pray-cli 1.9.1 → 1.9.2

package/dist/serve/index.js

@@ -1,21 +1,26 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync, } from "node:fs";
 import { createServer, } from "node:http";
-import { extname, join, resolve } from "node:path";
+import { extname, isAbsolute, join, relative, resolve } from "node:path";
 import { PrayError } from "../errors.js";
+import { MAX_HTTP_RESPONSE_BYTES, MAX_SERVE_BODY_BYTES, MAX_SERVE_CONCURRENT_CONNECTIONS, MAX_SERVE_HEADER_BYTES, SERVE_SOCKET_TIMEOUT_MILLISECONDS, } from "../resource-limits.js";
 export function runServer(options) {
     const root = resolve(options.root);
     const host = options.host ?? "127.0.0.1";
     const port = options.port ?? 7429;
     return new Promise((resolvePromise, reject) => {
-        const server = createServer((request, response) => {
-            try {
-                handleRequest(root, request, response);
-            }
-            catch (error) {
+        const allowWrites = isLoopbackHost(host);
+        const server = createServer({ maxHeaderSize: MAX_SERVE_HEADER_BYTES }, (request, response) => {
+            const requestId = randomUUID();
+            void handleRequest(root, allowWrites, requestId, request, response).catch((error) => {
                 const message = error instanceof Error ? error.message : String(error);
-                writeResponse(response, 500, "text/plain", message);
-            }
+                process.stderr.write(`${JSON.stringify({ event: "serve_request_failed", request_id: requestId, message })}\n`);
+                writeResponse(response, 500, "text/plain", "internal error", requestId);
+            });
         });
+        server.maxConnections = MAX_SERVE_CONCURRENT_CONNECTIONS;
+        server.requestTimeout = SERVE_SOCKET_TIMEOUT_MILLISECONDS;
+        server.headersTimeout = SERVE_SOCKET_TIMEOUT_MILLISECONDS;
         server.listen(port, host, () => {
             process.stdout.write(`Serving ${root} on http://${host}:${port}\n`);
         });
@@ -25,43 +30,85 @@ export function runServer(options) {
         });
     });
 }
-function handleRequest(root, request, response) {
+async function handleRequest(root, allowWrites, requestId, request, response) {
     const url = new URL(request.url ?? "/", "http://localhost");
     const method = request.method ?? "GET";
     const path = url.pathname;
     if (method === "PUT") {
-        handlePut(root, path, request, response);
+        await handlePut(root, path, allowWrites, requestId, request, response);
         return;
     }
     if (method !== "GET") {
-        writeResponse(response, 405, "text/plain", "method not allowed");
+        writeResponse(response, 405, "text/plain", "method not allowed", requestId);
         return;
     }
     if (path === "/") {
-        writeResponse(response, 200, "text/html", `<h1>Pray distribution</h1><p>Root: ${root}</p>`);
+        writeResponse(response, 200, "text/html", "<h1>Pray distribution</h1>", requestId);
         return;
     }
-    const filePath = resolve(root, path.replace(/^\//, ""));
-    if (!filePath.startsWith(root) || !existsSync(filePath)) {
-        writeResponse(response, 404, "text/plain", "not found");
+    if (path === "/health") {
+        writeResponse(response, 200, "text/plain", "ok", requestId);
+        return;
+    }
+    const filePath = containedPath(root, path);
+    if (!filePath || !existsSync(filePath)) {
+        writeResponse(response, 404, "text/plain", "not found", requestId);
+        return;
+    }
+    if (statSync(filePath).size > MAX_HTTP_RESPONSE_BYTES) {
+        writeResponse(response, 413, "text/plain", "file exceeds server limit", requestId);
         return;
     }
     const body = readFileSync(filePath);
-    writeResponse(response, 200, contentTypeFor(filePath), body);
+    writeResponse(response, 200, contentTypeFor(filePath), body, requestId);
 }
-function handlePut(root, path, request, response) {
-    const chunks = [];
-    request.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
-    request.on("end", () => {
-        const filePath = resolve(root, path.replace(/^\//, ""));
-        if (!filePath.startsWith(root)) {
-            writeResponse(response, 403, "text/plain", "forbidden");
+async function handlePut(root, path, allowWrites, requestId, request, response) {
+    if (!allowWrites) {
+        writeResponse(response, 403, "text/plain", "forbidden", requestId);
+        return;
+    }
+    const filePath = containedPath(root, path);
+    if (!filePath) {
+        writeResponse(response, 403, "text/plain", "forbidden", requestId);
+        return;
+    }
+    let body;
+    try {
+        body = await readRequestBody(request);
+    }
+    catch (error) {
+        if (error instanceof PrayError) {
+            writeResponse(response, 413, "text/plain", error.message, requestId);
             return;
         }
-        mkdirSync(join(filePath, ".."), { recursive: true });
-        writeFileSync(filePath, Buffer.concat(chunks));
-        writeResponse(response, 200, "text/plain", "ok");
-    });
+        throw error;
+    }
+    mkdirSync(join(filePath, ".."), { recursive: true });
+    writeFileSync(filePath, body);
+    writeResponse(response, 200, "text/plain", "ok", requestId);
+}
+export async function readRequestBody(request) {
+    const chunks = [];
+    let length = 0;
+    for await (const chunk of request) {
+        const bytes = Buffer.from(chunk);
+        length += bytes.byteLength;
+        if (length > MAX_SERVE_BODY_BYTES) {
+            throw PrayError.resolution(`request body exceeds ${MAX_SERVE_BODY_BYTES} bytes`);
+        }
+        chunks.push(bytes);
+    }
+    return Buffer.concat(chunks, length);
+}
+function containedPath(root, requestPath) {
+    const candidate = resolve(root, requestPath.replace(/^\//, ""));
+    const fromRoot = relative(root, candidate);
+    if (fromRoot.startsWith("..") || isAbsolute(fromRoot))
+        return undefined;
+    return candidate;
+}
+function isLoopbackHost(host) {
+    return host === "127.0.0.1" || host === "::1" || host === "localhost";
 }
 function contentTypeFor(path) {
     switch (extname(path)) {
@@ -73,12 +120,15 @@ function contentTypeFor(path) {
             return "text/plain";
     }
 }
-function writeResponse(response, status, contentType, body) {
+function writeResponse(response, status, contentType, body, requestId) {
+    if (response.headersSent || response.writableEnded)
+        return;
     const buffer = typeof body === "string" ? Buffer.from(body, "utf8") : body;
     response.writeHead(status, {
         "Content-Type": contentType,
         "Content-Length": buffer.length,
         Connection: "close",
+        "X-Request-ID": requestId,
     });
     response.end(buffer);
 }

package/dist/serve/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/serve/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EACL,YAAY,GAGb,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,UAAU,SAAS,CAAC,OAIzB;IACC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC;IAElC,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YAChD,IAAI,CAAC;gBACH,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvE,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YACtD,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,cAAc,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;YACxB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CACpB,IAAY,EACZ,OAAwB,EACxB,QAAwB;IAExB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;IACvC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAE1B,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IAED,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IAED,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjB,aAAa,CACX,QAAQ,EACR,GAAG,EACH,WAAW,EACX,sCAAsC,IAAI,MAAM,CACjD,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACpC,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,SAAS,CAChB,IAAY,EACZ,IAAY,EACZ,OAAwB,EACxB,QAAwB;IAExB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;QACrB,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,QAAQ,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,KAAK,OAAO;YACV,OAAO,kBAAkB,CAAC;QAC5B,KAAK,UAAU;YACb,OAAO,0BAA0B,CAAC;QACpC;YACE,OAAO,YAAY,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,QAAwB,EACxB,MAAc,EACd,WAAmB,EACnB,IAAqB;IAErB,MAAM,MAAM,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE;QACzB,cAAc,EAAE,WAAW;QAC3B,gBAAgB,EAAE,MAAM,CAAC,MAAM;QAC/B,UAAU,EAAE,OAAO;KACpB,CAAC,CAAC;IACH,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,MAAM,SAAS,CAAC,WAAW,CAAC,wCAAwC,CAAC,CAAC;AACxE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/serve/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,UAAU,EACV,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,YAAY,GAGb,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,gCAAgC,EAChC,sBAAsB,EACtB,iCAAiC,GAClC,MAAM,uBAAuB,CAAC;AAE/B,MAAM,UAAU,SAAS,CAAC,OAIzB;IACC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC;IAElC,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,YAAY,CACzB,EAAE,aAAa,EAAE,sBAAsB,EAAE,EACzC,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YACpB,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;YAC/B,KAAK,aAAa,CAChB,IAAI,EACJ,WAAW,EACX,SAAS,EACT,OAAO,EACP,QAAQ,CACT,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACzB,MAAM,OAAO,GACX,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,IAAI,CACzF,CAAC;gBACF,aAAa,CACX,QAAQ,EACR,GAAG,EACH,YAAY,EACZ,gBAAgB,EAChB,SAAS,CACV,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QACF,MAAM,CAAC,cAAc,GAAG,gCAAgC,CAAC;QACzD,MAAM,CAAC,cAAc,GAAG,iCAAiC,CAAC;QAC1D,MAAM,CAAC,cAAc,GAAG,iCAAiC,CAAC;QAC1D,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,IAAI,cAAc,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;YACxB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,IAAY,EACZ,WAAoB,EACpB,SAAiB,EACjB,OAAwB,EACxB,QAAwB;IAExB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;IACvC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAE1B,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IAED,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,oBAAoB,EAAE,SAAS,CAAC,CAAC;QAC5E,OAAO;IACT,CAAC;IAED,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjB,aAAa,CACX,QAAQ,EACR,GAAG,EACH,WAAW,EACX,4BAA4B,EAC5B,SAAS,CACV,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QACnE,OAAO;IACT,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,GAAG,uBAAuB,EAAE,CAAC;QACtD,aAAa,CACX,QAAQ,EACR,GAAG,EACH,YAAY,EACZ,2BAA2B,EAC3B,SAAS,CACV,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACpC,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AAC1E,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,IAAY,EACZ,IAAY,EACZ,WAAoB,EACpB,SAAiB,EACjB,OAAwB,EACxB,QAAwB;IAExB,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QACnE,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QACnE,OAAO;IACT,CAAC;IACD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;YAC/B,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC9B,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAiB;IACrD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;QAC3B,IAAI,MAAM,GAAG,oBAAoB,EAAE,CAAC;YAClC,MAAM,SAAS,CAAC,UAAU,CACxB,wBAAwB,oBAAoB,QAAQ,CACrD,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,WAAmB;IACtD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC3C,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACxE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,WAAW,CAAC;AACxE,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,QAAQ,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,KAAK,OAAO;YACV,OAAO,kBAAkB,CAAC;QAC5B,KAAK,UAAU;YACb,OAAO,0BAA0B,CAAC;QACpC;YACE,OAAO,YAAY,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,QAAwB,EACxB,MAAc,EACd,WAAmB,EACnB,IAAqB,EACrB,SAAiB;IAEjB,IAAI,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,aAAa;QAAE,OAAO;IAC3D,MAAM,MAAM,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE;QACzB,cAAc,EAAE,WAAW;QAC3B,gBAAgB,EAAE,MAAM,CAAC,MAAM;QAC/B,UAAU,EAAE,OAAO;QACnB,cAAc,EAAE,SAAS;KAC1B,CAAC,CAAC;IACH,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,MAAM,SAAS,CAAC,WAAW,CAAC,wCAAwC,CAAC,CAAC;AACxE,CAAC"}

package/dist/sync/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sync/index.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EAAE,GACd,OAAO,CAAC,WAAW,CAAC,CAgEtB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sync/index.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EAAE,GACd,OAAO,CAAC,WAAW,CAAC,CAqFtB"}

package/dist/sync/index.js

@@ -1,10 +1,12 @@
 import { mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { unpackPraypkg } from "../archive/praypkg.js";
 import { PrayError } from "../errors.js";
 import { sha256Prefixed } from "../hashing.js";
 import { httpGet, joinUrl } from "../http/client.js";
 import { fetchPackageMetadata } from "../registry/index.js";
+import { installArtifactToCache, requireIntegrityFields, } from "../registry/install.js";
+import { MAX_FEDERATION_PEERS } from "../resource-limits.js";
+import { rejectAbsoluteArtifactPath, resolveDistributionPath, validatePackageName, validatePathSegment, } from "./path-safety.js";
 export async function syncDistributionRoot(root, peers) {
     const distributionRoot = root;
     const queue = [...peers];
@@ -16,37 +18,48 @@ export async function syncDistributionRoot(root, peers) {
             continue;
         }
         visited.add(peer);
+        if (visited.size > MAX_FEDERATION_PEERS) {
+            throw PrayError.resolution(`federation exceeds ${MAX_FEDERATION_PEERS} peers`);
+        }
         const metadata = await fetchPackageIndex(peer);
-        for (const packageName of metadata.packages) {
+        for (const rawPackageName of metadata.packages) {
+            const packageName = validatePackageName(rawPackageName);
             const packageMetadata = await fetchPackageMetadata(peer, packageName);
+            if (packageMetadata.name !== packageName) {
+                throw PrayError.integrity(`metadata name mismatch for ${packageName}`);
+            }
             const latest = packageMetadata.versions
                 .filter((entry) => !entry.yanked)
                 .at(-1);
             if (!latest) {
                 continue;
             }
+            validatePathSegment(latest.version, "package version");
+            requireIntegrityFields(packageName, latest);
+            rejectAbsoluteArtifactPath(latest.artifact);
             const artifactBytes = await httpGet(joinUrl(peer, latest.artifact));
-            if (latest.artifactHash &&
-                sha256Prefixed(artifactBytes) !== latest.artifactHash) {
+            if (sha256Prefixed(artifactBytes) !== latest.artifactHash) {
                 throw PrayError.integrity(`artifact hash mismatch for ${packageName}`);
             }
-            const cacheDirectory = join(distributionRoot, ".pray", "sync-staging", packageName.replaceAll("/", "-"), latest.version);
-            mkdirSync(cacheDirectory, { recursive: true });
-            unpackPraypkg(artifactBytes, cacheDirectory);
-            writeRegistryPackageMetadataLocal(join(distributionRoot, "v1", "packages", `${packageName}.json`), packageMetadata);
-            mkdirSync(join(distributionRoot, latest.artifact, ".."), {
-                recursive: true,
-            });
-            writeFileSync(join(distributionRoot, latest.artifact), artifactBytes);
+            const cacheDirectory = resolveDistributionPath(distributionRoot, join(".pray", "sync-staging", packageName.replaceAll("/", "-"), latest.version));
+            installArtifactToCache(cacheDirectory, { name: packageName }, latest, artifactBytes);
+            writeRegistryPackageMetadataLocal(resolveDistributionPath(distributionRoot, join("v1", "packages", `${packageName}.json`)), packageMetadata);
+            const artifactPath = resolveDistributionPath(distributionRoot, latest.artifact);
+            writeRegistryBytes(artifactPath, artifactBytes);
             syncedPackages.add(packageName);
         }
     }
-    writeFileSync(join(distributionRoot, "v1", "index.json"), `${JSON.stringify({
+    writeRegistryBytes(resolveDistributionPath(distributionRoot, "v1/index.json"), Buffer.from(`${JSON.stringify({
         spec: "prayfile-distribution-1",
         packages: [...syncedPackages].sort(),
-    }, null, 2)}\n`, "utf8");
+    }, null, 2)}\n`, "utf8"));
     return { peers: [...visited], packages: [...syncedPackages].sort() };
 }
+function writeRegistryBytes(path, bytes) {
+    const parent = join(path, "..");
+    mkdirSync(parent, { recursive: true });
+    writeFileSync(path, bytes);
+}
 async function fetchPackageIndex(peer) {
     const text = await httpGet(joinUrl(peer, "v1/index.json")).then((buffer) => buffer.toString("utf8"));
     const data = JSON.parse(text);

package/dist/sync/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sync/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAQ5D,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAY,EACZ,KAAe;IAEf,MAAM,gBAAgB,GAAG,IAAI,CAAC;IAC9B,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IACzB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IAEzC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;QAC5B,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAElB,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC/C,KAAK,MAAM,WAAW,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC5C,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YACtE,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ;iBACpC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;iBAChC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACV,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,SAAS;YACX,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpE,IACE,MAAM,CAAC,YAAY;gBACnB,cAAc,CAAC,aAAa,CAAC,KAAK,MAAM,CAAC,YAAY,EACrD,CAAC;gBACD,MAAM,SAAS,CAAC,SAAS,CAAC,8BAA8B,WAAW,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,cAAc,GAAG,IAAI,CACzB,gBAAgB,EAChB,OAAO,EACP,cAAc,EACd,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,EAChC,MAAM,CAAC,OAAO,CACf,CAAC;YACF,SAAS,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,aAAa,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YAC7C,iCAAiC,CAC/B,IAAI,CAAC,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,WAAW,OAAO,CAAC,EAC/D,eAAe,CAChB,CAAC;YACF,SAAS,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE;gBACvD,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;YACH,aAAa,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAC;YACtE,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,aAAa,CACX,IAAI,CAAC,gBAAgB,EAAE,IAAI,EAAE,YAAY,CAAC,EAC1C,GAAG,IAAI,CAAC,SAAS,CACf;QACE,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,EAAE;KACrC,EACD,IAAI,EACJ,CAAC,CACF,IAAI,EACL,MAAM,CACP,CAAC;IAEF,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACvE,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,IAAY;IAEZ,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACzE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CACxB,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IACzD,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,iCAAiC,CACxC,IAAY,EACZ,QAAiC;IAEjC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,aAAa,CACX,IAAI,EACJ,GAAG,IAAI,CAAC,SAAS,CACf;QACE,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,aAAa,EAAE,KAAK,CAAC,YAAY;YACjC,SAAS,EAAE,KAAK,CAAC,QAAQ;YACzB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,kBAAkB,EAAE,KAAK,CAAC,iBAAiB;YAC3C,YAAY,EAAE,KAAK,CAAC,WAAW;YAC/B,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;KACJ,EACD,IAAI,EACJ,CAAC,CACF,IAAI,EACL,MAAM,CACP,CAAC;AACJ,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sync/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAO1B,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAY,EACZ,KAAe;IAEf,MAAM,gBAAgB,GAAG,IAAI,CAAC;IAC9B,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IACzB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IAEzC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;QAC5B,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,IAAI,OAAO,CAAC,IAAI,GAAG,oBAAoB,EAAE,CAAC;YACxC,MAAM,SAAS,CAAC,UAAU,CACxB,sBAAsB,oBAAoB,QAAQ,CACnD,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC/C,KAAK,MAAM,cAAc,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC/C,MAAM,WAAW,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;YACxD,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YACtE,IAAI,eAAe,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBACzC,MAAM,SAAS,CAAC,SAAS,CAAC,8BAA8B,WAAW,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ;iBACpC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;iBAChC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACV,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,SAAS;YACX,CAAC;YACD,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;YACvD,sBAAsB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAC5C,0BAA0B,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5C,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpE,IAAI,cAAc,CAAC,aAAa,CAAC,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;gBAC1D,MAAM,SAAS,CAAC,SAAS,CAAC,8BAA8B,WAAW,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,cAAc,GAAG,uBAAuB,CAC5C,gBAAgB,EAChB,IAAI,CACF,OAAO,EACP,cAAc,EACd,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,EAChC,MAAM,CAAC,OAAO,CACf,CACF,CAAC;YACF,sBAAsB,CACpB,cAAc,EACd,EAAE,IAAI,EAAE,WAAW,EAAqB,EACxC,MAAM,EACN,aAAa,CACd,CAAC;YACF,iCAAiC,CAC/B,uBAAuB,CACrB,gBAAgB,EAChB,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,WAAW,OAAO,CAAC,CAC9C,EACD,eAAe,CAChB,CAAC;YACF,MAAM,YAAY,GAAG,uBAAuB,CAC1C,gBAAgB,EAChB,MAAM,CAAC,QAAQ,CAChB,CAAC;YACF,kBAAkB,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;YAChD,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,kBAAkB,CAChB,uBAAuB,CAAC,gBAAgB,EAAE,eAAe,CAAC,EAC1D,MAAM,CAAC,IAAI,CACT,GAAG,IAAI,CAAC,SAAS,CACf;QACE,IAAI,EAAE,yBAAyB;QAC/B,QAAQ,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,EAAE;KACrC,EACD,IAAI,EACJ,CAAC,CACF,IAAI,EACL,MAAM,CACP,CACF,CAAC;IAEF,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,KAAa;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,IAAY;IAEZ,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACzE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CACxB,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IACzD,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,iCAAiC,CACxC,IAAY,EACZ,QAAiC;IAEjC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,aAAa,CACX,IAAI,EACJ,GAAG,IAAI,CAAC,SAAS,CACf;QACE,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,aAAa,EAAE,KAAK,CAAC,YAAY;YACjC,SAAS,EAAE,KAAK,CAAC,QAAQ;YACzB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,kBAAkB,EAAE,KAAK,CAAC,iBAAiB;YAC3C,YAAY,EAAE,KAAK,CAAC,WAAW;YAC/B,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;KACJ,EACD,IAAI,EACJ,CAAC,CACF,IAAI,EACL,MAAM,CACP,CAAC;AACJ,CAAC"}

package/dist/sync/path-safety.d.ts

@@ -0,0 +1,5 @@
+export declare function resolveDistributionPath(root: string, value: string): string;
+export declare function validatePackageName(value: string): string;
+export declare function rejectAbsoluteArtifactPath(value: string): string;
+export declare function validatePathSegment(value: string, label: string): string;
+//# sourceMappingURL=path-safety.d.ts.map

package/dist/sync/path-safety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-safety.d.ts","sourceRoot":"","sources":["../../src/sync/path-safety.ts"],"names":[],"mappings":"AAGA,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAkB3E;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAWzD;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQhE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAYxE"}

package/dist/sync/path-safety.js

@@ -0,0 +1,48 @@
+import { isAbsolute, relative, resolve, win32 } from "node:path";
+import { PrayError } from "../errors.js";
+export function resolveDistributionPath(root, value) {
+    const path = value.trim().replaceAll("\\", "/");
+    if (path.length === 0 ||
+        isAbsolute(path) ||
+        win32.isAbsolute(value) ||
+        path.includes("\0") ||
+        path.split("/").includes("..")) {
+        throw PrayError.integrity(`unsafe distribution path: ${value}`);
+    }
+    const absoluteRoot = resolve(root);
+    const candidate = resolve(absoluteRoot, path);
+    const fromRoot = relative(absoluteRoot, candidate);
+    if (fromRoot.startsWith("..") || isAbsolute(fromRoot)) {
+        throw PrayError.integrity(`distribution path escapes root: ${value}`);
+    }
+    return candidate;
+}
+export function validatePackageName(value) {
+    const parts = value.split("/");
+    if (parts.length === 0 ||
+        parts.some((part) => part.length === 0 || part === "." || part === "..") ||
+        value.includes("\\") ||
+        value.includes("\0")) {
+        throw PrayError.integrity(`invalid package name: ${value}`);
+    }
+    return value;
+}
+export function rejectAbsoluteArtifactPath(value) {
+    const path = value.trim();
+    if (/^[a-z][a-z0-9+.-]*:/i.test(path)) {
+        throw PrayError.integrity(`remote artifact path must be relative: ${value}`);
+    }
+    return path;
+}
+export function validatePathSegment(value, label) {
+    if (value.length === 0 ||
+        value === "." ||
+        value === ".." ||
+        value.includes("/") ||
+        value.includes("\\") ||
+        value.includes("\0")) {
+        throw PrayError.integrity(`invalid ${label}: ${value}`);
+    }
+    return value;
+}
+//# sourceMappingURL=path-safety.js.map

package/dist/sync/path-safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-safety.js","sourceRoot":"","sources":["../../src/sync/path-safety.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,KAAa;IACjE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAChD,IACE,IAAI,CAAC,MAAM,KAAK,CAAC;QACjB,UAAU,CAAC,IAAI,CAAC;QAChB,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACnB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAC9B,CAAC;QACD,MAAM,SAAS,CAAC,SAAS,CAAC,6BAA6B,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACnD,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtD,MAAM,SAAS,CAAC,SAAS,CAAC,mCAAmC,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC;QACxE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EACpB,CAAC;QACD,MAAM,SAAS,CAAC,SAAS,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,SAAS,CAAC,SAAS,CACvB,0CAA0C,KAAK,EAAE,CAClD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,KAAa;IAC9D,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,KAAK,KAAK,GAAG;QACb,KAAK,KAAK,IAAI;QACd,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QACnB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EACpB,CAAC;QACD,MAAM,SAAS,CAAC,SAAS,CAAC,WAAW,KAAK,KAAK,KAAK,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pray-cli",
-  "version": "1.9.1",
+  "version": "1.9.2",
   "description": "Package manager for the language placed before inference — TypeScript Prayfile CLI and library",
   "author": "Andrei Makarov <contact@kiskolabs.com>",
   "license": "MIT",
@@ -35,6 +35,7 @@
     "build": "rm -rf dist && tsc -p tsconfig.build.json",
     "prepublishOnly": "npm run build",
     "test": "npm run build && tsc -p tsconfig.test.json && node --test 'dist/**/*.test.js'",
+    "test:coverage": "npm run build && tsc -p tsconfig.test.json && node --test --experimental-test-coverage --test-coverage-lines=60 --test-coverage-include='dist/**/*.js' --test-coverage-exclude='dist/**/*.test.js' 'dist/**/*.test.js'",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "lint": "biome check . && npm run lint:cycles",
     "libyears": "libyear --dev --quiet",