jNT d Z ddlZddlZddlZddlZddlZddlZddlZddlZddl Z ddl
Z
dZ dZ dZ
dZdZdZd Zd
Zd Zd Z ed
dddddddddej ej d ddddd ej ej d d f Zd Zej ed Zej ed Z ej d! Z ej d" Z ej d# Z d$Z!d%Z"d&Z#d'Z$d(Z%d)d*d+d,dd-Z&d.d/d0d1d2d-Z'd3gZ(dZ)d4Z*d5Z+d6Z,d7Z-d8Z.d9Z/d:Z0 ed; Z1 G d< d=e2 Z3 G d> d?e3 Z4e fd@Z5dA Z6dB Z7dC Z8dD Z9dE Z:dF Z;dG ZddJZ?efdKZ@ddLZAdM ZBe
fdNZCdO ZDdP ZEdQ ZFdR ZGdS ZHdT ZIe
fdUZJe
fdVZKdW ZLdX ZMdY ZNdZ ZOd[ ZPdd]ZQd^ ZRd_ ZSd` ZTda ZU G db dceV ZWedfddZXe dfdeZY ddfZZddgZ[dh Z\di Z]ddjZ^ddkZ_ddlZ`ddmZadn ZbddoZcdp ZdddqZeedfdrZfds Zgdt Zhdu Zidv Zjdw Zkdx Zle
fdyZmdz Znd{ Zod| Zpd} Zqd~ Zre
dfdZsd Ztd Zud Zvd Zwd Zxe
dddddfdZyd Zz ddZ{edfdZ|dS )a Configuration for the server-wide shared Node modules storage.
The account-readable file contains non-sensitive delivery policy. Account
names excluded by the administrator live in a separate root-only sidecar;
accounts learn only their own current decision from the authenticated daemon.
Unknown JSON keys survive writes so a newer package can add settings without
an older administrator CLI discarding them.
Nz/opt/cl-bun/bunzShared node_modules Store requires a usable cl-bun engine. Ask the administrator to run cl-node-modules-storage enable to restore it, or cl-node-modules-storage disable to use classic npm.z)/opt/cl-bun/etc/node-modules-storage.jsonz.excluded-usersz /var/lib/cl-node-modules-storagei z /proc/sys/fs/protected_hardlinks i /z/bootz/devz/etcz/homez/optz/procz/rootz/runz/systmpz/usrz/varz
/var/cachez/var/libz/var/logvarz$/run/cloudlinux-node-modules-storagez storage.lockz config.lockz-^\.[0-9a-f]{1,16}-[0-9A-F]+\.[A-Za-z0-9_.-]+$z^entry-[0-9a-f]{32}$z^[0-9]+$z .prune-trashz.cl-node-modules-check-@ g333333?< x )account_deliveries_per_houraccount_deliveries_per_dayconcurrent_deliveries delivery_queue_timeout_secondssoft_storage_limit_gb) i )r i@B )r i )r iQ )r i zhttps://registry.npmjs.org/ i -1i z.cl-storage-usage.jsonz .cl-shared-node-modules.json )schemaengine delivered_at shared_files
private_filesquarantined_files shared_bytes shared_inodec e Zd ZdZdS ) StorageErrorz4A safe-to-display administrator configuration error.N__name__
__module__ __qualname____doc__ V/opt/cloudlinux/venv/lib64/python3.11/site-packages/clselector/node_modules_storage.pyr r w s >>>>r' r c e Zd ZdZdS )CachePopulationBusyz@A daemon retry may wait outside its scarce global delivery gate.Nr! r& r' r( r* r* { s JJJJr' r* c $ t j | }n# t $ r Y dS w xY wt j |j oP|j dk oEt j |j dz o(t t j |j dz S )z7Check the packaged engine without executing it as root.Fr I )osstatOSErrorS_ISREGst_modest_uidS_IMODEbool)pathinfos r( engine_availabler8 s wt}} uu L & &
94;!+;
9L ..66
9T\$,//%788:s
%%c J i }| D ] \ }}||v rt d |||< |S )zBjson object_pairs_hook rejecting ambiguous duplicate member names.zduplicate JSON member)
ValueError)pairsresultkeyvalues r( _unique_objectr? sB
F
U &== 455 5s Mr' c d} t | t rt j | }n9t j | t j t j z t j z }t | |& t j | S # t $ r Y S w xY wS # t t f$ r. Y |( t j | dS # t $ r Y dS w xY wdS w xY w# |& t j | w # t $ r Y w w xY ww xY w)aS Return a valid delivered-tree marker, or ``None`` for inactive.
The marker is account-readable input when the selector lists applications.
It is deliberately a tiny, flat, exact schema: malformed data, a symlink,
or any read failure is an inactive shared-node-modules state rather than an
application-listing failure.
N)
isinstanceintr. dupopenO_RDONLY O_DIRECTORY
O_NOFOLLOW"read_shared_node_modules_marker_fdcloser0 TypeError) node_modulesroot_fds r( read_shared_node_modules_markerrM sc G lC ( ( Lf\**GGgl kBN :R] JL LG1'::
!!!!
Y
!!!!!
!!!!
sl A1B 8B
BB C /C 3C
CC C C D
$C98D
9
DD
DD
c x d} t j t t j t j z t j z | }t j | }t j |j r|j
t k r- |( t j | dS # t $ r Y dS w xY wdS g }t dz }|rOt j |t d| }|sn)| | |t# | z }|Od | }t# | t k r- |( t j | dS # t $ r Y dS w xY wdS t' j | d t, }nN# t t. t0 t2 f$ r. Y |( t j | dS # t $ r Y dS w xY wdS w xY w |& t j | n># t $ r Y n2w xY wn-# |& t j | w # t $ r Y w w xY ww xY wt5 |t6 rt9 | t: k rdS t= | d t@ us |d d k rdS | d
d k rdS | d }t= | t@ u r@ tC j" tG | } n# tH $ r d
} Y nw xY w|dk s| sdS n2t= | tF ustC j" | r|dk rdS dD ]:}
t= | |
t@ us ||
dk r dS ;|d } |d dk stK | | sdS |S )z=Read a marker below an already-pinned node_modules directory.Ndir_fdr r r' utf-8)object_pairs_hookr r bunr Fr )r r r r r r )&r. rD SHARED_NODE_MODULES_MARKERrE
O_NONBLOCKrG fstatr/ r1 r2 st_size$MAX_SHARED_NODE_MODULES_MARKER_BYTESrI r0 readminappendlenjoinjsonloadsdecoder? UnicodeErrorr: RecursionErrorrA dictset _SHARED_NODE_MODULES_MARKER_KEYStypegetrB mathisfinitefloat
OverflowError_shared_inode_matches) rL marker_fdr7 chunks remainingchunkdatar> r timestamp_finitenameproofs r( rH rH sq IG 6 K"- 7"- G#*, , , x "" T\** <"FFF
#####
! 81< $GIs4';';<RRR \:~ >
#####
!
####
!9
####
!
eT " " c%jj4T&T&Tt EIIh ++uX!/C/Ct yye##t99^,,L LS % #}U<-@-@ A A % % % $ % ! #3 4
|
E
)
) |,, *0w)N)N!t Ls A=F B
B)(B).B
F <E
E E %.F H G 1H 5G
GG G H &G; ;
HH H6H%$H6%
H2/H61H22H6&!L LLc t |t rt | h dk st | d t rjt | d t usA|d dk s5t | d t us |d dk rdS |d }| d }|r8t j
| st d |D rdS t j | } |d d
D ]S}t j
|t j t j z t j z | }t j | |}Tt j |d
|d }t% j |j o;|j |d k o*|j |d k o|j d
k ot1 | t j | S # t2 t4 f$ r Y t j | dS w xY w# t j | w xY w)z?Verify one inode that proves the restored tree is still shared.> r6 inodedevicer6 rx r rw Fr c 3 K | ]}|d v V dS ) ...Nr& ).0parts r( z(_shared_inode_matches.. s' ==t4?*======r' NrO rP follow_symlinksr )rA rd re rh strrg rB splitr. r6 isabsanyrC rD rE rF rG rI r/ r1 r2 st_devst_inost_nlinkis_sound_shared_inoder0 r: )rL ru r6 partscurrentr childr7 s r( rm rm sO ud # # 5zz 8 8 888 eii / /55 9EIIh''((33uX7J7JEIIg&&''s22eGnq6H6Hu =D JJsOOE BGMM$'' ==u=====ufWooG#2#J DGD"+"> "N#*, , ,E HW GGwuRy%HHH T\** 0K5?20K5>10 MA%0 *$// 1
Z
s% -CH H;#H> :H;;H> >Ic ddl m} m} || j }n"# t $ r}t d |d}~ww xY wt
| t urt d |S )a Return the panel capability without hiding probe failures.
``False`` is reserved for a successful, authoritative "unsupported"
answer. Callers must refuse on ``StorageError`` so a transient panel API
failure can never select classic npm and detach a live shared tree.
r )Featureis_panel_feature_supportedz)cannot determine Node.js Selector supportN)clcommon.cpapir r NODEJS_SELECTOR Exceptionr rg r5 )r r supportedexcs r( nodejs_selector_supportedr s QFFFFFFFF..w/FGG Q Q QFGGSPQ Id""FGGG s
:5:c t | t rQt j | r2t | t us t |t t f sdS t d |D rdS d} t j
| t j t j z t j
z }t j | j |k r |t j | dS dS |D ]}t j
|t j t j z t j
z | }t j | |}t j | j |k r |t j | dS dS |}d}||t j | S S # t" $ r Y |t j | dS dS w xY w# |t j | w w xY w)zBPin a user-owned directory below an account home without symlinks.Nc 3 K | ]W}t |t p<|d v p8t j j |v p%t j j duot j j |v V XdS rz )rA r r. r6 sepaltsep)r~ components r( r z/_open_user_directory_beneath.. s ( ( )S)) ) KY/-I KgkY& Kw~T)Ibgn .I ( ( ( ( ( (r' rO )rA r r. r6 r rg rB listtupler rD rE rF rG rW r3 rI r0 )homeuid
components directory_fdr child_fdr< s r( _open_user_directory_beneathr s& tS ! ! t)<)< Cyy##:j4-+P+P#t
( ( ' ( ( ( ( ( tL#wtR[2>%ABM%QRR
8L ! ! (C / / # H\ " " " " " $ # $ Iwy !{R^ ;bm K&24 4 4H
H\ " " "#Lx %%,33 # H\ " " " " " $ # 4 # H\ " " " " $ # H\ " " " " " $ # # H\ " " " " $s2 AF# 8A3F# F# #
G -G G G G%c t | || }|dS t j | j t j | S # t
$ r Y t j | dS w xY w# t j | w xY w)z.>< --5 /?!- T\22mCC<"222 $ii+++72s4)9A)=D )I J JKKD
DLD $ii+++
s& ,/
==BE< AE< E< <Fc ( t | }|dv S )a Return true only for the kernel's exact enabled sysctl value.
The kernel state is external input: read it with the same bounded,
no-follow, root-owned-file contract used for administrator configuration.
Missing or malformed state fails closed.
) 1s 1
)r )r6 r> s r( protected_hardlinks_enabledr | s
E N ""r' c t | | }|d S t j | d }n # t t
t f$ r Y d S w xY wt |t r|nd S )Nr rQ ) r r_ r` ra rb r: rc rA rd )r6 r rr r> s r( _read_rawr s t= 9 9 9D |t
4;;w//00 *n 5 tt ud++ 5555s '? AAc r | | }t |t sg S d |D S )zA list of account names, or nothing. Wrong types are ignored per
key -- same policy as every other key in this file -- so a hand-edited
`"excluded_users": "bob"` reads as an empty list, not as a crash and
not as the letters b, o, b.c < g | ]}t |t |S r& rA r r~ entrys r(
z _user_list.. s' ? ? ?e
5#(>(> ?E ? ? ?r' )rh rA r )rawr= r> s r(
_user_listr s>
GGCLLE eT " " ? ?u ? ? ??r' c | t z S )z?Root-only account-exclusion authority beside the public policy.)EXCLUSIONS_SUFFIXr6 s r( exclusions_pathr s # ##r' c j t | }t j | st |d dfS t |t }|g dfS | d }t |t rt d |D rg dfS t | dfS )a Return (account names, valid).
A pre-release configuration may still carry the list in its public JSON;
reconcile migrates it. Once the private sidecar exists, malformed or
unreadable content is never interpreted as an empty allow-all list.
excluded_usersTr NFc 3 B K | ]}t |t V d S Nr r s r( r z _exclusions.. s/ AA%z%---AAAAAAr' ) r r. r6 lexistsr r EXCLUSIONS_MODErh rA r r )r6
public_raw private_path private_rawr> s r( _exclusionsr s #4((L
7??< ( ( >*&677==LHHHK5y OO , - -E ud # # AA5AAAAA5y ;; r' c n t t }| d }t |t rvt D ]\\ }\ }}| | }t |t r*t |t s||cxk r|k rn W|||< ]|S )zFill every ceiling from defaults, taking only values that are sane
integers within bounds. A hand-edited garbage value reads as the
default for that key alone -- the same per-key tolerance as the lists.limits)rd DEFAULT_LIMITSrh rA LIMIT_BOUNDSitemsrB r5 )r r givenr= lowhighr> s r( _limitsr s .
!
!F GGH E% $ , 2 2 4 4 $ $ C#tIIcNNE5#&&
$z%/F/F
$u,,,,,,,,, #s Mr' c | d }t |t st t S |sg S d |D }|pt t S )a
The allowlist of registries a lockfile may name.
Preserve an exact empty or multi-entry list so status can diagnose a
hand-edited or legacy configuration and delivery can fail closed. Missing
and malformed values retain the safe npm-default behaviour.
allowed_registriesc d g | ]-}t |t | +|.S r& )rA r stripr s r( r z _registries.. sF ? ? ?E s++?05
?% ? ? ?r' )rh rA r DEFAULT_REGISTRIES)r r
registriess r( _registriesr su
GG( ) )E eT " " (&''' ? ?U ? ? ?J 1 0111r' c ` d| vr d| vrt gS | d }t |t s/| d }t |t r|gng }g }|D ]?}t |t r(t | r||vr| | @|S )a The list of storage directories, newest key first, legacy folded in.
`storage_paths` (a list) is authoritative; a legacy single `storage_path`
string is read as a one-element list. With neither key present the store
defaults to DEFAULT_STORAGE_PATH (unchanged behaviour). Only syntactically
valid, de-duplicated paths survive; a present-but-all-invalid setting
yields the empty result, which the caller then treats as off -- exactly
what an invalid single path did before.
storage_paths storage_path)DEFAULT_STORAGE_PATHrh rA r r _valid_path_syntaxr\ )r
candidateslegacypathsr s r( _storage_pathsr s c!!nC&?&?$%% ))J j$ ' ' A ((!+FC!8!8@fXXb
E uc " " '9%'@'@ && LL Lr' c | d }t |t sdS g }|D ]K}t |t r4t |t s |dk r||vr| | L|S )al Root-published device IDs used by account-side eligibility checks.
Storage is deliberately root-private. The identifiers are not sensitive,
but they let a selector running as an account determine same-filesystem
eligibility without opening a protected storage path. ``None`` means an
older configuration did not publish the information yet.
storage_devicesNr )rh rA r rB r5 r\ )r r> devicesrx s r( _storage_devicesr s
GG% & &E eT " " tG # # vs # # #Jvt,D,D #aKKF'$9$9 NN6 " " " Nr' c x | t | ng }t | duo |od| v pd| v }| |s;dt gt dd||t t t t d S | d du ||d t | |||t | t | d S ) zBBuild the complete caller shape from already selected authorities.Nr r F) enabledr r r storage_configuredr exclusions_validr r r Tr ) r r5 r rd r r r rh r r r )r r r r
configureds r( _effective_configr s #&?N3 E co L% L*c1J^s5JM MJ
{%{ "6!7 4#'&+"0$4 ~..&*+=&>&>@ @ @ wwy))T1 " !!H / 4 4", , 0 cll"-c"2"2 4 4 4r' c l t | }t | |pi \ }}t ||| S )a% Return root-authoritative policy; invalid input is always off.
Every key is present on every return path so no caller has to guess: a
partial or malformed public file yields the safe disabled shape with
defaults. A malformed private exclusion authority refuses every account.
)r r r )r6 r r r s r( read_configr s; D//C'24'C'C$N$ S.2B C CCr' c > t t | g d S )a Return only CageFS-readable policy without opening account names.
``exclusions_valid`` is unknown rather than true. Passing this view to
``is_user_included`` therefore fails closed; callers that need an account
decision must ask the authenticated daemon.
N)r r r s r( read_public_configr ) s Yt__b$ 7 77r' c , | D ]~\ }}|t vrt d|z t | \ }}t |t s$t |t
r||cxk r|k sn t d|||fz dS )z|Range-check a partial {key: int} the CLI is about to write. Raises
StorageError naming the offending key and its bounds.zunknown limit: %sz'%s must be an integer between %d and %dN)r r r rA r5 rB )partialr= r> r r s r( validate_limitsr 3 s mmoo 3 3
U l " " 2S 899 9 % T eT " " 3*UC*@*@ 3uH\H\H\H\X\H\H\H\H\ H"%sD!1 2 3 3
3 I] 3 3r' c ` | dd o| | d pg vS )aY Per-account carve-out on top of the global `enabled` flag.
The feature is for everyone; `excluded_users` is the handle for the
account it cannot serve -- a git or tarball dependency, say -- carved
out without touching the flag for the rest of the server. An excluded
account takes the ordinary npm path: that is the point of the knob,
not a failure. There is deliberately no allowlist counterpart: an
administrator cannot know in advance which accounts are safe, so an
allowlist rollout degenerates into more work than excluding the few
that surface (and the config's unknown-key tolerance leaves room to
add one later without migration, should a real need appear).
Takes the dict `read_config` returned; an absent key reads as an empty
list, so a partial dict from an older caller means everyone included.
r Tr )rh )userconfigs r( is_user_includedr ? s<
JJ)4 0 0
AVZZ(8 9 9 ?R@Br' c t | oJt j | o+| t j | k o| t
vS r )r5 r. r6 r normpath_DANGEROUS_PATHSr s r( r r S sO JJ
-27==..
-427;K;KD;Q;Q3Q
- ,,.r' c R t j }| t j dd D ]r}t j || } t j | }n# t $ r Y dS w xY wt j |j rt d sdS )zCReject every lexical symlink component before creating or using it.r Nz path must not traverse a symlink) r. r r r6 r^ lstatr0 r/ S_ISLNKr2 r )r6 r r r7 s r( _reject_symlink_ancestorsr X s fGZZ''+ C C ',,w 22 8G$$DD FFF < % % C ABB B C
C Cs A,,
A;:A;c t j | }t j |j r'|j dk s t j |j dz rt d|z d S )Nr r, z.%s must be a root-owned non-writable directory)r. rW r/ S_ISDIRr2 r3 r4 r )r labelr7 s r( _require_root_private_dirr e se
8B<>> )* 5 5 E9
V " bn >-j.GI I I IkX-- dl33|CC $$$$ :j)) ! $$$$ !\*
$$$$
!
$$$$$$$$
s * K
A AA -K 9BK
B4K 3B44.K 8
K ;EK
E;"K :E;;K ?A I K I K J! JJ!K JJ! K !J77K K'c L d x}}d}d} t d D ]}t t j d z } t j |t j t j z t j z t j z d| }d} n<# t $ r }|j t j k r Y d }~d }~ww xY wt d t j | |dz }t j ||| | d d}n$# t $ r}t d
|z d }~ww xY w |r|nd |r|nd fD ],}|r( t j || # t $ r Y (w xY w-d S # |r|nd |r|nd fD ],}|r( t j || # t $ r Y (w xY w-w xY w) NF r rO Tz#cannot create unique hardlink probez.link)
src_dir_fd
dst_dir_fdr z+storage path does not support hardlinks: %s)ranger r. urandomhexrD O_WRONLYO_CREATO_EXCLrG r0 errnoEEXISTr rI linkunlink) r sourcetargetr linked_unusedr r candidates r( r r s] FVG
F Ryy F FG*RZ^^-?-?-A-AAF
WV [2: 5 ABM Q "<9 9 9
9 ,, -,,,,
DEE E
'!
E
E"!E"(F#:FF#
F F# F F#c t | t rBt j | r#| t j | k rt
d t j | \ }}|st
d t j t j t j
t j z t j z } t |d | t j dd }t | D ]\ }} t j |t j
t j z t j z | }n# t $ r}|t! | dz
k s|j t" j k rt
d|z t j |t( | n># t $ r1} | j t" j k rt
d| z Y d} ~ nd} ~ ww xY w t j |t j
t j z t j z | }n$# t $ r}
t
d|
z d}
~
ww xY wY d}~nd}~ww xY w t |d |t! | dz
k rCt- j t j | j t( k rt
d n## t4 $ r t j | w xY wt j | |}||fS # t4 $ r t j | w xY w)
zBOpen the root-private parent for a lock without trusting its name.z storage lock path is invalidzstorage lock ancestorr NrO z(storage lock directory is not usable: %sz(cannot create storage lock directory: %szstorage lock directoryz*storage lock directory must have mode 0700) rA r r. r6 r r r r rD r rE rF rG r r r0 r] r- ENOENTr r
r. r/ r4 rW r2 r rI ) r6 directoryrt r r r
r r r mkdir_excopen_excs r( _open_lock_directoryr; sL tS ! ! ; t)<)< ;rw''----9:::gmmD))OIt ;9::: r~5
E F FB#!"&=>>> __RV,,QRR0
)* 5 5 E9
^ " bn }| j t j% | j d | _ t) d |z d }~ww xY w t j% | n# t j% | w xY w| S )
NrO Fr Tr ? z6storage lock must be a root-owned private regular filez)storage lock timeout must be non-negativezstorage lock is busyzstorage lock wait timed outg?z cannot open storage lock: %s)&r; r@ r. rD O_RDWRrG rC r0 r- r7 r+ r, r. r rW r/ r1 r2 r3 r4 r r? fcntlLOCK_EXLOCK_SHrB time monotonicrA LOCK_NBflockEACCESEAGAIN EWOULDBLOCKr* sleepr[ rI )
rD r rt r r r r7 flagsdeadlinerp s
r( __enter__z_StorageLock.__enter__= s 1$* = = d: #
$ 74R])B*6 8 8 8
$
$
$9 ,,
$ !w bi"* 4ry @2= P l 4 4 4DH #GG $ $ $!'5<77 !wtRY -F.: < < ++dm;
'H$8 &
5 5K%000 5 5 5y !L%,8I)K K K ( J 12H I II (4>+;+; ;I A~~ *+H I IIJs4 3 344444444 5
5 x#""" E E Ex#""" = CDD D E! ,
H\ " " " "BH\ " " " " s 5A K.
D.D)1ACD)
D! A D D) D!!D)$K. )D..C=K. ,I K.
K)BK$ K. $K))K. -N .;M')9M""M''N Nc X | j "t j | j d | _ d S d S r )rC r. rI )rD r s r( __exit__z_StorageLock.__exit__| s/ 8 HTX DHHH r' )r" r# r$ LOCK_PATHrH rY r[ r& r' r( r= r= 4 sO '0e = = =~ r' r= c & t | || S )NrG r= )rE r6 rG s r( storage_lockr` s 4 9 9 99r' c & t d| | S )z@Serialize the supported CLI's complete config read-modify-write.Tr^ r_ )r6 rG s r( config_lockrb s dG 4 4 44r' c B t | \ }} t j | }t j | n# t j | w xY w|t }d|j |j fz }t dt j || || S )a Serialize Bun cache writers for one pinned storage directory.
Delivery keeps its existing shared storage lock for the complete
transaction, while this narrower lock covers only Bun's cache mutation.
Distinct storage directories therefore remain independent.
Nzbun-cache-%x-%x.lockT)rF rG
r r. rW rI LOCK_DIRECTORYr r r= r6 r^ )r6 lock_directoryrF rG rL r r7 rt s r( cache_population_lockrg s *$//GXx
' !T[$+$> >D bgll>4 @ @$/ B B B B = Ac @ t | \ }} t j | }t j | n# t j | w xY w|t }d|j |j fz }t dt j || | S )zESerialize prune commands without making deliveries wait on this lock.Nzbun-prune-%x-%x.lockTr^ rd )r6 rf rG rL r r7 rt s r( _prune_maintenance_lockrj s )$//GXx
' !T[$+$> >D bgll>4 @ @ ' ) ) ) )rh c | d }|dk s%t | |dz d sdS | d| }| d }||dz d }|dk oX|oVt d t |d cxk ot d k nc od
|vo| d S ) z:Measured Bun 1.4 name: package@version@@@cache-generation.@@@r NF@r 09r r| )rfind
_ASCII_DIGITSmatchordr )rt markerpackage_version separatorversions r( _is_canonical_namery s
ZZ
F
{{---d6A:;;.?@@{u7F7mO %%c**I i!mnn-G M
Sg
SCC
OO7777s3xx7777
S?*
S3B3M3Mc3R3R/RTr' c | d }| d | }| d }|d | ||dz d | |d z fS )Nrl rn r )rq )rt ru rv rw s r( _canonical_partsr{ sa
ZZ
F7F7mO %%c**I :I: & A
(G$vww-(W WWr' c ( d}t }d}t j | g} |r|Ft j |k r/ |r*t j | |(dS dS | } t j | D ]#}|Zt j |k rC t j | |r*t j | |(dS dS t j ||d }nR# t $ rE Y t j | |r*t j | |(dS dS w xY wt j
|j r|j dk s t j
|j dz rC t j | |r*t j | |(dS dS t j |t j t j z t j z | } nR# t $ rE Y t j | |r*t j | |(dS dS w xY w| | t j |j rd }t) | sC t j | |r*t j | |(dS dS |j d
k rC t j | |r*t j | |(d S d S |j |j f}
|
|vr | |
||j z
} t j | |r*t j | |(dS dS t j | n# t j | w xY w|n=# t $ r0 Y |r*t j | |(dS dS w xY w|r(t j | |(n/# |r(t j | |(w xY w|rd |fndS )
a. Return (state, bytes): removable, kept (linked), poisoned, or skipped.
``poisoned`` is an owner/mode anomaly on a directory or regular file --
the trace a ``chown -R`` leaves -- and is reported separately from the
other anomalies because it is the one the administrator has to act on.
r FNskippedr r r, poisonedr rO Tr keptr removable)re r. rC rO rP rI popr r/ r0 r r2 r3 r4 rD rE rF rG r\ r1 r r r r addrX ) r rX totalseen has_regularstackr rt r7 r rw s r( _safe_entry_treer s
E 55DK
VBZZLE)" # "#(8(8H(D(D#J " HUYY[[ ! ! ! " " " " "I iikkG
" Jw / / , ,D +0@0@H0L0L +8 !!! " HUYY[[ ! ! ! " " " " "?, !wtGU S S S" , , , +|0 !!! " HUYY[[ ! ! ! " " " " ";,|DL11 , ;!++t|DL/I/IE/Q+#0* !!! " HUYY[[ ! ! ! " " " " "10$&GD,.K".,H2=,X3:%< %< % O
O5 4O O5 O5 O..O5 4Q 5
P/?Q .P//Q ,R c d }t j | }t j | }ddd|j |j dg} |r|&t j |k rt d |d }|d t j | |d< |d t |d k r|d |
||d
\ }} |d }
| j |
d k s| j |
d
k rt d t j |d | n## t $ r t j
| w xY wt j
| |}|
C|d |d } |dxx dz
cc< t j | |d } t j | j rrt | t" k rt d ||| \ }
}t j
| |
}| | dd|j |j d n|t j | j r"| j dk rt j | | nA|r0t j | j rt j | | nt d |t j
| dS # t j
| w xY w)a0 Remove a previously scanned tree, still refusing all unsafe nodes.
A tree deeper than `MAX_REMOVAL_DEPTH` is refused rather than removed:
every caller counts that as `skipped`, so the entry stays quarantined for
the next prune instead of costing this one unbounded time under the locks.
c t j |t j t j z t j z | } |t j | fS # t $ r t j | w xY w)NrO )r. rD rE rF rG rW
BaseExceptionrI )rP rt r s r( open_dirz _remove_tree..open_dir
sr bkBN :R] J %' ' ' "(5//) ) HUOOO s A A3Nr )rt r r
devinoz prune maintenance slice expiredr r r
rt r} r r zentry changed while pruningrO r Fr zentry is too deep to prune)r. rC rW r r rO rP r r r] r rmdirr rI r/ r r2 MAX_REMOVAL_DEPTHr\ r1 r r0 r )r allow_symlinksrX r r root_infoframesframeparent parent_infoabovert r7 r
child_infos r( _remove_treer s= " fRjjG!!IdQ &y/?A A BF, ) B#(8(8H(D(D"#DEEE2JEW~%!#G!4!4gW~U7^!4!444=(JJLLL &.hw&=&=# r
#*eEl:: * 1U5\ A A *+H I IIHU6]6:::::$ HV$$$ !!!
>%.1D 'NNNa NNN74GGGD|DL))
Bv;;"333&'CDDD$,HWd$;$;!z!!!
tdQ&0&7&0&7 9 9 : : : : dl++
B
0B0B $w/////
BDL $>$>
B $w/////"#@AAAS ) BV s' B%K &A
D4 3K 4 EE4K K4c
d}t }t j | g} |r:|Ft j |k r/ |r*t j | |(dS dS | } t j | D ]}|Zt j |k rC t j | |r*t j | |(dS dS t j ||d }nR# t $ rE Y t j | |r*t j | |(dS dS w xY wt j
|j r|j t k s t j |j dz rC t j | |r*t j | |(dS dS t j |t j t j z t j z | }nR# t $ rE Y t j | |r*t j | |(dS dS w xY w| | t j |j r|j t k rC t j | |r*t j | |(dS dS |j d k rC t j | |r*t j | |(d
S d
S |j |j f} | |vr | | ||j z
}t j |j rU|j t k rC t j | |r*t j | |(dS dS T t j | |r*t j | |(dS dS t j | n# t j | w xY w|:n=# t $ r0 Y |r*t j | |(dS dS w xY w|r(t j | |(n/# |r(t j | |(w xY wd |fS ) aA Classify one observed Bun 1.4 temporary cache entry.
Symlinks are data inside npm tarballs and are safe to unlink without
following. A regular file with another hardlink means a delivered tree
still uses this otherwise non-reusable temporary entry, so retain the
whole directory until a later prune.
r Nr} Fr r, r rO r r r )re r. rC rO rP rI r r r/ r0 r r2 r3 r r4 rD rE rF rG r\ r1 r r r r rX r )
r rX r r r r rt r7 r rw s
r( _safe_temporary_treer F s
E 55D
VBZZLE." ( "#(8(8H(D(D#T " HUYY[[ ! ! ! " " " " "S iikkG$
" Jw / / !, !,D +0@0@H0L0L +B !!! " HUYY[[ ! ! ! " " " " "I, !wtGU S S S" , , , +|: !!! " HUYY[[ ! ! ! " " " " "E,|DL11 , ;(22dl4<6P6PSX6X2#04 !!! " HUYY[[ ! ! ! " " " " ";0$&G $bkBN&BR]&R'.%0 %0 %0EE ' 0 0 0#/<( !!! " HUYY[[ ! ! ! " " " " "30 U++++ dl33 , ;(22#0 !!! " HUYY[[ ! ! ! " " " " "! =1,,#, !!! " HUYY[[ ! ! ! " " " " " "&dk : ,, HHUOOO !T\ 1E dl33 , ;(22#0 !!! " HUYY[[ ! ! ! " " " " " 3 ,!!! " HUYY[[ ! ! ! " " " " "O!,F !!!!!!!!Q ( "R " HUYY[[ ! ! ! " " " " " " HUYY[[ ! ! ! "e " HUYY[[ ! ! ! " " " " " s Q% 2Q% 1Q 8Q% ;DQ
E" Q Q% !E""A
Q ,Q% /;H+*Q +
I:5Q 7Q% 9I::AQ >Q% Q Q% A Q +Q% -Q 0Q% 3Q% Q Q% $S
%
R /S
R S
,S9c t j dt j t j z t j z | }n=# t
$ r0}|j t j k r|dxx dz
cc< Y d}~dS d}~ww xY w t |d n5# t $ r( |dxx dz
cc< Y t j
| dS w xY w t t j | }n5# t
$ r( |dxx dz
cc< Y t j
| dS w xY w|D ]}|t j |k r nt | s|dxx dz
cc< J t j |t j t j z t j z | }n # t
$ r |dxx dz
cc< Y w xY w t |d n4# t $ r' |dxx dz
cc< Y t j
| w xY wt# || \ }} |d
k r'||xx dz
cc< t j
| /t% |d | t j || |d
xx dz
cc< |dxx | z
cc< n'# t
t f$ r |dxx dz
cc< Y nw xY wt j
| # t j
| w xY wt j
| n# t j
| w xY w t j d| dS # t
$ r Y dS w xY w)z?Remove only inactive Bun 1.4 race/crash residue below ``.tmp``.r rO r~ r Nr r zBun temporary entryrX r T)r rX removedbytes)r. rD rE rF rG r0 r- r7 r r rI sortedr rO rP _BUN_TEMPORARY_ENTRYrs r r r )
rL summaryrX temporary_fdr r rt entry_fdstate reclaimeds
r( _prune_bun_temporary_entriesr sX w BK".02=@ 9 $ $ I ! # - %l4M N N N N J 1 $ P U 2:l3344EE I ! # F K # #D#(8(8H(D(D'--d33
"""a'"""
7"+6 F' ) ) )
"""a'"""
# -h8MNNNN# J'''1,''' """"! $8 x$1 $1 $1 yK''ENNNa'NNN """" Xd&.0 0 0 0l3333 """a'""" I- \*
(
(
( """a'"""""
( """"""""
((((((
s ;>
A8%A33A8=B
L C (L ?C L !C& %L &D L DAL (;F$#L $G>L GL GJH1J2L H-J6L AJK!J96K8J99K<L K((L LL2 2
M ?M c L t j |t j t j z t j z | }n# t
$ r Y dS w xY w t
|d t j || |k r t j | dS t j || n%# t
$ r Y t j | dS w xY w t j | n# t j | w xY w t j
|| dS # t
$ r Y dS w xY w)zCDrop only Bun's exact lookup symlink; unknown lookup data survives.rO NBun lookup directory) r. rD rE rF rG r0 r readlinkrI r0 r ) parent_fdpackagerx canonicalexpected_target lookup_fds r( _remove_lookupr sf GG K". 82= H#,. . . !)-CDDD
;wy 1 1 1_ D D
'),,,,,
-
++++++
sQ ;>
A A *B( B( 'C# (
C
2C# C
C# #C9=D
D#"D#c t j t t j t j z t j z | }n# t $ r}|sY d }~d S |j t j k rt d|z t j
t t | t j t t j t j z t j z | }n$# t $ r}t d|z d }~ww xY wY d }~nd }~ww xY w t |d n## t $ r t j | w xY w|S )NrO z cannot open prune quarantine: %sz"cannot create prune quarantine: %szprune quarantine)r. rD r rE rF rG r0 r- r7 r r r
r r rI )rL r r r r s r( _open_prune_trashr sv R
W*[2>1BMA #% % % R R R 44444 9 $ $ AC GHH H R H*L I I I I.r~5
E ') ) )BB R R R Cj PQQ Q R
BBBB R!"&89999
IsO A A
D
D'D=A!C D
D )C;;D DD
D" " Ec T t | }|dS t j | }n$# t $ r}t d|z d}~ww xY w|D ]}t
| s|dxx dz
cc< -d} t j |t j t j z t j
z | }t |d t | t j
|| n'# t t f$ r |dxx dz
cc< Y nw xY w|t j | # |t j | w w xY w t j | n# t j | w xY w t j
t | dS # t $ r Y dS w xY w)z>Finish deletions whose canonical name was already quarantined.Nz cannot list prune quarantine: %sr~ r rO zquarantined cache entry)r r. r r0 r _PRUNE_TRASH_ENTRYrs rD rE rF rG r r r rI r )rL r trash_fdr r rt r s r( _clean_prune_trashr s ))H IJx((EE I I I AC GHH H I ' 'D%++D11
"""a'"""H
' 74#%; #?"-#O*2 4 4 4 *(4MNNN X&&&h/////\*
(
(
( """a'"""""
( 'HX&&& 'HX&&&& ( '$
&w777777
sn + E"
A AA 4E" A0C21D02!DD0DD0E" 0E E" "E8<F
F'&F'c ( |\ }}}}}|)t j |k r|dxx dz
cc< dS t j |t j t j z t j z | } n# t $ r d} Y nw xY w| v t | d n5# t $ r( |dxx dz
cc< Y t j
| dS w xY w t j
| n# t j
| w xY w t j |t j t j z t j z | }
n!# t $ r |dxx dz
cc< Y dS w xY w t |
d n5# t $ r( |dxx dz
cc< Y t j
|
dS w xY wt |
| \ } } | d k r'|| xx dz
cc< t j
|
dS t | d
}
d t j
d
z } t j ||||
t! ||||| t# |
| t j ||
t j
|
n# t j
|
w xY w|dxx dz
cc< |dxx | z
cc< n'# t t f$ r |dxx dz
cc< Y nw xY wt j
|
dS # t j
|
w xY w)zCClassify and remove one canonical entry while population is paused.Nr~ r rO r zBun canonical entryr r r Tr zentry-%sr# r% r& r r )rO rP r. rD rE rF rG r0 r r rI r r r( r) renamer r r )rL r5 r rX r r r rx r r r r r r
trash_names r( _prune_canonical_entryr s >G;Iy'7O 0 0H < < a GG K". 82= H#,. . . %i1G H H H H I ! # HY
I
HY BHY 79 ; 7"-G"+- - - a %h0E F F F F J 1 $ . 3 ,HxHHHy K ENNNa NNN & % %WT::: "*R.."4"4"6"66
Ii!*x
A
A
A
A
9gw *
,
,
, H 5 5 5 5 HZ 1 1 1 1 HX BHX a I% \ " a s ;A1 1 B ?B B C" C 1C" C C" "C8<;D8 8EEE, +J> ,F J> F -J> ":J> AJ /J> J#J> =K; >!K" K; !K""K; ;Lc H dddddd}|
t d }t j | }t d|| 5 t | || 5 t
| \ }}g }t } t j t j
| j t k rt d t t j | } n$# t $ r}
t d|
z d}
~
ww xY wt# || t% | || 5 t' ||t) j t, z ddd n # 1 swxY w Y t# || g } | D ]c} t j | |d
}
n# t $ r Y (w xY wt j |
j rZt1 | rKt3 | \ }}| || ||t j | | f t j |
j r| d rd | vr| d
syd} t j | t j t j z t j z | }tC |d t t j | }n># t t f$ r* |t j" | |dxx dz
cc< Y w xY w| | |D ]} t j ||d
}n# t $ r Y 'w xY wt j |j rot1 | r`t3 | \ }}| ||||t j | | | f |# | ed}|tI | k rtK |tL z tI | }t% | || 5 t) j t, z }||k r++x77 !
!9,, " " " " " " " " " " " " " " " #7G444C
OO++J ;<<<# 3z??*** '.'; ; ;
- E w77777"
E.w77D%((((
E
E
E D'E
###
E
%
#
#"""" HW Og g g g g g g g g g g g g g g J &
#
#"""" HW Og g g g g g g g g g g g g g g g g g g g g g g g g g s X #W? AW
!C&%W
&
D0DD%W
,,E$ W
$E( (W
+E( ,W
F W
F, )W
+F, ,CW
0A,K W
7L W
L W
5M
W
M W
M CW
4A R W
R" "W
%R" &A$W
UT'&U'
T4 1U3T4 4U8 W
U W
U W
U0/W
0V W
VW
-W?4 X
/W<<W??X XX XX Xc
dx}x}x}x}}t }t }d}g } d}
t j t z } | t j | ddddd | rt j | k rd}n| d } | d ] t j | d | d< n># t $ r1 t j | d |
Y w xY w| d t | d k r/t j | d |
| d | d }
| dxx d z
cc< |
d z
}
|
t k rd
}n t j
|
| d d }n# t $ r Y =w xY w| d
}t j |j r| d d z }|t k rt# d |}|m| d dk rt% |
sD| d d k rF| dd d r t% |
r|j |j f}|A|j t0 k s t j |j dz r| | d} t j |
t
j t
j z t
j z | d }t j | }t j |j r |j |j k s|j |j k rt j | d}n'# t $ r |t j | Y w xY w| |dd|||
d nt j |j r|$tC | s| | |j |j f}||vr[| | ||j" z
}|j# dz }||z
}|j$ d k r"|d z
}||j$ d z
z
}|||j$ d z
z z
}n|| | | | D ]-} t j | d # t $ r Y *w xY wn5# | D ]-} t j | d # t $ r Y *w xY ww xY w|||||t | |r||z tK | z nd|du|d S )a Unique logical and allocated bytes below a pinned storage root fd.
Hardlinks are the whole point of the store, so a file linked N times must
count once: dedup by (dev, ino). Odd nodes do not contribute bytes; inside
a canonical entry they mark that entry poisoned. This is accounting
telemetry, never a delivery decision.
Which is why its own entry/time bounds do not refuse. Raising on a real
server-wide cache stopped the snapshot advancing at all: every delivery
and prune logged the same failure, `status` froze on an old number, and a
missing record made `over_soft_storage_limit` refuse every delivery with
a "run prune" that could not help. A bound returns what it counted so
far, marked `stale` with the bound it hit -- a floor, not a size.r N)r r r
depthr z!maximum measurement time exceededr r r r
r z(maximum measurement entry count exceededFr r r zmaximum tree depth exceeded
child_namer{ rn r, rO )r r r
r r r i g ?)
used_bytesallocated_bytes
shared_inodes shared_linksestimated_saved_bytespoisoned_entriesdeduplication_ratiostale stale_reason)&re rO rP MEASURE_MAX_SECONDSr\ r. rC r r0 rI r r] MEASURE_MAX_ENTRIESr/ r r2 MAX_TREE_WALK_DEPTHr ry rh r r r r3 r r4 r rD rE rF rG rW r1 r rX st_blocksr rk )rL used allocatedr r savedr r r r entriesrX r rt r7 r r child_canonicalr openedr= blockss r( r r s ?@?D?9?}?|e 55DuuL FG~ "55HT
RVG__ta !6 6 7 7 7 K 0~ (** B 2JEW~% %'Zd %<%%.1D 'NNNa NNN qLG,,, I
wtE$KOOO
k*I|DL)) 0
0 g*...&'DEEE"+ $ w 1,,1CD1I1I, !'Na / / % , ; ; F Fs K K 0 24 8 8 0 (,{DK&@O#/ ![H 4 4 $ T\ : :U B 5$(( 999 !w bkBN :R] J $T{ , , ,H Xh / /F L 8 8 ! %} ; ; %} ; ;***#' < +*** H
Xq(-O-1 3 3 4 4 4 4 dl++
0 (1Ft1L1L($((333{DK0d??HHSMMMDL(D !^c 1F 'I}q((%*
$
(99 4=1+;R =C>>B R F& %R &
F40R 3F44D R 5B$M R N <R ?N C'R ,R
RRS
R98S
9
S S
S S
c , t | d S )z7Compatibility helper for the existing logical-size API.r )r )rL s r( _measure_tree_fdr @ s !' * *< 88r' c , t | d S )z;Walk one storage directory and return its unique byte size.r )measure_storage_usager s r( measure_storager E s & &| 44r' c t | \ }} t | t j | S # t j | w xY w)z > > >t 3 E ;9:::G
#
# ( 66 H |BHRLL 011\AA"#VWWW # # #Xb\\(F HRLLLLBHRLLLL NN6 " " "&s++w6O #5 u )!( GG d### c>4FH H H H 4s
A+E E!c L t j | t S r )r. r6 r^ r r s r( _usage_pathr s
7<< 0 1 11r' c t j t | t j t j z }n# t
$ r Y dS w xY w t j | }t j |j r |j
dk r t j | dS t j |d }t j | n# t j | w xY w t j | d }n# t t" f$ r Y dS w xY wt% |t& r5t) | d t, us |d dk rdS |d | d | d du | d d
}d D ]}| | ||< |S ) a The last recorded size of a storage directory, or None if never
measured / unreadable. The file is 0644, but it sits inside the 0700
store, so only root can read it. Non-root status reports unknown rather
than activating the privileged daemon for server-wide statistics.Nr rQ r r measured_atr Tr )r r r r )r r r r r r )r. rD r rE rG r0 rW r/ r1 r2 rX rI rZ r_ r` ra rb r: rA rd rg rh rB )r6 r r7 rr r> r< rt s r(
read_usager s
W[&& bm(C
D
D ttx|||DL)) T\D-@-@ wr4
4;;w//00 * % tt ud # # EIIl++,,C77\"Q&&t !, / "YY} 5 5 yy))T1 #ii 7 7 9 9F % ' ' yyt Ms3 9<
A
A
8C C C !'D D D c h ddl m} | }d|v s d|vst |d t sdS t }d}|d D ] }t |t s dS | d }|3t |t s dS | D ]\ }}t |t s dS | d }t |t s dS | D ]\} t | t rE| d i d
d u r| | |d z
}] t | |fS # t $ r Y dS w xY w)
zBReturn aggregate active user/application counts, never identities.r )ApplicationsManagerwarningavailable_versionsNNusersN applicationsshared_node_modulesactiveTr ) $clselect.clselectnodejs.apps_managerr get_applications_users_inforA rd re valuesrh r r r] r )
r r7 active_usersactive_applicationsrx r r user_infor applications
r( "_active_shared_node_modules_countsr s !LLLLLL""$$@@BB !5T!A!A!$';"0F# 0,F# BF# #
F10F1c x fd| D }|rt d |D sdS t | S )z6Sum one non-negative integer field, or return unknown.c h g | ].}t |t r| nd /S r rA rd rh )r~ recordrt s r( r z'_sum_recorded_usage.. sI % % % #-VT":":Dfjj % % %r' c 3 N K | ] }t | t u o|d k V !dS r Nrg rB r~ r> s r( r z&_sum_recorded_usage.. sJ 2 2!& "%[[C / >EQJ 2 2 2 2 2 2r' N)allsum)recordsrt r
s ` r( _sum_recorded_usager sq % % % % #% % %F 2 2*0 2 2 2 2 2 t v;;r' c r t d | D rdS t d | D rdS dS )a Whether any contributing measurement stopped at one of its own bounds.
A measurement that hit MEASURE_MAX_ENTRIES / MEASURE_MAX_SECONDS records a
floor, so every aggregate built from it is a floor too. One known floor is
a more useful answer than "cannot tell" and outranks an unreadable record;
with no floor but a record missing, completeness is simply unknown.
c 3 n K | ]0}t |t o| d du V 1dS )r TNr r~ r s r( r z%_measurement_stale.. sV " " fd # # C
7(;(;t(C " " " " " "r' Tc 3 B K | ]}t |t V d S r )rA rd r! s r( r z%_measurement_stale.. s/
>
>Fz&$'' '
>
>
>
>
>
>r' NF)r )r s r( _measurement_staler# s` " " " " " " " t
>
>g
>
>
>>> t 5r' c t | }t |t r2t | dk r t d |D r|\ }}n|t \ }}nd\ }}d |d D }t
| }t |d }|du r|sd}|d ||t |d
t |d ||d S )
a Return privacy-safe aggregates for ``cloudlinux-summary``.
Storage sizes come only from existing accounting snapshots. This function
deliberately never walks the shared storage tree; delivery and prune own
those comparatively expensive measurements.
rS c 3 N K | ] }t | t u o|d k V !dS r r r s r( r z2get_shared_node_modules_summary.. sJ 0 0 KK3&55A: 0 0 0 0 0 0r' Nr c , g | ]}t | S r& )r )r~ r s r( r z3get_shared_node_modules_summary..$ s0 < < < ,'' < < ??H }}X})$ 2$#6 &$( $(!4 ,". ".#+ "
r' c t | \ }}dt j d z }t |t
rt | }ndt
| i}t
|d |d< t | d |d< | d pd|d< t j |d< t j | dz d }d}d
} t j
|t j t j z t j z t j z d | }d
}t j |d t j |dd d} | t) | k r3| t j ||| d z
} | t) | k 3t j | t j | d}t j |t2 || d
}n$# t4 $ r}
t7 d|
z d}
~
ww xY w |t j | |r( t j || n# t4 $ r Y nw xY wt j | dS # |t j | |r( t j || n# t4 $ r Y nw xY wt j | w xY w)z^Record a storage directory's size beside it, atomically and
root-owned but world-readable.z.cl-storage-usage-%s r r r Nr
rQ Fr rO Tr r z cannot record storage usage: %s) r r. r( r) rA rd rB r5 rh rO r_ dumpsencoderD r* r+ r, rG r fchownr] writefsyncrI replacer r0 r r0 ) r6 r rL r temporaryr bodyr r writtenr s r( r r : s *$//GX&A ):):)<)< IKKF= Jv % - -g 6 6D
BG
WY bj 829 Dr} T7, , ,
"e
"aD !! rxDN33 3G D !!
9 0 %' ; ; ; ; D D D HRLLL
)G44444
> HRLLL
)G44444
sa DH J
H7 H22H77J I+ +
I87I8K'+KK'
K K'KK'c P t | }t | | |d S )a? Re-measure and record a storage directory's size, every time.
This runs after the account already has its answer. The soft threshold is
deliberately a post-fact guardrail rather than a synchronous filesystem
quota: a delivery reads this last complete snapshot and the next deferred
refresh advances it.r )r r )r6 r s r(
refresh_usager; h s,
"$ ' 'Ee r' c n |sdS t | }|t d| z |d |dz k S )a Whether recorded usage has reached the configured soft threshold.
Reads the recorded size, never walks: deferred refresh can lag admissions
(the trees that tip it over still land), which is fine for a guardrail
against a shared filesystem, not a billing quota. A threshold of 0
disables the check entirely. Missing or malformed
accounting fails closed. A snapshot that stopped at a measurement bound
counted part of the store, so its number is a floor rather than a size --
and a floor is compared before it is doubted. Over the threshold it is
conclusive: 300 GB counted is 300 GB there, whatever the rest holds.
Below it, it says nothing about the whole, and an advisory guardrail
must not turn a partial count into a server-wide refusal. Checking
staleness first switched the guardrail off permanently for exactly the
store that outgrew its own accounting, because every later walk stops at
the same bound. Administrator operations create a fresh snapshot
before enabling a non-zero threshold, and delivery refreshes it after Bun
has changed the store. This is intentionally not a hard quota: a delivery
that crosses the threshold and already-admitted concurrent deliveries may
exceed it.FNzfshared storage usage snapshot is unavailable for %s; run cl-node-modules-storage prune before retryingr i @)r r )r6 r r s r( over_soft_storage_limitr= t s^ ( ! u t E }
<>B
CD D D "77"C CCr' c " ddl m} | S )zThe panel's hosting accounts. Imported here rather than at module
scope because `read_config` runs as the account inside a cage on every
`npm install`: importing cpapi costs a panel probe (0.17 s measured)
that has no business happening there.r cpusers)r r@ r? s r( _cpusersrA s"
'&&&&& 799r' c t }| D ]?} | t j | j 0# t
$ r Y <== = H FGG G ) 0 0L !, / / / / #M 2 2O !3M!B!B %%% g IO%T1 ( )$ 4 4 I GHH H 00 $'''
f H
%$();$<$< ! c?5EG G G G G Gs .:B) )
C
3CC
c t j | dd dz d }t | t k rt dt z |S )NT),:) sort_keys
separatorsr0 rQ z'configuration exceeds the %d byte limit)r_ r1 r2 r] r r )r encodeds r( _encoded_configr\
sc z#*EEE vg
7||&&& 58H HJ J J Nr' c t | }|rEdt | i}t | }t t | |t | t | || dS )z@Publish a requested private authority, then the public snapshot.r )r r[ )r[ N)r\ r
_atomic_writer r )r6 r r r public_encodedprivateprivate_encodeds r( r r s %S))N E#T.%9%9:)'22od++W*O E E E E$^444444r' c V t j | }|t | }d }d } t j |dd \ }}t j || t j |dd d}|t | k r3|t j |||d z
}|t | k 3t j
| t j | d }t j || t j
|t j t j z t j z } t j
| t j | n# t j | w xY wd }n$# t" $ r} t% d| z d } ~ ww xY w |t j | |( t j | d S # t" $ r Y d S w xY wd S # |t j | |& t j | w # t" $ r Y w w xY ww xY w)Nz.node-modules-storage-F)dirprefixtextr z cannot write configuration: %s)r. r6 r r\ tempfilemkstempr r3 r] r4 r5 rI r6 rD rE rF rG r0 r r0 )
r6 r r r[ r8 r r7 r9 r r s
r( r^ r^ sN %%I!#&&
BI (Y?W^cddd
I
"d
"aG $$ rxGGHH$566 6G G $$
9d###wy"+*F *VWW # H\ " " " H\ " " " "BH\ " " " " C C C;cABBBC > HRLLL
)$$$$$
! > HRLLL
)$$$$
!sx DF <E% F %E;;F G(
F" F F""G( ?G
G#"G#(H(HH(
H$!H(#H$$H(r )F)NFNr )FN)}r% r- rL r_ ri r. rC rer/ rf rO BUN_BINENGINE_UNAVAILABLE CONFIG_PATHr r r PROTECTED_HARDLINKS_PATH CONFIG_MODEr r
frozensetr6 r^ r r re r\ CONFIG_LOCK_PATHcompiler r rr r r r r r r r r r r r r r r rU rY rf r r r* r8 r? rM rH rm r r r r r r r r r r r r r r r r r r r r r r r r r r! r r; objectr= r` rb rg rj ry r{ r r r r r r r r r r r r r r r r r r r r r# r- r r; r= rA rL rU r\ r r^ r& r' r( rr s
= : % 9 = 9&&'67GV
BGLL ' ' zS]GLL&& ( ) ) 8 GLL 8 8 7<<
>> !rz46 6 RZ 788
;''
& 1 # $&"% &) $/". &&0 ) 44
. ; '+ $#,9 .9 $: $:
? ? ? ? ?9 ? ? ?K K K K K, K K K " : : : : 47 7 7t @ " # # #B
P P P$ 0 &> # # # #6 6 6 6@ @ @ % $ $ $ $
( 2 2 2" . &4 4 4: ! D D D D ( 8 8 8 8 3 3 3B B B(. . .
C
C
CU U U$ $ $ $N 05 5 5p D, , ,^K K K K K 6 K K K \ "+D : : : : &t 5 5 5 5
BG"&B B B B( ) ) ) )
T
T
TX X X5C 5C 5C 5CpJ J J JZ: : : : z;
;
;
;
|
. 2
F9 9 9 9x #,T q q q q lw w wt9 9 9
5 5 5
& $/ 3 3 3 3l2 2 2" " "J# # #L
*5D $ $ $ $N+ + +\ D D DB /$ /$ /$d #D!%dt7G 7G 7G 7Gt 38 5 5 5 5 #.t r'