remoteclaw 0.0.0 → 0.1.0-next.2abd2fa

package/dist/npm-registry-spec-COvUzy5J.js

@@ -0,0 +1,786 @@
+import { rt as resolveUserPath } from "./entry.js";
+import { t as runCommandWithTimeout } from "./exec-DkFE7lqU.js";
+import { n as isPathInside, r as isSymlinkOpenError, t as isNotFoundPathError } from "./path-guards-CIx4hURU.js";
+import { n as resolveSafeBaseDir } from "./path-safety-DkT9RmTG.js";
+import os from "node:os";
+import path from "node:path";
+import { constants } from "node:fs";
+import fsp from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { pipeline } from "node:stream/promises";
+import { Readable, Transform } from "node:stream";
+import JSZip from "jszip";
+import * as tar from "tar";
+
+//#region src/infra/archive-path.ts
+function isWindowsDrivePath(value) {
+	return /^[a-zA-Z]:[\\/]/.test(value);
+}
+function normalizeArchiveEntryPath(raw) {
+	return raw.replaceAll("\\", "/");
+}
+function validateArchiveEntryPath(entryPath, params) {
+	if (!entryPath || entryPath === "." || entryPath === "./") return;
+	if (isWindowsDrivePath(entryPath)) throw new Error(`archive entry uses a drive path: ${entryPath}`);
+	const normalized = path.posix.normalize(normalizeArchiveEntryPath(entryPath));
+	const escapeLabel = params?.escapeLabel ?? "destination";
+	if (normalized === ".." || normalized.startsWith("../")) throw new Error(`archive entry escapes ${escapeLabel}: ${entryPath}`);
+	if (path.posix.isAbsolute(normalized) || normalized.startsWith("//")) throw new Error(`archive entry is absolute: ${entryPath}`);
+}
+function stripArchivePath(entryPath, stripComponents) {
+	const raw = normalizeArchiveEntryPath(entryPath);
+	if (!raw || raw === "." || raw === "./") return null;
+	const parts = raw.split("/").filter((part) => part.length > 0 && part !== ".");
+	const strip = Math.max(0, Math.floor(stripComponents));
+	const stripped = strip === 0 ? parts.join("/") : parts.slice(strip).join("/");
+	const result = path.posix.normalize(stripped);
+	if (!result || result === "." || result === "./") return null;
+	return result;
+}
+function resolveArchiveOutputPath(params) {
+	const safeBase = resolveSafeBaseDir(params.rootDir);
+	const outPath = path.resolve(params.rootDir, params.relPath);
+	const escapeLabel = params.escapeLabel ?? "destination";
+	if (!outPath.startsWith(safeBase)) throw new Error(`archive entry escapes ${escapeLabel}: ${params.originalPath}`);
+	return outPath;
+}
+
+//#endregion
+//#region src/infra/archive.ts
+var ArchiveSecurityError = class extends Error {
+	constructor(code, message, options) {
+		super(message, options);
+		this.code = code;
+		this.name = "ArchiveSecurityError";
+	}
+};
+/** @internal */
+const DEFAULT_MAX_ARCHIVE_BYTES_ZIP = 256 * 1024 * 1024;
+/** @internal */
+const DEFAULT_MAX_ENTRIES = 5e4;
+/** @internal */
+const DEFAULT_MAX_EXTRACTED_BYTES = 512 * 1024 * 1024;
+/** @internal */
+const DEFAULT_MAX_ENTRY_BYTES = 256 * 1024 * 1024;
+const ERROR_ARCHIVE_SIZE_EXCEEDS_LIMIT = "archive size exceeds limit";
+const ERROR_ARCHIVE_ENTRY_COUNT_EXCEEDS_LIMIT = "archive entry count exceeds limit";
+const ERROR_ARCHIVE_ENTRY_EXTRACTED_SIZE_EXCEEDS_LIMIT = "archive entry extracted size exceeds limit";
+const ERROR_ARCHIVE_EXTRACTED_SIZE_EXCEEDS_LIMIT = "archive extracted size exceeds limit";
+const ERROR_ARCHIVE_ENTRY_TRAVERSES_SYMLINK = "archive entry traverses symlink in destination";
+const TAR_SUFFIXES = [
+	".tgz",
+	".tar.gz",
+	".tar"
+];
+const OPEN_WRITE_FLAGS = constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | (process.platform !== "win32" && "O_NOFOLLOW" in constants ? constants.O_NOFOLLOW : 0);
+function resolveArchiveKind(filePath) {
+	const lower = filePath.toLowerCase();
+	if (lower.endsWith(".zip")) return "zip";
+	if (TAR_SUFFIXES.some((suffix) => lower.endsWith(suffix))) return "tar";
+	return null;
+}
+async function resolvePackedRootDir(extractDir) {
+	const direct = path.join(extractDir, "package");
+	try {
+		if ((await fsp.stat(direct)).isDirectory()) return direct;
+	} catch {}
+	const dirs = (await fsp.readdir(extractDir, { withFileTypes: true })).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+	if (dirs.length !== 1) throw new Error(`unexpected archive layout (dirs: ${dirs.join(", ")})`);
+	const onlyDir = dirs[0];
+	if (!onlyDir) throw new Error("unexpected archive layout (no package dir found)");
+	return path.join(extractDir, onlyDir);
+}
+async function withTimeout(promise, timeoutMs, label) {
+	let timeoutId;
+	try {
+		return await Promise.race([promise, new Promise((_, reject) => {
+			timeoutId = setTimeout(() => reject(/* @__PURE__ */ new Error(`${label} timed out after ${timeoutMs}ms`)), timeoutMs);
+		})]);
+	} finally {
+		if (timeoutId) clearTimeout(timeoutId);
+	}
+}
+function clampLimit(value) {
+	if (typeof value !== "number" || !Number.isFinite(value)) return;
+	const v = Math.floor(value);
+	return v > 0 ? v : void 0;
+}
+function resolveExtractLimits(limits) {
+	return {
+		maxArchiveBytes: clampLimit(limits?.maxArchiveBytes) ?? DEFAULT_MAX_ARCHIVE_BYTES_ZIP,
+		maxEntries: clampLimit(limits?.maxEntries) ?? DEFAULT_MAX_ENTRIES,
+		maxExtractedBytes: clampLimit(limits?.maxExtractedBytes) ?? DEFAULT_MAX_EXTRACTED_BYTES,
+		maxEntryBytes: clampLimit(limits?.maxEntryBytes) ?? DEFAULT_MAX_ENTRY_BYTES
+	};
+}
+function assertArchiveEntryCountWithinLimit(entryCount, limits) {
+	if (entryCount > limits.maxEntries) throw new Error(ERROR_ARCHIVE_ENTRY_COUNT_EXCEEDS_LIMIT);
+}
+function createByteBudgetTracker(limits) {
+	let entryBytes = 0;
+	let extractedBytes = 0;
+	const addBytes = (bytes) => {
+		const b = Math.max(0, Math.floor(bytes));
+		if (b === 0) return;
+		entryBytes += b;
+		if (entryBytes > limits.maxEntryBytes) throw new Error(ERROR_ARCHIVE_ENTRY_EXTRACTED_SIZE_EXCEEDS_LIMIT);
+		extractedBytes += b;
+		if (extractedBytes > limits.maxExtractedBytes) throw new Error(ERROR_ARCHIVE_EXTRACTED_SIZE_EXCEEDS_LIMIT);
+	};
+	return {
+		startEntry() {
+			entryBytes = 0;
+		},
+		addBytes,
+		addEntrySize(size) {
+			const s = Math.max(0, Math.floor(size));
+			if (s > limits.maxEntryBytes) throw new Error(ERROR_ARCHIVE_ENTRY_EXTRACTED_SIZE_EXCEEDS_LIMIT);
+			addBytes(s);
+		}
+	};
+}
+function createExtractBudgetTransform(params) {
+	return new Transform({ transform(chunk, _encoding, callback) {
+		try {
+			const buf = chunk instanceof Buffer ? chunk : Buffer.from(chunk);
+			params.onChunkBytes(buf.byteLength);
+			callback(null, buf);
+		} catch (err) {
+			callback(err instanceof Error ? err : new Error(String(err)));
+		}
+	} });
+}
+function symlinkTraversalError(originalPath) {
+	return new ArchiveSecurityError("destination-symlink-traversal", `${ERROR_ARCHIVE_ENTRY_TRAVERSES_SYMLINK}: ${originalPath}`);
+}
+async function assertDestinationDirReady(destDir) {
+	const stat = await fsp.lstat(destDir);
+	if (stat.isSymbolicLink()) throw new ArchiveSecurityError("destination-symlink", "archive destination is a symlink");
+	if (!stat.isDirectory()) throw new ArchiveSecurityError("destination-not-directory", "archive destination is not a directory");
+	return await fsp.realpath(destDir);
+}
+async function assertNoSymlinkTraversal(params) {
+	const parts = params.relPath.split("/").filter(Boolean);
+	let current = path.resolve(params.rootDir);
+	for (const part of parts) {
+		current = path.join(current, part);
+		let stat;
+		try {
+			stat = await fsp.lstat(current);
+		} catch (err) {
+			if (isNotFoundPathError(err)) continue;
+			throw err;
+		}
+		if (stat.isSymbolicLink()) throw symlinkTraversalError(params.originalPath);
+	}
+}
+async function assertResolvedInsideDestination(params) {
+	let resolved;
+	try {
+		resolved = await fsp.realpath(params.targetPath);
+	} catch (err) {
+		if (isNotFoundPathError(err)) return;
+		throw err;
+	}
+	if (!isPathInside(params.destinationRealDir, resolved)) throw symlinkTraversalError(params.originalPath);
+}
+async function openZipOutputFile(outPath, originalPath) {
+	try {
+		return await fsp.open(outPath, OPEN_WRITE_FLAGS, 438);
+	} catch (err) {
+		if (isSymlinkOpenError(err)) throw symlinkTraversalError(originalPath);
+		throw err;
+	}
+}
+async function cleanupPartialRegularFile(filePath) {
+	let stat;
+	try {
+		stat = await fsp.lstat(filePath);
+	} catch (err) {
+		if (isNotFoundPathError(err)) return;
+		throw err;
+	}
+	if (stat.isFile()) await fsp.unlink(filePath).catch(() => void 0);
+}
+async function readZipEntryStream(entry) {
+	if (typeof entry.nodeStream === "function") return entry.nodeStream();
+	const buf = await entry.async("nodebuffer");
+	return Readable.from(buf);
+}
+function resolveZipOutputPath(params) {
+	validateArchiveEntryPath(params.entryPath);
+	const relPath = stripArchivePath(params.entryPath, params.strip);
+	if (!relPath) return null;
+	validateArchiveEntryPath(relPath);
+	return {
+		relPath,
+		outPath: resolveArchiveOutputPath({
+			rootDir: params.destinationDir,
+			relPath,
+			originalPath: params.entryPath
+		})
+	};
+}
+async function prepareZipOutputPath(params) {
+	await assertNoSymlinkTraversal({
+		rootDir: params.destinationDir,
+		relPath: params.relPath,
+		originalPath: params.originalPath
+	});
+	if (params.isDirectory) {
+		await fsp.mkdir(params.outPath, { recursive: true });
+		await assertResolvedInsideDestination({
+			destinationRealDir: params.destinationRealDir,
+			targetPath: params.outPath,
+			originalPath: params.originalPath
+		});
+		return;
+	}
+	const parentDir = path.dirname(params.outPath);
+	await fsp.mkdir(parentDir, { recursive: true });
+	await assertResolvedInsideDestination({
+		destinationRealDir: params.destinationRealDir,
+		targetPath: parentDir,
+		originalPath: params.originalPath
+	});
+}
+async function writeZipFileEntry(params) {
+	const handle = await openZipOutputFile(params.outPath, params.entry.name);
+	params.budget.startEntry();
+	const readable = await readZipEntryStream(params.entry);
+	const writable = handle.createWriteStream();
+	try {
+		await pipeline(readable, createExtractBudgetTransform({ onChunkBytes: params.budget.addBytes }), writable);
+	} catch (err) {
+		await cleanupPartialRegularFile(params.outPath).catch(() => void 0);
+		throw err;
+	}
+	if (typeof params.entry.unixPermissions === "number") {
+		const mode = params.entry.unixPermissions & 511;
+		if (mode !== 0) await fsp.chmod(params.outPath, mode).catch(() => void 0);
+	}
+}
+async function extractZip(params) {
+	const limits = resolveExtractLimits(params.limits);
+	const destinationRealDir = await assertDestinationDirReady(params.destDir);
+	if ((await fsp.stat(params.archivePath)).size > limits.maxArchiveBytes) throw new Error(ERROR_ARCHIVE_SIZE_EXCEEDS_LIMIT);
+	const buffer = await fsp.readFile(params.archivePath);
+	const zip = await JSZip.loadAsync(buffer);
+	const entries = Object.values(zip.files);
+	const strip = Math.max(0, Math.floor(params.stripComponents ?? 0));
+	assertArchiveEntryCountWithinLimit(entries.length, limits);
+	const budget = createByteBudgetTracker(limits);
+	for (const entry of entries) {
+		const output = resolveZipOutputPath({
+			entryPath: entry.name,
+			strip,
+			destinationDir: params.destDir
+		});
+		if (!output) continue;
+		await prepareZipOutputPath({
+			destinationDir: params.destDir,
+			destinationRealDir,
+			relPath: output.relPath,
+			outPath: output.outPath,
+			originalPath: entry.name,
+			isDirectory: entry.dir
+		});
+		if (entry.dir) continue;
+		await writeZipFileEntry({
+			entry,
+			outPath: output.outPath,
+			budget
+		});
+	}
+}
+function readTarEntryInfo(entry) {
+	return {
+		path: typeof entry === "object" && entry !== null && "path" in entry ? String(entry.path) : "",
+		type: typeof entry === "object" && entry !== null && "type" in entry ? String(entry.type) : "",
+		size: typeof entry === "object" && entry !== null && "size" in entry && typeof entry.size === "number" && Number.isFinite(entry.size) ? Math.max(0, Math.floor(entry.size)) : 0
+	};
+}
+async function extractArchive(params) {
+	const kind = params.kind ?? resolveArchiveKind(params.archivePath);
+	if (!kind) throw new Error(`unsupported archive: ${params.archivePath}`);
+	const label = kind === "zip" ? "extract zip" : "extract tar";
+	if (kind === "tar") {
+		const strip = Math.max(0, Math.floor(params.stripComponents ?? 0));
+		const limits = resolveExtractLimits(params.limits);
+		let entryCount = 0;
+		const budget = createByteBudgetTracker(limits);
+		await withTimeout(tar.x({
+			file: params.archivePath,
+			cwd: params.destDir,
+			strip,
+			gzip: params.tarGzip,
+			preservePaths: false,
+			strict: true,
+			onReadEntry(entry) {
+				const info = readTarEntryInfo(entry);
+				try {
+					validateArchiveEntryPath(info.path);
+					const relPath = stripArchivePath(info.path, strip);
+					if (!relPath) return;
+					validateArchiveEntryPath(relPath);
+					resolveArchiveOutputPath({
+						rootDir: params.destDir,
+						relPath,
+						originalPath: info.path
+					});
+					if (info.type === "SymbolicLink" || info.type === "Link" || info.type === "BlockDevice" || info.type === "CharacterDevice" || info.type === "FIFO" || info.type === "Socket") throw new Error(`tar entry is a link: ${info.path}`);
+					entryCount += 1;
+					assertArchiveEntryCountWithinLimit(entryCount, limits);
+					budget.addEntrySize(info.size);
+				} catch (err) {
+					const error = err instanceof Error ? err : new Error(String(err));
+					this.abort?.(error);
+				}
+			}
+		}), params.timeoutMs, label);
+		return;
+	}
+	await withTimeout(extractZip({
+		archivePath: params.archivePath,
+		destDir: params.destDir,
+		stripComponents: params.stripComponents,
+		limits: params.limits
+	}), params.timeoutMs, label);
+}
+async function fileExists(filePath) {
+	try {
+		await fsp.stat(filePath);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function readJsonFile(filePath) {
+	const raw = await fsp.readFile(filePath, "utf-8");
+	return JSON.parse(raw);
+}
+
+//#endregion
+//#region src/infra/install-source-utils.ts
+async function withTempDir(prefix, fn) {
+	const tmpDir = await fsp.mkdtemp(path.join(os.tmpdir(), prefix));
+	try {
+		return await fn(tmpDir);
+	} finally {
+		await fsp.rm(tmpDir, {
+			recursive: true,
+			force: true
+		}).catch(() => void 0);
+	}
+}
+async function resolveArchiveSourcePath(archivePath) {
+	const resolved = resolveUserPath(archivePath);
+	if (!await fileExists(resolved)) return {
+		ok: false,
+		error: `archive not found: ${resolved}`
+	};
+	if (!resolveArchiveKind(resolved)) return {
+		ok: false,
+		error: `unsupported archive: ${resolved}`
+	};
+	return {
+		ok: true,
+		path: resolved
+	};
+}
+function toOptionalString(value) {
+	if (typeof value !== "string") return;
+	const trimmed = value.trim();
+	return trimmed.length > 0 ? trimmed : void 0;
+}
+function parseResolvedSpecFromId(id) {
+	const at = id.lastIndexOf("@");
+	if (at <= 0 || at >= id.length - 1) return;
+	const name = id.slice(0, at).trim();
+	const version = id.slice(at + 1).trim();
+	if (!name || !version) return;
+	return `${name}@${version}`;
+}
+function normalizeNpmPackEntry(entry) {
+	if (!entry || typeof entry !== "object") return null;
+	const rec = entry;
+	const name = toOptionalString(rec.name);
+	const version = toOptionalString(rec.version);
+	const id = toOptionalString(rec.id);
+	const resolvedSpec = (name && version ? `${name}@${version}` : void 0) ?? (id ? parseResolvedSpecFromId(id) : void 0);
+	return {
+		filename: toOptionalString(rec.filename),
+		metadata: {
+			name,
+			version,
+			resolvedSpec,
+			integrity: toOptionalString(rec.integrity),
+			shasum: toOptionalString(rec.shasum)
+		}
+	};
+}
+function parseNpmPackJsonOutput(raw) {
+	const trimmed = raw.trim();
+	if (!trimmed) return null;
+	const candidates = [trimmed];
+	const arrayStart = trimmed.indexOf("[");
+	if (arrayStart > 0) candidates.push(trimmed.slice(arrayStart));
+	for (const candidate of candidates) {
+		let parsed;
+		try {
+			parsed = JSON.parse(candidate);
+		} catch {
+			continue;
+		}
+		const entries = Array.isArray(parsed) ? parsed : [parsed];
+		let fallback = null;
+		for (let i = entries.length - 1; i >= 0; i -= 1) {
+			const normalized = normalizeNpmPackEntry(entries[i]);
+			if (!normalized) continue;
+			if (!fallback) fallback = normalized;
+			if (normalized.filename) return normalized;
+		}
+		if (fallback) return fallback;
+	}
+	return null;
+}
+async function packNpmSpecToArchive(params) {
+	const res = await runCommandWithTimeout([
+		"npm",
+		"pack",
+		params.spec,
+		"--ignore-scripts",
+		"--json"
+	], {
+		timeoutMs: Math.max(params.timeoutMs, 3e5),
+		cwd: params.cwd,
+		env: {
+			COREPACK_ENABLE_DOWNLOAD_PROMPT: "0",
+			NPM_CONFIG_IGNORE_SCRIPTS: "true"
+		}
+	});
+	if (res.code !== 0) return {
+		ok: false,
+		error: `npm pack failed: ${res.stderr.trim() || res.stdout.trim()}`
+	};
+	const parsedJson = parseNpmPackJsonOutput(res.stdout || "");
+	const packed = parsedJson?.filename ?? (res.stdout || "").split("\n").map((line) => line.trim()).filter(Boolean).pop();
+	if (!packed) return {
+		ok: false,
+		error: "npm pack produced no archive"
+	};
+	return {
+		ok: true,
+		archivePath: path.join(params.cwd, packed),
+		metadata: parsedJson?.metadata ?? {}
+	};
+}
+
+//#endregion
+//#region src/infra/install-flow.ts
+async function resolveExistingInstallPath(inputPath) {
+	const resolvedPath = resolveUserPath(inputPath);
+	if (!await fileExists(resolvedPath)) return {
+		ok: false,
+		error: `path not found: ${resolvedPath}`
+	};
+	return {
+		ok: true,
+		resolvedPath,
+		stat: await fsp.stat(resolvedPath)
+	};
+}
+async function withExtractedArchiveRoot(params) {
+	return await withTempDir(params.tempDirPrefix, async (tmpDir) => {
+		const extractDir = path.join(tmpDir, "extract");
+		await fsp.mkdir(extractDir, { recursive: true });
+		params.logger?.info?.(`Extracting ${params.archivePath}…`);
+		try {
+			await extractArchive({
+				archivePath: params.archivePath,
+				destDir: extractDir,
+				timeoutMs: params.timeoutMs,
+				logger: params.logger
+			});
+		} catch (err) {
+			return {
+				ok: false,
+				error: `failed to extract archive: ${String(err)}`
+			};
+		}
+		let rootDir = "";
+		try {
+			rootDir = await resolvePackedRootDir(extractDir);
+		} catch (err) {
+			return {
+				ok: false,
+				error: String(err)
+			};
+		}
+		return await params.onExtracted(rootDir);
+	});
+}
+
+//#endregion
+//#region src/infra/install-mode-options.ts
+function resolveInstallModeOptions(params, defaultLogger) {
+	return {
+		logger: params.logger ?? defaultLogger,
+		mode: params.mode ?? "install",
+		dryRun: params.dryRun ?? false
+	};
+}
+function resolveTimedInstallModeOptions(params, defaultLogger, defaultTimeoutMs = 12e4) {
+	return {
+		...resolveInstallModeOptions(params, defaultLogger),
+		timeoutMs: params.timeoutMs ?? defaultTimeoutMs
+	};
+}
+
+//#endregion
+//#region src/infra/install-package-dir.ts
+function isObjectRecord(value) {
+	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+async function sanitizeManifestForNpmInstall(targetDir) {
+	const manifestPath = path.join(targetDir, "package.json");
+	let manifestRaw = "";
+	try {
+		manifestRaw = await fsp.readFile(manifestPath, "utf-8");
+	} catch {
+		return;
+	}
+	let manifest;
+	try {
+		const parsed = JSON.parse(manifestRaw);
+		if (!isObjectRecord(parsed)) return;
+		manifest = parsed;
+	} catch {
+		return;
+	}
+	const devDependencies = manifest.devDependencies;
+	if (!isObjectRecord(devDependencies)) return;
+	const filteredEntries = Object.entries(devDependencies).filter(([, rawSpec]) => {
+		return !(typeof rawSpec === "string" ? rawSpec.trim() : "").startsWith("workspace:");
+	});
+	if (filteredEntries.length === Object.keys(devDependencies).length) return;
+	if (filteredEntries.length === 0) delete manifest.devDependencies;
+	else manifest.devDependencies = Object.fromEntries(filteredEntries);
+	await fsp.writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, "utf-8");
+}
+async function installPackageDir(params) {
+	params.logger?.info?.(`Installing to ${params.targetDir}…`);
+	let backupDir = null;
+	if (params.mode === "update" && await fileExists(params.targetDir)) {
+		const backupRoot = path.join(path.dirname(params.targetDir), ".remoteclaw-install-backups");
+		backupDir = path.join(backupRoot, `${path.basename(params.targetDir)}-${Date.now()}`);
+		await fsp.mkdir(backupRoot, { recursive: true });
+		await fsp.rename(params.targetDir, backupDir);
+	}
+	const rollback = async () => {
+		if (!backupDir) return;
+		await fsp.rm(params.targetDir, {
+			recursive: true,
+			force: true
+		}).catch(() => void 0);
+		await fsp.rename(backupDir, params.targetDir).catch(() => void 0);
+	};
+	try {
+		await fsp.cp(params.sourceDir, params.targetDir, { recursive: true });
+	} catch (err) {
+		await rollback();
+		return {
+			ok: false,
+			error: `${params.copyErrorPrefix}: ${String(err)}`
+		};
+	}
+	try {
+		await params.afterCopy?.();
+	} catch (err) {
+		await rollback();
+		return {
+			ok: false,
+			error: `post-copy validation failed: ${String(err)}`
+		};
+	}
+	if (params.hasDeps) {
+		await sanitizeManifestForNpmInstall(params.targetDir);
+		params.logger?.info?.(params.depsLogMessage);
+		const npmRes = await runCommandWithTimeout([
+			"npm",
+			"install",
+			"--omit=dev",
+			"--silent",
+			"--ignore-scripts"
+		], {
+			timeoutMs: Math.max(params.timeoutMs, 3e5),
+			cwd: params.targetDir
+		});
+		if (npmRes.code !== 0) {
+			await rollback();
+			return {
+				ok: false,
+				error: `npm install failed: ${npmRes.stderr.trim() || npmRes.stdout.trim()}`
+			};
+		}
+	}
+	if (backupDir) await fsp.rm(backupDir, {
+		recursive: true,
+		force: true
+	}).catch(() => void 0);
+	return { ok: true };
+}
+
+//#endregion
+//#region src/infra/install-safe-path.ts
+function unscopedPackageName(name) {
+	const trimmed = name.trim();
+	if (!trimmed) return trimmed;
+	return trimmed.includes("/") ? trimmed.split("/").pop() ?? trimmed : trimmed;
+}
+function safeDirName(input) {
+	const trimmed = input.trim();
+	if (!trimmed) return trimmed;
+	return trimmed.replaceAll("/", "__").replaceAll("\\", "__");
+}
+function resolveSafeInstallDir(params) {
+	const targetDir = path.join(params.baseDir, safeDirName(params.id));
+	const resolvedBase = path.resolve(params.baseDir);
+	const resolvedTarget = path.resolve(targetDir);
+	const relative = path.relative(resolvedBase, resolvedTarget);
+	if (!relative || relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) return {
+		ok: false,
+		error: params.invalidNameMessage
+	};
+	return {
+		ok: true,
+		path: targetDir
+	};
+}
+
+//#endregion
+//#region src/infra/npm-integrity.ts
+async function resolveNpmIntegrityDrift(params) {
+	if (!params.expectedIntegrity || !params.resolution.integrity) return { proceed: true };
+	if (params.expectedIntegrity === params.resolution.integrity) return { proceed: true };
+	const integrityDrift = {
+		expectedIntegrity: params.expectedIntegrity,
+		actualIntegrity: params.resolution.integrity
+	};
+	const payload = params.createPayload({
+		spec: params.spec,
+		expectedIntegrity: integrityDrift.expectedIntegrity,
+		actualIntegrity: integrityDrift.actualIntegrity,
+		resolution: params.resolution
+	});
+	let proceed = true;
+	if (params.onIntegrityDrift) proceed = await params.onIntegrityDrift(payload);
+	else params.warn?.(payload);
+	return {
+		integrityDrift,
+		proceed,
+		payload
+	};
+}
+async function resolveNpmIntegrityDriftWithDefaultMessage(params) {
+	const driftResult = await resolveNpmIntegrityDrift({
+		spec: params.spec,
+		expectedIntegrity: params.expectedIntegrity,
+		resolution: params.resolution,
+		createPayload: (drift) => ({ ...drift }),
+		onIntegrityDrift: params.onIntegrityDrift,
+		warn: (driftPayload) => {
+			params.warn?.(`Integrity drift detected for ${driftPayload.resolution.resolvedSpec ?? driftPayload.spec}: expected ${driftPayload.expectedIntegrity}, got ${driftPayload.actualIntegrity}`);
+		}
+	});
+	if (!driftResult.proceed && driftResult.payload) return {
+		integrityDrift: driftResult.integrityDrift,
+		error: `aborted: npm package integrity drift detected for ${driftResult.payload.resolution.resolvedSpec ?? driftResult.payload.spec}`
+	};
+	return { integrityDrift: driftResult.integrityDrift };
+}
+
+//#endregion
+//#region src/infra/npm-pack-install.ts
+async function installFromNpmSpecArchiveWithInstaller(params) {
+	return await installFromNpmSpecArchive({
+		tempDirPrefix: params.tempDirPrefix,
+		spec: params.spec,
+		timeoutMs: params.timeoutMs,
+		expectedIntegrity: params.expectedIntegrity,
+		onIntegrityDrift: params.onIntegrityDrift,
+		warn: params.warn,
+		installFromArchive: async ({ archivePath }) => await params.installFromArchive({
+			archivePath,
+			...params.archiveInstallParams
+		})
+	});
+}
+function isSuccessfulInstallResult(result) {
+	return result.ok;
+}
+function finalizeNpmSpecArchiveInstall(flowResult) {
+	if (!flowResult.ok) return flowResult;
+	const installResult = flowResult.installResult;
+	if (!isSuccessfulInstallResult(installResult)) return installResult;
+	return {
+		...installResult,
+		npmResolution: flowResult.npmResolution,
+		...flowResult.integrityDrift ? { integrityDrift: flowResult.integrityDrift } : {}
+	};
+}
+async function installFromNpmSpecArchive(params) {
+	return await withTempDir(params.tempDirPrefix, async (tmpDir) => {
+		const packedResult = await packNpmSpecToArchive({
+			spec: params.spec,
+			timeoutMs: params.timeoutMs,
+			cwd: tmpDir
+		});
+		if (!packedResult.ok) return packedResult;
+		const npmResolution = {
+			...packedResult.metadata,
+			resolvedAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		const driftResult = await resolveNpmIntegrityDriftWithDefaultMessage({
+			spec: params.spec,
+			expectedIntegrity: params.expectedIntegrity,
+			resolution: npmResolution,
+			onIntegrityDrift: params.onIntegrityDrift,
+			warn: params.warn
+		});
+		if (driftResult.error) return {
+			ok: false,
+			error: driftResult.error
+		};
+		return {
+			ok: true,
+			installResult: await params.installFromArchive({ archivePath: packedResult.archivePath }),
+			npmResolution,
+			integrityDrift: driftResult.integrityDrift
+		};
+	});
+}
+
+//#endregion
+//#region src/infra/npm-registry-spec.ts
+function validateRegistryNpmSpec(rawSpec) {
+	const spec = rawSpec.trim();
+	if (!spec) return "missing npm spec";
+	if (/\s/.test(spec)) return "unsupported npm spec: whitespace is not allowed";
+	if (spec.includes("://")) return "unsupported npm spec: URLs are not allowed";
+	if (spec.includes("#")) return "unsupported npm spec: git refs are not allowed";
+	if (spec.includes(":")) return "unsupported npm spec: protocol specs are not allowed";
+	const at = spec.lastIndexOf("@");
+	const hasVersion = at > 0;
+	const name = hasVersion ? spec.slice(0, at) : spec;
+	const version = hasVersion ? spec.slice(at + 1) : "";
+	if (!(name.startsWith("@") ? /^@[a-z0-9][a-z0-9-._~]*\/[a-z0-9][a-z0-9-._~]*$/.test(name) : /^[a-z0-9][a-z0-9-._~]*$/.test(name))) return "unsupported npm spec: expected <name> or <name>@<version> from the npm registry";
+	if (hasVersion) {
+		if (!version) return "unsupported npm spec: missing version/tag after @";
+		if (/[\\/]/.test(version)) return "unsupported npm spec: invalid version/tag";
+	}
+	return null;
+}
+
+//#endregion
+export { safeDirName as a, resolveInstallModeOptions as c, withExtractedArchiveRoot as d, resolveArchiveSourcePath as f, resolveArchiveKind as g, readJsonFile as h, resolveSafeInstallDir as i, resolveTimedInstallModeOptions as l, fileExists as m, finalizeNpmSpecArchiveInstall as n, unscopedPackageName as o, extractArchive as p, installFromNpmSpecArchiveWithInstaller as r, installPackageDir as s, validateRegistryNpmSpec as t, resolveExistingInstallPath as u };