@supacloud/admin 0.15.2 → 0.15.4

package/dist/index.js

@@ -4757,6 +4757,11 @@ var require_utils = __commonJS((exports, module) => {
   };
 });
 
+// node_modules/ssh2/lib/protocol/crypto/build/Release/sshcrypto.node
+var require_sshcrypto = __commonJS((exports, module) => {
+  module.exports = __require("./sshcrypto-vd2k5hq9.node");
+});
+
 // node_modules/ssh2/lib/protocol/crypto/poly1305.js
 var require_poly1305 = __commonJS((exports, module) => {
   var __dirname = "/home/runner/work/supacloud/supacloud/packages/admin/node_modules/ssh2/lib/protocol/crypto", __filename = "/home/runner/work/supacloud/supacloud/packages/admin/node_modules/ssh2/lib/protocol/crypto/poly1305.js";
@@ -5243,7 +5248,7 @@ var require_crypto = __commonJS((exports, module) => {
   var ChaChaPolyDecipher;
   var GenericDecipher;
   try {
-    binding = (()=>{throw new Error("Cannot require module "+"./crypto/build/Release/sshcrypto.node");})();
+    binding = require_sshcrypto();
     ({
       AESGCMCipher,
       ChaChaPolyCipher,
@@ -26376,6 +26381,14 @@ var RELEASE_CHECKSUMS_NAME = "SHA256SUMS";
 var RELEASE_REPOSITORY = "vibeunion/supacloud";
 var RELEASE_SOURCE_REF = "refs/heads/main";
 var RELEASE_SIGNER_WORKFLOW = `${RELEASE_REPOSITORY}/.github/workflows/release-please.yml`;
+var LEGACY_EDGE_RUNTIME_RELEASE_IDENTITY = {
+  repository: "zuohuadong/supacloud",
+  workflow: "zuohuadong/supacloud/.github/workflows/release-please.yml",
+  component: "edge-runtime",
+  version: "0.18.2",
+  tag: "edge-runtime-v0.18.2",
+  sourceCommit: "c6a3a87cf4e41e0f3dafadb018dd0c7d5b99b7d9"
+};
 var MEBIBYTE = 1024 * 1024;
 var RELEASE_BUNDLE_SIZE_LIMITS = {
   manifest: MEBIBYTE,
@@ -26482,6 +26495,16 @@ function parseArtifacts(candidate, component) {
     throw new Error(`Release manifest artifact ${oversized.name} exceeds its size limit`);
   return artifacts;
 }
+function parseIdentity(manifest, source, release) {
+  const current = manifest.repository === RELEASE_REPOSITORY && manifest.workflow === RELEASE_SIGNER_WORKFLOW;
+  const legacyEdgeRuntime = manifest.repository === LEGACY_EDGE_RUNTIME_RELEASE_IDENTITY.repository && manifest.workflow === LEGACY_EDGE_RUNTIME_RELEASE_IDENTITY.workflow && release.component === LEGACY_EDGE_RUNTIME_RELEASE_IDENTITY.component && release.version === LEGACY_EDGE_RUNTIME_RELEASE_IDENTITY.version && release.tag === LEGACY_EDGE_RUNTIME_RELEASE_IDENTITY.tag && source.commit === LEGACY_EDGE_RUNTIME_RELEASE_IDENTITY.sourceCommit;
+  if (!current && !legacyEdgeRuntime)
+    throw new Error("Release manifest identity is invalid");
+  return {
+    repository: manifest.repository,
+    workflow: manifest.workflow
+  };
+}
 function parseReleaseManifest(text, expected) {
   let candidate;
   try {
@@ -26491,15 +26514,16 @@ function parseReleaseManifest(text, expected) {
   }
   const manifest = manifestObject(candidate, "Release manifest");
   assertExactKeys(manifest, ["schemaVersion", "repository", "source", "workflow", "release", "artifacts"], "Release manifest");
-  if (manifest.schemaVersion !== 1 || manifest.repository !== RELEASE_REPOSITORY || manifest.workflow !== RELEASE_SIGNER_WORKFLOW) {
+  if (manifest.schemaVersion !== 1)
     throw new Error("Release manifest identity is invalid");
-  }
+  const source = parseSource(manifest.source);
+  const release = parseRelease(manifest.release, expected);
+  const identity = parseIdentity(manifest, source, release);
   return {
     schemaVersion: 1,
-    repository: RELEASE_REPOSITORY,
-    source: parseSource(manifest.source),
-    workflow: RELEASE_SIGNER_WORKFLOW,
-    release: parseRelease(manifest.release, expected),
+    ...identity,
+    source,
+    release,
     artifacts: parseArtifacts(manifest.artifacts, expected.component)
   };
 }
@@ -26625,6 +26649,7 @@ async function withSigstoreVerificationDirectory(operation) {
 // src/shared/releases/local-upgrade-bundle.ts
 var RELEASES_API = `https://api.github.com/repos/${RELEASE_REPOSITORY}/releases`;
 var ATTESTATIONS_API = `https://api.github.com/repos/${RELEASE_REPOSITORY}/attestations`;
+var GITHUB_CLI_REPOSITORY = "cli/cli";
 var GH_VERSION = "2.96.0";
 var GH_ARCHIVE_SHA256 = {
   amd64: "83d5c2ccad5498f58bf6368acb1ab32588cf43ab3a4b1c301bf36328b1c8bd60",
@@ -26835,6 +26860,36 @@ async function downloadDirect(url, destination, maxBytes) {
   }
   throw new AggregateError(retryFailures, `Unable to download ${parsed.hostname}${parsed.pathname}`);
 }
+async function downloadGithubReleaseAsset(request) {
+  const download = await runGithubCliDownload([
+    "release",
+    "download",
+    request.tag,
+    "--repo",
+    `github.com/${request.repository}`,
+    "--pattern",
+    request.assetName,
+    "--output",
+    "-"
+  ], request.destination, request.maxBytes, DOWNLOAD_TIMEOUT_MS);
+  if (download.exitCode !== 0) {
+    rmSync2(request.destination, { force: true });
+    throw new Error(`GitHub release asset download failed: ${download.stderr.trim().slice(-1000) || download.exitCode}`);
+  }
+  assertDownloadedReleaseAsset(request);
+}
+function assertDownloadedReleaseAsset(request) {
+  const stats = lstatSync(request.destination);
+  if (!stats.isFile() || stats.isSymbolicLink() || stats.nlink !== 1) {
+    rmSync2(request.destination, { force: true });
+    throw new Error("GitHub release asset must be a direct regular file");
+  }
+  if (stats.size > request.maxBytes) {
+    rmSync2(request.destination, { force: true });
+    throw new Error(`GitHub release asset exceeded ${request.maxBytes} bytes`);
+  }
+  chmodSync2(request.destination, 384);
+}
 function parseJsonFile(filePath, label) {
   const contents = readFileSync3(filePath, "utf8");
   try {
@@ -26906,7 +26961,7 @@ function serializeAttestationBundles(candidate) {
 function directEnvironment() {
   const environment = { ...process.env };
   for (const key of Object.keys(environment)) {
-    if (/(?:^|_)proxy$/i.test(key) || /^(?:SUPACLOUD_GITHUB_PROXIES|NODE_USE_ENV_PROXY)$/.test(key)) {
+    if (/(?:^|_)proxy$/i.test(key) || /^(?:GH_HOST|GH_REPO|SUPACLOUD_GITHUB_PROXIES|NODE_USE_ENV_PROXY)$/.test(key)) {
       delete environment[key];
     }
   }
@@ -26931,15 +26986,15 @@ function githubCliExecutable(environment) {
   }
   throw new Error("GitHub CLI executable was not found in PATH");
 }
-async function runGithubCli(arguments_, timeoutMs) {
-  return await new Promise((resolve2, reject) => {
-    const environment = directEnvironment();
-    const child = spawn(githubCliExecutable(environment), arguments_, {
-      env: environment,
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    let stdout = "";
-    let stderr = "";
+function spawnGithubCli(arguments_) {
+  const environment = directEnvironment();
+  return spawn(githubCliExecutable(environment), arguments_, {
+    env: environment,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+}
+function githubCliExitCode(child, timeoutMs) {
+  return new Promise((resolve2, reject) => {
     let timedOut = false;
     let settled = false;
     let forceKillTimer;
@@ -26958,18 +27013,46 @@ async function runGithubCli(arguments_, timeoutMs) {
       if (error)
         reject(error);
       else
-        resolve2({ exitCode: timedOut ? 124 : exitCode, stdout, stderr });
+        resolve2(timedOut ? 124 : exitCode);
     };
-    child.stdout.on("data", (chunk) => {
-      stdout = `${stdout}${chunk.toString()}`.slice(-8000);
-    });
-    child.stderr.on("data", (chunk) => {
-      stderr = `${stderr}${chunk.toString()}`.slice(-8000);
-    });
     child.once("error", (error) => settleExecution(error, 127));
     child.once("close", (code) => settleExecution(undefined, code ?? 1));
   });
 }
+async function runGithubCli(arguments_, timeoutMs) {
+  const child = spawnGithubCli(arguments_);
+  let stdout = "";
+  let stderr = "";
+  child.stdout.on("data", (chunk) => {
+    stdout = `${stdout}${chunk.toString()}`.slice(-8000);
+  });
+  child.stderr.on("data", (chunk) => {
+    stderr = `${stderr}${chunk.toString()}`.slice(-8000);
+  });
+  const exitCode = await githubCliExitCode(child, timeoutMs);
+  return { exitCode, stdout, stderr };
+}
+async function runGithubCliDownload(arguments_, destination, maxBytes, timeoutMs) {
+  const child = spawnGithubCli(arguments_);
+  let stderr = "";
+  child.stderr.on("data", (chunk) => {
+    stderr = `${stderr}${chunk.toString()}`.slice(-8000);
+  });
+  const write = pipeline(child.stdout, boundedWriter(maxBytes), createWriteStream(destination, { flags: "wx", mode: 384 })).catch((error) => {
+    child.kill("SIGKILL");
+    throw error;
+  });
+  const [writeState, exitState] = await Promise.allSettled([write, githubCliExitCode(child, timeoutMs)]);
+  if (writeState.status === "rejected") {
+    rmSync2(destination, { force: true });
+    throw writeState.reason;
+  }
+  if (exitState.status === "rejected") {
+    rmSync2(destination, { force: true });
+    throw exitState.reason;
+  }
+  return { exitCode: exitState.value, stdout: "", stderr };
+}
 function supportsStrictGithubVerification(execution) {
   const tokens = `${execution.stdout}
 ${execution.stderr}`.split(/\s+/);
@@ -26989,11 +27072,11 @@ function githubAttestationVerificationArguments(request) {
     "--bundle",
     request.bundlePath,
     "--repo",
-    RELEASE_REPOSITORY,
+    request.manifest.repository,
     "--signer-workflow",
-    RELEASE_SIGNER_WORKFLOW,
+    request.manifest.workflow,
     "--source-ref",
-    RELEASE_SOURCE_REF,
+    request.manifest.source.ref,
     "--source-digest",
     request.manifest.source.commit,
     "--deny-self-hosted-runners",
@@ -27036,10 +27119,30 @@ async function downloadReleaseMetadata(component, version, directory) {
     rmSync2(metadataPath, { force: true });
   }
 }
-async function downloadManifestAttestation(manifestPath, destination) {
+function manifestAttestationDownloadUrl(release, manifest, manifestDigest) {
+  if (manifest.repository === RELEASE_REPOSITORY) {
+    return `${ATTESTATIONS_API}/sha256:${manifestDigest}`;
+  }
+  if (manifest.repository === LEGACY_EDGE_RUNTIME_RELEASE_IDENTITY.repository) {
+    return releaseAssetUrl(release, RELEASE_ATTESTATION_NAME);
+  }
+  throw new Error("Release manifest repository is not supported");
+}
+async function downloadManifestAttestation(request) {
+  const { release, manifest, manifestPath, destination } = request;
+  if (manifest.repository !== RELEASE_REPOSITORY) {
+    await downloadGithubReleaseAsset({
+      repository: RELEASE_REPOSITORY,
+      tag: release.tag_name,
+      assetName: RELEASE_ATTESTATION_NAME,
+      destination,
+      maxBytes: RELEASE_BUNDLE_SIZE_LIMITS.attestation
+    });
+    return;
+  }
   const responsePath = `${destination}.response`;
   try {
-    await downloadDirect(`${ATTESTATIONS_API}/sha256:${sha256File(manifestPath)}`, responsePath, RELEASE_BUNDLE_SIZE_LIMITS.attestation);
+    await downloadDirect(manifestAttestationDownloadUrl(release, manifest, sha256File(manifestPath)), responsePath, RELEASE_BUNDLE_SIZE_LIMITS.attestation);
     const bundles = serializeAttestationBundles(parseJsonFile(responsePath, "GitHub attestation response"));
     writeFileSync2(destination, bundles, { mode: 384, flag: "wx" });
     chmodSync2(destination, 384);
@@ -27051,9 +27154,16 @@ async function downloadComponent(request) {
   const release = await downloadReleaseMetadata(request.component, request.version, request.destination);
   const manifestPath = directChildPath(request.destination, RELEASE_MANIFEST_NAME);
   const attestationPath = directChildPath(request.destination, RELEASE_ATTESTATION_NAME);
-  await downloadDirect(releaseAssetUrl(release, RELEASE_MANIFEST_NAME), manifestPath, RELEASE_BUNDLE_SIZE_LIMITS.manifest);
+  releaseAssetUrl(release, RELEASE_MANIFEST_NAME);
+  await downloadGithubReleaseAsset({
+    repository: RELEASE_REPOSITORY,
+    tag: release.tag_name,
+    assetName: RELEASE_MANIFEST_NAME,
+    destination: manifestPath,
+    maxBytes: RELEASE_BUNDLE_SIZE_LIMITS.manifest
+  });
   const manifest = parseReleaseManifest(readFileSync3(manifestPath, "utf8"), request);
-  await downloadManifestAttestation(manifestPath, attestationPath);
+  await downloadManifestAttestation({ release, manifest, manifestPath, destination: attestationPath });
   await verifyManifestAttestation({
     artifactPath: manifestPath,
     bundlePath: attestationPath,
@@ -27061,12 +27171,26 @@ async function downloadComponent(request) {
     trustedRootPath: request.trustedRootPath
   });
   const checksumsPath = directChildPath(request.destination, RELEASE_CHECKSUMS_NAME);
-  await downloadDirect(releaseAssetUrl(release, RELEASE_CHECKSUMS_NAME), checksumsPath, RELEASE_BUNDLE_SIZE_LIMITS.checksums);
+  releaseAssetUrl(release, RELEASE_CHECKSUMS_NAME);
+  await downloadGithubReleaseAsset({
+    repository: RELEASE_REPOSITORY,
+    tag: release.tag_name,
+    assetName: RELEASE_CHECKSUMS_NAME,
+    destination: checksumsPath,
+    maxBytes: RELEASE_BUNDLE_SIZE_LIMITS.checksums
+  });
   assertSignedArtifact(checksumsPath, manifest);
   const checksums = parseReleaseChecksums(readFileSync3(checksumsPath, "utf8"), manifest);
   for (const assetName of request.assetNames) {
     const assetPath = directChildPath(request.destination, assetName);
-    await downloadDirect(releaseAssetUrl(release, assetName), assetPath, releaseAssetSizeLimit(request.component, assetName));
+    releaseAssetUrl(release, assetName);
+    await downloadGithubReleaseAsset({
+      repository: RELEASE_REPOSITORY,
+      tag: release.tag_name,
+      assetName,
+      destination: assetPath,
+      maxBytes: releaseAssetSizeLimit(request.component, assetName)
+    });
     verifyDownloadedFile(assetPath, manifest, checksums);
   }
   return [RELEASE_MANIFEST_NAME, RELEASE_ATTESTATION_NAME, RELEASE_CHECKSUMS_NAME, ...request.assetNames].map((name) => localUpgradeFile(directChildPath(request.destination, name), `bundle/${request.component}/${name}`));
@@ -27074,8 +27198,13 @@ async function downloadComponent(request) {
 async function downloadPinnedGithubCli(directory, architecture) {
   const identity = githubCliArchiveIdentity(architecture);
   const archivePath = directChildPath(directory, identity.archiveName);
-  const url = `https://github.com/cli/cli/releases/download/v${identity.version}/${identity.archiveName}`;
-  await downloadDirect(url, archivePath, MAX_GH_ARCHIVE_BYTES);
+  await downloadGithubReleaseAsset({
+    repository: GITHUB_CLI_REPOSITORY,
+    tag: `v${identity.version}`,
+    assetName: identity.archiveName,
+    destination: archivePath,
+    maxBytes: MAX_GH_ARCHIVE_BYTES
+  });
   if (sha256File(archivePath) !== identity.sha256) {
     throw new Error("Pinned GitHub CLI archive SHA256 mismatch");
   }
@@ -32116,7 +32245,7 @@ Actions: list_releases, get_release, upload_release, activate_release`, {
 // package.json
 var package_default = {
   name: "@supacloud/admin",
-  version: "0.15.2",
+  version: "0.15.4",
   description: "Platform administration CLI for SupaCloud operators",
   type: "module",
   main: "./dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/admin",
-  "version": "0.15.2",
+  "version": "0.15.4",
   "description": "Platform administration CLI for SupaCloud operators",
   "type": "module",
   "main": "./dist/index.js",