feat(biometrics): add prospective shadow runtime, coordinator host and calibration API

app/api/raw/[filename]/route.ts

@@ -20,26 +20,26 @@ export async function GET(
   }
 
   const resolved = path.resolve(RAW_DIR, filename)
-  if (!resolved.startsWith(path.resolve(RAW_DIR))) {
+  if (!resolved.startsWith(path.resolve(/* turbopackIgnore: true */ RAW_DIR))) {
     return NextResponse.json({ error: 'Path traversal detected' }, { status: 400 })
   }
 
   try {
     // Reject symlinks to prevent escaping RAW_DIR
-    const lstats = await lstat(resolved)
+    const lstats = await lstat(/* turbopackIgnore: true */ resolved)
     if (lstats.isSymbolicLink()) {
       return NextResponse.json({ error: 'Path traversal detected' }, { status: 400 })
     }
 
     // Verify canonical path is still inside RAW_DIR
-    const canonicalFile = await realpath(resolved)
-    const canonicalDir = await realpath(RAW_DIR)
+    const canonicalFile = await realpath(/* turbopackIgnore: true */ resolved)
+    const canonicalDir = await realpath(/* turbopackIgnore: true */ RAW_DIR)
     if (!canonicalFile.startsWith(canonicalDir)) {
       return NextResponse.json({ error: 'Path traversal detected' }, { status: 400 })
     }
 
-    const s = await stat(resolved)
-    const stream = createReadStream(resolved)
+    const s = await stat(/* turbopackIgnore: true */ resolved)
+    const stream = createReadStream(/* turbopackIgnore: true */ resolved)
     const webStream = Readable.toWeb(stream) as ReadableStream
 
     return new Response(webStream, {

app/api/raw/[filename]/tests/route.test.ts

@@ -0,0 +1,43 @@
+// @vitest-environment node
+import { Readable } from 'node:stream'
+import { beforeEach, expect, it, vi } from 'vitest'
+import { GET } from '../route'
+const fs = vi.hoisted(() => ({ lstat: vi.fn(), realpath: vi.fn(), stat: vi.fn(), createReadStream: vi.fn() }))
+vi.mock('node:fs/promises', () => ({ lstat: fs.lstat, realpath: fs.realpath, stat: fs.stat }))
+vi.mock('node:fs', () => ({ createReadStream: fs.createReadStream }))
+const request = (filename = 'capture.RAW') => GET(new Request('http://localhost/api/raw/' + filename), { params: Promise.resolve({ filename }) })
+beforeEach(() => {
+  vi.resetAllMocks()
+  fs.lstat.mockResolvedValue({ isSymbolicLink: () => false })
+  fs.realpath.mockImplementation(async (path: string) => path)
+  fs.stat.mockResolvedValue({ size: 3 })
+  fs.createReadStream.mockImplementation(() => Readable.from([Buffer.from([1, 2, 3])]))
+})
+it('streams the original bytes with explicit download metadata', async () => {
+  const response = await request()
+  expect(response.status).toBe(200)
+  expect(response.headers.get('Content-Type')).toBe('application/octet-stream')
+  expect(response.headers.get('Content-Disposition')).toBe('attachment; filename="capture.RAW"')
+  expect(response.headers.get('Content-Length')).toBe('3')
+  expect(new Uint8Array(await response.arrayBuffer())).toEqual(new Uint8Array([1, 2, 3]))
+})
+it.each(['../private.RAW', 'nested/capture.RAW', 'capture.txt', 'capture.RAW\n'])('rejects invalid filename %s before filesystem access', async (filename) => {
+  expect((await request(filename)).status).toBe(400)
+  expect(fs.lstat).not.toHaveBeenCalled()
+  expect(fs.createReadStream).not.toHaveBeenCalled()
+})
+it('refuses symbolic links and canonical paths outside the configured directory', async () => {
+  fs.lstat.mockResolvedValueOnce({ isSymbolicLink: () => true })
+  expect((await request()).status).toBe(400)
+  expect(fs.realpath).not.toHaveBeenCalled()
+  fs.realpath.mockResolvedValueOnce('/outside/capture.RAW').mockResolvedValueOnce('/owned')
+  expect((await request()).status).toBe(400)
+  expect(fs.createReadStream).not.toHaveBeenCalled()
+})
+it.each([['ENOENT', 404, 'File not found'], ['EACCES', 500, 'Failed to read file']] as const)('sanitizes %s filesystem failures', async (code, status, error) => {
+  fs.lstat.mockRejectedValue(Object.assign(new Error('/private/source'), { code }))
+  const response = await request()
+  expect(response.status).toBe(status)
+  expect(await response.json()).toEqual({ error })
+  expect(fs.createReadStream).not.toHaveBeenCalled()
+})