@supacloud/admin 0.15.3 → 0.15.4

package/dist/index.js

@@ -26367,7 +26367,7 @@ function quoteShell(shellText) {
 // src/shared/releases/local-upgrade-bundle.ts
 import { spawn } from "node:child_process";
 import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
-import { accessSync, chmodSync as chmodSync2, constants as fsConstants, createWriteStream, lstatSync, mkdirSync, mkdtempSync as mkdtempSync2, readFileSync as readFileSync3, readdirSync, renameSync, rmSync as rmSync2, statSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { accessSync, chmodSync as chmodSync2, constants as fsConstants, createWriteStream, lstatSync, mkdirSync, mkdtempSync as mkdtempSync2, readFileSync as readFileSync3, readdirSync, rmSync as rmSync2, statSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { get } from "node:https";
 import { tmpdir as tmpdir2 } from "node:os";
 import { basename, delimiter, join } from "node:path";
@@ -26649,6 +26649,7 @@ async function withSigstoreVerificationDirectory(operation) {
 // src/shared/releases/local-upgrade-bundle.ts
 var RELEASES_API = `https://api.github.com/repos/${RELEASE_REPOSITORY}/releases`;
 var ATTESTATIONS_API = `https://api.github.com/repos/${RELEASE_REPOSITORY}/attestations`;
+var GITHUB_CLI_REPOSITORY = "cli/cli";
 var GH_VERSION = "2.96.0";
 var GH_ARCHIVE_SHA256 = {
   amd64: "83d5c2ccad5498f58bf6368acb1ab32588cf43ab3a4b1c301bf36328b1c8bd60",
@@ -26859,6 +26860,36 @@ async function downloadDirect(url, destination, maxBytes) {
   }
   throw new AggregateError(retryFailures, `Unable to download ${parsed.hostname}${parsed.pathname}`);
 }
+async function downloadGithubReleaseAsset(request) {
+  const download = await runGithubCliDownload([
+    "release",
+    "download",
+    request.tag,
+    "--repo",
+    `github.com/${request.repository}`,
+    "--pattern",
+    request.assetName,
+    "--output",
+    "-"
+  ], request.destination, request.maxBytes, DOWNLOAD_TIMEOUT_MS);
+  if (download.exitCode !== 0) {
+    rmSync2(request.destination, { force: true });
+    throw new Error(`GitHub release asset download failed: ${download.stderr.trim().slice(-1000) || download.exitCode}`);
+  }
+  assertDownloadedReleaseAsset(request);
+}
+function assertDownloadedReleaseAsset(request) {
+  const stats = lstatSync(request.destination);
+  if (!stats.isFile() || stats.isSymbolicLink() || stats.nlink !== 1) {
+    rmSync2(request.destination, { force: true });
+    throw new Error("GitHub release asset must be a direct regular file");
+  }
+  if (stats.size > request.maxBytes) {
+    rmSync2(request.destination, { force: true });
+    throw new Error(`GitHub release asset exceeded ${request.maxBytes} bytes`);
+  }
+  chmodSync2(request.destination, 384);
+}
 function parseJsonFile(filePath, label) {
   const contents = readFileSync3(filePath, "utf8");
   try {
@@ -26930,7 +26961,7 @@ function serializeAttestationBundles(candidate) {
 function directEnvironment() {
   const environment = { ...process.env };
   for (const key of Object.keys(environment)) {
-    if (/(?:^|_)proxy$/i.test(key) || /^(?:SUPACLOUD_GITHUB_PROXIES|NODE_USE_ENV_PROXY)$/.test(key)) {
+    if (/(?:^|_)proxy$/i.test(key) || /^(?:GH_HOST|GH_REPO|SUPACLOUD_GITHUB_PROXIES|NODE_USE_ENV_PROXY)$/.test(key)) {
       delete environment[key];
     }
   }
@@ -26955,15 +26986,15 @@ function githubCliExecutable(environment) {
   }
   throw new Error("GitHub CLI executable was not found in PATH");
 }
-async function runGithubCli(arguments_, timeoutMs) {
-  return await new Promise((resolve2, reject) => {
-    const environment = directEnvironment();
-    const child = spawn(githubCliExecutable(environment), arguments_, {
-      env: environment,
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    let stdout = "";
-    let stderr = "";
+function spawnGithubCli(arguments_) {
+  const environment = directEnvironment();
+  return spawn(githubCliExecutable(environment), arguments_, {
+    env: environment,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+}
+function githubCliExitCode(child, timeoutMs) {
+  return new Promise((resolve2, reject) => {
     let timedOut = false;
     let settled = false;
     let forceKillTimer;
@@ -26982,18 +27013,46 @@ async function runGithubCli(arguments_, timeoutMs) {
       if (error)
         reject(error);
       else
-        resolve2({ exitCode: timedOut ? 124 : exitCode, stdout, stderr });
+        resolve2(timedOut ? 124 : exitCode);
     };
-    child.stdout.on("data", (chunk) => {
-      stdout = `${stdout}${chunk.toString()}`.slice(-8000);
-    });
-    child.stderr.on("data", (chunk) => {
-      stderr = `${stderr}${chunk.toString()}`.slice(-8000);
-    });
     child.once("error", (error) => settleExecution(error, 127));
     child.once("close", (code) => settleExecution(undefined, code ?? 1));
   });
 }
+async function runGithubCli(arguments_, timeoutMs) {
+  const child = spawnGithubCli(arguments_);
+  let stdout = "";
+  let stderr = "";
+  child.stdout.on("data", (chunk) => {
+    stdout = `${stdout}${chunk.toString()}`.slice(-8000);
+  });
+  child.stderr.on("data", (chunk) => {
+    stderr = `${stderr}${chunk.toString()}`.slice(-8000);
+  });
+  const exitCode = await githubCliExitCode(child, timeoutMs);
+  return { exitCode, stdout, stderr };
+}
+async function runGithubCliDownload(arguments_, destination, maxBytes, timeoutMs) {
+  const child = spawnGithubCli(arguments_);
+  let stderr = "";
+  child.stderr.on("data", (chunk) => {
+    stderr = `${stderr}${chunk.toString()}`.slice(-8000);
+  });
+  const write = pipeline(child.stdout, boundedWriter(maxBytes), createWriteStream(destination, { flags: "wx", mode: 384 })).catch((error) => {
+    child.kill("SIGKILL");
+    throw error;
+  });
+  const [writeState, exitState] = await Promise.allSettled([write, githubCliExitCode(child, timeoutMs)]);
+  if (writeState.status === "rejected") {
+    rmSync2(destination, { force: true });
+    throw writeState.reason;
+  }
+  if (exitState.status === "rejected") {
+    rmSync2(destination, { force: true });
+    throw exitState.reason;
+  }
+  return { exitCode: exitState.value, stdout: "", stderr };
+}
 function supportsStrictGithubVerification(execution) {
   const tokens = `${execution.stdout}
 ${execution.stderr}`.split(/\s+/);
@@ -27071,16 +27130,22 @@ function manifestAttestationDownloadUrl(release, manifest, manifestDigest) {
 }
 async function downloadManifestAttestation(request) {
   const { release, manifest, manifestPath, destination } = request;
+  if (manifest.repository !== RELEASE_REPOSITORY) {
+    await downloadGithubReleaseAsset({
+      repository: RELEASE_REPOSITORY,
+      tag: release.tag_name,
+      assetName: RELEASE_ATTESTATION_NAME,
+      destination,
+      maxBytes: RELEASE_BUNDLE_SIZE_LIMITS.attestation
+    });
+    return;
+  }
   const responsePath = `${destination}.response`;
   try {
     await downloadDirect(manifestAttestationDownloadUrl(release, manifest, sha256File(manifestPath)), responsePath, RELEASE_BUNDLE_SIZE_LIMITS.attestation);
-    if (manifest.repository === RELEASE_REPOSITORY) {
-      const bundles = serializeAttestationBundles(parseJsonFile(responsePath, "GitHub attestation response"));
-      writeFileSync2(destination, bundles, { mode: 384, flag: "wx" });
-      chmodSync2(destination, 384);
-    } else {
-      renameSync(responsePath, destination);
-    }
+    const bundles = serializeAttestationBundles(parseJsonFile(responsePath, "GitHub attestation response"));
+    writeFileSync2(destination, bundles, { mode: 384, flag: "wx" });
+    chmodSync2(destination, 384);
   } finally {
     rmSync2(responsePath, { force: true });
   }
@@ -27089,7 +27154,14 @@ async function downloadComponent(request) {
   const release = await downloadReleaseMetadata(request.component, request.version, request.destination);
   const manifestPath = directChildPath(request.destination, RELEASE_MANIFEST_NAME);
   const attestationPath = directChildPath(request.destination, RELEASE_ATTESTATION_NAME);
-  await downloadDirect(releaseAssetUrl(release, RELEASE_MANIFEST_NAME), manifestPath, RELEASE_BUNDLE_SIZE_LIMITS.manifest);
+  releaseAssetUrl(release, RELEASE_MANIFEST_NAME);
+  await downloadGithubReleaseAsset({
+    repository: RELEASE_REPOSITORY,
+    tag: release.tag_name,
+    assetName: RELEASE_MANIFEST_NAME,
+    destination: manifestPath,
+    maxBytes: RELEASE_BUNDLE_SIZE_LIMITS.manifest
+  });
   const manifest = parseReleaseManifest(readFileSync3(manifestPath, "utf8"), request);
   await downloadManifestAttestation({ release, manifest, manifestPath, destination: attestationPath });
   await verifyManifestAttestation({
@@ -27099,12 +27171,26 @@ async function downloadComponent(request) {
     trustedRootPath: request.trustedRootPath
   });
   const checksumsPath = directChildPath(request.destination, RELEASE_CHECKSUMS_NAME);
-  await downloadDirect(releaseAssetUrl(release, RELEASE_CHECKSUMS_NAME), checksumsPath, RELEASE_BUNDLE_SIZE_LIMITS.checksums);
+  releaseAssetUrl(release, RELEASE_CHECKSUMS_NAME);
+  await downloadGithubReleaseAsset({
+    repository: RELEASE_REPOSITORY,
+    tag: release.tag_name,
+    assetName: RELEASE_CHECKSUMS_NAME,
+    destination: checksumsPath,
+    maxBytes: RELEASE_BUNDLE_SIZE_LIMITS.checksums
+  });
   assertSignedArtifact(checksumsPath, manifest);
   const checksums = parseReleaseChecksums(readFileSync3(checksumsPath, "utf8"), manifest);
   for (const assetName of request.assetNames) {
     const assetPath = directChildPath(request.destination, assetName);
-    await downloadDirect(releaseAssetUrl(release, assetName), assetPath, releaseAssetSizeLimit(request.component, assetName));
+    releaseAssetUrl(release, assetName);
+    await downloadGithubReleaseAsset({
+      repository: RELEASE_REPOSITORY,
+      tag: release.tag_name,
+      assetName,
+      destination: assetPath,
+      maxBytes: releaseAssetSizeLimit(request.component, assetName)
+    });
     verifyDownloadedFile(assetPath, manifest, checksums);
   }
   return [RELEASE_MANIFEST_NAME, RELEASE_ATTESTATION_NAME, RELEASE_CHECKSUMS_NAME, ...request.assetNames].map((name) => localUpgradeFile(directChildPath(request.destination, name), `bundle/${request.component}/${name}`));
@@ -27112,8 +27198,13 @@ async function downloadComponent(request) {
 async function downloadPinnedGithubCli(directory, architecture) {
   const identity = githubCliArchiveIdentity(architecture);
   const archivePath = directChildPath(directory, identity.archiveName);
-  const url = `https://github.com/cli/cli/releases/download/v${identity.version}/${identity.archiveName}`;
-  await downloadDirect(url, archivePath, MAX_GH_ARCHIVE_BYTES);
+  await downloadGithubReleaseAsset({
+    repository: GITHUB_CLI_REPOSITORY,
+    tag: `v${identity.version}`,
+    assetName: identity.archiveName,
+    destination: archivePath,
+    maxBytes: MAX_GH_ARCHIVE_BYTES
+  });
   if (sha256File(archivePath) !== identity.sha256) {
     throw new Error("Pinned GitHub CLI archive SHA256 mismatch");
   }
@@ -32154,7 +32245,7 @@ Actions: list_releases, get_release, upload_release, activate_release`, {
 // package.json
 var package_default = {
   name: "@supacloud/admin",
-  version: "0.15.3",
+  version: "0.15.4",
   description: "Platform administration CLI for SupaCloud operators",
   type: "module",
   main: "./dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/admin",
-  "version": "0.15.3",
+  "version": "0.15.4",
   "description": "Platform administration CLI for SupaCloud operators",
   "type": "module",
   "main": "./dist/index.js",