jorgex-stack 1.9.62 → 1.9.63

package/dist/chunk-KGL5VNVZ.js

@@ -1,305 +0,0 @@
-#!/usr/bin/env node
-
-// src/lib/pi-release-resolver.ts
-import fs from "fs";
-import path from "path";
-import { createHash, randomBytes, timingSafeEqual } from "crypto";
-var REGISTRY_URL = "https://registry.npmjs.org/jorgex-pi";
-var REGISTRY_HOST = "registry.npmjs.org";
-var ACCEPT = "application/vnd.npm.install-v1+json";
-var MAX_METADATA_BYTES = 4 * 1024 * 1024;
-var FETCH_TIMEOUT_MS = 1e4;
-var STABLE_SEMVER = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
-function fail(message) {
-  throw new Error(`pi-release-resolver: ${message}`);
-}
-function isRecord(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function canonicalTarballUrl(version) {
-  return `https://registry.npmjs.org/jorgex-pi/-/jorgex-pi-${version}.tgz`;
-}
-async function readBoundedText(response) {
-  if (response.body === null) fail("missing response body");
-  const reader = response.body.getReader();
-  const chunks = [];
-  let total = 0;
-  try {
-    for (; ; ) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      total += value.byteLength;
-      if (total >= MAX_METADATA_BYTES) {
-        await reader.cancel().catch(() => {
-        });
-        fail("metadata exceeds 4 MiB");
-      }
-      chunks.push(value);
-    }
-  } finally {
-    reader.releaseLock();
-  }
-  return Buffer.concat(chunks.map((chunk) => Buffer.from(chunk))).toString("utf8");
-}
-function assertCanonicalIntegrity(integrity) {
-  if (typeof integrity !== "string" || !integrity.startsWith("sha512-")) {
-    fail("invalid integrity (expected canonical sha512 SRI)");
-  }
-  const b64 = integrity.slice("sha512-".length);
-  if (!/^[A-Za-z0-9+/]+={0,2}$/.test(b64)) fail("invalid integrity (expected canonical sha512 SRI)");
-  let bytes;
-  try {
-    bytes = Buffer.from(b64, "base64");
-  } catch {
-    fail("invalid integrity (expected canonical sha512 SRI)");
-  }
-  if (bytes.length !== 64 || bytes.toString("base64") !== b64) {
-    fail("invalid integrity (expected canonical sha512 SRI)");
-  }
-}
-async function resolveLatestPiRelease(fetchImpl) {
-  const response = await fetchImpl(REGISTRY_URL, {
-    headers: { Accept: ACCEPT },
-    redirect: "error",
-    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
-  });
-  if (!response.ok) fail(`registry responded ${response.status}`);
-  if (response.url !== REGISTRY_URL) fail(`unexpected response URL ${response.url}`);
-  const lengthHeader = response.headers.get("content-length");
-  if (lengthHeader !== null) {
-    const trimmed = lengthHeader.trim();
-    if (!/^\d+$/.test(trimmed)) fail("invalid content-length");
-    if (Number(trimmed) > MAX_METADATA_BYTES) fail("metadata exceeds 4 MiB");
-  }
-  const text = await readBoundedText(response);
-  let data;
-  try {
-    data = JSON.parse(text);
-  } catch {
-    fail("malformed packument JSON");
-  }
-  if (!isRecord(data) || data["name"] !== "jorgex-pi") fail("malformed packument name");
-  const tags = data["dist-tags"];
-  if (!isRecord(tags) || typeof tags["latest"] !== "string") fail("missing dist-tags.latest");
-  const latest = tags["latest"];
-  if (!STABLE_SEMVER.test(latest)) fail(`unstable or malformed version ${latest}`);
-  const versions = data["versions"];
-  if (!isRecord(versions)) fail("missing versions map");
-  const entry = versions[latest];
-  if (!isRecord(entry)) fail(`missing versions[${latest}]`);
-  if (entry["name"] !== "jorgex-pi" || entry["version"] !== latest) {
-    fail("version mismatch in versions entry");
-  }
-  if (entry["deprecated"] !== void 0) fail(`version ${latest} is deprecated`);
-  const dist = entry["dist"];
-  if (!isRecord(dist)) fail("missing dist");
-  const { tarball, integrity } = dist;
-  if (typeof tarball !== "string" || typeof integrity !== "string") {
-    fail("missing dist.tarball/integrity");
-  }
-  let parsed;
-  try {
-    parsed = new URL(tarball);
-  } catch {
-    fail("foreign tarball URL");
-  }
-  if (parsed.protocol !== "https:" || parsed.host !== REGISTRY_HOST || tarball !== canonicalTarballUrl(latest)) {
-    fail("foreign tarball URL");
-  }
-  assertCanonicalIntegrity(integrity);
-  return { version: latest, tarballUrl: tarball, integrity };
-}
-var MAX_TARBALL_BYTES = 128 * 1024 * 1024;
-var TARBALL_FETCH_TIMEOUT_MS = 12e4;
-function expectedSha512Digest(integrity) {
-  assertCanonicalIntegrity(integrity);
-  return Buffer.from(integrity.slice("sha512-".length), "base64");
-}
-function assertCanonicalReleaseInput(release) {
-  if (!isRecord(release)) fail("invalid release");
-  const { version, tarballUrl, integrity } = release;
-  if (typeof version !== "string" || !STABLE_SEMVER.test(version)) fail("invalid release version");
-  if (typeof tarballUrl !== "string") fail("foreign tarball URL");
-  let parsed;
-  try {
-    parsed = new URL(tarballUrl);
-  } catch {
-    fail("foreign tarball URL");
-  }
-  if (parsed.protocol !== "https:" || parsed.host !== REGISTRY_HOST || tarballUrl !== canonicalTarballUrl(version)) {
-    fail("foreign tarball URL");
-  }
-  return { tarballUrl, expectedSha512: expectedSha512Digest(integrity) };
-}
-function readExistingArtifact(file) {
-  const stat = fs.statSync(file, { throwIfNoEntry: false });
-  if (stat === void 0) return null;
-  if (!stat.isFile()) fail("destination is not a regular file");
-  let fd;
-  try {
-    fd = fs.openSync(file, "r");
-  } catch {
-    fail("cannot read existing destination");
-  }
-  const sha256 = createHash("sha256");
-  const sha512 = createHash("sha512");
-  const buffer = Buffer.allocUnsafe(1024 * 1024);
-  let bytes = 0;
-  try {
-    for (; ; ) {
-      const read = fs.readSync(fd, buffer, 0, buffer.length, null);
-      if (read === 0) break;
-      bytes += read;
-      if (bytes >= MAX_TARBALL_BYTES) fail("existing destination exceeds tarball bound");
-      sha256.update(buffer.subarray(0, read));
-      sha512.update(buffer.subarray(0, read));
-    }
-  } finally {
-    try {
-      fs.closeSync(fd);
-    } catch {
-    }
-  }
-  return { bytes, sha256: sha256.digest("hex"), sha512: sha512.digest("hex") };
-}
-async function downloadVerifiedPiTarball(release, destination, fetchImpl) {
-  const { tarballUrl, expectedSha512 } = assertCanonicalReleaseInput(release);
-  if (typeof destination !== "string" || destination === "") fail("invalid destination");
-  const existing = readExistingArtifact(destination);
-  if (existing !== null) {
-    const existing512 = Buffer.from(existing.sha512, "hex");
-    if (existing512.length === expectedSha512.length && timingSafeEqual(existing512, expectedSha512)) {
-      return { path: destination, bytes: existing.bytes, sha256: existing.sha256, sha512: existing.sha512 };
-    }
-    fail("destination bytes do not match requested integrity");
-  }
-  let response;
-  try {
-    response = await fetchImpl(tarballUrl, {
-      headers: { accept: "application/octet-stream" },
-      redirect: "error",
-      signal: AbortSignal.timeout(TARBALL_FETCH_TIMEOUT_MS)
-    });
-  } catch (error) {
-    fail(`tarball fetch failed: ${error instanceof Error ? error.message : String(error)}`);
-  }
-  if (!response.ok) fail(`tarball responded ${response.status}`);
-  if (response.url !== tarballUrl) fail(`unexpected tarball response URL ${response.url}`);
-  const declared = response.headers.get("content-length");
-  if (declared !== null) {
-    const trimmed = declared.trim();
-    if (!/^\d+$/.test(trimmed)) fail("invalid tarball content-length");
-    if (Number(trimmed) > MAX_TARBALL_BYTES) fail("tarball exceeds 128 MiB");
-  }
-  if (response.body === null) fail("missing tarball body");
-  const tempPath = path.join(
-    path.dirname(destination),
-    `jorgex-pi-partial-${process.pid}-${randomBytes(8).toString("hex")}`
-  );
-  let fd;
-  try {
-    fd = fs.openSync(tempPath, "wx", 384);
-  } catch {
-    fail("cannot stage tarball temp");
-  }
-  let fdClosed = false;
-  const closeFd = () => {
-    if (fdClosed) return;
-    fdClosed = true;
-    try {
-      fs.closeSync(fd);
-    } catch {
-    }
-  };
-  const discardStaged = () => {
-    closeFd();
-    try {
-      fs.rmSync(tempPath, { force: true });
-    } catch {
-    }
-  };
-  try {
-    const reader = response.body.getReader();
-    const sha256 = createHash("sha256");
-    const sha512 = createHash("sha512");
-    let bytes = 0;
-    try {
-      for (; ; ) {
-        const { done, value } = await reader.read();
-        if (done) break;
-        bytes += value.byteLength;
-        if (bytes + value.byteLength >= MAX_TARBALL_BYTES) {
-          await reader.cancel().catch(() => {
-          });
-          fail("tarball exceeds 128 MiB");
-        }
-        sha256.update(value);
-        sha512.update(value);
-        let offset = 0;
-        while (offset < value.byteLength) {
-          offset += fs.writeSync(fd, value, offset, value.byteLength - offset);
-        }
-      }
-    } finally {
-      reader.releaseLock();
-    }
-    closeFd();
-    const actual512 = sha512.digest();
-    if (!timingSafeEqual(actual512, expectedSha512)) fail("tarball integrity mismatch");
-    try {
-      fs.linkSync(tempPath, destination);
-    } catch {
-      fail("tarball publish raced with existing destination");
-    }
-    try {
-      fs.rmSync(tempPath, { force: true });
-    } catch {
-    }
-    return { path: destination, bytes, sha256: sha256.digest("hex"), sha512: actual512.toString("hex") };
-  } catch (error) {
-    discardStaged();
-    if (error instanceof Error && error.message.startsWith("pi-release-resolver: ")) throw error;
-    fail(`tarball download failed: ${error instanceof Error ? error.message : String(error)}`);
-  }
-}
-var PRODUCER_REF_API = "https://api.github.com/repos/jorgehn98/jorgex-pi/git/ref/tags";
-var PRODUCER_ACCEPT = "application/vnd.github+json";
-var SHA40_HEX = /^[0-9a-f]{40}$/;
-function producerTagUrl(version) {
-  return `${PRODUCER_REF_API}/v${version}`;
-}
-async function resolvePiProducerCommit(version, fetchImpl) {
-  if (typeof version !== "string" || !STABLE_SEMVER.test(version)) fail("invalid producer version");
-  const url = producerTagUrl(version);
-  let response;
-  try {
-    response = await fetchImpl(url, {
-      headers: { accept: PRODUCER_ACCEPT },
-      redirect: "error",
-      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
-    });
-  } catch (error) {
-    fail(`producer ref fetch failed: ${error instanceof Error ? error.message : String(error)}`);
-  }
-  if (!response.ok) fail(`producer ref responded ${response.status}`);
-  if (response.url !== url) fail(`unexpected producer ref response URL ${response.url}`);
-  const text = await readBoundedText(response);
-  let data;
-  try {
-    data = JSON.parse(text);
-  } catch {
-    fail("malformed producer ref JSON");
-  }
-  if (!isRecord(data) || data["ref"] !== `refs/tags/v${version}`) fail("producer ref mismatch");
-  const object = data["object"];
-  if (!isRecord(object) || object["type"] !== "commit") fail("producer ref is not a lightweight tag commit");
-  const sha = object["sha"];
-  if (typeof sha !== "string" || !SHA40_HEX.test(sha)) fail("invalid producer commit sha");
-  return sha;
-}
-
-export {
-  resolveLatestPiRelease,
-  downloadVerifiedPiTarball,
-  resolvePiProducerCommit
-};