akm-cli 0.9.0-rc.4 → 0.9.0-rc.6

package/dist/runtime.js

@@ -28,6 +28,7 @@ import path from "node:path";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { fileURLToPath } from "node:url";
+import { ResponseTooLargeError, readChunkWithDeadline } from "./core/common.js";
 /** True when running under the Bun runtime. Computed once at module load. */
 const isBun = !!process.versions?.bun;
 /** A CommonJS-style require usable from this ESM module on both runtimes. */
@@ -153,6 +154,82 @@ export async function writeResponseToFile(filePath, res) {
     const buf = Buffer.from(await res.arrayBuffer());
     await pipeline(Readable.from(buf), createWriteStream(filePath));
 }
+/**
+ * Defensive ceiling on a streamed-to-disk download (1 GiB). `writeResponseToFile`
+ * imposes no size or duration bound — a compromised or misconfigured endpoint
+ * could stream until the disk fills or dribble bytes forever. Archive-download
+ * paths use {@link writeResponseToFileCapped} with these bounds instead.
+ */
+export const MAX_STREAMED_DOWNLOAD_BYTES = 1024 * 1024 * 1024;
+/** Default overall wall-clock budget for streaming a download body (5 min). */
+export const STREAMED_DOWNLOAD_BODY_TIMEOUT_MS = 5 * 60_000;
+function writeStreamChunk(out, chunk) {
+    return new Promise((resolve, reject) => {
+        out.write(chunk, (err) => (err ? reject(err) : resolve()));
+    });
+}
+function endWriteStream(out) {
+    return new Promise((resolve, reject) => {
+        out.once("error", reject);
+        out.end(() => resolve());
+    });
+}
+/**
+ * Stream a `Response` body to `filePath` enforcing an explicit max-bytes cap
+ * and an overall body-read deadline — the bounds `writeResponseToFile` lacks.
+ *
+ * Refuses before reading when `Content-Length` exceeds the cap; otherwise
+ * streams chunk-by-chunk, aborting with {@link ResponseTooLargeError} the
+ * instant BYTES WRITTEN exceed the cap, or {@link BodyReadTimeoutError} when the
+ * body-read deadline passes. Uses the same runtime-agnostic reader loop on Bun
+ * and Node (correctness over the native `Bun.write` fast path, which offers no
+ * per-byte hook). On any failure the partial file is discarded and the stream
+ * cancelled.
+ */
+export async function writeResponseToFileCapped(filePath, res, options) {
+    const maxBytes = options?.maxBytes ?? MAX_STREAMED_DOWNLOAD_BYTES;
+    const bodyTimeoutMs = options?.bodyTimeoutMs ?? STREAMED_DOWNLOAD_BODY_TIMEOUT_MS;
+    const url = res.url || filePath;
+    const declared = Number(res.headers.get("content-length"));
+    if (Number.isFinite(declared) && declared > maxBytes) {
+        await res.body?.cancel?.().catch(() => undefined);
+        throw new ResponseTooLargeError(url, maxBytes, declared);
+    }
+    const body = res.body;
+    if (!body) {
+        const buf = Buffer.from(await res.arrayBuffer());
+        if (buf.byteLength > maxBytes)
+            throw new ResponseTooLargeError(url, maxBytes, buf.byteLength);
+        await pipeline(Readable.from(buf), createWriteStream(filePath));
+        return;
+    }
+    const reader = body.getReader();
+    const out = createWriteStream(filePath);
+    const deadlineAt = Date.now() + bodyTimeoutMs;
+    let total = 0;
+    try {
+        while (true) {
+            const { done, value } = await readChunkWithDeadline(reader, deadlineAt, options?.signal, url, bodyTimeoutMs);
+            if (done)
+                break;
+            if (!value)
+                continue;
+            total += value.byteLength;
+            if (total > maxBytes)
+                throw new ResponseTooLargeError(url, maxBytes, total);
+            await writeStreamChunk(out, value);
+        }
+        await endWriteStream(out);
+    }
+    catch (err) {
+        out.destroy();
+        await reader.cancel().catch(() => undefined);
+        throw err;
+    }
+    finally {
+        reader.releaseLock?.();
+    }
+}
 // ── Hashing ─────────────────────────────────────────────────────────────────
 /**
  * Hex SHA-256 of `data`. Uses `node:crypto` on both runtimes (available in Bun
@@ -237,6 +314,19 @@ export function sleepSync(ms) {
     }
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
+/**
+ * Request a synchronous garbage collection. On Bun runs `Bun.gc(true)`; on
+ * Node a no-op (no portable forced-GC without --expose-gc). Used by the
+ * migrate-apply WAL conversion to finalize any zombie-closed bun:sqlite
+ * connection (statements not finalized before close keep the connection and
+ * its WAL shared memory alive until GC — issue #720) before concluding that
+ * ANOTHER process holds the database.
+ */
+export function requestGc() {
+    if (isBun) {
+        bunGlobal().gc(true);
+    }
+}
 /** Async sleep for `ms`. On Bun uses `Bun.sleep`; on Node a `setTimeout` promise. */
 export function sleep(ms) {
     if (isBun) {