runcastle 0.2.0 → 1.0.0

package/dist/chunk-6CWCR5SO.js

@@ -1,24 +0,0 @@
-// src/lib/errors.ts
-var CliError = class extends Error {
-  exitCode;
-  /** Optional stable machine code (e.g. a validation code or "E_CHECKSUM"). */
-  code;
-  /** Extra lines printed under the message (hints, URLs tried). */
-  details;
-  constructor(message, opts = {}) {
-    super(message);
-    this.name = "CliError";
-    this.exitCode = opts.exitCode ?? 1;
-    this.code = opts.code;
-    this.details = opts.details ?? [];
-  }
-};
-function isCliError(e) {
-  return e instanceof CliError;
-}
-
-export {
-  CliError,
-  isCliError
-};
-//# sourceMappingURL=chunk-6CWCR5SO.js.map

package/dist/chunk-6CWCR5SO.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/lib/errors.ts"],"sourcesContent":["// A typed error the top-level handler renders cleanly (no stack) and maps to a\n// process exit code. Everything the user should see as an actionable failure is\n// thrown as a CliError.\n\nexport class CliError extends Error {\n  readonly exitCode: number;\n  /** Optional stable machine code (e.g. a validation code or \"E_CHECKSUM\"). */\n  readonly code: string | undefined;\n  /** Extra lines printed under the message (hints, URLs tried). */\n  readonly details: string[];\n\n  constructor(\n    message: string,\n    opts: { exitCode?: number; code?: string; details?: string[] } = {},\n  ) {\n    super(message);\n    this.name = \"CliError\";\n    this.exitCode = opts.exitCode ?? 1;\n    this.code = opts.code;\n    this.details = opts.details ?? [];\n  }\n}\n\n/** True for our own actionable errors (rendered without a stack trace). */\nexport function isCliError(e: unknown): e is CliError {\n  return e instanceof CliError;\n}\n"],"mappings":";AAIO,IAAM,WAAN,cAAuB,MAAM;AAAA,EACzB;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA,EAET,YACE,SACA,OAAiE,CAAC,GAClE;AACA,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,WAAW,KAAK,YAAY;AACjC,SAAK,OAAO,KAAK;AACjB,SAAK,UAAU,KAAK,WAAW,CAAC;AAAA,EAClC;AACF;AAGO,SAAS,WAAW,GAA2B;AACpD,SAAO,aAAa;AACtB;","names":[]}

package/dist/chunk-7CHGGMP7.js

@@ -1,73 +0,0 @@
-import {
-  sha256Hex
-} from "./chunk-QTC5Y3LU.js";
-import {
-  doFetch
-} from "./chunk-5VPKMXSV.js";
-import {
-  USER_AGENT
-} from "./chunk-LP5MV76P.js";
-import {
-  CliError
-} from "./chunk-6CWCR5SO.js";
-
-// src/lib/download.ts
-async function fetchFromRegistry(fetchImpl, url, filePath) {
-  const res = await doFetch(fetchImpl, url, { headers: { "user-agent": USER_AGENT } });
-  if (res.status === 410) {
-    throw new CliError(
-      `${filePath} has been withdrawn by the registry (410) \u2014 this workflow was blocked or removed for policy reasons; refusing to fall back to GitHub`,
-      { code: "E_GONE", details: [url] }
-    );
-  }
-  if (!res.ok) return null;
-  return new Uint8Array(await res.arrayBuffer());
-}
-async function downloadFromRegistry(record, registry, github, fetchImpl) {
-  const [owner, repo] = record.repo.split("/");
-  const dirPrefix = record.directory ? `${record.directory.replace(/\/+$/, "")}/` : "";
-  const out = [];
-  for (const file of record.files) {
-    let bytes = null;
-    let source = "registry";
-    const urlsTried = [];
-    const cacheUrl = file.downloadUrl ?? registry.fileUrl(record.author, record.slug, record.version, file.path);
-    urlsTried.push(cacheUrl);
-    bytes = await fetchFromRegistry(fetchImpl, cacheUrl, file.path);
-    if (!bytes && owner && repo) {
-      source = "github";
-      try {
-        bytes = await github.fetchRawFile(owner, repo, record.commitSha, `${dirPrefix}${file.path}`);
-      } catch (e) {
-        urlsTried.push(e.message);
-      }
-    }
-    if (!bytes) {
-      throw new CliError(`could not download ${file.path} from any source`, {
-        code: "E_DOWNLOAD",
-        details: urlsTried
-      });
-    }
-    const digest = sha256Hex(bytes);
-    if (digest !== file.sha256) {
-      throw new CliError(
-        `checksum mismatch for ${file.path} \u2014 refusing to write (possible tampering)`,
-        {
-          code: "E_CHECKSUM",
-          details: [
-            `expected sha256: ${file.sha256}`,
-            `actual   sha256: ${digest}`,
-            `source: ${source}`
-          ]
-        }
-      );
-    }
-    out.push({ path: file.path, bytes, sha256: digest, source });
-  }
-  return out;
-}
-
-export {
-  downloadFromRegistry
-};
-//# sourceMappingURL=chunk-7CHGGMP7.js.map

package/dist/chunk-7CHGGMP7.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/lib/download.ts"],"sourcesContent":["// Download + verify (spec §5.4.2). Registry cache endpoint first, then\n// raw.githubusercontent.com fallback. EVERY file's SHA-256 is verified against\n// the registry's publish-time checksum; a mismatch is a security-flavored abort.\n\nimport {\n  type FileChecksum,\n  type WorkflowRecord,\n} from \"@castellan/schema\";\nimport { CliError } from \"./errors.js\";\nimport { sha256Hex } from \"./checksum.js\";\nimport { doFetch, type FetchLike } from \"./http.js\";\nimport { USER_AGENT } from \"./config.js\";\nimport type { RegistryClient } from \"./registry.js\";\nimport type { GitHubClient } from \"./github.js\";\n\n/** A downloaded file: raw bytes keyed later by its package-relative path. */\nexport interface DownloadedFile {\n  path: string;\n  bytes: Uint8Array;\n  sha256: string;\n  /** Where the bytes came from, for transparency. */\n  source: \"registry\" | \"github\";\n}\n\n/**\n * Fetch bytes from the registry cache endpoint. A `410 Gone` is a MODERATION\n * signal (blocked/removed workflow, §8.7): it hard-aborts and must NOT fall\n * back to GitHub. Any other failure (404/5xx/network) returns null so the\n * caller can try the GitHub raw mirror.\n */\nasync function fetchFromRegistry(\n  fetchImpl: FetchLike,\n  url: string,\n  filePath: string,\n): Promise<Uint8Array | null> {\n  const res = await doFetch(fetchImpl, url, { headers: { \"user-agent\": USER_AGENT } });\n  if (res.status === 410) {\n    throw new CliError(\n      `${filePath} has been withdrawn by the registry (410) — this workflow was blocked or removed for policy reasons; refusing to fall back to GitHub`,\n      { code: \"E_GONE\", details: [url] },\n    );\n  }\n  if (!res.ok) return null;\n  return new Uint8Array(await res.arrayBuffer());\n}\n\n/**\n * Download and verify every file in a resolved registry record. Owner/repo are\n * parsed from `record.repo`. On any checksum mismatch, aborts immediately with a\n * security-flavored error naming the file and both digests.\n */\nexport async function downloadFromRegistry(\n  record: WorkflowRecord,\n  registry: RegistryClient,\n  github: GitHubClient,\n  fetchImpl: FetchLike,\n): Promise<DownloadedFile[]> {\n  const [owner, repo] = record.repo.split(\"/\");\n  const dirPrefix = record.directory ? `${record.directory.replace(/\\/+$/, \"\")}/` : \"\";\n  const out: DownloadedFile[] = [];\n\n  for (const file of record.files as FileChecksum[]) {\n    let bytes: Uint8Array | null = null;\n    let source: DownloadedFile[\"source\"] = \"registry\";\n    const urlsTried: string[] = [];\n\n    // 1) Registry cache endpoint (downloadUrl if provided, else constructed).\n    const cacheUrl = file.downloadUrl ?? registry.fileUrl(record.author, record.slug, record.version, file.path);\n    urlsTried.push(cacheUrl);\n    bytes = await fetchFromRegistry(fetchImpl, cacheUrl, file.path);\n\n    // 2) raw.githubusercontent.com fallback at the pinned SHA.\n    if (!bytes && owner && repo) {\n      source = \"github\";\n      try {\n        bytes = await github.fetchRawFile(owner, repo, record.commitSha, `${dirPrefix}${file.path}`);\n      } catch (e) {\n        urlsTried.push((e as CliError).message);\n      }\n    }\n\n    if (!bytes) {\n      throw new CliError(`could not download ${file.path} from any source`, {\n        code: \"E_DOWNLOAD\",\n        details: urlsTried,\n      });\n    }\n\n    const digest = sha256Hex(bytes);\n    if (digest !== file.sha256) {\n      throw new CliError(\n        `checksum mismatch for ${file.path} — refusing to write (possible tampering)`,\n        {\n          code: \"E_CHECKSUM\",\n          details: [\n            `expected sha256: ${file.sha256}`,\n            `actual   sha256: ${digest}`,\n            `source: ${source}`,\n          ],\n        },\n      );\n    }\n\n    out.push({ path: file.path, bytes, sha256: digest, source });\n  }\n\n  return out;\n}\n"],"mappings":";;;;;;;;;;;;;;AA8BA,eAAe,kBACb,WACA,KACA,UAC4B;AAC5B,QAAM,MAAM,MAAM,QAAQ,WAAW,KAAK,EAAE,SAAS,EAAE,cAAc,WAAW,EAAE,CAAC;AACnF,MAAI,IAAI,WAAW,KAAK;AACtB,UAAM,IAAI;AAAA,MACR,GAAG,QAAQ;AAAA,MACX,EAAE,MAAM,UAAU,SAAS,CAAC,GAAG,EAAE;AAAA,IACnC;AAAA,EACF;AACA,MAAI,CAAC,IAAI,GAAI,QAAO;AACpB,SAAO,IAAI,WAAW,MAAM,IAAI,YAAY,CAAC;AAC/C;AAOA,eAAsB,qBACpB,QACA,UACA,QACA,WAC2B;AAC3B,QAAM,CAAC,OAAO,IAAI,IAAI,OAAO,KAAK,MAAM,GAAG;AAC3C,QAAM,YAAY,OAAO,YAAY,GAAG,OAAO,UAAU,QAAQ,QAAQ,EAAE,CAAC,MAAM;AAClF,QAAM,MAAwB,CAAC;AAE/B,aAAW,QAAQ,OAAO,OAAyB;AACjD,QAAI,QAA2B;AAC/B,QAAI,SAAmC;AACvC,UAAM,YAAsB,CAAC;AAG7B,UAAM,WAAW,KAAK,eAAe,SAAS,QAAQ,OAAO,QAAQ,OAAO,MAAM,OAAO,SAAS,KAAK,IAAI;AAC3G,cAAU,KAAK,QAAQ;AACvB,YAAQ,MAAM,kBAAkB,WAAW,UAAU,KAAK,IAAI;AAG9D,QAAI,CAAC,SAAS,SAAS,MAAM;AAC3B,eAAS;AACT,UAAI;AACF,gBAAQ,MAAM,OAAO,aAAa,OAAO,MAAM,OAAO,WAAW,GAAG,SAAS,GAAG,KAAK,IAAI,EAAE;AAAA,MAC7F,SAAS,GAAG;AACV,kBAAU,KAAM,EAAe,OAAO;AAAA,MACxC;AAAA,IACF;AAEA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,SAAS,sBAAsB,KAAK,IAAI,oBAAoB;AAAA,QACpE,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAEA,UAAM,SAAS,UAAU,KAAK;AAC9B,QAAI,WAAW,KAAK,QAAQ;AAC1B,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,QAClC;AAAA,UACE,MAAM;AAAA,UACN,SAAS;AAAA,YACP,oBAAoB,KAAK,MAAM;AAAA,YAC/B,oBAAoB,MAAM;AAAA,YAC1B,WAAW,MAAM;AAAA,UACnB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,KAAK,EAAE,MAAM,KAAK,MAAM,OAAO,QAAQ,QAAQ,OAAO,CAAC;AAAA,EAC7D;AAEA,SAAO;AACT;","names":[]}