kynjal-cli 4.0.0 → 4.0.1

package/dist/src/appliance/rvfa-distribution.js

@@ -7,53 +7,6 @@
  * RVFP layout: [4B "RVFP"] [4B version u32LE] [4B header_len u32LE]
  *              [header JSON] [new section data] [32B SHA256 footer]
  */
-var __assign = (this && this.__assign) || function () {
-    __assign = Object.assign || function(t) {
-        for (var s, i = 1, n = arguments.length; i < n; i++) {
-            s = arguments[i];
-            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
-                t[p] = s[p];
-        }
-        return t;
-    };
-    return __assign.apply(this, arguments);
-};
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-var __generator = (this && this.__generator) || function (thisArg, body) {
-    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
-    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
-    function verb(n) { return function (v) { return step([n, v]); }; }
-    function step(op) {
-        if (f) throw new TypeError("Generator is already executing.");
-        while (_) try {
-            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
-            if (y = 0, t) op = [op[0] & 2, t.value];
-            switch (op[0]) {
-                case 0: case 1: t = op; break;
-                case 4: _.label++; return { value: op[1], done: false };
-                case 5: _.label++; y = op[1]; op = [0]; continue;
-                case 7: op = _.ops.pop(); _.trys.pop(); continue;
-                default:
-                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
-                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
-                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
-                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
-                    if (t[2]) _.ops.pop();
-                    _.trys.pop(); continue;
-            }
-            op = body.call(thisArg, _);
-        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
-        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
-    }
-};
 import { createHash, sign, verify as edVerify } from 'node:crypto';
 import { readFile, writeFile, rename, unlink, copyFile, mkdir } from 'node:fs/promises';
 import { dirname } from 'node:path';
@@ -61,16 +14,16 @@ import { request as httpsRequest } from 'node:https';
 import { gzipSync, gunzipSync } from 'node:zlib';
 import { RvfaReader, RvfaWriter } from './rvfa-format.js';
 // ── Constants ────────────────────────────────────────────────
-var RVFP_VERSION = 1;
-var PRE = 12; // preamble: 4 magic + 4 version + 4 header_len
-var SHA_LEN = 32;
-var DEFAULT_GW = 'https://gateway.pinata.cloud';
-var DEFAULT_API = 'https://api.pinata.cloud';
+const RVFP_VERSION = 1;
+const PRE = 12; // preamble: 4 magic + 4 version + 4 header_len
+const SHA_LEN = 32;
+const DEFAULT_GW = 'https://gateway.pinata.cloud';
+const DEFAULT_API = 'https://api.pinata.cloud';
 // ── Crypto helpers ───────────────────────────────────────────
 function sha256(d) { return createHash('sha256').update(d).digest('hex'); }
 function sha256B(d) { return createHash('sha256').update(d).digest(); }
 function detectKeyFormat(key) {
-    var str = key.toString('utf-8');
+    const str = key.toString('utf-8');
     if (str.includes('BEGIN PRIVATE KEY'))
         return { format: 'pem', type: 'pkcs8' };
     if (str.includes('BEGIN PUBLIC KEY'))
@@ -79,96 +32,93 @@ function detectKeyFormat(key) {
     return { format: 'der', type: 'pkcs8' }; // caller must override type for public keys
 }
 function edSign(data, key) {
-    var det = detectKeyFormat(key);
-    return sign(null, data, { key: key, format: det.format, type: det.type }).toString('hex');
+    const det = detectKeyFormat(key);
+    return sign(null, data, { key, format: det.format, type: det.type }).toString('hex');
 }
 function edCheck(data, sig, key) {
     try {
-        var det = detectKeyFormat(key);
-        var type = det.format === 'pem' ? det.type : 'spki'; // public key for verify
-        return edVerify(null, data, { key: key, format: det.format, type: type }, Buffer.from(sig, 'hex'));
+        const det = detectKeyFormat(key);
+        const type = det.format === 'pem' ? det.type : 'spki'; // public key for verify
+        return edVerify(null, data, { key, format: det.format, type }, Buffer.from(sig, 'hex'));
     }
-    catch (_a) {
+    catch {
         return false;
     }
 }
 // ── HTTP helpers ─────────────────────────────────────────────
 function pinataReq(method, path, jwt, body, ct) {
-    return new Promise(function (resolve, reject) {
-        var u = new URL(path);
-        var h = { Authorization: "Bearer " + jwt };
+    return new Promise((resolve, reject) => {
+        const u = new URL(path);
+        const h = { Authorization: `Bearer ${jwt}` };
         if (ct)
             h['Content-Type'] = ct;
         if (body)
             h['Content-Length'] = String(body.length);
-        var req = httpsRequest({ hostname: u.hostname, path: u.pathname + u.search, method: method, headers: h }, function (res) {
-            var ch = [];
-            res.on('data', function (c) { return ch.push(c); });
-            res.on('end', function () {
-                var _a;
-                var raw = Buffer.concat(ch);
-                var data;
+        const req = httpsRequest({ hostname: u.hostname, path: u.pathname + u.search, method, headers: h }, (res) => {
+            const ch = [];
+            res.on('data', (c) => ch.push(c));
+            res.on('end', () => {
+                const raw = Buffer.concat(ch);
+                let data;
                 try {
                     data = JSON.parse(raw.toString('utf-8'));
                 }
-                catch (_b) {
+                catch {
                     data = raw;
                 }
-                resolve({ status: (_a = res.statusCode) !== null && _a !== void 0 ? _a : 0, data: data });
+                resolve({ status: res.statusCode ?? 0, data });
             });
         });
-        req.setTimeout(30000, function () { req.destroy(new Error('Request timed out after 30s')); });
+        req.setTimeout(30_000, () => { req.destroy(new Error('Request timed out after 30s')); });
         req.on('error', reject);
         if (body)
             req.write(body);
         req.end();
     });
 }
-function httpGet(url, maxRedirects) {
-    if (maxRedirects === void 0) { maxRedirects = 5; }
-    return new Promise(function (resolve, reject) {
+function httpGet(url, maxRedirects = 5) {
+    return new Promise((resolve, reject) => {
         if (maxRedirects <= 0)
             return reject(new Error('Too many redirects'));
-        var u = new URL(url);
-        var req = httpsRequest({ hostname: u.hostname, path: u.pathname + u.search, method: 'GET' }, function (res) {
+        const u = new URL(url);
+        const req = httpsRequest({ hostname: u.hostname, path: u.pathname + u.search, method: 'GET' }, (res) => {
             if (res.statusCode && res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
                 return void httpGet(res.headers.location, maxRedirects - 1).then(resolve, reject);
             }
-            var ch = [];
-            res.on('data', function (c) { return ch.push(c); });
-            res.on('end', function () { return resolve(Buffer.concat(ch)); });
+            const ch = [];
+            res.on('data', (c) => ch.push(c));
+            res.on('end', () => resolve(Buffer.concat(ch)));
         });
-        req.setTimeout(30000, function () { req.destroy(new Error('Request timed out after 30s')); });
+        req.setTimeout(30_000, () => { req.destroy(new Error('Request timed out after 30s')); });
         req.on('error', reject);
         req.end();
     });
 }
 function multipart(name, file, data, meta) {
-    var b = "----Rvfa" + Date.now() + Math.random().toString(36).slice(2);
-    var parts = [];
+    const b = `----Rvfa${Date.now()}${Math.random().toString(36).slice(2)}`;
+    const parts = [];
     if (meta) {
-        parts.push(Buffer.from("--" + b + "\r\nContent-Disposition: form-data; name=\"pinataMetadata\"\r\n" +
-            ("Content-Type: application/json\r\n\r\n" + meta + "\r\n")));
+        parts.push(Buffer.from(`--${b}\r\nContent-Disposition: form-data; name="pinataMetadata"\r\n` +
+            `Content-Type: application/json\r\n\r\n${meta}\r\n`));
     }
-    parts.push(Buffer.from("--" + b + "\r\nContent-Disposition: form-data; name=\"" + name + "\"; filename=\"" + file + "\"\r\n" +
-        "Content-Type: application/octet-stream\r\n\r\n"));
-    parts.push(data, Buffer.from("\r\n--" + b + "--\r\n"));
-    return { body: Buffer.concat(parts), ct: "multipart/form-data; boundary=" + b };
+    parts.push(Buffer.from(`--${b}\r\nContent-Disposition: form-data; name="${name}"; filename="${file}"\r\n` +
+        `Content-Type: application/octet-stream\r\n\r\n`));
+    parts.push(data, Buffer.from(`\r\n--${b}--\r\n`));
+    return { body: Buffer.concat(parts), ct: `multipart/form-data; boundary=${b}` };
 }
 /** Extract patch section data and bounds from a parsed patch buffer. */
 function patchData(buf) {
-    var hLen = buf.readUInt32LE(8);
-    var start = PRE + hLen;
-    var end = buf.length - SHA_LEN;
-    return { start: start, end: end, section: buf.subarray(start, end) };
+    const hLen = buf.readUInt32LE(8);
+    const start = PRE + hLen;
+    const end = buf.length - SHA_LEN;
+    return { start, end, section: buf.subarray(start, end) };
 }
 /** Canonical JSON: recursive key-sorting for deterministic serialization. */
 function canonicalJson(value) {
-    return JSON.stringify(value, function (_key, val) {
+    return JSON.stringify(value, (_key, val) => {
         if (val !== null && typeof val === 'object' && !Array.isArray(val) && !Buffer.isBuffer(val)) {
-            var sorted = {};
-            for (var _i = 0, _a = Object.keys(val).sort(); _i < _a.length; _i++) {
-                var k = _a[_i];
+            const sorted = {};
+            for (const k of Object.keys(val).sort()) {
                 sorted[k] = val[k];
             }
             return sorted;
@@ -178,356 +128,243 @@ function canonicalJson(value) {
 }
 /** Build a failed ApplyResult. */
 function failResult(sec, errs, extra) {
-    return __assign({ success: false, newSize: 0, patchedSection: sec, errors: errs }, extra);
+    return { success: false, newSize: 0, patchedSection: sec, errors: errs, ...extra };
 }
 // ── RvfaPatcher ──────────────────────────────────────────────
-var RvfaPatcher = /** @class */ (function () {
-    function RvfaPatcher() {
+export class RvfaPatcher {
+    static async createPatch(opts) {
+        const comp = opts.compression ?? 'none';
+        const payload = comp === 'gzip' ? gzipSync(opts.sectionData) : opts.sectionData;
+        const header = {
+            magic: 'RVFP', version: RVFP_VERSION,
+            targetApplianceName: opts.targetName, targetApplianceVersion: opts.targetVersion,
+            targetSection: opts.sectionId, patchVersion: opts.patchVersion,
+            created: new Date().toISOString(), newSectionSize: payload.length,
+            newSectionSha256: sha256(payload), compression: comp,
+        };
+        if (opts.privateKey && opts.signedBy) {
+            const signable = Buffer.concat([Buffer.from(canonicalJson(header), 'utf-8'), payload]);
+            header.signature = edSign(signable, opts.privateKey);
+            header.signedBy = opts.signedBy;
+        }
+        const hJson = Buffer.from(JSON.stringify(header), 'utf-8');
+        const magic = Buffer.from('RVFP');
+        const ver = Buffer.alloc(4);
+        ver.writeUInt32LE(RVFP_VERSION, 0);
+        const hLen = Buffer.alloc(4);
+        hLen.writeUInt32LE(hJson.length, 0);
+        return Buffer.concat([magic, ver, hLen, hJson, payload, sha256B(payload)]);
     }
-    RvfaPatcher.createPatch = function (opts) {
-        var _a;
-        return __awaiter(this, void 0, Promise, function () {
-            var comp, payload, header, signable, hJson, magic, ver, hLen;
-            return __generator(this, function (_b) {
-                comp = (_a = opts.compression) !== null && _a !== void 0 ? _a : 'none';
-                payload = comp === 'gzip' ? gzipSync(opts.sectionData) : opts.sectionData;
-                header = {
-                    magic: 'RVFP', version: RVFP_VERSION,
-                    targetApplianceName: opts.targetName, targetApplianceVersion: opts.targetVersion,
-                    targetSection: opts.sectionId, patchVersion: opts.patchVersion,
-                    created: new Date().toISOString(), newSectionSize: payload.length,
-                    newSectionSha256: sha256(payload), compression: comp
-                };
-                if (opts.privateKey && opts.signedBy) {
-                    signable = Buffer.concat([Buffer.from(canonicalJson(header), 'utf-8'), payload]);
-                    header.signature = edSign(signable, opts.privateKey);
-                    header.signedBy = opts.signedBy;
-                }
-                hJson = Buffer.from(JSON.stringify(header), 'utf-8');
-                magic = Buffer.from('RVFP');
-                ver = Buffer.alloc(4);
-                ver.writeUInt32LE(RVFP_VERSION, 0);
-                hLen = Buffer.alloc(4);
-                hLen.writeUInt32LE(hJson.length, 0);
-                return [2 /*return*/, Buffer.concat([magic, ver, hLen, hJson, payload, sha256B(payload)])];
-            });
-        });
-    };
-    RvfaPatcher.parsePatchHeader = function (buf) {
+    static parsePatchHeader(buf) {
         if (buf.length < PRE)
             throw new Error('Buffer too small for RVFP preamble');
-        var magic = buf.subarray(0, 4).toString('ascii');
+        const magic = buf.subarray(0, 4).toString('ascii');
         if (magic !== 'RVFP')
-            throw new Error("Invalid RVFP magic: \"" + magic + "\"");
-        var ver = buf.readUInt32LE(4);
+            throw new Error(`Invalid RVFP magic: "${magic}"`);
+        const ver = buf.readUInt32LE(4);
         if (ver !== RVFP_VERSION)
-            throw new Error("Unsupported RVFP version: " + ver);
-        var hLen = buf.readUInt32LE(8);
+            throw new Error(`Unsupported RVFP version: ${ver}`);
+        const hLen = buf.readUInt32LE(8);
         if (PRE + hLen > buf.length)
             throw new Error('Buffer too small for declared header');
-        var h = JSON.parse(buf.subarray(PRE, PRE + hLen).toString('utf-8'));
+        const h = JSON.parse(buf.subarray(PRE, PRE + hLen).toString('utf-8'));
         if (h.magic !== 'RVFP')
             throw new Error('RVFP header magic mismatch');
         return h;
-    };
-    RvfaPatcher.verifyPatch = function (buf) {
-        return __awaiter(this, void 0, Promise, function () {
-            var errors, header, empty, _a, start, end, section;
-            return __generator(this, function (_b) {
-                errors = [];
-                try {
-                    header = RvfaPatcher.parsePatchHeader(buf);
-                }
-                catch (e) {
-                    empty = {
-                        magic: 'RVFP', version: 0, targetApplianceName: '', targetApplianceVersion: '',
-                        targetSection: '', patchVersion: '', created: '', newSectionSize: 0,
-                        newSectionSha256: '', compression: 'none'
-                    };
-                    return [2 /*return*/, { valid: false, header: empty, errors: [e.message] }];
-                }
-                _a = patchData(buf), start = _a.start, end = _a.end, section = _a.section;
-                if (end < start) {
-                    errors.push('Patch too small: no room for section data and footer');
-                    return [2 /*return*/, { valid: false, header: header, errors: errors }];
-                }
-                if (section.length !== header.newSectionSize)
-                    errors.push("Size mismatch: header=" + header.newSectionSize + ", actual=" + section.length);
-                if (sha256(section) !== header.newSectionSha256)
-                    errors.push('Section SHA256 mismatch');
-                if (!sha256B(section).equals(buf.subarray(buf.length - SHA_LEN)))
-                    errors.push('Footer SHA256 mismatch');
-                return [2 /*return*/, { valid: errors.length === 0, header: header, errors: errors }];
-            });
-        });
-    };
-    RvfaPatcher.applyPatch = function (rvfaPath, patchBuf, opts) {
-        var _a, _b;
-        return __awaiter(this, void 0, Promise, function () {
-            var doBackup, doVerify, header, sec, section, unsigned, signable, check, reader, e_1, rh, errs, backupPath, newData, writer, _i, _c, s, comp, newRvfa, tmpPath, e_2, vr, vResult, e_3;
-            return __generator(this, function (_d) {
-                switch (_d.label) {
-                    case 0:
-                        doBackup = (_a = opts === null || opts === void 0 ? void 0 : opts.backup) !== null && _a !== void 0 ? _a : true;
-                        doVerify = (_b = opts === null || opts === void 0 ? void 0 : opts.verify) !== null && _b !== void 0 ? _b : true;
-                        try {
-                            header = RvfaPatcher.parsePatchHeader(patchBuf);
-                        }
-                        catch (e) {
-                            return [2 /*return*/, failResult('', [e.message])];
-                        }
-                        sec = header.targetSection;
-                        // Verify signature
-                        if ((opts === null || opts === void 0 ? void 0 : opts.publicKey) && header.signature) {
-                            section = patchData(patchBuf).section;
-                            unsigned = __assign({}, header);
-                            delete unsigned.signature;
-                            delete unsigned.signedBy;
-                            signable = Buffer.concat([Buffer.from(canonicalJson(unsigned), 'utf-8'), section]);
-                            if (!edCheck(signable, header.signature, opts.publicKey))
-                                return [2 /*return*/, failResult(sec, ['Patch signature verification failed'])];
-                        }
-                        return [4 /*yield*/, RvfaPatcher.verifyPatch(patchBuf)];
-                    case 1:
-                        check = _d.sent();
-                        if (!check.valid)
-                            return [2 /*return*/, failResult(sec, check.errors)];
-                        _d.label = 2;
-                    case 2:
-                        _d.trys.push([2, 4, , 5]);
-                        return [4 /*yield*/, RvfaReader.fromFile(rvfaPath)];
-                    case 3:
-                        reader = _d.sent();
-                        return [3 /*break*/, 5];
-                    case 4:
-                        e_1 = _d.sent();
-                        return [2 /*return*/, failResult(sec, ["Failed to read RVFA: " + e_1.message])];
-                    case 5:
-                        rh = reader.getHeader();
-                        errs = [];
-                        if (rh.name !== header.targetApplianceName)
-                            errs.push("Name mismatch: patch=\"" + header.targetApplianceName + "\", file=\"" + rh.name + "\"");
-                        if (rh.appVersion !== header.targetApplianceVersion)
-                            errs.push("Version mismatch: patch=\"" + header.targetApplianceVersion + "\", file=\"" + rh.appVersion + "\"");
-                        if (errs.length)
-                            return [2 /*return*/, failResult(sec, errs)];
-                        if (!rh.sections.find(function (s) { return s.id === sec; }))
-                            return [2 /*return*/, failResult(sec, ["Section \"" + sec + "\" not found in appliance"])];
-                        if (!doBackup) return [3 /*break*/, 7];
-                        backupPath = rvfaPath + '.bak';
-                        return [4 /*yield*/, copyFile(rvfaPath, backupPath)];
-                    case 6:
-                        _d.sent();
-                        _d.label = 7;
-                    case 7:
-                        newData = patchData(patchBuf).section;
-                        if (header.compression === 'gzip')
-                            newData = gunzipSync(newData);
-                        writer = new RvfaWriter(__assign(__assign({}, rh), { sections: [] }));
-                        for (_i = 0, _c = rh.sections; _i < _c.length; _i++) {
-                            s = _c[_i];
-                            comp = s.compression === 'zstd' ? 'gzip' : s.compression;
-                            if (s.id === sec) {
-                                writer.addSection(s.id, newData, { compression: comp, type: s.type });
-                            }
-                            else {
-                                writer.addSection(s.id, reader.extractSection(s.id), { compression: comp, type: s.type });
-                            }
-                        }
-                        newRvfa = writer.build();
-                        tmpPath = rvfaPath + (".tmp." + Date.now());
-                        _d.label = 8;
-                    case 8:
-                        _d.trys.push([8, 11, , 15]);
-                        return [4 /*yield*/, writeFile(tmpPath, newRvfa)];
-                    case 9:
-                        _d.sent();
-                        return [4 /*yield*/, rename(tmpPath, rvfaPath)];
-                    case 10:
-                        _d.sent();
-                        return [3 /*break*/, 15];
-                    case 11:
-                        e_2 = _d.sent();
-                        return [4 /*yield*/, unlink(tmpPath)["catch"](function () { })];
-                    case 12:
-                        _d.sent();
-                        if (!backupPath) return [3 /*break*/, 14];
-                        return [4 /*yield*/, copyFile(backupPath, rvfaPath)["catch"](function () { })];
-                    case 13:
-                        _d.sent();
-                        _d.label = 14;
-                    case 14: return [2 /*return*/, failResult(sec, ["Atomic write failed: " + e_2.message], { backupPath: backupPath })];
-                    case 15:
-                        if (!doVerify) return [3 /*break*/, 24];
-                        _d.label = 16;
-                    case 16:
-                        _d.trys.push([16, 21, , 24]);
-                        return [4 /*yield*/, RvfaReader.fromFile(rvfaPath)];
-                    case 17:
-                        vr = _d.sent();
-                        vResult = vr.verify();
-                        if (!!vResult.valid) return [3 /*break*/, 20];
-                        if (!backupPath) return [3 /*break*/, 19];
-                        return [4 /*yield*/, copyFile(backupPath, rvfaPath)["catch"](function () { })];
-                    case 18:
-                        _d.sent();
-                        _d.label = 19;
-                    case 19: return [2 /*return*/, failResult(sec, ["Post-patch verification failed: " + vResult.errors.join('; ')], { backupPath: backupPath, newSize: newRvfa.length })];
-                    case 20: return [3 /*break*/, 24];
-                    case 21:
-                        e_3 = _d.sent();
-                        if (!backupPath) return [3 /*break*/, 23];
-                        return [4 /*yield*/, copyFile(backupPath, rvfaPath)["catch"](function () { })];
-                    case 22:
-                        _d.sent();
-                        _d.label = 23;
-                    case 23: return [2 /*return*/, failResult(sec, ["Post-patch verify error: " + e_3.message], { backupPath: backupPath, newSize: newRvfa.length })];
-                    case 24: return [2 /*return*/, { success: true, backupPath: backupPath, newSize: newRvfa.length, patchedSection: sec, errors: [] }];
+    }
+    static async verifyPatch(buf) {
+        const errors = [];
+        let header;
+        try {
+            header = RvfaPatcher.parsePatchHeader(buf);
+        }
+        catch (e) {
+            const empty = {
+                magic: 'RVFP', version: 0, targetApplianceName: '', targetApplianceVersion: '',
+                targetSection: '', patchVersion: '', created: '', newSectionSize: 0,
+                newSectionSha256: '', compression: 'none',
+            };
+            return { valid: false, header: empty, errors: [e.message] };
+        }
+        const { start, end, section } = patchData(buf);
+        if (end < start) {
+            errors.push('Patch too small: no room for section data and footer');
+            return { valid: false, header, errors };
+        }
+        if (section.length !== header.newSectionSize)
+            errors.push(`Size mismatch: header=${header.newSectionSize}, actual=${section.length}`);
+        if (sha256(section) !== header.newSectionSha256)
+            errors.push('Section SHA256 mismatch');
+        if (!sha256B(section).equals(buf.subarray(buf.length - SHA_LEN)))
+            errors.push('Footer SHA256 mismatch');
+        return { valid: errors.length === 0, header, errors };
+    }
+    static async applyPatch(rvfaPath, patchBuf, opts) {
+        const doBackup = opts?.backup ?? true;
+        const doVerify = opts?.verify ?? true;
+        // Parse & verify patch
+        let header;
+        try {
+            header = RvfaPatcher.parsePatchHeader(patchBuf);
+        }
+        catch (e) {
+            return failResult('', [e.message]);
+        }
+        const sec = header.targetSection;
+        // Verify signature
+        if (opts?.publicKey && header.signature) {
+            const { section } = patchData(patchBuf);
+            const unsigned = { ...header };
+            delete unsigned.signature;
+            delete unsigned.signedBy;
+            const signable = Buffer.concat([Buffer.from(canonicalJson(unsigned), 'utf-8'), section]);
+            if (!edCheck(signable, header.signature, opts.publicKey))
+                return failResult(sec, ['Patch signature verification failed']);
+        }
+        // Verify patch integrity
+        const check = await RvfaPatcher.verifyPatch(patchBuf);
+        if (!check.valid)
+            return failResult(sec, check.errors);
+        // Read target RVFA
+        let reader;
+        try {
+            reader = await RvfaReader.fromFile(rvfaPath);
+        }
+        catch (e) {
+            return failResult(sec, [`Failed to read RVFA: ${e.message}`]);
+        }
+        const rh = reader.getHeader();
+        // Verify target matches
+        const errs = [];
+        if (rh.name !== header.targetApplianceName)
+            errs.push(`Name mismatch: patch="${header.targetApplianceName}", file="${rh.name}"`);
+        if (rh.appVersion !== header.targetApplianceVersion)
+            errs.push(`Version mismatch: patch="${header.targetApplianceVersion}", file="${rh.appVersion}"`);
+        if (errs.length)
+            return failResult(sec, errs);
+        if (!rh.sections.find((s) => s.id === sec))
+            return failResult(sec, [`Section "${sec}" not found in appliance`]);
+        // Backup
+        let backupPath;
+        if (doBackup) {
+            backupPath = rvfaPath + '.bak';
+            await copyFile(rvfaPath, backupPath);
+        }
+        // Extract new section data from patch (decompress if needed)
+        let newData = patchData(patchBuf).section;
+        if (header.compression === 'gzip')
+            newData = gunzipSync(newData);
+        // Rebuild RVFA with replaced section
+        const writer = new RvfaWriter({ ...rh, sections: [] });
+        for (const s of rh.sections) {
+            const comp = s.compression === 'zstd' ? 'gzip' : s.compression;
+            if (s.id === sec) {
+                writer.addSection(s.id, newData, { compression: comp, type: s.type });
+            }
+            else {
+                writer.addSection(s.id, reader.extractSection(s.id), { compression: comp, type: s.type });
+            }
+        }
+        const newRvfa = writer.build();
+        // Atomic write (tmp + rename)
+        const tmpPath = rvfaPath + `.tmp.${Date.now()}`;
+        try {
+            await writeFile(tmpPath, newRvfa);
+            await rename(tmpPath, rvfaPath);
+        }
+        catch (e) {
+            await unlink(tmpPath).catch(() => { });
+            if (backupPath)
+                await copyFile(backupPath, rvfaPath).catch(() => { });
+            return failResult(sec, [`Atomic write failed: ${e.message}`], { backupPath });
+        }
+        // Post-patch verification with rollback
+        if (doVerify) {
+            try {
+                const vr = await RvfaReader.fromFile(rvfaPath);
+                const vResult = vr.verify();
+                if (!vResult.valid) {
+                    if (backupPath)
+                        await copyFile(backupPath, rvfaPath).catch(() => { });
+                    return failResult(sec, [`Post-patch verification failed: ${vResult.errors.join('; ')}`], { backupPath, newSize: newRvfa.length });
                 }
-            });
-        });
-    };
-    return RvfaPatcher;
-}());
-export { RvfaPatcher };
+            }
+            catch (e) {
+                if (backupPath)
+                    await copyFile(backupPath, rvfaPath).catch(() => { });
+                return failResult(sec, [`Post-patch verify error: ${e.message}`], { backupPath, newSize: newRvfa.length });
+            }
+        }
+        return { success: true, backupPath, newSize: newRvfa.length, patchedSection: sec, errors: [] };
+    }
+}
 // ── RvfaPublisher ────────────────────────────────────────────
-var RvfaPublisher = /** @class */ (function () {
-    function RvfaPublisher(config) {
+export class RvfaPublisher {
+    jwt;
+    gw;
+    api;
+    constructor(config) {
         this.jwt = config.pinataJwt || process.env.PINATA_API_JWT || '';
         this.gw = (config.gatewayUrl || DEFAULT_GW).replace(/\/+$/, '');
         this.api = (config.apiUrl || DEFAULT_API).replace(/\/+$/, '');
         if (!this.jwt)
             throw new Error('Pinata JWT required (config.pinataJwt or PINATA_API_JWT)');
     }
-    RvfaPublisher.prototype.upload = function (fileName, data, kv) {
-        return __awaiter(this, void 0, Promise, function () {
-            var meta, _a, body, ct, res, r;
-            return __generator(this, function (_b) {
-                switch (_b.label) {
-                    case 0:
-                        meta = JSON.stringify({ name: fileName, keyvalues: kv });
-                        _a = multipart('file', fileName, data, meta), body = _a.body, ct = _a.ct;
-                        return [4 /*yield*/, pinataReq('POST', this.api + "/pinning/pinFileToIPFS", this.jwt, body, ct)];
-                    case 1:
-                        res = _b.sent();
-                        if (res.status !== 200)
-                            throw new Error("Pinata upload failed (HTTP " + res.status + "): " + JSON.stringify(res.data));
-                        r = res.data;
-                        return [2 /*return*/, {
-                                cid: r.IpfsHash, size: r.PinSize,
-                                gatewayUrl: this.gw + "/ipfs/" + r.IpfsHash, pinataUrl: this.api + "/pinning/pins/" + r.IpfsHash
-                            }];
-                }
-            });
-        });
-    };
-    RvfaPublisher.prototype.publish = function (rvfaPath, meta) {
-        return __awaiter(this, void 0, Promise, function () {
-            var data, name;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, readFile(rvfaPath)];
-                    case 1:
-                        data = _a.sent();
-                        name = (meta === null || meta === void 0 ? void 0 : meta.name) || rvfaPath.split('/').pop() || 'appliance.rvf';
-                        return [2 /*return*/, this.upload(name, data, {
-                                type: 'rvfa-appliance', version: (meta === null || meta === void 0 ? void 0 : meta.version) || '',
-                                profile: (meta === null || meta === void 0 ? void 0 : meta.profile) || '', description: (meta === null || meta === void 0 ? void 0 : meta.description) || ''
-                            })];
-                }
-            });
-        });
-    };
-    RvfaPublisher.prototype.publishPatch = function (patchBuf, meta) {
-        return __awaiter(this, void 0, Promise, function () {
-            var name;
-            return __generator(this, function (_a) {
-                name = (meta === null || meta === void 0 ? void 0 : meta.name) || "patch-" + Date.now() + ".rvfp";
-                return [2 /*return*/, this.upload(name, patchBuf, {
-                        type: 'rvfp-patch', version: (meta === null || meta === void 0 ? void 0 : meta.version) || '', description: (meta === null || meta === void 0 ? void 0 : meta.description) || ''
-                    })];
-            });
-        });
-    };
-    RvfaPublisher.prototype.fetch = function (cid, outputPath) {
-        return __awaiter(this, void 0, Promise, function () {
-            var data;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, httpGet(this.gw + "/ipfs/" + cid)];
-                    case 1:
-                        data = _a.sent();
-                        return [4 /*yield*/, mkdir(dirname(outputPath), { recursive: true })];
-                    case 2:
-                        _a.sent();
-                        return [4 /*yield*/, writeFile(outputPath, data)];
-                    case 3:
-                        _a.sent();
-                        return [2 /*return*/];
-                }
-            });
-        });
-    };
-    RvfaPublisher.prototype.list = function () {
-        return __awaiter(this, void 0, Promise, function () {
-            var res, d;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0: return [4 /*yield*/, pinataReq('GET', this.api + "/data/pinList?status=pinned&pageLimit=100", this.jwt)];
-                    case 1:
-                        res = _a.sent();
-                        if (res.status !== 200)
-                            throw new Error("Pinata list failed (HTTP " + res.status + "): " + JSON.stringify(res.data));
-                        d = res.data;
-                        return [2 /*return*/, (d.rows || []).map(function (r) {
-                                var _a;
-                                return ({
-                                    cid: r.ipfs_pin_hash, name: ((_a = r.metadata) === null || _a === void 0 ? void 0 : _a.name) || r.ipfs_pin_hash,
-                                    size: r.size, date: r.date_pinned
-                                });
-                            })];
-                }
-            });
+    async upload(fileName, data, kv) {
+        const meta = JSON.stringify({ name: fileName, keyvalues: kv });
+        const { body, ct } = multipart('file', fileName, data, meta);
+        const res = await pinataReq('POST', `${this.api}/pinning/pinFileToIPFS`, this.jwt, body, ct);
+        if (res.status !== 200)
+            throw new Error(`Pinata upload failed (HTTP ${res.status}): ${JSON.stringify(res.data)}`);
+        const r = res.data;
+        return {
+            cid: r.IpfsHash, size: r.PinSize,
+            gatewayUrl: `${this.gw}/ipfs/${r.IpfsHash}`, pinataUrl: `${this.api}/pinning/pins/${r.IpfsHash}`,
+        };
+    }
+    async publish(rvfaPath, meta) {
+        const data = await readFile(rvfaPath);
+        const name = meta?.name || rvfaPath.split('/').pop() || 'appliance.rvf';
+        return this.upload(name, data, {
+            type: 'rvfa-appliance', version: meta?.version || '',
+            profile: meta?.profile || '', description: meta?.description || '',
         });
-    };
-    RvfaPublisher.prototype.pin = function (cid, name) {
-        return __awaiter(this, void 0, Promise, function () {
-            var body, res;
-            return __generator(this, function (_a) {
-                switch (_a.label) {
-                    case 0:
-                        body = Buffer.from(JSON.stringify({ hashToPin: cid, pinataMetadata: { name: name || cid } }));
-                        return [4 /*yield*/, pinataReq('POST', this.api + "/pinning/pinByHash", this.jwt, body, 'application/json')];
-                    case 1:
-                        res = _a.sent();
-                        if (res.status !== 200)
-                            throw new Error("Pinata pin failed (HTTP " + res.status + "): " + JSON.stringify(res.data));
-                        return [2 /*return*/];
-                }
-            });
+    }
+    async publishPatch(patchBuf, meta) {
+        const name = meta?.name || `patch-${Date.now()}.rvfp`;
+        return this.upload(name, patchBuf, {
+            type: 'rvfp-patch', version: meta?.version || '', description: meta?.description || '',
         });
-    };
-    return RvfaPublisher;
-}());
-export { RvfaPublisher };
+    }
+    async fetch(cid, outputPath) {
+        const data = await httpGet(`${this.gw}/ipfs/${cid}`);
+        await mkdir(dirname(outputPath), { recursive: true });
+        await writeFile(outputPath, data);
+    }
+    async list() {
+        const res = await pinataReq('GET', `${this.api}/data/pinList?status=pinned&pageLimit=100`, this.jwt);
+        if (res.status !== 200)
+            throw new Error(`Pinata list failed (HTTP ${res.status}): ${JSON.stringify(res.data)}`);
+        const d = res.data;
+        return (d.rows || []).map((r) => ({
+            cid: r.ipfs_pin_hash, name: r.metadata?.name || r.ipfs_pin_hash,
+            size: r.size, date: r.date_pinned,
+        }));
+    }
+    async pin(cid, name) {
+        const body = Buffer.from(JSON.stringify({ hashToPin: cid, pinataMetadata: { name: name || cid } }));
+        const res = await pinataReq('POST', `${this.api}/pinning/pinByHash`, this.jwt, body, 'application/json');
+        if (res.status !== 200)
+            throw new Error(`Pinata pin failed (HTTP ${res.status}): ${JSON.stringify(res.data)}`);
+    }
+}
 // ── Convenience exports ──────────────────────────────────────
 export function createPublisher(config) {
-    return new RvfaPublisher({ pinataJwt: config === null || config === void 0 ? void 0 : config.pinataJwt, gatewayUrl: config === null || config === void 0 ? void 0 : config.gatewayUrl, apiUrl: config === null || config === void 0 ? void 0 : config.apiUrl });
+    return new RvfaPublisher({ pinataJwt: config?.pinataJwt, gatewayUrl: config?.gatewayUrl, apiUrl: config?.apiUrl });
 }
-export function createAndVerifyPatch(options) {
-    return __awaiter(this, void 0, Promise, function () {
-        var patch, verification;
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0: return [4 /*yield*/, RvfaPatcher.createPatch(options)];
-                case 1:
-                    patch = _a.sent();
-                    return [4 /*yield*/, RvfaPatcher.verifyPatch(patch)];
-                case 2:
-                    verification = _a.sent();
-                    return [2 /*return*/, { patch: patch, verification: verification }];
-            }
-        });
-    });
+export async function createAndVerifyPatch(options) {
+    const patch = await RvfaPatcher.createPatch(options);
+    const verification = await RvfaPatcher.verifyPatch(patch);
+    return { patch, verification };
 }
 //# sourceMappingURL=rvfa-distribution.js.map