@synopackageland/cli 0.1.0

package/dist/build-spk/native-payload.js

@@ -0,0 +1,654 @@
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { chmodSync, closeSync, copyFileSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readlinkSync, readdirSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync, } from "node:fs";
+import { dirname, join, posix, resolve } from "node:path";
+import { inflateRawSync } from "node:zlib";
+import * as tar from "tar";
+import { collectArchiveEntries, createReproducibleTar } from "./reproducible-archive.js";
+class NativePayloadError extends Error {
+    code;
+    constructor(code, message) {
+        super(`${code}: ${message}`);
+        this.name = "NativePayloadError";
+        this.code = code;
+    }
+}
+export function archiveKindFor(nameOrUrl) {
+    const pathname = nameOrUrlForSuffix(nameOrUrl).toLowerCase();
+    if (pathname.endsWith(".tar.gz")) {
+        return "tar.gz";
+    }
+    if (pathname.endsWith(".tar.xz")) {
+        return "tar.xz";
+    }
+    if (pathname.endsWith(".zip")) {
+        return "zip";
+    }
+    return "raw";
+}
+export async function buildNativePayload(options) {
+    const stripComponents = readStripComponents(options.source.strip_components);
+    const outputPath = resolve(options.outputTgz);
+    const outputParent = dirname(outputPath);
+    mkdirSync(outputParent, { recursive: true });
+    rmSync(outputPath, { force: true });
+    const workDir = mkdtempSync(join(outputParent, ".syno-native-payload-"));
+    let committed = false;
+    try {
+        const sourceName = options.source.path ?? options.source.url;
+        if (sourceName === undefined) {
+            throw new NativePayloadError("NATIVE_PAYLOAD_SOURCE_REQUIRED", "source.path or source.url is required");
+        }
+        const kind = archiveKindFor(sourceName);
+        const sourceBytes = await readSourceBytes(options);
+        const sourceSha256 = digestBytes(sourceBytes);
+        if (options.source.sha256 !== undefined &&
+            options.source.sha256.trim().toLowerCase() !== sourceSha256) {
+            throw new NativePayloadError("NATIVE_PAYLOAD_SHA256_MISMATCH", `expected ${options.source.sha256}, got ${sourceSha256}`);
+        }
+        const sourcePath = join(workDir, "source.archive");
+        writeFileSync(sourcePath, sourceBytes, { mode: 0o600 });
+        // The payload root IS SYNOPKG_PKGDEST (/var/packages/<pkg>/target): DSM
+        // extracts package.tgz straight into it. Nesting a literal `target/`
+        // directory here would put the binary at $SYNOPKG_PKGDEST/target/<exec>.
+        // Same layout the Broker SPK ships (packages/broker/src/spk/build.ts).
+        const targetDir = join(workDir, "package");
+        mkdirSync(targetDir, { recursive: true, mode: 0o755 });
+        chmodSync(targetDir, 0o755);
+        if (kind === "raw") {
+            materializeRaw(sourceBytes, targetDir, rawSourceName(sourceName));
+        }
+        else if (kind === "zip") {
+            const rawDir = join(workDir, "zip-tree");
+            mkdirSync(rawDir, { mode: 0o755 });
+            const entries = parseZipEntries(sourceBytes, stripComponents);
+            materializeZipEntries(entries, rawDir);
+            copyStrippedTree(rawDir, targetDir, stripComponents);
+        }
+        else {
+            const tarPath = kind === "tar.xz" ? decompressXz(sourcePath, join(workDir, "source.tar")) : sourcePath;
+            const descriptors = await inspectTarEntries(tarPath, stripComponents);
+            const rawDir = join(workDir, "tar-tree");
+            mkdirSync(rawDir, { mode: 0o755 });
+            await tar.x({
+                file: tarPath,
+                cwd: rawDir,
+                strict: true,
+                preservePaths: false,
+                unlink: true,
+                preserveOwner: false,
+            });
+            validateExtractedTarTree(rawDir, descriptors, stripComponents);
+            copyStrippedTree(rawDir, targetDir, stripComponents);
+        }
+        const entries = collectArchiveEntries(targetDir);
+        const temporaryOutput = join(workDir, "package.tgz");
+        await createReproducibleTar(targetDir, temporaryOutput, { gzip: true });
+        const packageSha256 = digestFile(temporaryOutput);
+        renameSync(temporaryOutput, outputPath);
+        committed = true;
+        return {
+            outputTgz: options.outputTgz,
+            sha256: packageSha256,
+            sourceSha256,
+            entries,
+        };
+    }
+    finally {
+        rmSync(workDir, { recursive: true, force: true });
+        if (!committed) {
+            rmSync(outputPath, { force: true });
+        }
+    }
+}
+async function readSourceBytes(options) {
+    if (options.source.path !== undefined && options.source.url !== undefined) {
+        throw new NativePayloadError("NATIVE_PAYLOAD_SOURCE_AMBIGUOUS", "source.path and source.url cannot both be set");
+    }
+    if (options.source.path !== undefined) {
+        return readFileSync(resolve(options.projectRoot, options.source.path));
+    }
+    if (options.source.url === undefined) {
+        throw new NativePayloadError("NATIVE_PAYLOAD_SOURCE_REQUIRED", "source.path or source.url is required");
+    }
+    const download = options.download ?? defaultDownload;
+    const bytes = await download(options.source.url);
+    if (!Buffer.isBuffer(bytes)) {
+        throw new NativePayloadError("NATIVE_PAYLOAD_DOWNLOAD_INVALID", "download must return a Buffer");
+    }
+    return bytes;
+}
+async function defaultDownload(url) {
+    const response = await fetch(url);
+    if (!response.ok) {
+        throw new NativePayloadError("NATIVE_PAYLOAD_DOWNLOAD_FAILED", `HTTP ${response.status} while downloading ${url}`);
+    }
+    return Buffer.from(await response.arrayBuffer());
+}
+function readStripComponents(value) {
+    const stripComponents = value ?? 0;
+    if (!Number.isInteger(stripComponents) || stripComponents < 0) {
+        throw new NativePayloadError("NATIVE_PAYLOAD_INVALID_STRIP_COMPONENTS", "strip_components must be a non-negative integer");
+    }
+    return stripComponents;
+}
+function nameOrUrlForSuffix(nameOrUrl) {
+    try {
+        const parsed = new URL(nameOrUrl);
+        return decodeURIComponent(parsed.pathname);
+    }
+    catch {
+        return nameOrUrl.split(/[?#]/u, 1)[0];
+    }
+}
+function rawSourceName(nameOrUrl) {
+    const candidate = posix.basename(nameOrUrlForSuffix(nameOrUrl));
+    if (candidate === "" || candidate === "." || candidate === ".." || candidate.includes("\0")) {
+        return "native-binary";
+    }
+    return candidate;
+}
+function digestBytes(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+function digestFile(path) {
+    return digestBytes(readFileSync(path));
+}
+function normalizeArchivePath(pathValue) {
+    if (pathValue.length === 0) {
+        return "";
+    }
+    if (pathValue.includes("\0") ||
+        pathValue.startsWith("/") ||
+        pathValue.startsWith("\\") ||
+        /^[A-Za-z]:[\\/]/u.test(pathValue)) {
+        throw new NativePayloadError("NATIVE_PAYLOAD_UNSAFE_PATH", `archive entry is absolute: ${pathValue}`);
+    }
+    const normalized = posix.normalize(pathValue).replace(/^\.\//u, "");
+    if (normalized === "." || normalized === "") {
+        return "";
+    }
+    if (normalized === ".." || normalized.startsWith("../")) {
+        throw new NativePayloadError("NATIVE_PAYLOAD_UNSAFE_PATH", `archive entry escapes its root: ${pathValue}`);
+    }
+    return normalized;
+}
+function stripArchivePath(pathValue, stripComponents) {
+    const normalized = normalizeArchivePath(pathValue);
+    if (normalized === "") {
+        return undefined;
+    }
+    const parts = normalized.split("/");
+    if (parts.length <= stripComponents) {
+        return undefined;
+    }
+    return parts.slice(stripComponents).join("/");
+}
+async function inspectTarEntries(archivePath, stripComponents) {
+    const descriptors = [];
+    let validationError;
+    await tar.t({
+        file: archivePath,
+        strict: true,
+        onReadEntry: (entry) => {
+            if (validationError !== undefined) {
+                return;
+            }
+            try {
+                const rawPath = normalizeArchivePath(entry.path);
+                const outputPath = stripArchivePath(rawPath, stripComponents);
+                if (outputPath === undefined) {
+                    return;
+                }
+                descriptors.push({
+                    rawPath,
+                    outputPath,
+                    kind: tarEntryKind(entry.type),
+                    mode: entry.mode ?? 0o644,
+                    linkpath: entry.linkpath,
+                });
+            }
+            catch (error) {
+                validationError = error;
+            }
+        },
+    });
+    if (validationError !== undefined) {
+        throw validationError;
+    }
+    validateArchiveDescriptors(descriptors, stripComponents);
+    return descriptors;
+}
+function tarEntryKind(type) {
+    if (type === "File" || type === "OldFile") {
+        return "file";
+    }
+    if (type === "Directory") {
+        return "directory";
+    }
+    if (type === "SymbolicLink") {
+        return "symlink";
+    }
+    if (type === "Link") {
+        return "hardlink";
+    }
+    throw new NativePayloadError("NATIVE_PAYLOAD_UNSUPPORTED_ENTRY", `unsupported tar entry type: ${type}`);
+}
+function validateArchiveDescriptors(descriptors, stripComponents) {
+    const byOutputPath = new Map();
+    const symlinks = new Map();
+    for (const descriptor of descriptors) {
+        const outputPath = descriptor.outputPath;
+        if (outputPath === undefined) {
+            continue;
+        }
+        const previous = byOutputPath.get(outputPath);
+        if (previous !== undefined) {
+            if (previous.kind === "directory" && descriptor.kind === "directory") {
+                continue;
+            }
+            throw new NativePayloadError("NATIVE_PAYLOAD_DUPLICATE_ENTRY", `multiple archive entries map to ${outputPath}`);
+        }
+        byOutputPath.set(outputPath, descriptor);
+        if (descriptor.kind === "symlink") {
+            if (descriptor.linkpath === undefined) {
+                throw new NativePayloadError("NATIVE_PAYLOAD_INVALID_SYMLINK", `symlink ${descriptor.rawPath} has no target`);
+            }
+            symlinks.set(outputPath, descriptor.linkpath);
+        }
+    }
+    for (const descriptor of descriptors) {
+        const outputPath = descriptor.outputPath;
+        if (outputPath === undefined) {
+            continue;
+        }
+        assertOutputParentsAreRealEntries(outputPath, byOutputPath);
+        if (descriptor.kind === "symlink") {
+            resolveSymlinkTarget(outputPath, symlinks, new Set());
+        }
+        else if (descriptor.kind === "hardlink") {
+            const linkpath = descriptor.linkpath;
+            if (linkpath === undefined) {
+                throw new NativePayloadError("NATIVE_PAYLOAD_INVALID_HARDLINK", `hardlink ${descriptor.rawPath} has no target`);
+            }
+            const targetRawPath = normalizeArchivePath(linkpath);
+            const targetOutputPath = stripArchivePath(targetRawPath, stripComponents);
+            if (targetOutputPath === undefined) {
+                throw new NativePayloadError("NATIVE_PAYLOAD_UNSAFE_HARDLINK", `hardlink ${descriptor.rawPath} targets a stripped entry`);
+            }
+            if (targetOutputPath === outputPath) {
+                throw new NativePayloadError("NATIVE_PAYLOAD_INVALID_HARDLINK", `hardlink ${descriptor.rawPath} targets itself`);
+            }
+            assertNoSymlinkPathComponent(targetOutputPath, symlinks);
+        }
+    }
+}
+function assertOutputParentsAreRealEntries(outputPath, byOutputPath) {
+    const parts = outputPath.split("/");
+    for (let index = 1; index < parts.length; index += 1) {
+        const parent = parts.slice(0, index).join("/");
+        const entry = byOutputPath.get(parent);
+        if (entry !== undefined && entry.kind !== "directory") {
+            throw new NativePayloadError("NATIVE_PAYLOAD_UNSAFE_PATH", `archive entry ${outputPath} traverses ${entry.kind} ${parent}`);
+        }
+    }
+}
+function resolveSymlinkTarget(pathValue, symlinks, visiting) {
+    const linkpath = symlinks.get(pathValue);
+    if (linkpath === undefined) {
+        return pathValue;
+    }
+    if (linkpath.length === 0 || posix.isAbsolute(linkpath) || /^[A-Za-z]:[\\/]/u.test(linkpath)) {
+        throw new NativePayloadError("NATIVE_PAYLOAD_UNSAFE_SYMLINK", `symlink ${pathValue} points outside target: ${linkpath}`);
+    }
+    if (visiting.has(pathValue)) {
+        throw new NativePayloadError("NATIVE_PAYLOAD_SYMLINK_CYCLE", `symlink cycle includes ${pathValue}`);
+    }
+    const target = normalizePayloadTarget(posix.dirname(pathValue), linkpath, pathValue);
+    assertNoSymlinkPathComponent(target, symlinks);
+    visiting.add(pathValue);
+    const resolved = symlinks.has(target)
+        ? resolveSymlinkTarget(target, symlinks, visiting)
+        : target;
+    visiting.delete(pathValue);
+    return resolved;
+}
+function normalizePayloadTarget(parent, linkpath, sourcePath) {
+    const target = posix.normalize(posix.join(parent, linkpath));
+    if (target === ".." || target.startsWith("../") || posix.isAbsolute(target)) {
+        throw new NativePayloadError("NATIVE_PAYLOAD_UNSAFE_SYMLINK", `symlink ${sourcePath} points outside target: ${linkpath}`);
+    }
+    return target === "." ? "" : target;
+}
+function assertNoSymlinkPathComponent(pathValue, symlinks) {
+    const parts = pathValue === "" ? [] : pathValue.split("/");
+    for (let index = 1; index < parts.length; index += 1) {
+        const parent = parts.slice(0, index).join("/");
+        if (symlinks.has(parent)) {
+            throw new NativePayloadError("NATIVE_PAYLOAD_UNSAFE_SYMLINK", `path ${pathValue} traverses symlink ${parent}`);
+        }
+    }
+}
+function decompressXz(inputPath, outputPath) {
+    let outputFd;
+    try {
+        outputFd = openSync(outputPath, "w", 0o600);
+        execFileSync("xz", ["--decompress", "--stdout", inputPath], {
+            stdio: ["ignore", outputFd, "pipe"],
+        });
+        return outputPath;
+    }
+    catch (error) {
+        const code = error instanceof Error && "code" in error ? error.code : undefined;
+        if (code === "ENOENT") {
+            throw new NativePayloadError("NATIVE_PAYLOAD_XZ_UNAVAILABLE", "the xz executable is required to read .tar.xz sources");
+        }
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new NativePayloadError("NATIVE_PAYLOAD_XZ_FAILED", detail);
+    }
+    finally {
+        if (outputFd !== undefined) {
+            closeSync(outputFd);
+        }
+    }
+}
+function validateExtractedTarTree(rawDir, descriptors, stripComponents) {
+    for (const descriptor of descriptors) {
+        const path = safePathInside(rawDir, descriptor.rawPath);
+        let stats;
+        try {
+            stats = lstatSync(path);
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            throw new NativePayloadError("NATIVE_PAYLOAD_EXTRACTION_FAILED", `cannot inspect ${descriptor.rawPath}: ${detail}`);
+        }
+        if (descriptor.kind === "symlink") {
+            if (!stats.isSymbolicLink()) {
+                throw new NativePayloadError("NATIVE_PAYLOAD_EXTRACTION_FAILED", `${descriptor.rawPath} was not extracted as a symlink`);
+            }
+            const linkpath = readlinkSync(path);
+            const outputPath = stripArchivePath(descriptor.rawPath, stripComponents);
+            if (outputPath !== undefined) {
+                normalizePayloadTarget(posix.dirname(outputPath), linkpath, outputPath);
+            }
+            try {
+                const targetStats = statSync(resolve(dirname(path), linkpath));
+                if (targetStats.isDirectory()) {
+                    throw new NativePayloadError("NATIVE_PAYLOAD_UNSUPPORTED_ENTRY", `directory symlink is not supported: ${descriptor.rawPath}`);
+                }
+            }
+            catch (error) {
+                if (error instanceof NativePayloadError) {
+                    throw error;
+                }
+                throw new NativePayloadError("NATIVE_PAYLOAD_EXTRACTION_FAILED", `symlink target is unavailable: ${descriptor.rawPath}`);
+            }
+        }
+    }
+}
+function materializeRaw(bytes, targetDir, name) {
+    const targetPath = safePathInside(targetDir, name);
+    ensureOutputParents(targetDir, name);
+    writeFileSync(targetPath, bytes, { mode: 0o755 });
+    chmodSync(targetPath, 0o755);
+}
+function materializeZipEntries(entries, rawDir) {
+    const directories = entries
+        .filter((entry) => entry.kind === "directory")
+        .sort((left, right) => pathDepth(left.rawPath) - pathDepth(right.rawPath));
+    for (const entry of directories) {
+        ensureOutputDirectory(rawDir, entry.rawPath, entry.mode);
+    }
+    for (const entry of entries) {
+        if (entry.kind === "directory") {
+            continue;
+        }
+        const outputPath = safePathInside(rawDir, entry.rawPath);
+        ensureOutputParents(rawDir, entry.rawPath);
+        if (lstatIfPresent(outputPath) !== undefined) {
+            throw new NativePayloadError("NATIVE_PAYLOAD_DUPLICATE_ENTRY", `multiple archive entries map to ${entry.rawPath}`);
+        }
+        if (entry.kind === "symlink") {
+            symlinkSync(entry.linkpath, outputPath);
+        }
+        else if (entry.kind === "file") {
+            writeFileSync(outputPath, entry.data ?? Buffer.alloc(0), { mode: normalizedMode(entry.mode) });
+            chmodSync(outputPath, normalizedMode(entry.mode));
+        }
+        else {
+            throw new NativePayloadError("NATIVE_PAYLOAD_UNSUPPORTED_ENTRY", `unsupported zip entry kind: ${entry.kind}`);
+        }
+    }
+}
+function copyStrippedTree(sourceDir, targetDir, stripComponents) {
+    walkTree(sourceDir, "", targetDir, stripComponents);
+}
+function walkTree(currentDir, relativeDir, targetDir, stripComponents) {
+    const children = readdirSync(currentDir, { withFileTypes: true }).sort((left, right) => left.name.localeCompare(right.name));
+    for (const child of children) {
+        const rawPath = relativeDir ? `${relativeDir}/${child.name}` : child.name;
+        const outputPath = stripArchivePath(rawPath, stripComponents);
+        const sourcePath = join(currentDir, child.name);
+        if (child.isDirectory()) {
+            if (outputPath !== undefined) {
+                ensureOutputDirectory(targetDir, outputPath, lstatSync(sourcePath).mode);
+            }
+            walkTree(sourcePath, rawPath, targetDir, stripComponents);
+            continue;
+        }
+        if (outputPath === undefined) {
+            continue;
+        }
+        ensureOutputParents(targetDir, outputPath);
+        const targetPath = safePathInside(targetDir, outputPath);
+        if (lstatIfPresent(targetPath) !== undefined) {
+            throw new NativePayloadError("NATIVE_PAYLOAD_DUPLICATE_ENTRY", `multiple archive entries map to ${outputPath}`);
+        }
+        if (child.isSymbolicLink()) {
+            const linkpath = readlinkSync(sourcePath);
+            normalizePayloadTarget(posix.dirname(outputPath), linkpath, outputPath);
+            let targetStats;
+            try {
+                targetStats = statSync(sourcePath);
+            }
+            catch {
+                throw new NativePayloadError("NATIVE_PAYLOAD_EXTRACTION_FAILED", `symlink target is unavailable: ${rawPath}`);
+            }
+            if (targetStats.isDirectory()) {
+                throw new NativePayloadError("NATIVE_PAYLOAD_UNSUPPORTED_ENTRY", `directory symlink is not supported: ${rawPath}`);
+            }
+            symlinkSync(linkpath, targetPath);
+            continue;
+        }
+        if (!child.isFile()) {
+            throw new NativePayloadError("NATIVE_PAYLOAD_UNSUPPORTED_ENTRY", `unsupported filesystem entry: ${rawPath}`);
+        }
+        const mode = lstatSync(sourcePath).mode;
+        copyFileSync(sourcePath, targetPath);
+        chmodSync(targetPath, normalizedMode(mode));
+    }
+}
+function normalizedMode(mode) {
+    return mode & 0o7777;
+}
+function pathDepth(pathValue) {
+    return pathValue === "" ? 0 : pathValue.split("/").length;
+}
+function safePathInside(root, relativePath) {
+    const rootPath = resolve(root);
+    const candidate = resolve(rootPath, ...relativePath.split("/"));
+    if (candidate !== rootPath && !candidate.startsWith(`${rootPath}/`)) {
+        throw new NativePayloadError("NATIVE_PAYLOAD_UNSAFE_PATH", `path escapes target: ${relativePath}`);
+    }
+    return candidate;
+}
+function ensureOutputParents(root, relativePath) {
+    const parts = relativePath.split("/");
+    if (parts.length <= 1) {
+        return;
+    }
+    ensureOutputDirectory(root, parts.slice(0, -1).join("/"), 0o755);
+}
+function ensureOutputDirectory(root, relativePath, mode) {
+    if (relativePath === "") {
+        return;
+    }
+    const parts = relativePath.split("/");
+    let current = resolve(root);
+    for (const part of parts) {
+        current = safePathInside(current, part);
+        const existing = lstatIfPresent(current);
+        if (existing !== undefined) {
+            if (!existing.isDirectory() || existing.isSymbolicLink()) {
+                throw new NativePayloadError("NATIVE_PAYLOAD_UNSAFE_PATH", `path component is not a real directory: ${part}`);
+            }
+            continue;
+        }
+        mkdirSync(current, { mode: 0o755 });
+    }
+    chmodSync(current, normalizedMode(mode) || 0o755);
+}
+function lstatIfPresent(path) {
+    try {
+        return lstatSync(path);
+    }
+    catch (error) {
+        if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+            return undefined;
+        }
+        throw error;
+    }
+}
+function parseZipEntries(bytes, stripComponents) {
+    const directory = findZipCentralDirectory(bytes);
+    const descriptors = [];
+    let cursor = directory.offset;
+    for (let index = 0; index < directory.count; index += 1) {
+        assertBytes(bytes, cursor, 46, "zip central directory header");
+        if (bytes.readUInt32LE(cursor) !== 0x02014b50) {
+            throw new NativePayloadError("NATIVE_PAYLOAD_INVALID_ZIP", "invalid central directory header");
+        }
+        const flags = bytes.readUInt16LE(cursor + 8);
+        const method = bytes.readUInt16LE(cursor + 10);
+        const compressedSize = bytes.readUInt32LE(cursor + 20);
+        const uncompressedSize = bytes.readUInt32LE(cursor + 24);
+        const nameLength = bytes.readUInt16LE(cursor + 28);
+        const extraLength = bytes.readUInt16LE(cursor + 30);
+        const commentLength = bytes.readUInt16LE(cursor + 32);
+        const externalAttributes = bytes.readUInt32LE(cursor + 38);
+        const localHeaderOffset = bytes.readUInt32LE(cursor + 42);
+        const recordLength = 46 + nameLength + extraLength + commentLength;
+        assertBytes(bytes, cursor, recordLength, "zip central directory record");
+        const nameBytes = bytes.subarray(cursor + 46, cursor + 46 + nameLength);
+        const archiveName = decodeZipName(nameBytes, flags);
+        const rawPath = normalizeArchivePath(archiveName);
+        if (rawPath === "") {
+            throw new NativePayloadError("NATIVE_PAYLOAD_INVALID_ZIP", "zip entry has an empty name");
+        }
+        const data = readZipEntryData(bytes, localHeaderOffset, compressedSize, uncompressedSize, method, flags);
+        const mode = (externalAttributes >>> 16) & 0xffff;
+        const directoryEntry = archiveName.endsWith("/") || (externalAttributes & 0x10) !== 0 || (mode & 0o170000) === 0o040000;
+        const symlinkEntry = !directoryEntry && (mode & 0o170000) === 0o120000;
+        const kind = directoryEntry
+            ? "directory"
+            : symlinkEntry
+                ? "symlink"
+                : "file";
+        const outputPath = stripArchivePath(rawPath, stripComponents);
+        const descriptor = {
+            rawPath,
+            outputPath,
+            kind,
+            mode: mode === 0 ? (directoryEntry ? 0o755 : 0o644) : mode,
+            data: kind === "file" ? data : undefined,
+            linkpath: kind === "symlink" ? data.toString("utf8") : undefined,
+        };
+        descriptors.push(descriptor);
+        cursor += recordLength;
+    }
+    if (cursor !== directory.endOffset) {
+        throw new NativePayloadError("NATIVE_PAYLOAD_INVALID_ZIP", "central directory length does not match");
+    }
+    validateArchiveDescriptors(descriptors, stripComponents);
+    return descriptors;
+}
+function findZipCentralDirectory(bytes) {
+    const minimumOffset = Math.max(0, bytes.length - 0xffff - 22);
+    for (let cursor = bytes.length - 22; cursor >= minimumOffset; cursor -= 1) {
+        if (cursor < 0 || bytes.readUInt32LE(cursor) !== 0x06054b50) {
+            continue;
+        }
+        assertBytes(bytes, cursor, 22, "zip end record");
+        const disk = bytes.readUInt16LE(cursor + 4);
+        const centralDisk = bytes.readUInt16LE(cursor + 6);
+        const entriesOnDisk = bytes.readUInt16LE(cursor + 8);
+        const entryCount = bytes.readUInt16LE(cursor + 10);
+        const centralSize = bytes.readUInt32LE(cursor + 12);
+        const centralOffset = bytes.readUInt32LE(cursor + 16);
+        const commentLength = bytes.readUInt16LE(cursor + 20);
+        if (disk !== 0 || centralDisk !== 0 || entriesOnDisk !== entryCount) {
+            throw new NativePayloadError("NATIVE_PAYLOAD_UNSUPPORTED_ZIP", "multi-disk zip archives are unsupported");
+        }
+        if (centralSize === 0xffffffff || centralOffset === 0xffffffff) {
+            throw new NativePayloadError("NATIVE_PAYLOAD_UNSUPPORTED_ZIP", "ZIP64 archives are unsupported");
+        }
+        assertBytes(bytes, cursor, 22 + commentLength, "zip end record");
+        assertBytes(bytes, centralOffset, centralSize, "zip central directory");
+        return {
+            offset: centralOffset,
+            size: centralSize,
+            count: entryCount,
+            endOffset: centralOffset + centralSize,
+        };
+    }
+    throw new NativePayloadError("NATIVE_PAYLOAD_INVALID_ZIP", "end of central directory was not found");
+}
+function decodeZipName(bytes, flags) {
+    if ((flags & 0x1) !== 0) {
+        throw new NativePayloadError("NATIVE_PAYLOAD_UNSUPPORTED_ZIP", "encrypted zip entries are unsupported");
+    }
+    return bytes.toString("utf8");
+}
+function readZipEntryData(bytes, localHeaderOffset, compressedSize, uncompressedSize, method, flags) {
+    assertBytes(bytes, localHeaderOffset, 30, "zip local header");
+    if (bytes.readUInt32LE(localHeaderOffset) !== 0x04034b50) {
+        throw new NativePayloadError("NATIVE_PAYLOAD_INVALID_ZIP", "invalid local file header");
+    }
+    const localNameLength = bytes.readUInt16LE(localHeaderOffset + 26);
+    const localExtraLength = bytes.readUInt16LE(localHeaderOffset + 28);
+    const dataOffset = localHeaderOffset + 30 + localNameLength + localExtraLength;
+    assertBytes(bytes, dataOffset, compressedSize, "zip entry data");
+    const compressed = bytes.subarray(dataOffset, dataOffset + compressedSize);
+    let data;
+    try {
+        if (method === 0) {
+            data = Buffer.from(compressed);
+        }
+        else if (method === 8) {
+            data = inflateRawSync(compressed);
+        }
+        else {
+            throw new NativePayloadError("NATIVE_PAYLOAD_UNSUPPORTED_ZIP", `compression method ${method} is unsupported`);
+        }
+    }
+    catch (error) {
+        if (error instanceof NativePayloadError) {
+            throw error;
+        }
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new NativePayloadError("NATIVE_PAYLOAD_INVALID_ZIP", `cannot inflate entry: ${detail}`);
+    }
+    if (data.length !== uncompressedSize) {
+        throw new NativePayloadError("NATIVE_PAYLOAD_INVALID_ZIP", "zip entry size does not match its header");
+    }
+    if ((flags & 0x1) !== 0) {
+        throw new NativePayloadError("NATIVE_PAYLOAD_UNSUPPORTED_ZIP", "encrypted zip entries are unsupported");
+    }
+    return data;
+}
+function assertBytes(bytes, offset, length, what) {
+    if (offset < 0 || length < 0 || offset > bytes.length - length) {
+        throw new NativePayloadError("NATIVE_PAYLOAD_INVALID_ZIP", `${what} is truncated`);
+    }
+}

package/dist/build-spk/reproducible-archive.d.ts

@@ -0,0 +1,8 @@
+/** Every archive this CLI writes uses the same timestamp so builds are byte-identical. */
+export declare const FIXED_MTIME: Date;
+/** Relative paths of every file under `root`, depth-first and sorted for a stable archive order. */
+export declare function collectArchiveEntries(root: string): string[];
+/** Writes `sourceDir` to `outputPath` as a tar whose bytes depend only on the file contents. */
+export declare function createReproducibleTar(sourceDir: string, outputPath: string, options?: {
+    gzip?: boolean;
+}): Promise<void>;