@vascend/talos 0.1.0 → 0.1.1

package/install.ps1

@@ -1,30 +1,374 @@
-# Public entry point: https://cdn.jsdelivr.net/npm/@vascend/talos@latest/install.ps1
-& {
-    $ErrorActionPreference = 'Stop'
-    $node = Get-Command node.exe -ErrorAction SilentlyContinue
-    $npm = Get-Command npm.cmd -ErrorAction SilentlyContinue
-    if (-not $node -or -not $npm) {
-        throw 'Talos requires Node.js 20 or newer (including npm). Install it from https://nodejs.org and run this command again.'
-    }
-    & $node.Source -e 'process.exit(Number(process.versions.node.split(String.fromCharCode(46))[0]) >= 20 ? 0 : 1)'
-    if ($LASTEXITCODE -ne 0) { throw 'Please update Node.js to version 20 or newer.' }
-    $talosVersion = if ($env:TALOS_VERSION) { $env:TALOS_VERSION } else { 'latest' }
-    if ($talosVersion -notmatch '\A(?:latest|[0-9]+\.[0-9]+\.[0-9]+)\z') {
-        throw 'TALOS_VERSION must be latest or a stable version such as 0.1.0.'
-    }
-    $talosPrefix = if ($env:TALOS_INSTALL_DIR) { $env:TALOS_INSTALL_DIR } else { Join-Path $env:LOCALAPPDATA 'Programs\Talos' }
-    Write-Host "Installing Talos $talosVersion in $talosPrefix"
-    & $npm.Source install --global --prefix $talosPrefix --registry=https://registry.npmjs.org "@vascend/talos@$talosVersion"
-    if ($LASTEXITCODE -ne 0) { throw 'Talos installation failed. Check the npm output above.' }
-    $talosEntry = Join-Path $talosPrefix 'node_modules\@vascend\talos\dist\index.js'
-    & $node.Source $talosEntry --version
-    if ($LASTEXITCODE -ne 0) { throw 'Talos was installed but the startup check failed.' }
-    if ($env:TALOS_NO_MODIFY_PATH -ne '1') {
-        $talosUserPath = [Environment]::GetEnvironmentVariable('Path', 'User')
-        if (($talosUserPath -split ';') -notcontains $talosPrefix) {
-            [Environment]::SetEnvironmentVariable('Path', (([string]$talosUserPath).TrimEnd(';') + ';' + $talosPrefix).TrimStart(';'), 'User')
-        }
-    }
-    if (($env:Path -split ';') -notcontains $talosPrefix) { $env:Path = "$talosPrefix;$env:Path" }
-    Write-Host 'Talos is ready. Run talos to sign in.'
-}
+# Generated by scripts/build-installers.mjs. Public entry: https://vascend.it/install.ps1
+& {
+    $ErrorActionPreference = 'Stop'
+    $script:talosRuntimeBin = $null
+function Initialize-TalosNode {
+    $existing = Get-Command node.exe -ErrorAction SilentlyContinue
+    $npm = Get-Command npm.cmd -ErrorAction SilentlyContinue
+    if ($env:TALOS_FORCE_BUNDLED_NODE -ne '1' -and $existing -and $npm) {
+        & $existing.Source -e 'process.exit(Number(process.versions.node.split(String.fromCharCode(46))[0]) >= 22 ? 0 : 1)' 2>$null
+        if ($LASTEXITCODE -eq 0) {
+            & $npm.Source --version *> $null
+            if ($LASTEXITCODE -eq 0) { return $existing.Source }
+        }
+    }
+    $architecture = if ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } else { $env:PROCESSOR_ARCHITECTURE }
+    switch ($architecture) {
+        'ARM64' { $platform = 'win-arm64'; $digest = '8779b1bde1d39f8d420e3b57aa657b39891af434d3de44a919044cec06785921' }
+        'AMD64' { $platform = 'win-x64'; $digest = '158f7685b44de51f6c0df1d153526cbcd3e1bc739a8dfc607721cef75de9e541' }
+        default { throw 'Talos requires 64-bit Windows (x64 or ARM64).' }
+    }
+    $runtimeBase = if ($env:TALOS_RUNTIME_DIR) { $env:TALOS_RUNTIME_DIR } else { Join-Path $env:LOCALAPPDATA 'Vascend\runtime' }
+    if ($runtimeBase -match '[;\x00-\x1f\x7f]') { throw 'Invalid Node runtime directory.' }
+    if (-not [IO.Path]::IsPathRooted($runtimeBase)) { $runtimeBase = Join-Path (Get-Location).Path $runtimeBase }
+    $runtimeBase = [IO.Path]::GetFullPath($runtimeBase)
+    $runtime = Join-Path $runtimeBase "node-v24.21.0-$platform"
+    if (-not (Test-Path -LiteralPath $runtime)) {
+        New-Item -ItemType Directory -Force -Path $runtimeBase | Out-Null
+        $stage = Join-Path $runtimeBase ('.node-download-' + [Guid]::NewGuid().ToString('N'))
+        New-Item -ItemType Directory -Path $stage | Out-Null
+        try {
+            Write-Host 'Installing Node.js 24.21.0 with npm for Talos...'
+            $archive = Join-Path $stage 'node.zip'
+            [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12
+            Invoke-WebRequest -UseBasicParsing -MaximumRedirection 0 -TimeoutSec 300 -Uri "https://nodejs.org/dist/v24.21.0/node-v24.21.0-$platform.zip" -OutFile $archive
+            if ((Get-FileHash -LiteralPath $archive -Algorithm SHA256).Hash.ToLowerInvariant() -ne $digest) { throw 'Node checksum mismatch. Installation refused.' }
+            Expand-Archive -LiteralPath $archive -DestinationPath $stage
+            if (Test-Path -LiteralPath $runtime) { throw 'The Node runtime already exists. Run the installer again.' }
+            $expanded = Join-Path $stage "node-v24.21.0-$platform"
+            if (-not ([IO.Path]::GetFullPath($expanded)).StartsWith($stage + [IO.Path]::DirectorySeparatorChar, [StringComparison]::OrdinalIgnoreCase)) { throw 'Invalid runtime source.' }
+            if (-not $runtime.StartsWith($runtimeBase + [IO.Path]::DirectorySeparatorChar, [StringComparison]::OrdinalIgnoreCase)) { throw 'Invalid runtime destination.' }
+            Move-Item -LiteralPath $expanded -Destination $runtime
+        } finally {
+            $resolvedStage = [IO.Path]::GetFullPath($stage)
+            if (-not $resolvedStage.StartsWith($runtimeBase + [IO.Path]::DirectorySeparatorChar, [StringComparison]::OrdinalIgnoreCase)) { throw 'Invalid temporary runtime directory.' }
+            Remove-Item -LiteralPath $resolvedStage -Recurse -Force
+        }
+    }
+    $script:talosRuntimeBin = $runtime
+    $env:Path = "$runtime;$env:Path"
+    $executable = Join-Path $runtime 'node.exe'
+    $reported = & $executable --version
+    if ($LASTEXITCODE -ne 0 -or $reported -ne 'v24.21.0' -or -not (Test-Path -LiteralPath (Join-Path $runtime 'node_modules\npm\bin\npm-cli.js'))) { throw 'The managed Node runtime is incomplete.' }
+    return $executable
+}
+
+function Merge-TalosPath([string]$ExistingPath, [string[]]$Directories) {
+    $paths = [Collections.Generic.List[string]]::new()
+    $seen = [Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
+    foreach ($directory in @($Directories) + @($ExistingPath -split ';')) {
+        if ($directory -and $seen.Add($directory.TrimEnd('\', '/'))) { $paths.Add($directory) }
+    }
+    return $paths -join ';'
+}
+
+function Update-TalosPath([string]$Prefix, [string]$RuntimeBin) {
+    $directories = @($Prefix, $RuntimeBin) | Where-Object { $_ }
+    $env:Path = Merge-TalosPath $env:Path $directories
+    if ($env:TALOS_NO_MODIFY_PATH -eq '1') { return }
+    $before = [Environment]::GetEnvironmentVariable('Path', 'User')
+    $after = Merge-TalosPath $before $directories
+    if ($after -eq $before) { return }
+    [Environment]::SetEnvironmentVariable('Path', $after, 'User')
+    # Inform Explorer so newly opened terminals can inherit the updated PATH.
+    try {
+        if (-not ('TalosInstaller.EnvironmentNotification' -as [type])) {
+            Add-Type -TypeDefinition @'
+using System;
+using System.Runtime.InteropServices;
+namespace TalosInstaller {
+    public static class EnvironmentNotification {
+        [DllImport("user32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
+        public static extern IntPtr SendMessageTimeout(IntPtr window, uint message, IntPtr wParam,
+            string lParam, uint flags, uint timeout, out IntPtr result);
+    }
+}
+'@
+        }
+        $result = [IntPtr]::Zero
+        [void][TalosInstaller.EnvironmentNotification]::SendMessageTimeout([IntPtr]0xffff, 0x1a, [IntPtr]::Zero, 'Environment', 2, 1000, [ref]$result)
+    } catch { Write-Host 'PATH saved. Restart your terminal application if it still has the old environment.' }
+}
+
+    $talosNode = Initialize-TalosNode
+    $env:TALOS_INSTALL_DIR = & $talosNode -p "require('node:path').resolve(process.env.TALOS_INSTALL_DIR || require('node:path').join(process.env.LOCALAPPDATA, 'Programs', 'Talos'))"
+    if ($LASTEXITCODE -ne 0) { throw 'Unable to resolve the Talos installation directory.' }
+    $talosInstaller = @'
+// src/distribution/install.ts
+import { join as join4 } from "node:path";
+import { homedir } from "node:os";
+
+// src/core/signed-release.ts
+import { createHash, createPublicKey, verify } from "node:crypto";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+var TALOS_DOWNLOAD_ORIGIN = "https://vascend.it";
+var STABLE_VERSION = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+function stableVersion(value) {
+  return typeof value === "string" && value.length <= 40 && STABLE_VERSION.exec(value)?.[0] === value;
+}
+function verifyRelease(bytes, registryKeys, options = {}) {
+  if (bytes.length > 64 * 1024)
+    throw new Error("Release metadata is too large.");
+  const data = JSON.parse(Buffer.from(bytes).toString("utf8"));
+  if (!data || data.name !== "@vascend/talos" || !stableVersion(data.version) || options.version !== undefined && data.version !== options.version)
+    throw new Error("Unexpected release version.");
+  if (typeof data.dist?.integrity !== "string" || !/^sha512-[A-Za-z0-9+/]{86}==$/.test(data.dist.integrity) || data.dist.integrity.length !== 95 || !Array.isArray(data.dist.signatures) || data.dist.signatures.length > 10)
+    throw new Error("Invalid npm release signature.");
+  const keys = registryKeys?.keys;
+  if (!Array.isArray(keys) || keys.length > 30)
+    throw new Error("Invalid npm signing keys.");
+  const payload = Buffer.from(`${data.name}@${data.version}:${data.dist.integrity}`);
+  for (const signature of data.dist.signatures) {
+    if (typeof signature?.sig !== "string" || signature.sig.length > 256 || typeof signature.keyid !== "string")
+      continue;
+    for (const trusted of keys) {
+      if (!trusted || trusted.keyid !== signature.keyid || trusted.keytype !== "ecdsa-sha2-nistp256" || trusted.scheme !== "ecdsa-sha2-nistp256" || typeof trusted.key !== "string" || trusted.key.length > 512 || trusted.expires !== null && !(Date.parse(trusted.expires) > (options.now ?? Date.now())))
+        continue;
+      try {
+        const key = createPublicKey({ key: Buffer.from(trusted.key, "base64"), format: "der", type: "spki" });
+        if (key.asymmetricKeyType === "ec" && key.asymmetricKeyDetails?.namedCurve === "prime256v1" && verify("sha256", payload, key, Buffer.from(signature.sig, "base64")))
+          return data;
+      } catch {}
+    }
+  }
+  throw new Error("The npm registry signature is invalid.");
+}
+function verifyPackage(bytes, release) {
+  if (`sha512-${createHash("sha512").update(bytes).digest("base64")}` !== release.dist.integrity) {
+    throw new Error("Release checksum does not match. Installation refused.");
+  }
+}
+async function fetchReleaseBytes(url, limit, options = {}) {
+  const controller = new AbortController;
+  const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? 20000);
+  try {
+    const response = await (options.fetch ?? fetch)(url, { redirect: "error", signal: controller.signal, headers: { Accept: "application/octet-stream" } });
+    if (!response.ok || !response.body) {
+      await response.body?.cancel();
+      throw new Error("Release download is unavailable.");
+    }
+    if (Number(response.headers.get("content-length")) > limit) {
+      await response.body.cancel();
+      throw new Error("Release download is too large.");
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let length = 0;
+    try {
+      for (;; ) {
+        const { done, value } = await reader.read();
+        if (done)
+          break;
+        length += value.length;
+        if (length > limit)
+          throw new Error("Release download is too large.");
+        chunks.push(value);
+      }
+    } finally {
+      await reader.cancel();
+    }
+    return Buffer.concat(chunks);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function fetchSignedRelease(version = "latest", options = {}) {
+  if (version !== "latest" && !stableVersion(version))
+    throw new Error("Invalid Talos version.");
+  const [metadata, keys] = await Promise.all([
+    fetchReleaseBytes(`https://registry.npmjs.org/@vascend%2ftalos/${version}`, 64 * 1024, options),
+    fetchReleaseBytes("https://registry.npmjs.org/-/npm/v1/keys", 64 * 1024, options)
+  ]);
+  return verifyRelease(metadata, JSON.parse(keys.toString("utf8")), version === "latest" ? {} : { version });
+}
+async function downloadVerifiedPackage(version, options = {}) {
+  const release = await fetchSignedRelease(version, options);
+  const filename = `vascend-talos-${release.version}.tgz`;
+  let bytes;
+  try {
+    bytes = await fetchReleaseBytes(`${TALOS_DOWNLOAD_ORIGIN}/talos/releases/${release.version}/${filename}`, 32 * 1024 * 1024, options);
+    verifyPackage(bytes, release);
+  } catch {
+    bytes = await fetchReleaseBytes(`https://registry.npmjs.org/@vascend/talos/-/talos-${release.version}.tgz`, 32 * 1024 * 1024, options);
+    verifyPackage(bytes, release);
+  }
+  const directory = await mkdtemp(join(tmpdir(), "talos-verified-"));
+  const dispose = () => rm(directory, { recursive: true, force: true });
+  try {
+    const path = join(directory, filename);
+    await writeFile(path, bytes, { flag: "wx", mode: 384 });
+    return { path, dispose };
+  } catch (error) {
+    await dispose();
+    throw error;
+  }
+}
+
+// src/core/package-update.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, realpathSync as realpathSync2 } from "node:fs";
+import { delimiter, dirname as dirname2, join as join3 } from "node:path";
+
+// src/core/update-process.ts
+import { spawn } from "node:child_process";
+var runUpdateCommand = (command) => new Promise((resolve, reject) => {
+  const child = spawn(command.command, [...command.args], {
+    cwd: command.cwd,
+    env: command.env,
+    shell: false,
+    windowsHide: true,
+    stdio: command.inherit ? "inherit" : ["ignore", "pipe", "pipe"],
+    timeout: command.timeoutMs
+  });
+  let output = "";
+  let failed = false;
+  const collect = (data) => {
+    output += data.toString();
+    if (output.length > 2000000) {
+      failed = true;
+      child.kill();
+      reject(new Error("Command output exceeded limit"));
+    }
+  };
+  child.stdout?.on("data", collect);
+  child.stderr?.resume();
+  child.on("error", reject);
+  child.on("close", (code, signal) => {
+    if (failed)
+      return;
+    if (code === 0 && !signal)
+      resolve(output.trim());
+    else
+      reject(new Error(`${command.command} exited with ${signal ?? code}`));
+  });
+});
+
+// src/core/cli-installation.ts
+import { existsSync, lstatSync, readFileSync, realpathSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname, join as join2, resolve } from "node:path";
+function installationPrefix(value) {
+  const prefix = resolve(value);
+  if (/[\x00-\x1f\x7f]/.test(prefix) || prefix.includes(process.platform === "win32" ? ";" : ":")) {
+    throw new Error("The installation directory cannot be represented safely in PATH.");
+  }
+  return prefix;
+}
+function windowsCliShim() {
+  return `@echo off\r
+"%~dp0.talos-runtime\\node.exe" "%~dp0node_modules\\@vascend\\talos\\dist\\index.js" %*\r
+`;
+}
+function finalizeCliInstallation(root, version) {
+  const pkg = JSON.parse(readFileSync(join2(root, "package.json"), "utf8"));
+  if (pkg.name !== "@vascend/talos" || pkg.version !== version)
+    throw new Error("Installed Talos version differs from the requested release.");
+  if (process.platform !== "win32")
+    return;
+  const modules = dirname(dirname(root));
+  if (dirname(root).split(/[\\/]/).pop() !== "@vascend" || modules.split(/[\\/]/).pop() !== "node_modules")
+    return;
+  const prefix = dirname(modules);
+  const belongsToTalos = (file) => {
+    if (!existsSync(file))
+      return false;
+    const info = lstatSync(file);
+    return info.isFile() && !info.isSymbolicLink() && info.size < 16384 && /node_modules[\\/]@vascend[\\/]talos[\\/]dist[\\/]index\.js/i.test(readFileSync(file, "utf8"));
+  };
+  for (const alias of ["talos", "horizon"]) {
+    const cmd = join2(prefix, `${alias}.cmd`);
+    if (!belongsToTalos(cmd))
+      continue;
+    if (!process.versions.bun) {
+      const runtime = join2(prefix, ".talos-runtime");
+      if (existsSync(runtime)) {
+        if (!lstatSync(runtime).isSymbolicLink())
+          throw new Error("The Talos runtime link is occupied by a regular directory.");
+        if (realpathSync(runtime).toLowerCase() !== realpathSync(dirname(process.execPath)).toLowerCase())
+          unlinkSync(runtime);
+      }
+      if (!existsSync(runtime))
+        symlinkSync(dirname(process.execPath), runtime, "junction");
+      writeFileSync(cmd, windowsCliShim());
+    }
+    const ps1 = join2(prefix, `${alias}.ps1`);
+    if (belongsToTalos(ps1))
+      unlinkSync(ps1);
+  }
+}
+
+// src/core/package-update.ts
+var REGISTRY = "https://registry.npmjs.org";
+function managerCommand(manager, env) {
+  if (process.platform !== "win32")
+    return { command: manager, args: [] };
+  const path = Object.entries(env).find(([key]) => key.toLowerCase() === "path")?.[1] ?? "";
+  const directories = path.split(delimiter).filter(Boolean).map((directory) => directory.replace(/^"|"$/g, ""));
+  const node = process.versions.bun ? directories.map((directory) => join3(directory, "node.exe")).find((file) => existsSync2(file)) : process.execPath;
+  for (const directory of directories) {
+    const exe = join3(directory, `${manager}.exe`);
+    if (existsSync2(exe))
+      return { command: exe, args: [] };
+    const scripts = {
+      npm: ["npm/bin/npm-cli.js"],
+      pnpm: ["pnpm/bin/pnpm.cjs", "corepack/dist/pnpm.js"],
+      yarn: ["yarn/bin/yarn.js", "corepack/dist/yarn.js"]
+    };
+    if (manager !== "bun")
+      for (const script of scripts[manager]) {
+        const file = join3(directory, "node_modules", script);
+        if (node && existsSync2(file))
+          return { command: node, args: [file] };
+      }
+  }
+  return null;
+}
+function packageUpdateArgs(manager, target, prefix) {
+  const security = ["--ignore-scripts", `--registry=${REGISTRY}`];
+  if (manager === "npm")
+    return ["install", "--global", target, ...security, "--no-audit", "--no-fund", ...prefix ? ["--prefix", prefix] : []];
+  if (manager === "yarn")
+    return ["global", "add", target, ...security];
+  return ["add", "--global", target, ...security];
+}
+
+// src/distribution/install.ts
+async function install() {
+  if (Number(process.versions.node.split(".")[0]) < 20)
+    throw new Error("Talos requires Node.js 20 or newer, including npm: https://nodejs.org");
+  const npm = managerCommand("npm", process.env);
+  if (!npm)
+    throw new Error("npm is missing. Install Node.js with npm from https://nodejs.org");
+  const version = process.env.TALOS_VERSION || "latest";
+  const release = await fetchSignedRelease(version);
+  const prefix = installationPrefix(process.env.TALOS_INSTALL_DIR || (process.platform === "win32" ? join4(process.env.LOCALAPPDATA || join4(homedir(), "AppData", "Local"), "Programs", "Talos") : join4(homedir(), ".local")));
+  console.log(`Installing Talos ${release.version} in ${prefix}`);
+  const artifact = await downloadVerifiedPackage(release.version);
+  try {
+    await runUpdateCommand({
+      ...npm,
+      args: [...npm.args, ...packageUpdateArgs("npm", artifact.path, prefix)],
+      cwd: homedir(),
+      env: process.env,
+      inherit: true,
+      timeoutMs: 300000
+    });
+    const entry = join4(prefix, ...process.platform === "win32" ? [] : ["lib"], "node_modules", "@vascend", "talos", "dist", "index.js");
+    finalizeCliInstallation(join4(prefix, ...process.platform === "win32" ? [] : ["lib"], "node_modules", "@vascend", "talos"), release.version);
+    await runUpdateCommand({ command: process.execPath, args: [entry, "--version"], cwd: homedir(), env: process.env, inherit: true, timeoutMs: 1e4 });
+    console.log("Talos installed. npm registry signature and SHA-512 verified.");
+  } finally {
+    await artifact.dispose();
+  }
+}
+install().catch((error) => {
+  console.error(error instanceof Error ? error.message : "Installation failed.");
+  process.exitCode = 1;
+});
+
+'@
+    $talosInstaller | & $talosNode --input-type=module -
+    if ($LASTEXITCODE -ne 0) { throw 'Talos installation failed. See the error above.' }
+    Update-TalosPath $env:TALOS_INSTALL_DIR $script:talosRuntimeBin
+    Write-Host 'Talos is ready. Run talos to sign in.'
+}