app-builder-lib 26.12.0 → 26.13.0

package/out/asar/asarFileChecker.d.ts

@@ -1,2 +1,2 @@
-import { FilesystemEntry } from "@electron/asar/lib/filesystem";
-export declare function checkFileInArchive(asarFile: string, relativeFile: string, messagePrefix: string): FilesystemEntry;
+import type { FilesystemEntry } from "@electron/asar/lib/filesystem";
+export declare function checkFileInArchive(asarFile: string, relativeFile: string, messagePrefix: string): Promise<FilesystemEntry>;

package/out/asar/asarFileChecker.js

@@ -1,8 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkFileInArchive = checkFileInArchive;
-const asar = require("@electron/asar");
-function checkFileInArchive(asarFile, relativeFile, messagePrefix) {
+const dynamicImport_1 = require("../util/dynamicImport");
+async function checkFileInArchive(asarFile, relativeFile, messagePrefix) {
+    const asar = await (0, dynamicImport_1.dynamicImport)("@electron/asar");
     function error(text) {
         return new Error(`${messagePrefix} "${relativeFile}" in the "${asarFile}" ${text}`);
     }

package/out/asar/asarFileChecker.js.map

@@ -1 +1 @@
-{"version":3,"file":"asarFileChecker.js","sourceRoot":"","sources":["../../src/asar/asarFileChecker.ts"],"names":[],"mappings":";;AAGA,gDAiBC;AApBD,uCAAsC;AAGtC,SAAgB,kBAAkB,CAAC,QAAgB,EAAE,YAAoB,EAAE,aAAqB;IAC9F,SAAS,KAAK,CAAC,IAAY;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,aAAa,KAAK,YAAY,aAAa,QAAQ,KAAK,IAAI,EAAE,CAAC,CAAA;IACrF,CAAC;IACD,IAAI,IAAqB,CAAA;IACzB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,CAAA;IACrD,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,sDAAsD,CAAC,EAAE,CAAC;YAC/E,MAAM,KAAK,CAAC,mDAAmD,CAAC,CAAA;QAClE,CAAC;QACD,MAAM,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAA;IACnC,CAAC;IACD,IAAK,IAA4B,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC","sourcesContent":["import * as asar from \"@electron/asar\"\nimport { FilesystemEntry, FilesystemFileEntry } from \"@electron/asar/lib/filesystem\"\n\nexport function checkFileInArchive(asarFile: string, relativeFile: string, messagePrefix: string) {\n  function error(text: string) {\n    return new Error(`${messagePrefix} \"${relativeFile}\" in the \"${asarFile}\" ${text}`)\n  }\n  let stat: FilesystemEntry\n  try {\n    stat = asar.statFile(asarFile, relativeFile, false)\n  } catch (e: any) {\n    if (e.message.includes(\"Cannot read properties of undefined (reading 'link')\")) {\n      throw error(\"does not exist. Seems like a wrong configuration.\")\n    }\n    throw error(`is corrupted: ${e}`)\n  }\n  if ((stat as FilesystemFileEntry).size === 0) {\n    throw error(`is corrupted: size 0`)\n  }\n  return stat\n}\n"]}
+{"version":3,"file":"asarFileChecker.js","sourceRoot":"","sources":["../../src/asar/asarFileChecker.ts"],"names":[],"mappings":";;AAGA,gDAkBC;AApBD,yDAAqD;AAE9C,KAAK,UAAU,kBAAkB,CAAC,QAAgB,EAAE,YAAoB,EAAE,aAAqB;IACpG,MAAM,IAAI,GAAG,MAAM,IAAA,6BAAa,EAAkC,gBAAgB,CAAC,CAAA;IACnF,SAAS,KAAK,CAAC,IAAY;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,aAAa,KAAK,YAAY,aAAa,QAAQ,KAAK,IAAI,EAAE,CAAC,CAAA;IACrF,CAAC;IACD,IAAI,IAAqB,CAAA;IACzB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,CAAA;IACrD,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,sDAAsD,CAAC,EAAE,CAAC;YAC/E,MAAM,KAAK,CAAC,mDAAmD,CAAC,CAAA;QAClE,CAAC;QACD,MAAM,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAA;IACnC,CAAC;IACD,IAAK,IAA4B,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC","sourcesContent":["import type { FilesystemEntry, FilesystemFileEntry } from \"@electron/asar/lib/filesystem\"\nimport { dynamicImport } from \"../util/dynamicImport\"\n\nexport async function checkFileInArchive(asarFile: string, relativeFile: string, messagePrefix: string) {\n  const asar = await dynamicImport<typeof import(\"@electron/asar\")>(\"@electron/asar\")\n  function error(text: string) {\n    return new Error(`${messagePrefix} \"${relativeFile}\" in the \"${asarFile}\" ${text}`)\n  }\n  let stat: FilesystemEntry\n  try {\n    stat = asar.statFile(asarFile, relativeFile, false)\n  } catch (e: any) {\n    if (e.message.includes(\"Cannot read properties of undefined (reading 'link')\")) {\n      throw error(\"does not exist. Seems like a wrong configuration.\")\n    }\n    throw error(`is corrupted: ${e}`)\n  }\n  if ((stat as FilesystemFileEntry).size === 0) {\n    throw error(`is corrupted: size 0`)\n  }\n  return stat\n}\n"]}

package/out/asar/asarUtil.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AsarPackager = void 0;
-const asar_1 = require("@electron/asar");
 const builder_util_1 = require("builder-util");
+const dynamicImport_1 = require("../util/dynamicImport");
 const fs_1 = require("builder-util/out/fs");
 const fs = require("fs-extra");
 const fs_extra_1 = require("fs-extra");
@@ -61,7 +61,8 @@ class AsarPackager {
             }
             builder_util_1.log.info({ args }, "logging @electron/asar");
         };
-        await (0, asar_1.createPackageFromStreams)(this.outFile, streams);
+        const { createPackageFromStreams } = await (0, dynamicImport_1.dynamicImport)("@electron/asar");
+        await createPackageFromStreams(this.outFile, streams);
         console.log = consoleLogger;
     }
     async processFileSets(fileSets) {

package/out/asar/asarUtil.js.map

@@ -1 +1 @@
-{"version":3,"file":"asarUtil.js","sourceRoot":"","sources":["../../src/asar/asarUtil.ts"],"names":[],"mappings":";;;AAAA,yCAAwF;AACxF,+CAAmD;AACnD,4CAAiE;AACjE,+BAA8B;AAC9B,uCAAmC;AACnC,6BAA4B;AAG5B,yDAA2E;AAC3E,qDAAqD;AACrD,mCAAiC;AACjC,yBAAwB;AAExB,MAAM,WAAW,GAAG,KAAK,EAAE,IAAwB,EAA+B,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,IAAA,WAAM,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;AACnL,MAAM,YAAY,GAAG,KAAK,EAAE,SAAiC,EAAE,EAAE;IAC/D,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,CAAA;AAC9G,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,YAAY,CAAC;IAC5B,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IAEN,MAAM;IACN,MAAM,EAAE,gLAAgL;IAExL,2BAA2B;IAC3B,SAAS;IACT,UAAU;IACV,UAAU;IAEV,6BAA6B;IAC7B,OAAO,CAAC,GAAG,CAAC,UAAU;IACtB,OAAO,CAAC,GAAG,CAAC,MAAM;CACnB,CAAC,CAAA;AAEF,MAAM,SAAS,GAAG,YAAY,CAAC;IAC7B,EAAE,CAAC,MAAM,EAAE,EAAE,wBAAwB;IACrC,EAAE,CAAC,OAAO,EAAE,EAAE,wBAAwB;CACvC,CAAC,CAAA;AAEF,gBAAgB;AAChB,MAAa,YAAY;IAGvB,YACW,QAA+B,EACvB,MAKhB;QANQ,aAAQ,GAAR,QAAQ,CAAuB;QACvB,WAAM,GAAN,MAAM,CAKtB;QAED,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,CAAA;IAC3D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgC;QACzC,MAAM,eAAe,GAAG;YACtB,qEAAqE;YACrE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAEpB,mDAAmD;YACnD,QAAQ,CAAC,CAAC,CAAC;SACZ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;QAEpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,CAAA;QAC3D,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAA;IACzC,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,OAAyB;QACzD,6IAA6I;QAC7I,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAA;QACjC,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE;YACxB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,kCAAkC,EAAE,CAAC;gBACnD,OAAM,CAAC,qEAAqE;YAC9E,CAAC;YACD,kBAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,wBAAwB,CAAC,CAAA;QAC9C,CAAC,CAAA;QACD,MAAM,IAAA,+BAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACrD,OAAO,CAAC,GAAG,GAAG,aAAa,CAAA;IAC7B,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,QAA2B;;QACvD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAA;QACvC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;YAC9C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,IAAA,mCAAkB,EAAC,OAAO,EAAE,aAAa,CAAC,CAAA;YAC5C,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAA;QACpD,MAAM,cAAc,GAAa,EAAE,CAAA;QACnC,MAAM,uBAAuB,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;QAErF,8GAA8G;QAC9G,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,IAAa,EAAE,IAAkB,EAAW,EAAE;;YAC7E,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;YAEzC,2CAA2C;YAC3C,IAAI,CAAC,IAAA,8BAAe,EAAC,IAAI,CAAC,IAAI,IAAI,KAAI,MAAA,MAAA,IAAI,CAAC,MAAM,EAAC,aAAa,mDAAG,IAAI,EAAE,IAAI,CAAC,CAAA,EAAE,CAAC;gBAC9E,OAAO,IAAI,CAAA;YACb,CAAC;YAED,iDAAiD;YACjD,KAAK,MAAM,YAAY,IAAI,uBAAuB,EAAE,CAAC;gBACnD,IAAI,aAAa,KAAK,YAAY,IAAI,aAAa,CAAC,UAAU,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxF,OAAO,IAAI,CAAA;gBACb,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAA;QACd,CAAC,CAAA;QAED,4EAA4E;QAC5E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,4GAA4G;YAC5G,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;gBACpD,MAAM,eAAe,GAAG,MAAA,OAAO,CAAC,gBAAgB,0CAAE,GAAG,CAAC,KAAK,CAAC,CAAA;gBAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAE,CAAA;gBACxC,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,IAAA,kCAAkB,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;gBAEpG,yDAAyD;gBACzD,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,UAAU,EAAE,cAAc,CAAC,CAAA;gBAErE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC;oBAC7C,IAAI;oBACJ,WAAW;oBACX,OAAO;oBACP,eAAe;oBACf,IAAI;oBACJ,UAAU;iBACX,CAAC,CAAA;gBAEF,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC3C,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;oBACnC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;QAED,6DAA6D;QAC7D,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnB,IAAI,CAAC,+BAA+B,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;YAC1E,CAAC;QACH,CAAC;QAED,yDAAyD;QACzD,OAAO,cAAc,CAAC,MAAM,CAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;YAC/D,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACjE,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACtB,CAAC;YACD,OAAO,OAAO,CAAA;QAChB,CAAC,EAAE,EAAE,CAAC,CAAA;IACR,CAAC;IAEO,uBAAuB,CAAC,WAAmB,EAAE,UAAuC,EAAE,cAAwB;QACpH,MAAM,OAAO,GAAa,EAAE,CAAA;QAC5B,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAA;QAEvD,sDAAsD;QACtD,OAAO,OAAO,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YACxB,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACjC,CAAC;QAED,oDAAoD;QACpD,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,MAAM,GAAG,GAAkB;oBACzB,IAAI,EAAE,WAAW;oBACjB,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE,KAAK,EAAE,mCAAmC;iBACrD,CAAA;gBACD,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;gBAC/B,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAEO,+BAA+B,CAAC,WAAmB,EAAE,UAAuC,EAAE,UAAqC;QACzI,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAA;QAEvD,OAAO,OAAO,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACrC,IAAI,KAAK,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAA;YACvB,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,OAOlC;QACC,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;QACxE,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QAEpD,qBAAqB;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC7C,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QAC3D,CAAC;QAED,kDAAkD;QAClD,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,CAAA;YAC/C,OAAO;gBACL,IAAI,EAAE,WAAW;gBACjB,eAAe,EAAE,GAAG,EAAE,CACpB,IAAI,iBAAQ,CAAC;oBACX,IAAI;wBACF,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;wBAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;oBACjB,CAAC;iBACF,CAAC;gBACJ,QAAQ;gBACR,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;aAChC,CAAA;QACH,CAAC;QAED,sFAAsF;QACtF,MAAM,IAAI,CAAC,2BAA2B,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAA;QAEzF,MAAM,UAAU,GAAG;YACjB,IAAI,EAAE,WAAW;YACjB,eAAe,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;YAChD,QAAQ;YACR,IAAI;SACL,CAAA;QAED,uBAAuB;QACvB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,OAAO,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QACxC,CAAC;QAED,qDAAqD;QACrD,IAAI,IAAI,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAI,CAAC,CAAA;QAC/B,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAA;QAChD,CAAC;QAED,OAAO;YACL,GAAG,UAAU;YACb,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,IAAI;SACd,CAAA;IACH,CAAC;IAEO,YAAY,CAAC,OAAwB;QAC3C,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;QAE7D,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE;YACtC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACZ,OAAO,CAAC,CAAA;YACV,CAAC;YAED,8DAA8D;YAC9D,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YACpC,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YACpC,IAAI,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,OAAO,CAAC,CAAA;YACV,CAAC;YACD,IAAI,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,OAAO,CAAC,CAAC,CAAA;YACX,CAAC;YAED,0BAA0B;YAC1B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACvB,CAAC,CAAC,CAAA;QAEF,IAAI,gBAA0D,CAAA;QAC9D,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC7B,gBAAgB,GAAG,IAAI,GAAG,EAAE,CAAA;YAE5B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAA;YAC1C,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,iBAAiB,CAAC,OAAO,EAAE,EAAE,CAAC;gBACjE,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;YAClC,CAAC;YAED,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBACzD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;gBACvC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC3B,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,+BAA+B,CAAC,CAAA;gBAC5F,CAAC;gBACD,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;YACvC,CAAC;QACH,CAAC;QAED,OAAO;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC;YAChD,gBAAgB;SACjB,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,UAAoB;QAClE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAA;QAC1C,IAAI,QAAQ,IAAI,IAAI,IAAI,IAAA,8BAAe,EAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,OAAO,KAAK,CAAA;QACd,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9D,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAEO,KAAK,CAAC,2BAA2B,CAAC,IAAY,EAAE,aAAqB;QAC3E,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAA;QACxC,MAAM,SAAS,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;QAEtD,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,CAAA;QAElD,+BAA+B;QAC/B,IAAI,SAAS,KAAI,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,UAAU,CAAC,SAAS,CAAC,CAAA,EAAE,CAAC;YACjD,OAAM;QACR,CAAC;QAED,6BAA6B;QAC7B,IAAI,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,SAAS,CAAC,EAAE,CAAC;YACxD,OAAM;QACR,CAAC;QAED,iBAAiB;QACjB,IAAI,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,QAAQ,CAAC,EAAE,CAAC;YACvD,kBAAG,CAAC,KAAK,CAAC,SAAS,EAAE,wCAAwC,CAAC,CAAA;YAC9D,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,wBAAwB,QAAQ,kDAAkD,CAAC,CAAA;QAC9H,CAAC;QAED,4DAA4D;QAC5D,kBAAG,CAAC,KAAK,CAAC,SAAS,EAAE,4DAA4D,CAAC,CAAA;IACpF,CAAC;CACF;AA9SD,oCA8SC","sourcesContent":["import { createPackageFromStreams, AsarStreamType, AsarDirectory } from \"@electron/asar\"\nimport { isEmptyOrSpaces, log } from \"builder-util\"\nimport { exists, Filter, FilterStats } from \"builder-util/out/fs\"\nimport * as fs from \"fs-extra\"\nimport { readlink } from \"fs-extra\"\nimport * as path from \"path\"\nimport { AsarOptions } from \"../options/PlatformSpecificBuildOptions\"\nimport { PlatformPackager } from \"../platformPackager\"\nimport { ResolvedFileSet, getDestinationPath } from \"../util/appFileCopier\"\nimport { detectUnpackedDirs } from \"./unpackDetector\"\nimport { Readable } from \"stream\"\nimport * as os from \"os\"\n\nconst resolvePath = async (file: string | undefined): Promise<string | undefined> => (file && (await exists(file)) ? fs.realpath(file).catch(() => path.resolve(file)) : undefined)\nconst resolvePaths = async (filepaths: (string | undefined)[]) => {\n  return Promise.all(filepaths.map(resolvePath)).then(paths => paths.filter((it): it is string => it != null))\n}\n\nconst DENYLIST = resolvePaths([\n  \"/usr\",\n  \"/lib\",\n  \"/bin\",\n  \"/sbin\",\n  \"/etc\",\n\n  \"/tmp\",\n  \"/var\", // block whole /var by default. If $HOME is under /var, it's explicitly in ALLOWLIST - https://github.com/electron-userland/electron-builder/issues/9025#issuecomment-3575380041\n\n  // macOS system directories\n  \"/System\",\n  \"/Library\",\n  \"/private\",\n\n  // Windows system directories\n  process.env.SystemRoot,\n  process.env.WINDIR,\n])\n\nconst ALLOWLIST = resolvePaths([\n  os.tmpdir(), // always allow temp dir\n  os.homedir(), // always allow home dir\n])\n\n/** @internal */\nexport class AsarPackager {\n  private readonly outFile: string\n\n  constructor(\n    readonly packager: PlatformPackager<any>,\n    private readonly config: {\n      defaultDestination: string\n      resourcePath: string\n      options: AsarOptions\n      unpackPattern: Filter | undefined\n    }\n  ) {\n    this.outFile = path.join(config.resourcePath, `app.asar`)\n  }\n\n  async pack(fileSets: Array<ResolvedFileSet>) {\n    const orderedFileSets = [\n      // Write dependencies first to minimize offset changes to asar header\n      ...fileSets.slice(1),\n\n      // Finish with the app files that change most often\n      fileSets[0],\n    ].map(set => this.orderFileSet(set))\n\n    const streams = await this.processFileSets(orderedFileSets)\n    await this.executeElectronAsar(streams)\n  }\n\n  private async executeElectronAsar(streams: AsarStreamType[]) {\n    // override logger temporarily to clean up console (electron/asar does some internal logging that blogs up the default electron-builder logs)\n    const consoleLogger = console.log\n    console.log = (...args) => {\n      if (args[0] === \"Ordering file has 100% coverage.\") {\n        return // no need to log, this means our ordering logic is working correctly\n      }\n      log.info({ args }, \"logging @electron/asar\")\n    }\n    await createPackageFromStreams(this.outFile, streams)\n    console.log = consoleLogger\n  }\n\n  private async processFileSets(fileSets: ResolvedFileSet[]): Promise<AsarStreamType[]> {\n    const unpackedPaths = new Set<string>()\n    if (this.config.options.smartUnpack !== false) {\n      for (const fileSet of fileSets) {\n        detectUnpackedDirs(fileSet, unpackedPaths)\n      }\n    }\n\n    const resultsMap = new Map<string, AsarStreamType>()\n    const streamOrdering: string[] = []\n    const normalizedUnpackedPaths = Array.from(unpackedPaths).map(p => path.normalize(p))\n\n    // Check whether a file or directory should be unpacked, using pre-normalized unpacked paths and early returns\n    const isUnpacked = (dir: string, file?: string, stat?: FilterStats): boolean => {\n      const normalizedDir = path.normalize(dir)\n\n      // Check file pattern first (most specific)\n      if (!isEmptyOrSpaces(file) && stat && this.config.unpackPattern?.(file, stat)) {\n        return true\n      }\n\n      // Check if path is within any unpacked directory\n      for (const unpackedPath of normalizedUnpackedPaths) {\n        if (normalizedDir === unpackedPath || normalizedDir.startsWith(unpackedPath + path.sep)) {\n          return true\n        }\n      }\n\n      return false\n    }\n\n    // First pass: process all files in order, ensuring parent directories exist\n    for (const fileSet of fileSets) {\n      // Don't use Promise.all, we need to retain order of execution/iteration through the already-ordered fileset\n      for (const [index, file] of fileSet.files.entries()) {\n        const transformedData = fileSet.transformedFiles?.get(index)\n        const stat = fileSet.metadata.get(file)!\n        const destination = path.relative(this.config.defaultDestination, getDestinationPath(file, fileSet))\n\n        // Ensure parent directories exist before processing file\n        this.ensureParentDirectories(destination, resultsMap, streamOrdering)\n\n        const result = await this.processFileOrSymlink({\n          file,\n          destination,\n          fileSet,\n          transformedData,\n          stat,\n          isUnpacked,\n        })\n\n        if (result && !resultsMap.has(result.path)) {\n          resultsMap.set(result.path, result)\n          streamOrdering.push(result.path)\n        }\n      }\n    }\n\n    // Second pass: propagate unpacked flag to parent directories\n    for (const entry of resultsMap.values()) {\n      if (entry.unpacked) {\n        this.markParentDirectoriesAsUnpacked(entry.path, resultsMap, isUnpacked)\n      }\n    }\n\n    // Build final results array maintaining processing order\n    return streamOrdering.reduce<AsarStreamType[]>((streams, path) => {\n      const stream = resultsMap.has(path) ? resultsMap.get(path) : null\n      if (stream != null) {\n        streams.push(stream)\n      }\n      return streams\n    }, [])\n  }\n\n  private ensureParentDirectories(destination: string, resultsMap: Map<string, AsarStreamType>, streamOrdering: string[]): void {\n    const parents: string[] = []\n    let current = path.dirname(path.normalize(destination))\n\n    // Collect all parent directories from deepest to root\n    while (current !== \".\") {\n      parents.unshift(current)\n      current = path.dirname(current)\n    }\n\n    // Add parent directories in order (root to deepest)\n    for (const parentPath of parents) {\n      if (!resultsMap.has(parentPath)) {\n        const dir: AsarDirectory = {\n          type: \"directory\",\n          path: parentPath,\n          unpacked: false, // Updated in second pass if needed\n        }\n        resultsMap.set(parentPath, dir)\n        streamOrdering.push(parentPath)\n      }\n    }\n  }\n\n  private markParentDirectoriesAsUnpacked(destination: string, resultsMap: Map<string, AsarStreamType>, isUnpacked: (path: string) => boolean): void {\n    let current = path.dirname(path.normalize(destination))\n\n    while (current !== \".\") {\n      const entry = resultsMap.get(current)\n      if (entry && isUnpacked(current)) {\n        entry.unpacked = true\n      }\n      current = path.dirname(current)\n    }\n  }\n\n  private async processFileOrSymlink(options: {\n    file: string\n    destination: string\n    stat: fs.Stats\n    fileSet: ResolvedFileSet\n    transformedData: string | Buffer | undefined\n    isUnpacked: (dir: string, file?: string, stat?: FilterStats) => boolean\n  }): Promise<AsarStreamType> {\n    const { isUnpacked, transformedData, file, destination, stat } = options\n    const unpacked = isUnpacked(destination, file, stat)\n\n    // Handle directories\n    if (!stat.isFile() && !stat.isSymbolicLink()) {\n      return { path: destination, unpacked, type: \"directory\" }\n    }\n\n    // Handle transformed data (pre-processed content)\n    if (transformedData != null) {\n      const size = Buffer.byteLength(transformedData)\n      return {\n        path: destination,\n        streamGenerator: () =>\n          new Readable({\n            read() {\n              this.push(transformedData)\n              this.push(null)\n            },\n          }),\n        unpacked,\n        type: \"file\",\n        stat: { mode: stat.mode, size },\n      }\n    }\n\n    // verify that the file is not a direct link or symlinked to access/copy a system file\n    await this.protectSystemAndUnsafePaths(file, await this.packager.info.getWorkspaceRoot())\n\n    const baseConfig = {\n      path: destination,\n      streamGenerator: () => fs.createReadStream(file),\n      unpacked,\n      stat,\n    }\n\n    // Handle regular files\n    if (!stat.isSymbolicLink()) {\n      return { ...baseConfig, type: \"file\" }\n    }\n\n    // Handle symlinks - make relative to source location\n    let link = await readlink(file)\n    if (path.isAbsolute(link)) {\n      link = path.relative(path.dirname(file), link)\n    }\n\n    return {\n      ...baseConfig,\n      type: \"link\",\n      symlink: link,\n    }\n  }\n\n  private orderFileSet(fileSet: ResolvedFileSet): ResolvedFileSet {\n    const sortedFileEntries = Array.from(fileSet.files.entries())\n\n    sortedFileEntries.sort(([, a], [, b]) => {\n      if (a === b) {\n        return 0\n      }\n\n      // Place addons last because their signature changes per build\n      const isAAddon = a.endsWith(\".node\")\n      const isBAddon = b.endsWith(\".node\")\n      if (isAAddon && !isBAddon) {\n        return 1\n      }\n      if (isBAddon && !isAAddon) {\n        return -1\n      }\n\n      // Otherwise order by name\n      return a < b ? -1 : 1\n    })\n\n    let transformedFiles: Map<number, string | Buffer> | undefined\n    if (fileSet.transformedFiles) {\n      transformedFiles = new Map()\n\n      const indexMap = new Map<number, number>()\n      for (const [newIndex, [oldIndex]] of sortedFileEntries.entries()) {\n        indexMap.set(oldIndex, newIndex)\n      }\n\n      for (const [oldIndex, value] of fileSet.transformedFiles) {\n        const newIndex = indexMap.get(oldIndex)\n        if (newIndex === undefined) {\n          throw new Error(`Internal error: ${fileSet.files[oldIndex]} was lost while ordering asar`)\n        }\n        transformedFiles.set(newIndex, value)\n      }\n    }\n\n    return {\n      src: fileSet.src,\n      destination: fileSet.destination,\n      metadata: fileSet.metadata,\n      files: sortedFileEntries.map(([, file]) => file),\n      transformedFiles,\n    }\n  }\n\n  private async checkAgainstRoots(target: string, allowRoots: string[]): Promise<boolean> {\n    const resolved = await resolvePath(target)\n    if (resolved == null || isEmptyOrSpaces(resolved)) {\n      return false\n    }\n\n    for (const root of allowRoots) {\n      if (resolved === root || resolved.startsWith(root + path.sep)) {\n        return true\n      }\n    }\n    return false\n  }\n\n  private async protectSystemAndUnsafePaths(file: string, workspaceRoot: string): Promise<void> {\n    const resolved = await resolvePath(file)\n    const logFields = { source: file, realPath: resolved }\n\n    const workspace = await resolvePath(workspaceRoot)\n\n    // If in workspace, always safe\n    if (workspace && resolved?.startsWith(workspace)) {\n      return\n    }\n\n    // Check allowlist (priority)\n    if (await this.checkAgainstRoots(file, await ALLOWLIST)) {\n      return\n    }\n\n    // Check denylist\n    if (await this.checkAgainstRoots(file, await DENYLIST)) {\n      log.error(logFields, `denied access to system or unsafe path`)\n      throw new Error(`Cannot copy file [${file}] symlinked to file [${resolved}] outside the package to a system or unsafe path`)\n    }\n\n    // Default: outside explicit paths but not explicitly denied\n    log.debug(logFields, `path is outside of explicit safe paths, defaulting to safe`)\n  }\n}\n"]}
+{"version":3,"file":"asarUtil.js","sourceRoot":"","sources":["../../src/asar/asarUtil.ts"],"names":[],"mappings":";;;AACA,+CAAmD;AACnD,yDAAqD;AACrD,4CAAiE;AACjE,+BAA8B;AAC9B,uCAAmC;AACnC,6BAA4B;AAG5B,yDAA2E;AAC3E,qDAAqD;AACrD,mCAAiC;AACjC,yBAAwB;AAExB,MAAM,WAAW,GAAG,KAAK,EAAE,IAAwB,EAA+B,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,IAAA,WAAM,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;AACnL,MAAM,YAAY,GAAG,KAAK,EAAE,SAAiC,EAAE,EAAE;IAC/D,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,CAAA;AAC9G,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,YAAY,CAAC;IAC5B,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IAEN,MAAM;IACN,MAAM,EAAE,gLAAgL;IAExL,2BAA2B;IAC3B,SAAS;IACT,UAAU;IACV,UAAU;IAEV,6BAA6B;IAC7B,OAAO,CAAC,GAAG,CAAC,UAAU;IACtB,OAAO,CAAC,GAAG,CAAC,MAAM;CACnB,CAAC,CAAA;AAEF,MAAM,SAAS,GAAG,YAAY,CAAC;IAC7B,EAAE,CAAC,MAAM,EAAE,EAAE,wBAAwB;IACrC,EAAE,CAAC,OAAO,EAAE,EAAE,wBAAwB;CACvC,CAAC,CAAA;AAEF,gBAAgB;AAChB,MAAa,YAAY;IAGvB,YACW,QAA+B,EACvB,MAKhB;QANQ,aAAQ,GAAR,QAAQ,CAAuB;QACvB,WAAM,GAAN,MAAM,CAKtB;QAED,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,CAAA;IAC3D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAgC;QACzC,MAAM,eAAe,GAAG;YACtB,qEAAqE;YACrE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAEpB,mDAAmD;YACnD,QAAQ,CAAC,CAAC,CAAC;SACZ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;QAEpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,eAAe,CAAC,CAAA;QAC3D,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAA;IACzC,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,OAAyB;QACzD,6IAA6I;QAC7I,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAA;QACjC,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE;YACxB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,kCAAkC,EAAE,CAAC;gBACnD,OAAM,CAAC,qEAAqE;YAC9E,CAAC;YACD,kBAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,wBAAwB,CAAC,CAAA;QAC9C,CAAC,CAAA;QACD,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,IAAA,6BAAa,EAAkC,gBAAgB,CAAC,CAAA;QAC3G,MAAM,wBAAwB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACrD,OAAO,CAAC,GAAG,GAAG,aAAa,CAAA;IAC7B,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,QAA2B;;QACvD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAA;QACvC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;YAC9C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,IAAA,mCAAkB,EAAC,OAAO,EAAE,aAAa,CAAC,CAAA;YAC5C,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAA;QACpD,MAAM,cAAc,GAAa,EAAE,CAAA;QACnC,MAAM,uBAAuB,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;QAErF,8GAA8G;QAC9G,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,IAAa,EAAE,IAAkB,EAAW,EAAE;;YAC7E,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;YAEzC,2CAA2C;YAC3C,IAAI,CAAC,IAAA,8BAAe,EAAC,IAAI,CAAC,IAAI,IAAI,KAAI,MAAA,MAAA,IAAI,CAAC,MAAM,EAAC,aAAa,mDAAG,IAAI,EAAE,IAAI,CAAC,CAAA,EAAE,CAAC;gBAC9E,OAAO,IAAI,CAAA;YACb,CAAC;YAED,iDAAiD;YACjD,KAAK,MAAM,YAAY,IAAI,uBAAuB,EAAE,CAAC;gBACnD,IAAI,aAAa,KAAK,YAAY,IAAI,aAAa,CAAC,UAAU,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxF,OAAO,IAAI,CAAA;gBACb,CAAC;YACH,CAAC;YAED,OAAO,KAAK,CAAA;QACd,CAAC,CAAA;QAED,4EAA4E;QAC5E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,4GAA4G;YAC5G,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;gBACpD,MAAM,eAAe,GAAG,MAAA,OAAO,CAAC,gBAAgB,0CAAE,GAAG,CAAC,KAAK,CAAC,CAAA;gBAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAE,CAAA;gBACxC,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,IAAA,kCAAkB,EAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;gBAEpG,yDAAyD;gBACzD,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,UAAU,EAAE,cAAc,CAAC,CAAA;gBAErE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC;oBAC7C,IAAI;oBACJ,WAAW;oBACX,OAAO;oBACP,eAAe;oBACf,IAAI;oBACJ,UAAU;iBACX,CAAC,CAAA;gBAEF,IAAI,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC3C,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;oBACnC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;QAED,6DAA6D;QAC7D,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnB,IAAI,CAAC,+BAA+B,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,CAAA;YAC1E,CAAC;QACH,CAAC;QAED,yDAAyD;QACzD,OAAO,cAAc,CAAC,MAAM,CAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;YAC/D,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACjE,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACtB,CAAC;YACD,OAAO,OAAO,CAAA;QAChB,CAAC,EAAE,EAAE,CAAC,CAAA;IACR,CAAC;IAEO,uBAAuB,CAAC,WAAmB,EAAE,UAAuC,EAAE,cAAwB;QACpH,MAAM,OAAO,GAAa,EAAE,CAAA;QAC5B,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAA;QAEvD,sDAAsD;QACtD,OAAO,OAAO,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YACxB,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACjC,CAAC;QAED,oDAAoD;QACpD,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,MAAM,GAAG,GAAkB;oBACzB,IAAI,EAAE,WAAW;oBACjB,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE,KAAK,EAAE,mCAAmC;iBACrD,CAAA;gBACD,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;gBAC/B,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAEO,+BAA+B,CAAC,WAAmB,EAAE,UAAuC,EAAE,UAAqC;QACzI,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAA;QAEvD,OAAO,OAAO,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACrC,IAAI,KAAK,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAA;YACvB,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,OAOlC;QACC,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;QACxE,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QAEpD,qBAAqB;QACrB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC7C,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QAC3D,CAAC;QAED,kDAAkD;QAClD,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,CAAA;YAC/C,OAAO;gBACL,IAAI,EAAE,WAAW;gBACjB,eAAe,EAAE,GAAG,EAAE,CACpB,IAAI,iBAAQ,CAAC;oBACX,IAAI;wBACF,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;wBAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;oBACjB,CAAC;iBACF,CAAC;gBACJ,QAAQ;gBACR,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;aAChC,CAAA;QACH,CAAC;QAED,sFAAsF;QACtF,MAAM,IAAI,CAAC,2BAA2B,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAA;QAEzF,MAAM,UAAU,GAAG;YACjB,IAAI,EAAE,WAAW;YACjB,eAAe,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;YAChD,QAAQ;YACR,IAAI;SACL,CAAA;QAED,uBAAuB;QACvB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,OAAO,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;QACxC,CAAC;QAED,qDAAqD;QACrD,IAAI,IAAI,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAI,CAAC,CAAA;QAC/B,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAA;QAChD,CAAC;QAED,OAAO;YACL,GAAG,UAAU;YACb,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,IAAI;SACd,CAAA;IACH,CAAC;IAEO,YAAY,CAAC,OAAwB;QAC3C,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;QAE7D,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE;YACtC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACZ,OAAO,CAAC,CAAA;YACV,CAAC;YAED,8DAA8D;YAC9D,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YACpC,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;YACpC,IAAI,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,OAAO,CAAC,CAAA;YACV,CAAC;YACD,IAAI,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC1B,OAAO,CAAC,CAAC,CAAA;YACX,CAAC;YAED,0BAA0B;YAC1B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACvB,CAAC,CAAC,CAAA;QAEF,IAAI,gBAA0D,CAAA;QAC9D,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC7B,gBAAgB,GAAG,IAAI,GAAG,EAAE,CAAA;YAE5B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAA;YAC1C,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,iBAAiB,CAAC,OAAO,EAAE,EAAE,CAAC;gBACjE,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;YAClC,CAAC;YAED,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;gBACzD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;gBACvC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC3B,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,+BAA+B,CAAC,CAAA;gBAC5F,CAAC;gBACD,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;YACvC,CAAC;QACH,CAAC;QAED,OAAO;YACL,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC;YAChD,gBAAgB;SACjB,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,MAAc,EAAE,UAAoB;QAClE,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAA;QAC1C,IAAI,QAAQ,IAAI,IAAI,IAAI,IAAA,8BAAe,EAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,OAAO,KAAK,CAAA;QACd,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9D,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAEO,KAAK,CAAC,2BAA2B,CAAC,IAAY,EAAE,aAAqB;QAC3E,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAA;QACxC,MAAM,SAAS,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;QAEtD,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,CAAA;QAElD,+BAA+B;QAC/B,IAAI,SAAS,KAAI,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,UAAU,CAAC,SAAS,CAAC,CAAA,EAAE,CAAC;YACjD,OAAM;QACR,CAAC;QAED,6BAA6B;QAC7B,IAAI,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,SAAS,CAAC,EAAE,CAAC;YACxD,OAAM;QACR,CAAC;QAED,iBAAiB;QACjB,IAAI,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,QAAQ,CAAC,EAAE,CAAC;YACvD,kBAAG,CAAC,KAAK,CAAC,SAAS,EAAE,wCAAwC,CAAC,CAAA;YAC9D,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,wBAAwB,QAAQ,kDAAkD,CAAC,CAAA;QAC9H,CAAC;QAED,4DAA4D;QAC5D,kBAAG,CAAC,KAAK,CAAC,SAAS,EAAE,4DAA4D,CAAC,CAAA;IACpF,CAAC;CACF;AA/SD,oCA+SC","sourcesContent":["import type { AsarStreamType, AsarDirectory } from \"@electron/asar\"\nimport { isEmptyOrSpaces, log } from \"builder-util\"\nimport { dynamicImport } from \"../util/dynamicImport\"\nimport { exists, Filter, FilterStats } from \"builder-util/out/fs\"\nimport * as fs from \"fs-extra\"\nimport { readlink } from \"fs-extra\"\nimport * as path from \"path\"\nimport { AsarOptions } from \"../options/PlatformSpecificBuildOptions\"\nimport { PlatformPackager } from \"../platformPackager\"\nimport { ResolvedFileSet, getDestinationPath } from \"../util/appFileCopier\"\nimport { detectUnpackedDirs } from \"./unpackDetector\"\nimport { Readable } from \"stream\"\nimport * as os from \"os\"\n\nconst resolvePath = async (file: string | undefined): Promise<string | undefined> => (file && (await exists(file)) ? fs.realpath(file).catch(() => path.resolve(file)) : undefined)\nconst resolvePaths = async (filepaths: (string | undefined)[]) => {\n  return Promise.all(filepaths.map(resolvePath)).then(paths => paths.filter((it): it is string => it != null))\n}\n\nconst DENYLIST = resolvePaths([\n  \"/usr\",\n  \"/lib\",\n  \"/bin\",\n  \"/sbin\",\n  \"/etc\",\n\n  \"/tmp\",\n  \"/var\", // block whole /var by default. If $HOME is under /var, it's explicitly in ALLOWLIST - https://github.com/electron-userland/electron-builder/issues/9025#issuecomment-3575380041\n\n  // macOS system directories\n  \"/System\",\n  \"/Library\",\n  \"/private\",\n\n  // Windows system directories\n  process.env.SystemRoot,\n  process.env.WINDIR,\n])\n\nconst ALLOWLIST = resolvePaths([\n  os.tmpdir(), // always allow temp dir\n  os.homedir(), // always allow home dir\n])\n\n/** @internal */\nexport class AsarPackager {\n  private readonly outFile: string\n\n  constructor(\n    readonly packager: PlatformPackager<any>,\n    private readonly config: {\n      defaultDestination: string\n      resourcePath: string\n      options: AsarOptions\n      unpackPattern: Filter | undefined\n    }\n  ) {\n    this.outFile = path.join(config.resourcePath, `app.asar`)\n  }\n\n  async pack(fileSets: Array<ResolvedFileSet>) {\n    const orderedFileSets = [\n      // Write dependencies first to minimize offset changes to asar header\n      ...fileSets.slice(1),\n\n      // Finish with the app files that change most often\n      fileSets[0],\n    ].map(set => this.orderFileSet(set))\n\n    const streams = await this.processFileSets(orderedFileSets)\n    await this.executeElectronAsar(streams)\n  }\n\n  private async executeElectronAsar(streams: AsarStreamType[]) {\n    // override logger temporarily to clean up console (electron/asar does some internal logging that blogs up the default electron-builder logs)\n    const consoleLogger = console.log\n    console.log = (...args) => {\n      if (args[0] === \"Ordering file has 100% coverage.\") {\n        return // no need to log, this means our ordering logic is working correctly\n      }\n      log.info({ args }, \"logging @electron/asar\")\n    }\n    const { createPackageFromStreams } = await dynamicImport<typeof import(\"@electron/asar\")>(\"@electron/asar\")\n    await createPackageFromStreams(this.outFile, streams)\n    console.log = consoleLogger\n  }\n\n  private async processFileSets(fileSets: ResolvedFileSet[]): Promise<AsarStreamType[]> {\n    const unpackedPaths = new Set<string>()\n    if (this.config.options.smartUnpack !== false) {\n      for (const fileSet of fileSets) {\n        detectUnpackedDirs(fileSet, unpackedPaths)\n      }\n    }\n\n    const resultsMap = new Map<string, AsarStreamType>()\n    const streamOrdering: string[] = []\n    const normalizedUnpackedPaths = Array.from(unpackedPaths).map(p => path.normalize(p))\n\n    // Check whether a file or directory should be unpacked, using pre-normalized unpacked paths and early returns\n    const isUnpacked = (dir: string, file?: string, stat?: FilterStats): boolean => {\n      const normalizedDir = path.normalize(dir)\n\n      // Check file pattern first (most specific)\n      if (!isEmptyOrSpaces(file) && stat && this.config.unpackPattern?.(file, stat)) {\n        return true\n      }\n\n      // Check if path is within any unpacked directory\n      for (const unpackedPath of normalizedUnpackedPaths) {\n        if (normalizedDir === unpackedPath || normalizedDir.startsWith(unpackedPath + path.sep)) {\n          return true\n        }\n      }\n\n      return false\n    }\n\n    // First pass: process all files in order, ensuring parent directories exist\n    for (const fileSet of fileSets) {\n      // Don't use Promise.all, we need to retain order of execution/iteration through the already-ordered fileset\n      for (const [index, file] of fileSet.files.entries()) {\n        const transformedData = fileSet.transformedFiles?.get(index)\n        const stat = fileSet.metadata.get(file)!\n        const destination = path.relative(this.config.defaultDestination, getDestinationPath(file, fileSet))\n\n        // Ensure parent directories exist before processing file\n        this.ensureParentDirectories(destination, resultsMap, streamOrdering)\n\n        const result = await this.processFileOrSymlink({\n          file,\n          destination,\n          fileSet,\n          transformedData,\n          stat,\n          isUnpacked,\n        })\n\n        if (result && !resultsMap.has(result.path)) {\n          resultsMap.set(result.path, result)\n          streamOrdering.push(result.path)\n        }\n      }\n    }\n\n    // Second pass: propagate unpacked flag to parent directories\n    for (const entry of resultsMap.values()) {\n      if (entry.unpacked) {\n        this.markParentDirectoriesAsUnpacked(entry.path, resultsMap, isUnpacked)\n      }\n    }\n\n    // Build final results array maintaining processing order\n    return streamOrdering.reduce<AsarStreamType[]>((streams, path) => {\n      const stream = resultsMap.has(path) ? resultsMap.get(path) : null\n      if (stream != null) {\n        streams.push(stream)\n      }\n      return streams\n    }, [])\n  }\n\n  private ensureParentDirectories(destination: string, resultsMap: Map<string, AsarStreamType>, streamOrdering: string[]): void {\n    const parents: string[] = []\n    let current = path.dirname(path.normalize(destination))\n\n    // Collect all parent directories from deepest to root\n    while (current !== \".\") {\n      parents.unshift(current)\n      current = path.dirname(current)\n    }\n\n    // Add parent directories in order (root to deepest)\n    for (const parentPath of parents) {\n      if (!resultsMap.has(parentPath)) {\n        const dir: AsarDirectory = {\n          type: \"directory\",\n          path: parentPath,\n          unpacked: false, // Updated in second pass if needed\n        }\n        resultsMap.set(parentPath, dir)\n        streamOrdering.push(parentPath)\n      }\n    }\n  }\n\n  private markParentDirectoriesAsUnpacked(destination: string, resultsMap: Map<string, AsarStreamType>, isUnpacked: (path: string) => boolean): void {\n    let current = path.dirname(path.normalize(destination))\n\n    while (current !== \".\") {\n      const entry = resultsMap.get(current)\n      if (entry && isUnpacked(current)) {\n        entry.unpacked = true\n      }\n      current = path.dirname(current)\n    }\n  }\n\n  private async processFileOrSymlink(options: {\n    file: string\n    destination: string\n    stat: fs.Stats\n    fileSet: ResolvedFileSet\n    transformedData: string | Buffer | undefined\n    isUnpacked: (dir: string, file?: string, stat?: FilterStats) => boolean\n  }): Promise<AsarStreamType> {\n    const { isUnpacked, transformedData, file, destination, stat } = options\n    const unpacked = isUnpacked(destination, file, stat)\n\n    // Handle directories\n    if (!stat.isFile() && !stat.isSymbolicLink()) {\n      return { path: destination, unpacked, type: \"directory\" }\n    }\n\n    // Handle transformed data (pre-processed content)\n    if (transformedData != null) {\n      const size = Buffer.byteLength(transformedData)\n      return {\n        path: destination,\n        streamGenerator: () =>\n          new Readable({\n            read() {\n              this.push(transformedData)\n              this.push(null)\n            },\n          }),\n        unpacked,\n        type: \"file\",\n        stat: { mode: stat.mode, size },\n      }\n    }\n\n    // verify that the file is not a direct link or symlinked to access/copy a system file\n    await this.protectSystemAndUnsafePaths(file, await this.packager.info.getWorkspaceRoot())\n\n    const baseConfig = {\n      path: destination,\n      streamGenerator: () => fs.createReadStream(file),\n      unpacked,\n      stat,\n    }\n\n    // Handle regular files\n    if (!stat.isSymbolicLink()) {\n      return { ...baseConfig, type: \"file\" }\n    }\n\n    // Handle symlinks - make relative to source location\n    let link = await readlink(file)\n    if (path.isAbsolute(link)) {\n      link = path.relative(path.dirname(file), link)\n    }\n\n    return {\n      ...baseConfig,\n      type: \"link\",\n      symlink: link,\n    }\n  }\n\n  private orderFileSet(fileSet: ResolvedFileSet): ResolvedFileSet {\n    const sortedFileEntries = Array.from(fileSet.files.entries())\n\n    sortedFileEntries.sort(([, a], [, b]) => {\n      if (a === b) {\n        return 0\n      }\n\n      // Place addons last because their signature changes per build\n      const isAAddon = a.endsWith(\".node\")\n      const isBAddon = b.endsWith(\".node\")\n      if (isAAddon && !isBAddon) {\n        return 1\n      }\n      if (isBAddon && !isAAddon) {\n        return -1\n      }\n\n      // Otherwise order by name\n      return a < b ? -1 : 1\n    })\n\n    let transformedFiles: Map<number, string | Buffer> | undefined\n    if (fileSet.transformedFiles) {\n      transformedFiles = new Map()\n\n      const indexMap = new Map<number, number>()\n      for (const [newIndex, [oldIndex]] of sortedFileEntries.entries()) {\n        indexMap.set(oldIndex, newIndex)\n      }\n\n      for (const [oldIndex, value] of fileSet.transformedFiles) {\n        const newIndex = indexMap.get(oldIndex)\n        if (newIndex === undefined) {\n          throw new Error(`Internal error: ${fileSet.files[oldIndex]} was lost while ordering asar`)\n        }\n        transformedFiles.set(newIndex, value)\n      }\n    }\n\n    return {\n      src: fileSet.src,\n      destination: fileSet.destination,\n      metadata: fileSet.metadata,\n      files: sortedFileEntries.map(([, file]) => file),\n      transformedFiles,\n    }\n  }\n\n  private async checkAgainstRoots(target: string, allowRoots: string[]): Promise<boolean> {\n    const resolved = await resolvePath(target)\n    if (resolved == null || isEmptyOrSpaces(resolved)) {\n      return false\n    }\n\n    for (const root of allowRoots) {\n      if (resolved === root || resolved.startsWith(root + path.sep)) {\n        return true\n      }\n    }\n    return false\n  }\n\n  private async protectSystemAndUnsafePaths(file: string, workspaceRoot: string): Promise<void> {\n    const resolved = await resolvePath(file)\n    const logFields = { source: file, realPath: resolved }\n\n    const workspace = await resolvePath(workspaceRoot)\n\n    // If in workspace, always safe\n    if (workspace && resolved?.startsWith(workspace)) {\n      return\n    }\n\n    // Check allowlist (priority)\n    if (await this.checkAgainstRoots(file, await ALLOWLIST)) {\n      return\n    }\n\n    // Check denylist\n    if (await this.checkAgainstRoots(file, await DENYLIST)) {\n      log.error(logFields, `denied access to system or unsafe path`)\n      throw new Error(`Cannot copy file [${file}] symlinked to file [${resolved}] outside the package to a system or unsafe path`)\n    }\n\n    // Default: outside explicit paths but not explicitly denied\n    log.debug(logFields, `path is outside of explicit safe paths, defaulting to safe`)\n  }\n}\n"]}

package/out/binDownload.js

@@ -4,21 +4,27 @@ exports.download = download;
 exports.getBinFromCustomLoc = getBinFromCustomLoc;
 exports.getBinFromUrl = getBinFromUrl;
 exports.getBin = getBin;
-const get = require("@electron/get");
-const get_1 = require("@electron/get");
 const fs = require("fs/promises");
 const builder_util_1 = require("builder-util");
+const dynamicImport_1 = require("./util/dynamicImport");
 const filename_1 = require("builder-util/out/filename");
 const path = require("path");
 const electronGet_1 = require("./util/electronGet");
 const versionToPromise = new Map();
 async function download(url, output, checksum) {
     const filenameWithExt = path.basename(new URL(url).pathname);
-    const downloadedFile = await get.downloadArtifact({
+    if (checksum == null) {
+        // Without a checksum, a download intercepted via a rogue mirror, tampered CDN
+        // edge, or DNS spoofing can substitute a malicious payload undetected.
+        // Callers should supply a checksum whenever possible.
+        builder_util_1.log.warn({ url }, "downloading without an integrity checksum — the download is not verified against a known-good hash");
+    }
+    const { downloadArtifact, ElectronDownloadCacheMode } = await (0, dynamicImport_1.dynamicImport)("@electron/get");
+    const downloadedFile = await downloadArtifact({
         version: "9.9.9",
         artifactName: filenameWithExt,
         cacheRoot: path.resolve((0, electronGet_1.getCacheDirectory)({ allowEnvVarOverride: true }), "downloads"),
-        cacheMode: get_1.ElectronDownloadCacheMode.ReadWrite,
+        cacheMode: ElectronDownloadCacheMode.ReadWrite,
         ...(checksum != null ? { checksums: { [filenameWithExt]: checksum } } : { unsafelyDisableChecksums: true }),
         mirrorOptions: { resolveAssetURL: async () => Promise.resolve(url) },
         isGeneric: true,
@@ -29,6 +35,22 @@ function getBinFromCustomLoc(name, version, binariesLocUrl, checksum) {
     const dirName = `${name}-${version}`;
     return getBin(dirName, binariesLocUrl, checksum);
 }
+/**
+ * Validates a binary-download custom-directory value read from an environment
+ * variable.  These values are interpolated directly into a download URL; a
+ * malicious value (e.g. set via a postinstall hook in node_modules) could
+ * redirect tool downloads to an attacker-controlled server.
+ *
+ * Allowed: relative path components such as "v1.0.0-custom" or "my-mirror/nsis".
+ * Rejected: anything containing "://", ".." (traversal), or a leading "/" (which
+ * could make the resulting URL protocol-relative or change the host).
+ */
+function validateBinaryCustomDir(envVarName, value) {
+    if (value.includes("://") || value.includes("..") || value.startsWith("/")) {
+        throw new Error(`${envVarName} must be a safe relative path component (e.g. "v1.0.0-custom"). Values containing "://", "..", or a leading "/" are not allowed. Got: "${value}"`);
+    }
+    return value;
+}
 function getBinFromUrl(releaseName, filenameWithExt, checksum, githubOrgRepo = "electron-userland/electron-builder-binaries") {
     if (/[/\\]|^\.\./.test(filenameWithExt) || filenameWithExt.includes("..")) {
         throw new Error(`getBinFromUrl: unsafe filenameWithExt "${filenameWithExt}" — must be a plain filename with no path separators or traversal sequences`);
@@ -40,11 +62,16 @@ function getBinFromUrl(releaseName, filenameWithExt, checksum, githubOrgRepo = "
     }
     else {
         const baseUrl = (0, electronGet_1.getBinariesMirrorUrl)(githubOrgRepo);
-        const middleUrl = process.env.NPM_CONFIG_ELECTRON_BUILDER_BINARIES_CUSTOM_DIR ||
-            process.env.npm_config_electron_builder_binaries_custom_dir ||
-            process.env.npm_package_config_electron_builder_binaries_custom_dir ||
-            process.env.ELECTRON_BUILDER_BINARIES_CUSTOM_DIR ||
-            releaseName;
+        // Any of these env vars can redirect downloads to a custom release directory.
+        // Validate each one before interpolating into the URL.
+        const CUSTOM_DIR_ENV_VARS = [
+            "NPM_CONFIG_ELECTRON_BUILDER_BINARIES_CUSTOM_DIR",
+            "npm_config_electron_builder_binaries_custom_dir",
+            "npm_package_config_electron_builder_binaries_custom_dir",
+            "ELECTRON_BUILDER_BINARIES_CUSTOM_DIR",
+        ];
+        const customDirEntry = CUSTOM_DIR_ENV_VARS.map(name => ({ name, value: process.env[name] })).find(e => e.value != null);
+        const middleUrl = customDirEntry != null ? validateBinaryCustomDir(customDirEntry.name, customDirEntry.value) : releaseName;
         url = `${baseUrl}${middleUrl}/${filenameWithExt}`;
     }
     const cacheKey = `${releaseName}-${path.basename(filenameWithExt, path.extname(filenameWithExt))}`;

package/out/binDownload.js.map

@@ -1 +1 @@
-{"version":3,"file":"binDownload.js","sourceRoot":"","sources":["../src/binDownload.ts"],"names":[],"mappings":";;AAWA,4BAYC;AAED,kDAGC;AAED,sCAqBC;AAED,wBA2BC;AAhFD,qCAAoC;AACpC,uCAAyD;AACzD,kCAAiC;AACjC,+CAAkD;AAElD,wDAA4D;AAC5D,6BAA4B;AAC5B,oDAAoG;AAEpG,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA2B,CAAA;AAEpD,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,MAAc,EAAE,QAAwB;IAClF,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC5D,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,gBAAgB,CAAC;QAChD,OAAO,EAAE,OAAO;QAChB,YAAY,EAAE,eAAe;QAC7B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,IAAA,+BAAiB,EAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,CAAC;QACtF,SAAS,EAAE,+BAAyB,CAAC,SAAS;QAC9C,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC;QAC3G,aAAa,EAAE,EAAE,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;QACpE,SAAS,EAAE,IAAI;KAChB,CAAC,CAAA;IACF,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;AAC3C,CAAC;AAED,SAAgB,mBAAmB,CAAC,IAAY,EAAE,OAAe,EAAE,cAAsB,EAAE,QAAgB;IACzG,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAA;IACpC,OAAO,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAA;AAClD,CAAC;AAED,SAAgB,aAAa,CAAC,WAAmB,EAAE,eAAuB,EAAE,QAAgB,EAAE,aAAa,GAAG,6CAA6C;IACzJ,IAAI,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,0CAA0C,eAAe,6EAA6E,CAAC,CAAA;IACzJ,CAAC;IACD,IAAI,GAAW,CAAA;IACf,MAAM,WAAW,GAAG,IAAA,kCAAmB,EAAC,iDAAiD,CAAC,CAAA;IAC1F,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QACxB,GAAG,GAAG,WAAW,GAAG,GAAG,GAAG,eAAe,CAAA;IAC3C,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,IAAA,kCAAoB,EAAC,aAAa,CAAC,CAAA;QACnD,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,+CAA+C;YAC3D,OAAO,CAAC,GAAG,CAAC,+CAA+C;YAC3D,OAAO,CAAC,GAAG,CAAC,uDAAuD;YACnE,OAAO,CAAC,GAAG,CAAC,oCAAoC;YAChD,WAAW,CAAA;QACb,GAAG,GAAG,GAAG,OAAO,GAAG,SAAS,IAAI,eAAe,EAAE,CAAA;IACnD,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,EAAE,CAAA;IAClG,OAAO,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;AACxC,CAAC;AAED,SAAgB,MAAM,CAAC,QAAgB,EAAE,GAAsB,EAAE,QAA2B;;IAC1F,MAAM,SAAS,GAAG,IAAA,2BAAgB,EAAC,GAAG,MAAA,OAAO,CAAC,GAAG,CAAC,sBAAsB,mCAAI,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAA;IAC5F,IAAI,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAC7C,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACpB,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,WAAW,QAAQ,kCAAkC;YACnD,wEAAwE;YACxE,wDAAwD,CAC3D,CAAA;IACH,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC1C,MAAM,WAAW,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAE9C,OAAO,GAAG,IAAA,oCAAsB,EAAC;QAC/B,WAAW;QACX,eAAe;QACf,SAAS,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;QACzE,WAAW;KACZ,CAAC,CAAA;IACF,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IACxC,OAAO,OAAO,CAAA;AAChB,CAAC","sourcesContent":["import * as get from \"@electron/get\"\nimport { ElectronDownloadCacheMode } from \"@electron/get\"\nimport * as fs from \"fs/promises\"\nimport { parseValidEnvVarUrl } from \"builder-util\"\nimport { Nullish } from \"builder-util-runtime\"\nimport { sanitizeFileName } from \"builder-util/out/filename\"\nimport * as path from \"path\"\nimport { downloadBuilderToolset, getBinariesMirrorUrl, getCacheDirectory } from \"./util/electronGet\"\n\nconst versionToPromise = new Map<string, Promise<string>>()\n\nexport async function download(url: string, output: string, checksum?: string | null): Promise<void> {\n  const filenameWithExt = path.basename(new URL(url).pathname)\n  const downloadedFile = await get.downloadArtifact({\n    version: \"9.9.9\",\n    artifactName: filenameWithExt,\n    cacheRoot: path.resolve(getCacheDirectory({ allowEnvVarOverride: true }), \"downloads\"),\n    cacheMode: ElectronDownloadCacheMode.ReadWrite,\n    ...(checksum != null ? { checksums: { [filenameWithExt]: checksum } } : { unsafelyDisableChecksums: true }),\n    mirrorOptions: { resolveAssetURL: async () => Promise.resolve(url) },\n    isGeneric: true,\n  })\n  await fs.copyFile(downloadedFile, output)\n}\n\nexport function getBinFromCustomLoc(name: string, version: string, binariesLocUrl: string, checksum: string): Promise<string> {\n  const dirName = `${name}-${version}`\n  return getBin(dirName, binariesLocUrl, checksum)\n}\n\nexport function getBinFromUrl(releaseName: string, filenameWithExt: string, checksum: string, githubOrgRepo = \"electron-userland/electron-builder-binaries\"): Promise<string> {\n  if (/[/\\\\]|^\\.\\./.test(filenameWithExt) || filenameWithExt.includes(\"..\")) {\n    throw new Error(`getBinFromUrl: unsafe filenameWithExt \"${filenameWithExt}\" — must be a plain filename with no path separators or traversal sequences`)\n  }\n  let url: string\n  const overrideUrl = parseValidEnvVarUrl(\"ELECTRON_BUILDER_BINARIES_DOWNLOAD_OVERRIDE_URL\")\n  if (overrideUrl != null) {\n    url = overrideUrl + \"/\" + filenameWithExt\n  } else {\n    const baseUrl = getBinariesMirrorUrl(githubOrgRepo)\n    const middleUrl =\n      process.env.NPM_CONFIG_ELECTRON_BUILDER_BINARIES_CUSTOM_DIR ||\n      process.env.npm_config_electron_builder_binaries_custom_dir ||\n      process.env.npm_package_config_electron_builder_binaries_custom_dir ||\n      process.env.ELECTRON_BUILDER_BINARIES_CUSTOM_DIR ||\n      releaseName\n    url = `${baseUrl}${middleUrl}/${filenameWithExt}`\n  }\n\n  const cacheKey = `${releaseName}-${path.basename(filenameWithExt, path.extname(filenameWithExt))}`\n  return getBin(cacheKey, url, checksum)\n}\n\nexport function getBin(cacheKey: string, url?: string | Nullish, checksum?: string | Nullish): Promise<string> {\n  const cacheName = sanitizeFileName(`${process.env.ELECTRON_BUILDER_CACHE ?? \"\"}${cacheKey}`)\n  let promise = versionToPromise.get(cacheName)\n  if (promise != null) {\n    return promise\n  }\n\n  if (url == null) {\n    throw new Error(\n      `getBin(\"${cacheKey}\"): a download URL is required. ` +\n        `The no-URL legacy path (e.g. winCodeSign \"0.0.0\") is no longer used — ` +\n        `it now downloads from winCodeSign-2.6.0 automatically.`\n    )\n  }\n\n  const filenameWithExt = path.basename(url)\n  const overrideUrl = url.substring(0, url.lastIndexOf(\"/\"))\n  const releaseName = path.basename(overrideUrl)\n\n  promise = downloadBuilderToolset({\n    releaseName,\n    filenameWithExt,\n    checksums: checksum != null ? { [filenameWithExt]: checksum } : undefined,\n    overrideUrl,\n  })\n  versionToPromise.set(cacheName, promise)\n  return promise\n}\n"]}
+{"version":3,"file":"binDownload.js","sourceRoot":"","sources":["../src/binDownload.ts"],"names":[],"mappings":";;AAUA,4BAmBC;AAED,kDAGC;AAmBD,sCAyBC;AAED,wBA2BC;AA3GD,kCAAiC;AACjC,+CAAuD;AACvD,wDAAoD;AAEpD,wDAA4D;AAC5D,6BAA4B;AAC5B,oDAAoG;AAEpG,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA2B,CAAA;AAEpD,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,MAAc,EAAE,QAAwB;IAClF,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC5D,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,8EAA8E;QAC9E,uEAAuE;QACvE,sDAAsD;QACtD,kBAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,oGAAoG,CAAC,CAAA;IACzH,CAAC;IACD,MAAM,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,GAAG,MAAM,IAAA,6BAAa,EAAiC,eAAe,CAAC,CAAA;IAC5H,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC;QAC5C,OAAO,EAAE,OAAO;QAChB,YAAY,EAAE,eAAe;QAC7B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,IAAA,+BAAiB,EAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,CAAC;QACtF,SAAS,EAAE,yBAAyB,CAAC,SAAS;QAC9C,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC;QAC3G,aAAa,EAAE,EAAE,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE;QACpE,SAAS,EAAE,IAAI;KAChB,CAAC,CAAA;IACF,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;AAC3C,CAAC;AAED,SAAgB,mBAAmB,CAAC,IAAY,EAAE,OAAe,EAAE,cAAsB,EAAE,QAAgB;IACzG,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAA;IACpC,OAAO,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAA;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,uBAAuB,CAAC,UAAkB,EAAE,KAAa;IAChE,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,0IAA0I,KAAK,GAAG,CAAC,CAAA;IAClL,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAgB,aAAa,CAAC,WAAmB,EAAE,eAAuB,EAAE,QAAgB,EAAE,aAAa,GAAG,6CAA6C;IACzJ,IAAI,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,0CAA0C,eAAe,6EAA6E,CAAC,CAAA;IACzJ,CAAC;IACD,IAAI,GAAW,CAAA;IACf,MAAM,WAAW,GAAG,IAAA,kCAAmB,EAAC,iDAAiD,CAAC,CAAA;IAC1F,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QACxB,GAAG,GAAG,WAAW,GAAG,GAAG,GAAG,eAAe,CAAA;IAC3C,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,IAAA,kCAAoB,EAAC,aAAa,CAAC,CAAA;QACnD,8EAA8E;QAC9E,uDAAuD;QACvD,MAAM,mBAAmB,GAAG;YAC1B,iDAAiD;YACjD,iDAAiD;YACjD,yDAAyD;YACzD,sCAAsC;SAC9B,CAAA;QACV,MAAM,cAAc,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAA;QACvH,MAAM,SAAS,GAAG,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,uBAAuB,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,KAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAA;QAC5H,GAAG,GAAG,GAAG,OAAO,GAAG,SAAS,IAAI,eAAe,EAAE,CAAA;IACnD,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,EAAE,CAAA;IAClG,OAAO,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;AACxC,CAAC;AAED,SAAgB,MAAM,CAAC,QAAgB,EAAE,GAAsB,EAAE,QAA2B;;IAC1F,MAAM,SAAS,GAAG,IAAA,2BAAgB,EAAC,GAAG,MAAA,OAAO,CAAC,GAAG,CAAC,sBAAsB,mCAAI,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAA;IAC5F,IAAI,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAC7C,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACpB,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,WAAW,QAAQ,kCAAkC;YACnD,wEAAwE;YACxE,wDAAwD,CAC3D,CAAA;IACH,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC1C,MAAM,WAAW,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IAE9C,OAAO,GAAG,IAAA,oCAAsB,EAAC;QAC/B,WAAW;QACX,eAAe;QACf,SAAS,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;QACzE,WAAW;KACZ,CAAC,CAAA;IACF,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IACxC,OAAO,OAAO,CAAA;AAChB,CAAC","sourcesContent":["import * as fs from \"fs/promises\"\nimport { log, parseValidEnvVarUrl } from \"builder-util\"\nimport { dynamicImport } from \"./util/dynamicImport\"\nimport { Nullish } from \"builder-util-runtime\"\nimport { sanitizeFileName } from \"builder-util/out/filename\"\nimport * as path from \"path\"\nimport { downloadBuilderToolset, getBinariesMirrorUrl, getCacheDirectory } from \"./util/electronGet\"\n\nconst versionToPromise = new Map<string, Promise<string>>()\n\nexport async function download(url: string, output: string, checksum?: string | null): Promise<void> {\n  const filenameWithExt = path.basename(new URL(url).pathname)\n  if (checksum == null) {\n    // Without a checksum, a download intercepted via a rogue mirror, tampered CDN\n    // edge, or DNS spoofing can substitute a malicious payload undetected.\n    // Callers should supply a checksum whenever possible.\n    log.warn({ url }, \"downloading without an integrity checksum — the download is not verified against a known-good hash\")\n  }\n  const { downloadArtifact, ElectronDownloadCacheMode } = await dynamicImport<typeof import(\"@electron/get\")>(\"@electron/get\")\n  const downloadedFile = await downloadArtifact({\n    version: \"9.9.9\",\n    artifactName: filenameWithExt,\n    cacheRoot: path.resolve(getCacheDirectory({ allowEnvVarOverride: true }), \"downloads\"),\n    cacheMode: ElectronDownloadCacheMode.ReadWrite,\n    ...(checksum != null ? { checksums: { [filenameWithExt]: checksum } } : { unsafelyDisableChecksums: true }),\n    mirrorOptions: { resolveAssetURL: async () => Promise.resolve(url) },\n    isGeneric: true,\n  })\n  await fs.copyFile(downloadedFile, output)\n}\n\nexport function getBinFromCustomLoc(name: string, version: string, binariesLocUrl: string, checksum: string): Promise<string> {\n  const dirName = `${name}-${version}`\n  return getBin(dirName, binariesLocUrl, checksum)\n}\n\n/**\n * Validates a binary-download custom-directory value read from an environment\n * variable.  These values are interpolated directly into a download URL; a\n * malicious value (e.g. set via a postinstall hook in node_modules) could\n * redirect tool downloads to an attacker-controlled server.\n *\n * Allowed: relative path components such as \"v1.0.0-custom\" or \"my-mirror/nsis\".\n * Rejected: anything containing \"://\", \"..\" (traversal), or a leading \"/\" (which\n * could make the resulting URL protocol-relative or change the host).\n */\nfunction validateBinaryCustomDir(envVarName: string, value: string): string {\n  if (value.includes(\"://\") || value.includes(\"..\") || value.startsWith(\"/\")) {\n    throw new Error(`${envVarName} must be a safe relative path component (e.g. \"v1.0.0-custom\"). Values containing \"://\", \"..\", or a leading \"/\" are not allowed. Got: \"${value}\"`)\n  }\n  return value\n}\n\nexport function getBinFromUrl(releaseName: string, filenameWithExt: string, checksum: string, githubOrgRepo = \"electron-userland/electron-builder-binaries\"): Promise<string> {\n  if (/[/\\\\]|^\\.\\./.test(filenameWithExt) || filenameWithExt.includes(\"..\")) {\n    throw new Error(`getBinFromUrl: unsafe filenameWithExt \"${filenameWithExt}\" — must be a plain filename with no path separators or traversal sequences`)\n  }\n  let url: string\n  const overrideUrl = parseValidEnvVarUrl(\"ELECTRON_BUILDER_BINARIES_DOWNLOAD_OVERRIDE_URL\")\n  if (overrideUrl != null) {\n    url = overrideUrl + \"/\" + filenameWithExt\n  } else {\n    const baseUrl = getBinariesMirrorUrl(githubOrgRepo)\n    // Any of these env vars can redirect downloads to a custom release directory.\n    // Validate each one before interpolating into the URL.\n    const CUSTOM_DIR_ENV_VARS = [\n      \"NPM_CONFIG_ELECTRON_BUILDER_BINARIES_CUSTOM_DIR\",\n      \"npm_config_electron_builder_binaries_custom_dir\",\n      \"npm_package_config_electron_builder_binaries_custom_dir\",\n      \"ELECTRON_BUILDER_BINARIES_CUSTOM_DIR\",\n    ] as const\n    const customDirEntry = CUSTOM_DIR_ENV_VARS.map(name => ({ name, value: process.env[name] })).find(e => e.value != null)\n    const middleUrl = customDirEntry != null ? validateBinaryCustomDir(customDirEntry.name, customDirEntry.value!) : releaseName\n    url = `${baseUrl}${middleUrl}/${filenameWithExt}`\n  }\n\n  const cacheKey = `${releaseName}-${path.basename(filenameWithExt, path.extname(filenameWithExt))}`\n  return getBin(cacheKey, url, checksum)\n}\n\nexport function getBin(cacheKey: string, url?: string | Nullish, checksum?: string | Nullish): Promise<string> {\n  const cacheName = sanitizeFileName(`${process.env.ELECTRON_BUILDER_CACHE ?? \"\"}${cacheKey}`)\n  let promise = versionToPromise.get(cacheName)\n  if (promise != null) {\n    return promise\n  }\n\n  if (url == null) {\n    throw new Error(\n      `getBin(\"${cacheKey}\"): a download URL is required. ` +\n        `The no-URL legacy path (e.g. winCodeSign \"0.0.0\") is no longer used — ` +\n        `it now downloads from winCodeSign-2.6.0 automatically.`\n    )\n  }\n\n  const filenameWithExt = path.basename(url)\n  const overrideUrl = url.substring(0, url.lastIndexOf(\"/\"))\n  const releaseName = path.basename(overrideUrl)\n\n  promise = downloadBuilderToolset({\n    releaseName,\n    filenameWithExt,\n    checksums: checksum != null ? { [filenameWithExt]: checksum } : undefined,\n    overrideUrl,\n  })\n  versionToPromise.set(cacheName, promise)\n  return promise\n}\n"]}

package/out/codeSign/certInfo.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Decrypt `data` using RC2-CBC with PKCS#7 padding removal (RFC 2268).
+ *
+ * Used for pbeWithSHAAnd40BitRC2CBC  (OID 1.2.840.113549.1.12.1.6) and
+ *          pbeWithSHAAnd128BitRC2CBC (OID 1.2.840.113549.1.12.1.5).
+ *
+ * These OIDs are commonly used to encrypt certificate bags in PKCS#12
+ * files produced by OpenSSL and Windows with default settings. Node.js 22+
+ * (OpenSSL 3 default provider) does not support RC2 via `createDecipheriv`.
+ */
+declare function rc2CbcDecrypt(key: Buffer, iv: Buffer, data: Buffer, effectiveBits: number): Buffer;
+/**
+ * PKCS#12 key/IV derivation function from RFC 7292 Appendix B (SHA-1 variant).
+ * id = 1 to derive a key, id = 2 to derive an IV.
+ *
+ * Throws if `iterations` is outside [1, MAX_PKCS12_PBE_ITERATIONS] to prevent
+ * CPU exhaustion from a crafted PFX file.
+ */
+declare function pkcs12PbeDeriveKey(password: Buffer, salt: Buffer, iterations: number, id: number, length: number): Buffer;
+/**
+ * Encode a password as UTF-16 Big Endian with a null terminator, which is the
+ * format required by PKCS#12 PBE key derivation (RFC 7292).
+ * An empty string yields [0x00, 0x00] (just the null terminator).
+ */
+declare function pkcs12PasswordToUtf16(password: string): Buffer;
+/**
+ * Reads certificate info from a PKCS#12 (.pfx) file using pkijs (unobfuscated TypeScript).
+ * Mirrors the `certificate-info` subcommand of app-builder-bin.
+ * https://github.com/develar/app-builder/blob/master/pkg/codesign/p12.go
+ *
+ * Returns { commonName, bloodyMicrosoftSubjectDn } on success.
+ *
+ * Known divergences from the Go binary:
+ * - No OpenSSL fallback when the pure PKCS#12 decoder fails for a non-password reason.
+ * - Unknown OIDs are rendered using the raw numeric OID as the type name (e.g. `2.5.4.100=value`); Go uses `OID=#hexbytes` when ASN.1 marshal succeeds.
+ * - RDN ordering uses DER order; Go normalizes via pkix.Name.ToRDNSequence then reverses via
+ *   BloodyMsString. These coincide for pkijs-generated certs (CN-first DER) but may
+ *   differ for real CA-issued certs stored in traditional C-first DER order.
+ */
+export declare function readCertInfo(file: string, password: string): Promise<{
+    commonName: string;
+    bloodyMicrosoftSubjectDn: string;
+}>;
+/**
+ * Internal functions exported exclusively for unit testing.
+ * Not part of the public API — do not use outside of test files.
+ */
+export declare const _testingOnly: {
+    pkcs12PbeDeriveKey: typeof pkcs12PbeDeriveKey;
+    pkcs12PasswordToUtf16: typeof pkcs12PasswordToUtf16;
+    rc2CbcDecrypt: typeof rc2CbcDecrypt;
+    MAX_PKCS12_PBE_ITERATIONS: number;
+};
+export {};