@ai-agent-forge/agent-forge 0.85.0

package/dist/plugins/ecosystem/node-release-package-source.js

@@ -0,0 +1,336 @@
+import { downloadNodeUrlPackageV1 } from "./node-url-package-source.js";
+/**
+ * GitHub/Gitee release plugin package source (design
+ * `插件独立分发与启动装配设计.md` §4.6 "GitHub"/"Gitee" rows). Two-step
+ * protocol: resolve one release through the repo's release API — the exact
+ * tag endpoint when a tag is given, otherwise the first non-draft entry of
+ * the first releases page in API order (no client-side sorting) — then pick
+ * the release's single `.zip`/`.tgz` asset and download it with the same
+ * bounded http(s) semantics as custom URL packages (redirect-per-hop, budget,
+ * timeout, optional strong sha256). Zero or multiple matching assets are
+ * explicit structured errors listing the asset names; nothing is guessed.
+ * Authentication is optional: GitHub uses an `Authorization: Bearer` header,
+ * Gitee an `access_token` query parameter. Anonymous rate limits (403/429
+ * with `X-RateLimit-Remaining: 0`, or any 429) surface as `rate_limited`
+ * carrying the advertised `X-RateLimit-Reset` epoch; there is no retry.
+ */
+const DEFAULT_GITHUB_API_ORIGIN_V1 = "https://api.github.com";
+const DEFAULT_GITEE_API_ORIGIN_V1 = "https://gitee.com/api/v5";
+const DEFAULT_TIMEOUT_MS_V1 = 15_000;
+const MAX_TIMEOUT_MS_V1 = 120_000;
+const DEFAULT_MAX_RESPONSE_BYTES_V1 = 8 * 1024 * 1024;
+const MAX_RESPONSE_BYTES_V1 = 16 * 1024 * 1024;
+const DEFAULT_MAX_ASSET_BYTES_V1 = 128 * 1024 * 1024;
+const MAX_ASSET_BYTES_V1 = 512 * 1024 * 1024;
+const DEFAULT_REDIRECTS_V1 = 3;
+const MAX_REDIRECTS_V1 = 5;
+const REDIRECT_STATUS = new Set([301, 302, 303, 307, 308]);
+export class NodeReleasePackageSourceErrorV1 extends Error {
+    code;
+    /** Unix epoch seconds advertised by `X-RateLimit-Reset`; present only for `rate_limited`. */
+    resetEpochSeconds;
+    constructor(code, message, options) {
+        super(message);
+        this.name = "NodeReleasePackageSourceErrorV1";
+        this.code = code;
+        if (options?.resetEpochSeconds !== undefined)
+            this.resetEpochSeconds = options.resetEpochSeconds;
+    }
+}
+function boundedPositive(value, fallback, maximum, label) {
+    const result = value ?? fallback;
+    if (!Number.isSafeInteger(result) || result <= 0 || result > maximum)
+        throw new NodeReleasePackageSourceErrorV1("invalid_configuration", `${label} must be a positive integer at most ${maximum}`);
+    return result;
+}
+function boundedToken(value, label) {
+    if (value === undefined)
+        return undefined;
+    if (value.length === 0 || value.length > 4096 || /[\r\n\s]/u.test(value))
+        throw new NodeReleasePackageSourceErrorV1("invalid_configuration", `${label} is invalid`);
+    return value;
+}
+function apiOrigin(value, label) {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        throw new NodeReleasePackageSourceErrorV1("invalid_configuration", `${label} is invalid`);
+    }
+    if ((parsed.protocol !== "http:" && parsed.protocol !== "https:") ||
+        parsed.username !== "" ||
+        parsed.password !== "")
+        throw new NodeReleasePackageSourceErrorV1("invalid_configuration", `${label} must be http(s) without credentials`);
+    if (parsed.search !== "" || parsed.hash !== "")
+        throw new NodeReleasePackageSourceErrorV1("invalid_configuration", `${label} must not include a query or fragment`);
+    // The Gitee default origin carries the `/api/v5` path prefix. The prefix is
+    // kept as a plain string because a URL normalizes an empty pathname back
+    // to "/", which would reintroduce a double slash when joining endpoints.
+    const trimmed = parsed.pathname.replace(/\/+$/u, "");
+    return { origin: parsed.origin, pathPrefix: trimmed === "" || trimmed === "/" ? "" : trimmed.replace(/^\//u, "") };
+}
+function jsonBytes(value) {
+    try {
+        return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(value));
+    }
+    catch {
+        throw new NodeReleasePackageSourceErrorV1("invalid_response", "release API response is not valid JSON");
+    }
+}
+function parseReleaseList(bytes) {
+    const value = jsonBytes(bytes);
+    if (!Array.isArray(value))
+        throw new NodeReleasePackageSourceErrorV1("invalid_response", "release API response is not a release list");
+    return value;
+}
+function parseReleaseObject(bytes) {
+    const value = jsonBytes(bytes);
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        throw new NodeReleasePackageSourceErrorV1("invalid_response", "release API response is not a release object");
+    return value;
+}
+/** First non-draft entry in API order; the array itself is the ordering contract. */
+function firstPublishedRelease(releases) {
+    const published = releases.find((release) => release.draft !== true);
+    if (published === undefined)
+        throw new NodeReleasePackageSourceErrorV1("release_not_found", "repo has no published release");
+    return published;
+}
+/** Assets with a usable name; entries without a string name are ignored as API noise. */
+function namedAssets(release) {
+    if (release.assets === undefined)
+        return [];
+    if (!Array.isArray(release.assets))
+        throw new NodeReleasePackageSourceErrorV1("invalid_response", "release assets are invalid");
+    const entries = [];
+    for (const asset of release.assets) {
+        if (typeof asset !== "object" || asset === null)
+            continue;
+        const shape = asset;
+        if (typeof shape.name !== "string" || shape.name.length === 0)
+            continue;
+        entries.push({ name: shape.name, url: shape.browser_download_url });
+    }
+    return entries;
+}
+function isPackageAssetName(name) {
+    const value = name.toLowerCase();
+    return value.endsWith(".zip") || value.endsWith(".tgz");
+}
+/** Select the release's single `.zip`/`.tgz` asset and return its download URL. */
+function selectPackageAssetUrl(release) {
+    const assets = namedAssets(release);
+    const candidates = assets.filter((asset) => isPackageAssetName(asset.name));
+    const assetNames = assets.map((asset) => asset.name).join(", ");
+    if (candidates.length === 0)
+        throw new NodeReleasePackageSourceErrorV1("release_asset_not_found", assetNames.length === 0 ? "release has no assets" : `assets: ${assetNames}`);
+    if (candidates.length > 1)
+        throw new NodeReleasePackageSourceErrorV1("release_asset_ambiguous", `candidates: ${candidates.map((asset) => asset.name).join(", ")}`);
+    const chosen = candidates[0];
+    if (typeof chosen.url !== "string" || chosen.url.length === 0)
+        throw new NodeReleasePackageSourceErrorV1("invalid_response", "release asset has no download URL");
+    return chosen.url;
+}
+function isAbortLike(error) {
+    return error instanceof Error && (error.name === "AbortError" || error.name === "AbortSignalError");
+}
+function requestSignal(parent, timeoutMs) {
+    const controller = new AbortController();
+    let timedOut = false;
+    const abort = () => controller.abort(parent?.reason);
+    if (parent?.aborted === true)
+        abort();
+    else
+        parent?.addEventListener("abort", abort, { once: true });
+    const timeout = setTimeout(() => {
+        timedOut = true;
+        controller.abort();
+    }, timeoutMs);
+    return {
+        signal: controller.signal,
+        timedOut: () => timedOut,
+        cleanup: () => {
+            clearTimeout(timeout);
+            parent?.removeEventListener("abort", abort);
+        },
+    };
+}
+function isJsonResponse(response) {
+    const contentType = response.headers.get("content-type");
+    if (contentType === null)
+        return false;
+    const mediaType = contentType.split(";", 1)[0]?.trim().toLowerCase();
+    return mediaType === "application/json" || mediaType === "application/vnd.github+json";
+}
+/**
+ * Rate-limit verdict for 403/429 responses: any 429, and a 403 whose
+ * `X-RateLimit-Remaining` is exactly `0`. The reset epoch is passed through
+ * verbatim when present and integer-like; absent headers stay absent.
+ */
+function rateLimitState(response) {
+    const limited = response.status === 429 || (response.status === 403 && response.headers.get("x-ratelimit-remaining") === "0");
+    if (!limited)
+        return { limited: false };
+    const reset = response.headers.get("x-ratelimit-reset");
+    const resetValue = reset === null ? Number.NaN : Number.parseInt(reset, 10);
+    if (!Number.isSafeInteger(resetValue) || resetValue < 0)
+        return { limited: true };
+    return { limited: true, resetEpochSeconds: resetValue };
+}
+async function readBody(response, maxBytes, signal) {
+    if (response.body === null)
+        throw new NodeReleasePackageSourceErrorV1("invalid_response", "release API response has no body");
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            if (signal.aborted)
+                throw new DOMException("aborted", "AbortError");
+            const item = await reader.read();
+            if (item.done)
+                break;
+            total += item.value.byteLength;
+            if (total > maxBytes)
+                throw new NodeReleasePackageSourceErrorV1("response_too_large", "release API response exceeds the configured size limit");
+            chunks.push(item.value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const bytes = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return bytes;
+}
+/** Create the bounded GitHub/Gitee release reader. */
+export function createNodeReleasePackageSourceV1(options = {}) {
+    const transport = options.fetch ?? globalThis.fetch;
+    if (typeof transport !== "function")
+        throw new NodeReleasePackageSourceErrorV1("invalid_configuration", "Node fetch is unavailable");
+    const githubOrigin = apiOrigin(options.githubApiOrigin ?? DEFAULT_GITHUB_API_ORIGIN_V1, "githubApiOrigin");
+    const giteeOrigin = apiOrigin(options.giteeApiOrigin ?? DEFAULT_GITEE_API_ORIGIN_V1, "giteeApiOrigin");
+    const githubToken = boundedToken(options.githubToken, "githubToken");
+    const giteeToken = boundedToken(options.giteeToken, "giteeToken");
+    const timeoutMs = boundedPositive(options.requestTimeoutMs, DEFAULT_TIMEOUT_MS_V1, MAX_TIMEOUT_MS_V1, "requestTimeoutMs");
+    const maxResponseBytes = boundedPositive(options.maxResponseBytes, DEFAULT_MAX_RESPONSE_BYTES_V1, MAX_RESPONSE_BYTES_V1, "maxResponseBytes");
+    const maxAssetBytes = boundedPositive(options.maxAssetBytes, DEFAULT_MAX_ASSET_BYTES_V1, MAX_ASSET_BYTES_V1, "maxAssetBytes");
+    const maxRedirects = options.maxRedirects ?? DEFAULT_REDIRECTS_V1;
+    if (!Number.isSafeInteger(maxRedirects) || maxRedirects < 0 || maxRedirects > MAX_REDIRECTS_V1)
+        throw new NodeReleasePackageSourceErrorV1("invalid_configuration", `maxRedirects must be an integer between 0 and ${MAX_REDIRECTS_V1}`);
+    const userAgent = options.userAgent ?? "agent-forge-plugin-release/1";
+    if (userAgent.length === 0 || userAgent.length > 256 || /[\r\n]/u.test(userAgent))
+        throw new NodeReleasePackageSourceErrorV1("invalid_configuration", "userAgent is invalid");
+    const fetchReleaseJson = async (url, headers, parentSignal) => {
+        let current = url;
+        for (let redirect = 0;; redirect += 1) {
+            const request = requestSignal(parentSignal, timeoutMs);
+            let response;
+            try {
+                response = await transport(current.toString(), {
+                    method: "GET",
+                    headers: { accept: "application/json", "user-agent": userAgent, ...headers },
+                    redirect: "manual",
+                    signal: request.signal,
+                });
+            }
+            catch (error) {
+                request.cleanup();
+                if (request.timedOut())
+                    throw new NodeReleasePackageSourceErrorV1("request_timed_out", "release API request timed out");
+                if (isAbortLike(error))
+                    throw new NodeReleasePackageSourceErrorV1("cancelled", "release API request was cancelled");
+                throw new NodeReleasePackageSourceErrorV1("request_failed", "release API request failed");
+            }
+            if (!REDIRECT_STATUS.has(response.status)) {
+                try {
+                    if (response.status === 404)
+                        throw new NodeReleasePackageSourceErrorV1("release_not_found", "repo or release was not found");
+                    const limit = rateLimitState(response);
+                    if (limit.limited) {
+                        const message = limit.resetEpochSeconds === undefined
+                            ? "rate limit was exceeded"
+                            : `rate limit resets at ${new Date(limit.resetEpochSeconds * 1000).toISOString()}`;
+                        throw new NodeReleasePackageSourceErrorV1("rate_limited", message, {
+                            ...(limit.resetEpochSeconds === undefined ? {} : { resetEpochSeconds: limit.resetEpochSeconds }),
+                        });
+                    }
+                    if (response.status < 200 || response.status >= 300)
+                        throw new NodeReleasePackageSourceErrorV1("request_failed", "release API request did not succeed");
+                    if (!isJsonResponse(response))
+                        throw new NodeReleasePackageSourceErrorV1("invalid_response", "release API response must be JSON");
+                    const bytes = await readBody(response, maxResponseBytes, request.signal);
+                    return bytes;
+                }
+                finally {
+                    await response.body?.cancel().catch(() => undefined);
+                    request.cleanup();
+                }
+            }
+            const location = response.headers.get("location");
+            await response.body?.cancel().catch(() => undefined);
+            request.cleanup();
+            if (location === null || redirect >= maxRedirects)
+                throw new NodeReleasePackageSourceErrorV1("request_failed", "release API redirect limit exceeded");
+            let next;
+            try {
+                next = new URL(location, current);
+            }
+            catch {
+                throw new NodeReleasePackageSourceErrorV1("invalid_response", "release API redirect target is invalid");
+            }
+            if ((next.protocol !== "http:" && next.protocol !== "https:") || next.username !== "" || next.password !== "")
+                throw new NodeReleasePackageSourceErrorV1("invalid_response", "release API redirect must stay http(s)");
+            current = next;
+        }
+    };
+    const downloadReleaseAsset = async (input) => {
+        if (input.signal?.aborted === true)
+            throw new NodeReleasePackageSourceErrorV1("cancelled", "release asset download was cancelled");
+        const sourceLabel = `${input.kind}:${input.owner}/${input.repo}@${input.tag ?? "latest"}`;
+        const base = input.kind === "github" ? githubOrigin : giteeOrigin;
+        const segments = [
+            base.pathPrefix === "" ? undefined : base.pathPrefix,
+            "repos",
+            encodeURIComponent(input.owner),
+            encodeURIComponent(input.repo),
+            "releases",
+            ...(input.tag === undefined ? [] : ["tags", encodeURIComponent(input.tag)]),
+        ].filter((segment) => segment !== undefined);
+        const endpoint = new URL(`${base.origin}/${segments.join("/")}`);
+        const headers = input.kind === "github"
+            ? {
+                "x-github-api-version": "2022-11-28",
+                ...(githubToken === undefined ? {} : { authorization: `Bearer ${githubToken}` }),
+            }
+            : {};
+        if (input.kind === "gitee" && giteeToken !== undefined)
+            endpoint.searchParams.set("access_token", giteeToken);
+        const payload = await fetchReleaseJson(endpoint, headers, input.signal);
+        const release = input.tag === undefined ? firstPublishedRelease(parseReleaseList(payload)) : parseReleaseObject(payload);
+        const assetUrl = selectPackageAssetUrl(release);
+        const download = await downloadNodeUrlPackageV1({
+            ...(options.fetch === undefined ? {} : { fetch: options.fetch }),
+            requestTimeoutMs: timeoutMs,
+            maxPackageBytes: maxAssetBytes,
+            userAgent,
+        }, {
+            url: assetUrl,
+            ...(input.expectedDigestHex === undefined ? {} : { expectedDigestHex: input.expectedDigestHex }),
+            signal: input.signal,
+        });
+        return {
+            bytes: download.bytes,
+            mediaType: download.mediaType,
+            sha256Hex: download.digestHex,
+            sourceLabel,
+        };
+    };
+    return { version: 1, downloadReleaseAsset };
+}
+//# sourceMappingURL=node-release-package-source.js.map

package/dist/plugins/ecosystem/node-release-package-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-release-package-source.js","sourceRoot":"","sources":["../../../src/plugins/ecosystem/node-release-package-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAExE;;;;;;;;;;;;;;GAcG;AAEH,MAAM,4BAA4B,GAAG,wBAAwB,CAAC;AAC9D,MAAM,2BAA2B,GAAG,0BAA0B,CAAC;AAC/D,MAAM,qBAAqB,GAAG,MAAM,CAAC;AACrC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAClC,MAAM,6BAA6B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACtD,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC/C,MAAM,0BAA0B,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AACrD,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAC7C,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAC3B,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAc3D,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IAChD,IAAI,CAAsC;IACnD,6FAA6F;IACpF,iBAAiB,CAAU;IAEpC,YACC,IAAyC,EACzC,OAAe,EACf,OAAiD,EAChD;QACD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;QAC9C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,OAAO,EAAE,iBAAiB,KAAK,SAAS;YAAE,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAAA,CACjG;CACD;AAkDD,SAAS,eAAe,CAAC,KAAyB,EAAE,QAAgB,EAAE,OAAe,EAAE,KAAa,EAAU;IAC7G,MAAM,MAAM,GAAG,KAAK,IAAI,QAAQ,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,MAAM,GAAG,OAAO;QACnE,MAAM,IAAI,+BAA+B,CACxC,uBAAuB,EACvB,GAAG,KAAK,uCAAuC,OAAO,EAAE,CACxD,CAAC;IACH,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,YAAY,CAAC,KAAyB,EAAE,KAAa,EAAsB;IACnF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;QACvE,MAAM,IAAI,+BAA+B,CAAC,uBAAuB,EAAE,GAAG,KAAK,aAAa,CAAC,CAAC;IAC3F,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,KAAa,EAA4D;IAC1G,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,+BAA+B,CAAC,uBAAuB,EAAE,GAAG,KAAK,aAAa,CAAC,CAAC;IAC3F,CAAC;IACD,IACC,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAC7D,MAAM,CAAC,QAAQ,KAAK,EAAE;QACtB,MAAM,CAAC,QAAQ,KAAK,EAAE;QAEtB,MAAM,IAAI,+BAA+B,CACxC,uBAAuB,EACvB,GAAG,KAAK,sCAAsC,CAC9C,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE;QAC7C,MAAM,IAAI,+BAA+B,CACxC,uBAAuB,EACvB,GAAG,KAAK,uCAAuC,CAC/C,CAAC;IACH,4EAA4E;IAC5E,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AAAA,CACnH;AAED,SAAS,SAAS,CAAC,KAAiB,EAAW;IAC9C,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,+BAA+B,CAAC,kBAAkB,EAAE,wCAAwC,CAAC,CAAC;IACzG,CAAC;AAAA,CACD;AAED,SAAS,gBAAgB,CAAC,KAAiB,EAA6B;IACvE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACxB,MAAM,IAAI,+BAA+B,CAAC,kBAAkB,EAAE,4CAA4C,CAAC,CAAC;IAC7G,OAAO,KAAkC,CAAC;AAAA,CAC1C;AAED,SAAS,kBAAkB,CAAC,KAAiB,EAAkB;IAC9D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACtE,MAAM,IAAI,+BAA+B,CAAC,kBAAkB,EAAE,8CAA8C,CAAC,CAAC;IAC/G,OAAO,KAAuB,CAAC;AAAA,CAC/B;AAED,qFAAqF;AACrF,SAAS,qBAAqB,CAAC,QAAmC,EAAkB;IACnF,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;IACrE,IAAI,SAAS,KAAK,SAAS;QAC1B,MAAM,IAAI,+BAA+B,CAAC,mBAAmB,EAAE,+BAA+B,CAAC,CAAC;IACjG,OAAO,SAAS,CAAC;AAAA,CACjB;AAOD,yFAAyF;AACzF,SAAS,WAAW,CAAC,OAAuB,EAAiC;IAC5E,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;QACjC,MAAM,IAAI,+BAA+B,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAC;IAC7F,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC1D,MAAM,KAAK,GAAG,KAA4B,CAAC;QAC3C,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACxE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,OAAO,CAAC;AAAA,CACf;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAW;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAAA,CACxD;AAED,mFAAmF;AACnF,SAAS,qBAAqB,CAAC,OAAuB,EAAU;IAC/D,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM,IAAI,+BAA+B,CACxC,yBAAyB,EACzB,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,WAAW,UAAU,EAAE,CAC3E,CAAC;IACH,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QACxB,MAAM,IAAI,+BAA+B,CACxC,yBAAyB,EACzB,eAAe,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACjE,CAAC;IACH,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC;IAC9B,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;QAC5D,MAAM,IAAI,+BAA+B,CAAC,kBAAkB,EAAE,mCAAmC,CAAC,CAAC;IACpG,OAAO,MAAM,CAAC,GAAG,CAAC;AAAA,CAClB;AAED,SAAS,WAAW,CAAC,KAAc,EAAW;IAC7C,OAAO,KAAK,YAAY,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC;AAAA,CACpG;AAQD,SAAS,aAAa,CAAC,MAA+B,EAAE,SAAiB,EAAiB;IACzF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrD,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI;QAAE,KAAK,EAAE,CAAC;;QACjC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC;QAChC,QAAQ,GAAG,IAAI,CAAC;QAChB,UAAU,CAAC,KAAK,EAAE,CAAC;IAAA,CACnB,EAAE,SAAS,CAAC,CAAC;IACd,OAAO;QACN,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ;QACxB,OAAO,EAAE,GAAG,EAAE,CAAC;YACd,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAAA,CAC5C;KACD,CAAC;AAAA,CACF;AAED,SAAS,cAAc,CAAC,QAAkB,EAAW;IACpD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACzD,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrE,OAAO,SAAS,KAAK,kBAAkB,IAAI,SAAS,KAAK,6BAA6B,CAAC;AAAA,CACvF;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,QAAkB,EAAsE;IAC/G,MAAM,OAAO,GACZ,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,GAAG,CAAC,CAAC;IAC/G,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAClF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,CAAC;AAAA,CACxD;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB,EAAE,QAAgB,EAAE,MAAmB,EAAuB;IACvG,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;QACzB,MAAM,IAAI,+BAA+B,CAAC,kBAAkB,EAAE,kCAAkC,CAAC,CAAC;IACnG,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACJ,SAAS,CAAC;YACT,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YACpE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,IAAI;gBAAE,MAAM;YACrB,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC/B,IAAI,KAAK,GAAG,QAAQ;gBACnB,MAAM,IAAI,+BAA+B,CACxC,oBAAoB,EACpB,wDAAwD,CACxD,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACF,CAAC;YAAS,CAAC;QACV,MAAM,CAAC,WAAW,EAAE,CAAC;IACtB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC5B,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,sDAAsD;AACtD,MAAM,UAAU,gCAAgC,CAC/C,OAAO,GAAsC,EAAE,EAClB;IAC7B,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACpD,IAAI,OAAO,SAAS,KAAK,UAAU;QAClC,MAAM,IAAI,+BAA+B,CAAC,uBAAuB,EAAE,2BAA2B,CAAC,CAAC;IACjG,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,eAAe,IAAI,4BAA4B,EAAE,iBAAiB,CAAC,CAAC;IAC3G,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC,cAAc,IAAI,2BAA2B,EAAE,gBAAgB,CAAC,CAAC;IACvG,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACrE,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,eAAe,CAChC,OAAO,CAAC,gBAAgB,EACxB,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,CAClB,CAAC;IACF,MAAM,gBAAgB,GAAG,eAAe,CACvC,OAAO,CAAC,gBAAgB,EACxB,6BAA6B,EAC7B,qBAAqB,EACrB,kBAAkB,CAClB,CAAC;IACF,MAAM,aAAa,GAAG,eAAe,CACpC,OAAO,CAAC,aAAa,EACrB,0BAA0B,EAC1B,kBAAkB,EAClB,eAAe,CACf,CAAC;IACF,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,oBAAoB,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,CAAC,IAAI,YAAY,GAAG,gBAAgB;QAC7F,MAAM,IAAI,+BAA+B,CACxC,uBAAuB,EACvB,iDAAiD,gBAAgB,EAAE,CACnE,CAAC;IACH,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,8BAA8B,CAAC;IACtE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;QAChF,MAAM,IAAI,+BAA+B,CAAC,uBAAuB,EAAE,sBAAsB,CAAC,CAAC;IAE5F,MAAM,gBAAgB,GAAG,KAAK,EAC7B,GAAQ,EACR,OAAyC,EACzC,YAAqC,EACf,EAAE,CAAC;QACzB,IAAI,OAAO,GAAG,GAAG,CAAC;QAClB,KAAK,IAAI,QAAQ,GAAG,CAAC,GAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,aAAa,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YACvD,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACJ,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE;oBAC9C,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,OAAO,EAAE;oBAC5E,QAAQ,EAAE,QAAQ;oBAClB,MAAM,EAAE,OAAO,CAAC,MAAM;iBACtB,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,OAAO,CAAC,OAAO,EAAE,CAAC;gBAClB,IAAI,OAAO,CAAC,QAAQ,EAAE;oBACrB,MAAM,IAAI,+BAA+B,CAAC,mBAAmB,EAAE,+BAA+B,CAAC,CAAC;gBACjG,IAAI,WAAW,CAAC,KAAK,CAAC;oBACrB,MAAM,IAAI,+BAA+B,CAAC,WAAW,EAAE,mCAAmC,CAAC,CAAC;gBAC7F,MAAM,IAAI,+BAA+B,CAAC,gBAAgB,EAAE,4BAA4B,CAAC,CAAC;YAC3F,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC;oBACJ,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;wBAC1B,MAAM,IAAI,+BAA+B,CAAC,mBAAmB,EAAE,+BAA+B,CAAC,CAAC;oBACjG,MAAM,KAAK,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;oBACvC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;wBACnB,MAAM,OAAO,GACZ,KAAK,CAAC,iBAAiB,KAAK,SAAS;4BACpC,CAAC,CAAC,yBAAyB;4BAC3B,CAAC,CAAC,wBAAwB,IAAI,IAAI,CAAC,KAAK,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;wBACrF,MAAM,IAAI,+BAA+B,CAAC,cAAc,EAAE,OAAO,EAAE;4BAClE,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC;yBAChG,CAAC,CAAC;oBACJ,CAAC;oBACD,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;wBAClD,MAAM,IAAI,+BAA+B,CAAC,gBAAgB,EAAE,qCAAqC,CAAC,CAAC;oBACpG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;wBAC5B,MAAM,IAAI,+BAA+B,CAAC,kBAAkB,EAAE,mCAAmC,CAAC,CAAC;oBACpG,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;oBACzE,OAAO,KAAK,CAAC;gBACd,CAAC;wBAAS,CAAC;oBACV,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBACrD,OAAO,CAAC,OAAO,EAAE,CAAC;gBACnB,CAAC;YACF,CAAC;YACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACrD,OAAO,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,IAAI,YAAY;gBAChD,MAAM,IAAI,+BAA+B,CAAC,gBAAgB,EAAE,qCAAqC,CAAC,CAAC;YACpG,IAAI,IAAS,CAAC;YACd,IAAI,CAAC;gBACJ,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACR,MAAM,IAAI,+BAA+B,CAAC,kBAAkB,EAAE,wCAAwC,CAAC,CAAC;YACzG,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,KAAK,EAAE;gBAC5G,MAAM,IAAI,+BAA+B,CAAC,kBAAkB,EAAE,wCAAwC,CAAC,CAAC;YACzG,OAAO,GAAG,IAAI,CAAC;QAChB,CAAC;IAAA,CACD,CAAC;IAEF,MAAM,oBAAoB,GAAuD,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;QACjG,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI;YACjC,MAAM,IAAI,+BAA+B,CAAC,WAAW,EAAE,sCAAsC,CAAC,CAAC;QAChG,MAAM,WAAW,GAAG,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC1F,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;QAClE,MAAM,QAAQ,GAAG;YAChB,IAAI,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU;YACpD,OAAO;YACP,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC;YAC/B,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC;YAC9B,UAAU;YACV,GAAG,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;SAC3E,CAAC,MAAM,CAAC,CAAC,OAAO,EAAqB,EAAE,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjE,MAAM,OAAO,GACZ,KAAK,CAAC,IAAI,KAAK,QAAQ;YACtB,CAAC,CAAC;gBACA,sBAAsB,EAAE,YAAY;gBACpC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC;aAChF;YACF,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,UAAU,KAAK,SAAS;YAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QAC9G,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACxE,MAAM,OAAO,GACZ,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC1G,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAC9C;YACC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;YAChE,gBAAgB,EAAE,SAAS;YAC3B,eAAe,EAAE,aAAa;YAC9B,SAAS;SACT,EACD;YACC,GAAG,EAAE,QAAQ;YACb,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAChG,MAAM,EAAE,KAAK,CAAC,MAAM;SACpB,CACD,CAAC;QACF,OAAO;YACN,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,WAAW;SACX,CAAC;IAAA,CACF,CAAC;IAEF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,oBAAoB,EAAE,CAAC;AAAA,CAC5C","sourcesContent":["import { downloadNodeUrlPackageV1 } from \"./node-url-package-source.ts\";\n\n/**\n * GitHub/Gitee release plugin package source (design\n * `插件独立分发与启动装配设计.md` §4.6 \"GitHub\"/\"Gitee\" rows). Two-step\n * protocol: resolve one release through the repo's release API — the exact\n * tag endpoint when a tag is given, otherwise the first non-draft entry of\n * the first releases page in API order (no client-side sorting) — then pick\n * the release's single `.zip`/`.tgz` asset and download it with the same\n * bounded http(s) semantics as custom URL packages (redirect-per-hop, budget,\n * timeout, optional strong sha256). Zero or multiple matching assets are\n * explicit structured errors listing the asset names; nothing is guessed.\n * Authentication is optional: GitHub uses an `Authorization: Bearer` header,\n * Gitee an `access_token` query parameter. Anonymous rate limits (403/429\n * with `X-RateLimit-Remaining: 0`, or any 429) surface as `rate_limited`\n * carrying the advertised `X-RateLimit-Reset` epoch; there is no retry.\n */\n\nconst DEFAULT_GITHUB_API_ORIGIN_V1 = \"https://api.github.com\";\nconst DEFAULT_GITEE_API_ORIGIN_V1 = \"https://gitee.com/api/v5\";\nconst DEFAULT_TIMEOUT_MS_V1 = 15_000;\nconst MAX_TIMEOUT_MS_V1 = 120_000;\nconst DEFAULT_MAX_RESPONSE_BYTES_V1 = 8 * 1024 * 1024;\nconst MAX_RESPONSE_BYTES_V1 = 16 * 1024 * 1024;\nconst DEFAULT_MAX_ASSET_BYTES_V1 = 128 * 1024 * 1024;\nconst MAX_ASSET_BYTES_V1 = 512 * 1024 * 1024;\nconst DEFAULT_REDIRECTS_V1 = 3;\nconst MAX_REDIRECTS_V1 = 5;\nconst REDIRECT_STATUS = new Set([301, 302, 303, 307, 308]);\n\nexport type NodeReleasePackageSourceErrorCodeV1 =\n\t| \"cancelled\"\n\t| \"invalid_configuration\"\n\t| \"request_failed\"\n\t| \"request_timed_out\"\n\t| \"invalid_response\"\n\t| \"response_too_large\"\n\t| \"release_not_found\"\n\t| \"release_asset_not_found\"\n\t| \"release_asset_ambiguous\"\n\t| \"rate_limited\";\n\nexport class NodeReleasePackageSourceErrorV1 extends Error {\n\treadonly code: NodeReleasePackageSourceErrorCodeV1;\n\t/** Unix epoch seconds advertised by `X-RateLimit-Reset`; present only for `rate_limited`. */\n\treadonly resetEpochSeconds?: number;\n\n\tconstructor(\n\t\tcode: NodeReleasePackageSourceErrorCodeV1,\n\t\tmessage: string,\n\t\toptions?: { readonly resetEpochSeconds?: number },\n\t) {\n\t\tsuper(message);\n\t\tthis.name = \"NodeReleasePackageSourceErrorV1\";\n\t\tthis.code = code;\n\t\tif (options?.resetEpochSeconds !== undefined) this.resetEpochSeconds = options.resetEpochSeconds;\n\t}\n}\n\nexport interface NodeReleasePackageSourceOptionsV1 {\n\t/** Bare http(s) GitHub API origin; defaults to `https://api.github.com`. */\n\treadonly githubApiOrigin?: string;\n\t/** Bare http(s) Gitee API origin; defaults to `https://gitee.com/api/v5`. */\n\treadonly giteeApiOrigin?: string;\n\t/** Optional GitHub API token sent as a bearer header. */\n\treadonly githubToken?: string;\n\t/** Optional Gitee API token sent as an `access_token` query parameter. */\n\treadonly giteeToken?: string;\n\t/** Real fetch or a deterministic test replacement. */\n\treadonly fetch?: typeof globalThis.fetch;\n\treadonly requestTimeoutMs?: number;\n\treadonly maxResponseBytes?: number;\n\treadonly maxAssetBytes?: number;\n\treadonly maxRedirects?: number;\n\treadonly userAgent?: string;\n}\n\nexport interface NodeReleaseAssetDownloadV1 {\n\treadonly bytes: Uint8Array;\n\treadonly mediaType: \"application/zip\" | \"application/gzip\";\n\treadonly sha256Hex: string;\n\t/** `github:<owner>/<repo>@<tag|latest>` or the `gitee:` equivalent. */\n\treadonly sourceLabel: string;\n}\n\nexport interface NodeReleasePackageSourceV1 {\n\treadonly version: 1;\n\treadonly downloadReleaseAsset: (input: {\n\t\treadonly kind: \"github\" | \"gitee\";\n\t\treadonly owner: string;\n\t\treadonly repo: string;\n\t\treadonly tag?: string;\n\t\treadonly expectedDigestHex?: string;\n\t\treadonly signal?: AbortSignal;\n\t}) => Promise<NodeReleaseAssetDownloadV1>;\n}\n\ninterface ReleaseAssetShapeV1 {\n\treadonly name?: unknown;\n\treadonly browser_download_url?: unknown;\n}\n\ninterface ReleaseShapeV1 {\n\treadonly draft?: unknown;\n\treadonly assets?: unknown;\n}\n\nfunction boundedPositive(value: number | undefined, fallback: number, maximum: number, label: string): number {\n\tconst result = value ?? fallback;\n\tif (!Number.isSafeInteger(result) || result <= 0 || result > maximum)\n\t\tthrow new NodeReleasePackageSourceErrorV1(\n\t\t\t\"invalid_configuration\",\n\t\t\t`${label} must be a positive integer at most ${maximum}`,\n\t\t);\n\treturn result;\n}\n\nfunction boundedToken(value: string | undefined, label: string): string | undefined {\n\tif (value === undefined) return undefined;\n\tif (value.length === 0 || value.length > 4096 || /[\\r\\n\\s]/u.test(value))\n\t\tthrow new NodeReleasePackageSourceErrorV1(\"invalid_configuration\", `${label} is invalid`);\n\treturn value;\n}\n\nfunction apiOrigin(value: string, label: string): { readonly origin: string; readonly pathPrefix: string } {\n\tlet parsed: URL;\n\ttry {\n\t\tparsed = new URL(value);\n\t} catch {\n\t\tthrow new NodeReleasePackageSourceErrorV1(\"invalid_configuration\", `${label} is invalid`);\n\t}\n\tif (\n\t\t(parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") ||\n\t\tparsed.username !== \"\" ||\n\t\tparsed.password !== \"\"\n\t)\n\t\tthrow new NodeReleasePackageSourceErrorV1(\n\t\t\t\"invalid_configuration\",\n\t\t\t`${label} must be http(s) without credentials`,\n\t\t);\n\tif (parsed.search !== \"\" || parsed.hash !== \"\")\n\t\tthrow new NodeReleasePackageSourceErrorV1(\n\t\t\t\"invalid_configuration\",\n\t\t\t`${label} must not include a query or fragment`,\n\t\t);\n\t// The Gitee default origin carries the `/api/v5` path prefix. The prefix is\n\t// kept as a plain string because a URL normalizes an empty pathname back\n\t// to \"/\", which would reintroduce a double slash when joining endpoints.\n\tconst trimmed = parsed.pathname.replace(/\\/+$/u, \"\");\n\treturn { origin: parsed.origin, pathPrefix: trimmed === \"\" || trimmed === \"/\" ? \"\" : trimmed.replace(/^\\//u, \"\") };\n}\n\nfunction jsonBytes(value: Uint8Array): unknown {\n\ttry {\n\t\treturn JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(value));\n\t} catch {\n\t\tthrow new NodeReleasePackageSourceErrorV1(\"invalid_response\", \"release API response is not valid JSON\");\n\t}\n}\n\nfunction parseReleaseList(bytes: Uint8Array): readonly ReleaseShapeV1[] {\n\tconst value = jsonBytes(bytes);\n\tif (!Array.isArray(value))\n\t\tthrow new NodeReleasePackageSourceErrorV1(\"invalid_response\", \"release API response is not a release list\");\n\treturn value as readonly ReleaseShapeV1[];\n}\n\nfunction parseReleaseObject(bytes: Uint8Array): ReleaseShapeV1 {\n\tconst value = jsonBytes(bytes);\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value))\n\t\tthrow new NodeReleasePackageSourceErrorV1(\"invalid_response\", \"release API response is not a release object\");\n\treturn value as ReleaseShapeV1;\n}\n\n/** First non-draft entry in API order; the array itself is the ordering contract. */\nfunction firstPublishedRelease(releases: readonly ReleaseShapeV1[]): ReleaseShapeV1 {\n\tconst published = releases.find((release) => release.draft !== true);\n\tif (published === undefined)\n\t\tthrow new NodeReleasePackageSourceErrorV1(\"release_not_found\", \"repo has no published release\");\n\treturn published;\n}\n\ninterface ReleaseAssetNameV1 {\n\treadonly name: string;\n\treadonly url: unknown;\n}\n\n/** Assets with a usable name; entries without a string name are ignored as API noise. */\nfunction namedAssets(release: ReleaseShapeV1): readonly ReleaseAssetNameV1[] {\n\tif (release.assets === undefined) return [];\n\tif (!Array.isArray(release.assets))\n\t\tthrow new NodeReleasePackageSourceErrorV1(\"invalid_response\", \"release assets are invalid\");\n\tconst entries: ReleaseAssetNameV1[] = [];\n\tfor (const asset of release.assets) {\n\t\tif (typeof asset !== \"object\" || asset === null) continue;\n\t\tconst shape = asset as ReleaseAssetShapeV1;\n\t\tif (typeof shape.name !== \"string\" || shape.name.length === 0) continue;\n\t\tentries.push({ name: shape.name, url: shape.browser_download_url });\n\t}\n\treturn entries;\n}\n\nfunction isPackageAssetName(name: string): boolean {\n\tconst value = name.toLowerCase();\n\treturn value.endsWith(\".zip\") || value.endsWith(\".tgz\");\n}\n\n/** Select the release's single `.zip`/`.tgz` asset and return its download URL. */\nfunction selectPackageAssetUrl(release: ReleaseShapeV1): string {\n\tconst assets = namedAssets(release);\n\tconst candidates = assets.filter((asset) => isPackageAssetName(asset.name));\n\tconst assetNames = assets.map((asset) => asset.name).join(\", \");\n\tif (candidates.length === 0)\n\t\tthrow new NodeReleasePackageSourceErrorV1(\n\t\t\t\"release_asset_not_found\",\n\t\t\tassetNames.length === 0 ? \"release has no assets\" : `assets: ${assetNames}`,\n\t\t);\n\tif (candidates.length > 1)\n\t\tthrow new NodeReleasePackageSourceErrorV1(\n\t\t\t\"release_asset_ambiguous\",\n\t\t\t`candidates: ${candidates.map((asset) => asset.name).join(\", \")}`,\n\t\t);\n\tconst chosen = candidates[0]!;\n\tif (typeof chosen.url !== \"string\" || chosen.url.length === 0)\n\t\tthrow new NodeReleasePackageSourceErrorV1(\"invalid_response\", \"release asset has no download URL\");\n\treturn chosen.url;\n}\n\nfunction isAbortLike(error: unknown): boolean {\n\treturn error instanceof Error && (error.name === \"AbortError\" || error.name === \"AbortSignalError\");\n}\n\ninterface RequestSignal {\n\treadonly signal: AbortSignal;\n\treadonly timedOut: () => boolean;\n\treadonly cleanup: () => void;\n}\n\nfunction requestSignal(parent: AbortSignal | undefined, timeoutMs: number): RequestSignal {\n\tconst controller = new AbortController();\n\tlet timedOut = false;\n\tconst abort = () => controller.abort(parent?.reason);\n\tif (parent?.aborted === true) abort();\n\telse parent?.addEventListener(\"abort\", abort, { once: true });\n\tconst timeout = setTimeout(() => {\n\t\ttimedOut = true;\n\t\tcontroller.abort();\n\t}, timeoutMs);\n\treturn {\n\t\tsignal: controller.signal,\n\t\ttimedOut: () => timedOut,\n\t\tcleanup: () => {\n\t\t\tclearTimeout(timeout);\n\t\t\tparent?.removeEventListener(\"abort\", abort);\n\t\t},\n\t};\n}\n\nfunction isJsonResponse(response: Response): boolean {\n\tconst contentType = response.headers.get(\"content-type\");\n\tif (contentType === null) return false;\n\tconst mediaType = contentType.split(\";\", 1)[0]?.trim().toLowerCase();\n\treturn mediaType === \"application/json\" || mediaType === \"application/vnd.github+json\";\n}\n\n/**\n * Rate-limit verdict for 403/429 responses: any 429, and a 403 whose\n * `X-RateLimit-Remaining` is exactly `0`. The reset epoch is passed through\n * verbatim when present and integer-like; absent headers stay absent.\n */\nfunction rateLimitState(response: Response): { readonly limited: boolean; readonly resetEpochSeconds?: number } {\n\tconst limited =\n\t\tresponse.status === 429 || (response.status === 403 && response.headers.get(\"x-ratelimit-remaining\") === \"0\");\n\tif (!limited) return { limited: false };\n\tconst reset = response.headers.get(\"x-ratelimit-reset\");\n\tconst resetValue = reset === null ? Number.NaN : Number.parseInt(reset, 10);\n\tif (!Number.isSafeInteger(resetValue) || resetValue < 0) return { limited: true };\n\treturn { limited: true, resetEpochSeconds: resetValue };\n}\n\nasync function readBody(response: Response, maxBytes: number, signal: AbortSignal): Promise<Uint8Array> {\n\tif (response.body === null)\n\t\tthrow new NodeReleasePackageSourceErrorV1(\"invalid_response\", \"release API response has no body\");\n\tconst reader = response.body.getReader();\n\tconst chunks: Uint8Array[] = [];\n\tlet total = 0;\n\ttry {\n\t\tfor (;;) {\n\t\t\tif (signal.aborted) throw new DOMException(\"aborted\", \"AbortError\");\n\t\t\tconst item = await reader.read();\n\t\t\tif (item.done) break;\n\t\t\ttotal += item.value.byteLength;\n\t\t\tif (total > maxBytes)\n\t\t\t\tthrow new NodeReleasePackageSourceErrorV1(\n\t\t\t\t\t\"response_too_large\",\n\t\t\t\t\t\"release API response exceeds the configured size limit\",\n\t\t\t\t);\n\t\t\tchunks.push(item.value);\n\t\t}\n\t} finally {\n\t\treader.releaseLock();\n\t}\n\tconst bytes = new Uint8Array(total);\n\tlet offset = 0;\n\tfor (const chunk of chunks) {\n\t\tbytes.set(chunk, offset);\n\t\toffset += chunk.byteLength;\n\t}\n\treturn bytes;\n}\n\n/** Create the bounded GitHub/Gitee release reader. */\nexport function createNodeReleasePackageSourceV1(\n\toptions: NodeReleasePackageSourceOptionsV1 = {},\n): NodeReleasePackageSourceV1 {\n\tconst transport = options.fetch ?? globalThis.fetch;\n\tif (typeof transport !== \"function\")\n\t\tthrow new NodeReleasePackageSourceErrorV1(\"invalid_configuration\", \"Node fetch is unavailable\");\n\tconst githubOrigin = apiOrigin(options.githubApiOrigin ?? DEFAULT_GITHUB_API_ORIGIN_V1, \"githubApiOrigin\");\n\tconst giteeOrigin = apiOrigin(options.giteeApiOrigin ?? DEFAULT_GITEE_API_ORIGIN_V1, \"giteeApiOrigin\");\n\tconst githubToken = boundedToken(options.githubToken, \"githubToken\");\n\tconst giteeToken = boundedToken(options.giteeToken, \"giteeToken\");\n\tconst timeoutMs = boundedPositive(\n\t\toptions.requestTimeoutMs,\n\t\tDEFAULT_TIMEOUT_MS_V1,\n\t\tMAX_TIMEOUT_MS_V1,\n\t\t\"requestTimeoutMs\",\n\t);\n\tconst maxResponseBytes = boundedPositive(\n\t\toptions.maxResponseBytes,\n\t\tDEFAULT_MAX_RESPONSE_BYTES_V1,\n\t\tMAX_RESPONSE_BYTES_V1,\n\t\t\"maxResponseBytes\",\n\t);\n\tconst maxAssetBytes = boundedPositive(\n\t\toptions.maxAssetBytes,\n\t\tDEFAULT_MAX_ASSET_BYTES_V1,\n\t\tMAX_ASSET_BYTES_V1,\n\t\t\"maxAssetBytes\",\n\t);\n\tconst maxRedirects = options.maxRedirects ?? DEFAULT_REDIRECTS_V1;\n\tif (!Number.isSafeInteger(maxRedirects) || maxRedirects < 0 || maxRedirects > MAX_REDIRECTS_V1)\n\t\tthrow new NodeReleasePackageSourceErrorV1(\n\t\t\t\"invalid_configuration\",\n\t\t\t`maxRedirects must be an integer between 0 and ${MAX_REDIRECTS_V1}`,\n\t\t);\n\tconst userAgent = options.userAgent ?? \"agent-forge-plugin-release/1\";\n\tif (userAgent.length === 0 || userAgent.length > 256 || /[\\r\\n]/u.test(userAgent))\n\t\tthrow new NodeReleasePackageSourceErrorV1(\"invalid_configuration\", \"userAgent is invalid\");\n\n\tconst fetchReleaseJson = async (\n\t\turl: URL,\n\t\theaders: Readonly<Record<string, string>>,\n\t\tparentSignal: AbortSignal | undefined,\n\t): Promise<Uint8Array> => {\n\t\tlet current = url;\n\t\tfor (let redirect = 0; ; redirect += 1) {\n\t\t\tconst request = requestSignal(parentSignal, timeoutMs);\n\t\t\tlet response: Response;\n\t\t\ttry {\n\t\t\t\tresponse = await transport(current.toString(), {\n\t\t\t\t\tmethod: \"GET\",\n\t\t\t\t\theaders: { accept: \"application/json\", \"user-agent\": userAgent, ...headers },\n\t\t\t\t\tredirect: \"manual\",\n\t\t\t\t\tsignal: request.signal,\n\t\t\t\t});\n\t\t\t} catch (error) {\n\t\t\t\trequest.cleanup();\n\t\t\t\tif (request.timedOut())\n\t\t\t\t\tthrow new NodeReleasePackageSourceErrorV1(\"request_timed_out\", \"release API request timed out\");\n\t\t\t\tif (isAbortLike(error))\n\t\t\t\t\tthrow new NodeReleasePackageSourceErrorV1(\"cancelled\", \"release API request was cancelled\");\n\t\t\t\tthrow new NodeReleasePackageSourceErrorV1(\"request_failed\", \"release API request failed\");\n\t\t\t}\n\t\t\tif (!REDIRECT_STATUS.has(response.status)) {\n\t\t\t\ttry {\n\t\t\t\t\tif (response.status === 404)\n\t\t\t\t\t\tthrow new NodeReleasePackageSourceErrorV1(\"release_not_found\", \"repo or release was not found\");\n\t\t\t\t\tconst limit = rateLimitState(response);\n\t\t\t\t\tif (limit.limited) {\n\t\t\t\t\t\tconst message =\n\t\t\t\t\t\t\tlimit.resetEpochSeconds === undefined\n\t\t\t\t\t\t\t\t? \"rate limit was exceeded\"\n\t\t\t\t\t\t\t\t: `rate limit resets at ${new Date(limit.resetEpochSeconds * 1000).toISOString()}`;\n\t\t\t\t\t\tthrow new NodeReleasePackageSourceErrorV1(\"rate_limited\", message, {\n\t\t\t\t\t\t\t...(limit.resetEpochSeconds === undefined ? {} : { resetEpochSeconds: limit.resetEpochSeconds }),\n\t\t\t\t\t\t});\n\t\t\t\t\t}\n\t\t\t\t\tif (response.status < 200 || response.status >= 300)\n\t\t\t\t\t\tthrow new NodeReleasePackageSourceErrorV1(\"request_failed\", \"release API request did not succeed\");\n\t\t\t\t\tif (!isJsonResponse(response))\n\t\t\t\t\t\tthrow new NodeReleasePackageSourceErrorV1(\"invalid_response\", \"release API response must be JSON\");\n\t\t\t\t\tconst bytes = await readBody(response, maxResponseBytes, request.signal);\n\t\t\t\t\treturn bytes;\n\t\t\t\t} finally {\n\t\t\t\t\tawait response.body?.cancel().catch(() => undefined);\n\t\t\t\t\trequest.cleanup();\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst location = response.headers.get(\"location\");\n\t\t\tawait response.body?.cancel().catch(() => undefined);\n\t\t\trequest.cleanup();\n\t\t\tif (location === null || redirect >= maxRedirects)\n\t\t\t\tthrow new NodeReleasePackageSourceErrorV1(\"request_failed\", \"release API redirect limit exceeded\");\n\t\t\tlet next: URL;\n\t\t\ttry {\n\t\t\t\tnext = new URL(location, current);\n\t\t\t} catch {\n\t\t\t\tthrow new NodeReleasePackageSourceErrorV1(\"invalid_response\", \"release API redirect target is invalid\");\n\t\t\t}\n\t\t\tif ((next.protocol !== \"http:\" && next.protocol !== \"https:\") || next.username !== \"\" || next.password !== \"\")\n\t\t\t\tthrow new NodeReleasePackageSourceErrorV1(\"invalid_response\", \"release API redirect must stay http(s)\");\n\t\t\tcurrent = next;\n\t\t}\n\t};\n\n\tconst downloadReleaseAsset: NodeReleasePackageSourceV1[\"downloadReleaseAsset\"] = async (input) => {\n\t\tif (input.signal?.aborted === true)\n\t\t\tthrow new NodeReleasePackageSourceErrorV1(\"cancelled\", \"release asset download was cancelled\");\n\t\tconst sourceLabel = `${input.kind}:${input.owner}/${input.repo}@${input.tag ?? \"latest\"}`;\n\t\tconst base = input.kind === \"github\" ? githubOrigin : giteeOrigin;\n\t\tconst segments = [\n\t\t\tbase.pathPrefix === \"\" ? undefined : base.pathPrefix,\n\t\t\t\"repos\",\n\t\t\tencodeURIComponent(input.owner),\n\t\t\tencodeURIComponent(input.repo),\n\t\t\t\"releases\",\n\t\t\t...(input.tag === undefined ? [] : [\"tags\", encodeURIComponent(input.tag)]),\n\t\t].filter((segment): segment is string => segment !== undefined);\n\t\tconst endpoint = new URL(`${base.origin}/${segments.join(\"/\")}`);\n\t\tconst headers: Readonly<Record<string, string>> =\n\t\t\tinput.kind === \"github\"\n\t\t\t\t? {\n\t\t\t\t\t\t\"x-github-api-version\": \"2022-11-28\",\n\t\t\t\t\t\t...(githubToken === undefined ? {} : { authorization: `Bearer ${githubToken}` }),\n\t\t\t\t\t}\n\t\t\t\t: {};\n\t\tif (input.kind === \"gitee\" && giteeToken !== undefined) endpoint.searchParams.set(\"access_token\", giteeToken);\n\t\tconst payload = await fetchReleaseJson(endpoint, headers, input.signal);\n\t\tconst release =\n\t\t\tinput.tag === undefined ? firstPublishedRelease(parseReleaseList(payload)) : parseReleaseObject(payload);\n\t\tconst assetUrl = selectPackageAssetUrl(release);\n\t\tconst download = await downloadNodeUrlPackageV1(\n\t\t\t{\n\t\t\t\t...(options.fetch === undefined ? {} : { fetch: options.fetch }),\n\t\t\t\trequestTimeoutMs: timeoutMs,\n\t\t\t\tmaxPackageBytes: maxAssetBytes,\n\t\t\t\tuserAgent,\n\t\t\t},\n\t\t\t{\n\t\t\t\turl: assetUrl,\n\t\t\t\t...(input.expectedDigestHex === undefined ? {} : { expectedDigestHex: input.expectedDigestHex }),\n\t\t\t\tsignal: input.signal,\n\t\t\t},\n\t\t);\n\t\treturn {\n\t\t\tbytes: download.bytes,\n\t\t\tmediaType: download.mediaType,\n\t\t\tsha256Hex: download.digestHex,\n\t\t\tsourceLabel,\n\t\t};\n\t};\n\n\treturn { version: 1, downloadReleaseAsset };\n}\n"]}

package/dist/plugins/ecosystem/node-tar-package.d.ts

@@ -0,0 +1,11 @@
+import { type NodeZipPackageEntryV1, type NodeZipPackageLimitsV1 } from "./node-package-install-host.ts";
+/**
+ * Parse a gzip-compressed tar package into the same normalized entry shape as
+ * {@link parseNodeZipPackageV1}, sharing its name normalization, budgets, and
+ * structured errors. The gzip layer is decompressed streaming with a hard
+ * extracted-bytes cap; the tar layer accepts only ustar-style headers with
+ * valid checksums, rejects links and non-regular types, and supports GNU long
+ * names ('L'), pax path records ('x'), and skipped global headers ('g').
+ */
+export declare function parseNodeTarGzPackageV1(input: Uint8Array, limitsInput?: NodeZipPackageLimitsV1): Promise<readonly NodeZipPackageEntryV1[]>;
+//# sourceMappingURL=node-tar-package.d.ts.map

package/dist/plugins/ecosystem/node-tar-package.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-tar-package.d.ts","sourceRoot":"","sources":["../../../src/plugins/ecosystem/node-tar-package.ts"],"names":[],"mappings":"AACA,OAAO,EAEN,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAG3B,MAAM,gCAAgC,CAAC;AAyPxC;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC5C,KAAK,EAAE,UAAU,EACjB,WAAW,GAAE,sBAA2B,GACtC,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAM3C","sourcesContent":["import { createGunzip } from \"node:zlib\";\nimport {\n\tNodePackageInstallErrorV1,\n\ttype NodeZipPackageEntryV1,\n\ttype NodeZipPackageLimitsV1,\n\tnormalizedEntryName,\n\tresolveNodePackageLimitsV1,\n} from \"./node-package-install-host.ts\";\n\nconst TAR_BLOCK_BYTES_V1 = 512;\nconst TAR_NAME_LENGTH_V1 = 100;\nconst TAR_SIZE_OFFSET_V1 = 124;\nconst TAR_SIZE_LENGTH_V1 = 12;\nconst TAR_CHECKSUM_OFFSET_V1 = 148;\nconst TAR_CHECKSUM_LENGTH_V1 = 8;\nconst TAR_TYPEFLAG_OFFSET_V1 = 156;\nconst TAR_MAGIC_OFFSET_V1 = 257;\nconst TAR_PREFIX_OFFSET_V1 = 345;\nconst TAR_PREFIX_LENGTH_V1 = 155;\nconst USTAR_MAGIC_V1: readonly number[] = [0x75, 0x73, 0x74, 0x61, 0x72];\n\nfunction readHeaderString(bytes: Uint8Array, offset: number, length: number): string {\n\tconst end = offset + length;\n\tlet stop = offset;\n\twhile (stop < end && bytes[stop] !== 0) stop += 1;\n\ttry {\n\t\treturn new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes.subarray(offset, stop));\n\t} catch {\n\t\tthrow new NodePackageInstallErrorV1(\"archive_invalid\");\n\t}\n}\n\nfunction readOctalHeaderField(header: Uint8Array, offset: number, length: number): number {\n\tconst end = offset + length;\n\tlet start = offset;\n\twhile (start < end && header[start] === 0x20) start += 1;\n\tlet stop = end;\n\twhile (stop > start && (header[stop - 1] === 0 || header[stop - 1] === 0x20)) stop -= 1;\n\tlet value = 0;\n\tfor (let index = start; index < stop; index += 1) {\n\t\tconst byte = header[index]!;\n\t\t// Octal ASCII only; the GNU base-256 (0x80-prefixed) encoding is rejected.\n\t\tif (byte < 0x30 || byte > 0x37) throw new NodePackageInstallErrorV1(\"archive_invalid\");\n\t\tvalue = value * 8 + (byte - 0x30);\n\t\tif (value > Number.MAX_SAFE_INTEGER) throw new NodePackageInstallErrorV1(\"archive_invalid\");\n\t}\n\treturn value;\n}\n\nfunction verifyHeaderChecksum(header: Uint8Array): void {\n\tlet sum = 0;\n\tfor (let index = 0; index < TAR_BLOCK_BYTES_V1; index += 1) {\n\t\tsum +=\n\t\t\tindex >= TAR_CHECKSUM_OFFSET_V1 && index < TAR_CHECKSUM_OFFSET_V1 + TAR_CHECKSUM_LENGTH_V1\n\t\t\t\t? 32\n\t\t\t\t: header[index]!;\n\t}\n\tif (readOctalHeaderField(header, TAR_CHECKSUM_OFFSET_V1, TAR_CHECKSUM_LENGTH_V1) !== sum)\n\t\tthrow new NodePackageInstallErrorV1(\"archive_invalid\");\n}\n\nfunction headerEntryName(header: Uint8Array): string {\n\tfor (let index = 0; index < USTAR_MAGIC_V1.length; index += 1)\n\t\tif (header[TAR_MAGIC_OFFSET_V1 + index] !== USTAR_MAGIC_V1[index])\n\t\t\tthrow new NodePackageInstallErrorV1(\"archive_invalid\");\n\tconst name = readHeaderString(header, 0, TAR_NAME_LENGTH_V1);\n\tconst prefix = readHeaderString(header, TAR_PREFIX_OFFSET_V1, TAR_PREFIX_LENGTH_V1);\n\treturn prefix === \"\" ? name : `${prefix}/${name}`;\n}\n\nfunction isZeroBlock(tar: Uint8Array, offset: number): boolean {\n\tfor (let index = 0; index < TAR_BLOCK_BYTES_V1; index += 1) if (tar[offset + index] !== 0) return false;\n\treturn true;\n}\n\nfunction verifyZeroPadding(tar: Uint8Array, dataEnd: number, paddedEnd: number): void {\n\tfor (let index = dataEnd; index < paddedEnd; index += 1)\n\t\tif (tar[index] !== 0) throw new NodePackageInstallErrorV1(\"archive_invalid\");\n}\n\n/**\n * Extract the `path` override from a pax extended header payload. Records are\n * `<length> <key>=<value>\\n` with byte-oriented lengths; every record except\n * `path` is deliberately ignored.\n */\nfunction parsePaxPath(data: Uint8Array): string | undefined {\n\tlet offset = 0;\n\tlet path: string | undefined;\n\twhile (offset < data.byteLength) {\n\t\tlet space = offset;\n\t\twhile (space < data.byteLength && data[space] !== 0x20) space += 1;\n\t\tif (space >= data.byteLength) throw new NodePackageInstallErrorV1(\"archive_invalid\");\n\t\tlet recordLength = 0;\n\t\tfor (let index = offset; index < space; index += 1) {\n\t\t\tconst byte = data[index]!;\n\t\t\tif (byte < 0x30 || byte > 0x39) throw new NodePackageInstallErrorV1(\"archive_invalid\");\n\t\t\trecordLength = recordLength * 10 + (byte - 0x30);\n\t\t\tif (recordLength > data.byteLength) throw new NodePackageInstallErrorV1(\"archive_invalid\");\n\t\t}\n\t\tif (recordLength <= space - offset + 1) throw new NodePackageInstallErrorV1(\"archive_invalid\");\n\t\tconst end = offset + recordLength;\n\t\tif (end > data.byteLength || data[end - 1] !== 0x0a) throw new NodePackageInstallErrorV1(\"archive_invalid\");\n\t\tlet equals = space + 1;\n\t\twhile (equals < end - 1 && data[equals] !== 0x3d) equals += 1;\n\t\tif (equals >= end - 1) throw new NodePackageInstallErrorV1(\"archive_invalid\");\n\t\tif (readHeaderString(data, space + 1, equals - space - 1) === \"path\")\n\t\t\tpath = readHeaderString(data, equals + 1, end - 1 - equals - 1);\n\t\toffset = end;\n\t}\n\treturn path;\n}\n\nfunction readGnuLongName(data: Uint8Array): string {\n\tlet end = data.byteLength;\n\tif (end > 0 && data[end - 1] === 0) end -= 1;\n\tif (end === 0) throw new NodePackageInstallErrorV1(\"archive_invalid\");\n\ttry {\n\t\treturn new TextDecoder(\"utf-8\", { fatal: true }).decode(data.subarray(0, end));\n\t} catch {\n\t\tthrow new NodePackageInstallErrorV1(\"archive_invalid\");\n\t}\n}\n\n/**\n * Streaming gunzip with a running output counter so a gzip bomb is cut off\n * as soon as the extracted budget is exceeded, never buffered in full first.\n */\nfunction gunzipBounded(input: Uint8Array, maxBytes: number): Promise<Uint8Array> {\n\treturn new Promise((resolve, reject) => {\n\t\tconst gunzip = createGunzip();\n\t\tconst chunks: Uint8Array[] = [];\n\t\tlet total = 0;\n\t\tlet settled = false;\n\t\tconst fail = (error: NodePackageInstallErrorV1): void => {\n\t\t\tif (settled) return;\n\t\t\tsettled = true;\n\t\t\tgunzip.destroy();\n\t\t\treject(error);\n\t\t};\n\t\tgunzip.on(\"data\", (chunk: Uint8Array) => {\n\t\t\tif (settled) return;\n\t\t\ttotal += chunk.byteLength;\n\t\t\tif (total > maxBytes) {\n\t\t\t\tfail(new NodePackageInstallErrorV1(\"archive_budget_exceeded\"));\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tchunks.push(chunk);\n\t\t});\n\t\tgunzip.on(\"end\", () => {\n\t\t\tif (settled) return;\n\t\t\tsettled = true;\n\t\t\tconst result = new Uint8Array(total);\n\t\t\tlet offset = 0;\n\t\t\tfor (const chunk of chunks) {\n\t\t\t\tresult.set(chunk, offset);\n\t\t\t\toffset += chunk.byteLength;\n\t\t\t}\n\t\t\tresolve(result);\n\t\t});\n\t\tgunzip.on(\"error\", () => {\n\t\t\tfail(new NodePackageInstallErrorV1(\"archive_invalid\"));\n\t\t});\n\t\tgunzip.end(input);\n\t});\n}\n\nfunction parseTarEntries(tar: Uint8Array, limits: Required<NodeZipPackageLimitsV1>): readonly NodeZipPackageEntryV1[] {\n\tconst entries: NodeZipPackageEntryV1[] = [];\n\tconst names = new Set<string>();\n\tlet extractedBytes = 0;\n\tlet offset = 0;\n\tlet pendingPath: string | undefined;\n\twhile (offset + TAR_BLOCK_BYTES_V1 <= tar.byteLength) {\n\t\tconst header = tar.subarray(offset, offset + TAR_BLOCK_BYTES_V1);\n\t\tif (isZeroBlock(tar, offset)) {\n\t\t\t// EOF is two consecutive zero blocks followed by nothing but zero padding.\n\t\t\tif (offset + 2 * TAR_BLOCK_BYTES_V1 > tar.byteLength || !isZeroBlock(tar, offset + TAR_BLOCK_BYTES_V1))\n\t\t\t\tthrow new NodePackageInstallErrorV1(\"archive_invalid\");\n\t\t\tif (pendingPath !== undefined) throw new NodePackageInstallErrorV1(\"archive_invalid\");\n\t\t\tfor (let index = offset + 2 * TAR_BLOCK_BYTES_V1; index < tar.byteLength; index += 1)\n\t\t\t\tif (tar[index] !== 0) throw new NodePackageInstallErrorV1(\"archive_invalid\");\n\t\t\treturn Object.freeze(entries);\n\t\t}\n\t\tverifyHeaderChecksum(header);\n\t\tconst typeflag = String.fromCharCode(header[TAR_TYPEFLAG_OFFSET_V1]!);\n\t\tconst size = readOctalHeaderField(header, TAR_SIZE_OFFSET_V1, TAR_SIZE_LENGTH_V1);\n\t\tif (size > limits.maxEntryBytes) throw new NodePackageInstallErrorV1(\"archive_budget_exceeded\");\n\t\tconst dataStart = offset + TAR_BLOCK_BYTES_V1;\n\t\tconst dataEnd = dataStart + size;\n\t\tif (dataEnd > tar.byteLength) throw new NodePackageInstallErrorV1(\"archive_invalid\");\n\t\tconst paddedEnd = Math.ceil(dataEnd / TAR_BLOCK_BYTES_V1) * TAR_BLOCK_BYTES_V1;\n\t\tverifyZeroPadding(tar, dataEnd, paddedEnd);\n\t\tconst data = tar.subarray(dataStart, dataEnd);\n\t\tif (typeflag === \"L\") {\n\t\t\tpendingPath = readGnuLongName(data);\n\t\t\toffset = paddedEnd;\n\t\t\tcontinue;\n\t\t}\n\t\tif (typeflag === \"x\") {\n\t\t\tconst paxPath = parsePaxPath(data);\n\t\t\tif (paxPath !== undefined) pendingPath = paxPath;\n\t\t\toffset = paddedEnd;\n\t\t\tcontinue;\n\t\t}\n\t\tif (typeflag === \"g\") {\n\t\t\toffset = paddedEnd;\n\t\t\tcontinue;\n\t\t}\n\t\t// Hard links ('1') and symlinks ('2') are rejected like ZIP symlink entries.\n\t\tif (typeflag === \"1\" || typeflag === \"2\") throw new NodePackageInstallErrorV1(\"archive_invalid\");\n\t\tif (typeflag !== \"\\0\" && typeflag !== \"0\" && typeflag !== \"5\")\n\t\t\tthrow new NodePackageInstallErrorV1(\"archive_invalid\");\n\t\tlet rawName = pendingPath ?? headerEntryName(header);\n\t\tpendingPath = undefined;\n\t\tif (typeflag === \"5\" && !rawName.endsWith(\"/\")) rawName += \"/\";\n\t\tconst normalized = normalizedEntryName(rawName);\n\t\tif (normalized.directory && size !== 0) throw new NodePackageInstallErrorV1(\"archive_invalid\");\n\t\tif (names.has(normalized.name)) throw new NodePackageInstallErrorV1(\"archive_invalid\");\n\t\tnames.add(normalized.name);\n\t\tif (entries.length + 1 > limits.maxEntries) throw new NodePackageInstallErrorV1(\"archive_budget_exceeded\");\n\t\tconst bytes = normalized.directory ? new Uint8Array() : new Uint8Array(data);\n\t\textractedBytes += bytes.byteLength;\n\t\tif (extractedBytes > limits.maxExtractedBytes) throw new NodePackageInstallErrorV1(\"archive_budget_exceeded\");\n\t\tentries.push(Object.freeze({ name: normalized.name, directory: normalized.directory, bytes }));\n\t\toffset = paddedEnd;\n\t}\n\t// The archive ended without the two-block EOF marker.\n\tthrow new NodePackageInstallErrorV1(\"archive_invalid\");\n}\n\n/**\n * npm tarballs root every entry below a single literal `package/` directory,\n * while ZIP packages carry their manifests at the archive root. When every\n * entry shares exactly that one leading directory segment, strip the one\n * layer so npm tgz artifacts land in the same normalized shape as ZIP\n * artifacts. Any other layout — including root-level entries and arbitrary\n * nested directories — is returned unchanged.\n */\nfunction stripNpmPackageRoot(entries: readonly NodeZipPackageEntryV1[]): readonly NodeZipPackageEntryV1[] {\n\tif (entries.length === 0) return entries;\n\tconst rootSegment = entries[0]!.name.split(\"/\")[0]!;\n\tif (rootSegment !== \"package\") return entries;\n\tconst sharesRoot = (entry: NodeZipPackageEntryV1): boolean => {\n\t\tif (entry.name === rootSegment) return entry.directory;\n\t\tconst parts = entry.name.split(\"/\");\n\t\treturn parts.length >= 2 && parts[0] === rootSegment;\n\t};\n\tif (!entries.every(sharesRoot)) return entries;\n\tconst stripped: NodeZipPackageEntryV1[] = [];\n\tfor (const entry of entries) {\n\t\tif (entry.name === rootSegment) continue;\n\t\tstripped.push(Object.freeze({ ...entry, name: entry.name.slice(rootSegment.length + 1) }));\n\t}\n\treturn Object.freeze(stripped);\n}\n\n/**\n * Parse a gzip-compressed tar package into the same normalized entry shape as\n * {@link parseNodeZipPackageV1}, sharing its name normalization, budgets, and\n * structured errors. The gzip layer is decompressed streaming with a hard\n * extracted-bytes cap; the tar layer accepts only ustar-style headers with\n * valid checksums, rejects links and non-regular types, and supports GNU long\n * names ('L'), pax path records ('x'), and skipped global headers ('g').\n */\nexport async function parseNodeTarGzPackageV1(\n\tinput: Uint8Array,\n\tlimitsInput: NodeZipPackageLimitsV1 = {},\n): Promise<readonly NodeZipPackageEntryV1[]> {\n\tif (!(input instanceof Uint8Array)) throw new NodePackageInstallErrorV1(\"archive_invalid\");\n\tconst limits = resolveNodePackageLimitsV1(limitsInput);\n\tif (input.byteLength > limits.maxArchiveBytes) throw new NodePackageInstallErrorV1(\"archive_budget_exceeded\");\n\tconst tar = await gunzipBounded(input, limits.maxExtractedBytes);\n\treturn stripNpmPackageRoot(parseTarEntries(tar, limits));\n}\n"]}