dsh-zen-remote 2.2.9 → 2.3.1

package/lib/types/wizard/verify.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Final-verification orchestration (GW-9): the wizard's last mile, where
+ * 「完成」 means a real phone really paired through the real public URL —
+ * never a green light from internal checks alone (设计: 不做已联通的假绿灯).
+ *
+ * The flow, spread over two entry points the UI drives:
+ *
+ *   start({ publicUrl }): runtime ready? → walk the public URL
+ *   (GW-8's probe; BOTH the pairing page and the admin-403 shape must be
+ *   right) → snapshot the gateway's device ids (the baseline) → mint a WEB
+ *   pairing code → remember the session IN MEMORY and answer with the
+ *   code, the URL and the expiry. The code never touches the row config,
+ *   and minting it restarts nothing — trustedProxies changes are what
+ *   restart the gateway, and any such change invalidates the session
+ *   instead (the config fingerprint below).
+ *
+ *   check(): re-read the gateway status. A device id the baseline did not
+ *   have is a freshly paired phone; the gateway's lastWebClaim record must
+ *   name THAT device with secure === true (the proxy passed
+ *   X-Forwarded-Proto: https through, so the issued cookie carries the
+ *   Secure flag). All green → pass. The claim recorded an insecure cookie →
+ *   cookie-insecure. Past the code's expiry → code-expired. Anything else →
+ *   pending, keep polling.
+ *
+ * The session binds to a CONFIG FINGERPRINT (ingressMode, domain,
+ * httpsPort, publicUrl, the gateway's ACTUAL port, host, trustedProxies):
+ * any of those moving between start and check answers stale and discards
+ * the session, because the verification proved a URL that no longer exists.
+ * The session is deliberately memory-only — a row reload (which a
+ * trustedProxies change causes) builds a fresh manager and the session is
+ * gone, exactly the same verdict the fingerprint would have produced.
+ */
+import type { ZenRemoteConfig } from '../config.js';
+import { type HostPathOutcome } from './probe.js';
+export interface VerificationManagerOptions {
+    /** Loopback base of the gateway child, `http://127.0.0.1:<port>`. */
+    gatewayBase: string;
+    /** Fresh resolved config values per call (volatile discipline). */
+    getValues: () => ZenRemoteConfig;
+    /** The hostPath probe; injectable for tests (defaults to GW-8's real one). */
+    probe?: (publicUrl: string) => Promise<HostPathOutcome>;
+    /** Whether the ingress processes are alive (Caddy / cloudflared). The
+     * wiring supplies this once the process managers are mounted; absent
+     * means "checked elsewhere" and only the gateway is probed. */
+    runtimeReady?: () => boolean | Promise<boolean>;
+    fetchImpl?: typeof fetch;
+    /** Per-gateway-call ceiling. Default 5000 ms. */
+    timeoutMs?: number;
+    /** Clock (tests drive expiry). */
+    now?: () => number;
+}
+export type VerificationStartResult = {
+    ok: true;
+    pairingCode: string;
+    publicUrl: string;
+    expiresAt: number;
+} | {
+    ok: false;
+    reason: 'no-public-url' | 'bad-public-url' | 'runtime-not-ready' | 'gateway-unreachable' | 'probe-failed' | 'pair-refused';
+    /** The probe's classifications for `probe-failed`; the gateway's status
+     * code for `pair-refused`; the normalize failure reason for
+     * `bad-public-url`. */
+    detail?: unknown;
+};
+export type VerificationCheckResult = {
+    result: 'not-started';
+} | {
+    result: 'stale';
+} | {
+    result: 'code-expired';
+} | {
+    result: 'pending';
+} | {
+    result: 'cookie-insecure';
+    deviceId: string;
+} | {
+    result: 'pass';
+    deviceId: string;
+    at: number;
+};
+/**
+ * The config fingerprint a session binds to: any drift between start and
+ * check means the verified URL is no longer the deployed URL.
+ */
+export declare function verificationFingerprint(values: ZenRemoteConfig, gatewayPort: number | null): string;
+export interface VerificationManager {
+    start(input: {
+        publicUrl: unknown;
+        probeOnly?: boolean;
+    }): Promise<VerificationStartResult>;
+    check(): Promise<VerificationCheckResult>;
+    /** Whether a verification session is open (the route surfaces it for the
+     * UI's 「待外部验证」 state). */
+    hasSession(): boolean;
+}
+export declare function createVerificationManager(options: VerificationManagerOptions): VerificationManager;
+//# sourceMappingURL=verify.d.ts.map

package/lib/types/wizard/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../../src/wizard/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAEnD,OAAO,EAAiB,KAAK,eAAe,EAAE,MAAM,YAAY,CAAA;AAEhE,MAAM,WAAW,0BAA0B;IACzC,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAA;IACnB,mEAAmE;IACnE,SAAS,EAAE,MAAM,eAAe,CAAA;IAChC,8EAA8E;IAC9E,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAA;IACvD;;mEAE+D;IAC/D,YAAY,CAAC,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CACnB;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACvE;IACA,EAAE,EAAE,KAAK,CAAA;IACT,MAAM,EAAE,eAAe,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,qBAAqB,GAAG,cAAc,GAAG,cAAc,CAAA;IAC1H;;2BAEuB;IACvB,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB,CAAA;AAEH,MAAM,MAAM,uBAAuB,GAC/B;IAAE,MAAM,EAAE,aAAa,CAAA;CAAE,GACzB;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,GACnB;IAAE,MAAM,EAAE,cAAc,CAAA;CAAE,GAC1B;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,iBAAiB,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAA;AASpD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAUnG;AAWD,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,KAAK,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAA;IAC3F,KAAK,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAAA;IACzC;8BAC0B;IAC1B,UAAU,IAAI,OAAO,CAAA;CACtB;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,0BAA0B,GAAG,mBAAmB,CAyHlG"}

package/lib/wizard/binary-io.js

@@ -0,0 +1,386 @@
+/**
+ * Ingress binary I/O (GW-2, revised by GW-fix-1/H1): download, unpack,
+ * install and cache-probe for the two wizard-managed binaries. The
+ * arithmetic lives in binary.ts; this file is the only one allowed to touch
+ * the filesystem or the network for it.
+ *
+ * House rules the tasks pin down:
+ *
+ *   - No shell, no `child_process` at all. Downloads ride `fetch`, the
+ *     body streams straight to a `.part` file, and the install is a POSIX
+ *     rename — a crash mid-download can never leave a half binary at the
+ *     install path.
+ *   - The archive wrapper comes from binary.ts's METADATA (`options.archive`,
+ *     what binaryUrls() models per platform), never from sniffing the URL:
+ *     the Caddy build API's URL is a query string whose ending says nothing
+ *     about the tar.gz / zip payload it answers with (GW-fix-1/H1).
+ *   - Windows' Caddy asset is a zip and there is no zip reader here yet:
+ *     refused up front with the typed `windows-zip-unsupported` code, the
+ *     manual-install link stays the fallback (GW-fix-1/H1 item 3).
+ *   - After unpacking (or for a bare download), a unix image must carry an
+ *     ELF or Mach-O magic; anything else is refused as `bad-binary-image`
+ *     and leaves nothing on disk (GW-fix-1/H1 item 4). Windows keeps no
+ *     magic check — PE inspection is not this module's job.
+ *   - The darwin cloudflared asset is a `.tgz`; it is unpacked with
+ *     `zlib.gunzipSync` plus a minimal ustar reader (the archive carries a
+ *     single entry — no PAX/GNU long-name handling needed, but those
+ *     header types are skipped correctly if an upstream rebuild adds one).
+ *   - Installed images get 0755; `ensureBinary` is idempotent (an existing
+ *     executable short-circuits before any network traffic).
+ *
+ * `fetch` is injectable so the tests drive real downloads against a local
+ * mock server without touching the network.
+ */
+import { accessSync, chmodSync, closeSync, constants as fsConstants, createWriteStream, mkdirSync, openSync, readFileSync, readSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+import { Readable, Transform } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { gunzipSync } from 'node:zlib';
+import { MANUAL_INSTALL_LINKS, binaryDownloadCandidates, binaryInstallPath, binDir, binaryUrls, currentPlatform, } from './binary.js';
+/** Generous ceiling on one download; a mirror gone wrong must not be able
+ * to fill the disk. Both real binaries sit far below 200 MB. */
+const MAX_DOWNLOAD_BYTES = 512 * 1024 * 1024;
+/** Connection / response-headers timeout before a mirror is skipped. */
+const CONNECT_TIMEOUT_MS = 10_000;
+/** Maximum idle gap between body chunks before a stalled mirror is aborted. */
+const STALL_TIMEOUT_MS = 15_000;
+/** ELF: `\x7fELF`. */
+const ELF_MAGIC = Buffer.from([0x7f, 0x45, 0x4c, 0x46]);
+/** Mach-O 32 big-endian, Mach-O 64 big-endian, Mach-O 64 little-endian —
+ * the three shapes Apple toolchains emit for this codebase's targets. */
+const MACH_O_MAGICS = [
+    Buffer.from([0xfe, 0xed, 0xfa, 0xce]),
+    Buffer.from([0xfe, 0xed, 0xfa, 0xcf]),
+    Buffer.from([0xcf, 0xfa, 0xed, 0xfe]),
+];
+/** Whether the first bytes of an image look like an executable this module
+ * is willing to install on a unix host (GW-fix-1/H1 item 4). */
+function looksLikeUnixImage(head) {
+    return ELF_MAGIC.equals(head) || MACH_O_MAGICS.some((magic) => magic.equals(head));
+}
+/** The first four bytes of a file (fewer when the file is shorter). */
+function headBytes(path) {
+    const head = Buffer.alloc(4);
+    const fd = openSync(path, 'r');
+    try {
+        return head.subarray(0, readSync(fd, head, 0, 4, 0));
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/**
+ * One failed or refused download/install. `code` is the wire-stable marker
+ * the UI classifies on — `'download-failed'` for transport/shaping
+ * failures, `'windows-zip-unsupported'` for the zip refusal, and
+ * `'bad-binary-image'` when the payload did not carry an executable
+ * image's magic. `installUrl` is the official manual-install page the
+ * failure card links to. Fields are assigned in the constructor body rather
+ * than declared as parameter properties (the check scripts import modules
+ * through Node's strip-only type stripping, which rejects that syntax).
+ */
+export class BinaryDownloadError extends Error {
+    code;
+    tool;
+    url;
+    status;
+    installUrl;
+    constructor(tool, url, status, message, options) {
+        super(message, options);
+        this.name = 'BinaryDownloadError';
+        this.code = options?.code ?? 'download-failed';
+        this.tool = tool;
+        this.url = url;
+        this.status = status;
+        this.installUrl = MANUAL_INSTALL_LINKS[tool];
+    }
+}
+/** Whether `path` exists and is executable (the "already installed" test). */
+function isExecutableFile(path) {
+    try {
+        if (!statSync(path).isFile())
+            return false;
+        accessSync(path, fsConstants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The installed binary's absolute path, or undefined when it is not (yet)
+ * on disk in executable shape — the read-only probe; see binary.ts's
+ * `binaryInstallPath` for the pure arithmetic.
+ */
+export function binaryPath(dshHome, tool, platform = currentPlatform()) {
+    const path = binaryInstallPath(dshHome, tool, platform);
+    return isExecutableFile(path) ? path : undefined;
+}
+/** Write one fetched response body to `partPath` under the size cap and
+ * per-chunk stall timeout so a throttled or hung mirror fails over quickly. */
+async function streamToFile(tool, url, body, partPath, onProgress) {
+    let received = 0;
+    let stallTimer;
+    const counter = new Transform({
+        transform(chunk, _encoding, done) {
+            received += chunk.length;
+            if (received > MAX_DOWNLOAD_BYTES) {
+                done(new BinaryDownloadError(tool, url, null, `the download of ${tool} exceeds the ${MAX_DOWNLOAD_BYTES}-byte cap`));
+                return;
+            }
+            if (stallTimer !== undefined)
+                clearTimeout(stallTimer);
+            stallTimer = setTimeout(() => {
+                counter.destroy(new BinaryDownloadError(tool, url, null, `the download of ${tool} stalled after ${received} bytes`));
+            }, STALL_TIMEOUT_MS);
+            if (typeof stallTimer.unref === 'function')
+                stallTimer.unref();
+            onProgress?.(received, null);
+            done(null, chunk);
+        },
+    });
+    stallTimer = setTimeout(() => {
+        counter.destroy(new BinaryDownloadError(tool, url, null, `the download of ${tool} stalled before first byte`));
+    }, STALL_TIMEOUT_MS);
+    if (typeof stallTimer.unref === 'function')
+        stallTimer.unref();
+    try {
+        await pipeline(Readable.fromWeb(body), counter, createWriteStream(partPath, { mode: 0o644 }));
+    }
+    catch (error) {
+        rmSync(partPath, { force: true });
+        throw error;
+    }
+    finally {
+        if (stallTimer !== undefined)
+            clearTimeout(stallTimer);
+    }
+}
+/** Size bytes of a ustar header's octal size field, 0 when unparsable. */
+function tarEntrySize(header) {
+    const raw = header.subarray(124, 136).toString('ascii').replace(/[\0 ]+$/g, '').trim();
+    const size = parseInt(raw === '' ? '0' : raw, 8);
+    return Number.isFinite(size) && size > 0 ? size : 0;
+}
+/**
+ * The first regular-file payload of a ustar archive as one buffer slice.
+ * The cloudflared `.tgz` carries exactly one (`cloudflared`); anything else
+ * (PAX/GNU metadata, directories) is skipped by advancing over its data
+ * blocks, so a future archive layout change degrades to "not found" instead
+ * of corrupt bytes.
+ */
+function firstTarFileEntry(archive) {
+    let offset = 0;
+    while (offset + 512 <= archive.length) {
+        const header = archive.subarray(offset, offset + 512);
+        if (header.every((byte) => byte === 0))
+            return undefined;
+        const size = tarEntrySize(header);
+        const typeflag = String.fromCharCode(header[156] ?? 0x20);
+        const dataStart = offset + 512;
+        if ((typeflag === '0' || typeflag === '\0') && size > 0 && dataStart + size <= archive.length) {
+            return archive.subarray(dataStart, dataStart + size);
+        }
+        offset = dataStart + Math.ceil(size / 512) * 512;
+    }
+    return undefined;
+}
+function chmodExec(path) {
+    try {
+        chmodSync(path, 0o755);
+    }
+    catch {
+        // Windows: no executable bit — the extension does that job.
+    }
+}
+/** Install `bytes` at `installPath`: `.part` sibling, chmod, atomic rename. */
+function installBytes(bytes, installPath) {
+    const partPath = `${installPath}.part`;
+    try {
+        writeFileSync(partPath, bytes, { mode: 0o644 });
+        chmodExec(partPath);
+        renameSync(partPath, installPath);
+    }
+    catch (error) {
+        rmSync(partPath, { force: true });
+        throw error;
+    }
+}
+/** The unix image-magic gate (GW-fix-1/H1 item 4): a payload that does not
+ * open with an ELF or Mach-O magic is refused, nothing lands on disk. */
+function assertUnixImageMagic(tool, url, status, head) {
+    if (looksLikeUnixImage(head))
+        return;
+    throw new BinaryDownloadError(tool, url, status, `the downloaded ${tool} does not carry an ELF or Mach-O image magic`, { code: 'bad-binary-image' });
+}
+/**
+ * Download one binary from an explicit URL and install it. The archive
+ * wrapper is the CALLER'S metadata (`options.archive`) — `ensureBinary`
+ * feeds it from binaryUrls(); tests pin it per fixture. `platform` only
+ * matters for the install name and the magic-check gate; it defaults to
+ * this process's.
+ * @returns the absolute install path.
+ */
+export async function downloadBinary(dshHome, tool, url, options = {}) {
+    const platform = options.platform ?? currentPlatform();
+    const archive = options.archive ?? 'none';
+    const installPath = binaryInstallPath(dshHome, tool, platform);
+    if (archive === 'zip') {
+        // Refused BEFORE any network traffic: there is no zip reader in this
+        // codebase yet (GW-fix-1/H1 item 3), and half-supporting the format
+        // would only install a zip's bytes as an image.
+        throw new BinaryDownloadError(tool, url, null, `the ${tool} asset for Windows ships as a zip, which cannot be unpacked here yet`, { code: 'windows-zip-unsupported' });
+    }
+    const fetchImpl = options.fetchImpl ?? fetch;
+    let response;
+    try {
+        response = await fetchImpl(url, {
+            redirect: 'follow',
+            signal: AbortSignal.timeout(CONNECT_TIMEOUT_MS),
+        });
+    }
+    catch (cause) {
+        throw new BinaryDownloadError(tool, url, null, `the download of ${tool} failed before an answer arrived`, { cause });
+    }
+    if (!response.ok || response.body === null) {
+        throw new BinaryDownloadError(tool, url, response.status, `the download of ${tool} answered ${response.status}`);
+    }
+    mkdirSync(binDir(dshHome), { recursive: true });
+    const declared = Number(response.headers.get('content-length'));
+    const total = Number.isFinite(declared) && declared > 0 ? declared : null;
+    const onProgress = options.onProgress
+        ? (received) => options.onProgress?.(received, total)
+        : undefined;
+    if (archive === 'tgz') {
+        // Archive (or auto-detected bare binary if an upstream endpoint serves a
+        // raw ELF/Mach-O image despite tgz metadata): land the bytes in a sibling,
+        // then either install directly when the payload already starts with a
+        // unix image magic or gunzip + extract the tar entry.
+        const tgzPath = `${installPath}.download.tgz`;
+        try {
+            await streamToFile(tool, url, response.body, tgzPath, onProgress);
+            const rawBytes = readFileSync(tgzPath);
+            const gzipMagic = rawBytes.length >= 2 && rawBytes[0] === 0x1f && rawBytes[1] === 0x8b;
+            const entry = (!gzipMagic && platform.os !== 'windows' && looksLikeUnixImage(rawBytes.subarray(0, 4)))
+                ? rawBytes
+                : firstTarFileEntry(gunzipSync(rawBytes));
+            if (entry === undefined) {
+                throw new BinaryDownloadError(tool, url, response.status, `the ${tool} archive carried no binary entry`);
+            }
+            if (platform.os !== 'windows')
+                assertUnixImageMagic(tool, url, response.status, entry.subarray(0, 4));
+            installBytes(entry, installPath);
+        }
+        catch (error) {
+            if (error instanceof BinaryDownloadError)
+                throw error;
+            throw new BinaryDownloadError(tool, url, response.status, `the ${tool} archive could not be unpacked`, { cause: error });
+        }
+        finally {
+            rmSync(tgzPath, { force: true });
+        }
+        return installPath;
+    }
+    // Bare executable: stream to the .part, gate the magic, then rename.
+    const partPath = `${installPath}.part`;
+    try {
+        await streamToFile(tool, url, response.body, partPath, onProgress);
+        if (platform.os !== 'windows')
+            assertUnixImageMagic(tool, url, response.status, headBytes(partPath));
+        chmodExec(partPath);
+        renameSync(partPath, installPath);
+    }
+    catch (error) {
+        rmSync(partPath, { force: true });
+        if (error instanceof BinaryDownloadError)
+            throw error;
+        throw new BinaryDownloadError(tool, url, response.status, `the download of ${tool} could not be written to disk`, { cause: error });
+    }
+    return installPath;
+}
+/** Cached mainland-China network detection so repeated downloads do not
+ * re-probe within the same process. */
+let cachedCnNetwork;
+/**
+ * Detect whether the current host is in mainland China:
+ * 1. Fast local check: system timezone is `Asia/Shanghai`, `Asia/Chongqing`,
+ *    `Asia/Harbin`, or `Asia/Urumqi`, or `LANG`/`LC_ALL` carries `zh_CN`.
+ * 2. Quick 1.5s probe to Cloudflare's `/cdn-cgi/trace` (`loc=CN`), or if
+ *    direct `github.com` HEAD fails/times out within 2s.
+ */
+export async function detectCnNetwork(fetchImpl = fetch) {
+    if (cachedCnNetwork !== undefined)
+        return cachedCnNetwork;
+    try {
+        const tz = Intl.DateTimeFormat().resolvedOptions().timeZone ?? '';
+        if (/^Asia\/(Shanghai|Chongqing|Harbin|Urumqi)$/i.test(tz)) {
+            cachedCnNetwork = true;
+            return true;
+        }
+    }
+    catch { /* ignore */ }
+    const envLang = `${process.env.LANG ?? ''} ${process.env.LC_ALL ?? ''}`;
+    if (/zh_CN/i.test(envLang)) {
+        cachedCnNetwork = true;
+        return true;
+    }
+    try {
+        const trace = await fetchImpl('https://www.cloudflare.com/cdn-cgi/trace', {
+            signal: AbortSignal.timeout(1500),
+        });
+        if (trace.ok) {
+            const text = await trace.text();
+            if (/\bloc=CN\b/i.test(text)) {
+                cachedCnNetwork = true;
+                return true;
+            }
+            cachedCnNetwork = false;
+            return false;
+        }
+    }
+    catch {
+        // ignore trace timeout
+    }
+    cachedCnNetwork = false;
+    return false;
+}
+/**
+ * The idempotent front door: an already-installed executable short-circuits
+ * (no network), anything else downloads from the official distribution
+ * point for the tool, archive shape included.
+ *
+ * When using the default `fetch` transport, automatically detects mainland
+ * China network environments and tries prebuilt GitHub Release mirrors
+ * (`gh-proxy.com` / `ghfast.top`) + direct GitHub Release before falling back
+ * to `caddyserver.com/api/download`. When a custom `fetchImpl` is injected
+ * (unit tests), calls the canonical `binaryUrls(platform)` endpoint directly.
+ * @returns the absolute install path and whether THIS call downloaded.
+ */
+export async function ensureBinary(dshHome, tool, options = {}) {
+    const platform = options.platform ?? currentPlatform();
+    const existing = binaryPath(dshHome, tool, platform);
+    if (existing !== undefined)
+        return { path: existing, downloaded: false };
+    if (options.fetchImpl !== undefined) {
+        const urls = binaryUrls(platform);
+        const [url, archive] = tool === 'caddy' ? [urls.caddy, urls.caddyArchive] : [urls.cloudflared, urls.cloudflaredArchive];
+        const path = await downloadBinary(dshHome, tool, url, { ...options, archive });
+        return { path, downloaded: true };
+    }
+    const preferCnMirror = await detectCnNetwork();
+    const candidates = binaryDownloadCandidates(tool, platform, preferCnMirror);
+    let lastError;
+    for (const candidate of candidates) {
+        try {
+            const path = await downloadBinary(dshHome, tool, candidate.url, {
+                ...options,
+                archive: candidate.archive,
+            });
+            return { path, downloaded: true };
+        }
+        catch (error) {
+            lastError = error;
+        }
+    }
+    throw lastError;
+}
+//# sourceMappingURL=binary-io.js.map

package/lib/wizard/binary-io.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binary-io.js","sourceRoot":"","sources":["../../src/wizard/binary-io.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EACL,UAAU,EACV,SAAS,EACT,SAAS,EACT,SAAS,IAAI,WAAW,EACxB,iBAAiB,EACjB,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,QAAQ,EACR,UAAU,EACV,MAAM,EACN,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAE/C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,MAAM,EACN,UAAU,EACV,eAAe,GAIhB,MAAM,aAAa,CAAA;AAEpB;gEACgE;AAChE,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAA;AAC5C,wEAAwE;AACxE,MAAM,kBAAkB,GAAG,MAAM,CAAA;AACjC,+EAA+E;AAC/E,MAAM,gBAAgB,GAAG,MAAM,CAAA;AAE/B,sBAAsB;AACtB,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;AACvD;yEACyE;AACzE,MAAM,aAAa,GAAG;IACpB,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;CACtC,CAAA;AAED;gEACgE;AAChE,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;AACpF,CAAC;AAED,uEAAuE;AACvE,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC5B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC9B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACtD,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAA;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,IAAI,CAAQ;IACZ,IAAI,CAAe;IACnB,GAAG,CAAQ;IACX,MAAM,CAAe;IACrB,UAAU,CAAQ;IAE3B,YAAY,IAAmB,EAAE,GAAW,EAAE,MAAqB,EAAE,OAAe,EAAE,OAA4C;QAChI,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;QACjC,IAAI,CAAC,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,iBAAiB,CAAA;QAC9C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;QACd,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;IAC9C,CAAC;CACF;AAED,8EAA8E;AAC9E,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE;YAAE,OAAO,KAAK,CAAA;QAC1C,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAA;QAClC,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,IAAmB,EAAE,WAA2B,eAAe,EAAE;IAC3G,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;IACvD,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AAClD,CAAC;AAgBD;+EAC+E;AAC/E,KAAK,UAAU,YAAY,CACzB,IAAmB,EACnB,GAAW,EACX,IAAuC,EACvC,QAAgB,EAChB,UAAwC;IAExC,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,UAAqD,CAAA;IACzD,MAAM,OAAO,GAAG,IAAI,SAAS,CAAC;QAC5B,SAAS,CAAC,KAAa,EAAE,SAAS,EAAE,IAAI;YACtC,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAA;YACxB,IAAI,QAAQ,GAAG,kBAAkB,EAAE,CAAC;gBAClC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,IAAI,gBAAgB,kBAAkB,WAAW,CAAC,CAAC,CAAA;gBACpH,OAAM;YACR,CAAC;YACD,IAAI,UAAU,KAAK,SAAS;gBAAE,YAAY,CAAC,UAAU,CAAC,CAAA;YACtD,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC3B,OAAO,CAAC,OAAO,CAAC,IAAI,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,IAAI,kBAAkB,QAAQ,QAAQ,CAAC,CAAC,CAAA;YACtH,CAAC,EAAE,gBAAgB,CAAC,CAAA;YACpB,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;gBAAE,UAAU,CAAC,KAAK,EAAE,CAAA;YAC9D,UAAU,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;YAC5B,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACnB,CAAC;KACF,CAAC,CAAA;IACF,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;QAC3B,OAAO,CAAC,OAAO,CAAC,IAAI,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,IAAI,4BAA4B,CAAC,CAAC,CAAA;IAChH,CAAC,EAAE,gBAAgB,CAAC,CAAA;IACpB,IAAI,OAAO,UAAU,CAAC,KAAK,KAAK,UAAU;QAAE,UAAU,CAAC,KAAK,EAAE,CAAA;IAC9D,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,iBAAiB,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IAC/F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACjC,MAAM,KAAK,CAAA;IACb,CAAC;YAAS,CAAC;QACT,IAAI,UAAU,KAAK,SAAS;YAAE,YAAY,CAAC,UAAU,CAAC,CAAA;IACxD,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IACtF,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IAChD,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;AACrD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,OAAO,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,CAAA;QACrD,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC;YAAE,OAAO,SAAS,CAAA;QACxD,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;QACjC,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAA;QACzD,MAAM,SAAS,GAAG,MAAM,GAAG,GAAG,CAAA;QAC9B,IAAI,CAAC,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,SAAS,GAAG,IAAI,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YAC9F,OAAO,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC,CAAA;QACtD,CAAC;QACD,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,GAAG,CAAA;IAClD,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS,YAAY,CAAC,KAAiB,EAAE,WAAmB;IAC1D,MAAM,QAAQ,GAAG,GAAG,WAAW,OAAO,CAAA;IACtC,IAAI,CAAC;QACH,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC/C,SAAS,CAAC,QAAQ,CAAC,CAAA;QACnB,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACjC,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED;yEACyE;AACzE,SAAS,oBAAoB,CAAC,IAAmB,EAAE,GAAW,EAAE,MAAqB,EAAE,IAAY;IACjG,IAAI,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAM;IACpC,MAAM,IAAI,mBAAmB,CAC3B,IAAI,EACJ,GAAG,EACH,MAAM,EACN,kBAAkB,IAAI,8CAA8C,EACpE,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAC7B,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAe,EACf,IAAmB,EACnB,GAAW,EACX,UAAiC,EAAE;IAEnC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAA;IACtD,MAAM,OAAO,GAAkB,OAAO,CAAC,OAAO,IAAI,MAAM,CAAA;IACxD,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC9D,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,qEAAqE;QACrE,oEAAoE;QACpE,gDAAgD;QAChD,MAAM,IAAI,mBAAmB,CAC3B,IAAI,EACJ,GAAG,EACH,IAAI,EACJ,OAAO,IAAI,sEAAsE,EACjF,EAAE,IAAI,EAAE,yBAAyB,EAAE,CACpC,CAAA;IACH,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAA;IAC5C,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YAC9B,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAChD,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,IAAI,kCAAkC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IACtH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC3C,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,mBAAmB,IAAI,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IAClH,CAAC;IACD,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAA;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;IACzE,MAAM,UAAU,GAAiC,OAAO,CAAC,UAAU;QACjE,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC;QACrD,CAAC,CAAC,SAAS,CAAA;IACb,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,yEAAyE;QACzE,2EAA2E;QAC3E,sEAAsE;QACtE,sDAAsD;QACtD,MAAM,OAAO,GAAG,GAAG,WAAW,eAAe,CAAA;QAC7C,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAoD,EAAE,OAAO,EAAE,UAAU,CAAC,CAAA;YACjH,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;YACtC,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAA;YACtF,MAAM,KAAK,GAAG,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS,IAAI,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACpG,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;YAC3C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,IAAI,kCAAkC,CAAC,CAAA;YAC1G,CAAC;YACD,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS;gBAAE,oBAAoB,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YACrG,YAAY,CAAC,KAAK,EAAE,WAAW,CAAC,CAAA;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,mBAAmB;gBAAE,MAAM,KAAK,CAAA;YACrD,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,IAAI,gCAAgC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QAC1H,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAClC,CAAC;QACD,OAAO,WAAW,CAAA;IACpB,CAAC;IACD,qEAAqE;IACrE,MAAM,QAAQ,GAAG,GAAG,WAAW,OAAO,CAAA;IACtC,IAAI,CAAC;QACH,MAAM,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAoD,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAA;QAClH,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS;YAAE,oBAAoB,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAA;QACpG,SAAS,CAAC,QAAQ,CAAC,CAAA;QACnB,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACjC,IAAI,KAAK,YAAY,mBAAmB;YAAE,MAAM,KAAK,CAAA;QACrD,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,mBAAmB,IAAI,+BAA+B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IACrI,CAAC;IACD,OAAO,WAAW,CAAA;AACpB,CAAC;AAOD;uCACuC;AACvC,IAAI,eAAoC,CAAA;AAExC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,YAA0B,KAAK;IACnE,IAAI,eAAe,KAAK,SAAS;QAAE,OAAO,eAAe,CAAA;IACzD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAA;QACjE,IAAI,6CAA6C,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3D,eAAe,GAAG,IAAI,CAAA;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACxB,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAA;IACvE,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,eAAe,GAAG,IAAI,CAAA;QACtB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,0CAA0C,EAAE;YACxE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAA;QACF,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;YAC/B,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,eAAe,GAAG,IAAI,CAAA;gBACtB,OAAO,IAAI,CAAA;YACb,CAAC;YACD,eAAe,GAAG,KAAK,CAAA;YACvB,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uBAAuB;IACzB,CAAC;IACD,eAAe,GAAG,KAAK,CAAA;IACvB,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAe,EACf,IAAmB,EACnB,UAA+B,EAAE;IAEjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,eAAe,EAAE,CAAA;IACtD,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAA;IACpD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,CAAA;IACxE,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;QACjC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAA;QACvH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;QAC9E,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;IACnC,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,eAAe,EAAE,CAAA;IAC9C,MAAM,UAAU,GAAG,wBAAwB,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAA;IAC3E,IAAI,SAAkB,CAAA;IACtB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,GAAG,EAAE;gBAC9D,GAAG,OAAO;gBACV,OAAO,EAAE,SAAS,CAAC,OAAO;aAC3B,CAAC,CAAA;YACF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,KAAK,CAAA;QACnB,CAAC;IACH,CAAC;IACD,MAAM,SAAS,CAAA;AACjB,CAAC"}

package/lib/wizard/binary.js

@@ -0,0 +1,138 @@
+/**
+ * Ingress binary arithmetic (GW-2): platform mapping, download-URL
+ * construction and install-path computation for the two binaries the
+ * gateway wizard manages — Caddy (custom build with the Cloudflare DNS
+ * module, for DNS-01 certificates) and cloudflared (the tunnel client).
+ *
+ * Pure by contract: URL strings, path strings and platform facts only —
+ * every touch of the filesystem or the network lives in binary-io.ts, and
+ * the routes layer reads both. `node:path`/`node:os` here are arithmetic,
+ * not I/O: the same discipline as virtual-id.ts's zero-dependency rule,
+ * relaxed one notch because path building is this module's whole job.
+ *
+ * Platform coverage mirrors what both upstream distribution points actually
+ * ship: darwin/linux/windows × amd64/arm64. macOS arm64's cloudflared asset
+ * is a `.tgz` (the only archive shape in the set) — binary-io unpacks it.
+ */
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+/** This process's platform, mapped into the download points' naming. */
+export function currentPlatform() {
+    if (process.platform === 'win32')
+        return { os: 'windows', arch: 'amd64' };
+    const arch = process.arch === 'arm64' ? 'arm64' : 'amd64';
+    if (process.platform === 'darwin')
+        return { os: 'darwin', arch };
+    return { os: 'linux', arch };
+}
+/** Caddy's custom-build API, pinned to the Cloudflare DNS module the
+ * DNS-01 challenge needs (plain Caddy cannot write the TXT record). */
+export function caddyDownloadUrl(platform) {
+    return `https://caddyserver.com/api/download?os=${platform.os}&arch=${platform.arch}&p=github.com/caddy-dns/cloudflare`;
+}
+/**
+ * The Caddy asset the build API answers with, PLUS its archive shape —
+ * `caddyserver.com/api/download` returns a bare Mach-O/ELF binary on unix
+ * (`Content-Disposition: attachment; filename="caddy_<os>_<arch>_custom"`,
+ * `Content-Type: application/octet-stream`) and a bare `.exe` on Windows.
+ */
+export function caddyDownload(platform) {
+    return { url: caddyDownloadUrl(platform), archive: platform.os === 'windows' ? 'exe' : 'none' };
+}
+/** cloudflared's GitHub Releases asset for one platform, plus the archive
+ * shape the I/O half must unwrap (darwin assets are `.tgz`, windows ships
+ * a bare `.exe`, linux a bare binary). */
+export function cloudflaredDownload(platform) {
+    const base = 'https://github.com/cloudflare/cloudflared/releases/latest/download/';
+    if (platform.os === 'darwin')
+        return { url: `${base}cloudflared-darwin-${platform.arch}.tgz`, archive: 'tgz' };
+    if (platform.os === 'windows')
+        return { url: `${base}cloudflared-windows-amd64.exe`, archive: 'exe' };
+    return { url: `${base}cloudflared-linux-${platform.arch}`, archive: 'none' };
+}
+/** Both download URLs for one platform WITH their archive shapes, defaults
+ * to the running process's. The archive metadata — not a URL suffix — is
+ * what tells the I/O half how to unpack. */
+export function binaryUrls(platform = currentPlatform()) {
+    const caddy = caddyDownload(platform);
+    const cloudflared = cloudflaredDownload(platform);
+    return { caddy: caddy.url, caddyArchive: caddy.archive, cloudflared: cloudflared.url, cloudflaredArchive: cloudflared.archive };
+}
+/** Official manual-install pages, surfaced by the UI when a download fails. */
+export const MANUAL_INSTALL_LINKS = {
+    caddy: 'https://caddyserver.com/download',
+    cloudflared: 'https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/',
+};
+/** Everything ingress lives under this one directory of DSH_HOME. */
+export const INGRESS_DIR_NAME = 'zen-remote-ingress';
+/** `<DSH_HOME>` as the rest of the plugin resolves it (config.ts's convention). */
+export function dshHomeDefault(env = process.env) {
+    return env.DSH_HOME ?? join(homedir(), '.dsh');
+}
+/** `<DSH_HOME>/zen-remote-ingress` — Caddyfile, data dir and bin/ sit here. */
+export function ingressDir(dshHome) {
+    return join(dshHome, INGRESS_DIR_NAME);
+}
+/** `<DSH_HOME>/zen-remote-ingress/bin` — both binaries install here. */
+export function binDir(dshHome) {
+    return join(ingressDir(dshHome), 'bin');
+}
+/** `<DSH_HOME>/zen-remote-ingress/Caddyfile` — generated, validated, then
+ * handed to `caddy run --config`. */
+export function caddyfilePath(dshHome) {
+    return join(ingressDir(dshHome), 'Caddyfile');
+}
+/** `<DSH_HOME>/zen-remote-ingress/caddy-data` — certificates and the ACME
+ * account live here, kept out of the default Caddy home. */
+export function caddyDataDir(dshHome) {
+    return join(ingressDir(dshHome), 'caddy-data');
+}
+/** The installed file name. Windows cannot spawn an extension-less image,
+ * so the `.exe` suffix is part of the install name there. */
+export function binaryFileName(tool, platform = currentPlatform()) {
+    if (platform.os === 'windows')
+        return tool === 'caddy' ? 'caddy.exe' : 'cloudflared.exe';
+    return tool;
+}
+/** The absolute install path for one binary (where downloadBinary puts it). */
+export function binaryInstallPath(dshHome, tool, platform = currentPlatform()) {
+    return join(binDir(dshHome), binaryFileName(tool, platform));
+}
+/** Prebuilt Caddy + `github.com/caddy-dns/cloudflare` release assets hosted
+ * on this repository's `caddy-cloudflare` GitHub Release (built by
+ * `.github/workflows/caddy-assets.yml`). Unlike `caddyserver.com/api/download`
+ * — which compiles on the fly and throttles downloads to ~13 KB/s — these
+ * static GitHub Release assets download in seconds and work with mainland
+ * China GitHub acceleration mirrors (`gh-proxy.com` / `ghfast.top`). */
+export function caddyPrebuiltDownload(platform) {
+    const base = 'https://github.com/KyoMio/dsh-zen-remote/releases/download/caddy-cloudflare/';
+    if (platform.os === 'windows')
+        return { url: `${base}caddy-windows-amd64.exe`, archive: 'exe' };
+    return { url: `${base}caddy-${platform.os}-${platform.arch}.tgz`, archive: 'tgz' };
+}
+/** Mainland China GitHub release acceleration mirrors, tried first when the
+ * host environment is detected as mainland China (or tried as fallbacks if
+ * direct GitHub times out). */
+export const GITHUB_MIRROR_PREFIXES = [
+    'https://gh-proxy.com/',
+    'https://ghfast.top/',
+];
+/** Ordered candidate downloads for one binary and platform:
+ * - When `preferCnMirror` is true, GitHub Release URLs through mainland
+ *   mirrors come first, followed by direct GitHub Release URL, and finally
+ *   (for Caddy) the upstream `caddyserver.com/api/download` fallback.
+ * - When `preferCnMirror` is false, direct GitHub Release comes first, then
+ *   mainland mirrors, then the upstream build API fallback. */
+export function binaryDownloadCandidates(tool, platform = currentPlatform(), preferCnMirror = false) {
+    const primary = tool === 'caddy' ? caddyPrebuiltDownload(platform) : cloudflaredDownload(platform);
+    const mirrored = GITHUB_MIRROR_PREFIXES.map((prefix) => ({
+        url: `${prefix}${primary.url}`,
+        archive: primary.archive,
+    }));
+    const ordered = preferCnMirror ? [...mirrored, primary] : [primary, ...mirrored];
+    if (tool === 'caddy') {
+        ordered.push(caddyDownload(platform));
+    }
+    return ordered;
+}
+//# sourceMappingURL=binary.js.map

package/lib/wizard/binary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binary.js","sourceRoot":"","sources":["../../src/wizard/binary.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAwBjC,wEAAwE;AACxE,MAAM,UAAU,eAAe;IAC7B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IACzE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAA;IACzD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAChE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC9B,CAAC;AAED;uEACuE;AACvE,MAAM,UAAU,gBAAgB,CAAC,QAAwB;IACvD,OAAO,2CAA2C,QAAQ,CAAC,EAAE,SAAS,QAAQ,CAAC,IAAI,oCAAoC,CAAA;AACzH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,QAAwB;IACpD,OAAO,EAAE,GAAG,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;AACjG,CAAC;AAED;;0CAE0C;AAC1C,MAAM,UAAU,mBAAmB,CAAC,QAAwB;IAC1D,MAAM,IAAI,GAAG,qEAAqE,CAAA;IAClF,IAAI,QAAQ,CAAC,EAAE,KAAK,QAAQ;QAAE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,sBAAsB,QAAQ,CAAC,IAAI,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAC9G,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,+BAA+B,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IACrG,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,qBAAqB,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;AAC9E,CAAC;AAED;;4CAE4C;AAC5C,MAAM,UAAU,UAAU,CACxB,WAA2B,eAAe,EAAE;IAE5C,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;IACrC,MAAM,WAAW,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAA;IACjD,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,GAAG,EAAE,kBAAkB,EAAE,WAAW,CAAC,OAAO,EAAE,CAAA;AACjI,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,oBAAoB,GAA4C;IAC3E,KAAK,EAAE,kCAAkC;IACzC,WAAW,EAAE,0FAA0F;CACxG,CAAA;AAED,qEAAqE;AACrE,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAA;AAEpD,mFAAmF;AACnF,MAAM,UAAU,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,OAAO,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAA;AAChD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAA;AACxC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,MAAM,CAAC,OAAe;IACpC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAA;AACzC,CAAC;AAED;qCACqC;AACrC,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,WAAW,CAAC,CAAA;AAC/C,CAAC;AAED;4DAC4D;AAC5D,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,CAAA;AAChD,CAAC;AAED;6DAC6D;AAC7D,MAAM,UAAU,cAAc,CAAC,IAAmB,EAAE,WAA2B,eAAe,EAAE;IAC9F,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS;QAAE,OAAO,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,iBAAiB,CAAA;IACxF,OAAO,IAAI,CAAA;AACb,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,IAAmB,EAAE,WAA2B,eAAe,EAAE;IAClH,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;wEAKwE;AACxE,MAAM,UAAU,qBAAqB,CAAC,QAAwB;IAC5D,MAAM,IAAI,GAAG,8EAA8E,CAAA;IAC3F,IAAI,QAAQ,CAAC,EAAE,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,yBAAyB,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAC/F,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,SAAS,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;AACpF,CAAC;AAED;;+BAE+B;AAC/B,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,uBAAuB;IACvB,qBAAqB;CACb,CAAA;AAEV;;;;;+DAK+D;AAC/D,MAAM,UAAU,wBAAwB,CACtC,IAAmB,EACnB,WAA2B,eAAe,EAAE,EAC5C,cAAc,GAAG,KAAK;IAEtB,MAAM,OAAO,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAA;IAClG,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACvD,GAAG,EAAE,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC,CAAA;IACH,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAA;IAChF,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAA;IACvC,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}