActionPreference = 'Stop'",
-    "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security')",
-    '$in = [System.IO.MemoryStream]::new()',
-    '[Console]::OpenStandardInput().CopyTo($in)',
-    `$entropy = [System.Text.Encoding]::UTF8.GetBytes('${DPAPI_ENTROPY}')`,
-    '$protected = [System.Security.Cryptography.ProtectedData]::Protect($in.ToArray(), $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)',
-    '$bytes = [System.Text.Encoding]::ASCII.GetBytes([Convert]::ToBase64String($protected))',
-    '[Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length)',
-].join('; ');
-const UNPROTECT_SCRIPT = [
-    "$ErrorActionPreference = 'Stop'",
-    "[void][System.Reflection.Assembly]::LoadWithPartialName('System.Security')",
-    '$b64 = [System.Text.Encoding]::ASCII.GetString((& { $in = [System.IO.MemoryStream]::new(); [Console]::OpenStandardInput().CopyTo($in); $in.ToArray() })).Trim()',
-    '$protected = [Convert]::FromBase64String($b64)',
-    `$entropy = [System.Text.Encoding]::UTF8.GetBytes('${DPAPI_ENTROPY}')`,
-    '$plain = [System.Security.Cryptography.ProtectedData]::Unprotect($protected, $entropy, [System.Security.Cryptography.DataProtectionScope]::CurrentUser)',
-    '[Console]::OpenStandardOutput().Write($plain, 0, $plain.Length)',
-].join('; ');
-const PROTECT_ENCODED = encodePowerShell(PROTECT_SCRIPT);
-const UNPROTECT_ENCODED = encodePowerShell(UNPROTECT_SCRIPT);
-function encodePowerShell(script) {
-    return Buffer.from(script, 'utf16le').toString('base64');
-}
-function powerShellInvocation(encoded, env) {
-    const root = env['SystemRoot'] || env['SYSTEMROOT'] || 'C:\\Windows';
-    return {
-        command: path.win32.join(root, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe'),
-        args: ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-EncodedCommand', encoded],
-    };
-}
-/** Which DPAPI operation a process invocation asked for. Args never carry secrets. */
-export function windowsDpapiOperation(args) {
-    const index = args.indexOf('-EncodedCommand');
-    const encoded = index >= 0 ? args[index + 1] : undefined;
-    if (encoded === PROTECT_ENCODED)
-        return 'protect';
-    if (encoded === UNPROTECT_ENCODED)
-        return 'unprotect';
-    return null;
-}
-export const defaultProcessRunner = {
-    run(spec) {
-        const result = spawnSync(spec.command, [...spec.args], {
-            input: spec.input,
-            timeout: spec.timeoutMs ?? DPAPI_TIMEOUT_MS,
-            maxBuffer: 1024 * 1024,
-            windowsHide: true,
-        });
-        const stdout = Buffer.isBuffer(result.stdout) ? result.stdout : Buffer.alloc(0);
-        if (result.error)
-            return { status: 1, stdout: Buffer.alloc(0) };
-        return { status: result.status ?? 1, stdout };
-    },
-};
-/**
- * macOS Keychain via the first-party `security` Security.framework client.
- *
- * `security add-generic-password -w <value>` puts the value in process argv.
- * Interactive mode instead parses a command from stdin, so the credential
- * crosses the helper boundary only through the pipe. `-X` keeps arbitrary
- * serialized bytes out of the command parser's quoting rules.
- */
-export class KeychainStore {
-    run;
-    constructor(options = {}) {
-        this.run = options.run ?? defaultProcessRunner;
-    }
-    load() {
-        try {
-            const raw = execFileSync('security', ['find-generic-password', '-s', SERVICE, '-a', 'machine', '-w'], { stdio: ['ignore', 'pipe', 'ignore'] })
-                .toString()
-                .trim();
-            return parseCredentialJson(raw);
-        }
-        catch {
-            return null;
-        }
-    }
-    save(credential) {
-        const serialized = Buffer.from(JSON.stringify(serializeCredential(credential)), 'utf8');
-        const command = Buffer.from(`add-generic-password -U -s ${SERVICE} -a machine -X ${serialized.toString('hex')}\n`, 'ascii');
-        const result = this.run.run({
-            command: 'security',
-            args: ['-q', '-i'],
-            input: command,
-            timeoutMs: KEYCHAIN_TIMEOUT_MS,
-        });
-        if (result.status !== 0) {
-            throw new Error('macOS Keychain credential save failed');
-        }
-    }
-    clear() {
-        try {
-            execFileSync('security', ['delete-generic-password', '-s', SERVICE, '-a', 'machine'], {
-                stdio: 'ignore',
-            });
-        }
-        catch {
-            // nothing stored
-        }
-    }
-    describe() {
-        return `macOS Keychain (${SERVICE})`;
-    }
-}
-/**
- * Explicit plaintext file store.
- *
- * Default on Linux, where mode 0600 is a real ACL. Also the
- * `NOTIFAI_CREDENTIALS=file` development and test escape hatch on every
- * platform. POSIX mode bits are not an NTFS ACL, so this is not a protected
- * Windows store.
- */
-export class FileStore {
-    env;
-    platform;
-    constructor(env = process.env, options = {}) {
-        this.env = env;
-        this.platform = options.platform ?? process.platform;
-    }
-    filePath() {
-        return path.join(globalConfigDir(this.env, this.platform), 'credentials.json');
-    }
-    load() {
-        const file = this.filePath();
-        if (!existsSync(file))
-            return null;
-        try {
-            return parseCredentialJson(readFileSync(file, 'utf8'));
-        }
-        catch {
-            return null;
-        }
-    }
-    save(credential) {
-        atomicWriteFileSync(this.filePath(), `${JSON.stringify(serializeCredential(credential), null, 2)}\n`, {
-            mode: 0o600,
-            preserveMode: false,
-            requireCurrentUserOwner: true,
-        });
-    }
-    clear() {
-        rmSync(this.filePath(), { force: true });
-    }
-    describe() {
-        const file = this.filePath();
-        if (this.platform === 'win32') {
-            return `plaintext file ${file} (NOTIFAI_CREDENTIALS=file; POSIX mode bits are not protection on NTFS)`;
-        }
-        return `plaintext file ${file} (mode 0600)`;
-    }
-}
-/**
- * Windows default: DPAPI CurrentUser via first-party PowerShell.
- *
- * The protected blob lives under LOCALAPPDATA, never roaming APPDATA.
- * Plaintext crosses the process boundary only on stdin/stdout — never as a
- * command-line argument.
- */
-export class WindowsDpapiStore {
-    env;
-    run;
-    constructor(env = process.env, options = {}) {
-        this.env = env;
-        this.run = options.run ?? defaultProcessRunner;
-    }
-    filePath() {
-        const local = this.env['LOCALAPPDATA'];
-        if (typeof local !== 'string' || local.trim() === '')
-            return null;
-        return path.join(local, 'notifai', DPAPI_FILE);
-    }
-    load() {
-        const file = this.filePath();
-        if (file === null || !existsSync(file))
-            return null;
-        let text;
-        try {
-            text = readFileSync(file, 'utf8');
-        }
-        catch {
-            return null;
-        }
-        const blob = parseDpapiEnvelope(text);
-        if (blob === null)
-            return null;
-        const plain = this.unprotect(blob);
-        return plain === null ? null : parseCredentialJson(plain);
-    }
-    save(credential) {
-        const file = this.filePath();
-        if (file === null) {
-            throw new Error('Windows credential store path is not configured (LOCALAPPDATA is missing)');
-        }
-        const blob = this.protect(Buffer.from(JSON.stringify(serializeCredential(credential)), 'utf8'));
-        atomicWriteFileSync(file, `${JSON.stringify({ format: DPAPI_FORMAT, data: blob })}\n`, {
-            mode: 0o600,
-            preserveMode: false,
-            requireCurrentUserOwner: true,
-        });
-    }
-    clear() {
-        const file = this.filePath();
-        if (file === null)
-            return;
-        rmSync(file, { force: true });
-    }
-    describe() {
-        const file = this.filePath();
-        if (file === null)
-            return 'Windows DPAPI current-user (LOCALAPPDATA unset)';
-        return `Windows DPAPI current-user (${file})`;
-    }
-    protect(plaintext) {
-        const result = this.invoke('protect', plaintext);
-        if (result.status !== 0) {
-            throw new Error('Windows credential protection failed');
-        }
-        const encoded = result.stdout.toString('utf8').trim();
-        if (!isBase64(encoded)) {
-            throw new Error('Windows credential protection failed');
-        }
-        return encoded;
-    }
-    unprotect(blob) {
-        const result = this.invoke('unprotect', Buffer.from(blob, 'utf8'));
-        if (result.status !== 0)
-            return null;
-        const plain = result.stdout.toString('utf8');
-        return plain === '' ? null : plain;
-    }
-    invoke(operation, input) {
-        const encoded = operation === 'protect' ? PROTECT_ENCODED : UNPROTECT_ENCODED;
-        const invocation = powerShellInvocation(encoded, this.env);
-        return this.run.run({
-            command: invocation.command,
-            args: invocation.args,
-            input,
-            timeoutMs: DPAPI_TIMEOUT_MS,
-        });
-    }
-}
-function serializeCredential(credential) {
-    return { format: CREDENTIAL_FORMAT, ...credential };
-}
-function parseCredentialJson(raw) {
-    try {
-        return parseCredential(JSON.parse(raw));
-    }
-    catch {
-        return null;
-    }
-}
-function parseCredential(raw) {
-    if (raw === null || typeof raw !== 'object')
-        return null;
-    const value = raw;
-    const format = value['format'];
-    // Unversioned credentials are the pre-epoch v1 representation. A future
-    // format is left untouched on disk/keychain and treated as unavailable;
-    // interpreting it as v1 could silently change authentication meaning.
-    if (format !== undefined && format !== CREDENTIAL_FORMAT)
-        return null;
-    const machineId = value['machineId'];
-    const secret = value['secret'];
-    const baseUrl = value['baseUrl'];
-    const machineName = value['machineName'];
-    if (typeof machineId !== 'string' ||
-        machineId === '' ||
-        typeof secret !== 'string' ||
-        secret === '' ||
-        typeof baseUrl !== 'string' ||
-        baseUrl === '' ||
-        typeof machineName !== 'string' ||
-        machineName === '') {
-        return null;
-    }
-    return { machineId, secret, baseUrl, machineName };
-}
-function parseDpapiEnvelope(text) {
-    let parsed;
-    try {
-        parsed = JSON.parse(text);
-    }
-    catch {
-        return null;
-    }
-    if (parsed === null || typeof parsed !== 'object')
-        return null;
-    const value = parsed;
-    if (value['format'] !== DPAPI_FORMAT)
-        return null;
-    const data = value['data'];
-    if (typeof data !== 'string' || !isBase64(data))
-        return null;
-    return data;
-}
-function isBase64(value) {
-    return value.length > 0 && value.length % 4 === 0 && /^[A-Za-z0-9+/]+={0,2}$/.test(value);
-}
-function keychainProbeSucceeds() {
-    try {
-        execFileSync('security', ['help'], { stdio: 'ignore' });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-export function defaultCredentialStore(env = process.env, options = {}) {
-    const platform = options.platform ?? process.platform;
-    if (env['NOTIFAI_CREDENTIALS'] === 'file')
-        return new FileStore(env, { platform });
-    if (platform === 'win32')
-        return new WindowsDpapiStore(env, options);
-    const keychain = options.keychainAvailable !== undefined
-        ? options.keychainAvailable
-        : platform === 'darwin' && keychainProbeSucceeds();
-    if (keychain)
-        return new KeychainStore(options);
-    return new FileStore(env, { platform });
-}
-//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAC1D,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AA4C7C,MAAM,OAAO,GAAG,gBAAgB,CAAA;AAChC,MAAM,iBAAiB,GAAG,+BAA+B,CAAA;AACzD,MAAM,YAAY,GAAG,+BAA+B,CAAA;AACpD,MAAM,aAAa,GAAG,gBAAgB,CAAA;AACtC,8EAA8E;AAC9E,yEAAyE;AACzE,uDAAuD;AACvD,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAC/B,MAAM,UAAU,GAAG,mBAAmB,CAAA;AACtC,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAElC,yEAAyE;AACzE,0EAA0E;AAC1E,2EAA2E;AAC3E,MAAM,cAAc,GAAG;IACrB,iCAAiC;IACjC,4EAA4E;IAC5E,uCAAuC;IACvC,4CAA4C;IAC5C,qDAAqD,aAAa,IAAI;IACtE,8JAA8J;IAC9J,wFAAwF;IACxF,iEAAiE;CAClE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEZ,MAAM,gBAAgB,GAAG;IACvB,iCAAiC;IACjC,4EAA4E;IAC5E,iKAAiK;IACjK,gDAAgD;IAChD,qDAAqD,aAAa,IAAI;IACtE,yJAAyJ;IACzJ,iEAAiE;CAClE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEZ,MAAM,eAAe,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAA;AACxD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,CAAA;AAE5D,SAAS,gBAAgB,CAAC,MAAc;IACtC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;AAC1D,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe,EAAE,GAAsB;IACnE,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,aAAa,CAAA;IACpE,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,EAAE,gBAAgB,CAAC;QACzF,IAAI,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,OAAO,CAAC;KAClG,CAAA;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CAAC,IAAuB;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC7C,MAAM,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACxD,IAAI,OAAO,KAAK,eAAe;QAAE,OAAO,SAAS,CAAA;IACjD,IAAI,OAAO,KAAK,iBAAiB;QAAE,OAAO,WAAW,CAAA;IACrD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAkB;IACjD,GAAG,CAAC,IAAI;QACN,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE;YACrD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,IAAI,CAAC,SAAS,IAAI,gBAAgB;YAC3C,SAAS,EAAE,IAAI,GAAG,IAAI;YACtB,WAAW,EAAE,IAAI;SAClB,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC/E,IAAI,MAAM,CAAC,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;QAC/D,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IAC/C,CAAC;CACF,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,aAAa;IACP,GAAG,CAAe;IAEnC,YAAY,UAAkC,EAAE;QAC9C,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,oBAAoB,CAAA;IAChD,CAAC;IAED,IAAI;QACF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CACtB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,EAC/D,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CACxC;iBACE,QAAQ,EAAE;iBACV,IAAI,EAAE,CAAA;YACT,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAA;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,IAAI,CAAC,UAA6B;QAChC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACvF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CACzB,8BAA8B,OAAO,kBAAkB,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EACrF,OAAO,CACR,CAAA;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAC1B,OAAO,EAAE,UAAU;YACnB,IAAI,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;YAClB,KAAK,EAAE,OAAO;YACd,SAAS,EAAE,mBAAmB;SAC/B,CAAC,CAAA;QACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,CAAC;YACH,YAAY,CAAC,UAAU,EAAE,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE;gBACpF,KAAK,EAAE,QAAQ;aAChB,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;IAED,QAAQ;QACN,OAAO,mBAAmB,OAAO,GAAG,CAAA;IACtC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,SAAS;IACH,GAAG,CAAmB;IACtB,QAAQ,CAAiB;IAE1C,YAAY,MAAyB,OAAO,CAAC,GAAG,EAAE,UAAkC,EAAE;QACpF,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;QACd,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAA;IACtD,CAAC;IAEO,QAAQ;QACd,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC,CAAA;IAChF,CAAC;IAED,IAAI;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;QAC5B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QAClC,IAAI,CAAC;YACH,OAAO,mBAAmB,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,IAAI,CAAC,UAA6B;QAChC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YACpG,IAAI,EAAE,KAAK;YACX,YAAY,EAAE,KAAK;YACnB,uBAAuB,EAAE,IAAI;SAC9B,CAAC,CAAA;IACJ,CAAC;IAED,KAAK;QACH,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1C,CAAC;IAED,QAAQ;QACN,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;QAC5B,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC9B,OAAO,kBAAkB,IAAI,yEAAyE,CAAA;QACxG,CAAC;QACD,OAAO,kBAAkB,IAAI,cAAc,CAAA;IAC7C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,iBAAiB;IACX,GAAG,CAAmB;IACtB,GAAG,CAAe;IAEnC,YAAY,MAAyB,OAAO,CAAC,GAAG,EAAE,UAAkC,EAAE;QACpF,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;QACd,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,oBAAoB,CAAA;IAChD,CAAC;IAEO,QAAQ;QACd,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;QACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,IAAI,CAAA;QACjE,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;IAChD,CAAC;IAED,IAAI;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;QAC5B,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QACnD,IAAI,IAAY,CAAA;QAChB,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;QACrC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAClC,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAA;IAC3D,CAAC;IAED,IAAI,CAAC,UAA6B;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;QAC5B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAA;QAC9F,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAA;QAC/F,mBAAmB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE;YACrF,IAAI,EAAE,KAAK;YACX,YAAY,EAAE,KAAK;YACnB,uBAAuB,EAAE,IAAI;SAC9B,CAAC,CAAA;IACJ,CAAC;IAED,KAAK;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;QAC5B,IAAI,IAAI,KAAK,IAAI;YAAE,OAAM;QACzB,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/B,CAAC;IAED,QAAQ;QACN,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAA;QAC5B,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,iDAAiD,CAAA;QAC3E,OAAO,+BAA+B,IAAI,GAAG,CAAA;IAC/C,CAAC;IAEO,OAAO,CAAC,SAAiB;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;QAChD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;QACzD,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;QACrD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;QACzD,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAEO,SAAS,CAAC,IAAY;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;QAClE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QACpC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC5C,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAA;IACpC,CAAC;IAEO,MAAM,CAAC,SAAkC,EAAE,KAAa;QAC9D,MAAM,OAAO,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,iBAAiB,CAAA;QAC7E,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;QAC1D,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAClB,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,KAAK;YACL,SAAS,EAAE,gBAAgB;SAC5B,CAAC,CAAA;IACJ,CAAC;CACF;AAED,SAAS,mBAAmB,CAAC,UAA6B;IACxD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,UAAU,EAAE,CAAA;AACrD,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC,CAAA;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACxD,MAAM,KAAK,GAAG,GAA8B,CAAA;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC9B,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAA;IACrE,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,CAAA;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAA;IAChC,MAAM,WAAW,GAAG,KAAK,CAAC,aAAa,CAAC,CAAA;IACxC,IACE,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,KAAK,EAAE;QAChB,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,KAAK,EAAE;QACb,OAAO,OAAO,KAAK,QAAQ;QAC3B,OAAO,KAAK,EAAE;QACd,OAAO,WAAW,KAAK,QAAQ;QAC/B,WAAW,KAAK,EAAE,EAClB,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,CAAA;AACpD,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC9D,MAAM,KAAK,GAAG,MAAiC,CAAA;IAC/C,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,YAAY;QAAE,OAAO,IAAI,CAAA;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;IAC1B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5D,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC3F,CAAC;AAED,SAAS,qBAAqB;IAC5B,IAAI,CAAC;QACH,YAAY,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;QACvD,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,MAAyB,OAAO,CAAC,GAAG,EACpC,UAAkC,EAAE;IAEpC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAA;IACrD,IAAI,GAAG,CAAC,qBAAqB,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;IAClF,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IACpE,MAAM,QAAQ,GACZ,OAAO,CAAC,iBAAiB,KAAK,SAAS;QACrC,CAAC,CAAC,OAAO,CAAC,iBAAiB;QAC3B,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,qBAAqB,EAAE,CAAA;IACtD,IAAI,QAAQ;QAAE,OAAO,IAAI,aAAa,CAAC,OAAO,CAAC,CAAA;IAC/C,OAAO,IAAI,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;AACzC,CAAC"}

package/dist/file-lock.d.ts

@@ -1,34 +0,0 @@
-import { type Stats } from 'node:fs';
-export type FileLockObservation = 
-/** The rendezvous has been scanned and this contender is about to publish. */
-{
-    phase: 'registering';
-    entry: string;
-} | {
-    phase: 'choosing-published';
-    entry: string;
-} | {
-    phase: 'stale-entry';
-    entry: string;
-} | {
-    phase: 'waiting';
-    blockers: string[];
-};
-interface FileLockOptions {
-    waitMs?: number;
-    observe?: (observation: FileLockObservation) => void;
-    /** Installer transactions report lock replacement after a successful action. */
-    strictRelease?: boolean;
-    /** Test seam for native directory-entry races. */
-    lstatEntry?: (file: string) => Stats;
-}
-export declare function withFileLock<T>(file: string, action: () => T, options?: FileLockOptions): T;
-/**
- * Serialize a read/merge/write transaction for one user-owned target file.
- *
- * This is the single installer-facing lock policy: the target's direct parent
- * is a real current-user-owned directory, remains the same inode throughout,
- * and the bakery rendezvous lives beside the target rather than inside it.
- */
-export declare function withTargetFileLock<T>(target: string, action: () => T, options?: Omit<FileLockOptions, 'strictRelease'>): T;
-export {};