u-chan-secrets 5.0.0 → 5.1.0

package/dist/service/update/coordinator.js

@@ -0,0 +1,171 @@
+import { mkdir, writeFile, lstat } from 'node:fs/promises';
+import { join } from 'node:path';
+import { atomicJson } from './journal.js';
+import { assertCompatibleState } from '../state.js';
+import { artifactIntegrity, compatibleRelease, inspectRelease } from './release.js';
+import { installedRelease, copyPrivate, writeRelease } from './files.js';
+import { identitySchema, planDecision, publicJob, sameIdentity, terminal } from './protocol.js';
+const answer = (value) => ({ ok: true, message: JSON.stringify(value) });
+const failure = (code) => ({ ok: false, message: code });
+export class UpdateCoordinator {
+    d;
+    staging = Promise.resolve();
+    beginChain = Promise.resolve();
+    pending;
+    constructor(d) {
+        this.d = d;
+    }
+    async check() {
+        const active = await this.d.journal.latest();
+        if (active && (!terminal(active.phase) || active.phase === 'recovery_required'))
+            return { service: this.d.boot, target: active.target, decision: planDecision(this.d.boot, active.target), compatible: active.phase !== 'recovery_required', reason: active.phase === 'recovery_required' ? 'recovery_required' : null, platform: this.d.platform === 'win32' ? 'win32' : 'unsupported', coordinator: 1, activeJob: publicJob(active) };
+        const latest = await this.d.verifier.checkLatest(this.d.boot.version);
+        const verified = await this.d.verifier.verify(latest.latestVersion);
+        if (!verified.ok || !verified.tarball)
+            throw new Error('update_verification_failed');
+        const target = identitySchema.parse({ version: latest.latestVersion, integrity: artifactIntegrity(verified.tarball) });
+        const decision = planDecision(this.d.boot, target);
+        let reason = null;
+        if (this.d.platform !== 'win32')
+            reason = 'unsupported_platform';
+        else if (decision === 'update_required') {
+            await this.d.verifyActive();
+            await assertCompatibleState(this.d.home, Number(target.version.split('.')[0]));
+            const manifest = inspectRelease(verified.tarball);
+            if (manifest.version !== target.version)
+                throw new Error('update_target_mismatch');
+            reason = compatibleRelease(manifest, await installedRelease(join(this.d.home, 'program')), process.versions.node);
+        }
+        else if (decision !== 'up_to_date')
+            reason = decision;
+        return { service: this.d.boot, target, decision, compatible: reason === null, reason, platform: this.d.platform === 'win32' ? 'win32' : 'unsupported', coordinator: 1 };
+    }
+    async planUpdate() { try {
+        return answer(await this.check());
+    }
+    catch {
+        return failure('update_check_failed; no components changed');
+    } }
+    async beginUpdate(target) {
+        const work = async () => {
+            try {
+                if (this.d.platform !== 'win32')
+                    return failure('coordinated updates require Windows');
+                identitySchema.parse(target);
+                const existing = await this.d.journal.latest();
+                if (existing?.phase === 'recovery_required')
+                    return failure('recovery_required; restore the retained program before starting another update');
+                if (existing && !terminal(existing.phase))
+                    return sameIdentity(existing.target, target) ? answer(publicJob(existing)) : failure('update_busy');
+                const plan = await this.check();
+                if (!sameIdentity(plan.target, target))
+                    return failure('update_target_changed; run update --check again');
+                if (!plan.compatible || plan.decision !== 'update_required')
+                    return failure(plan.reason ?? plan.decision);
+                const job = await this.d.journal.create(this.d.boot, target, process.pid);
+                this.staging = this.stage(job).catch(async () => { await this.d.journal.transition(job.id, 'failed', 'staging_failed').catch(() => { }); });
+                return answer(publicJob(job));
+            }
+            catch {
+                return failure('update_prepare_failed; active installation unchanged');
+            }
+        };
+        const result = this.beginChain.then(work, work);
+        this.beginChain = result.catch(() => { });
+        return result;
+    }
+    async stage(job) {
+        await this.d.journal.transition(job.id, 'verifying');
+        const verified = await this.d.verifier.verify(job.target.version);
+        if (!verified.ok || !verified.tarball || artifactIntegrity(verified.tarball) !== job.target.integrity)
+            throw new Error('verification_failed');
+        const manifest = inspectRelease(verified.tarball);
+        if (manifest.version !== job.target.version)
+            throw new Error('target_mismatch');
+        await this.d.verifyActive();
+        await assertCompatibleState(this.d.home, Number(job.target.version.split('.')[0]));
+        const program = join(this.d.home, 'program');
+        if (compatibleRelease(manifest, await installedRelease(program), process.versions.node))
+            throw new Error('incompatible');
+        await this.d.journal.transition(job.id, 'staging');
+        const dir = this.d.journal.directory(job.id), next = join(dir, 'next'), runtime = join(dir, 'runtime');
+        await writeFile(join(dir, 'release.tgz'), verified.tarball, { flag: 'wx', mode: 0o600 });
+        await writeRelease(next, manifest);
+        await copyPrivate(join(program, 'node_modules'), join(next, 'node_modules'));
+        await atomicJson(join(next, 'release.json'), job.target);
+        await mkdir(runtime, { mode: 0o700 });
+        await this.d.secure(runtime);
+        await copyPrivate(program, runtime);
+        if (!(await lstat(join(runtime, 'dist/service/update/worker-main.js'))).isFile())
+            throw new Error('worker_bootstrap_missing');
+        await this.d.verifyActive(next);
+        await this.d.verifyActive(runtime);
+        await this.d.audit('staged ' + job.id);
+        await this.d.journal.transition(job.id, 'ready_to_apply');
+    }
+    async waitForStage() { await this.staging; }
+    async updateStatus(id) { try {
+        await this.refreshGate();
+        return answer(publicJob(await this.d.journal.read(id)));
+    }
+    catch {
+        return failure('update_status_unavailable');
+    } }
+    async activateUpdate(id) {
+        try {
+            const job = await this.d.journal.read(id);
+            if (job.phase !== 'ready_to_apply')
+                return answer(publicJob(job));
+            if (this.pending === id)
+                return answer(publicJob(job));
+            if (!this.d.gate.tryPause())
+                return failure('update_busy; finish active work before retrying');
+            try {
+                await this.d.audit('activate ' + id);
+            }
+            catch {
+                this.d.gate.resume();
+                return failure('update_audit_failed; no switch dispatched');
+            }
+            this.pending = id;
+            return answer(publicJob(job));
+        }
+        catch {
+            return failure('update_activation_failed');
+        }
+    }
+    async afterResponse(method, id) {
+        if (method !== 'activate_update' || this.pending !== id)
+            return;
+        this.pending = undefined;
+        try {
+            const job = await this.d.journal.transition(id, 'switching');
+            await this.d.launch(job);
+        }
+        catch {
+            await this.d.journal.transition(id, 'failed', 'worker_failed').catch(() => { });
+            this.d.gate.resume();
+        }
+    }
+    async confirmUpdateReady(id) { try {
+        await this.d.journal.acknowledge(id, this.d.boot, process.pid);
+        return answer({ id, confirmed: true });
+    }
+    catch {
+        return failure('update_readiness_identity_mismatch');
+    } }
+    async refreshGate() {
+        const job = await this.d.journal.latest();
+        if (!job)
+            return;
+        if (job.parentPid !== process.pid && ['checking', 'verifying', 'staging', 'ready_to_apply'].includes(job.phase)) {
+            await this.d.journal.transition(job.id, 'failed', 'interrupted');
+            this.d.gate.resume();
+            return;
+        }
+        if (['switching', 'waiting_for_service', 'rolling_back', 'recovery_required'].includes(job.phase))
+            this.d.gate.blocked = true;
+        else if (['service_ready', 'rolled_back', 'failed'].includes(job.phase))
+            this.d.gate.resume();
+    }
+}

package/dist/service/update/files.js

@@ -0,0 +1,47 @@
+import { cp, lstat, mkdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { noLinks, boundedJson } from './journal.js';
+import { observedIdentitySchema } from './protocol.js';
+import { nativeFiles } from './release.js';
+export async function readBootIdentity(program) {
+    const pkg = await boundedJson(join(program, 'package.json'));
+    let integrity = null;
+    try {
+        const receipt = observedIdentitySchema.parse(await boundedJson(join(program, 'release.json')));
+        if (receipt.version !== pkg.version || !receipt.integrity)
+            throw new Error('invalid_release_receipt');
+        integrity = receipt.integrity;
+    }
+    catch (e) {
+        if (e.code !== 'ENOENT')
+            throw e;
+    }
+    return observedIdentitySchema.parse({ version: pkg.version, integrity });
+}
+export async function installedRelease(program) {
+    const pkg = await boundedJson(join(program, 'package.json'));
+    const native = {};
+    for (const name of nativeFiles) {
+        const path = join(program, 'dist/platform/windows/assets', name);
+        await noLinks(path);
+        if ((await lstat(path)).size > 1024 * 1024)
+            throw new Error('invalid_native_template');
+        native[name] = await readFile(path);
+    }
+    return { dependencies: pkg.dependencies ?? {}, native };
+}
+export async function writeRelease(directory, manifest) {
+    await noLinks(directory);
+    await mkdir(directory, { mode: 0o700 });
+    for (const [relative, bytes] of manifest.files) {
+        const path = join(directory, relative);
+        await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+        await writeFile(path, bytes, { flag: 'wx', mode: 0o600 });
+    }
+}
+export async function copyPrivate(source, destination) {
+    await noLinks(source);
+    await noLinks(destination);
+    await cp(source, destination, { recursive: true, filter: async (path) => { if ((await lstat(path)).isSymbolicLink())
+            throw new Error('unsafe_update_path'); return true; } });
+}

package/dist/service/update/gate.js

@@ -0,0 +1,21 @@
+const safeMethods = new Set(['capabilities', 'diagnose', 'audit', 'plan_update', 'begin_update', 'update_status', 'activate_update', 'confirm_update_ready']);
+/** One admission boundary covers grants, unlock prompts and management windows over authenticated IPC. */
+export class UpdateGate {
+    active = 0;
+    blocked = false;
+    enter(method) {
+        if (safeMethods.has(method))
+            return () => { };
+        if (this.blocked)
+            return null;
+        this.active++;
+        let left = false;
+        return () => { if (!left) {
+            left = true;
+            this.active--;
+        } };
+    }
+    tryPause() { if (this.active || this.blocked)
+        return false; this.blocked = true; return true; }
+    resume() { this.blocked = false; }
+}

package/dist/service/update/journal.js

@@ -0,0 +1,157 @@
+import { lstat, mkdir, open, readFile, rename, unlink } from 'node:fs/promises';
+import { dirname, join, resolve, parse } from 'node:path';
+import { randomBytes, randomUUID } from 'node:crypto';
+import { idSchema, jobSchema, markerSchema, sameIdentity, terminal } from './protocol.js';
+export async function noLinks(path) {
+    for (let p = resolve(path);;) {
+        try {
+            if ((await lstat(p)).isSymbolicLink())
+                throw new Error('unsafe_update_path');
+        }
+        catch (e) {
+            if (e.code !== 'ENOENT')
+                throw e;
+        }
+        if (p === parse(p).root)
+            break;
+        p = dirname(p);
+    }
+}
+export async function boundedJson(path, limit = 16384) {
+    await noLinks(path);
+    const stat = await lstat(path);
+    if (!stat.isFile() || stat.size > limit)
+        throw new Error('invalid_update_state');
+    const bytes = await readFile(path);
+    if (bytes.length > limit)
+        throw new Error('invalid_update_state');
+    return JSON.parse(bytes.toString('utf8'));
+}
+export async function atomicJson(path, value) {
+    await noLinks(path);
+    const bytes = JSON.stringify(value);
+    if (Buffer.byteLength(bytes) > 16384)
+        throw new Error('invalid_update_state');
+    const temp = path + '.' + randomUUID() + '.tmp', file = await open(temp, 'wx', 0o600);
+    try {
+        await file.writeFile(bytes);
+        await file.sync();
+        await file.close();
+        await rename(temp, path);
+    }
+    finally {
+        await file.close();
+        await unlink(temp).catch(() => { });
+    }
+}
+const transitions = {
+    checking: ['verifying', 'failed'], verifying: ['staging', 'failed'], staging: ['ready_to_apply', 'failed'],
+    ready_to_apply: ['switching', 'failed'], switching: ['waiting_for_service', 'rolling_back', 'failed', 'recovery_required'],
+    waiting_for_service: ['service_ready', 'rolling_back', 'recovery_required'], rolling_back: ['rolled_back', 'recovery_required'],
+    service_ready: [], rolled_back: [], failed: [], recovery_required: [],
+};
+export class UpdateJournal {
+    home;
+    secure;
+    verify;
+    initialized = false;
+    verified = new Set();
+    chain = Promise.resolve();
+    root;
+    constructor(home, secure = async () => { }, verify = async () => true) {
+        this.home = home;
+        this.secure = secure;
+        this.verify = verify;
+        this.root = join(home, 'updates');
+    }
+    directory(id) { return join(this.root, idSchema.parse(id)); }
+    async directoryReady(path, create = false) {
+        await noLinks(path);
+        let exists = true;
+        try {
+            if (!(await lstat(path)).isDirectory())
+                throw new Error('unsafe_update_path');
+        }
+        catch (e) {
+            if (e.code !== 'ENOENT')
+                throw e;
+            exists = false;
+        }
+        if (!exists) {
+            if (!create)
+                throw Object.assign(new Error('update_state_not_found'), { code: 'ENOENT' });
+            await mkdir(path, { mode: 0o700 });
+            await this.secure(path);
+        }
+        if (!await this.verify(path))
+            throw new Error('unsafe_update_permissions');
+    }
+    async init(create = false) { if (!this.initialized) {
+        await this.directoryReady(this.root, create);
+        this.initialized = true;
+    } }
+    async checked(id, create = false) {
+        await this.init(create);
+        const dir = this.directory(id);
+        if (!this.verified.has(id)) {
+            await this.directoryReady(dir, create);
+            this.verified.add(id);
+        }
+        return dir;
+    }
+    async read(id) { const dir = await this.checked(id); const job = jobSchema.parse(await boundedJson(join(dir, 'job.json'))); if (job.id !== id)
+        throw new Error('invalid_update_state'); return job; }
+    async latest() {
+        let pointer;
+        try {
+            await this.init();
+            pointer = await boundedJson(join(this.root, 'current.json'), 1024);
+        }
+        catch (e) {
+            if (e.code === 'ENOENT')
+                return null;
+            throw e;
+        }
+        const id = idSchema.parse(pointer?.id);
+        return this.read(id);
+    }
+    async create(source, target, parentPid) {
+        const operation = async () => {
+            await this.init(true);
+            if (await this.latest().then(j => j && (!terminal(j.phase) || j.phase === 'recovery_required')))
+                throw new Error('update_busy');
+            const job = jobSchema.parse({ id: randomUUID(), phase: 'checking', source, target, parentPid, nonce: randomBytes(32).toString('hex'), createdAt: Date.now(), updatedAt: Date.now() });
+            const dir = await this.checked(job.id, true);
+            await atomicJson(join(dir, 'job.json'), job);
+            await atomicJson(join(this.root, 'current.json'), { id: job.id });
+            return job;
+        };
+        const result = this.chain.then(operation, operation);
+        this.chain = result.catch(() => { });
+        return result;
+    }
+    async transition(id, phase, error) {
+        const job = await this.read(id);
+        if (phase !== job.phase && !transitions[job.phase].includes(phase))
+            throw new Error('invalid_update_transition');
+        const next = jobSchema.parse({ ...job, phase, updatedAt: Date.now(), ...(error ? { error } : {}) });
+        await atomicJson(join(this.directory(id), 'job.json'), next);
+        return next;
+    }
+    async acknowledge(id, boot, pid) {
+        const job = await this.read(id), kind = job.phase === 'waiting_for_service' ? 'target' : job.phase === 'rolling_back' ? 'source' : null;
+        if (!kind || !sameIdentity(boot, kind === 'target' ? job.target : job.source))
+            throw new Error('readiness_identity_mismatch');
+        await atomicJson(join(this.directory(id), 'ready.json'), markerSchema.parse({ id, nonce: job.nonce, boot, pid, kind }));
+    }
+    async marker(id) {
+        try {
+            return markerSchema.parse(await boundedJson(join(await this.checked(id), 'ready.json'), 4096));
+        }
+        catch (e) {
+            if (e.code === 'ENOENT')
+                return null;
+            throw e;
+        }
+    }
+}

package/dist/service/update/native.js

@@ -0,0 +1,50 @@
+import { fork } from 'node:child_process';
+import { join } from 'node:path';
+import { checkWindowsPermissions } from '../../platform/windows/doctor.js';
+import { setAdminOnlyAcl } from '../../platform/windows/acl.js';
+import { UpdateJournal } from './journal.js';
+import { terminal } from './protocol.js';
+export const secureUpdateDirectory = (path) => setAdminOnlyAcl(path, undefined, false);
+export const verifyUpdateDirectory = async (path) => await checkWindowsPermissions(path, false) === 'pass';
+export async function verifyUpdateActive(home, path) {
+    const checks = path ? [checkWindowsPermissions(path)] : [checkWindowsPermissions(home, false), checkWindowsPermissions(join(home, 'program')), checkWindowsPermissions(join(home, 'bin'))];
+    if ((await Promise.all(checks)).some(value => value !== 'pass'))
+        throw new Error('unsafe_update_permissions');
+}
+export function launchUpdateWorker(home, job, exit = () => process.exit(0)) {
+    return new Promise((resolve, reject) => {
+        const runtime = join(home, 'updates', job.id, 'runtime'), env = { ...process.env, U_CHAN_HOME: home };
+        delete env.BW_SESSION;
+        const child = fork(join(runtime, 'dist/service/update/worker-main.js'), [job.id], { execPath: join(home, 'bin', 'node.exe'), cwd: runtime, env, detached: true, windowsHide: true, stdio: ['ignore', 'ignore', 'ignore', 'ipc'] });
+        let started = false;
+        const timer = setTimeout(() => { if (!started) {
+            child.kill();
+            reject(new Error('worker_start_failed'));
+        } }, 30000);
+        child.once('error', () => { clearTimeout(timer); reject(new Error('worker_start_failed')); });
+        child.once('exit', () => { if (!started) {
+            clearTimeout(timer);
+            reject(new Error('worker_start_failed'));
+        }
+        else
+            void productionJournal(home).read(job.id).then(current => { if (!terminal(current.phase))
+                return productionJournal(home).transition(job.id, 'recovery_required', 'worker_failed'); }).catch(() => { }); });
+        child.on('message', message => {
+            const m = message;
+            if (m?.id !== job.id || m.nonce !== job.nonce)
+                return;
+            if (m.type === 'ready' && !started) {
+                started = true;
+                clearTimeout(timer);
+                child.send({ type: 'start', id: job.id, nonce: job.nonce });
+                child.unref();
+                resolve();
+            }
+            if (m.type === 'activated' && started)
+                exit();
+        });
+    });
+}
+export const productionJournal = (home) => process.platform === 'win32'
+    ? new UpdateJournal(home, secureUpdateDirectory, verifyUpdateDirectory)
+    : new UpdateJournal(home, async () => { throw new Error('unsupported_update_platform'); }, async (path) => (await import('../../platform/darwin/doctor.js')).checkDarwinPermissions(path).then(state => state === 'pass'));

package/dist/service/update/network.js

@@ -0,0 +1,28 @@
+import { abortable } from '../../core/abort.js';
+/** Bound every registry request; credentials are never part of this transport. */
+export const boundedRegistryFetch = async (input, init) => {
+    const signal = AbortSignal.timeout(30000);
+    const response = await abortable(fetch(input, { ...init, signal, redirect: 'error' }), signal);
+    if (Number(response.headers.get('content-length')) > 32 * 1024 * 1024) {
+        await response.body?.cancel();
+        throw new Error('registry_response_too_large');
+    }
+    const reader = response.body?.getReader(), chunks = [];
+    let size = 0;
+    try {
+        if (reader)
+            for (;;) {
+                const result = await abortable(reader.read(), signal);
+                if (result.done)
+                    break;
+                size += result.value.length;
+                if (size > 32 * 1024 * 1024)
+                    throw new Error('registry_response_too_large');
+                chunks.push(result.value);
+            }
+        return new Response(response.status === 204 ? null : Buffer.concat(chunks), { status: response.status, statusText: response.statusText, headers: response.headers });
+    }
+    finally {
+        await reader?.cancel().catch(() => { });
+    }
+};

package/dist/service/update/protocol.js

@@ -0,0 +1,28 @@
+import { z } from 'zod';
+import { semverGt } from './verifier.js';
+export const versionSchema = z.string().regex(/^(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})\.(0|[1-9][0-9]{0,5})$/);
+export const integritySchema = z.string().regex(/^sha512-[A-Za-z0-9+/]{86}==$/);
+export const identitySchema = z.strictObject({ version: versionSchema, integrity: integritySchema });
+export const observedIdentitySchema = z.strictObject({ version: versionSchema, integrity: integritySchema.nullable() });
+export const idSchema = z.uuid();
+export const phases = ['checking', 'verifying', 'staging', 'ready_to_apply', 'switching', 'waiting_for_service', 'service_ready', 'rolling_back', 'rolled_back', 'failed', 'recovery_required'];
+export const errors = ['verification_failed', 'staging_failed', 'busy', 'incompatible', 'worker_failed', 'startup_failed', 'rollback_failed', 'interrupted'];
+export const jobSchema = z.strictObject({
+    id: idSchema, phase: z.enum(phases), source: observedIdentitySchema, target: identitySchema,
+    nonce: z.string().regex(/^[a-f0-9]{64}$/), parentPid: z.number().int().positive(),
+    createdAt: z.number().int().nonnegative(), updatedAt: z.number().int().nonnegative(),
+    error: z.enum(errors).optional(),
+});
+export const publicJobSchema = jobSchema.omit({ nonce: true, parentPid: true });
+export const markerSchema = z.strictObject({ id: idSchema, nonce: z.string().regex(/^[a-f0-9]{64}$/), boot: observedIdentitySchema, pid: z.number().int().positive(), kind: z.enum(['target', 'source']) });
+export const terminal = (phase) => ['service_ready', 'rolled_back', 'failed', 'recovery_required'].includes(phase);
+export function publicJob(job) { const { nonce, parentPid, ...safe } = job; return safe; }
+export function sameIdentity(a, b) { return a.version === b.version && a.integrity === b.integrity; }
+export function planDecision(current, target) {
+    if (semverGt(current.version, target.version))
+        return 'local_ahead';
+    if (current.version === target.version)
+        return current.integrity === target.integrity ? 'up_to_date' : 'identity_unknown';
+    return 'update_required';
+}
+export const planSchema = z.strictObject({ service: observedIdentitySchema, target: identitySchema, decision: z.enum(['update_required', 'local_ahead', 'up_to_date', 'identity_unknown']), compatible: z.boolean(), reason: z.string().regex(/^[a-z_]{1,50}$/).nullable(), platform: z.enum(['win32', 'unsupported']), coordinator: z.literal(1), activeJob: publicJobSchema.nullable().optional() });

package/dist/service/update/release.js

@@ -0,0 +1,102 @@
+import { gunzipSync } from 'node:zlib';
+import { createHash } from 'node:crypto';
+import { versionSchema } from './protocol.js';
+export const nativeFiles = ['prompt-src.js', 'auth-src.js', 'service-src.js'];
+export const artifactIntegrity = (bytes) => 'sha512-' + createHash('sha512').update(bytes).digest('base64');
+export function safeReleasePath(path) {
+    if (!path || path.length > 240 || /[\\:\s\p{Cc}\p{Cf}]/u.test(path))
+        return false;
+    return path.split('/').every(p => p && p !== '.' && p !== '..' && !/[. ]$/.test(p) && !/^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(p));
+}
+/** Conservative npm tar reader: unsupported extended metadata fails closed instead of changing paths. */
+export function inspectRelease(tarball) {
+    try {
+        if (tarball.length > 32 * 1024 * 1024)
+            throw new Error();
+        const tar = gunzipSync(tarball, { maxOutputLength: 64 * 1024 * 1024 });
+        const files = new Map(), seen = new Set();
+        let offset = 0, count = 0, ended = false;
+        const string = (buf) => { const zero = buf.indexOf(0); const end = zero < 0 ? buf.length : zero; if (zero >= 0 && buf.subarray(zero).some(n => n !== 0))
+            throw new Error(); return buf.subarray(0, end).toString('utf8'); };
+        const octal = (buf) => { const v = buf.toString('ascii').replace(/[\0 ]/g, ''); if (!/^[0-7]+$/.test(v))
+            throw new Error(); return parseInt(v, 8); };
+        while (offset + 512 <= tar.length) {
+            const header = tar.subarray(offset, offset + 512);
+            if (header.every(n => n === 0)) {
+                if (tar.length - offset < 1024 || tar.subarray(offset).some(n => n !== 0))
+                    throw new Error();
+                ended = true;
+                break;
+            }
+            if (++count > 2000)
+                throw new Error();
+            const sum = [...header].reduce((s, n, i) => s + (i >= 148 && i < 156 ? 32 : n), 0);
+            if (sum !== octal(header.subarray(148, 156)))
+                throw new Error();
+            const prefix = string(header.subarray(345, 500)), name = (prefix ? prefix + '/' : '') + string(header.subarray(0, 100));
+            const type = header[156], size = octal(header.subarray(124, 136));
+            if (type !== 0 && type !== 48 && type !== 53)
+                throw new Error();
+            if (string(header.subarray(157, 257)))
+                throw new Error();
+            const path = name.replace(/\/$/, '');
+            if (!path.startsWith('package/') && path !== 'package')
+                throw new Error();
+            const relative = path.slice(8);
+            if (relative && (!safeReleasePath(relative) || !/^(dist\/|scripts\/|package.json$|README.md$|LICENSE$)/.test(relative)))
+                throw new Error();
+            const key = path.toLowerCase();
+            if (seen.has(key))
+                throw new Error();
+            seen.add(key);
+            const end = offset + 512 + size;
+            if (!Number.isSafeInteger(size) || size < 0 || end > tar.length || (type === 53 && size !== 0))
+                throw new Error();
+            if (type !== 53) {
+                if (!relative)
+                    throw new Error();
+                files.set(relative, Buffer.from(tar.subarray(offset + 512, end)));
+            }
+            offset += 512 + Math.ceil(size / 512) * 512;
+        }
+        if (!ended)
+            throw new Error();
+        const pkg = JSON.parse(files.get('package.json')?.toString('utf8') ?? '');
+        if (pkg.name !== 'u-chan-secrets' || !versionSchema.safeParse(pkg.version).success || !pkg.engines || typeof pkg.engines.node !== 'string')
+            throw new Error();
+        for (const file of ['dist/index.js', 'dist/cli.js', 'dist/service/main.js', 'dist/service/update/worker-main.js'])
+            if (!files.has(file))
+                throw new Error();
+        const dependencies = pkg.dependencies ?? {};
+        if (!dependencies || typeof dependencies !== 'object' || Array.isArray(dependencies) || Object.entries(dependencies).some(([k, v]) => typeof v !== 'string' || !k || k.length > 200))
+            throw new Error();
+        return { version: pkg.version, files, dependencies, node: pkg.engines.node };
+    }
+    catch {
+        throw new Error('invalid_or_unsupported_release');
+    }
+}
+export function compatibleRelease(manifest, installed, nodeVersion) {
+    const floor = /^>=\s*(\d+)(?:\.(\d+)(?:\.(\d+))?)?$/.exec(manifest.node), current = nodeVersion.split('.').map(Number);
+    if (!floor)
+        return 'runtime_changed';
+    const wanted = floor.slice(1).map(v => Number(v ?? 0));
+    let supported = true;
+    for (let i = 0; i < 3; i++) {
+        if (current[i] !== wanted[i]) {
+            supported = current[i] > wanted[i];
+            break;
+        }
+    }
+    if (!supported)
+        return 'runtime_changed';
+    const sorted = (v) => JSON.stringify(Object.entries(v).sort(([a], [b]) => a.localeCompare(b)));
+    if (sorted(manifest.dependencies) !== sorted(installed.dependencies))
+        return 'dependencies_changed';
+    for (const name of nativeFiles) {
+        const next = manifest.files.get('dist/platform/windows/assets/' + name);
+        if (!next || !installed.native[name] || !next.equals(installed.native[name]))
+            return 'native_helpers_changed';
+    }
+    return null;
+}