@ai-agent-forge/agent-forge 0.86.7 → 0.88.0

package/dist/plugins/ecosystem/node-distribution-host.js

@@ -3,6 +3,7 @@ import { createReadStream } from "node:fs";
 import { mkdir, mkdtemp, open, rename, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { isAbsolute, join } from "node:path";
+import { t } from "../../core/i18n/index.js";
 import { createPluginDistributionV1 } from "./distribution.js";
 import { createNodePluginTrustRootV1 } from "./node-plugin-trust-root.js";
 const NODE_DISTRIBUTION_HOST_VERSION_V1 = 1;
@@ -12,20 +13,20 @@ const DEFAULT_REDIRECTS_V1 = 3;
 const MAX_REDIRECTS_V1 = 5;
 const REDIRECT_STATUS = new Set([301, 302, 303, 307, 308]);
 function cancelledRequestError() {
-    const error = new Error("plugin request was cancelled");
+    const error = new Error(t("plugin request was cancelled"));
     error.name = "AbortError";
     return error;
 }
 function throwIfRequestCancelled(request) {
     if (request.timedOut())
-        throw new Error("plugin request timed out");
+        throw new Error(t("plugin request timed out"));
     if (request.signal.aborted)
         throw cancelledRequestError();
 }
 function boundedPositive(value, fallback, maximum, label) {
     const result = value ?? fallback;
     if (!Number.isSafeInteger(result) || result <= 0 || result > maximum)
-        throw new Error(`${label} must be a positive integer at most ${maximum}`);
+        throw new Error(t("{label} must be a positive integer at most {maximum}", { label, maximum }));
     return result;
 }
 function allowedOrigin(value) {
@@ -34,12 +35,12 @@ function allowedOrigin(value) {
         parsed = new URL(value);
     }
     catch {
-        throw new Error("allowed origin is invalid");
+        throw new Error(t("allowed origin is invalid"));
     }
     if ((parsed.protocol !== "http:" && parsed.protocol !== "https:") || parsed.username || parsed.password)
-        throw new Error("allowed origin must be an http(s) origin");
+        throw new Error(t("allowed origin must be an http(s) origin"));
     if (parsed.pathname !== "/" || parsed.search !== "" || parsed.hash !== "")
-        throw new Error("allowed origin must not include a path or query");
+        throw new Error(t("allowed origin must not include a path or query"));
     return parsed.origin;
 }
 function requestUrl(value, origins) {
@@ -48,12 +49,12 @@ function requestUrl(value, origins) {
         parsed = new URL(value);
     }
     catch {
-        throw new Error("plugin source URL is invalid");
+        throw new Error(t("plugin source URL is invalid"));
     }
     if ((parsed.protocol !== "http:" && parsed.protocol !== "https:") || parsed.username || parsed.password)
-        throw new Error("plugin source URL must use http(s) without credentials");
+        throw new Error(t("plugin source URL must use http(s) without credentials"));
     if (!origins.has(parsed.origin))
-        throw new Error("plugin source origin is not allowed");
+        throw new Error(t("plugin source origin is not allowed"));
     return parsed;
 }
 function requestSignal(parent, timeoutMs) {
@@ -82,10 +83,10 @@ function contentLength(response) {
     if (value === null)
         return undefined;
     if (!/^\d+$/u.test(value))
-        throw new Error("plugin response content length is invalid");
+        throw new Error(t("plugin response content length is invalid"));
     const result = Number(value);
     if (!Number.isSafeInteger(result))
-        throw new Error("plugin response content length is invalid");
+        throw new Error(t("plugin response content length is invalid"));
     return result;
 }
 function contentType(response) {
@@ -97,10 +98,10 @@ function contentType(response) {
 function assertResponseMetadata(response, descriptor) {
     const length = contentLength(response);
     if (length !== descriptor.sizeBytes)
-        throw new Error("plugin response size mismatch");
+        throw new Error(t("plugin response size mismatch"));
     const mediaType = contentType(response);
     if (mediaType !== descriptor.mediaType.toLowerCase())
-        throw new Error("plugin response media type mismatch");
+        throw new Error(t("plugin response media type mismatch"));
 }
 async function cancelBody(response) {
     if (response.body !== null)
@@ -118,7 +119,7 @@ function expectedDigest(value) {
         return { algorithm: "sha256", hex: value.toLowerCase() };
     if (/^[0-9a-f]{128}$/iu.test(value))
         return { algorithm: "sha512", hex: value.toLowerCase() };
-    throw new Error("plugin artifact digest algorithm is unsupported");
+    throw new Error(t("plugin artifact digest algorithm is unsupported"));
 }
 function metadataFromDescriptor(descriptor) {
     return {
@@ -149,7 +150,7 @@ async function writeFully(file, chunk) {
     while (offset < chunk.byteLength) {
         const result = await file.write(chunk, offset, chunk.byteLength - offset, null);
         if (result.bytesWritten <= 0)
-            throw new Error("plugin artifact file write failed");
+            throw new Error(t("plugin artifact file write failed"));
         offset += result.bytesWritten;
     }
 }
@@ -161,20 +162,20 @@ async function writeFully(file, chunk) {
 export async function createNodeHttpPluginDistributionHostV1(options) {
     const transport = options.fetch ?? globalThis.fetch;
     if (typeof transport !== "function")
-        throw new Error("Node fetch is unavailable");
+        throw new Error(t("Node fetch is unavailable"));
     if (!Array.isArray(options.allowedOrigins) || options.allowedOrigins.length === 0)
-        throw new Error("at least one allowed origin is required");
+        throw new Error(t("at least one allowed origin is required"));
     const origins = new Set(options.allowedOrigins.map(allowedOrigin));
     const timeoutMs = boundedPositive(options.requestTimeoutMs, DEFAULT_TIMEOUT_MS_V1, MAX_TIMEOUT_MS_V1, "requestTimeoutMs");
     const maxRedirects = options.maxRedirects ?? DEFAULT_REDIRECTS_V1;
     if (!Number.isSafeInteger(maxRedirects) || maxRedirects < 0 || maxRedirects > MAX_REDIRECTS_V1)
-        throw new Error(`maxRedirects must be an integer between 0 and ${MAX_REDIRECTS_V1}`);
+        throw new Error(t("maxRedirects must be an integer between 0 and {max}", { max: MAX_REDIRECTS_V1 }));
     const userAgent = options.userAgent ?? "agent-forge-plugin-distribution/1";
     if (userAgent.length === 0 || userAgent.length > 256 || /[\r\n]/u.test(userAgent))
-        throw new Error("userAgent is invalid");
+        throw new Error(t("userAgent is invalid"));
     const configuredDirectory = options.artifactDirectory;
     if (configuredDirectory !== undefined && !isAbsolute(configuredDirectory))
-        throw new Error("artifactDirectory must be absolute");
+        throw new Error(t("artifactDirectory must be absolute"));
     const baseDirectoryPromise = configuredDirectory === undefined
         ? mkdtemp(join(tmpdir(), "agent-forge-plugin-distribution-"))
         : (async () => {
@@ -188,7 +189,7 @@ export async function createNodeHttpPluginDistributionHostV1(options) {
     let closed = false;
     const assertOpen = () => {
         if (closed)
-            throw new Error("plugin distribution host is closed");
+            throw new Error(t("plugin distribution host is closed"));
     };
     const beginOperation = () => {
         assertOpen();
@@ -237,7 +238,7 @@ export async function createNodeHttpPluginDistributionHostV1(options) {
             await cancelBody(response);
             request.cleanup();
             if (location === null || redirect >= maxRedirects)
-                throw new Error("plugin redirect limit exceeded");
+                throw new Error(t("plugin redirect limit exceeded"));
             current = requestUrl(new URL(location, current).toString(), origins);
         }
     };
@@ -247,7 +248,7 @@ export async function createNodeHttpPluginDistributionHostV1(options) {
             const { response, request } = await fetchResponse(input.descriptor.source, "HEAD", input.signal, operation.signal);
             try {
                 if (response.status < 200 || response.status >= 300)
-                    throw new Error("plugin metadata request failed");
+                    throw new Error(t("plugin metadata request failed"));
                 assertResponseMetadata(response, input.descriptor);
                 return metadataFromDescriptor(input.descriptor);
             }
@@ -271,10 +272,10 @@ export async function createNodeHttpPluginDistributionHostV1(options) {
             let file;
             try {
                 if (response.status < 200 || response.status >= 300)
-                    throw new Error("plugin artifact request failed");
+                    throw new Error(t("plugin artifact request failed"));
                 assertResponseMetadata(response, input.descriptor);
                 if (response.body === null)
-                    throw new Error("plugin artifact response has no body");
+                    throw new Error(t("plugin artifact response has no body"));
                 const directory = await baseDirectoryPromise;
                 temporaryPath = join(directory, `.partial-${randomUUID()}`);
                 finalPath = join(directory, `artifact-${randomUUID()}`);
@@ -291,7 +292,7 @@ export async function createNodeHttpPluginDistributionHostV1(options) {
                         const chunk = item.value;
                         total += chunk.byteLength;
                         if (total > input.descriptor.sizeBytes)
-                            throw new Error("plugin artifact exceeds its size limit");
+                            throw new Error(t("plugin artifact exceeds its size limit"));
                         hash.update(chunk);
                         await writeFully(file, chunk);
                     }
@@ -301,9 +302,9 @@ export async function createNodeHttpPluginDistributionHostV1(options) {
                 }
                 throwIfRequestCancelled(request);
                 if (total !== input.descriptor.sizeBytes)
-                    throw new Error("plugin artifact size mismatch");
+                    throw new Error(t("plugin artifact size mismatch"));
                 if (hash.digest("hex") !== digest.hex)
-                    throw new Error("plugin artifact digest mismatch");
+                    throw new Error(t("plugin artifact digest mismatch"));
                 await file.close();
                 file = undefined;
                 await rename(temporaryPath, finalPath);
@@ -340,12 +341,12 @@ export async function createNodeHttpPluginDistributionHostV1(options) {
     const releaseArtifact = async (input) => {
         assertOpen();
         if (input.signal?.aborted)
-            throw new Error("plugin artifact release was cancelled");
+            throw new Error(t("plugin artifact release was cancelled"));
         const record = artifacts.get(input.artifact.artifactRef);
         if (record === undefined)
-            throw new Error("plugin artifact reference is unknown");
+            throw new Error(t("plugin artifact reference is unknown"));
         if (record.readers > 0)
-            throw new Error("plugin artifact is still being read");
+            throw new Error(t("plugin artifact is still being read"));
         await rm(record.path, { force: false });
         artifacts.delete(input.artifact.artifactRef);
     };
@@ -356,10 +357,10 @@ export async function createNodeHttpPluginDistributionHostV1(options) {
         const abort = () => stream?.destroy(new Error("plugin artifact read was cancelled"));
         try {
             if (input.signal?.aborted)
-                throw new Error("plugin artifact read was cancelled");
+                throw new Error(t("plugin artifact read was cancelled"));
             const record = artifacts.get(input.artifact.artifactRef);
             if (record === undefined || !artifactMatchesDescriptor(input.artifact, record.descriptor))
-                throw new Error("plugin artifact reference is unknown");
+                throw new Error(t("plugin artifact reference is unknown"));
             record.readers += 1;
             acquiredRecord = record;
             stream = createReadStream(record.path, { highWaterMark: 64 * 1024 });
@@ -367,7 +368,7 @@ export async function createNodeHttpPluginDistributionHostV1(options) {
             operation.signal.addEventListener("abort", abort, { once: true });
             for await (const chunk of stream) {
                 if (input.signal?.aborted || operation.signal.aborted)
-                    throw new Error("plugin artifact read was cancelled");
+                    throw new Error(t("plugin artifact read was cancelled"));
                 yield new Uint8Array(chunk);
             }
         }

package/dist/plugins/ecosystem/node-distribution-host.js.map

@@ -1 +1 @@
-{"version":3,"file":"node-distribution-host.js","sourceRoot":"","sources":["../../../src/plugins/ecosystem/node-distribution-host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAS7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,2BAA2B,EAAqC,MAAM,6BAA6B,CAAC;AAE7G,MAAM,iCAAiC,GAAG,CAAU,CAAC;AACrD,MAAM,qBAAqB,GAAG,MAAM,CAAC;AACrC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAClC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAC3B,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAwD3D,SAAS,qBAAqB,GAAU;IACvC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACxD,KAAK,CAAC,IAAI,GAAG,YAAY,CAAC;IAC1B,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,uBAAuB,CAAC,OAAsB,EAAQ;IAC9D,IAAI,OAAO,CAAC,QAAQ,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,qBAAqB,EAAE,CAAC;AAAA,CAC1D;AAED,SAAS,eAAe,CAAC,KAAyB,EAAE,QAAgB,EAAE,OAAe,EAAE,KAAa,EAAU;IAC7G,MAAM,MAAM,GAAG,KAAK,IAAI,QAAQ,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,MAAM,GAAG,OAAO;QACnE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,uCAAuC,OAAO,EAAE,CAAC,CAAC;IAC3E,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,aAAa,CAAC,KAAa,EAAU;IAC7C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ;QACtG,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE;QACxE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC,MAAM,CAAC;AAAA,CACrB;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,OAA4B,EAAO;IACrE,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ;QACtG,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC3E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACxF,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,aAAa,CAAC,MAA+B,EAAE,SAAiB,EAAiB;IACzF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrD,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI;QAAE,KAAK,EAAE,CAAC;;QACjC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC;QAChC,UAAU,GAAG,IAAI,CAAC;QAClB,UAAU,CAAC,KAAK,EAAE,CAAC;IAAA,CACnB,EAAE,SAAS,CAAC,CAAC;IACd,OAAO;QACN,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,QAAQ,EAAE,GAAG,EAAE,CAAC,UAAU;QAC1B,OAAO,EAAE,GAAG,EAAE,CAAC;YACd,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAAA,CAC5C;KACD,CAAC;AAAA,CACF;AAED,SAAS,aAAa,CAAC,QAAkB,EAAsB;IAC9D,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACrD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAChG,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,WAAW,CAAC,QAAkB,EAAsB;IAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACrC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC;AAAA,CACjE;AAED,SAAS,sBAAsB,CAAC,QAAkB,EAAE,UAA0C,EAAQ;IACrG,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,MAAM,KAAK,UAAU,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACtF,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,SAAS,KAAK,UAAU,CAAC,SAAS,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;AAAA,CAC7G;AAED,KAAK,UAAU,UAAU,CAAC,QAAkB,EAAiB;IAC5D,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;QAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAAA,CAChF;AAED,SAAS,cAAc,CAAC,KAAa,EAAqE;IACzG,MAAM,QAAQ,GAAG,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACvC,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,EAAE,MAAM,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,EAAE,MAAM,KAAK,GAAG,CAAC;YACpG,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;IAC7F,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;IAC9F,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;AAAA,CACnE;AAED,SAAS,sBAAsB,CAAC,UAA0C,EAAgC;IACzG,OAAO;QACN,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,SAAS,EAAE,UAAU,CAAC,SAAS;KAC/B,CAAC;AAAA,CACF;AAED,SAAS,yBAAyB,CACjC,QAAsC,EACtC,UAA0C,EAChC;IACV,OAAO,CACN,QAAQ,CAAC,OAAO,KAAK,CAAC;QACtB,QAAQ,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ;QACzC,QAAQ,CAAC,aAAa,KAAK,UAAU,CAAC,aAAa;QACnD,QAAQ,CAAC,cAAc,KAAK,UAAU,CAAC,cAAc;QACrD,QAAQ,CAAC,cAAc,KAAK,UAAU,CAAC,cAAc;QACrD,QAAQ,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS;QAC3C,QAAQ,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS;QAC3C,QAAQ,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;QACrC,QAAQ,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS,CAC3C,CAAC;AAAA,CACF;AAED,KAAK,UAAU,UAAU,CAAC,IAAsC,EAAE,KAAiB,EAAiB;IACnG,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC;QAChF,IAAI,MAAM,CAAC,YAAY,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnF,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC;IAC/B,CAAC;AAAA,CACD;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC3D,OAAgD,EACJ;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACpD,IAAI,OAAO,SAAS,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAClF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,eAAe,CAChC,OAAO,CAAC,gBAAgB,EACxB,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,CAClB,CAAC;IACF,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,oBAAoB,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,CAAC,IAAI,YAAY,GAAG,gBAAgB;QAC7F,MAAM,IAAI,KAAK,CAAC,iDAAiD,gBAAgB,EAAE,CAAC,CAAC;IACtF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,mCAAmC,CAAC;IAC3E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACzC,MAAM,mBAAmB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IACtD,IAAI,mBAAmB,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACvD,MAAM,oBAAoB,GACzB,mBAAmB,KAAK,SAAS;QAChC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kCAAkC,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACb,MAAM,KAAK,CAAC,mBAAmB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CAAC,CAAC;QAAA,CACpF,CAAC,EAAE,CAAC;IACR,MAAM,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC;IACpD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAmB,CAAC;IACpD,IAAI,iBAA2C,CAAC;IAChD,IAAI,YAAuC,CAAC;IAC5C,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,MAAM,UAAU,GAAG,GAAS,EAAE,CAAC;QAC9B,IAAI,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAAA,CAClE,CAAC;IAEF,MAAM,cAAc,GAAG,GAAoB,EAAE,CAAC;QAC7C,UAAU,EAAE,CAAC;QACb,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,OAAO,UAAU,CAAC;IAAA,CAClB,CAAC;IAEF,MAAM,YAAY,GAAG,CAAC,UAA2B,EAAQ,EAAE,CAAC;QAC3D,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,gBAAgB,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACjC,iBAAiB,EAAE,EAAE,CAAC;YACtB,iBAAiB,GAAG,SAAS,CAAC;QAC/B,CAAC;IAAA,CACD,CAAC;IAEF,MAAM,iBAAiB,GAAG,KAAK,IAAmB,EAAE,CAAC;QACpD,IAAI,gBAAgB,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QACxC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACpC,iBAAiB,GAAG,OAAO,CAAC;QAAA,CAC5B,CAAC,CAAC;IAAA,CACH,CAAC;IAEF,MAAM,aAAa,GAAG,KAAK,EAC1B,KAAa,EACb,MAAsB,EACtB,YAAqC,EACrC,eAA4B,EACgD,EAAE,CAAC;QAC/E,IAAI,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACzC,KAAK,IAAI,QAAQ,GAAG,CAAC,GAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YACxC,IAAI,eAAe,CAAC,OAAO;gBAAE,MAAM,qBAAqB,EAAE,CAAC;YAC3D,UAAU,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,aAAa,CAC5B,WAAW,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC,MAAM,CAAC,OAAO,CAAkB,CAAC,EACjF,SAAS,CACT,CAAC;YACF,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACJ,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE;oBAC9C,MAAM;oBACN,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE;oBACnD,QAAQ,EAAE,QAAQ;oBAClB,MAAM,EAAE,OAAO,CAAC,MAAM;iBACtB,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,OAAO,CAAC,OAAO,EAAE,CAAC;gBAClB,uBAAuB,CAAC,OAAO,CAAC,CAAC;gBACjC,MAAM,KAAK,CAAC;YACb,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YACxE,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC3B,OAAO,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,IAAI,YAAY;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACrG,OAAO,GAAG,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;QACtE,CAAC;IAAA,CACD,CAAC;IAEF,MAAM,eAAe,GAAG,KAAK,EAAE,KAG9B,EAAyC,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,cAAc,EAAE,CAAC;QACnC,IAAI,CAAC;YACJ,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,CAChD,KAAK,CAAC,UAAU,CAAC,MAAM,EACvB,MAAM,EACN,KAAK,CAAC,MAAM,EACZ,SAAS,CAAC,MAAM,CAChB,CAAC;YACF,IAAI,CAAC;gBACJ,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;oBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;gBACvG,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;gBACnD,OAAO,sBAAsB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACjD,CAAC;oBAAS,CAAC;gBACV,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC3B,OAAO,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC;QACF,CAAC;gBAAS,CAAC;YACV,YAAY,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;IAAA,CACD,CAAC;IAEF,MAAM,eAAe,GAAG,KAAK,EAAE,KAI9B,EAA+C,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,cAAc,EAAE,CAAC;QACnC,IAAI,aAAiC,CAAC;QACtC,IAAI,SAA6B,CAAC;QAClC,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;YAC/D,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,CAChD,KAAK,CAAC,UAAU,CAAC,MAAM,EACvB,KAAK,EACL,KAAK,CAAC,MAAM,EACZ,SAAS,CAAC,MAAM,CAChB,CAAC;YACF,IAAI,IAAkD,CAAC;YACvD,IAAI,CAAC;gBACJ,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;oBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;gBACvG,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;gBACnD,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;gBACpF,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC;gBAC7C,aAAa,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,UAAU,EAAE,EAAE,CAAC,CAAC;gBAC5D,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,UAAU,EAAE,EAAE,CAAC,CAAC;gBACxD,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;gBACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACzC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC1C,IAAI,KAAK,GAAG,CAAC,CAAC;gBACd,IAAI,CAAC;oBACJ,SAAS,CAAC;wBACT,uBAAuB,CAAC,OAAO,CAAC,CAAC;wBACjC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;wBACjC,IAAI,IAAI,CAAC,IAAI;4BAAE,MAAM;wBACrB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;wBACzB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;wBAC1B,IAAI,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,SAAS;4BAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;wBAClG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;wBACnB,MAAM,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBAC/B,CAAC;gBACF,CAAC;wBAAS,CAAC;oBACV,MAAM,CAAC,WAAW,EAAE,CAAC;gBACtB,CAAC;gBACD,uBAAuB,CAAC,OAAO,CAAC,CAAC;gBACjC,IAAI,KAAK,KAAK,KAAK,CAAC,UAAU,CAAC,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;gBAC3F,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,GAAG;oBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBAC1F,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;gBACnB,IAAI,GAAG,SAAS,CAAC;gBACjB,MAAM,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;gBACvC,UAAU,EAAE,CAAC;gBACb,MAAM,WAAW,GAAG,wBAAwB,UAAU,EAAE,EAAE,CAAC;gBAC3D,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC1F,SAAS,GAAG,IAAI,CAAC;gBACjB,OAAO;oBACN,WAAW;oBACX,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;oBAC/C,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS;oBACrC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS;iBACrC,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,uBAAuB,CAAC,OAAO,CAAC,CAAC;gBACjC,MAAM,KAAK,CAAC;YACb,CAAC;oBAAS,CAAC;gBACV,IAAI,IAAI,KAAK,SAAS;oBAAE,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClE,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC3B,OAAO,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC;QACF,CAAC;gBAAS,CAAC;YACV,IAAI,aAAa,KAAK,SAAS;gBAAE,MAAM,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACjG,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,SAAS;gBAAE,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACvG,YAAY,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;IAAA,CACD,CAAC;IAEF,MAAM,eAAe,GAAG,KAAK,EAAE,KAG9B,EAAiB,EAAE,CAAC;QACpB,UAAU,EAAE,CAAC;QACb,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACpF,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAClF,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC/E,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACxC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAAA,CAC7C,CAAC;IAEF,MAAM,YAAY,GAAG,CAAC,KAGrB,EAA6B,EAAE,CAC/B,CAAC,KAAK,SAAS,CAAC,IAAgC;QAC/C,MAAM,SAAS,GAAG,cAAc,EAAE,CAAC;QACnC,IAAI,MAAuD,CAAC;QAC5D,IAAI,cAA0C,CAAC;QAC/C,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC;YACJ,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACjF,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACzD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;gBACxF,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YACzD,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;YACpB,cAAc,GAAG,MAAM,CAAC;YACxB,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;YACrE,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAClE,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAClC,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO;oBACpD,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;gBACvD,MAAM,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC;QACF,CAAC;gBAAS,CAAC;YACV,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAClD,SAAS,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrD,MAAM,EAAE,OAAO,EAAE,CAAC;YAClB,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,CAAC,OAAO,GAAG,CAAC;gBAAE,cAAc,CAAC,OAAO,IAAI,CAAC,CAAC;YAC5F,YAAY,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;IAAA,CACD,CAAC,EAAE,CAAC;IAEN,OAAO;QACN,OAAO,EAAE,iCAAiC;QAC1C,IAAI,EAAE,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE;QAC3D,YAAY;QACZ,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC;YAClB,IAAI,YAAY,KAAK,SAAS;gBAAE,OAAO,MAAM,YAAY,CAAC;YAC1D,MAAM,GAAG,IAAI,CAAC;YACd,KAAK,MAAM,SAAS,IAAI,gBAAgB;gBAAE,SAAS,CAAC,KAAK,EAAE,CAAC;YAC5D,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3B,MAAM,iBAAiB,EAAE,CAAC;gBAC1B,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC;gBAC7C,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC7F,SAAS,CAAC,KAAK,EAAE,CAAC;gBAClB,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAAA,CACtD,CAAC,EAAE,CAAC;YACL,OAAO,MAAM,YAAY,CAAC;QAAA,CAC1B;KACD,CAAC;AAAA,CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC5D,OAAiD,EACJ;IAC7C,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,sCAAsC,CAAC,WAAW,CAAC,CAAC;IACvE,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,aAAa,IAAI,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACjE,MAAM,eAAe,GAAG,2BAA2B,CAAC,EAAE,GAAG,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3E,MAAM,YAAY,GAAG,0BAA0B,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3F,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,KAAK,CAAC;IACb,CAAC;AAAA,CACD","sourcesContent":["import { createHash, randomUUID } from \"node:crypto\";\nimport { createReadStream } from \"node:fs\";\nimport { mkdir, mkdtemp, open, rename, rm } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { isAbsolute, join } from \"node:path\";\nimport type {\n\tPluginDistributionArtifactHandleV1,\n\tPluginDistributionArtifactV1,\n\tPluginDistributionDescriptorV1,\n\tPluginDistributionHostV1,\n\tPluginDistributionMetadataV1,\n\tPluginDistributionV1,\n} from \"./distribution.ts\";\nimport { createPluginDistributionV1 } from \"./distribution.ts\";\nimport { createNodePluginTrustRootV1, type NodePluginTrustRootOptionsV1 } from \"./node-plugin-trust-root.ts\";\n\nconst NODE_DISTRIBUTION_HOST_VERSION_V1 = 1 as const;\nconst DEFAULT_TIMEOUT_MS_V1 = 30_000;\nconst MAX_TIMEOUT_MS_V1 = 120_000;\nconst DEFAULT_REDIRECTS_V1 = 3;\nconst MAX_REDIRECTS_V1 = 5;\nconst REDIRECT_STATUS = new Set([301, 302, 303, 307, 308]);\n\nexport interface NodeHttpPluginDistributionHostOptionsV1 {\n\t/** Real `fetch` or a deterministic replacement for tests. */\n\treadonly fetch?: typeof globalThis.fetch;\n\t/** Exact `http(s)` origins. An empty allowlist is rejected. */\n\treadonly allowedOrigins: readonly string[];\n\t/** Optional host-owned directory. It is never returned as an artifact reference. */\n\treadonly artifactDirectory?: string;\n\treadonly requestTimeoutMs?: number;\n\treadonly maxRedirects?: number;\n\treadonly userAgent?: string;\n}\n\nexport interface NodeHttpPluginDistributionHostV1 {\n\treadonly version: typeof NODE_DISTRIBUTION_HOST_VERSION_V1;\n\treadonly host: PluginDistributionHostV1;\n\t/**\n\t * Private Node-host reader for an installer that shares this host instance.\n\t * It is not part of the model-facing distribution contract and never exposes\n\t * a file path. The caller must consume it before releasing the artifact.\n\t */\n\treadonly openArtifact: (input: {\n\t\treadonly artifact: PluginDistributionArtifactV1;\n\t\treadonly signal?: AbortSignal;\n\t}) => AsyncIterable<Uint8Array>;\n\t/** Remove all artifacts owned by this host instance. */\n\treadonly close: () => Promise<void>;\n}\n\n/**\n * Explicitly composed Node distribution stack. The caller supplies the trust\n * root; no key or network origin is discovered implicitly.\n */\nexport interface NodeHttpPluginDistributionStackOptionsV1 extends NodeHttpPluginDistributionHostOptionsV1 {\n\treadonly trustRoot: NodePluginTrustRootOptionsV1;\n\t/** Shared clock for descriptor expiry and trust-key validity. */\n\treadonly now?: () => number;\n}\n\nexport interface NodeHttpPluginDistributionStackV1 extends NodeHttpPluginDistributionHostV1 {\n\treadonly distribution: PluginDistributionV1;\n}\n\ninterface ArtifactRecord {\n\treadonly path: string;\n\treadonly descriptor: PluginDistributionDescriptorV1;\n\treaders: number;\n}\n\ninterface RequestSignal {\n\treadonly signal: AbortSignal;\n\treadonly timedOut: () => boolean;\n\treadonly cleanup: () => void;\n}\n\nfunction cancelledRequestError(): Error {\n\tconst error = new Error(\"plugin request was cancelled\");\n\terror.name = \"AbortError\";\n\treturn error;\n}\n\nfunction throwIfRequestCancelled(request: RequestSignal): void {\n\tif (request.timedOut()) throw new Error(\"plugin request timed out\");\n\tif (request.signal.aborted) throw cancelledRequestError();\n}\n\nfunction boundedPositive(value: number | undefined, fallback: number, maximum: number, label: string): number {\n\tconst result = value ?? fallback;\n\tif (!Number.isSafeInteger(result) || result <= 0 || result > maximum)\n\t\tthrow new Error(`${label} must be a positive integer at most ${maximum}`);\n\treturn result;\n}\n\nfunction allowedOrigin(value: string): string {\n\tlet parsed: URL;\n\ttry {\n\t\tparsed = new URL(value);\n\t} catch {\n\t\tthrow new Error(\"allowed origin is invalid\");\n\t}\n\tif ((parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") || parsed.username || parsed.password)\n\t\tthrow new Error(\"allowed origin must be an http(s) origin\");\n\tif (parsed.pathname !== \"/\" || parsed.search !== \"\" || parsed.hash !== \"\")\n\t\tthrow new Error(\"allowed origin must not include a path or query\");\n\treturn parsed.origin;\n}\n\nfunction requestUrl(value: string, origins: ReadonlySet<string>): URL {\n\tlet parsed: URL;\n\ttry {\n\t\tparsed = new URL(value);\n\t} catch {\n\t\tthrow new Error(\"plugin source URL is invalid\");\n\t}\n\tif ((parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") || parsed.username || parsed.password)\n\t\tthrow new Error(\"plugin source URL must use http(s) without credentials\");\n\tif (!origins.has(parsed.origin)) throw new Error(\"plugin source origin is not allowed\");\n\treturn parsed;\n}\n\nfunction requestSignal(parent: AbortSignal | undefined, timeoutMs: number): RequestSignal {\n\tconst controller = new AbortController();\n\tlet didTimeout = false;\n\tconst abort = () => controller.abort(parent?.reason);\n\tif (parent?.aborted === true) abort();\n\telse parent?.addEventListener(\"abort\", abort, { once: true });\n\tconst timeout = setTimeout(() => {\n\t\tdidTimeout = true;\n\t\tcontroller.abort();\n\t}, timeoutMs);\n\treturn {\n\t\tsignal: controller.signal,\n\t\ttimedOut: () => didTimeout,\n\t\tcleanup: () => {\n\t\t\tclearTimeout(timeout);\n\t\t\tparent?.removeEventListener(\"abort\", abort);\n\t\t},\n\t};\n}\n\nfunction contentLength(response: Response): number | undefined {\n\tconst value = response.headers.get(\"content-length\");\n\tif (value === null) return undefined;\n\tif (!/^\\d+$/u.test(value)) throw new Error(\"plugin response content length is invalid\");\n\tconst result = Number(value);\n\tif (!Number.isSafeInteger(result)) throw new Error(\"plugin response content length is invalid\");\n\treturn result;\n}\n\nfunction contentType(response: Response): string | undefined {\n\tconst value = response.headers.get(\"content-type\");\n\tif (value === null) return undefined;\n\treturn value.split(\";\", 1)[0]?.trim().toLowerCase() || undefined;\n}\n\nfunction assertResponseMetadata(response: Response, descriptor: PluginDistributionDescriptorV1): void {\n\tconst length = contentLength(response);\n\tif (length !== descriptor.sizeBytes) throw new Error(\"plugin response size mismatch\");\n\tconst mediaType = contentType(response);\n\tif (mediaType !== descriptor.mediaType.toLowerCase()) throw new Error(\"plugin response media type mismatch\");\n}\n\nasync function cancelBody(response: Response): Promise<void> {\n\tif (response.body !== null) await response.body.cancel().catch(() => undefined);\n}\n\nfunction expectedDigest(value: string): { readonly algorithm: \"sha256\" | \"sha512\"; readonly hex: string } {\n\tconst prefixed = /^(sha256|sha512):([0-9a-f]+)$/iu.exec(value);\n\tif (prefixed !== null) {\n\t\tconst algorithm = prefixed[1]?.toLowerCase();\n\t\tconst hex = prefixed[2]?.toLowerCase();\n\t\tif ((algorithm === \"sha256\" && hex?.length === 64) || (algorithm === \"sha512\" && hex?.length === 128))\n\t\t\treturn { algorithm, hex };\n\t}\n\tif (/^[0-9a-f]{64}$/iu.test(value)) return { algorithm: \"sha256\", hex: value.toLowerCase() };\n\tif (/^[0-9a-f]{128}$/iu.test(value)) return { algorithm: \"sha512\", hex: value.toLowerCase() };\n\tthrow new Error(\"plugin artifact digest algorithm is unsupported\");\n}\n\nfunction metadataFromDescriptor(descriptor: PluginDistributionDescriptorV1): PluginDistributionMetadataV1 {\n\treturn {\n\t\tversion: 1,\n\t\tsource: descriptor.source,\n\t\tpluginId: descriptor.pluginId,\n\t\tpluginVersion: descriptor.pluginVersion,\n\t\tmanifestDigest: descriptor.manifestDigest,\n\t\tartifactDigest: descriptor.artifactDigest,\n\t\texpiresAt: descriptor.expiresAt,\n\t\tsizeBytes: descriptor.sizeBytes,\n\t\tmediaType: descriptor.mediaType,\n\t};\n}\n\nfunction artifactMatchesDescriptor(\n\tartifact: PluginDistributionArtifactV1,\n\tdescriptor: PluginDistributionDescriptorV1,\n): boolean {\n\treturn (\n\t\tartifact.version === 1 &&\n\t\tartifact.pluginId === descriptor.pluginId &&\n\t\tartifact.pluginVersion === descriptor.pluginVersion &&\n\t\tartifact.manifestDigest === descriptor.manifestDigest &&\n\t\tartifact.artifactDigest === descriptor.artifactDigest &&\n\t\tartifact.sizeBytes === descriptor.sizeBytes &&\n\t\tartifact.mediaType === descriptor.mediaType &&\n\t\tartifact.source === descriptor.source &&\n\t\tartifact.expiresAt === descriptor.expiresAt\n\t);\n}\n\nasync function writeFully(file: Awaited<ReturnType<typeof open>>, chunk: Uint8Array): Promise<void> {\n\tlet offset = 0;\n\twhile (offset < chunk.byteLength) {\n\t\tconst result = await file.write(chunk, offset, chunk.byteLength - offset, null);\n\t\tif (result.bytesWritten <= 0) throw new Error(\"plugin artifact file write failed\");\n\t\toffset += result.bytesWritten;\n\t}\n}\n\n/**\n * Node/undici distribution transport. It is a host adapter, not Core logic:\n * package bytes stay in a private artifact directory and are never returned by\n * the public distribution contract.\n */\nexport async function createNodeHttpPluginDistributionHostV1(\n\toptions: NodeHttpPluginDistributionHostOptionsV1,\n): Promise<NodeHttpPluginDistributionHostV1> {\n\tconst transport = options.fetch ?? globalThis.fetch;\n\tif (typeof transport !== \"function\") throw new Error(\"Node fetch is unavailable\");\n\tif (!Array.isArray(options.allowedOrigins) || options.allowedOrigins.length === 0)\n\t\tthrow new Error(\"at least one allowed origin is required\");\n\tconst origins = new Set(options.allowedOrigins.map(allowedOrigin));\n\tconst timeoutMs = boundedPositive(\n\t\toptions.requestTimeoutMs,\n\t\tDEFAULT_TIMEOUT_MS_V1,\n\t\tMAX_TIMEOUT_MS_V1,\n\t\t\"requestTimeoutMs\",\n\t);\n\tconst maxRedirects = options.maxRedirects ?? DEFAULT_REDIRECTS_V1;\n\tif (!Number.isSafeInteger(maxRedirects) || maxRedirects < 0 || maxRedirects > MAX_REDIRECTS_V1)\n\t\tthrow new Error(`maxRedirects must be an integer between 0 and ${MAX_REDIRECTS_V1}`);\n\tconst userAgent = options.userAgent ?? \"agent-forge-plugin-distribution/1\";\n\tif (userAgent.length === 0 || userAgent.length > 256 || /[\\r\\n]/u.test(userAgent))\n\t\tthrow new Error(\"userAgent is invalid\");\n\tconst configuredDirectory = options.artifactDirectory;\n\tif (configuredDirectory !== undefined && !isAbsolute(configuredDirectory))\n\t\tthrow new Error(\"artifactDirectory must be absolute\");\n\tconst baseDirectoryPromise: Promise<string> =\n\t\tconfiguredDirectory === undefined\n\t\t\t? mkdtemp(join(tmpdir(), \"agent-forge-plugin-distribution-\"))\n\t\t\t: (async () => {\n\t\t\t\t\tawait mkdir(configuredDirectory, { recursive: true });\n\t\t\t\t\treturn await mkdtemp(join(configuredDirectory, \"agent-forge-plugin-distribution-\"));\n\t\t\t\t})();\n\tconst artifacts = new Map<string, ArtifactRecord>();\n\tconst activeOperations = new Set<AbortController>();\n\tlet operationsDrained: (() => void) | undefined;\n\tlet closePromise: Promise<void> | undefined;\n\tlet closed = false;\n\n\tconst assertOpen = (): void => {\n\t\tif (closed) throw new Error(\"plugin distribution host is closed\");\n\t};\n\n\tconst beginOperation = (): AbortController => {\n\t\tassertOpen();\n\t\tconst controller = new AbortController();\n\t\tactiveOperations.add(controller);\n\t\treturn controller;\n\t};\n\n\tconst endOperation = (controller: AbortController): void => {\n\t\tactiveOperations.delete(controller);\n\t\tif (activeOperations.size === 0) {\n\t\t\toperationsDrained?.();\n\t\t\toperationsDrained = undefined;\n\t\t}\n\t};\n\n\tconst waitForOperations = async (): Promise<void> => {\n\t\tif (activeOperations.size === 0) return;\n\t\tawait new Promise<void>((resolve) => {\n\t\t\toperationsDrained = resolve;\n\t\t});\n\t};\n\n\tconst fetchResponse = async (\n\t\tvalue: string,\n\t\tmethod: \"HEAD\" | \"GET\",\n\t\tparentSignal: AbortSignal | undefined,\n\t\toperationSignal: AbortSignal,\n\t): Promise<{ readonly response: Response; readonly request: RequestSignal }> => {\n\t\tlet current = requestUrl(value, origins);\n\t\tfor (let redirect = 0; ; redirect += 1) {\n\t\t\tif (operationSignal.aborted) throw cancelledRequestError();\n\t\t\tassertOpen();\n\t\t\tconst request = requestSignal(\n\t\t\t\tAbortSignal.any([parentSignal, operationSignal].filter(Boolean) as AbortSignal[]),\n\t\t\t\ttimeoutMs,\n\t\t\t);\n\t\t\tlet response: Response;\n\t\t\ttry {\n\t\t\t\tresponse = await transport(current.toString(), {\n\t\t\t\t\tmethod,\n\t\t\t\t\theaders: { accept: \"*/*\", \"user-agent\": userAgent },\n\t\t\t\t\tredirect: \"manual\",\n\t\t\t\t\tsignal: request.signal,\n\t\t\t\t});\n\t\t\t} catch (error) {\n\t\t\t\trequest.cleanup();\n\t\t\t\tthrowIfRequestCancelled(request);\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\tif (!REDIRECT_STATUS.has(response.status)) return { response, request };\n\t\t\tconst location = response.headers.get(\"location\");\n\t\t\tawait cancelBody(response);\n\t\t\trequest.cleanup();\n\t\t\tif (location === null || redirect >= maxRedirects) throw new Error(\"plugin redirect limit exceeded\");\n\t\t\tcurrent = requestUrl(new URL(location, current).toString(), origins);\n\t\t}\n\t};\n\n\tconst resolveMetadata = async (input: {\n\t\treadonly descriptor: PluginDistributionDescriptorV1;\n\t\treadonly signal?: AbortSignal;\n\t}): Promise<PluginDistributionMetadataV1> => {\n\t\tconst operation = beginOperation();\n\t\ttry {\n\t\t\tconst { response, request } = await fetchResponse(\n\t\t\t\tinput.descriptor.source,\n\t\t\t\t\"HEAD\",\n\t\t\t\tinput.signal,\n\t\t\t\toperation.signal,\n\t\t\t);\n\t\t\ttry {\n\t\t\t\tif (response.status < 200 || response.status >= 300) throw new Error(\"plugin metadata request failed\");\n\t\t\t\tassertResponseMetadata(response, input.descriptor);\n\t\t\t\treturn metadataFromDescriptor(input.descriptor);\n\t\t\t} finally {\n\t\t\t\tawait cancelBody(response);\n\t\t\t\trequest.cleanup();\n\t\t\t}\n\t\t} finally {\n\t\t\tendOperation(operation);\n\t\t}\n\t};\n\n\tconst acquireArtifact = async (input: {\n\t\treadonly descriptor: PluginDistributionDescriptorV1;\n\t\treadonly metadata: PluginDistributionMetadataV1;\n\t\treadonly signal?: AbortSignal;\n\t}): Promise<PluginDistributionArtifactHandleV1> => {\n\t\tconst operation = beginOperation();\n\t\tlet temporaryPath: string | undefined;\n\t\tlet finalPath: string | undefined;\n\t\tlet published = false;\n\t\ttry {\n\t\t\tconst digest = expectedDigest(input.descriptor.artifactDigest);\n\t\t\tconst { response, request } = await fetchResponse(\n\t\t\t\tinput.descriptor.source,\n\t\t\t\t\"GET\",\n\t\t\t\tinput.signal,\n\t\t\t\toperation.signal,\n\t\t\t);\n\t\t\tlet file: Awaited<ReturnType<typeof open>> | undefined;\n\t\t\ttry {\n\t\t\t\tif (response.status < 200 || response.status >= 300) throw new Error(\"plugin artifact request failed\");\n\t\t\t\tassertResponseMetadata(response, input.descriptor);\n\t\t\t\tif (response.body === null) throw new Error(\"plugin artifact response has no body\");\n\t\t\t\tconst directory = await baseDirectoryPromise;\n\t\t\t\ttemporaryPath = join(directory, `.partial-${randomUUID()}`);\n\t\t\t\tfinalPath = join(directory, `artifact-${randomUUID()}`);\n\t\t\t\tfile = await open(temporaryPath, \"wx\");\n\t\t\t\tconst reader = response.body.getReader();\n\t\t\t\tconst hash = createHash(digest.algorithm);\n\t\t\t\tlet total = 0;\n\t\t\t\ttry {\n\t\t\t\t\tfor (;;) {\n\t\t\t\t\t\tthrowIfRequestCancelled(request);\n\t\t\t\t\t\tconst item = await reader.read();\n\t\t\t\t\t\tif (item.done) break;\n\t\t\t\t\t\tconst chunk = item.value;\n\t\t\t\t\t\ttotal += chunk.byteLength;\n\t\t\t\t\t\tif (total > input.descriptor.sizeBytes) throw new Error(\"plugin artifact exceeds its size limit\");\n\t\t\t\t\t\thash.update(chunk);\n\t\t\t\t\t\tawait writeFully(file, chunk);\n\t\t\t\t\t}\n\t\t\t\t} finally {\n\t\t\t\t\treader.releaseLock();\n\t\t\t\t}\n\t\t\t\tthrowIfRequestCancelled(request);\n\t\t\t\tif (total !== input.descriptor.sizeBytes) throw new Error(\"plugin artifact size mismatch\");\n\t\t\t\tif (hash.digest(\"hex\") !== digest.hex) throw new Error(\"plugin artifact digest mismatch\");\n\t\t\t\tawait file.close();\n\t\t\t\tfile = undefined;\n\t\t\t\tawait rename(temporaryPath, finalPath);\n\t\t\t\tassertOpen();\n\t\t\t\tconst artifactRef = `artifact://node-http/${randomUUID()}`;\n\t\t\t\tartifacts.set(artifactRef, { path: finalPath, descriptor: input.descriptor, readers: 0 });\n\t\t\t\tpublished = true;\n\t\t\t\treturn {\n\t\t\t\t\tartifactRef,\n\t\t\t\t\tartifactDigest: input.descriptor.artifactDigest,\n\t\t\t\t\tsizeBytes: input.descriptor.sizeBytes,\n\t\t\t\t\tmediaType: input.descriptor.mediaType,\n\t\t\t\t};\n\t\t\t} catch (error) {\n\t\t\t\tthrowIfRequestCancelled(request);\n\t\t\t\tthrow error;\n\t\t\t} finally {\n\t\t\t\tif (file !== undefined) await file.close().catch(() => undefined);\n\t\t\t\tawait cancelBody(response);\n\t\t\t\trequest.cleanup();\n\t\t\t}\n\t\t} finally {\n\t\t\tif (temporaryPath !== undefined) await rm(temporaryPath, { force: true }).catch(() => undefined);\n\t\t\tif (!published && finalPath !== undefined) await rm(finalPath, { force: true }).catch(() => undefined);\n\t\t\tendOperation(operation);\n\t\t}\n\t};\n\n\tconst releaseArtifact = async (input: {\n\t\treadonly artifact: { readonly artifactRef: string };\n\t\treadonly signal?: AbortSignal;\n\t}): Promise<void> => {\n\t\tassertOpen();\n\t\tif (input.signal?.aborted) throw new Error(\"plugin artifact release was cancelled\");\n\t\tconst record = artifacts.get(input.artifact.artifactRef);\n\t\tif (record === undefined) throw new Error(\"plugin artifact reference is unknown\");\n\t\tif (record.readers > 0) throw new Error(\"plugin artifact is still being read\");\n\t\tawait rm(record.path, { force: false });\n\t\tartifacts.delete(input.artifact.artifactRef);\n\t};\n\n\tconst openArtifact = (input: {\n\t\treadonly artifact: PluginDistributionArtifactV1;\n\t\treadonly signal?: AbortSignal;\n\t}): AsyncIterable<Uint8Array> =>\n\t\t(async function* (): AsyncGenerator<Uint8Array> {\n\t\t\tconst operation = beginOperation();\n\t\t\tlet stream: ReturnType<typeof createReadStream> | undefined;\n\t\t\tlet acquiredRecord: ArtifactRecord | undefined;\n\t\t\tconst abort = () => stream?.destroy(new Error(\"plugin artifact read was cancelled\"));\n\t\t\ttry {\n\t\t\t\tif (input.signal?.aborted) throw new Error(\"plugin artifact read was cancelled\");\n\t\t\t\tconst record = artifacts.get(input.artifact.artifactRef);\n\t\t\t\tif (record === undefined || !artifactMatchesDescriptor(input.artifact, record.descriptor))\n\t\t\t\t\tthrow new Error(\"plugin artifact reference is unknown\");\n\t\t\t\trecord.readers += 1;\n\t\t\t\tacquiredRecord = record;\n\t\t\t\tstream = createReadStream(record.path, { highWaterMark: 64 * 1024 });\n\t\t\t\tinput.signal?.addEventListener(\"abort\", abort, { once: true });\n\t\t\t\toperation.signal.addEventListener(\"abort\", abort, { once: true });\n\t\t\t\tfor await (const chunk of stream) {\n\t\t\t\t\tif (input.signal?.aborted || operation.signal.aborted)\n\t\t\t\t\t\tthrow new Error(\"plugin artifact read was cancelled\");\n\t\t\t\t\tyield new Uint8Array(chunk);\n\t\t\t\t}\n\t\t\t} finally {\n\t\t\t\tinput.signal?.removeEventListener(\"abort\", abort);\n\t\t\t\toperation.signal.removeEventListener(\"abort\", abort);\n\t\t\t\tstream?.destroy();\n\t\t\t\tif (acquiredRecord !== undefined && acquiredRecord.readers > 0) acquiredRecord.readers -= 1;\n\t\t\t\tendOperation(operation);\n\t\t\t}\n\t\t})();\n\n\treturn {\n\t\tversion: NODE_DISTRIBUTION_HOST_VERSION_V1,\n\t\thost: { resolveMetadata, acquireArtifact, releaseArtifact },\n\t\topenArtifact,\n\t\tclose: async () => {\n\t\t\tif (closePromise !== undefined) return await closePromise;\n\t\t\tclosed = true;\n\t\t\tfor (const operation of activeOperations) operation.abort();\n\t\t\tclosePromise = (async () => {\n\t\t\t\tawait waitForOperations();\n\t\t\t\tconst directory = await baseDirectoryPromise;\n\t\t\t\tawait Promise.all([...artifacts.values()].map((record) => rm(record.path, { force: true })));\n\t\t\t\tartifacts.clear();\n\t\t\t\tawait rm(directory, { recursive: true, force: true });\n\t\t\t})();\n\t\t\treturn await closePromise;\n\t\t},\n\t};\n}\n\n/**\n * Compose the real Node HTTP transport with the explicit Ed25519 trust root.\n * Distribution descriptors are verified before metadata or artifact access;\n * the returned host still keeps bytes behind its private reader.\n */\nexport async function createNodeHttpPluginDistributionStackV1(\n\toptions: NodeHttpPluginDistributionStackOptionsV1,\n): Promise<NodeHttpPluginDistributionStackV1> {\n\tconst { trustRoot, now: configuredNow, ...hostOptions } = options;\n\tconst host = await createNodeHttpPluginDistributionHostV1(hostOptions);\n\ttry {\n\t\tconst now = configuredNow ?? trustRoot.now ?? (() => Date.now());\n\t\tconst verifySignature = createNodePluginTrustRootV1({ ...trustRoot, now });\n\t\tconst distribution = createPluginDistributionV1({ host: host.host, verifySignature, now });\n\t\treturn Object.freeze({ ...host, distribution });\n\t} catch (error) {\n\t\tawait host.close().catch(() => undefined);\n\t\tthrow error;\n\t}\n}\n"]}
+{"version":3,"file":"node-distribution-host.js","sourceRoot":"","sources":["../../../src/plugins/ecosystem/node-distribution-host.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,CAAC,EAAE,MAAM,0BAA0B,CAAC;AAS7C,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,2BAA2B,EAAqC,MAAM,6BAA6B,CAAC;AAE7G,MAAM,iCAAiC,GAAG,CAAU,CAAC;AACrD,MAAM,qBAAqB,GAAG,MAAM,CAAC;AACrC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAClC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAC3B,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAwD3D,SAAS,qBAAqB,GAAU;IACvC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC;IAC3D,KAAK,CAAC,IAAI,GAAG,YAAY,CAAC;IAC1B,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,uBAAuB,CAAC,OAAsB,EAAQ;IAC9D,IAAI,OAAO,CAAC,QAAQ,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,qBAAqB,EAAE,CAAC;AAAA,CAC1D;AAED,SAAS,eAAe,CAAC,KAAyB,EAAE,QAAgB,EAAE,OAAe,EAAE,KAAa,EAAU;IAC7G,MAAM,MAAM,GAAG,KAAK,IAAI,QAAQ,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,MAAM,GAAG,OAAO;QACnE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,sDAAsD,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAChG,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,aAAa,CAAC,KAAa,EAAU;IAC7C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ;QACtG,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE;QACxE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC;IACvE,OAAO,MAAM,CAAC,MAAM,CAAC;AAAA,CACrB;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,OAA4B,EAAO;IACrE,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ;QACtG,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,wDAAwD,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,aAAa,CAAC,MAA+B,EAAE,SAAiB,EAAiB;IACzF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrD,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI;QAAE,KAAK,EAAE,CAAC;;QACjC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC;QAChC,UAAU,GAAG,IAAI,CAAC;QAClB,UAAU,CAAC,KAAK,EAAE,CAAC;IAAA,CACnB,EAAE,SAAS,CAAC,CAAC;IACd,OAAO;QACN,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,QAAQ,EAAE,GAAG,EAAE,CAAC,UAAU;QAC1B,OAAO,EAAE,GAAG,EAAE,CAAC;YACd,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAAA,CAC5C;KACD,CAAC;AAAA,CACF;AAED,SAAS,aAAa,CAAC,QAAkB,EAAsB;IAC9D,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACrD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC;IAC3F,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC;IACnG,OAAO,MAAM,CAAC;AAAA,CACd;AAED,SAAS,WAAW,CAAC,QAAkB,EAAsB;IAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACnD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACrC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC;AAAA,CACjE;AAED,SAAS,sBAAsB,CAAC,QAAkB,EAAE,UAA0C,EAAQ;IACrG,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,MAAM,KAAK,UAAU,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC;IACzF,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,SAAS,KAAK,UAAU,CAAC,SAAS,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC;AAAA,CAChH;AAED,KAAK,UAAU,UAAU,CAAC,QAAkB,EAAiB;IAC5D,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;QAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAAA,CAChF;AAED,SAAS,cAAc,CAAC,KAAa,EAAqE;IACzG,MAAM,QAAQ,GAAG,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACvC,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,EAAE,MAAM,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,EAAE,MAAM,KAAK,GAAG,CAAC;YACpG,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;IAC7F,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;IAC9F,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC;AAAA,CACtE;AAED,SAAS,sBAAsB,CAAC,UAA0C,EAAgC;IACzG,OAAO;QACN,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,SAAS,EAAE,UAAU,CAAC,SAAS;KAC/B,CAAC;AAAA,CACF;AAED,SAAS,yBAAyB,CACjC,QAAsC,EACtC,UAA0C,EAChC;IACV,OAAO,CACN,QAAQ,CAAC,OAAO,KAAK,CAAC;QACtB,QAAQ,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ;QACzC,QAAQ,CAAC,aAAa,KAAK,UAAU,CAAC,aAAa;QACnD,QAAQ,CAAC,cAAc,KAAK,UAAU,CAAC,cAAc;QACrD,QAAQ,CAAC,cAAc,KAAK,UAAU,CAAC,cAAc;QACrD,QAAQ,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS;QAC3C,QAAQ,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS;QAC3C,QAAQ,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;QACrC,QAAQ,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS,CAC3C,CAAC;AAAA,CACF;AAED,KAAK,UAAU,UAAU,CAAC,IAAsC,EAAE,KAAiB,EAAiB;IACnG,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC;QAChF,IAAI,MAAM,CAAC,YAAY,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC;QACtF,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC;IAC/B,CAAC;AAAA,CACD;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC3D,OAAgD,EACJ;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACpD,IAAI,OAAO,SAAS,KAAK,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,eAAe,CAChC,OAAO,CAAC,gBAAgB,EACxB,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,CAClB,CAAC;IACF,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,oBAAoB,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,CAAC,IAAI,YAAY,GAAG,gBAAgB;QAC7F,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,qDAAqD,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;IACtG,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,mCAAmC,CAAC;IAC3E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC5C,MAAM,mBAAmB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IACtD,IAAI,mBAAmB,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC;IAC1D,MAAM,oBAAoB,GACzB,mBAAmB,KAAK,SAAS;QAChC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kCAAkC,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACb,MAAM,KAAK,CAAC,mBAAmB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CAAC,CAAC;QAAA,CACpF,CAAC,EAAE,CAAC;IACR,MAAM,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC;IACpD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAmB,CAAC;IACpD,IAAI,iBAA2C,CAAC;IAChD,IAAI,YAAuC,CAAC;IAC5C,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,MAAM,UAAU,GAAG,GAAS,EAAE,CAAC;QAC9B,IAAI,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC;IAAA,CACrE,CAAC;IAEF,MAAM,cAAc,GAAG,GAAoB,EAAE,CAAC;QAC7C,UAAU,EAAE,CAAC;QACb,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,OAAO,UAAU,CAAC;IAAA,CAClB,CAAC;IAEF,MAAM,YAAY,GAAG,CAAC,UAA2B,EAAQ,EAAE,CAAC;QAC3D,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,gBAAgB,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACjC,iBAAiB,EAAE,EAAE,CAAC;YACtB,iBAAiB,GAAG,SAAS,CAAC;QAC/B,CAAC;IAAA,CACD,CAAC;IAEF,MAAM,iBAAiB,GAAG,KAAK,IAAmB,EAAE,CAAC;QACpD,IAAI,gBAAgB,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO;QACxC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACpC,iBAAiB,GAAG,OAAO,CAAC;QAAA,CAC5B,CAAC,CAAC;IAAA,CACH,CAAC;IAEF,MAAM,aAAa,GAAG,KAAK,EAC1B,KAAa,EACb,MAAsB,EACtB,YAAqC,EACrC,eAA4B,EACgD,EAAE,CAAC;QAC/E,IAAI,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACzC,KAAK,IAAI,QAAQ,GAAG,CAAC,GAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YACxC,IAAI,eAAe,CAAC,OAAO;gBAAE,MAAM,qBAAqB,EAAE,CAAC;YAC3D,UAAU,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,aAAa,CAC5B,WAAW,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC,MAAM,CAAC,OAAO,CAAkB,CAAC,EACjF,SAAS,CACT,CAAC;YACF,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACJ,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE;oBAC9C,MAAM;oBACN,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE;oBACnD,QAAQ,EAAE,QAAQ;oBAClB,MAAM,EAAE,OAAO,CAAC,MAAM;iBACtB,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,OAAO,CAAC,OAAO,EAAE,CAAC;gBAClB,uBAAuB,CAAC,OAAO,CAAC,CAAC;gBACjC,MAAM,KAAK,CAAC;YACb,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YACxE,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAClD,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC3B,OAAO,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,IAAI,YAAY;gBAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC;YACxG,OAAO,GAAG,UAAU,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;QACtE,CAAC;IAAA,CACD,CAAC;IAEF,MAAM,eAAe,GAAG,KAAK,EAAE,KAG9B,EAAyC,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,cAAc,EAAE,CAAC;QACnC,IAAI,CAAC;YACJ,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,CAChD,KAAK,CAAC,UAAU,CAAC,MAAM,EACvB,MAAM,EACN,KAAK,CAAC,MAAM,EACZ,SAAS,CAAC,MAAM,CAChB,CAAC;YACF,IAAI,CAAC;gBACJ,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;oBAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC;gBAC1G,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;gBACnD,OAAO,sBAAsB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACjD,CAAC;oBAAS,CAAC;gBACV,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC3B,OAAO,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC;QACF,CAAC;gBAAS,CAAC;YACV,YAAY,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;IAAA,CACD,CAAC;IAEF,MAAM,eAAe,GAAG,KAAK,EAAE,KAI9B,EAA+C,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,cAAc,EAAE,CAAC;QACnC,IAAI,aAAiC,CAAC;QACtC,IAAI,SAA6B,CAAC;QAClC,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;YAC/D,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,CAChD,KAAK,CAAC,UAAU,CAAC,MAAM,EACvB,KAAK,EACL,KAAK,CAAC,MAAM,EACZ,SAAS,CAAC,MAAM,CAChB,CAAC;YACF,IAAI,IAAkD,CAAC;YACvD,IAAI,CAAC;gBACJ,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;oBAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC;gBAC1G,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;gBACnD,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC;gBACvF,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC;gBAC7C,aAAa,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,UAAU,EAAE,EAAE,CAAC,CAAC;gBAC5D,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,UAAU,EAAE,EAAE,CAAC,CAAC;gBACxD,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;gBACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACzC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC1C,IAAI,KAAK,GAAG,CAAC,CAAC;gBACd,IAAI,CAAC;oBACJ,SAAS,CAAC;wBACT,uBAAuB,CAAC,OAAO,CAAC,CAAC;wBACjC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;wBACjC,IAAI,IAAI,CAAC,IAAI;4BAAE,MAAM;wBACrB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;wBACzB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;wBAC1B,IAAI,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,SAAS;4BAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC;wBACrG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;wBACnB,MAAM,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBAC/B,CAAC;gBACF,CAAC;wBAAS,CAAC;oBACV,MAAM,CAAC,WAAW,EAAE,CAAC;gBACtB,CAAC;gBACD,uBAAuB,CAAC,OAAO,CAAC,CAAC;gBACjC,IAAI,KAAK,KAAK,KAAK,CAAC,UAAU,CAAC,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC;gBAC9F,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,GAAG;oBAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC;gBAC7F,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;gBACnB,IAAI,GAAG,SAAS,CAAC;gBACjB,MAAM,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;gBACvC,UAAU,EAAE,CAAC;gBACb,MAAM,WAAW,GAAG,wBAAwB,UAAU,EAAE,EAAE,CAAC;gBAC3D,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC1F,SAAS,GAAG,IAAI,CAAC;gBACjB,OAAO;oBACN,WAAW;oBACX,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,cAAc;oBAC/C,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS;oBACrC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,SAAS;iBACrC,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,uBAAuB,CAAC,OAAO,CAAC,CAAC;gBACjC,MAAM,KAAK,CAAC;YACb,CAAC;oBAAS,CAAC;gBACV,IAAI,IAAI,KAAK,SAAS;oBAAE,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClE,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC3B,OAAO,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC;QACF,CAAC;gBAAS,CAAC;YACV,IAAI,aAAa,KAAK,SAAS;gBAAE,MAAM,EAAE,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACjG,IAAI,CAAC,SAAS,IAAI,SAAS,KAAK,SAAS;gBAAE,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACvG,YAAY,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;IAAA,CACD,CAAC;IAEF,MAAM,eAAe,GAAG,KAAK,EAAE,KAG9B,EAAiB,EAAE,CAAC;QACpB,UAAU,EAAE,CAAC;QACb,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC;QACrF,IAAI,MAAM,CAAC,OAAO,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC;QAClF,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACxC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAAA,CAC7C,CAAC;IAEF,MAAM,YAAY,GAAG,CAAC,KAGrB,EAA6B,EAAE,CAC/B,CAAC,KAAK,SAAS,CAAC,IAAgC;QAC/C,MAAM,SAAS,GAAG,cAAc,EAAE,CAAC;QACnC,IAAI,MAAuD,CAAC;QAC5D,IAAI,cAA0C,CAAC;QAC/C,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC;YACJ,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC;YACpF,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACzD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;gBACxF,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC;YAC5D,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;YACpB,cAAc,GAAG,MAAM,CAAC;YACxB,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;YACrE,KAAK,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,SAAS,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAClE,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAClC,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO;oBACpD,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC;gBAC1D,MAAM,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;YAC7B,CAAC;QACF,CAAC;gBAAS,CAAC;YACV,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAClD,SAAS,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrD,MAAM,EAAE,OAAO,EAAE,CAAC;YAClB,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,CAAC,OAAO,GAAG,CAAC;gBAAE,cAAc,CAAC,OAAO,IAAI,CAAC,CAAC;YAC5F,YAAY,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;IAAA,CACD,CAAC,EAAE,CAAC;IAEN,OAAO;QACN,OAAO,EAAE,iCAAiC;QAC1C,IAAI,EAAE,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE;QAC3D,YAAY;QACZ,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC;YAClB,IAAI,YAAY,KAAK,SAAS;gBAAE,OAAO,MAAM,YAAY,CAAC;YAC1D,MAAM,GAAG,IAAI,CAAC;YACd,KAAK,MAAM,SAAS,IAAI,gBAAgB;gBAAE,SAAS,CAAC,KAAK,EAAE,CAAC;YAC5D,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC3B,MAAM,iBAAiB,EAAE,CAAC;gBAC1B,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC;gBAC7C,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC7F,SAAS,CAAC,KAAK,EAAE,CAAC;gBAClB,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAAA,CACtD,CAAC,EAAE,CAAC;YACL,OAAO,MAAM,YAAY,CAAC;QAAA,CAC1B;KACD,CAAC;AAAA,CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAC5D,OAAiD,EACJ;IAC7C,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,sCAAsC,CAAC,WAAW,CAAC,CAAC;IACvE,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,aAAa,IAAI,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACjE,MAAM,eAAe,GAAG,2BAA2B,CAAC,EAAE,GAAG,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3E,MAAM,YAAY,GAAG,0BAA0B,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3F,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,KAAK,CAAC;IACb,CAAC;AAAA,CACD","sourcesContent":["import { createHash, randomUUID } from \"node:crypto\";\nimport { createReadStream } from \"node:fs\";\nimport { mkdir, mkdtemp, open, rename, rm } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { isAbsolute, join } from \"node:path\";\n\nimport { t } from \"../../core/i18n/index.ts\";\nimport type {\n\tPluginDistributionArtifactHandleV1,\n\tPluginDistributionArtifactV1,\n\tPluginDistributionDescriptorV1,\n\tPluginDistributionHostV1,\n\tPluginDistributionMetadataV1,\n\tPluginDistributionV1,\n} from \"./distribution.ts\";\nimport { createPluginDistributionV1 } from \"./distribution.ts\";\nimport { createNodePluginTrustRootV1, type NodePluginTrustRootOptionsV1 } from \"./node-plugin-trust-root.ts\";\n\nconst NODE_DISTRIBUTION_HOST_VERSION_V1 = 1 as const;\nconst DEFAULT_TIMEOUT_MS_V1 = 30_000;\nconst MAX_TIMEOUT_MS_V1 = 120_000;\nconst DEFAULT_REDIRECTS_V1 = 3;\nconst MAX_REDIRECTS_V1 = 5;\nconst REDIRECT_STATUS = new Set([301, 302, 303, 307, 308]);\n\nexport interface NodeHttpPluginDistributionHostOptionsV1 {\n\t/** Real `fetch` or a deterministic replacement for tests. */\n\treadonly fetch?: typeof globalThis.fetch;\n\t/** Exact `http(s)` origins. An empty allowlist is rejected. */\n\treadonly allowedOrigins: readonly string[];\n\t/** Optional host-owned directory. It is never returned as an artifact reference. */\n\treadonly artifactDirectory?: string;\n\treadonly requestTimeoutMs?: number;\n\treadonly maxRedirects?: number;\n\treadonly userAgent?: string;\n}\n\nexport interface NodeHttpPluginDistributionHostV1 {\n\treadonly version: typeof NODE_DISTRIBUTION_HOST_VERSION_V1;\n\treadonly host: PluginDistributionHostV1;\n\t/**\n\t * Private Node-host reader for an installer that shares this host instance.\n\t * It is not part of the model-facing distribution contract and never exposes\n\t * a file path. The caller must consume it before releasing the artifact.\n\t */\n\treadonly openArtifact: (input: {\n\t\treadonly artifact: PluginDistributionArtifactV1;\n\t\treadonly signal?: AbortSignal;\n\t}) => AsyncIterable<Uint8Array>;\n\t/** Remove all artifacts owned by this host instance. */\n\treadonly close: () => Promise<void>;\n}\n\n/**\n * Explicitly composed Node distribution stack. The caller supplies the trust\n * root; no key or network origin is discovered implicitly.\n */\nexport interface NodeHttpPluginDistributionStackOptionsV1 extends NodeHttpPluginDistributionHostOptionsV1 {\n\treadonly trustRoot: NodePluginTrustRootOptionsV1;\n\t/** Shared clock for descriptor expiry and trust-key validity. */\n\treadonly now?: () => number;\n}\n\nexport interface NodeHttpPluginDistributionStackV1 extends NodeHttpPluginDistributionHostV1 {\n\treadonly distribution: PluginDistributionV1;\n}\n\ninterface ArtifactRecord {\n\treadonly path: string;\n\treadonly descriptor: PluginDistributionDescriptorV1;\n\treaders: number;\n}\n\ninterface RequestSignal {\n\treadonly signal: AbortSignal;\n\treadonly timedOut: () => boolean;\n\treadonly cleanup: () => void;\n}\n\nfunction cancelledRequestError(): Error {\n\tconst error = new Error(t(\"plugin request was cancelled\"));\n\terror.name = \"AbortError\";\n\treturn error;\n}\n\nfunction throwIfRequestCancelled(request: RequestSignal): void {\n\tif (request.timedOut()) throw new Error(t(\"plugin request timed out\"));\n\tif (request.signal.aborted) throw cancelledRequestError();\n}\n\nfunction boundedPositive(value: number | undefined, fallback: number, maximum: number, label: string): number {\n\tconst result = value ?? fallback;\n\tif (!Number.isSafeInteger(result) || result <= 0 || result > maximum)\n\t\tthrow new Error(t(\"{label} must be a positive integer at most {maximum}\", { label, maximum }));\n\treturn result;\n}\n\nfunction allowedOrigin(value: string): string {\n\tlet parsed: URL;\n\ttry {\n\t\tparsed = new URL(value);\n\t} catch {\n\t\tthrow new Error(t(\"allowed origin is invalid\"));\n\t}\n\tif ((parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") || parsed.username || parsed.password)\n\t\tthrow new Error(t(\"allowed origin must be an http(s) origin\"));\n\tif (parsed.pathname !== \"/\" || parsed.search !== \"\" || parsed.hash !== \"\")\n\t\tthrow new Error(t(\"allowed origin must not include a path or query\"));\n\treturn parsed.origin;\n}\n\nfunction requestUrl(value: string, origins: ReadonlySet<string>): URL {\n\tlet parsed: URL;\n\ttry {\n\t\tparsed = new URL(value);\n\t} catch {\n\t\tthrow new Error(t(\"plugin source URL is invalid\"));\n\t}\n\tif ((parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") || parsed.username || parsed.password)\n\t\tthrow new Error(t(\"plugin source URL must use http(s) without credentials\"));\n\tif (!origins.has(parsed.origin)) throw new Error(t(\"plugin source origin is not allowed\"));\n\treturn parsed;\n}\n\nfunction requestSignal(parent: AbortSignal | undefined, timeoutMs: number): RequestSignal {\n\tconst controller = new AbortController();\n\tlet didTimeout = false;\n\tconst abort = () => controller.abort(parent?.reason);\n\tif (parent?.aborted === true) abort();\n\telse parent?.addEventListener(\"abort\", abort, { once: true });\n\tconst timeout = setTimeout(() => {\n\t\tdidTimeout = true;\n\t\tcontroller.abort();\n\t}, timeoutMs);\n\treturn {\n\t\tsignal: controller.signal,\n\t\ttimedOut: () => didTimeout,\n\t\tcleanup: () => {\n\t\t\tclearTimeout(timeout);\n\t\t\tparent?.removeEventListener(\"abort\", abort);\n\t\t},\n\t};\n}\n\nfunction contentLength(response: Response): number | undefined {\n\tconst value = response.headers.get(\"content-length\");\n\tif (value === null) return undefined;\n\tif (!/^\\d+$/u.test(value)) throw new Error(t(\"plugin response content length is invalid\"));\n\tconst result = Number(value);\n\tif (!Number.isSafeInteger(result)) throw new Error(t(\"plugin response content length is invalid\"));\n\treturn result;\n}\n\nfunction contentType(response: Response): string | undefined {\n\tconst value = response.headers.get(\"content-type\");\n\tif (value === null) return undefined;\n\treturn value.split(\";\", 1)[0]?.trim().toLowerCase() || undefined;\n}\n\nfunction assertResponseMetadata(response: Response, descriptor: PluginDistributionDescriptorV1): void {\n\tconst length = contentLength(response);\n\tif (length !== descriptor.sizeBytes) throw new Error(t(\"plugin response size mismatch\"));\n\tconst mediaType = contentType(response);\n\tif (mediaType !== descriptor.mediaType.toLowerCase()) throw new Error(t(\"plugin response media type mismatch\"));\n}\n\nasync function cancelBody(response: Response): Promise<void> {\n\tif (response.body !== null) await response.body.cancel().catch(() => undefined);\n}\n\nfunction expectedDigest(value: string): { readonly algorithm: \"sha256\" | \"sha512\"; readonly hex: string } {\n\tconst prefixed = /^(sha256|sha512):([0-9a-f]+)$/iu.exec(value);\n\tif (prefixed !== null) {\n\t\tconst algorithm = prefixed[1]?.toLowerCase();\n\t\tconst hex = prefixed[2]?.toLowerCase();\n\t\tif ((algorithm === \"sha256\" && hex?.length === 64) || (algorithm === \"sha512\" && hex?.length === 128))\n\t\t\treturn { algorithm, hex };\n\t}\n\tif (/^[0-9a-f]{64}$/iu.test(value)) return { algorithm: \"sha256\", hex: value.toLowerCase() };\n\tif (/^[0-9a-f]{128}$/iu.test(value)) return { algorithm: \"sha512\", hex: value.toLowerCase() };\n\tthrow new Error(t(\"plugin artifact digest algorithm is unsupported\"));\n}\n\nfunction metadataFromDescriptor(descriptor: PluginDistributionDescriptorV1): PluginDistributionMetadataV1 {\n\treturn {\n\t\tversion: 1,\n\t\tsource: descriptor.source,\n\t\tpluginId: descriptor.pluginId,\n\t\tpluginVersion: descriptor.pluginVersion,\n\t\tmanifestDigest: descriptor.manifestDigest,\n\t\tartifactDigest: descriptor.artifactDigest,\n\t\texpiresAt: descriptor.expiresAt,\n\t\tsizeBytes: descriptor.sizeBytes,\n\t\tmediaType: descriptor.mediaType,\n\t};\n}\n\nfunction artifactMatchesDescriptor(\n\tartifact: PluginDistributionArtifactV1,\n\tdescriptor: PluginDistributionDescriptorV1,\n): boolean {\n\treturn (\n\t\tartifact.version === 1 &&\n\t\tartifact.pluginId === descriptor.pluginId &&\n\t\tartifact.pluginVersion === descriptor.pluginVersion &&\n\t\tartifact.manifestDigest === descriptor.manifestDigest &&\n\t\tartifact.artifactDigest === descriptor.artifactDigest &&\n\t\tartifact.sizeBytes === descriptor.sizeBytes &&\n\t\tartifact.mediaType === descriptor.mediaType &&\n\t\tartifact.source === descriptor.source &&\n\t\tartifact.expiresAt === descriptor.expiresAt\n\t);\n}\n\nasync function writeFully(file: Awaited<ReturnType<typeof open>>, chunk: Uint8Array): Promise<void> {\n\tlet offset = 0;\n\twhile (offset < chunk.byteLength) {\n\t\tconst result = await file.write(chunk, offset, chunk.byteLength - offset, null);\n\t\tif (result.bytesWritten <= 0) throw new Error(t(\"plugin artifact file write failed\"));\n\t\toffset += result.bytesWritten;\n\t}\n}\n\n/**\n * Node/undici distribution transport. It is a host adapter, not Core logic:\n * package bytes stay in a private artifact directory and are never returned by\n * the public distribution contract.\n */\nexport async function createNodeHttpPluginDistributionHostV1(\n\toptions: NodeHttpPluginDistributionHostOptionsV1,\n): Promise<NodeHttpPluginDistributionHostV1> {\n\tconst transport = options.fetch ?? globalThis.fetch;\n\tif (typeof transport !== \"function\") throw new Error(t(\"Node fetch is unavailable\"));\n\tif (!Array.isArray(options.allowedOrigins) || options.allowedOrigins.length === 0)\n\t\tthrow new Error(t(\"at least one allowed origin is required\"));\n\tconst origins = new Set(options.allowedOrigins.map(allowedOrigin));\n\tconst timeoutMs = boundedPositive(\n\t\toptions.requestTimeoutMs,\n\t\tDEFAULT_TIMEOUT_MS_V1,\n\t\tMAX_TIMEOUT_MS_V1,\n\t\t\"requestTimeoutMs\",\n\t);\n\tconst maxRedirects = options.maxRedirects ?? DEFAULT_REDIRECTS_V1;\n\tif (!Number.isSafeInteger(maxRedirects) || maxRedirects < 0 || maxRedirects > MAX_REDIRECTS_V1)\n\t\tthrow new Error(t(\"maxRedirects must be an integer between 0 and {max}\", { max: MAX_REDIRECTS_V1 }));\n\tconst userAgent = options.userAgent ?? \"agent-forge-plugin-distribution/1\";\n\tif (userAgent.length === 0 || userAgent.length > 256 || /[\\r\\n]/u.test(userAgent))\n\t\tthrow new Error(t(\"userAgent is invalid\"));\n\tconst configuredDirectory = options.artifactDirectory;\n\tif (configuredDirectory !== undefined && !isAbsolute(configuredDirectory))\n\t\tthrow new Error(t(\"artifactDirectory must be absolute\"));\n\tconst baseDirectoryPromise: Promise<string> =\n\t\tconfiguredDirectory === undefined\n\t\t\t? mkdtemp(join(tmpdir(), \"agent-forge-plugin-distribution-\"))\n\t\t\t: (async () => {\n\t\t\t\t\tawait mkdir(configuredDirectory, { recursive: true });\n\t\t\t\t\treturn await mkdtemp(join(configuredDirectory, \"agent-forge-plugin-distribution-\"));\n\t\t\t\t})();\n\tconst artifacts = new Map<string, ArtifactRecord>();\n\tconst activeOperations = new Set<AbortController>();\n\tlet operationsDrained: (() => void) | undefined;\n\tlet closePromise: Promise<void> | undefined;\n\tlet closed = false;\n\n\tconst assertOpen = (): void => {\n\t\tif (closed) throw new Error(t(\"plugin distribution host is closed\"));\n\t};\n\n\tconst beginOperation = (): AbortController => {\n\t\tassertOpen();\n\t\tconst controller = new AbortController();\n\t\tactiveOperations.add(controller);\n\t\treturn controller;\n\t};\n\n\tconst endOperation = (controller: AbortController): void => {\n\t\tactiveOperations.delete(controller);\n\t\tif (activeOperations.size === 0) {\n\t\t\toperationsDrained?.();\n\t\t\toperationsDrained = undefined;\n\t\t}\n\t};\n\n\tconst waitForOperations = async (): Promise<void> => {\n\t\tif (activeOperations.size === 0) return;\n\t\tawait new Promise<void>((resolve) => {\n\t\t\toperationsDrained = resolve;\n\t\t});\n\t};\n\n\tconst fetchResponse = async (\n\t\tvalue: string,\n\t\tmethod: \"HEAD\" | \"GET\",\n\t\tparentSignal: AbortSignal | undefined,\n\t\toperationSignal: AbortSignal,\n\t): Promise<{ readonly response: Response; readonly request: RequestSignal }> => {\n\t\tlet current = requestUrl(value, origins);\n\t\tfor (let redirect = 0; ; redirect += 1) {\n\t\t\tif (operationSignal.aborted) throw cancelledRequestError();\n\t\t\tassertOpen();\n\t\t\tconst request = requestSignal(\n\t\t\t\tAbortSignal.any([parentSignal, operationSignal].filter(Boolean) as AbortSignal[]),\n\t\t\t\ttimeoutMs,\n\t\t\t);\n\t\t\tlet response: Response;\n\t\t\ttry {\n\t\t\t\tresponse = await transport(current.toString(), {\n\t\t\t\t\tmethod,\n\t\t\t\t\theaders: { accept: \"*/*\", \"user-agent\": userAgent },\n\t\t\t\t\tredirect: \"manual\",\n\t\t\t\t\tsignal: request.signal,\n\t\t\t\t});\n\t\t\t} catch (error) {\n\t\t\t\trequest.cleanup();\n\t\t\t\tthrowIfRequestCancelled(request);\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t\tif (!REDIRECT_STATUS.has(response.status)) return { response, request };\n\t\t\tconst location = response.headers.get(\"location\");\n\t\t\tawait cancelBody(response);\n\t\t\trequest.cleanup();\n\t\t\tif (location === null || redirect >= maxRedirects) throw new Error(t(\"plugin redirect limit exceeded\"));\n\t\t\tcurrent = requestUrl(new URL(location, current).toString(), origins);\n\t\t}\n\t};\n\n\tconst resolveMetadata = async (input: {\n\t\treadonly descriptor: PluginDistributionDescriptorV1;\n\t\treadonly signal?: AbortSignal;\n\t}): Promise<PluginDistributionMetadataV1> => {\n\t\tconst operation = beginOperation();\n\t\ttry {\n\t\t\tconst { response, request } = await fetchResponse(\n\t\t\t\tinput.descriptor.source,\n\t\t\t\t\"HEAD\",\n\t\t\t\tinput.signal,\n\t\t\t\toperation.signal,\n\t\t\t);\n\t\t\ttry {\n\t\t\t\tif (response.status < 200 || response.status >= 300) throw new Error(t(\"plugin metadata request failed\"));\n\t\t\t\tassertResponseMetadata(response, input.descriptor);\n\t\t\t\treturn metadataFromDescriptor(input.descriptor);\n\t\t\t} finally {\n\t\t\t\tawait cancelBody(response);\n\t\t\t\trequest.cleanup();\n\t\t\t}\n\t\t} finally {\n\t\t\tendOperation(operation);\n\t\t}\n\t};\n\n\tconst acquireArtifact = async (input: {\n\t\treadonly descriptor: PluginDistributionDescriptorV1;\n\t\treadonly metadata: PluginDistributionMetadataV1;\n\t\treadonly signal?: AbortSignal;\n\t}): Promise<PluginDistributionArtifactHandleV1> => {\n\t\tconst operation = beginOperation();\n\t\tlet temporaryPath: string | undefined;\n\t\tlet finalPath: string | undefined;\n\t\tlet published = false;\n\t\ttry {\n\t\t\tconst digest = expectedDigest(input.descriptor.artifactDigest);\n\t\t\tconst { response, request } = await fetchResponse(\n\t\t\t\tinput.descriptor.source,\n\t\t\t\t\"GET\",\n\t\t\t\tinput.signal,\n\t\t\t\toperation.signal,\n\t\t\t);\n\t\t\tlet file: Awaited<ReturnType<typeof open>> | undefined;\n\t\t\ttry {\n\t\t\t\tif (response.status < 200 || response.status >= 300) throw new Error(t(\"plugin artifact request failed\"));\n\t\t\t\tassertResponseMetadata(response, input.descriptor);\n\t\t\t\tif (response.body === null) throw new Error(t(\"plugin artifact response has no body\"));\n\t\t\t\tconst directory = await baseDirectoryPromise;\n\t\t\t\ttemporaryPath = join(directory, `.partial-${randomUUID()}`);\n\t\t\t\tfinalPath = join(directory, `artifact-${randomUUID()}`);\n\t\t\t\tfile = await open(temporaryPath, \"wx\");\n\t\t\t\tconst reader = response.body.getReader();\n\t\t\t\tconst hash = createHash(digest.algorithm);\n\t\t\t\tlet total = 0;\n\t\t\t\ttry {\n\t\t\t\t\tfor (;;) {\n\t\t\t\t\t\tthrowIfRequestCancelled(request);\n\t\t\t\t\t\tconst item = await reader.read();\n\t\t\t\t\t\tif (item.done) break;\n\t\t\t\t\t\tconst chunk = item.value;\n\t\t\t\t\t\ttotal += chunk.byteLength;\n\t\t\t\t\t\tif (total > input.descriptor.sizeBytes) throw new Error(t(\"plugin artifact exceeds its size limit\"));\n\t\t\t\t\t\thash.update(chunk);\n\t\t\t\t\t\tawait writeFully(file, chunk);\n\t\t\t\t\t}\n\t\t\t\t} finally {\n\t\t\t\t\treader.releaseLock();\n\t\t\t\t}\n\t\t\t\tthrowIfRequestCancelled(request);\n\t\t\t\tif (total !== input.descriptor.sizeBytes) throw new Error(t(\"plugin artifact size mismatch\"));\n\t\t\t\tif (hash.digest(\"hex\") !== digest.hex) throw new Error(t(\"plugin artifact digest mismatch\"));\n\t\t\t\tawait file.close();\n\t\t\t\tfile = undefined;\n\t\t\t\tawait rename(temporaryPath, finalPath);\n\t\t\t\tassertOpen();\n\t\t\t\tconst artifactRef = `artifact://node-http/${randomUUID()}`;\n\t\t\t\tartifacts.set(artifactRef, { path: finalPath, descriptor: input.descriptor, readers: 0 });\n\t\t\t\tpublished = true;\n\t\t\t\treturn {\n\t\t\t\t\tartifactRef,\n\t\t\t\t\tartifactDigest: input.descriptor.artifactDigest,\n\t\t\t\t\tsizeBytes: input.descriptor.sizeBytes,\n\t\t\t\t\tmediaType: input.descriptor.mediaType,\n\t\t\t\t};\n\t\t\t} catch (error) {\n\t\t\t\tthrowIfRequestCancelled(request);\n\t\t\t\tthrow error;\n\t\t\t} finally {\n\t\t\t\tif (file !== undefined) await file.close().catch(() => undefined);\n\t\t\t\tawait cancelBody(response);\n\t\t\t\trequest.cleanup();\n\t\t\t}\n\t\t} finally {\n\t\t\tif (temporaryPath !== undefined) await rm(temporaryPath, { force: true }).catch(() => undefined);\n\t\t\tif (!published && finalPath !== undefined) await rm(finalPath, { force: true }).catch(() => undefined);\n\t\t\tendOperation(operation);\n\t\t}\n\t};\n\n\tconst releaseArtifact = async (input: {\n\t\treadonly artifact: { readonly artifactRef: string };\n\t\treadonly signal?: AbortSignal;\n\t}): Promise<void> => {\n\t\tassertOpen();\n\t\tif (input.signal?.aborted) throw new Error(t(\"plugin artifact release was cancelled\"));\n\t\tconst record = artifacts.get(input.artifact.artifactRef);\n\t\tif (record === undefined) throw new Error(t(\"plugin artifact reference is unknown\"));\n\t\tif (record.readers > 0) throw new Error(t(\"plugin artifact is still being read\"));\n\t\tawait rm(record.path, { force: false });\n\t\tartifacts.delete(input.artifact.artifactRef);\n\t};\n\n\tconst openArtifact = (input: {\n\t\treadonly artifact: PluginDistributionArtifactV1;\n\t\treadonly signal?: AbortSignal;\n\t}): AsyncIterable<Uint8Array> =>\n\t\t(async function* (): AsyncGenerator<Uint8Array> {\n\t\t\tconst operation = beginOperation();\n\t\t\tlet stream: ReturnType<typeof createReadStream> | undefined;\n\t\t\tlet acquiredRecord: ArtifactRecord | undefined;\n\t\t\tconst abort = () => stream?.destroy(new Error(\"plugin artifact read was cancelled\"));\n\t\t\ttry {\n\t\t\t\tif (input.signal?.aborted) throw new Error(t(\"plugin artifact read was cancelled\"));\n\t\t\t\tconst record = artifacts.get(input.artifact.artifactRef);\n\t\t\t\tif (record === undefined || !artifactMatchesDescriptor(input.artifact, record.descriptor))\n\t\t\t\t\tthrow new Error(t(\"plugin artifact reference is unknown\"));\n\t\t\t\trecord.readers += 1;\n\t\t\t\tacquiredRecord = record;\n\t\t\t\tstream = createReadStream(record.path, { highWaterMark: 64 * 1024 });\n\t\t\t\tinput.signal?.addEventListener(\"abort\", abort, { once: true });\n\t\t\t\toperation.signal.addEventListener(\"abort\", abort, { once: true });\n\t\t\t\tfor await (const chunk of stream) {\n\t\t\t\t\tif (input.signal?.aborted || operation.signal.aborted)\n\t\t\t\t\t\tthrow new Error(t(\"plugin artifact read was cancelled\"));\n\t\t\t\t\tyield new Uint8Array(chunk);\n\t\t\t\t}\n\t\t\t} finally {\n\t\t\t\tinput.signal?.removeEventListener(\"abort\", abort);\n\t\t\t\toperation.signal.removeEventListener(\"abort\", abort);\n\t\t\t\tstream?.destroy();\n\t\t\t\tif (acquiredRecord !== undefined && acquiredRecord.readers > 0) acquiredRecord.readers -= 1;\n\t\t\t\tendOperation(operation);\n\t\t\t}\n\t\t})();\n\n\treturn {\n\t\tversion: NODE_DISTRIBUTION_HOST_VERSION_V1,\n\t\thost: { resolveMetadata, acquireArtifact, releaseArtifact },\n\t\topenArtifact,\n\t\tclose: async () => {\n\t\t\tif (closePromise !== undefined) return await closePromise;\n\t\t\tclosed = true;\n\t\t\tfor (const operation of activeOperations) operation.abort();\n\t\t\tclosePromise = (async () => {\n\t\t\t\tawait waitForOperations();\n\t\t\t\tconst directory = await baseDirectoryPromise;\n\t\t\t\tawait Promise.all([...artifacts.values()].map((record) => rm(record.path, { force: true })));\n\t\t\t\tartifacts.clear();\n\t\t\t\tawait rm(directory, { recursive: true, force: true });\n\t\t\t})();\n\t\t\treturn await closePromise;\n\t\t},\n\t};\n}\n\n/**\n * Compose the real Node HTTP transport with the explicit Ed25519 trust root.\n * Distribution descriptors are verified before metadata or artifact access;\n * the returned host still keeps bytes behind its private reader.\n */\nexport async function createNodeHttpPluginDistributionStackV1(\n\toptions: NodeHttpPluginDistributionStackOptionsV1,\n): Promise<NodeHttpPluginDistributionStackV1> {\n\tconst { trustRoot, now: configuredNow, ...hostOptions } = options;\n\tconst host = await createNodeHttpPluginDistributionHostV1(hostOptions);\n\ttry {\n\t\tconst now = configuredNow ?? trustRoot.now ?? (() => Date.now());\n\t\tconst verifySignature = createNodePluginTrustRootV1({ ...trustRoot, now });\n\t\tconst distribution = createPluginDistributionV1({ host: host.host, verifySignature, now });\n\t\treturn Object.freeze({ ...host, distribution });\n\t} catch (error) {\n\t\tawait host.close().catch(() => undefined);\n\t\tthrow error;\n\t}\n}\n"]}

package/dist/plugins/ecosystem/node-npm-registry-source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-npm-registry-source.d.ts","sourceRoot":"","sources":["../../../src/plugins/ecosystem/node-npm-registry-source.ts"],"names":[],"mappings":"AAqBA,MAAM,MAAM,gCAAgC,GACzC,WAAW,GACX,uBAAuB,GACvB,gBAAgB,GAChB,mBAAmB,GACnB,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,GACnB,mBAAmB,GACnB,uBAAuB,CAAC;AAE3B,qBAAa,4BAA6B,SAAQ,KAAK;IACtD,QAAQ,CAAC,IAAI,EAAE,gCAAgC,CAAC;IAEhD,YAAY,IAAI,EAAE,gCAAgC,EAAE,OAAO,EAAE,MAAM,EAIlE;CACD;AAED,4FAA4F;AAC5F,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,8BAA8B;IAC9C,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,2CAA2C;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,sDAAsD;IACtD,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACzC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,iBAAiB,EAAE,CAAC,KAAK,EAAE;QACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;KAC9B,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC1C,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;CAC/G;AAED,oFAAoF;AACpF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,CAgBhE;AAgBD;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAmBzG;AAsKD,6FAA6F;AAC7F,wBAAgB,6BAA6B,CAAC,OAAO,GAAE,8BAAmC,GAAG,uBAAuB,CA8InH","sourcesContent":["import { comparePluginVersionsV1 } from \"./catalog.ts\";\n\n/**\n * Minimal npm registry (packument) source for plugin package acquisition\n * (design `插件独立分发与启动装配设计.md` §4.2). It is a two-step protocol:\n * resolve the packument to pick one version, then fetch the tarball. It does\n * not implement `PluginRegistrySourceV1.list()`; the signed registry sources\n * keep serving private deployments unchanged.\n */\n\nconst DEFAULT_NPM_REGISTRY_V1 = \"https://registry.npmjs.org\";\nconst DEFAULT_TIMEOUT_MS_V1 = 15_000;\nconst MAX_TIMEOUT_MS_V1 = 120_000;\nconst DEFAULT_MAX_RESPONSE_BYTES_V1 = 8 * 1024 * 1024;\nconst MAX_RESPONSE_BYTES_V1 = 16 * 1024 * 1024;\nconst DEFAULT_MAX_TARBALL_BYTES_V1 = 128 * 1024 * 1024;\nconst MAX_TARBALL_BYTES_V1 = 512 * 1024 * 1024;\nconst DEFAULT_REDIRECTS_V1 = 3;\nconst MAX_REDIRECTS_V1 = 5;\nconst REDIRECT_STATUS = new Set([301, 302, 303, 307, 308]);\n\nexport type NodeNpmRegistrySourceErrorCodeV1 =\n\t| \"cancelled\"\n\t| \"invalid_configuration\"\n\t| \"request_failed\"\n\t| \"request_timed_out\"\n\t| \"invalid_response\"\n\t| \"response_too_large\"\n\t| \"package_not_found\"\n\t| \"version_not_found\"\n\t| \"integrity_unsupported\";\n\nexport class NodeNpmRegistrySourceErrorV1 extends Error {\n\treadonly code: NodeNpmRegistrySourceErrorCodeV1;\n\n\tconstructor(code: NodeNpmRegistrySourceErrorCodeV1, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"NodeNpmRegistrySourceErrorV1\";\n\t\tthis.code = code;\n\t}\n}\n\n/** SRI integrity as hex plus its algorithm, aligned with the install host digest format. */\nexport interface NodeNpmIntegrityV1 {\n\treadonly algorithm: \"sha256\" | \"sha512\";\n\treadonly hex: string;\n}\n\nexport interface NodeNpmPackageResolutionV1 {\n\treadonly version: string;\n\treadonly tarballUrl: string;\n\treadonly integrity: NodeNpmIntegrityV1;\n\t/** Raw `dist` fields of the selected version. */\n\treadonly distInfo: Readonly<Record<string, unknown>>;\n}\n\nexport interface NodeNpmRegistrySourceOptionsV1 {\n\t/** Bare http(s) registry origin; defaults to the npm public registry. */\n\treadonly registry?: string;\n\t/** Bearer token for private registries. */\n\treadonly token?: string;\n\t/** Real fetch or a deterministic test replacement. */\n\treadonly fetch?: typeof globalThis.fetch;\n\treadonly requestTimeoutMs?: number;\n\treadonly maxResponseBytes?: number;\n\treadonly maxTarballBytes?: number;\n\treadonly maxRedirects?: number;\n\treadonly userAgent?: string;\n}\n\nexport interface NodeNpmRegistrySourceV1 {\n\treadonly version: 1;\n\t/** Sanitized bare registry origin (no credentials, path, query, or fragment). */\n\treadonly registry: string;\n\treadonly resolveNpmPackage: (input: {\n\t\treadonly name: string;\n\t\treadonly range?: string;\n\t\treadonly signal?: AbortSignal;\n\t}) => Promise<NodeNpmPackageResolutionV1>;\n\treadonly fetchTarball: (input: { readonly url: string; readonly signal?: AbortSignal }) => Promise<Uint8Array>;\n}\n\n/** Convert an npm SRI string (`sha512-<base64>`, `sha256-<base64>`) to hex form. */\nexport function sriToIntegrityV1(sri: string): NodeNpmIntegrityV1 {\n\tconst match = /^(sha512|sha256)-([A-Za-z0-9+/]+={0,2})$/u.exec(sri.trim());\n\tif (match === null)\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\"integrity_unsupported\", \"npm integrity algorithm is unsupported\");\n\tconst algorithm = match[1] as \"sha512\" | \"sha256\";\n\tlet raw: Buffer;\n\ttry {\n\t\traw = Buffer.from(match[2]!, \"base64\");\n\t} catch {\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\"integrity_unsupported\", \"npm integrity encoding is invalid\");\n\t}\n\tif ((algorithm === \"sha256\" && raw.byteLength !== 32) || (algorithm === \"sha512\" && raw.byteLength !== 64))\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\"integrity_unsupported\", \"npm integrity length is invalid\");\n\tconst hex = raw.toString(\"hex\").toLowerCase();\n\tif (hex.length === 0) throw new NodeNpmRegistrySourceErrorV1(\"integrity_unsupported\", \"npm integrity is invalid\");\n\treturn { algorithm, hex };\n}\n\nfunction parseVersionTriple(value: string): readonly [number, number, number] | undefined {\n\tconst match = /^(\\d+)\\.(\\d+)\\.(\\d+)/u.exec(value.replace(/^[vV]/u, \"\"));\n\tif (match === null) return undefined;\n\tconst major = Number.parseInt(match[1]!, 10);\n\tconst minor = Number.parseInt(match[2]!, 10);\n\tconst patch = Number.parseInt(match[3]!, 10);\n\tif (!Number.isSafeInteger(major) || !Number.isSafeInteger(minor) || !Number.isSafeInteger(patch)) return undefined;\n\treturn [major, minor, patch] as const;\n}\n\nfunction plainVersion(value: string): string {\n\treturn value.replace(/^[vV]/u, \"\");\n}\n\n/**\n * Select the highest version satisfying a minimal range subset using the\n * ecosystem comparator (`comparePluginVersionsV1`): `undefined`/`latest` →\n * highest; `x.y.z` → exact full match (prerelease suffix included);\n * `^x.y.z` → >= x.y.z and < (x+1).0.0; `~x.y.z` → >= x.y.z and\n * < x.(y+1).0. Bounds use the comparator ordering (e.g. `1.0.0-alpha`\n * sorts below `1.0.0`).\n */\nexport function selectNpmPackageVersionV1(versions: readonly string[], range?: string): string | undefined {\n\tif (!Array.isArray(versions)) return undefined;\n\tlet candidates = versions.filter((value) => typeof value === \"string\" && parseVersionTriple(value) !== undefined);\n\tif (candidates.length === 0) return undefined;\n\tif (range === undefined || range === \"latest\") {\n\t\treturn candidates.reduce((left, right) => (comparePluginVersionsV1(right, left) > 0 ? right : left));\n\t}\n\tconst exact = plainVersion(range.replace(/^[=~^]/u, \"\"));\n\tif (!range.startsWith(\"^\") && !range.startsWith(\"~\"))\n\t\treturn candidates.find((value) => plainVersion(value) === exact);\n\tconst bound = parseVersionTriple(exact);\n\tif (bound === undefined) return undefined;\n\tconst [major, minor] = bound;\n\tconst upper = range.startsWith(\"^\") ? `${major + 1}.0.0` : `${major}.${minor + 1}.0`;\n\tcandidates = candidates.filter(\n\t\t(value) => comparePluginVersionsV1(value, exact) >= 0 && comparePluginVersionsV1(value, upper) < 0,\n\t);\n\tif (candidates.length === 0) return undefined;\n\treturn candidates.reduce((left, right) => (comparePluginVersionsV1(right, left) > 0 ? right : left));\n}\n\nfunction boundedPositive(value: number | undefined, fallback: number, maximum: number, label: string): number {\n\tconst result = value ?? fallback;\n\tif (!Number.isSafeInteger(result) || result <= 0 || result > maximum)\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\n\t\t\t\"invalid_configuration\",\n\t\t\t`${label} must be a positive integer at most ${maximum}`,\n\t\t);\n\treturn result;\n}\n\nfunction registryOrigin(value: string): string {\n\tlet parsed: URL;\n\ttry {\n\t\tparsed = new URL(value);\n\t} catch {\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\"invalid_configuration\", \"npm registry origin is invalid\");\n\t}\n\tif (\n\t\t(parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") ||\n\t\tparsed.username !== \"\" ||\n\t\tparsed.password !== \"\"\n\t)\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\n\t\t\t\"invalid_configuration\",\n\t\t\t\"npm registry origin must be http(s) without credentials\",\n\t\t);\n\tif (parsed.pathname !== \"/\" || parsed.search !== \"\" || parsed.hash !== \"\")\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\n\t\t\t\"invalid_configuration\",\n\t\t\t\"npm registry origin must not include a path, query, or fragment\",\n\t\t);\n\treturn parsed.origin;\n}\n\nfunction packumentUrl(registryOriginValue: string, name: string): URL {\n\tconst scopeAt = name.indexOf(\"/\");\n\tif (name.startsWith(\"@\") && scopeAt > 0) {\n\t\t// npm registry convention keeps the leading scope literal and percent\n\t\t// encodes the rest of the name, including the separating slash.\n\t\tconst scope = name.slice(0, scopeAt);\n\t\tconst packageName = name.slice(scopeAt + 1);\n\t\treturn new URL(`${registryOriginValue}/${scope}%2F${encodeURIComponent(packageName)}`);\n\t}\n\tif (scopeAt >= 0) throw new NodeNpmRegistrySourceErrorV1(\"invalid_configuration\", \"npm package name is invalid\");\n\treturn new URL(`${registryOriginValue}/${encodeURIComponent(name)}`);\n}\n\nfunction tarballUrl(value: string): URL {\n\tlet parsed: URL;\n\ttry {\n\t\tparsed = new URL(value);\n\t} catch {\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\"invalid_response\", \"npm tarball URL is invalid\");\n\t}\n\tif (\n\t\t(parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") ||\n\t\tparsed.username !== \"\" ||\n\t\tparsed.password !== \"\"\n\t)\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\n\t\t\t\"invalid_response\",\n\t\t\t\"npm tarball URL must use http(s) without credentials\",\n\t\t);\n\tif (parsed.hash !== \"\")\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\"invalid_response\", \"npm tarball URL must not include a fragment\");\n\treturn parsed;\n}\n\nfunction isAbortLike(error: unknown): boolean {\n\treturn error instanceof Error && (error.name === \"AbortError\" || error.name === \"AbortSignalError\");\n}\n\ninterface RequestSignal {\n\treadonly signal: AbortSignal;\n\treadonly timedOut: () => boolean;\n\treadonly cleanup: () => void;\n}\n\nfunction requestSignal(parent: AbortSignal | undefined, timeoutMs: number): RequestSignal {\n\tconst controller = new AbortController();\n\tlet timedOut = false;\n\tconst abort = () => controller.abort(parent?.reason);\n\tif (parent?.aborted === true) abort();\n\telse parent?.addEventListener(\"abort\", abort, { once: true });\n\tconst timeout = setTimeout(() => {\n\t\ttimedOut = true;\n\t\tcontroller.abort();\n\t}, timeoutMs);\n\treturn {\n\t\tsignal: controller.signal,\n\t\ttimedOut: () => timedOut,\n\t\tcleanup: () => {\n\t\t\tclearTimeout(timeout);\n\t\t\tparent?.removeEventListener(\"abort\", abort);\n\t\t},\n\t};\n}\n\nfunction isJsonResponse(response: Response): boolean {\n\tconst contentType = response.headers.get(\"content-type\");\n\tif (contentType === null) return false;\n\tconst mediaType = contentType.split(\";\", 1)[0]?.trim().toLowerCase();\n\treturn mediaType === \"application/json\" || mediaType === \"application/vnd.npm.install-v1+json\";\n}\n\nasync function readBody(response: Response, maxBytes: number, signal: AbortSignal): Promise<Uint8Array> {\n\tif (response.body === null)\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\"invalid_response\", \"npm registry response has no body\");\n\tconst reader = response.body.getReader();\n\tconst chunks: Uint8Array[] = [];\n\tlet total = 0;\n\ttry {\n\t\tfor (;;) {\n\t\t\tif (signal.aborted) throw new DOMException(\"aborted\", \"AbortError\");\n\t\t\tconst item = await reader.read();\n\t\t\tif (item.done) break;\n\t\t\ttotal += item.value.byteLength;\n\t\t\tif (total > maxBytes)\n\t\t\t\tthrow new NodeNpmRegistrySourceErrorV1(\n\t\t\t\t\t\"response_too_large\",\n\t\t\t\t\t\"npm registry response exceeds the configured size limit\",\n\t\t\t\t);\n\t\t\tchunks.push(item.value);\n\t\t}\n\t} finally {\n\t\treader.releaseLock();\n\t}\n\tconst bytes = new Uint8Array(total);\n\tlet offset = 0;\n\tfor (const chunk of chunks) {\n\t\tbytes.set(chunk, offset);\n\t\toffset += chunk.byteLength;\n\t}\n\treturn bytes;\n}\n\ninterface PackumentVersionDistV1 {\n\treadonly tarball?: unknown;\n\treadonly integrity?: unknown;\n}\n\ninterface PackumentVersionV1 {\n\treadonly dist?: PackumentVersionDistV1;\n}\n\ninterface PackumentV1 {\n\treadonly versions?: Readonly<Record<string, PackumentVersionV1>>;\n}\n\nfunction parsePackument(bytes: Uint8Array): Readonly<Record<string, PackumentVersionV1>> {\n\tlet value: unknown;\n\ttry {\n\t\tvalue = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes));\n\t} catch {\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\"invalid_response\", \"npm registry response is not valid JSON\");\n\t}\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value))\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\"invalid_response\", \"npm packument is invalid\");\n\tconst packument = value as PackumentV1;\n\tif (typeof packument.versions !== \"object\" || packument.versions === null || Array.isArray(packument.versions))\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\"invalid_response\", \"npm packument has no version table\");\n\treturn packument.versions;\n}\n\n/** Create a bounded npm registry reader. Version selection uses the ecosystem comparator. */\nexport function createNodeNpmRegistrySourceV1(options: NodeNpmRegistrySourceOptionsV1 = {}): NodeNpmRegistrySourceV1 {\n\tconst transport = options.fetch ?? globalThis.fetch;\n\tif (typeof transport !== \"function\")\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\"invalid_configuration\", \"Node fetch is unavailable\");\n\tconst registry = registryOrigin(options.registry ?? DEFAULT_NPM_REGISTRY_V1);\n\tif (\n\t\toptions.token !== undefined &&\n\t\t(options.token.length === 0 || options.token.length > 4096 || /[\\r\\n\\s]/u.test(options.token))\n\t)\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\"invalid_configuration\", \"npm registry token is invalid\");\n\tconst token = options.token;\n\tconst timeoutMs = boundedPositive(\n\t\toptions.requestTimeoutMs,\n\t\tDEFAULT_TIMEOUT_MS_V1,\n\t\tMAX_TIMEOUT_MS_V1,\n\t\t\"requestTimeoutMs\",\n\t);\n\tconst maxResponseBytes = boundedPositive(\n\t\toptions.maxResponseBytes,\n\t\tDEFAULT_MAX_RESPONSE_BYTES_V1,\n\t\tMAX_RESPONSE_BYTES_V1,\n\t\t\"maxResponseBytes\",\n\t);\n\tconst maxTarballBytes = boundedPositive(\n\t\toptions.maxTarballBytes,\n\t\tDEFAULT_MAX_TARBALL_BYTES_V1,\n\t\tMAX_TARBALL_BYTES_V1,\n\t\t\"maxTarballBytes\",\n\t);\n\tconst maxRedirects = options.maxRedirects ?? DEFAULT_REDIRECTS_V1;\n\tif (!Number.isSafeInteger(maxRedirects) || maxRedirects < 0 || maxRedirects > MAX_REDIRECTS_V1)\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\n\t\t\t\"invalid_configuration\",\n\t\t\t`maxRedirects must be an integer between 0 and ${MAX_REDIRECTS_V1}`,\n\t\t);\n\tconst userAgent = options.userAgent ?? \"agent-forge-plugin-npm/1\";\n\tif (userAgent.length === 0 || userAgent.length > 256 || /[\\r\\n]/u.test(userAgent))\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\"invalid_configuration\", \"userAgent is invalid\");\n\n\tconst fetchFollowingRedirects = async (\n\t\turl: URL,\n\t\theaders: Readonly<Record<string, string>>,\n\t\tparentSignal: AbortSignal | undefined,\n\t): Promise<{ readonly response: Response; readonly request: RequestSignal }> => {\n\t\tlet current = url;\n\t\tfor (let redirect = 0; ; redirect += 1) {\n\t\t\tconst request = requestSignal(parentSignal, timeoutMs);\n\t\t\tlet response: Response;\n\t\t\ttry {\n\t\t\t\tresponse = await transport(current.toString(), {\n\t\t\t\t\tmethod: \"GET\",\n\t\t\t\t\theaders: { accept: \"*/*\", \"user-agent\": userAgent, ...headers },\n\t\t\t\t\tredirect: \"manual\",\n\t\t\t\t\tsignal: request.signal,\n\t\t\t\t});\n\t\t\t} catch (error) {\n\t\t\t\trequest.cleanup();\n\t\t\t\tif (request.timedOut())\n\t\t\t\t\tthrow new NodeNpmRegistrySourceErrorV1(\"request_timed_out\", \"npm registry request timed out\");\n\t\t\t\tif (isAbortLike(error))\n\t\t\t\t\tthrow new NodeNpmRegistrySourceErrorV1(\"cancelled\", \"npm registry request was cancelled\");\n\t\t\t\tthrow new NodeNpmRegistrySourceErrorV1(\"request_failed\", \"npm registry request failed\");\n\t\t\t}\n\t\t\tif (!REDIRECT_STATUS.has(response.status)) return { response, request };\n\t\t\tconst location = response.headers.get(\"location\");\n\t\t\tawait response.body?.cancel().catch(() => undefined);\n\t\t\trequest.cleanup();\n\t\t\tif (location === null || redirect >= maxRedirects)\n\t\t\t\tthrow new NodeNpmRegistrySourceErrorV1(\"request_failed\", \"npm registry redirect limit exceeded\");\n\t\t\tcurrent = tarballUrl(new URL(location, current).toString());\n\t\t}\n\t};\n\n\tconst resolveNpmPackage = async (input: {\n\t\treadonly name: string;\n\t\treadonly range?: string;\n\t\treadonly signal?: AbortSignal;\n\t}): Promise<NodeNpmPackageResolutionV1> => {\n\t\tif (input.signal?.aborted === true)\n\t\t\tthrow new NodeNpmRegistrySourceErrorV1(\"cancelled\", \"npm registry request was cancelled\");\n\t\tconst endpoint = packumentUrl(registry, input.name);\n\t\tconst authorization: Readonly<Record<string, string>> =\n\t\t\ttoken === undefined ? {} : { authorization: `Bearer ${token}` };\n\t\tconst { response, request } = await fetchFollowingRedirects(endpoint, authorization, input.signal);\n\t\ttry {\n\t\t\tif (response.status === 404 || response.status === 403)\n\t\t\t\tthrow new NodeNpmRegistrySourceErrorV1(\"package_not_found\", \"npm package was not found on the registry\");\n\t\t\tif (response.status < 200 || response.status >= 300)\n\t\t\t\tthrow new NodeNpmRegistrySourceErrorV1(\"request_failed\", \"npm registry request did not succeed\");\n\t\t\tif (!isJsonResponse(response))\n\t\t\t\tthrow new NodeNpmRegistrySourceErrorV1(\"invalid_response\", \"npm registry response must be JSON\");\n\t\t\tconst versions = parsePackument(await readBody(response, maxResponseBytes, request.signal));\n\t\t\tconst version = selectNpmPackageVersionV1(Object.keys(versions), input.range);\n\t\t\tconst dist = version === undefined ? undefined : versions[version]?.dist;\n\t\t\tif (\n\t\t\t\tversion === undefined ||\n\t\t\t\tdist === undefined ||\n\t\t\t\ttypeof dist.tarball !== \"string\" ||\n\t\t\t\tdist.tarball.length === 0\n\t\t\t) {\n\t\t\t\tthrow new NodeNpmRegistrySourceErrorV1(\n\t\t\t\t\t\"version_not_found\",\n\t\t\t\t\t\"No npm package version matches the requested range\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst integrityValue = dist.integrity;\n\t\t\tconst integrity =\n\t\t\t\ttypeof integrityValue === \"string\" && integrityValue.length > 0\n\t\t\t\t\t? sriToIntegrityV1(integrityValue)\n\t\t\t\t\t: undefined;\n\t\t\tif (integrity === undefined)\n\t\t\t\tthrow new NodeNpmRegistrySourceErrorV1(\"invalid_response\", \"npm package version has no integrity field\");\n\t\t\treturn {\n\t\t\t\tversion,\n\t\t\t\ttarballUrl: tarballUrl(dist.tarball).toString(),\n\t\t\t\tintegrity,\n\t\t\t\tdistInfo: dist as Readonly<Record<string, unknown>>,\n\t\t\t};\n\t\t} finally {\n\t\t\tawait response.body?.cancel().catch(() => undefined);\n\t\t\trequest.cleanup();\n\t\t}\n\t};\n\n\tconst fetchTarball = async (input: { readonly url: string; readonly signal?: AbortSignal }): Promise<Uint8Array> => {\n\t\tif (input.signal?.aborted === true)\n\t\t\tthrow new NodeNpmRegistrySourceErrorV1(\"cancelled\", \"npm tarball download was cancelled\");\n\t\tconst endpoint = tarballUrl(input.url);\n\t\tconst authorization: Readonly<Record<string, string>> =\n\t\t\ttoken === undefined ? {} : { authorization: `Bearer ${token}` };\n\t\tconst { response, request } = await fetchFollowingRedirects(endpoint, authorization, input.signal);\n\t\ttry {\n\t\t\tif (response.status < 200 || response.status >= 300)\n\t\t\t\tthrow new NodeNpmRegistrySourceErrorV1(\"request_failed\", \"npm tarball download did not succeed\");\n\t\t\treturn await readBody(response, maxTarballBytes, request.signal);\n\t\t} finally {\n\t\t\tawait response.body?.cancel().catch(() => undefined);\n\t\t\trequest.cleanup();\n\t\t}\n\t};\n\n\treturn { version: 1, registry, resolveNpmPackage, fetchTarball };\n}\n"]}
+{"version":3,"file":"node-npm-registry-source.d.ts","sourceRoot":"","sources":["../../../src/plugins/ecosystem/node-npm-registry-source.ts"],"names":[],"mappings":"AAsBA,MAAM,MAAM,gCAAgC,GACzC,WAAW,GACX,uBAAuB,GACvB,gBAAgB,GAChB,mBAAmB,GACnB,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,GACnB,mBAAmB,GACnB,uBAAuB,CAAC;AAE3B,qBAAa,4BAA6B,SAAQ,KAAK;IACtD,QAAQ,CAAC,IAAI,EAAE,gCAAgC,CAAC;IAEhD,YAAY,IAAI,EAAE,gCAAgC,EAAE,OAAO,EAAE,MAAM,EAIlE;CACD;AAED,4FAA4F;AAC5F,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,8BAA8B;IAC9C,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,2CAA2C;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,sDAAsD;IACtD,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACzC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,iBAAiB,EAAE,CAAC,KAAK,EAAE;QACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;KAC9B,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC1C,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;CAC/G;AAED,oFAAoF;AACpF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,CAgBhE;AAgBD;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAmBzG;AAsKD,6FAA6F;AAC7F,wBAAgB,6BAA6B,CAAC,OAAO,GAAE,8BAAmC,GAAG,uBAAuB,CA8InH","sourcesContent":["import { t } from \"../../core/i18n/index.ts\";\nimport { comparePluginVersionsV1 } from \"./catalog.ts\";\n\n/**\n * Minimal npm registry (packument) source for plugin package acquisition\n * (design `插件独立分发与启动装配设计.md` §4.2). It is a two-step protocol:\n * resolve the packument to pick one version, then fetch the tarball. It does\n * not implement `PluginRegistrySourceV1.list()`; the signed registry sources\n * keep serving private deployments unchanged.\n */\n\nconst DEFAULT_NPM_REGISTRY_V1 = \"https://registry.npmjs.org\";\nconst DEFAULT_TIMEOUT_MS_V1 = 15_000;\nconst MAX_TIMEOUT_MS_V1 = 120_000;\nconst DEFAULT_MAX_RESPONSE_BYTES_V1 = 8 * 1024 * 1024;\nconst MAX_RESPONSE_BYTES_V1 = 16 * 1024 * 1024;\nconst DEFAULT_MAX_TARBALL_BYTES_V1 = 128 * 1024 * 1024;\nconst MAX_TARBALL_BYTES_V1 = 512 * 1024 * 1024;\nconst DEFAULT_REDIRECTS_V1 = 3;\nconst MAX_REDIRECTS_V1 = 5;\nconst REDIRECT_STATUS = new Set([301, 302, 303, 307, 308]);\n\nexport type NodeNpmRegistrySourceErrorCodeV1 =\n\t| \"cancelled\"\n\t| \"invalid_configuration\"\n\t| \"request_failed\"\n\t| \"request_timed_out\"\n\t| \"invalid_response\"\n\t| \"response_too_large\"\n\t| \"package_not_found\"\n\t| \"version_not_found\"\n\t| \"integrity_unsupported\";\n\nexport class NodeNpmRegistrySourceErrorV1 extends Error {\n\treadonly code: NodeNpmRegistrySourceErrorCodeV1;\n\n\tconstructor(code: NodeNpmRegistrySourceErrorCodeV1, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"NodeNpmRegistrySourceErrorV1\";\n\t\tthis.code = code;\n\t}\n}\n\n/** SRI integrity as hex plus its algorithm, aligned with the install host digest format. */\nexport interface NodeNpmIntegrityV1 {\n\treadonly algorithm: \"sha256\" | \"sha512\";\n\treadonly hex: string;\n}\n\nexport interface NodeNpmPackageResolutionV1 {\n\treadonly version: string;\n\treadonly tarballUrl: string;\n\treadonly integrity: NodeNpmIntegrityV1;\n\t/** Raw `dist` fields of the selected version. */\n\treadonly distInfo: Readonly<Record<string, unknown>>;\n}\n\nexport interface NodeNpmRegistrySourceOptionsV1 {\n\t/** Bare http(s) registry origin; defaults to the npm public registry. */\n\treadonly registry?: string;\n\t/** Bearer token for private registries. */\n\treadonly token?: string;\n\t/** Real fetch or a deterministic test replacement. */\n\treadonly fetch?: typeof globalThis.fetch;\n\treadonly requestTimeoutMs?: number;\n\treadonly maxResponseBytes?: number;\n\treadonly maxTarballBytes?: number;\n\treadonly maxRedirects?: number;\n\treadonly userAgent?: string;\n}\n\nexport interface NodeNpmRegistrySourceV1 {\n\treadonly version: 1;\n\t/** Sanitized bare registry origin (no credentials, path, query, or fragment). */\n\treadonly registry: string;\n\treadonly resolveNpmPackage: (input: {\n\t\treadonly name: string;\n\t\treadonly range?: string;\n\t\treadonly signal?: AbortSignal;\n\t}) => Promise<NodeNpmPackageResolutionV1>;\n\treadonly fetchTarball: (input: { readonly url: string; readonly signal?: AbortSignal }) => Promise<Uint8Array>;\n}\n\n/** Convert an npm SRI string (`sha512-<base64>`, `sha256-<base64>`) to hex form. */\nexport function sriToIntegrityV1(sri: string): NodeNpmIntegrityV1 {\n\tconst match = /^(sha512|sha256)-([A-Za-z0-9+/]+={0,2})$/u.exec(sri.trim());\n\tif (match === null)\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\"integrity_unsupported\", t(\"npm integrity algorithm is unsupported\"));\n\tconst algorithm = match[1] as \"sha512\" | \"sha256\";\n\tlet raw: Buffer;\n\ttry {\n\t\traw = Buffer.from(match[2]!, \"base64\");\n\t} catch {\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\"integrity_unsupported\", t(\"npm integrity encoding is invalid\"));\n\t}\n\tif ((algorithm === \"sha256\" && raw.byteLength !== 32) || (algorithm === \"sha512\" && raw.byteLength !== 64))\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\"integrity_unsupported\", t(\"npm integrity length is invalid\"));\n\tconst hex = raw.toString(\"hex\").toLowerCase();\n\tif (hex.length === 0) throw new NodeNpmRegistrySourceErrorV1(\"integrity_unsupported\", t(\"npm integrity is invalid\"));\n\treturn { algorithm, hex };\n}\n\nfunction parseVersionTriple(value: string): readonly [number, number, number] | undefined {\n\tconst match = /^(\\d+)\\.(\\d+)\\.(\\d+)/u.exec(value.replace(/^[vV]/u, \"\"));\n\tif (match === null) return undefined;\n\tconst major = Number.parseInt(match[1]!, 10);\n\tconst minor = Number.parseInt(match[2]!, 10);\n\tconst patch = Number.parseInt(match[3]!, 10);\n\tif (!Number.isSafeInteger(major) || !Number.isSafeInteger(minor) || !Number.isSafeInteger(patch)) return undefined;\n\treturn [major, minor, patch] as const;\n}\n\nfunction plainVersion(value: string): string {\n\treturn value.replace(/^[vV]/u, \"\");\n}\n\n/**\n * Select the highest version satisfying a minimal range subset using the\n * ecosystem comparator (`comparePluginVersionsV1`): `undefined`/`latest` →\n * highest; `x.y.z` → exact full match (prerelease suffix included);\n * `^x.y.z` → >= x.y.z and < (x+1).0.0; `~x.y.z` → >= x.y.z and\n * < x.(y+1).0. Bounds use the comparator ordering (e.g. `1.0.0-alpha`\n * sorts below `1.0.0`).\n */\nexport function selectNpmPackageVersionV1(versions: readonly string[], range?: string): string | undefined {\n\tif (!Array.isArray(versions)) return undefined;\n\tlet candidates = versions.filter((value) => typeof value === \"string\" && parseVersionTriple(value) !== undefined);\n\tif (candidates.length === 0) return undefined;\n\tif (range === undefined || range === \"latest\") {\n\t\treturn candidates.reduce((left, right) => (comparePluginVersionsV1(right, left) > 0 ? right : left));\n\t}\n\tconst exact = plainVersion(range.replace(/^[=~^]/u, \"\"));\n\tif (!range.startsWith(\"^\") && !range.startsWith(\"~\"))\n\t\treturn candidates.find((value) => plainVersion(value) === exact);\n\tconst bound = parseVersionTriple(exact);\n\tif (bound === undefined) return undefined;\n\tconst [major, minor] = bound;\n\tconst upper = range.startsWith(\"^\") ? `${major + 1}.0.0` : `${major}.${minor + 1}.0`;\n\tcandidates = candidates.filter(\n\t\t(value) => comparePluginVersionsV1(value, exact) >= 0 && comparePluginVersionsV1(value, upper) < 0,\n\t);\n\tif (candidates.length === 0) return undefined;\n\treturn candidates.reduce((left, right) => (comparePluginVersionsV1(right, left) > 0 ? right : left));\n}\n\nfunction boundedPositive(value: number | undefined, fallback: number, maximum: number, label: string): number {\n\tconst result = value ?? fallback;\n\tif (!Number.isSafeInteger(result) || result <= 0 || result > maximum)\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\n\t\t\t\"invalid_configuration\",\n\t\t\tt(\"{label} must be a positive integer at most {maximum}\", { label, maximum }),\n\t\t);\n\treturn result;\n}\n\nfunction registryOrigin(value: string): string {\n\tlet parsed: URL;\n\ttry {\n\t\tparsed = new URL(value);\n\t} catch {\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\"invalid_configuration\", t(\"npm registry origin is invalid\"));\n\t}\n\tif (\n\t\t(parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") ||\n\t\tparsed.username !== \"\" ||\n\t\tparsed.password !== \"\"\n\t)\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\n\t\t\t\"invalid_configuration\",\n\t\t\tt(\"npm registry origin must be http(s) without credentials\"),\n\t\t);\n\tif (parsed.pathname !== \"/\" || parsed.search !== \"\" || parsed.hash !== \"\")\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\n\t\t\t\"invalid_configuration\",\n\t\t\tt(\"npm registry origin must not include a path, query, or fragment\"),\n\t\t);\n\treturn parsed.origin;\n}\n\nfunction packumentUrl(registryOriginValue: string, name: string): URL {\n\tconst scopeAt = name.indexOf(\"/\");\n\tif (name.startsWith(\"@\") && scopeAt > 0) {\n\t\t// npm registry convention keeps the leading scope literal and percent\n\t\t// encodes the rest of the name, including the separating slash.\n\t\tconst scope = name.slice(0, scopeAt);\n\t\tconst packageName = name.slice(scopeAt + 1);\n\t\treturn new URL(`${registryOriginValue}/${scope}%2F${encodeURIComponent(packageName)}`);\n\t}\n\tif (scopeAt >= 0) throw new NodeNpmRegistrySourceErrorV1(\"invalid_configuration\", t(\"npm package name is invalid\"));\n\treturn new URL(`${registryOriginValue}/${encodeURIComponent(name)}`);\n}\n\nfunction tarballUrl(value: string): URL {\n\tlet parsed: URL;\n\ttry {\n\t\tparsed = new URL(value);\n\t} catch {\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\"invalid_response\", t(\"npm tarball URL is invalid\"));\n\t}\n\tif (\n\t\t(parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") ||\n\t\tparsed.username !== \"\" ||\n\t\tparsed.password !== \"\"\n\t)\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\n\t\t\t\"invalid_response\",\n\t\t\tt(\"npm tarball URL must use http(s) without credentials\"),\n\t\t);\n\tif (parsed.hash !== \"\")\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\"invalid_response\", t(\"npm tarball URL must not include a fragment\"));\n\treturn parsed;\n}\n\nfunction isAbortLike(error: unknown): boolean {\n\treturn error instanceof Error && (error.name === \"AbortError\" || error.name === \"AbortSignalError\");\n}\n\ninterface RequestSignal {\n\treadonly signal: AbortSignal;\n\treadonly timedOut: () => boolean;\n\treadonly cleanup: () => void;\n}\n\nfunction requestSignal(parent: AbortSignal | undefined, timeoutMs: number): RequestSignal {\n\tconst controller = new AbortController();\n\tlet timedOut = false;\n\tconst abort = () => controller.abort(parent?.reason);\n\tif (parent?.aborted === true) abort();\n\telse parent?.addEventListener(\"abort\", abort, { once: true });\n\tconst timeout = setTimeout(() => {\n\t\ttimedOut = true;\n\t\tcontroller.abort();\n\t}, timeoutMs);\n\treturn {\n\t\tsignal: controller.signal,\n\t\ttimedOut: () => timedOut,\n\t\tcleanup: () => {\n\t\t\tclearTimeout(timeout);\n\t\t\tparent?.removeEventListener(\"abort\", abort);\n\t\t},\n\t};\n}\n\nfunction isJsonResponse(response: Response): boolean {\n\tconst contentType = response.headers.get(\"content-type\");\n\tif (contentType === null) return false;\n\tconst mediaType = contentType.split(\";\", 1)[0]?.trim().toLowerCase();\n\treturn mediaType === \"application/json\" || mediaType === \"application/vnd.npm.install-v1+json\";\n}\n\nasync function readBody(response: Response, maxBytes: number, signal: AbortSignal): Promise<Uint8Array> {\n\tif (response.body === null)\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\"invalid_response\", t(\"npm registry response has no body\"));\n\tconst reader = response.body.getReader();\n\tconst chunks: Uint8Array[] = [];\n\tlet total = 0;\n\ttry {\n\t\tfor (;;) {\n\t\t\tif (signal.aborted) throw new DOMException(t(\"aborted\"), \"AbortError\");\n\t\t\tconst item = await reader.read();\n\t\t\tif (item.done) break;\n\t\t\ttotal += item.value.byteLength;\n\t\t\tif (total > maxBytes)\n\t\t\t\tthrow new NodeNpmRegistrySourceErrorV1(\n\t\t\t\t\t\"response_too_large\",\n\t\t\t\t\tt(\"npm registry response exceeds the configured size limit\"),\n\t\t\t\t);\n\t\t\tchunks.push(item.value);\n\t\t}\n\t} finally {\n\t\treader.releaseLock();\n\t}\n\tconst bytes = new Uint8Array(total);\n\tlet offset = 0;\n\tfor (const chunk of chunks) {\n\t\tbytes.set(chunk, offset);\n\t\toffset += chunk.byteLength;\n\t}\n\treturn bytes;\n}\n\ninterface PackumentVersionDistV1 {\n\treadonly tarball?: unknown;\n\treadonly integrity?: unknown;\n}\n\ninterface PackumentVersionV1 {\n\treadonly dist?: PackumentVersionDistV1;\n}\n\ninterface PackumentV1 {\n\treadonly versions?: Readonly<Record<string, PackumentVersionV1>>;\n}\n\nfunction parsePackument(bytes: Uint8Array): Readonly<Record<string, PackumentVersionV1>> {\n\tlet value: unknown;\n\ttry {\n\t\tvalue = JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes));\n\t} catch {\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\"invalid_response\", t(\"npm registry response is not valid JSON\"));\n\t}\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value))\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\"invalid_response\", t(\"npm packument is invalid\"));\n\tconst packument = value as PackumentV1;\n\tif (typeof packument.versions !== \"object\" || packument.versions === null || Array.isArray(packument.versions))\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\"invalid_response\", t(\"npm packument has no version table\"));\n\treturn packument.versions;\n}\n\n/** Create a bounded npm registry reader. Version selection uses the ecosystem comparator. */\nexport function createNodeNpmRegistrySourceV1(options: NodeNpmRegistrySourceOptionsV1 = {}): NodeNpmRegistrySourceV1 {\n\tconst transport = options.fetch ?? globalThis.fetch;\n\tif (typeof transport !== \"function\")\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\"invalid_configuration\", t(\"Node fetch is unavailable\"));\n\tconst registry = registryOrigin(options.registry ?? DEFAULT_NPM_REGISTRY_V1);\n\tif (\n\t\toptions.token !== undefined &&\n\t\t(options.token.length === 0 || options.token.length > 4096 || /[\\r\\n\\s]/u.test(options.token))\n\t)\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\"invalid_configuration\", t(\"npm registry token is invalid\"));\n\tconst token = options.token;\n\tconst timeoutMs = boundedPositive(\n\t\toptions.requestTimeoutMs,\n\t\tDEFAULT_TIMEOUT_MS_V1,\n\t\tMAX_TIMEOUT_MS_V1,\n\t\t\"requestTimeoutMs\",\n\t);\n\tconst maxResponseBytes = boundedPositive(\n\t\toptions.maxResponseBytes,\n\t\tDEFAULT_MAX_RESPONSE_BYTES_V1,\n\t\tMAX_RESPONSE_BYTES_V1,\n\t\t\"maxResponseBytes\",\n\t);\n\tconst maxTarballBytes = boundedPositive(\n\t\toptions.maxTarballBytes,\n\t\tDEFAULT_MAX_TARBALL_BYTES_V1,\n\t\tMAX_TARBALL_BYTES_V1,\n\t\t\"maxTarballBytes\",\n\t);\n\tconst maxRedirects = options.maxRedirects ?? DEFAULT_REDIRECTS_V1;\n\tif (!Number.isSafeInteger(maxRedirects) || maxRedirects < 0 || maxRedirects > MAX_REDIRECTS_V1)\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\n\t\t\t\"invalid_configuration\",\n\t\t\tt(\"maxRedirects must be an integer between 0 and {max}\", { max: MAX_REDIRECTS_V1 }),\n\t\t);\n\tconst userAgent = options.userAgent ?? \"agent-forge-plugin-npm/1\";\n\tif (userAgent.length === 0 || userAgent.length > 256 || /[\\r\\n]/u.test(userAgent))\n\t\tthrow new NodeNpmRegistrySourceErrorV1(\"invalid_configuration\", t(\"userAgent is invalid\"));\n\n\tconst fetchFollowingRedirects = async (\n\t\turl: URL,\n\t\theaders: Readonly<Record<string, string>>,\n\t\tparentSignal: AbortSignal | undefined,\n\t): Promise<{ readonly response: Response; readonly request: RequestSignal }> => {\n\t\tlet current = url;\n\t\tfor (let redirect = 0; ; redirect += 1) {\n\t\t\tconst request = requestSignal(parentSignal, timeoutMs);\n\t\t\tlet response: Response;\n\t\t\ttry {\n\t\t\t\tresponse = await transport(current.toString(), {\n\t\t\t\t\tmethod: \"GET\",\n\t\t\t\t\theaders: { accept: \"*/*\", \"user-agent\": userAgent, ...headers },\n\t\t\t\t\tredirect: \"manual\",\n\t\t\t\t\tsignal: request.signal,\n\t\t\t\t});\n\t\t\t} catch (error) {\n\t\t\t\trequest.cleanup();\n\t\t\t\tif (request.timedOut())\n\t\t\t\t\tthrow new NodeNpmRegistrySourceErrorV1(\"request_timed_out\", t(\"npm registry request timed out\"));\n\t\t\t\tif (isAbortLike(error))\n\t\t\t\t\tthrow new NodeNpmRegistrySourceErrorV1(\"cancelled\", t(\"npm registry request was cancelled\"));\n\t\t\t\tthrow new NodeNpmRegistrySourceErrorV1(\"request_failed\", t(\"npm registry request failed\"));\n\t\t\t}\n\t\t\tif (!REDIRECT_STATUS.has(response.status)) return { response, request };\n\t\t\tconst location = response.headers.get(\"location\");\n\t\t\tawait response.body?.cancel().catch(() => undefined);\n\t\t\trequest.cleanup();\n\t\t\tif (location === null || redirect >= maxRedirects)\n\t\t\t\tthrow new NodeNpmRegistrySourceErrorV1(\"request_failed\", t(\"npm registry redirect limit exceeded\"));\n\t\t\tcurrent = tarballUrl(new URL(location, current).toString());\n\t\t}\n\t};\n\n\tconst resolveNpmPackage = async (input: {\n\t\treadonly name: string;\n\t\treadonly range?: string;\n\t\treadonly signal?: AbortSignal;\n\t}): Promise<NodeNpmPackageResolutionV1> => {\n\t\tif (input.signal?.aborted === true)\n\t\t\tthrow new NodeNpmRegistrySourceErrorV1(\"cancelled\", t(\"npm registry request was cancelled\"));\n\t\tconst endpoint = packumentUrl(registry, input.name);\n\t\tconst authorization: Readonly<Record<string, string>> =\n\t\t\ttoken === undefined ? {} : { authorization: `Bearer ${token}` };\n\t\tconst { response, request } = await fetchFollowingRedirects(endpoint, authorization, input.signal);\n\t\ttry {\n\t\t\tif (response.status === 404 || response.status === 403)\n\t\t\t\tthrow new NodeNpmRegistrySourceErrorV1(\"package_not_found\", t(\"npm package was not found on the registry\"));\n\t\t\tif (response.status < 200 || response.status >= 300)\n\t\t\t\tthrow new NodeNpmRegistrySourceErrorV1(\"request_failed\", t(\"npm registry request did not succeed\"));\n\t\t\tif (!isJsonResponse(response))\n\t\t\t\tthrow new NodeNpmRegistrySourceErrorV1(\"invalid_response\", t(\"npm registry response must be JSON\"));\n\t\t\tconst versions = parsePackument(await readBody(response, maxResponseBytes, request.signal));\n\t\t\tconst version = selectNpmPackageVersionV1(Object.keys(versions), input.range);\n\t\t\tconst dist = version === undefined ? undefined : versions[version]?.dist;\n\t\t\tif (\n\t\t\t\tversion === undefined ||\n\t\t\t\tdist === undefined ||\n\t\t\t\ttypeof dist.tarball !== \"string\" ||\n\t\t\t\tdist.tarball.length === 0\n\t\t\t) {\n\t\t\t\tthrow new NodeNpmRegistrySourceErrorV1(\n\t\t\t\t\t\"version_not_found\",\n\t\t\t\t\tt(\"No npm package version matches the requested range\"),\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst integrityValue = dist.integrity;\n\t\t\tconst integrity =\n\t\t\t\ttypeof integrityValue === \"string\" && integrityValue.length > 0\n\t\t\t\t\t? sriToIntegrityV1(integrityValue)\n\t\t\t\t\t: undefined;\n\t\t\tif (integrity === undefined)\n\t\t\t\tthrow new NodeNpmRegistrySourceErrorV1(\"invalid_response\", t(\"npm package version has no integrity field\"));\n\t\t\treturn {\n\t\t\t\tversion,\n\t\t\t\ttarballUrl: tarballUrl(dist.tarball).toString(),\n\t\t\t\tintegrity,\n\t\t\t\tdistInfo: dist as Readonly<Record<string, unknown>>,\n\t\t\t};\n\t\t} finally {\n\t\t\tawait response.body?.cancel().catch(() => undefined);\n\t\t\trequest.cleanup();\n\t\t}\n\t};\n\n\tconst fetchTarball = async (input: { readonly url: string; readonly signal?: AbortSignal }): Promise<Uint8Array> => {\n\t\tif (input.signal?.aborted === true)\n\t\t\tthrow new NodeNpmRegistrySourceErrorV1(\"cancelled\", t(\"npm tarball download was cancelled\"));\n\t\tconst endpoint = tarballUrl(input.url);\n\t\tconst authorization: Readonly<Record<string, string>> =\n\t\t\ttoken === undefined ? {} : { authorization: `Bearer ${token}` };\n\t\tconst { response, request } = await fetchFollowingRedirects(endpoint, authorization, input.signal);\n\t\ttry {\n\t\t\tif (response.status < 200 || response.status >= 300)\n\t\t\t\tthrow new NodeNpmRegistrySourceErrorV1(\"request_failed\", t(\"npm tarball download did not succeed\"));\n\t\t\treturn await readBody(response, maxTarballBytes, request.signal);\n\t\t} finally {\n\t\t\tawait response.body?.cancel().catch(() => undefined);\n\t\t\trequest.cleanup();\n\t\t}\n\t};\n\n\treturn { version: 1, registry, resolveNpmPackage, fetchTarball };\n}\n"]}