android-publisher-cli 0.0.0-stage → 0.2.0-dev

package/build/engine.js

@@ -0,0 +1,273 @@
+import path from 'node:path';
+import { inspectAndFreeze, verifyFrozen } from './artifact.js';
+import { channelAdapter } from './channels/index.js';
+import { ChannelError } from './channels/http.js';
+import { canonical, digest, isChannel, validAbsolute, validId, validateBatchInput, validateProject } from './model.js';
+import { dataRoot, freezeFile, hashFile, readJSON, regularFile, writePrivate } from './private-file.js';
+export function projectPath(root, id) {
+    if (!validId(id))
+        throw new Error('invalid project ID');
+    return path.join(root, 'projects', `${id}.json`);
+}
+export function saveProject(project, root = dataRoot(), replace = false) {
+    validateProject(project);
+    writePrivate(projectPath(root, project.project_id), JSON.stringify(project, null, 2) + '\n', replace, true);
+}
+export function loadProject(id, root = dataRoot()) {
+    return validateProject(readJSON(projectPath(root, id), 64 * 1024, true));
+}
+export function prepare(input, tools, store) {
+    validateBatchInput(input);
+    const project = loadProject(input.project_id, store.root);
+    const selected = Object.keys(input.apks);
+    if (selected.length !== project.channels.length || project.channels.some(ch => !selected.includes(ch.channel)))
+        throw new Error('one APK is required for every configured channel');
+    const notes = new TextDecoder('utf-8', { fatal: true }).decode(regularFile(input.release_notes_file, 64 * 1024));
+    if ([...notes.trim()].length < 5 || [...notes].length > 500 || /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/u.test(notes))
+        throw new Error('release notes must have 5–500 characters');
+    const targets = [];
+    let versionName = '';
+    let versionCode = '';
+    for (const config of project.channels) {
+        const apkPath = input.apks[config.channel];
+        if (!apkPath)
+            throw new Error(`${config.channel}: APK path missing`);
+        const artifact = inspectAndFreeze(tools, apkPath, store.root);
+        if (artifact.package_name !== project.package_name || artifact.signer_sha256 !== project.signer_sha256)
+            throw new Error(`${config.channel}: APK package or signer differs from the approved project`);
+        if (!versionName) {
+            versionName = artifact.version_name;
+            versionCode = artifact.version_code;
+        }
+        if (versionName !== artifact.version_name || versionCode !== artifact.version_code)
+            throw new Error('all APKs must have the same version');
+        const target = { channel: config.channel, account: config.account, app_id: config.app_id,
+            artifact, ...(config.client_id ? { client_id: config.client_id } : {}),
+            ...(config.language_id ? { language_id: config.language_id } : {}),
+            ...(config.privacy_url ? { privacy_url: config.privacy_url } : {}) };
+        if (config.channel === 'xiaomi') {
+            const iconSource = config.icon_path;
+            const iconHash = hashFile(iconSource);
+            const frozenIcon = path.join(store.root, 'artifacts', iconHash.sha256, `icon${path.extname(iconSource) || '.png'}`);
+            freezeFile(iconSource, frozenIcon, iconHash.sha256);
+            target.icon_path = frozenIcon;
+            target.icon_sha256 = iconHash.sha256;
+            target.icon_size = iconHash.size;
+        }
+        targets.push(target);
+    }
+    const body = { schema_version: 2, batch_id: input.batch_id, project_id: project.project_id,
+        package_name: project.package_name, version_name: versionName, version_code: versionCode,
+        signer_sha256: project.signer_sha256, release_notes: notes, release_policy: 'after_approval', targets };
+    const batch = { ...body, digest: digest(body), created_at: new Date().toISOString() };
+    store.saveBatch(batch);
+    return batch;
+}
+function selectedTargets(batch, channels) {
+    if (!channels?.length)
+        return batch.targets;
+    if (new Set(channels).size !== channels.length)
+        throw new Error('duplicate channel selection');
+    const rows = channels.map(channel => batch.targets.find(target => target.channel === channel));
+    if (rows.some(row => !row))
+        throw new Error('selected channel is outside the immutable batch');
+    return rows;
+}
+export async function preflight(store, batchId, credentials, channels, fetcher = fetch) {
+    const batch = store.loadBatch(batchId);
+    const errors = {};
+    for (const target of selectedTargets(batch, channels)) {
+        try {
+            const secrets = await credentials.forChannel(target.channel);
+            const adapter = channelAdapter(batch, target, secrets, store, fetcher);
+            const result = await adapter.preflight();
+            store.savePreflight(batchId, result);
+        }
+        catch (error) {
+            errors[target.channel] = publicError(error);
+        }
+    }
+    return { ...store.summary(batchId), effect: 'read_only', errors };
+}
+function approvalBody(store, batch, channels, requireReady = false) {
+    const selected = selectedTargets(batch, channels);
+    const preflightDigests = {};
+    const hashes = {};
+    for (const target of selected) {
+        const row = store.target(batch.batch_id, target.channel);
+        if (!row.preflight_digest || requireReady && row.phase !== 'preflighted')
+            throw new Error(`${target.channel}: a clean preflight is required`);
+        if (requireReady && store.operations(batch.batch_id, target.channel).some(op => ['intent', 'unknown'].includes(op.effect)))
+            throw new Error(`${target.channel}: unresolved write blocks review`);
+        preflightDigests[target.channel] = row.preflight_digest;
+        hashes[target.channel] = target.artifact.sha256;
+    }
+    return { schema_version: 2, batch_id: batch.batch_id, batch_digest: batch.digest,
+        selected_channels: selected.map(target => target.channel),
+        target_accounts: selected.map(target => ({ channel: target.channel, account: target.account,
+            app_id: target.app_id, ...(target.client_id ? { client_id: target.client_id } : {}) })),
+        preflight_digests: preflightDigests,
+        package_name: batch.package_name, version_name: batch.version_name, version_code: batch.version_code,
+        artifact_sha256: hashes, signer_sha256: batch.signer_sha256, release_notes: batch.release_notes,
+        release_policy: batch.release_policy };
+}
+export function review(store, batchId, file, channels) {
+    if (!validAbsolute(file))
+        throw new Error('approval file path must be absolute');
+    const body = approvalBody(store, store.loadBatch(batchId), channels, true);
+    const approval = { ...body, approval_plan: digest(body) };
+    writePrivate(file, JSON.stringify(approval, null, 2) + '\n');
+    return approval;
+}
+function validatedApproval(store, batch, file, approvedPlan) {
+    const raw = readJSON(file, 8 * 1024 * 1024, true);
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        throw new Error('approval file is invalid');
+    const approval = raw;
+    if (approval.schema_version !== 2 || approval.batch_id !== batch.batch_id ||
+        approval.approval_plan !== approvedPlan || !Array.isArray(approval.selected_channels) ||
+        approval.selected_channels.some(ch => !isChannel(ch)))
+        throw new Error('approval does not match the requested plan');
+    const body = approvalBody(store, batch, approval.selected_channels);
+    const expected = { ...body, approval_plan: digest(body) };
+    if (canonical(approval) !== canonical(expected))
+        throw new Error('approval file or reviewed inputs changed');
+    store.verifyApproval(approval);
+    return approval;
+}
+function samePreflightMeaning(a, b) {
+    const { inspected_at: _aTime, digest: _aDigest, ...left } = a;
+    const { inspected_at: _bTime, digest: _bDigest, ...right } = b;
+    return canonical(left) === canonical(right);
+}
+export function publicError(error) {
+    if (error instanceof ChannelError)
+        return error.message;
+    if (error instanceof Error)
+        return error.message.slice(0, 256);
+    return 'operation failed';
+}
+async function runTarget(store, batch, target, adapter, approval, resume) {
+    const row = store.target(batch.batch_id, target.channel);
+    if (row.phase === 'submitted')
+        return;
+    const existing = store.operations(batch.batch_id, target.channel);
+    if (!resume && existing.length)
+        throw new Error('target has an earlier operation; use resume after checking its status');
+    if (!existing.length) {
+        const observed = await adapter.preflight();
+        const saved = JSON.parse(row.preflight);
+        if (!samePreflightMeaning(observed, saved))
+            throw new Error('remote baseline changed after review; run preflight and review again');
+    }
+    for (const step of adapter.steps) {
+        const previous = store.latestOperation(batch.batch_id, target.channel, step);
+        if (previous?.effect === 'confirmed_applied')
+            continue;
+        if (previous && ['intent', 'unknown', 'confirmed_rejected'].includes(previous.effect))
+            throw new Error(`${step}: result is unresolved; run reconcile`);
+        if (adapter.waitBeforeStep)
+            await adapter.waitBeforeStep(step);
+        const checkpoints = Object.fromEntries(store.operations(batch.batch_id, target.channel)
+            .filter(op => op.effect === 'confirmed_applied').map(op => [op.step, op.remote_ref]));
+        const requestDigest = digest({ batch: batch.digest, approval: approval.approval_plan,
+            preflight: row.preflight_digest, channel: target.channel, step, checkpoints });
+        const operation = store.beginOperation(batch.batch_id, target.channel, step, requestDigest);
+        try {
+            const receipt = await adapter.execute(step, operation.id);
+            if (!receipt.ref || receipt.ref.length > 2048 || /[\r\n\u0000]/.test(receipt.ref))
+                throw new Error('vendor receipt is missing or invalid');
+            store.finishOperation(operation, 'confirmed_applied', receipt.ref, receipt.material);
+        }
+        catch (error) {
+            store.finishOperation(operation, error instanceof ChannelError && error.effect === 'not_sent' ? 'confirmed_not_applied' : 'unknown');
+            throw error;
+        }
+    }
+    const last = store.latestOperation(batch.batch_id, target.channel, adapter.steps.at(-1));
+    if (!last || last.effect !== 'confirmed_applied')
+        throw new Error('submit receipt missing');
+    store.setSubmitted(batch.batch_id, target.channel, last.remote_ref);
+}
+export async function submit(store, batchId, approvalFile, approvedPlan, credentials, tools, resume = false, fetcher = fetch) {
+    const batch = store.loadBatch(batchId);
+    const approval = validatedApproval(store, batch, approvalFile, approvedPlan);
+    // Verify every selected artifact before the first channel can write.
+    for (const target of selectedTargets(batch, approval.selected_channels)) {
+        verifyFrozen(tools, target.artifact);
+        if (target.icon_path && (hashFile(target.icon_path).sha256 !== target.icon_sha256))
+            throw new Error('frozen icon changed');
+        const row = store.target(batchId, target.channel);
+        store.assertScopeAvailable(row.scope, batchId, target.channel);
+    }
+    const errors = {};
+    for (const target of selectedTargets(batch, approval.selected_channels)) {
+        try {
+            const secrets = await credentials.forChannel(target.channel);
+            const adapter = channelAdapter(batch, target, secrets, store, fetcher);
+            await runTarget(store, batch, target, adapter, approval, resume);
+        }
+        catch (error) {
+            errors[target.channel] = publicError(error);
+        }
+    }
+    return { ...store.summary(batchId), effect: Object.keys(errors).length ? 'partial_or_unknown' : 'submitted', errors };
+}
+export async function refresh(store, batchId, credentials, channels, fetcher = fetch) {
+    const batch = store.loadBatch(batchId);
+    const errors = {};
+    for (const target of selectedTargets(batch, channels)) {
+        try {
+            const secrets = await credentials.forChannel(target.channel);
+            const adapter = channelAdapter(batch, target, secrets, store, fetcher);
+            const observed = await adapter.observe(store.target(batchId, target.channel).remote_ref);
+            store.saveObservation(batchId, target.channel, observed);
+        }
+        catch (error) {
+            errors[target.channel] = publicError(error);
+            store.saveQueryFailure(batchId, target.channel, errors[target.channel]);
+        }
+    }
+    return { ...store.summary(batchId), effect: 'read_only', errors };
+}
+export async function reconcile(store, batchId, credentials, channels, fetcher = fetch) {
+    const batch = store.loadBatch(batchId);
+    const errors = {};
+    for (const target of selectedTargets(batch, channels)) {
+        const pending = store.operations(batchId, target.channel).filter(op => ['intent', 'unknown'].includes(op.effect));
+        if (!pending.length)
+            continue;
+        try {
+            const secrets = await credentials.forChannel(target.channel);
+            const adapter = channelAdapter(batch, target, secrets, store, fetcher);
+            for (const op of pending) {
+                const result = await adapter.reconcile(op);
+                if (result.effect === 'unknown') {
+                    try {
+                        store.saveObservation(batchId, target.channel, await adapter.observe(store.target(batchId, target.channel).remote_ref));
+                    }
+                    catch { /* No read-only source can prove this write. Keep the durable block. */ }
+                    errors[target.channel] = 'read-only evidence cannot resolve this write';
+                    continue;
+                }
+                store.resolveOperation(op, result.effect, result.ref ?? '');
+            }
+        }
+        catch (error) {
+            errors[target.channel] = publicError(error);
+        }
+    }
+    return { ...store.summary(batchId), effect: 'read_only', errors };
+}
+export function report(store, batchId) {
+    const batch = store.loadBatch(batchId);
+    const summary = store.summary(batchId);
+    const lines = [`# ${batch.batch_id} 发布报告`, '', `包名：${batch.package_name}。`,
+        `版本：${batch.version_name}（${batch.version_code}）。`, `批次摘要：\`${batch.digest}\`。`, '',
+        '| 渠道 | 执行 | 审核 | 上架 | 查询 |', '| --- | --- | --- | --- | --- |'];
+    const targets = summary.targets;
+    for (const row of targets)
+        lines.push(`| ${row.channel} | ${row.execution_phase} | ${row.review_state} | ${row.availability_state} | ${row.query_status} |`);
+    lines.push('', '本报告只记录本地回执和已关联的观测。审核与上架状态以各字段为准。', '');
+    return lines.join('\n');
+}

package/build/model.js

@@ -0,0 +1,160 @@
+import { createHash } from 'node:crypto';
+import path from 'node:path';
+export const CHANNELS = ['huawei', 'honor', 'xiaomi', 'oppo', 'vivo', 'tencent'];
+export const validId = (s) => typeof s === 'string' && /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(s);
+export const validHash = (s) => typeof s === 'string' && /^[a-f0-9]{64}$/.test(s);
+export const validPackage = (s) => typeof s === 'string' && /^[A-Za-z][A-Za-z0-9_]*(?:\.[A-Za-z][A-Za-z0-9_]*)+$/.test(s) && s.length <= 255;
+export const validVersion = (s) => typeof s === 'string' && /^[1-9][0-9]{0,18}$/.test(s) && BigInt(s) <= 9223372036854775807n;
+export const validText = (s, max) => typeof s === 'string' && Buffer.byteLength(s) <= max && !/[\u0000-\u001f\u007f\u2028\u2029]/u.test(s);
+export const validAbsolute = (s) => typeof s === 'string' && s.length <= 4096 && path.isAbsolute(s) && path.normalize(s) === s && validText(s, 4096);
+export const isChannel = (s) => typeof s === 'string' && CHANNELS.includes(s);
+export function assertObject(value, keys, optional = []) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('expected an object');
+    const got = Object.keys(value);
+    if (got.some(k => !keys.includes(k) && !optional.includes(k)) || keys.some(k => !got.includes(k)))
+        throw new Error('unexpected or missing field');
+}
+// JSON.parse silently accepts duplicate identity keys. Check the token stream first.
+export function parseStrictJSON(source) {
+    if (Buffer.byteLength(source) > 8 * 1024 * 1024)
+        throw new Error('JSON input is too large');
+    let i = 0;
+    const ws = () => { while (i < source.length && /[ \t\r\n]/.test(source[i]))
+        i++; };
+    const quoted = () => {
+        const start = i++;
+        while (i < source.length) {
+            const ch = source[i++];
+            if (ch === '\\') {
+                i++;
+                continue;
+            }
+            if (ch === '"')
+                return JSON.parse(source.slice(start, i));
+        }
+        throw new Error('unterminated JSON string');
+    };
+    const scan = (depth) => {
+        if (depth > 32)
+            throw new Error('JSON nesting is too deep');
+        ws();
+        if (source[i] === '{') {
+            i++;
+            ws();
+            const seen = new Set();
+            const result = {};
+            if (source[i] === '}') {
+                i++;
+                return result;
+            }
+            for (;;) {
+                ws();
+                if (source[i] !== '"')
+                    throw new Error('invalid JSON object');
+                const key = quoted();
+                if (seen.has(key) || key === '__proto__' || key === 'constructor')
+                    throw new Error(`duplicate or unsafe JSON field: ${key}`);
+                seen.add(key);
+                ws();
+                if (source[i++] !== ':')
+                    throw new Error('invalid JSON object');
+                result[key] = scan(depth + 1);
+                ws();
+                const end = source[i++];
+                if (end === '}')
+                    return result;
+                if (end !== ',')
+                    throw new Error('invalid JSON object');
+            }
+        }
+        if (source[i] === '[') {
+            i++;
+            ws();
+            const result = [];
+            if (source[i] === ']') {
+                i++;
+                return result;
+            }
+            for (;;) {
+                result.push(scan(depth + 1));
+                ws();
+                const end = source[i++];
+                if (end === ']')
+                    return result;
+                if (end !== ',')
+                    throw new Error('invalid JSON array');
+            }
+        }
+        if (source[i] === '"')
+            return quoted();
+        const start = i;
+        while (i < source.length && !/[ \t\r\n,}\]]/.test(source[i]))
+            i++;
+        if (i === start)
+            throw new Error('invalid JSON value');
+        const token = source.slice(start, i);
+        const value = JSON.parse(token);
+        if (typeof value === 'number' && /^-?(?:0|[1-9][0-9]*)$/.test(token) && !Number.isSafeInteger(value))
+            return BigInt(token);
+        return value;
+    };
+    const value = scan(0);
+    ws();
+    if (i !== source.length)
+        throw new Error('trailing JSON content');
+    return value;
+}
+export function canonical(value) {
+    if (typeof value === 'bigint')
+        return value.toString();
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(',')}]`;
+    if (value && typeof value === 'object') {
+        const fields = Object.entries(value).filter(([, v]) => v !== undefined).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+        return `{${fields.map(([k, v]) => `${JSON.stringify(k)}:${canonical(v)}`).join(',')}}`;
+    }
+    return JSON.stringify(value);
+}
+export const digest = (value) => createHash('sha256').update(typeof value === 'string' ? value : canonical(value)).digest('hex');
+export function validateProject(value) {
+    assertObject(value, ['schema_version', 'project_id', 'package_name', 'signer_sha256', 'channels']);
+    if (value.schema_version !== 2 || !validId(value.project_id) || !validPackage(value.package_name) || !validHash(value.signer_sha256) || !Array.isArray(value.channels) || value.channels.length < 1 || value.channels.length > CHANNELS.length)
+        throw new Error('invalid project identity');
+    const seen = new Set();
+    for (const row of value.channels) {
+        assertObject(row, ['channel', 'account', 'app_id'], ['client_id', 'language_id', 'icon_path', 'privacy_url']);
+        if (!isChannel(row.channel) || seen.has(row.channel) || !validId(row.account) || !validId(row.app_id))
+            throw new Error('invalid or duplicate channel');
+        seen.add(row.channel);
+        if (row.client_id !== undefined && !validId(row.client_id))
+            throw new Error('invalid client_id');
+        if (row.language_id !== undefined && (!validText(row.language_id, 32) || !/^[A-Za-z][A-Za-z0-9_-]*$/.test(row.language_id)))
+            throw new Error('invalid language_id');
+        if (row.icon_path !== undefined && !validAbsolute(row.icon_path))
+            throw new Error('invalid icon_path');
+        if (row.privacy_url !== undefined) {
+            if (typeof row.privacy_url !== 'string')
+                throw new Error('invalid privacy_url');
+            const url = new URL(row.privacy_url);
+            if (url.protocol !== 'https:' || url.username || url.password || url.hash || url.search || !url.hostname)
+                throw new Error('invalid privacy_url');
+        }
+        if (row.channel === 'xiaomi' && (!row.icon_path || !row.privacy_url || !row.client_id))
+            throw new Error('Xiaomi needs client_id, icon_path and privacy_url');
+        if (['honor', 'vivo', 'tencent'].includes(row.channel) && !row.client_id)
+            throw new Error(`${row.channel} needs client_id`);
+    }
+    return value;
+}
+export function validateBatchInput(value) {
+    assertObject(value, ['schema_version', 'batch_id', 'project_id', 'release_notes_file', 'apks']);
+    if (value.schema_version !== 2 || !validId(value.batch_id) || !validId(value.project_id) || !validAbsolute(value.release_notes_file))
+        throw new Error('invalid batch input');
+    if (!value.apks || typeof value.apks !== 'object' || Array.isArray(value.apks) || !Object.keys(value.apks).length)
+        throw new Error('missing APK paths');
+    for (const [channel, apk] of Object.entries(value.apks))
+        if (!isChannel(channel) || !validAbsolute(apk))
+            throw new Error('invalid APK channel or path');
+    return value;
+}

package/build/private-file.js

@@ -0,0 +1,193 @@
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { parseStrictJSON } from './model.js';
+export const dataRoot = () => path.join(os.homedir(), 'Library', 'Application Support', 'AndroidPublisherCLI', 'v2');
+function noSymlinkAncestors(file) {
+    let current = path.dirname(file);
+    while (current !== path.dirname(current)) {
+        const st = fs.lstatSync(current);
+        if (st.isSymbolicLink() || !st.isDirectory())
+            throw new Error('file path contains a symbolic link');
+        current = path.dirname(current);
+    }
+}
+export function privateDir(dir) {
+    if (!path.isAbsolute(dir) || path.normalize(dir) !== dir)
+        throw new Error('directory must be an absolute normalized path');
+    const parts = dir.split(path.sep).filter(Boolean);
+    let current = path.sep;
+    for (const part of parts) {
+        current = path.join(current, part);
+        if (!fs.existsSync(current))
+            fs.mkdirSync(current, { mode: 0o700 });
+        const st = fs.lstatSync(current);
+        if (!st.isDirectory() || st.isSymbolicLink())
+            throw new Error('directory contains a symbolic link');
+    }
+    fs.chmodSync(dir, 0o700);
+}
+export function regularFile(file, maxBytes, privateOnly = false) {
+    if (!path.isAbsolute(file) || path.normalize(file) !== file)
+        throw new Error('file path must be absolute and normalized');
+    noSymlinkAncestors(file);
+    const st = fs.lstatSync(file);
+    if (!st.isFile() || st.isSymbolicLink() || st.size > maxBytes || st.size < 0)
+        throw new Error('file is not an allowed regular file');
+    if (privateOnly && ((st.mode & 0o077) !== 0 || st.uid !== process.getuid?.()))
+        throw new Error('file must belong to its owner and have mode 0600');
+    const fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+    try {
+        const opened = fs.fstatSync(fd);
+        if (!opened.isFile() || opened.ino !== st.ino || opened.dev !== st.dev || opened.size > maxBytes)
+            throw new Error('file changed while opening');
+        return fs.readFileSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+export function readJSON(file, maxBytes = 1024 * 1024, privateOnly = false) {
+    return parseStrictJSON(regularFile(file, maxBytes, privateOnly).toString('utf8'));
+}
+export function writePrivate(file, content, replace = false, createParents = false) {
+    if (!path.isAbsolute(file) || path.normalize(file) !== file)
+        throw new Error('output file path must be absolute');
+    if (createParents)
+        privateDir(path.dirname(file));
+    else
+        noSymlinkAncestors(file);
+    if (!replace && fs.existsSync(file))
+        throw new Error('file exists; choose a new path');
+    const temp = path.join(path.dirname(file), `.tmp-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`);
+    const fd = fs.openSync(temp, 'wx', 0o600);
+    try {
+        fs.writeFileSync(fd, content);
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    try {
+        if (replace) {
+            if (fs.existsSync(file) && !fs.lstatSync(file).isFile())
+                throw new Error('destination is not a regular file');
+            fs.renameSync(temp, file);
+        }
+        else {
+            fs.linkSync(temp, file);
+            fs.unlinkSync(temp);
+        }
+        const dir = fs.openSync(path.dirname(file), 'r');
+        try {
+            fs.fsyncSync(dir);
+        }
+        finally {
+            fs.closeSync(dir);
+        }
+    }
+    finally {
+        if (fs.existsSync(temp))
+            fs.unlinkSync(temp);
+    }
+}
+export function hashFile(file, maxBytes = 2 * 1024 * 1024 * 1024) {
+    const fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+    try {
+        const st = fs.fstatSync(fd);
+        if (!st.isFile() || st.size <= 0 || st.size > maxBytes)
+            throw new Error('file size or type is invalid');
+        const h = createHash('sha256');
+        const chunk = Buffer.allocUnsafe(1024 * 1024);
+        let pos = 0;
+        while (pos < st.size) {
+            const count = fs.readSync(fd, chunk, 0, Math.min(chunk.length, st.size - pos), pos);
+            if (count <= 0)
+                throw new Error('file changed while hashing');
+            h.update(chunk.subarray(0, count));
+            pos += count;
+        }
+        if (fs.fstatSync(fd).size !== st.size)
+            throw new Error('file changed while hashing');
+        return { sha256: h.digest('hex'), size: st.size };
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+export function md5File(file, expectedSHA256) {
+    if (hashFile(file).sha256 !== expectedSHA256)
+        throw new Error('frozen file changed');
+    const fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+    try {
+        const st = fs.fstatSync(fd);
+        const h = createHash('md5');
+        const chunk = Buffer.allocUnsafe(1024 * 1024);
+        let pos = 0;
+        while (pos < st.size) {
+            const count = fs.readSync(fd, chunk, 0, Math.min(chunk.length, st.size - pos), pos);
+            if (count <= 0)
+                throw new Error('frozen file changed');
+            h.update(chunk.subarray(0, count));
+            pos += count;
+        }
+        return h.digest('hex');
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+export function freezeFile(source, destination, expectedHash) {
+    privateDir(path.dirname(destination));
+    if (fs.existsSync(destination)) {
+        if (hashFile(destination).sha256 !== expectedHash)
+            throw new Error('frozen file differs from its saved hash');
+        return;
+    }
+    const temp = path.join(path.dirname(destination), `.freeze-${process.pid}-${Date.now()}`);
+    const src = fs.openSync(source, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+    const dst = fs.openSync(temp, 'wx', 0o600);
+    try {
+        const st = fs.fstatSync(src);
+        if (!st.isFile())
+            throw new Error('source is not a regular file');
+        const h = createHash('sha256');
+        const chunk = Buffer.allocUnsafe(1024 * 1024);
+        let pos = 0;
+        while (pos < st.size) {
+            const count = fs.readSync(src, chunk, 0, Math.min(chunk.length, st.size - pos), pos);
+            if (count <= 0)
+                throw new Error('source changed while freezing');
+            h.update(chunk.subarray(0, count));
+            let written = 0;
+            while (written < count)
+                written += fs.writeSync(dst, chunk, written, count - written);
+            pos += count;
+        }
+        fs.fsyncSync(dst);
+        if (h.digest('hex') !== expectedHash || fs.fstatSync(src).size !== st.size)
+            throw new Error('source changed while freezing');
+    }
+    catch (e) {
+        fs.closeSync(src);
+        fs.closeSync(dst);
+        fs.unlinkSync(temp);
+        throw e;
+    }
+    fs.closeSync(src);
+    fs.closeSync(dst);
+    try {
+        fs.linkSync(temp, destination);
+        const dir = fs.openSync(path.dirname(destination), 'r');
+        try {
+            fs.fsyncSync(dir);
+        }
+        finally {
+            fs.closeSync(dir);
+        }
+    }
+    finally {
+        fs.unlinkSync(temp);
+    }
+}