@guanjinke/artifact-client 1.17.0 → 1.19.0

package/dist/environment/drivers.js

@@ -0,0 +1,274 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DriverDeployWriteError = void 0;
+exports.deployThirdPartyDrivers = deployThirdPartyDrivers;
+const fs = __importStar(require("fs/promises"));
+const path = __importStar(require("path"));
+const fs_1 = require("fs");
+const registry_1 = require("./registry");
+const process_1 = require("./process");
+const posix_process_1 = require("./posix-process");
+const validate_1 = require("./validate");
+class DriverDeployWriteError extends Error {
+    installed;
+    failed;
+    constructor(installed, failed) {
+        super(`Driver deployment incomplete; created: ${installed.join(', ') || '(none)'}; failed or possibly partial: ${failed}. No files were removed.`);
+        this.installed = installed;
+        this.failed = failed;
+        this.name = 'DriverDeployWriteError';
+    }
+}
+exports.DriverDeployWriteError = DriverDeployWriteError;
+const MAX_FILES = 4096, MAX_ENTRIES = 8192, MAX_BYTES = 512 * 1024 * 1024, MAX_DEPTH = 32;
+function validName(name) {
+    return typeof name === 'string' && /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(name) && !/[. ]$/.test(name) && !/^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(name);
+}
+async function statOrMissing(file) {
+    try {
+        return await fs.lstat(file);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    }
+}
+async function noLinks(file) {
+    const absolute = path.resolve(file);
+    const root = path.parse(absolute).root;
+    let current = root;
+    for (const part of absolute.slice(root.length).split(path.sep).filter(Boolean)) {
+        current = path.join(current, part);
+        const stat = await statOrMissing(current);
+        if (!stat)
+            break;
+        if (stat.isSymbolicLink())
+            throw new Error(`Link is not allowed: ${current}.`);
+    }
+}
+async function readBounded(file, expected) {
+    const handle = await fs.open(file, 'r');
+    try {
+        const stat = await handle.stat();
+        if (!stat.isFile() || stat.size !== expected)
+            throw new Error('Driver file changed during inspection.');
+        const buffer = Buffer.alloc(expected + 1);
+        let offset = 0;
+        while (offset < buffer.length) {
+            const { bytesRead } = await handle.read(buffer, offset, buffer.length - offset, offset);
+            if (!bytesRead)
+                break;
+            offset += bytesRead;
+        }
+        if (offset !== expected)
+            throw new Error('Driver file changed during inspection.');
+        return buffer.subarray(0, expected);
+    }
+    finally {
+        await handle.close();
+    }
+}
+/** Install files without replacing existing files. A write failure can leave partial results. */
+async function deployThirdPartyDrivers(options, dependencies = {}) {
+    if (!validName(options.driverId))
+        throw new Error('Invalid driver id.');
+    const driverId = options.driverId.toLowerCase();
+    if (!Array.isArray(options.files) || options.files.length === 0)
+        throw new Error('At least one driver file is required.');
+    for (const file of options.files)
+        if (typeof file !== 'string' || !file || file.includes('\0'))
+            throw new Error('Invalid driver source path.');
+    const registry = dependencies.registry ?? new registry_1.EnvironmentRegistry();
+    const processes = dependencies.processes ?? (process.platform === 'win32' ? new process_1.WindowsProcessBackend() : new posix_process_1.PosixProcessBackend());
+    const original = await registry.get(options.name);
+    return registry.locked(`env-${original.id}`, async () => {
+        const entry = await registry.get(options.name);
+        if (entry.id !== original.id || entry.root !== original.root)
+            throw new Error('Environment changed during operation.');
+        await (0, validate_1.validateEnvironmentOwnership)(entry, registry.directory);
+        const state = await (0, validate_1.observeRuntimeState)(entry, processes);
+        if (state !== 'stopped' && state !== 'ready')
+            throw new Error(`Environment must be stopped; observed state: ${state}.`);
+        const directory = path.join(entry.root, 'DataSourceService', 'third-party-drivers', driverId);
+        await noLinks(directory);
+        const names = new Map();
+        const sources = [];
+        let count = 0;
+        let total = 0;
+        const register = (name, kind) => {
+            if (++count > MAX_ENTRIES)
+                throw new Error('Driver source entry limit exceeded.');
+            const key = name.toLowerCase();
+            const prior = names.get(key);
+            if (prior && (prior.name !== name || prior.kind !== kind || kind === 'file'))
+                throw new Error(`Invalid or duplicate driver filename: ${name}.`);
+            names.set(key, { name, kind });
+        };
+        const visit = async (source, parts) => {
+            if (parts.length > MAX_DEPTH)
+                throw new Error('Driver source depth limit exceeded.');
+            await noLinks(source);
+            const stat = await fs.lstat(source);
+            if (stat.isSymbolicLink())
+                throw new Error('Driver source link is not allowed.');
+            if (stat.isDirectory()) {
+                if (parts.length)
+                    register(parts.join('/'), 'directory');
+                for (const child of (await fs.readdir(source)).sort()) {
+                    if (!validName(child))
+                        throw new Error(`Invalid driver filename: ${child}.`);
+                    await visit(path.join(source, child), [...parts, child]);
+                }
+            }
+            else if (stat.isFile()) {
+                if (!parts.length || !validName(parts[parts.length - 1]))
+                    throw new Error('Invalid driver filename.');
+                register(parts.join('/'), 'file');
+                total += stat.size;
+                if (sources.length >= MAX_FILES || total > MAX_BYTES)
+                    throw new Error('Driver source file count or size limit exceeded.');
+                sources.push({ source, name: parts.join('/'), size: stat.size });
+            }
+            else
+                throw new Error('Driver source must contain only regular files and directories.');
+        };
+        for (const input of options.files) {
+            const source = path.resolve(input);
+            await noLinks(source);
+            const stat = await fs.lstat(source);
+            if (options.preserveSourceDir && (!stat.isDirectory() || options.files.length !== 1 || !validName(path.basename(source))))
+                throw new Error('Preserving source directory requires one safely named directory.');
+            await visit(source, stat.isDirectory() && !options.preserveSourceDir ? [] : [path.basename(source)]);
+        }
+        if (!sources.length)
+            throw new Error('At least one driver file is required.');
+        async function checkTarget(parts, file) {
+            let current = entry.root;
+            const all = ['DataSourceService', 'third-party-drivers', driverId, ...parts];
+            for (const [index, part] of all.entries()) {
+                const parent = await statOrMissing(current);
+                if (!parent)
+                    return;
+                if (!parent.isDirectory() || parent.isSymbolicLink())
+                    throw new Error('Driver destination is not a real directory.');
+                const match = (await fs.readdir(current)).find(name => name.toLowerCase() === part.toLowerCase());
+                if (!match)
+                    return;
+                if (match !== part)
+                    throw new Error(`Driver filename conflicts: ${parts.join('/')}.`);
+                current = path.join(current, match);
+                const stat = await fs.lstat(current);
+                if (stat.isSymbolicLink() || (index < all.length - 1 || !file) && !stat.isDirectory())
+                    throw new Error('Driver destination is not a real directory.');
+            }
+        }
+        await checkTarget([], false);
+        if (options.exclusiveJarSet) {
+            if (sources.some(item => item.name.includes('/') || !/\.jar$/i.test(item.name)))
+                throw new Error('Exclusive driver package must contain only flat JAR files.');
+            const destination = await statOrMissing(directory);
+            if (destination) {
+                for (const existing of await fs.readdir(directory)) {
+                    if (/\.jar$/i.test(existing) && !names.has(existing.toLowerCase()))
+                        throw new Error(`Existing driver JAR conflicts with selected package: ${existing}.`);
+                }
+            }
+        }
+        for (const item of names.values())
+            if (item.kind === 'directory')
+                await checkTarget(item.name.split('/'), false);
+        const plans = [];
+        let actualBytes = 0;
+        for (const item of sources) {
+            const parts = item.name.split('/');
+            await checkTarget(parts, true);
+            await noLinks(item.source);
+            const content = await readBounded(item.source, item.size);
+            actualBytes += content.length;
+            if (content.length !== item.size || actualBytes > MAX_BYTES)
+                throw new Error('Driver source changed or size limit exceeded.');
+            const destination = path.join(directory, ...parts);
+            const target = await statOrMissing(destination);
+            if (target) {
+                if (!target.isFile() || target.isSymbolicLink() || target.size !== content.length || !(await readBounded(destination, content.length)).equals(content))
+                    throw new Error(`Driver file conflicts: ${item.name}.`);
+                plans.push({ name: item.name, content, status: 'unchanged' });
+            }
+            else
+                plans.push({ name: item.name, content, status: 'would-install' });
+        }
+        if (!options.dryRun) {
+            for (const plan of plans.filter(item => item.status === 'unchanged')) {
+                const parts = plan.name.split('/');
+                await checkTarget(parts, true);
+                const destination = path.join(directory, ...parts);
+                const stat = await statOrMissing(destination);
+                if (!stat?.isFile() || stat.isSymbolicLink() || stat.size !== plan.content.length || !(await readBounded(destination, plan.content.length)).equals(plan.content))
+                    throw new Error(`Driver file conflicts: ${plan.name}.`);
+            }
+            const installed = [];
+            for (const plan of plans) {
+                if (plan.status === 'unchanged')
+                    continue;
+                try {
+                    const parts = plan.name.split('/');
+                    for (const dir of [path.join(entry.root, 'DataSourceService'), path.dirname(directory), directory, ...parts.slice(0, -1).map((_, i) => path.join(directory, ...parts.slice(0, i + 1)))]) {
+                        await noLinks(dir);
+                        try {
+                            await fs.mkdir(dir);
+                        }
+                        catch (error) {
+                            if (error.code !== 'EEXIST')
+                                throw error;
+                        }
+                        const stat = await fs.lstat(dir);
+                        if (!stat.isDirectory() || stat.isSymbolicLink())
+                            throw new Error('Driver destination is not a real directory.');
+                    }
+                    await checkTarget(parts, true);
+                    await fs.writeFile(path.join(directory, ...parts), plan.content, { flag: fs_1.constants.O_WRONLY | fs_1.constants.O_CREAT | fs_1.constants.O_EXCL, mode: 0o666 });
+                    installed.push(plan.name);
+                }
+                catch {
+                    throw new DriverDeployWriteError(installed, plan.name);
+                }
+            }
+        }
+        return { name: entry.name, driverId, directory, dryRun: !!options.dryRun, files: plans.map(plan => ({ name: plan.name, status: plan.status === 'would-install' && !options.dryRun ? 'installed' : plan.status })) };
+    });
+}
+//# sourceMappingURL=drivers.js.map

package/dist/environment/drivers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"drivers.js","sourceRoot":"","sources":["../../src/environment/drivers.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyDA,0DAuHC;AAhLD,gDAAkC;AAClC,2CAA6B;AAC7B,2BAA+B;AAC/B,yCAAiD;AACjD,uCAAkE;AAClE,mDAAsD;AACtD,yCAA+E;AAS/E,MAAa,sBAAuB,SAAQ,KAAK;IAC1B;IAA8B;IAAnD,YAAqB,SAAmB,EAAW,MAAc;QAC/D,KAAK,CAAC,0CAA0C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,iCAAiC,MAAM,0BAA0B,CAAC,CAAC;QADhI,cAAS,GAAT,SAAS,CAAU;QAAW,WAAM,GAAN,MAAM,CAAQ;QAE/D,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AALD,wDAKC;AACD,MAAM,SAAS,GAAG,IAAI,EAAE,WAAW,GAAG,IAAI,EAAE,SAAS,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,SAAS,GAAG,EAAE,CAAC;AAC1F,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,+CAA+C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3K,CAAC;AACD,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,IAAI,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAAC,MAAM,KAAK,CAAC;IAAC,CAAC;AAC/I,CAAC;AACD,KAAK,UAAU,OAAO,CAAC,IAAY;IACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IAC5E,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/E,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI;YAAE,MAAM;QACjB,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,GAAG,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,QAAgB;IACvD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACxG,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QAC1C,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YAC9B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC,CAAC;YACxF,IAAI,CAAC,SAAS;gBAAE,MAAM;YACtB,MAAM,IAAI,SAAS,CAAC;QACtB,CAAC;QACD,IAAI,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACnF,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACtC,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AACrC,CAAC;AAED,iGAAiG;AAC1F,KAAK,UAAU,uBAAuB,CAAC,OAA4B,EAAE,eAAyC,EAAE;IACrH,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC1H,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK;QAAE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC/I,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,IAAI,IAAI,8BAAmB,EAAE,CAAC;IACpE,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,+BAAqB,EAAE,CAAC,CAAC,CAAC,IAAI,mCAAmB,EAAE,CAAC,CAAC;IACrI,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,QAAQ,CAAC,MAAM,CAAC,OAAO,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACvH,MAAM,IAAA,uCAA4B,EAAC,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,IAAA,8BAAmB,EAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC1D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,KAAK,GAAG,CAAC,CAAC;QACxH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,QAAQ,CAAC,CAAC;QAC9F,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwD,CAAC;QAC9E,MAAM,OAAO,GAAqD,EAAE,CAAC;QACrE,IAAI,KAAK,GAAG,CAAC,CAAC;QAAC,IAAI,KAAK,GAAG,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,IAA0B,EAAE,EAAE;YAC5D,IAAI,EAAE,KAAK,GAAG,WAAW;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YAClF,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAAC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,GAAG,CAAC,CAAC;YAChJ,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACjC,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,KAAK,EAAE,MAAc,EAAE,KAAe,EAAiB,EAAE;YACrE,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACrF,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;YACtB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,IAAI,CAAC,cAAc,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACjF,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;gBACvB,IAAI,KAAK,CAAC,MAAM;oBAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;gBACzD,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;oBACtD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,GAAG,CAAC,CAAC;oBAC7E,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;iBAAM,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBACzB,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;gBACtG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;gBAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC;gBACtD,IAAI,OAAO,CAAC,MAAM,IAAI,SAAS,IAAI,KAAK,GAAG,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBAC1H,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YACnE,CAAC;;gBAAM,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QAC3F,CAAC,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;YAC1D,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,OAAO,CAAC,iBAAiB,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;YAC/M,MAAM,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAE9E,KAAK,UAAU,WAAW,CAAC,KAAe,EAAE,IAAa;YACvD,IAAI,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;YACzB,MAAM,GAAG,GAAG,CAAC,mBAAmB,EAAE,qBAAqB,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC;YAC7E,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;gBAC1C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;gBAC5C,IAAI,CAAC,MAAM;oBAAE,OAAO;gBACpB,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC,cAAc,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACrH,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;gBAClG,IAAI,CAAC,KAAK;oBAAE,OAAO;gBACnB,IAAI,KAAK,KAAK,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACtF,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACpC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACrC,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACxJ,CAAC;QACH,CAAC;QACD,MAAM,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC7B,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAC/J,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;YACnD,IAAI,WAAW,EAAE,CAAC;gBAChB,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;oBACnD,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,QAAQ,GAAG,CAAC,CAAC;gBAC3J,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE;YAAE,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;gBAAE,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QACjH,MAAM,KAAK,GAA+E,EAAE,CAAC;QAC7F,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAAC,MAAM,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACnE,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3B,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1D,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;YAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,IAAI,WAAW,GAAG,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YAC9H,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;YAChD,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,cAAc,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;gBAChN,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YAChE,CAAC;;gBAAM,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,WAAW,CAAC,EAAE,CAAC;gBACrE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACnC,MAAM,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC;gBACnD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;gBAC9C,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;YAC5N,CAAC;YACD,MAAM,SAAS,GAAa,EAAE,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW;oBAAE,SAAS;gBAC1C,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACnC,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,mBAAmB,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wBACxL,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;wBACnB,IAAI,CAAC;4BAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;wBAAC,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gCAAE,MAAM,KAAK,CAAC;wBAAC,CAAC;wBACnH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;wBACjC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;4BAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;oBACnH,CAAC;oBACD,MAAM,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;oBAC/B,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,cAAS,CAAC,QAAQ,GAAG,cAAS,CAAC,OAAO,GAAG,cAAS,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;oBACnJ,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC5B,CAAC;gBAAC,MAAM,CAAC;oBAAC,MAAM,IAAI,sBAAsB,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;YACrE,CAAC;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,eAAe,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC;IACtN,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/environment/hana-archive.d.ts

@@ -0,0 +1,9 @@
+export interface TrustedTgzLimits {
+    maxCompressedBytes?: number;
+    maxExpandedBytes?: number;
+    maxFileBytes?: number;
+    maxEntries?: number;
+}
+/** Read a hash-pinned TGZ, returning only explicitly selected regular files. Never writes extracted data. */
+export declare function extractTrustedTgz(archive: string, expectedSha256: string, selected: string[], limits?: TrustedTgzLimits): Promise<Map<string, Buffer>>;
+//# sourceMappingURL=hana-archive.d.ts.map

package/dist/environment/hana-archive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hana-archive.d.ts","sourceRoot":"","sources":["../../src/environment/hana-archive.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,gBAAgB;IAAG,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE;AAaxI,6GAA6G;AAC7G,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,MAAM,GAAE,gBAAqB,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAgFhK"}

package/dist/environment/hana-archive.js

@@ -0,0 +1,181 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractTrustedTgz = extractTrustedTgz;
+const fs = __importStar(require("fs/promises"));
+const crypto_1 = require("crypto");
+const stream_1 = require("stream");
+const zlib_1 = require("zlib");
+function tarNumber(field) {
+    const value = field.toString('ascii').replace(/\0.*$/, '').trim();
+    if (!/^[0-7]+$/.test(value))
+        throw new Error('Invalid TAR numeric field.');
+    const number = parseInt(value, 8);
+    if (!Number.isSafeInteger(number))
+        throw new Error('TAR numeric field too large.');
+    return number;
+}
+function safePath(value) {
+    return !!value && !value.startsWith('/') && !/[\\:\x00-\x1f\x7f]/.test(value) && value.split('/').every(part => !!part && part !== '.' && part !== '..');
+}
+/** Read a hash-pinned TGZ, returning only explicitly selected regular files. Never writes extracted data. */
+async function extractTrustedTgz(archive, expectedSha256, selected, limits = {}) {
+    if (!/^[a-f0-9]{64}$/.test(expectedSha256))
+        throw new Error('Invalid expected SHA256.');
+    if (!selected.length || new Set(selected).size !== selected.length || selected.some(name => !safePath(name)))
+        throw new Error('Invalid TAR selection.');
+    const compressedLimit = limits.maxCompressedBytes ?? 64 * 1024 * 1024;
+    const expandedLimit = limits.maxExpandedBytes ?? 128 * 1024 * 1024;
+    const fileLimit = limits.maxFileBytes ?? 32 * 1024 * 1024;
+    const entryLimit = limits.maxEntries ?? 1024;
+    if (![compressedLimit, expandedLimit, fileLimit, entryLimit].every(n => Number.isSafeInteger(n) && n > 0))
+        throw new Error('Invalid TAR limits.');
+    const link = await fs.lstat(archive);
+    if (!link.isFile() || link.isSymbolicLink() || link.size <= 0 || link.size > compressedLimit)
+        throw new Error('Invalid TGZ file or size.');
+    const handle = await fs.open(archive, 'r');
+    let compressed;
+    try {
+        const stat = await handle.stat();
+        if (!stat.isFile() || stat.size !== link.size)
+            throw new Error('TGZ changed during inspection.');
+        compressed = Buffer.alloc(stat.size);
+        let offset = 0;
+        while (offset < compressed.length) {
+            const { bytesRead } = await handle.read(compressed, offset, compressed.length - offset, offset);
+            if (!bytesRead)
+                throw new Error('TGZ changed during inspection.');
+            offset += bytesRead;
+        }
+        const after = await handle.stat();
+        if (after.size !== stat.size || after.mtimeMs !== stat.mtimeMs || after.ctimeMs !== stat.ctimeMs)
+            throw new Error('TGZ changed during inspection.');
+    }
+    finally {
+        await handle.close();
+    }
+    if ((0, crypto_1.createHash)('sha256').update(compressed).digest('hex') !== expectedSha256)
+        throw new Error('TGZ SHA256 mismatch.');
+    const output = new Map();
+    const seen = new Set();
+    let pending = Buffer.alloc(0), remaining = 0, padding = 0, expanded = 0, entries = 0, ended = false, zeroBlocks = 0;
+    let current;
+    let pieces = [];
+    const stream = stream_1.Readable.from([compressed]).pipe((0, zlib_1.createGunzip)());
+    for await (const input of stream) {
+        const chunk = input;
+        expanded += chunk.length;
+        if (expanded > expandedLimit)
+            throw new Error('TGZ expanded size limit exceeded.');
+        pending = Buffer.concat([pending, chunk]);
+        while (true) {
+            if (ended) {
+                if (pending.some(byte => byte !== 0))
+                    throw new Error('Unexpected data after TAR end.');
+                pending = Buffer.alloc(0);
+                break;
+            }
+            if (remaining) {
+                if (!pending.length)
+                    break;
+                const take = Math.min(remaining, pending.length);
+                if (current)
+                    pieces.push(Buffer.from(pending.subarray(0, take)));
+                pending = pending.subarray(take);
+                remaining -= take;
+                if (remaining)
+                    break;
+                if (current) {
+                    output.set(current, Buffer.concat(pieces));
+                    current = undefined;
+                    pieces = [];
+                }
+            }
+            if (padding) {
+                if (pending.length < padding)
+                    break;
+                if (pending.subarray(0, padding).some(byte => byte !== 0))
+                    throw new Error('Invalid TAR padding.');
+                pending = pending.subarray(padding);
+                padding = 0;
+            }
+            if (pending.length < 512)
+                break;
+            const header = pending.subarray(0, 512);
+            pending = pending.subarray(512);
+            if (header.every(byte => byte === 0)) {
+                if (++zeroBlocks === 2)
+                    ended = true;
+                continue;
+            }
+            if (zeroBlocks)
+                throw new Error('Invalid TAR end marker.');
+            if (++entries > entryLimit)
+                throw new Error('TAR entry limit exceeded.');
+            const recorded = tarNumber(header.subarray(148, 156));
+            let sum = 0;
+            for (let i = 0; i < 512; i++)
+                sum += i >= 148 && i < 156 ? 32 : header[i];
+            if (sum !== recorded)
+                throw new Error('Invalid TAR header checksum.');
+            const text = (start, length) => header.subarray(start, start + length).toString('utf8').replace(/\0.*$/, '');
+            const prefix = text(345, 155), name = (prefix ? prefix + '/' : '') + text(0, 100);
+            if (!safePath(name))
+                throw new Error('Unsafe TAR path.');
+            const key = name.toLowerCase();
+            if (seen.has(key))
+                throw new Error('Duplicate TAR entry.');
+            seen.add(key);
+            const type = header[156];
+            if (type !== 0 && type !== 48)
+                throw new Error('TAR links and non-regular entries are forbidden.');
+            const size = tarNumber(header.subarray(124, 136));
+            if (size > fileLimit)
+                throw new Error('TAR file size limit exceeded.');
+            remaining = size;
+            padding = (512 - size % 512) % 512;
+            if (selected.includes(name)) {
+                if (!size)
+                    output.set(name, Buffer.alloc(0));
+                else
+                    current = name;
+            }
+        }
+    }
+    if (!ended || remaining || padding || pending.length || output.size !== selected.length)
+        throw new Error('Incomplete TAR or selected file missing.');
+    return output;
+}
+//# sourceMappingURL=hana-archive.js.map

package/dist/environment/hana-archive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hana-archive.js","sourceRoot":"","sources":["../../src/environment/hana-archive.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmBA,8CAgFC;AAnGD,gDAAkC;AAClC,mCAAoC;AACpC,mCAAkC;AAClC,+BAAoC;AAIpC,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC;AAChB,CAAC;AACD,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC;AAC3J,CAAC;AAED,6GAA6G;AACtG,KAAK,UAAU,iBAAiB,CAAC,OAAe,EAAE,cAAsB,EAAE,QAAkB,EAAE,SAA2B,EAAE;IAChI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACxF,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACxJ,MAAM,eAAe,GAAG,MAAM,CAAC,kBAAkB,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IACtE,MAAM,aAAa,GAAG,MAAM,CAAC,gBAAgB,IAAI,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;IACnE,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC;IAC7C,IAAI,CAAC,CAAC,eAAe,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAClJ,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC3I,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACjG,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;YAClC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC,CAAC;YAChG,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAClE,MAAM,IAAI,SAAS,CAAC;QACtB,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACtJ,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IACnC,IAAI,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACtH,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IAAC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IACzE,IAAI,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,QAAQ,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,EAAE,UAAU,GAAG,CAAC,CAAC;IACpH,IAAI,OAA2B,CAAC;IAAC,IAAI,MAAM,GAAa,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,iBAAQ,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAA,mBAAY,GAAE,CAAC,CAAC;IAChE,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,KAAe,CAAC;QAC9B,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC;QACzB,IAAI,QAAQ,GAAG,aAAa;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnF,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1C,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;gBACxF,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAAC,MAAM;YACnC,CAAC;YACD,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC,OAAO,CAAC,MAAM;oBAAE,MAAM;gBAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBACjD,IAAI,OAAO;oBAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;gBACjE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAAC,SAAS,IAAI,IAAI,CAAC;gBACpD,IAAI,SAAS;oBAAE,MAAM;gBACrB,IAAI,OAAO,EAAE,CAAC;oBAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;oBAAC,OAAO,GAAG,SAAS,CAAC;oBAAC,MAAM,GAAG,EAAE,CAAC;gBAAC,CAAC;YAChG,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,OAAO,CAAC,MAAM,GAAG,OAAO;oBAAE,MAAM;gBACpC,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBACnG,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAAC,OAAO,GAAG,CAAC,CAAC;YACnD,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG;gBAAE,MAAM;YAChC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAAC,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACzE,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;gBAAC,IAAI,EAAE,UAAU,KAAK,CAAC;oBAAE,KAAK,GAAG,IAAI,CAAC;gBAAC,SAAS;YAAC,CAAC;YACzF,IAAI,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC3D,IAAI,EAAE,OAAO,GAAG,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;YACzE,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YACtD,IAAI,GAAG,GAAG,CAAC,CAAC;YAAC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE;gBAAE,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvF,IAAI,GAAG,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACtE,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,MAAc,EAAU,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACrI,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAClF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACzD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC3D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACnG,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YAClD,IAAI,IAAI,GAAG,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACvE,SAAS,GAAG,IAAI,CAAC;YAAC,OAAO,GAAG,CAAC,GAAG,GAAG,IAAI,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;YACrD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI;oBAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;;oBACxC,OAAO,GAAG,IAAI,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,SAAS,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACrJ,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/environment/hana.d.ts

@@ -0,0 +1,58 @@
+import { EnvironmentRegistry } from './registry';
+import { ProcessBackend } from './process';
+/** Fingerprint of the locally verified SAP HANA Client 2.10.15 Windows x64 DOTNETCORE.TGZ. */
+export declare const VERIFIED_HANA_WINDOWS_SHA256 = "95b7b6f1dbe9f4b0367b92189e3d819a9786c178555ea2e8b6246cac01850d7b";
+export interface HanaPackageReport {
+    archive: string;
+    sha256: string;
+    platform: 'win32';
+    architecture: 'x64';
+    version: '2.10.15' | null;
+    verified: boolean;
+    action: 'inspection-only';
+}
+/** Inspect a known Windows package without extracting, deploying, or changing environment variables. */
+export declare function inspectWindowsHanaPackage(archive?: string): Promise<HanaPackageReport>;
+export declare class HanaPrepareWriteError extends Error {
+    readonly created: string[];
+    readonly failed: string;
+    constructor(created: string[], failed: string);
+}
+export interface HanaPrepareDependencies {
+    registry?: EnvironmentRegistry;
+    processes?: ProcessBackend;
+}
+export interface HanaDeployDependencies extends HanaPrepareDependencies {
+    platform?: NodeJS.Platform;
+    arch?: string;
+}
+/** Prepare the pinned pair only; does not configure or install a Wyn provider. */
+export declare function prepareWindowsHana(name: string, archive?: string, dependencies?: HanaPrepareDependencies): Promise<{
+    name: string;
+    directory: string;
+    files: string[];
+    status: "prepared";
+    configured: boolean;
+    installed: boolean;
+    loadability: "unverified";
+}>;
+export declare class HanaDeployWriteError extends Error {
+    readonly created: string[];
+    readonly failed: string;
+    constructor(created: string[], failed: string);
+}
+/**
+ * Deploy the pinned managed and native files to the two Windows locations used by Wyn.
+ * The deployed files are not a complete installation: the provider stays unconfigured, plugin
+ * precedence and the native search path are not verified here, and a restart is required.
+ */
+export declare function deployWindowsHana(name: string, archive?: string, dependencies?: HanaDeployDependencies): Promise<{
+    name: string;
+    files: string[];
+    status: "deployed";
+    configured: boolean;
+    installed: boolean;
+    loadability: "unverified";
+    restartRequired: true;
+}>;
+//# sourceMappingURL=hana.d.ts.map

package/dist/environment/hana.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hana.d.ts","sourceRoot":"","sources":["../../src/environment/hana.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,cAAc,EAAyB,MAAM,WAAW,CAAC;AAGlE,8FAA8F;AAC9F,eAAO,MAAM,4BAA4B,qEAAqE,CAAC;AAG/G,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,EAAE,KAAK,CAAC;IACpB,OAAO,EAAE,SAAS,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,iBAAiB,CAAC;CAC3B;AAED,wGAAwG;AACxG,wBAAsB,yBAAyB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA0B5F;AAGD,qBAAa,qBAAsB,SAAQ,KAAK;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAA1C,OAAO,EAAE,MAAM,EAAE,EAAW,MAAM,EAAE,MAAM;CAIhE;AACD,MAAM,WAAW,uBAAuB;IAAG,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAAC,SAAS,CAAC,EAAE,cAAc,CAAA;CAAE;AACvG,MAAM,WAAW,sBAAuB,SAAQ,uBAAuB;IAAG,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE;AAyBrH,kFAAkF;AAClF,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,YAAY,GAAE,uBAA4B;;;;;;;;GAgClH;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAA1C,OAAO,EAAE,MAAM,EAAE,EAAW,MAAM,EAAE,MAAM;CAIhE;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,YAAY,GAAE,sBAA2B;;;;;;;;GAuChH"}