cognitive-modules-cli 2.2.7 → 2.2.9

package/dist/provenance.js

@@ -0,0 +1,137 @@
+import * as fs from 'node:fs/promises';
+import { createReadStream } from 'node:fs';
+import { createHash } from 'node:crypto';
+import * as path from 'node:path';
+export const PROVENANCE_FILENAME = 'provenance.json';
+export const PROVENANCE_SPEC = 'cognitive.module.provenance/v1';
+const DEFAULT_INTEGRITY_LIMITS = {
+    maxFiles: 5_000,
+    maxTotalBytes: 50 * 1024 * 1024, // 50MB
+    maxSingleFileBytes: 20 * 1024 * 1024, // 20MB
+};
+async function hashFileSha256(filePath, size) {
+    const h = createHash('sha256');
+    await new Promise((resolve, reject) => {
+        const rs = createReadStream(filePath);
+        rs.on('data', (chunk) => h.update(chunk));
+        rs.on('error', reject);
+        rs.on('end', resolve);
+    });
+    // Include size in the hash domain separation to make accidental truncation obvious.
+    h.update(`\nsize:${size}\n`);
+    return h.digest('hex');
+}
+async function walkFiles(rootDir, relDir) {
+    const absDir = path.join(rootDir, relDir);
+    const entries = await fs.readdir(absDir, { withFileTypes: true });
+    const out = [];
+    for (const ent of entries) {
+        const rel = relDir ? path.posix.join(relDir.replace(/\\/g, '/'), ent.name) : ent.name;
+        const abs = path.join(rootDir, rel);
+        // Never hash our own provenance.
+        if (rel === PROVENANCE_FILENAME)
+            continue;
+        if (ent.name === '.DS_Store' || ent.name === '__MACOSX')
+            continue;
+        if (ent.isSymbolicLink()) {
+            // Refuse to hash symlinks. Tar extraction also rejects them.
+            continue;
+        }
+        if (ent.isDirectory()) {
+            out.push(...await walkFiles(rootDir, rel));
+            continue;
+        }
+        if (ent.isFile()) {
+            out.push(rel);
+        }
+    }
+    return out;
+}
+export async function computeModuleIntegrity(moduleDir, options = {}) {
+    const limits = {
+        ...DEFAULT_INTEGRITY_LIMITS,
+        ...options,
+    };
+    const relFiles = (await walkFiles(moduleDir, '')).sort((a, b) => a.localeCompare(b));
+    if (relFiles.length > limits.maxFiles) {
+        throw new Error(`Module has too many files to hash (max ${limits.maxFiles}): ${relFiles.length}`);
+    }
+    const files = {};
+    let totalBytes = 0;
+    for (const rel of relFiles) {
+        const abs = path.join(moduleDir, rel);
+        const st = await fs.stat(abs);
+        if (!st.isFile())
+            continue;
+        if (st.size > limits.maxSingleFileBytes) {
+            throw new Error(`Module file too large for integrity hashing (max ${limits.maxSingleFileBytes} bytes): ${rel}`);
+        }
+        totalBytes += st.size;
+        if (totalBytes > limits.maxTotalBytes) {
+            throw new Error(`Module too large for integrity hashing (max ${limits.maxTotalBytes} bytes)`);
+        }
+        const sha256 = await hashFileSha256(abs, st.size);
+        files[rel] = sha256;
+    }
+    return {
+        algorithm: 'sha256',
+        maxFiles: limits.maxFiles,
+        maxTotalBytes: limits.maxTotalBytes,
+        maxSingleFileBytes: limits.maxSingleFileBytes,
+        totalBytes,
+        files,
+    };
+}
+export async function writeModuleProvenance(moduleDir, prov) {
+    const filePath = path.join(moduleDir, PROVENANCE_FILENAME);
+    const json = JSON.stringify(prov, null, 2) + '\n';
+    await fs.writeFile(filePath, json, 'utf-8');
+}
+export async function readModuleProvenance(moduleDir) {
+    const filePath = path.join(moduleDir, PROVENANCE_FILENAME);
+    try {
+        const raw = await fs.readFile(filePath, 'utf-8');
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== 'object')
+            return null;
+        if (parsed.spec !== PROVENANCE_SPEC)
+            return null;
+        if (!parsed.source || typeof parsed.source !== 'object')
+            return null;
+        if (!parsed.integrity || typeof parsed.integrity !== 'object')
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+export async function verifyModuleIntegrity(moduleDir, prov) {
+    const expected = prov.integrity?.files ?? {};
+    const expectedKeys = Object.keys(expected).sort();
+    if (expectedKeys.length === 0) {
+        return { ok: false, reason: 'Provenance integrity.files is empty' };
+    }
+    const computed = await computeModuleIntegrity(moduleDir, {
+        maxFiles: prov.integrity.maxFiles,
+        maxTotalBytes: prov.integrity.maxTotalBytes,
+        maxSingleFileBytes: prov.integrity.maxSingleFileBytes,
+    });
+    const computedKeys = Object.keys(computed.files).sort();
+    if (expectedKeys.length !== computedKeys.length) {
+        return { ok: false, reason: 'Integrity file list changed (file count mismatch)' };
+    }
+    for (let i = 0; i < expectedKeys.length; i++) {
+        if (expectedKeys[i] !== computedKeys[i]) {
+            return { ok: false, reason: `Integrity file list changed (mismatch at ${i}: ${expectedKeys[i]} vs ${computedKeys[i]})` };
+        }
+    }
+    for (const rel of expectedKeys) {
+        const a = expected[rel];
+        const b = computed.files[rel];
+        if (a !== b) {
+            return { ok: false, reason: `Integrity mismatch for ${rel}` };
+        }
+    }
+    return { ok: true };
+}

package/dist/registry/assets.d.ts

@@ -0,0 +1,48 @@
+export interface BuildRegistryOptions {
+    tag?: string | null;
+    tarballBaseUrl?: string | null;
+    modulesDir: string;
+    v1RegistryPath: string;
+    outDir: string;
+    registryOut: string;
+    namespace: string;
+    runtimeMin: string;
+    repository: string;
+    homepage: string;
+    license: string;
+    timestamp?: string | null;
+    only?: string[];
+}
+export interface VerifyRegistryOptions {
+    registryIndexPath: string;
+    assetsDir?: string;
+    maxTarballBytes?: number;
+    remote?: boolean;
+    fetchTimeoutMs?: number;
+    maxIndexBytes?: number;
+    concurrency?: number;
+}
+export interface RegistryBuildResult {
+    registryOut: string;
+    outDir: string;
+    updated: string;
+    modules: Array<{
+        name: string;
+        version: string;
+        file: string;
+        sha256: string;
+        size_bytes: number;
+    }>;
+}
+export interface RegistryVerifyResult {
+    ok: boolean;
+    checked: number;
+    passed: number;
+    failed: number;
+    failures: Array<{
+        module: string;
+        reason: string;
+    }>;
+}
+export declare function buildRegistryAssets(opts: BuildRegistryOptions): Promise<RegistryBuildResult>;
+export declare function verifyRegistryAssets(opts: VerifyRegistryOptions): Promise<RegistryVerifyResult>;