@senguoyun/dsh-arkme 0.1.16 → 0.1.22

package/lib/plugin-updater-helper-CEnlAUhI.js

@@ -0,0 +1,731 @@
+import { a as securePrivateFile, n as prepareProfilePackageManager, r as securePrivateDirectory } from "./profile-package-manager-DwuQu8ZL.js";
+import { closeSync, existsSync, openSync, readFileSync, realpathSync } from "node:fs";
+import { createHash, randomUUID } from "node:crypto";
+import { dirname, isAbsolute, join, posix } from "node:path";
+import { spawn, spawnSync } from "node:child_process";
+import { chmod as chmod$1, mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import semver from "semver";
+import { gunzipSync } from "node:zlib";
+//#region src/plugin-update-artifact.ts
+const ARKME_PLUGIN_PACKAGE_NAME = "@senguoyun/dsh-arkme";
+const PLUGIN_UPDATE_API_PATH = "/api/public/v1/arkme/plugin-update/latest";
+const MAX_PLUGIN_ARTIFACT_BYTES = 100 * 1024 * 1024;
+const MAX_TAR_FILES = 4096;
+const TAR_BLOCK_BYTES = 512;
+var PluginUpdateArtifactError = class extends Error {
+	code;
+	retryable;
+	constructor(code, message, retryable = false) {
+		super(message);
+		this.code = code;
+		this.retryable = retryable;
+		this.name = "PluginUpdateArtifactError";
+	}
+};
+function stringValue(value, maxLength) {
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim();
+	if (trimmed === "" || trimmed.length > maxLength) return void 0;
+	return trimmed;
+}
+function assertNoControls(value, label, allowedControls = "") {
+	for (const character of value) if (character < " " && !allowedControls.includes(character) || character === "") throw new PluginUpdateArtifactError("plugin-update-manifest-control", `${label} 包含非法控制字符`);
+}
+function validatePluginUpdateServiceOrigin(raw) {
+	const url = new URL(raw);
+	if (url.hostname.toLowerCase() === "registry.npmjs.org") throw new Error("dsh-arkme: update service must not use the npm registry");
+	if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "") throw new Error("dsh-arkme: update service base URL must be an HTTPS origin without credentials or path");
+	return url.origin;
+}
+function validatePluginUpdateArtifactOrigin(raw) {
+	const url = new URL(raw);
+	if (url.hostname.toLowerCase() === "registry.npmjs.org") throw new Error("dsh-arkme: update artifacts must not use the npm registry");
+	if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "") throw new Error("dsh-arkme: update artifact base URL must be an HTTPS origin without credentials or path");
+	return url.origin;
+}
+function validateArtifactUrl(raw, expectedOrigin) {
+	const url = new URL(raw);
+	if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.hostname === "" || url.hash !== "" || url.hostname.toLowerCase() === "registry.npmjs.org") throw new PluginUpdateArtifactError("plugin-update-artifact-url-invalid", "插件更新制品 URL 必须是非 npm 的 HTTPS 下载地址");
+	if (url.pathname === "" || url.pathname === "/" || url.pathname.includes("\\") || url.pathname.split("/").includes("..") || url.pathname.endsWith("/")) throw new PluginUpdateArtifactError("plugin-update-artifact-url-invalid", "插件更新制品 URL 路径无效");
+	if (expectedOrigin !== void 0 && url.origin !== validatePluginUpdateArtifactOrigin(expectedOrigin)) throw new PluginUpdateArtifactError("plugin-update-artifact-origin-invalid", "插件更新制品 URL 不属于受信下载源");
+	return url.toString();
+}
+function parsePluginUpdateManifest(value, options) {
+	validatePluginUpdateServiceOrigin(options.updateServiceOrigin);
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new PluginUpdateArtifactError("plugin-update-response-invalid", "更新服务返回格式无效", true);
+	const source = value;
+	const version = stringValue(source.version, 128);
+	const artifactUrl = stringValue(source.downloadUrl, 4096);
+	if (version === void 0 || semver.valid(version) === null || artifactUrl === void 0) throw new PluginUpdateArtifactError("plugin-update-response-invalid", "更新服务返回格式无效", true);
+	assertNoControls(version, "version");
+	const releaseNotes = stringValue(source.releaseNotes, 300);
+	if (releaseNotes !== void 0) assertNoControls(releaseNotes, "releaseNotes", "	\n\r");
+	return {
+		schemaVersion: 1,
+		packageName: ARKME_PLUGIN_PACKAGE_NAME,
+		version,
+		artifactUrl: validateArtifactUrl(artifactUrl, options.artifactOrigin),
+		artifactSize: MAX_PLUGIN_ARTIFACT_BYTES,
+		notice: {
+			level: "normal",
+			title: "插件更新",
+			summary: releaseNotes ?? "发现新版本"
+		}
+	};
+}
+function pluginUpdateEndpointUrl(updateServiceOrigin, input) {
+	const url = new URL(PLUGIN_UPDATE_API_PATH, validatePluginUpdateServiceOrigin(updateServiceOrigin));
+	url.searchParams.set("app_version", input.appVersion ?? "");
+	url.searchParams.set("dsh_version", input.dshVersion ?? "");
+	url.searchParams.set("current_version", input.currentVersion);
+	return url;
+}
+function parseOctal(buffer, offset, length) {
+	const value = buffer.subarray(offset, offset + length).toString("ascii").replace(/\0.*$/, "").trim();
+	if (!/^[0-7]*$/.test(value)) throw new PluginUpdateArtifactError("plugin-update-tgz-invalid", "插件 tgz tar 数值字段无效");
+	return value === "" ? 0 : Number.parseInt(value, 8);
+}
+function tarPath(header) {
+	const name = header.subarray(0, 100).toString("utf8").replace(/\0.*$/, "");
+	const prefix = header.subarray(345, 500).toString("utf8").replace(/\0.*$/, "");
+	return prefix === "" ? name : `${prefix}/${name}`;
+}
+function assertTarHeaderChecksum(header) {
+	const expected = parseOctal(header, 148, 8);
+	let actual = 0;
+	for (let index = 0; index < header.byteLength; index += 1) actual += index >= 148 && index < 156 ? 32 : header[index] ?? 0;
+	if (expected !== actual) throw new PluginUpdateArtifactError("plugin-update-tgz-checksum-invalid", "插件 tgz tar 头校验失败");
+}
+function validateTarPath(path) {
+	const clean = posix.normalize(path);
+	if (!path.startsWith("package/") || clean !== path || path.includes("\\") || path.includes("\0") || path.startsWith("/") || path.split("/").includes("..") || /^[A-Za-z]:/.test(path)) throw new PluginUpdateArtifactError("plugin-update-tgz-path-invalid", `插件 tgz 包含非法路径：${path}`);
+	for (const character of path) if (character < " " || character === "") throw new PluginUpdateArtifactError("plugin-update-tgz-path-invalid", "插件 tgz 路径包含控制字符");
+}
+function readTar(tar) {
+	const files = /* @__PURE__ */ new Map();
+	let offset = 0;
+	let total = 0;
+	while (offset + TAR_BLOCK_BYTES <= tar.byteLength) {
+		const header = tar.subarray(offset, offset + TAR_BLOCK_BYTES);
+		if (header.every((byte) => byte === 0)) {
+			if (!tar.subarray(offset).every((byte) => byte === 0)) throw new PluginUpdateArtifactError("plugin-update-tgz-trailing-data", "插件 tgz tar 结束块后包含额外数据");
+			return files;
+		}
+		assertTarHeaderChecksum(header);
+		const path = tarPath(header);
+		validateTarPath(path);
+		if (files.has(path)) throw new PluginUpdateArtifactError("plugin-update-tgz-duplicate-path", `插件 tgz 包含重复路径：${path}`);
+		const type = header[156];
+		if (type !== "0".charCodeAt(0) && type !== 0) throw new PluginUpdateArtifactError("plugin-update-tgz-entry-type", "插件 tgz 只允许普通文件");
+		const size = parseOctal(header, 124, 12);
+		total += size;
+		if (total > MAX_PLUGIN_ARTIFACT_BYTES) throw new PluginUpdateArtifactError("plugin-update-tgz-too-large", "插件 tgz 解包总量超过限制");
+		const start = offset + TAR_BLOCK_BYTES;
+		const end = start + size;
+		if (end > tar.byteLength) throw new PluginUpdateArtifactError("plugin-update-tgz-truncated", "插件 tgz 内容不完整");
+		files.set(path, Buffer.from(tar.subarray(start, end)));
+		if (files.size > MAX_TAR_FILES) throw new PluginUpdateArtifactError("plugin-update-tgz-file-count", "插件 tgz 文件数量超限");
+		offset = start + Math.ceil(size / TAR_BLOCK_BYTES) * TAR_BLOCK_BYTES;
+	}
+	throw new PluginUpdateArtifactError("plugin-update-tgz-end-missing", "插件 tgz 缺少 tar 结束块");
+}
+function readPackageJSON(bytes) {
+	try {
+		const value = JSON.parse(bytes.toString("utf8"));
+		if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error("not object");
+		return value;
+	} catch (error) {
+		throw new PluginUpdateArtifactError("plugin-update-package-json-invalid", `插件 package.json 无效：${String(error)}`);
+	}
+}
+function normalizePackagePath(path) {
+	return `package/${posix.normalize(path.replace(/^\.\//, ""))}`;
+}
+function inspectPluginPackageTgz(bytes) {
+	if (bytes.byteLength <= 0 || bytes.byteLength > MAX_PLUGIN_ARTIFACT_BYTES) throw new PluginUpdateArtifactError("plugin-update-artifact-size-invalid", "插件制品大小无效");
+	let tar;
+	try {
+		tar = gunzipSync(bytes, { maxOutputLength: 109052928 });
+	} catch (error) {
+		throw new PluginUpdateArtifactError("plugin-update-gzip-invalid", `插件 tgz 无法安全解压：${String(error)}`);
+	}
+	const files = readTar(tar);
+	const packageJson = files.get("package/package.json");
+	if (packageJson === void 0 || !files.has("package/lib/index.js") || !files.has("package/lib/client.js")) throw new PluginUpdateArtifactError("plugin-update-required-file-missing", "插件 tgz 缺少必要入口文件");
+	const manifest = readPackageJSON(packageJson);
+	if (manifest.name !== "@senguoyun/dsh-arkme" || typeof manifest.version !== "string" || semver.valid(manifest.version) === null) throw new PluginUpdateArtifactError("plugin-update-package-identity-invalid", "插件 tgz package identity 无效");
+	const dsh = manifest.dsh;
+	const patch = dsh !== null && typeof dsh === "object" && !Array.isArray(dsh) ? dsh.bundle?.patch : void 0;
+	if (typeof patch !== "string" || patch.trim() === "" || !files.has(normalizePackagePath(patch))) throw new PluginUpdateArtifactError("plugin-update-bundle-patch-missing", "插件 tgz 缺少 dsh.bundle.patch");
+	return {
+		packageName: ARKME_PLUGIN_PACKAGE_NAME,
+		version: manifest.version,
+		files
+	};
+}
+function cachedPluginArtifactPath(cacheDirectory, version) {
+	return join(cacheDirectory, version, `dsh-arkme-${version}.tgz`);
+}
+function existingCachedPluginArtifactPath(cacheDirectory, version) {
+	const path = cachedPluginArtifactPath(cacheDirectory, version);
+	return existsSync(path) ? path : void 0;
+}
+async function readResponseBytes(response, maximumSize) {
+	const declared = Number(response.headers.get("content-length"));
+	if (Number.isFinite(declared) && declared > maximumSize) throw new PluginUpdateArtifactError("plugin-update-artifact-too-large", "插件制品响应超过最大限制", true);
+	if (response.body === null) {
+		const bytes = Buffer.from(await response.arrayBuffer());
+		if (bytes.byteLength > maximumSize) throw new PluginUpdateArtifactError("plugin-update-artifact-too-large", "插件制品响应超过最大限制", true);
+		return bytes;
+	}
+	const reader = response.body.getReader();
+	const chunks = [];
+	let total = 0;
+	while (true) {
+		const result = await reader.read();
+		if (result.done) break;
+		total += result.value.byteLength;
+		if (total > maximumSize || total > MAX_PLUGIN_ARTIFACT_BYTES) {
+			await reader.cancel();
+			throw new PluginUpdateArtifactError("plugin-update-artifact-too-large", "插件制品响应超过声明大小", true);
+		}
+		chunks.push(Buffer.from(result.value));
+	}
+	return Buffer.concat(chunks);
+}
+async function fetchPluginArtifactBytes(manifest, options) {
+	const controller = new AbortController();
+	const timeout = setTimeout(() => controller.abort(), options.requestTimeoutMs);
+	timeout.unref?.();
+	try {
+		const response = await options.fetchImpl(manifest.artifactUrl, {
+			method: "GET",
+			headers: { Accept: "application/octet-stream" },
+			redirect: "error",
+			signal: controller.signal
+		});
+		if (!response.ok) throw new PluginUpdateArtifactError("plugin-update-artifact-http-error", `插件制品下载返回 HTTP ${String(response.status)}`, response.status >= 500 || response.status === 429);
+		return await readResponseBytes(response, manifest.artifactSize);
+	} catch (error) {
+		if (error instanceof PluginUpdateArtifactError) throw error;
+		throw new PluginUpdateArtifactError(controller.signal.aborted ? "plugin-update-artifact-timeout" : "plugin-update-artifact-network-error", controller.signal.aborted ? "插件制品下载超时" : "无法下载插件制品", true);
+	} finally {
+		clearTimeout(timeout);
+	}
+}
+async function downloadAndCachePluginArtifact(manifest, options) {
+	validateArtifactUrl(manifest.artifactUrl, options.artifactOrigin);
+	const cachedPath = cachedPluginArtifactPath(options.cacheDirectory, manifest.version);
+	if (existsSync(cachedPath)) {
+		try {
+			if (inspectPluginPackageTgz(readFileSync(cachedPath)).version === manifest.version) return cachedPath;
+		} catch {}
+		await unlink(cachedPath).catch(() => void 0);
+	}
+	const bytes = await fetchPluginArtifactBytes(manifest, {
+		fetchImpl: options.fetchImpl ?? globalThis.fetch.bind(globalThis),
+		requestTimeoutMs: options.requestTimeoutMs ?? 3e4
+	});
+	const inspected = inspectPluginPackageTgz(bytes);
+	if (inspected.packageName !== "@senguoyun/dsh-arkme" || inspected.version !== manifest.version) throw new PluginUpdateArtifactError("plugin-update-package-identity-invalid", "插件制品包名或版本不匹配");
+	const targetDirectory = join(options.cacheDirectory, manifest.version);
+	const temporaryDirectory = join(options.cacheDirectory, ".tmp");
+	await mkdir(targetDirectory, {
+		recursive: true,
+		mode: 448
+	});
+	await chmod$1(targetDirectory, 448);
+	await mkdir(temporaryDirectory, {
+		recursive: true,
+		mode: 448
+	});
+	await chmod$1(temporaryDirectory, 448);
+	const temporaryPath = join(temporaryDirectory, `${process.pid}.${randomUUID()}.tgz`);
+	await writeFile(temporaryPath, bytes, { mode: 384 });
+	await chmod$1(temporaryPath, 384);
+	try {
+		await rename(temporaryPath, cachedPath);
+	} catch (error) {
+		await unlink(temporaryPath).catch(() => void 0);
+		throw error;
+	}
+	await chmod$1(cachedPath, 384);
+	return cachedPath;
+}
+//#endregion
+//#region src/plugin-update-install-state.ts
+const PHASES = /* @__PURE__ */ new Set([
+	"idle",
+	"preparing",
+	"downloading",
+	"verifying",
+	"installing",
+	"restarting",
+	"succeeded",
+	"failed",
+	"rolled-back"
+]);
+function boundedString(value, maxLength) {
+	if (typeof value !== "string") return "";
+	const normalized = value.trim();
+	return normalized.length <= maxLength ? normalized : normalized.slice(0, maxLength);
+}
+function parsePluginUpdateInstallSnapshot(value) {
+	if (value === null || typeof value !== "object") return void 0;
+	const source = value;
+	const phase = source.phase;
+	const jobId = boundedString(source.jobId, 128);
+	const previousVersion = boundedString(source.previousVersion, 128);
+	const targetVersion = boundedString(source.targetVersion, 128);
+	const targetArtifactPath = boundedString(source.targetArtifactPath, 4096);
+	const targetArtifactSha512 = boundedString(source.targetArtifactSha512, 128);
+	const appVersion = boundedString(source.appVersion, 128);
+	const dshVersion = boundedString(source.dshVersion, 128);
+	const message = boundedString(source.message, 500);
+	const updatedAtMillis = source.updatedAtMillis;
+	if (source.schemaVersion !== 1 || !PHASES.has(phase) || jobId === "" || previousVersion === "" || targetVersion === "" || typeof updatedAtMillis !== "number" || !Number.isFinite(updatedAtMillis) || updatedAtMillis <= 0) return void 0;
+	return {
+		schemaVersion: 1,
+		jobId,
+		phase,
+		previousVersion,
+		targetVersion,
+		...targetArtifactPath === "" ? {} : { targetArtifactPath },
+		...!/^[a-f0-9]{128}$/.test(targetArtifactSha512) ? {} : { targetArtifactSha512 },
+		...appVersion === "" ? {} : { appVersion },
+		...dshVersion === "" ? {} : { dshVersion },
+		message,
+		updatedAtMillis
+	};
+}
+var PluginUpdateInstallStateStore = class {
+	path;
+	constructor(directory) {
+		this.path = join(directory, "plugin-update-install-state.json");
+	}
+	async read() {
+		try {
+			return parsePluginUpdateInstallSnapshot(JSON.parse(await readFile(this.path, "utf8")));
+		} catch (error) {
+			if (error.code === "ENOENT") return void 0;
+			return;
+		}
+	}
+	async write(snapshot) {
+		const directory = dirname(this.path);
+		await mkdir(directory, {
+			recursive: true,
+			mode: 448
+		});
+		await securePrivateDirectory(directory);
+		const temporary = `${this.path}.${process.pid}.${randomUUID()}.tmp`;
+		await writeFile(temporary, `${JSON.stringify(snapshot, void 0, 2)}\n`, { mode: 384 });
+		await securePrivateFile(temporary);
+		await rename(temporary, this.path);
+		await securePrivateFile(this.path);
+	}
+	async clear() {
+		await unlink(this.path).catch((error) => {
+			if (error.code !== "ENOENT") throw error;
+		});
+	}
+};
+//#endregion
+//#region src/plugin-update-install-receipt.ts
+async function writePluginUpdateInstallReceipt(input) {
+	if (input.targetArtifactSha512 === void 0 || input.appVersion === void 0 || input.dshVersion === void 0) throw new Error("plugin update install receipt metadata is incomplete");
+	if (!/^[a-f0-9]{128}$/.test(input.targetArtifactSha512)) throw new Error("plugin update install receipt digest is invalid");
+	const directory = dirname(input.targetArtifactPath);
+	const receiptPath = join(directory, "plugin-update-install-receipt.json");
+	await securePrivateDirectory(directory);
+	const temporaryPath = `${receiptPath}.${process.pid}.${randomUUID()}.tmp`;
+	await writeFile(temporaryPath, `${JSON.stringify({
+		schemaVersion: 1,
+		packageName: ARKME_PLUGIN_PACKAGE_NAME,
+		targetVersion: input.targetVersion,
+		targetArtifactPath: input.targetArtifactPath,
+		targetArtifactSha512: input.targetArtifactSha512,
+		appVersion: input.appVersion,
+		dshVersion: input.dshVersion,
+		installedAtMillis: Date.now()
+	}, void 0, 2)}\n`, { mode: 384 });
+	await chmod$1(temporaryPath, 384);
+	try {
+		await rename(temporaryPath, receiptPath);
+	} catch (error) {
+		await unlink(temporaryPath).catch(() => void 0);
+		throw error;
+	}
+	await securePrivateFile(receiptPath);
+}
+//#endregion
+//#region src/plugin-updater-helper.ts
+const PARENT_EXIT_TIMEOUT_MS = 2e4;
+const HEALTH_TIMEOUT_MS = 45e3;
+function nonEmptyString(value, maxLength = 4096) {
+	if (typeof value !== "string") return void 0;
+	const normalized = value.trim();
+	return normalized !== "" && normalized.length <= maxLength ? normalized : void 0;
+}
+function stringArray(value, options = {}) {
+	if (!Array.isArray(value)) return void 0;
+	const result = value.map((item) => nonEmptyString(item));
+	if (result.some((item) => item === void 0) || !options.allowEmpty && result.length === 0) return void 0;
+	return result;
+}
+function parsePluginUpdaterPlan(value) {
+	if (value === null || typeof value !== "object") throw new Error("updater plan must be an object");
+	const source = value;
+	const jobId = nonEmptyString(source.jobId, 128);
+	const execPath = nonEmptyString(source.execPath);
+	const execArgv = stringArray(source.execArgv, { allowEmpty: true });
+	const dshBinPath = nonEmptyString(source.dshBinPath);
+	const dshHome = nonEmptyString(source.dshHome);
+	const profileName = nonEmptyString(source.profileName, 64);
+	const previousVersion = nonEmptyString(source.previousVersion, 128);
+	const previousSpec = nonEmptyString(source.previousSpec, 4096);
+	const targetVersion = nonEmptyString(source.targetVersion, 128);
+	const targetArtifactPath = nonEmptyString(source.targetArtifactPath, 4096);
+	const targetArtifactSha512 = nonEmptyString(source.targetArtifactSha512, 128);
+	const appVersion = nonEmptyString(source.appVersion, 128);
+	const dshVersion = nonEmptyString(source.dshVersion, 128);
+	const previousArtifactPath = nonEmptyString(source.previousArtifactPath, 4096);
+	const stateDirectory = nonEmptyString(source.stateDirectory);
+	const healthUrl = nonEmptyString(source.healthUrl);
+	const logPath = nonEmptyString(source.logPath);
+	const restartArgv = stringArray(source.restartArgv);
+	if (source.schemaVersion !== 1 || jobId === void 0 || execPath === void 0 || execArgv === void 0 || dshBinPath === void 0 || dshHome === void 0 || profileName === void 0 || previousVersion === void 0 || previousSpec === void 0 || targetVersion === void 0 || targetArtifactPath === void 0 || stateDirectory === void 0 || healthUrl === void 0 || logPath === void 0 || restartArgv === void 0 || source.parentPid === void 0 || typeof source.parentPid !== "number" || !Number.isSafeInteger(source.parentPid) || source.parentPid <= 0) throw new Error("updater plan is incomplete");
+	if (!isAbsolute(targetArtifactPath) || !existsSync(targetArtifactPath) || previousArtifactPath !== void 0 && (!isAbsolute(previousArtifactPath) || !existsSync(previousArtifactPath))) throw new Error("updater plan artifact paths must be existing absolute files");
+	if (targetArtifactSha512 !== void 0 && !/^[a-f0-9]{128}$/.test(targetArtifactSha512)) throw new Error("updater plan artifact digest is invalid");
+	const url = new URL(healthUrl);
+	if (url.protocol !== "http:" || !["127.0.0.1", "localhost"].includes(url.hostname)) throw new Error("updater health URL must be loopback HTTP");
+	return {
+		schemaVersion: 1,
+		jobId,
+		parentPid: source.parentPid,
+		execPath,
+		execArgv,
+		dshBinPath,
+		restartArgv,
+		dshHome,
+		profileName,
+		previousVersion,
+		previousSpec,
+		targetVersion,
+		targetArtifactPath,
+		...targetArtifactSha512 === void 0 ? {} : { targetArtifactSha512 },
+		...appVersion === void 0 ? {} : { appVersion },
+		...dshVersion === void 0 ? {} : { dshVersion },
+		...previousArtifactPath === void 0 ? {} : { previousArtifactPath },
+		stateDirectory,
+		healthUrl: url.toString(),
+		logPath
+	};
+}
+function processAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return error.code !== "ESRCH";
+	}
+}
+async function waitForProcessExit(pid, timeoutMs) {
+	const deadline = Date.now() + timeoutMs;
+	while (processAlive(pid) && Date.now() < deadline) await new Promise((resolve) => setTimeout(resolve, 200));
+	return !processAlive(pid);
+}
+function isLocalPackageSpec(spec) {
+	return /^(?:link:|file:)/.test(spec);
+}
+function buildTargetInstallArgs(plan) {
+	return [
+		...plan.execArgv,
+		plan.dshBinPath,
+		"plugin",
+		"--profile",
+		plan.profileName,
+		"add",
+		`file:${plan.targetArtifactPath}`
+	];
+}
+function buildTargetRemoveArgs(plan) {
+	return [
+		...plan.execArgv,
+		plan.dshBinPath,
+		"plugin",
+		"--profile",
+		plan.profileName,
+		"remove",
+		ARKME_PLUGIN_PACKAGE_NAME
+	];
+}
+function assertTargetArtifactIntegrity(plan) {
+	if (plan.targetArtifactSha512 === void 0) return;
+	if (createHash("sha512").update(readFileSync(plan.targetArtifactPath)).digest("hex") !== plan.targetArtifactSha512) throw new Error("updater target artifact digest mismatch");
+}
+function readDshPackageVersion(dshBinPath) {
+	try {
+		let resolvedBinPath = dshBinPath;
+		try {
+			resolvedBinPath = realpathSync(dshBinPath);
+		} catch {}
+		const manifest = JSON.parse(readFileSync(join(dirname(resolvedBinPath), "..", "package.json"), "utf8"));
+		return typeof manifest.version === "string" && semver.valid(manifest.version) !== null ? manifest.version : void 0;
+	} catch {
+		return;
+	}
+}
+function completeReceiptMetadata(plan, environment = process.env) {
+	const targetArtifactSha512 = plan.targetArtifactSha512 ?? createHash("sha512").update(readFileSync(plan.targetArtifactPath)).digest("hex");
+	const appVersion = plan.appVersion ?? nonEmptyString(environment.ARKME_APP_VERSION, 128);
+	const dshVersion = plan.dshVersion ?? readDshPackageVersion(plan.dshBinPath);
+	if (appVersion === void 0 || dshVersion === void 0) throw new Error("updater plan cannot derive receipt compatibility metadata");
+	return {
+		...plan,
+		targetArtifactSha512,
+		appVersion,
+		dshVersion
+	};
+}
+function runTargetInstall(plan) {
+	return spawnSync(plan.execPath, buildTargetInstallArgs(plan), {
+		env: {
+			...process.env,
+			DSH_HOME: plan.dshHome
+		},
+		stdio: "inherit",
+		shell: false
+	}).status === 0;
+}
+function runTargetRemove(plan) {
+	return spawnSync(plan.execPath, buildTargetRemoveArgs(plan), {
+		env: {
+			...process.env,
+			DSH_HOME: plan.dshHome
+		},
+		stdio: "inherit",
+		shell: false
+	}).status === 0;
+}
+function runRollbackInstall(plan) {
+	const fallbackSpec = plan.previousArtifactPath === void 0 ? plan.previousSpec : `file:${plan.previousArtifactPath}`;
+	if (plan.previousArtifactPath === void 0 && !isLocalPackageSpec(fallbackSpec)) return false;
+	spawnSync(plan.execPath, buildTargetRemoveArgs(plan), {
+		env: {
+			...process.env,
+			DSH_HOME: plan.dshHome
+		},
+		stdio: "inherit",
+		shell: false
+	});
+	const args = [
+		...plan.execArgv,
+		plan.dshBinPath,
+		"plugin",
+		"--profile",
+		plan.profileName,
+		"add",
+		fallbackSpec
+	];
+	return spawnSync(plan.execPath, args, {
+		env: {
+			...process.env,
+			DSH_HOME: plan.dshHome
+		},
+		stdio: "inherit",
+		shell: false
+	}).status === 0;
+}
+function installedProfileVersion(plan) {
+	try {
+		return JSON.parse(readFileSync(join(plan.dshHome, "profiles", plan.profileName, "node_modules", "@senguoyun", "dsh-arkme", "package.json"), "utf8")).version ?? "";
+	} catch {
+		return "";
+	}
+}
+function restartDsh(plan) {
+	const child = spawn(plan.execPath, plan.restartArgv, {
+		detached: true,
+		env: {
+			...process.env,
+			DSH_HOME: plan.dshHome
+		},
+		stdio: "inherit",
+		shell: false
+	});
+	child.unref();
+	return child;
+}
+async function waitForHealthy(plan, expectedVersion) {
+	const deadline = Date.now() + HEALTH_TIMEOUT_MS;
+	while (Date.now() < deadline) {
+		const installedVersion = installedProfileVersion(plan);
+		try {
+			const response = await fetch(plan.healthUrl, {
+				method: "POST",
+				headers: {
+					"Content-Type": "application/json",
+					Origin: new URL(plan.healthUrl).origin
+				},
+				body: JSON.stringify({ operation: "plugin.update.status" }),
+				signal: AbortSignal.timeout(2e3)
+			});
+			if (response.ok) {
+				const body = await response.json();
+				if (body.ok === true && body.value?.installedVersion === expectedVersion) return true;
+			}
+		} catch {}
+		if (installedVersion === expectedVersion) try {
+			if ((await fetch(new URL("/", plan.healthUrl), { signal: AbortSignal.timeout(2e3) })).ok) return true;
+		} catch {}
+		await new Promise((resolve) => setTimeout(resolve, 500));
+	}
+	return false;
+}
+function managedOperations(overrides) {
+	return {
+		runRollbackInstall,
+		waitForHealthy,
+		writeInstallReceipt: writePluginUpdateInstallReceipt,
+		...overrides
+	};
+}
+function planWithReplacementHealthUrl(plan, replacementUrl) {
+	const replacement = new URL(replacementUrl);
+	if (replacement.protocol !== "http:" || !["127.0.0.1", "localhost"].includes(replacement.hostname)) throw new Error("managed plugin update replacement URL must be loopback HTTP");
+	const health = new URL(plan.healthUrl);
+	health.protocol = replacement.protocol;
+	health.hostname = replacement.hostname;
+	health.port = replacement.port;
+	return {
+		...plan,
+		healthUrl: health.toString()
+	};
+}
+async function writePhase(store, plan, phase, message) {
+	const snapshot = {
+		schemaVersion: 1,
+		jobId: plan.jobId,
+		phase,
+		previousVersion: plan.previousVersion,
+		targetVersion: plan.targetVersion,
+		...plan.targetArtifactSha512 === void 0 ? {} : {
+			targetArtifactPath: plan.targetArtifactPath,
+			targetArtifactSha512: plan.targetArtifactSha512
+		},
+		...plan.appVersion === void 0 ? {} : { appVersion: plan.appVersion },
+		...plan.dshVersion === void 0 ? {} : { dshVersion: plan.dshVersion },
+		message,
+		updatedAtMillis: Date.now()
+	};
+	await store.write(snapshot);
+	return snapshot;
+}
+async function rollbackAndRestart(plan, store, rolledBackMessage) {
+	if (!runRollbackInstall(plan)) {
+		await writePhase(store, plan, "failed", "更新失败，旧版本恢复也失败；请使用更新命令手动修复。");
+		return;
+	}
+	restartDsh(plan);
+	const healthy = await waitForHealthy(plan, plan.previousVersion);
+	await writePhase(store, plan, healthy ? "rolled-back" : "failed", healthy ? rolledBackMessage : "已恢复旧版本文件，但 DSH 未能自动启动。");
+}
+async function runPluginUpdater(planPath) {
+	const plan = completeReceiptMetadata(parsePluginUpdaterPlan(JSON.parse(await readFile(planPath, "utf8"))));
+	await unlink(planPath).catch(() => void 0);
+	const store = new PluginUpdateInstallStateStore(plan.stateDirectory);
+	if (!await waitForProcessExit(plan.parentPid, PARENT_EXIT_TIMEOUT_MS)) {
+		await writePhase(store, plan, "failed", "旧 DSH 进程未能退出，更新已取消。");
+		return;
+	}
+	try {
+		prepareProfilePackageManager(plan.dshHome, plan.profileName);
+	} catch (error) {
+		restartDsh(plan);
+		const detail = error instanceof Error ? error.message : String(error);
+		await writePhase(store, plan, "failed", await waitForHealthy(plan, plan.previousVersion) ? `Profile pnpm 不可用，更新已取消并重新启动旧版本：${detail}` : `Profile pnpm 不可用，更新已取消，但旧版本未能自动启动：${detail}`);
+		return;
+	}
+	try {
+		assertTargetArtifactIntegrity(plan);
+	} catch (error) {
+		restartDsh(plan);
+		const healthy = await waitForHealthy(plan, plan.previousVersion);
+		const detail = error instanceof Error ? error.message : String(error);
+		await writePhase(store, plan, "failed", healthy ? `更新包完整性校验失败，已重新启动旧版本：${detail}` : `更新包完整性校验失败，且旧版本未能自动启动：${detail}`);
+		return;
+	}
+	await writePhase(store, plan, "installing", `正在安装 ${plan.targetVersion}…`);
+	if (!runTargetRemove(plan)) {
+		await writePhase(store, plan, "failed", "旧版本清理失败，正在恢复旧版本…");
+		await rollbackAndRestart(plan, store, "旧版本清理失败，已自动恢复旧版本。");
+		return;
+	}
+	if (!runTargetInstall(plan)) {
+		await writePhase(store, plan, "failed", "新版本安装失败，正在恢复旧版本…");
+		await rollbackAndRestart(plan, store, "新版本安装失败，已自动恢复旧版本。");
+		return;
+	}
+	const installedVersion = installedProfileVersion(plan);
+	if (semver.valid(installedVersion) === null || semver.lt(installedVersion, plan.targetVersion)) {
+		await writePhase(store, plan, "failed", "未安装预期插件版本，正在恢复旧版本…");
+		await rollbackAndRestart(plan, store, "插件版本不符合预期，已自动恢复旧版本。");
+		return;
+	}
+	plan.targetVersion = installedVersion;
+	await writePhase(store, plan, "restarting", "安装完成，正在重启 DSH…");
+	const child = restartDsh(plan);
+	if (await waitForHealthy(plan, plan.targetVersion)) {
+		try {
+			assertTargetArtifactIntegrity(plan);
+			await writePluginUpdateInstallReceipt(plan);
+		} catch (error) {
+			child.kill("SIGTERM");
+			if (child.pid !== void 0) await waitForProcessExit(child.pid, 1e4);
+			await writePhase(store, plan, "failed", `成功回执持久化失败，正在恢复旧版本：${error instanceof Error ? error.message : String(error)}`).catch(() => void 0);
+			await rollbackAndRestart(plan, store, "成功回执持久化失败，已自动恢复旧版本。");
+			return;
+		}
+		await writePhase(store, plan, "succeeded", `已更新到 ${plan.targetVersion}。`);
+		return;
+	}
+	child.kill("SIGTERM");
+	if (child.pid !== void 0) await waitForProcessExit(child.pid, 1e4);
+	await writePhase(store, plan, "failed", "新版本健康检查失败，正在恢复旧版本…");
+	await rollbackAndRestart(plan, store, "新版本启动失败，已自动恢复旧版本。");
+}
+async function finalizeManagedPluginUpdate(planPath, replacementUrl, overrides = {}) {
+	const plan = completeReceiptMetadata(planWithReplacementHealthUrl(parsePluginUpdaterPlan(JSON.parse(await readFile(planPath, "utf8"))), replacementUrl));
+	const store = new PluginUpdateInstallStateStore(plan.stateDirectory);
+	const ops = managedOperations(overrides);
+	assertTargetArtifactIntegrity(plan);
+	if (!await ops.waitForHealthy(plan, plan.targetVersion)) throw new Error("managed plugin update did not become healthy");
+	assertTargetArtifactIntegrity(plan);
+	await ops.writeInstallReceipt(plan);
+	await writePhase(store, plan, "succeeded", `已更新到 ${plan.targetVersion}。`);
+	await unlink(planPath);
+}
+async function rollbackManagedPluginUpdate(planPath, overrides = {}) {
+	const plan = parsePluginUpdaterPlan(JSON.parse(await readFile(planPath, "utf8")));
+	const store = new PluginUpdateInstallStateStore(plan.stateDirectory);
+	if (!managedOperations(overrides).runRollbackInstall(plan)) {
+		await writePhase(store, plan, "failed", "更新失败，旧版本恢复也失败；请使用更新命令手动修复。");
+		throw new Error("managed plugin update rollback failed");
+	}
+	await writePhase(store, plan, "rolled-back", "已恢复旧版本文件，正在由 Arkme 重启 DSH…");
+	await unlink(planPath);
+}
+async function runPluginUpdaterCli(planPath) {
+	if (planPath === void 0) throw new Error("updater plan path is required");
+	const plan = parsePluginUpdaterPlan(JSON.parse(await readFile(planPath, "utf8")));
+	const logFd = openSync(plan.logPath, "a", 384);
+	try {
+		closeSync(logFd);
+		await runPluginUpdater(planPath);
+	} catch (error) {
+		await writePhase(new PluginUpdateInstallStateStore(plan.stateDirectory), plan, "failed", error instanceof Error ? error.message : String(error));
+	}
+}
+//#endregion
+export { validatePluginUpdateServiceOrigin as _, parsePluginUpdaterPlan as a, runPluginUpdaterCli as c, PluginUpdateArtifactError as d, downloadAndCachePluginArtifact as f, validatePluginUpdateArtifactOrigin as g, pluginUpdateEndpointUrl as h, finalizeManagedPluginUpdate as i, PluginUpdateInstallStateStore as l, parsePluginUpdateManifest as m, buildTargetInstallArgs as n, rollbackManagedPluginUpdate as o, existingCachedPluginArtifactPath as p, buildTargetRemoveArgs as r, runPluginUpdater as s, assertTargetArtifactIntegrity as t, ARKME_PLUGIN_PACKAGE_NAME as u };